YaPI::LdapServer
This package is the public Yast2 API to managing a LDAP Server.
use YaPI::LdapServer
\@dbList = ReadDatabaseList()
Returns a List of databases (suffix).
$bool = AddDatabase(\%valueMap)
Creates a new database section in the configuration file
$bool = EditDatabase($suffix,\%valueMap)
Edit the database section with the suffix $suffix.
\%valueMap = ReadDatabase($suffix)
Read the database section with the suffix $suffix.
\@indexList = ReadIndex($suffix)
Returns a List of Maps with all index statements for this database
$bool = AddIndex($suffix,\%indexMap)
Add a new index statement %indexMap to the database section
$bool = EditIndex($suffix,$index_md5,\%indexMap)
Replace the index $index_md5 in the database section
$bool = DeleteIndex($suffix,$index_md5)
Delete the index $index_md5 statement in the database section
$bool = RecreateIndex($suffix)
Regenerate indices
\@list = ReadSchemaIncludeList()
Returns a list of all included schema files
$bool = WriteSchemaIncludeList(\@list)
Writes all schema includes preserving order.
\@list = ReadAllowList()
Returns a list of allow statements.
$bool = WriteAllowList(\@list)
Replaces the complete allow option with the specified list
$loglevel = ReadLoglevel()
Read the loglevel bitmask.
$bool = AddLoglevel($bit)
Set the given loglevel bit to 1 in the current bitmask.
$bool = DeleteLoglevel($bit)
Set the given loglevel bit to 0 in the current bitmask.
$bool = WriteLoglevel($loglevel)
Replaces the loglevel bitmask.
Turn on/of the LDAP server runnlevel script
Start/Stop the LDAP server
$status = ReadService()
Read out the state of the LDAP server runlevel script
\%valueMap = ReadTLS()
Return the current TLS settings
$bool = WriteTLS(\%valueMap)
Write the TLS options in the configuration file.
$bool = CheckCommonServerCertificate()
Check, if a common server certificate is available.
$bool = ConfigureCommonServerCertificate()
Configure the LDAP server to use the common server certificate.
$bool = ImportCertificates(\%valueMap)
Import certificates and configure TLS for the LDAP Server.
$bool = ReadSLPEnabled()
Read if SLP is enabled in /etc/sysconfig/openldap
$bool = WriteSLPEnabled($bool)
Activate/Deactivate SLP Registering in /etc/sysconfig/openldap
\@dbList = ReadDatabaseList()
Returns a List of databases (suffix).
EXAMPLE:
use Data::Dumper;
my $res = YaPI::LdapServer->ReadDatabaseList(); if( not defined $res ) { # error } else { print "OK: \n"; print STDERR Data::Dumper->Dump([$res])."\n"; }
$bool = AddDatabase(\%valueMap)
Creates a new database section in the configuration file, start or restart the LDAP Server and add the base object. If the database exists, nothing is done and undef is returned.
Supported keys in %valueMap are:
* database: The database type (required)
* suffix: The suffix (required)
* directory: The Directory where the database files are(bdb/ldbm) (required)
* createdatabasedir: If true the directory for the database will be created (optional; default false)
* rootdn: The Root DN * passwd: The plain Root Password (requires rootdn)
* cryptmethod: The crypt method; allowed values are (CRYPT, SMD5, SHA, SSHA, PLAIN); default is 'SSHA' * cachesize: The cachesize(bdb/ldbm) (optional; default 10000) * checkpoint: The checkpoint(bdb) (optional; default 1024 5)
If no rootdn and passwd is set, the base object is not added to the LDAP server.
EXAMPLE:
my $hash = { database => 'bdb', suffix => 'dc=example,dc=com', rootdn => "cn=Admin,dc=example,dc=com", passwd => "system", cryptmethod => 'SMD5', directory => "/var/lib/ldap/db1", };
my $res = YaPI::LdapServer->AddDatabase($hash); if( not defined $res ) { # error } else { print "OK: \n"; }
$bool = EditDatabase($suffix,\%valueMap)
Edit the database section with the suffix $suffix in the configuration file. Only save parameter are supported.
You have to restart the LDAP Server with YaPI::LdapServer->SwitchService(1)
to activate these changes.
