Skip to content

Commit 97da7fa

Browse files
trevor-vaughantrevor-vaughan
authored
(SIMP-10188) 389-DS Account Management (#433)
* (SIMP-10188) 389-DS Account Management Added information on managing accounts in 389-DS SIMP-10188 #close SIMP-10189 #close * CR updates
1 parent cbed074 commit 97da7fa

File tree

7 files changed

+296
-12
lines changed

7 files changed

+296
-12
lines changed

‎CHANGELOG

+3
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
* Wed Jun 30 2021 Trevor Vaughan <tvaughan@onyxpoint.com>
2+
- Add 389-DS documentation
3+
14
* Wed Jun 02 2021 Trevor Vaughan <tvaughan@onyxpoint.com>
25
- Remove simp_bolt-related documentation
36

‎docs/changelogs/latest.rst

+1-1
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,7 @@ additional problems, please `submit an issue`_ to let use know.
170170
:depth: 2
171171
:local:
172172

173-
.. _changelog-6.5.0-el8-client-limitations:
173+
.. _changelog-6.6.0-el8-client-limitations:
174174

175175
Special considerations with EL8 clients
176176
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

‎docs/user_guide/User_Management/LDAP.rst

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ server. Client system configurations have been tested to support either system
1515
as a LDAP server.
1616

1717
.. toctree::
18-
:maxdepth: 2
18+
:maxdepth: 1
1919

2020
389-DS <LDAP/389_DS>
2121
OpenLDAP <LDAP/OpenLDAP>

‎docs/user_guide/User_Management/LDAP/389_DS.rst

+1
Original file line numberDiff line numberDiff line change
@@ -7,5 +7,6 @@ This section provides information on managing accounts in a SIMP-configured
77
.. toctree::
88
:maxdepth: 2
99

10+
389-DS Cheat Sheet <389_DS/cheat_sheet>
1011
389-DS User Management <389_DS/manage_users>
1112
389-DS Group Management <389_DS/manage_groups>

‎docs/user_guide/User_Management/LDAP/389_DS/cheat_sheet.rst

+112
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
.. _ug-user_management-ldap-389_ds-cheat_sheet:
2+
3+
The following provides base information for working with SIMP-managed
4+
:term:`389-DS` systems.
5+
6+
For more information about getting started with 389-DS, see the
7+
`389-DS Quickstart`_
8+
9+
File Locations
10+
==============
11+
12+
* ``/etc/dirsrv``
13+
14+
* The default location for directory services
15+
16+
* ``/usr/share/puppet_ds389_config``
17+
18+
* Information used to bootstrap the 389-DS instances. May, or may not, be
19+
relevant once the system is fully operational.
20+
21+
ds* Commands
22+
============
23+
24+
389-DS uses a collection of commands for managing instances.
25+
26+
Some of the more useful are listed below.
27+
28+
.. NOTE::
29+
30+
It is important to know that the SIMP-managed 389-DS instances use an
31+
account-to-DN mapping for the ``root`` user that automatically maps ``root``
32+
to the administrative DN for the instance if you are using LDAPI.
33+
34+
This makes the administration process much easier for daily activities and is
35+
recommended unless you need to manage the system remotely.
36+
37+
dsctl - Directory Server Control
38+
--------------------------------
39+
40+
* ``dsctl -l``
41+
42+
* List all instances on the system (ignore the ``slapd-`` prefix when
43+
referencing them in other commands).
44+
45+
* ``dsctl [instance_name] <start|stop|restart|status>``
46+
47+
* The easiest manner to manage the running state of your instances.
48+
49+
* ``dsctl [instance_name] healthcheck``
50+
51+
* Check the instance for common issues
52+
53+
dsconf - Directory Server Configuration
54+
---------------------------------------
55+
56+
* ``dsconf [instance_name] config get``
57+
58+
* Print the main configuration of the specified instance.
59+
60+
* ``dsconf [instance_name] security get``
61+
62+
* Print the security configuration of the specified instance.
63+
64+
* ``dsconf [instance_name] pwpolicy get``
65+
66+
* Print the **global** password policy for the instance.
67+
68+
* ``dsconf [instance_name] localpwp list``
69+
70+
* Print all known local password policies in the instance.
71+
72+
* ``dsconf [instance_name] localpwp get [DN]``
73+
74+
* Print the details of the local password policy specified by ``[DN]`` (This
75+
is one of the items output by ``localpwp list``).
76+
* Note that local password policies are overrides to individual global
77+
password policy entries.
78+
79+
dsidm - Directory Server Identity Management
80+
--------------------------------------------
81+
82+
The ``dsidm`` command provides account management capabilities and the usage is
83+
covered in detail in the account management sections.
84+
85+
To make using ``dsidm`` easier, you may want to add something like the following
86+
to ``~/.dsrc``:
87+
88+
.. code-block:: ini
89+
90+
[<instance_name>]
91+
uri = ldapi://%%2fvar%%2frun%%2fslapd-<instance_name>.socket
92+
basedn = <base DN>
93+
94+
For a more concrete example, we will use the ``accounts`` instance provided by
95+
the ``simp/simp_ds389`` module.
96+
97+
To find your base DN, you can run the following:
98+
99+
.. code-block:: shell
100+
101+
dsidm accounts account list | head -1
102+
103+
Assuming that our base DN is ``dc=local,dc=com``, our configuration file would
104+
look like the following:
105+
106+
.. code-block:: ini
107+
108+
[accounts]
109+
uri = ldapi://%%2fvar%%2frun%%2fslapd-accounts.socket
110+
basedn = dc=local,dc=com
111+
112+
.. _389-DS Quickstart: https://directory.fedoraproject.org/docs/389ds/howto/quickstart.html

‎docs/user_guide/User_Management/LDAP/389_DS/manage_groups.rst

+79-5
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,85 @@
11
.. _ug-user_management-ldap-389_ds-manage_groups:
22

3+
Group Management in 389-DS
4+
=========================
5+
6+
List 389-DS Groups
7+
------------------
8+
9+
You can list all groups in the default SIMP :term:`389-DS` instance by running:
10+
11+
.. code-block:: shell
12+
13+
dsidm accounts group list
14+
15+
If running a SIMP-generated default instance, you should see the usual ``users``
16+
and ``administrators`` groups.
17+
318
Add a Group to 389-DS
4-
=====================
19+
---------------------
20+
21+
To add a group to 389-DS, you can either run ``dsidm posixgroup create`` and it
22+
will prompt you for input or you can provide most parameters at the command line
23+
as follows:
24+
25+
.. code-block:: shell
26+
27+
dsidm accounts posixgroup create --cn alice --gidNumber 1000
28+
29+
.. NOTE::
30+
31+
Note the use of ``posixgroup`` instead of ``group`` when adding groups.
32+
33+
* ``posixgroup`` => POSIX-style groups generally used for system accounts.
34+
* ``group`` => Regular LDAP groups which may be useful for external services.
35+
36+
Remove a Group from 389-DS
37+
--------------------------
38+
39+
To remove our `alice` group, run the following command:
40+
41+
.. code-block:: shell
42+
43+
dsidm accounts group delete "<DN>"
44+
45+
It will prompt you to type ``Yes I am sure`` to confirm deletion.
46+
47+
To get the DN for the group run:
48+
49+
.. code-block:: shell
50+
51+
dsidm accounts group get alice | head