Supported keys in %valueMap are:
* rootdn: The Root DN
* passwd: The Root Password
* cryptmethod: The crypt method; allowed values are (CRYPT, SMD5, SHA, SSHA, PLAIN); default is 'SSHA'
* cachesize: The cachesize(bdb/ldbm) * checkpoint: The checkpoint(bdb)
If the key is defined, but the value is 'undef' the option will be deleted. If a key is not defined, the option is not changed. If the key is defined and a value is specified, this value will be set.
cryptmethod can not be deleted. It will be deleted if you delete passwd.
If you delete rootdn, passwd is also deleted.
EXAMPLE:
my $hash = { suffix => "dc=example,dc=com", rootdn => "cn=Administrator,dc=example,dc=com", rootpw => "example", cryptmethod => "CRYPT" };
my $res = YaPI::LdapServer->EditDatabase($hash); if( not defined $res ) { # error } else { print "OK: \n"; }
\%valueMap = ReadDatabase($suffix)
Read the database section with the suffix $suffix.
Returned keys in %valueMap are:
* database: The database type
* suffix: The suffix
* rootdn: The Root DN
* passwd: The Root Password
* directory: The Directory where the database files are(bdb/ldbm)
* cachesize: The cachesize(bdb/ldbm)
* checkpoint: The checkpoint(bdb)
There can be some more, if they are in this databse section.
EXAMPLE:
use Data::Dumper;
my $res = YaPI::LdapServer->ReadDatabase('"dc=example,dc=com"'); if( not defined $res ) { # error } else { print "OK: \n"; print STDERR Data::Dumper->Dump([$res])."\n"; }
\@indexList = ReadIndex($suffix)
Returns a List of Maps with all index statements for this database. The ``keys'' are:
* 'attr', an attribute or an attribute list
* 'param', a number of special index parameters
* 'md5', a MD5 sum of this index. This numer is needed for EditIndex and DeleteIndex
EXAMPLE:
use Data::Dumper;
my $res = YaPI::LdapServer->ReadIndex('"dc=example,dc=com"'); if( not defined $res ) { # error } else { print "OK: \n"; print STDERR Data::Dumper->Dump([$res])."\n"; }
$bool = AddIndex($suffix,\%indexMap)
Add a new index statement %indexMap to the database section $suffix.
The indexMap has two keys
* 'attr', an attribute or an attribute list
* 'param', a number of special index parameters
EXAMPLE:
my $newIndex = { 'attr' => "uid,cn", 'param' => "eq" };
my $res = YaPI::LdapServer->AddIndex("dc=example,dc=com", $newIndex); if( not defined $res ) { # error } else { print "OK: \n"; }
$bool = EditIndex($suffix,$index_md5,\%indexMap)
Replace the index $index_md5 in the database section $suffix by the new index statement %indexMap.
The indexMap has two keys
* 'attr', an attribute or an attribute list
* 'param', a number of special index parameters
EXAMPLE:
my $newIndex = { 'attr' => "uid,cn", 'param' => "eq" };
my $res = YaPI::LdapServer->EditIndex("dc=example,dc=com", "eacc11456b6c2ae4e1aef0fa287e02b0", $newIndex); if( not defined $res ) { # error } else { print "OK: \n"; }
$bool = DeleteIndex($suffix,$index_md5)
Delete the index $index_md5 statement in the database section $suffix.
EXAMPLE:
my $res = YaPI::LdapServer->DeleteIndex("dc=example,dc=com", "338a980b4eebe87365a4077067ce1559"); if( not defined $res ) { # error } else { print "OK: \n"; }
$bool = RecreateIndex($suffix)
Regenerate indices based upon the current contents of a database determined by $suffix. This function stops the ldapserver, call slapindex and start the ldapserver again.
EXAMPLE:
my $res = YaPI::LdapServer->RecreateIndex("dc=example,dc=com"); if( not defined $res ) { # error } else { print "OK: \n"; }
\@list = ReadSchemaIncludeList()
Returns a list of all included schema files in the order they appear in the config files.
EXAMPLE:
use Data::Dumper;
my $res = YaPI::LdapServer->ReadSchemaIncludeList(); if( not defined $res ) { # error } else { print "OK: \n"; print STDERR Data::Dumper->Dump([$res])."\n"; }
$bool = WriteSchemaIncludeList(\@list)
Writes all schema includes preserving order.
You have to restart the LDAP Server with YaPI::LdapServer->SwitchService(1)
to activate these changes.
EXAMPLE:
my $schemas = [ '/etc/openldap/schema/core.schema', '/etc/openldap/schema/cosine.schema', '/etc/openldap/schema/inetorgperson.schema', '/etc/openldap/schema/rfc2307bis.schema', '/etc/openldap/schema/yast2userconfig.schema', '/etc/openldap/schema/samba3.schema' ];
my $res = YaPI::LdapServer->WriteSchemaIncludeList($schemas); if( not defined $res ) { # error } else { print "OK: \n"; }
\@list = ReadAllowList()
Returns a list of allow statements.
EXAMPLE:
use Data::Dumper;
my $res = YaPI::LdapServer->ReadAllowList(); if( not defined $res ) { # error } else { print "OK: \n"; print STDERR Data::Dumper->Dump([$res])."\n"; }
$bool = WriteAllowList(\@list)
Replaces the complete allow option with the specified feature list.
You have to restart the LDAP Server with YaPI::LdapServer->SwitchService(1)
to activate these changes.
EXAMPLE:
my @list = ( "bind_v2" );
$res = YaPI::LdapServer->WriteAllowList( \@list ); if( not defined $res ) { # error } else { print "OK: \n"; }
$loglevel = ReadLoglevel()
Read the loglevel bitmask.
EXAMPLE:
my $res = YaPI::LdapServer->ReadLoglevel(); if( not defined $res ) {
} else { print "OK: \n"; print STDERR Data::Dumper->Dump([$res])."\n"; }
$bool = AddLoglevel($bit)
Set the given loglevel bit to 1 in the current bitmask.
You have to restart the LDAP Server with YaPI::LdapServer->SwitchService(1)
to activate these changes.
EXAMPLE:
my $res = YaPI::LdapServer->AddLoglevel( 0x04 ); if( not defined $res ) { # error } else { print "OK: \n"; }
$bool = DeleteLoglevel($bit)
Set the given loglevel bit to 0 in the current bitmask.
You have to restart the LDAP Server with YaPI::LdapServer->SwitchService(1)
to activate these changes.
EXAMPLE:
my $res = YaPI::LdapServer->DeleteLoglevel( 0x04 ); if( not defined $res ) {
} else { print "OK: \n"; }
$bool = WriteLoglevel($loglevel)
Replaces the loglevel bitmask.
You have to restart the LDAP Server with YaPI::LdapServer->SwitchService(1)
to activate these changes.
EXAMPLE:
my $res = YaPI::LdapServer->WriteLoglevel( 0x06 ); if( not defined $res ) {
} else { print "OK: \n"; }
ModifyService($status)
with this function you can turn on and off the LDAP server runlevel script. Turning off means, no LDAP server start at boot time.
EXAMPLE
ModifyService(0); # turn LDAP server off at boot time ModifyService(1); # turn LDAP server on at boot time
SwitchService($status)
with this function you can start and stop the LDAP server service.
EXAMPLE
SwitchService( 0 ); # turning off the LDAP server service SwitchService( 1 ); # turning on the LDAP server service
$status = ReadService()
with this function you can read out the state of the LDAP server runlevel script (starting LDAP server at boot time).
EXAMPLE
print "LDAP is ".( (ReadService())?('on'):('off') )."\n";
\%valueMap = ReadTLS()
Return the current TLS settings
Supported keys in %valueMap are:
* TLSCipherSuite: cipher suite parameter
* TLSCACertificateFile: Specifies the file that contains certificates for all of the Certificate Authorities that slapd will recognize.
* TLSCACertificatePath: Specifies the path of a directory that contains Certificate Authority certificates in separate individual files. Usually only one of this or the TLSCACertificateFile is used.
* TLSCertificateFile: Specifies the file that contains the slapd server certificate.
* TLSCertificateKeyFile: Specifies the file that contains the slapd server private key.
* TLSVerifyClient: Specifies what checks to perform on client certificates in an incoming TLS session.
EXAMPLE:
use Data::Dumper;
my $res = YaPI::LdapServer->ReadTLS(); if( not defined $res ) { # error } else { print "OK: \n"; print STDERR Data::Dumper->Dump([$res])."\n"; }
$bool = WriteTLS(\%valueMap)
Edit the TLS options in the configuration file.
You have to restart the LDAP Server with YaPI::LdapServer->SwitchService(1)
to activate these changes.
Supported keys in %valueMap are:
* TLSCipherSuite: cipher suite parameter
* TLSCACertificateFile: Specifies the file that contains certificates for all of the Certificate Authorities that slapd will recognize.
* TLSCACertificatePath: Specifies the path of a directory that contains Certificate Authority certificates in separate individual files. Usually only one of this or the TLSCACertificateFile is used.
* TLSCertificateFile: Specifies the file that contains the slapd server certificate.
* TLSCertificateKeyFile: Specifies the file that contains the slapd server private key.
* TLSVerifyClient: Specifies what checks to perform on client certificates in an incoming TLS session.
If the key is defined, but the value is 'undef' the option will be deleted. If a key is not defined, the option is not changed. If the key is defined and a value is specified, this value will be set.
EXAMPLE:
my $hash = { TLSCipherSuite => "HIGH:MEDIUM:+SSLv2", TLSCertificateFile => "/etc/ssl/server_crt.pem", TLSCertificateKeyFile => "/etc/ssl/server_key.pem", TLSCACertificateFile => "/etc/ssl/ca.pem", TLSVerifyClient => "never" };
my $res = YaPI::LdapServer->WriteTLS($hash); if( not defined $res ) { # error } else { print "OK: \n"; }
$bool = CheckCommonServerCertificate()
Check, if a server certificate is available which can be used for more then one service. Such common certificate is saved at '/etc/ssl/servercerts/servercert.pem'.
This function returns 'true' if such a certificate is available and 'false' if not.
EXAMPLE:
my $res = YaPI::LdapServer->CheckCommonServerCertificate(); if( not defined $res ) { # error } else { print "Available \n" if($res); print "Not Avalable \n" if(!res); }
$bool = ConfigureCommonServerCertificate()
Configure the LDAP server to use the common server certificate.
At first this function try to set read permissions for user ldap on the common private key via filesystem acls. After that it modifies the slapd.conf and add/edit the TLS pararamter.
You have to restart the LDAP Server with YaPI::LdapServer->SwitchService(1)
to activate these changes.
EXAMPLE:
my $res = YaPI::LdapServer->ConfigureCommonServerCertificate(); if( not defined $res ) { # error } else { print "OK: \n"; }
$bool = ImportCertificates(\%valueMap)
Import certificates and configure TLS for the LDAP Server.
The following Keys are possible in %valueMap:
* ServerCertificateFile (required)
* ServerKeyFile (required)
* CACertificatesFile (optional)
The file format must be PEM.
Alternative you can send the PEM data direct via:
* ServerCertificateData (required)
* ServerKeyData (required)
* CACertificatesData (optional)
The return value is 'true' on success and 'undef' on an error.
EXAMPLE:
my $hash = { ServerCertificateFile => '/path/to/the/certificate.pem', ServerKeyFile => '/path/to/the/key.pem', CACertificatesFile => '/path/to/the/CAcertificate.pem', }
my $res = YaPI::LdapServer->ImportCertificates($hash); if( not defined $res ) { # error } else { print "OK: \n"; }
$bool = ReadSLPEnabled()
This function reads the OPENLDAP_REGISTER_SLP entry in /etc/sysconfig/openldap. It returns 'true' if it reads 'yes' and 'false' if it reads 'no'.
EXAMPLE
print "SLP registering is ".( (ReadSLPEnabled())?('activated'):('deactivated') )."\n";
$bool = WriteSLPEnabled( $bool )
This function sets OPENLDAP_REGISTER_SLP in /etc/sysconfig/openldap. The entry is set to 'yes' if the argument is true or 'no' if the argument is false.
The return value is true on success, undef on error.
EXAMPLE
WriteSLPEnabled( 1 );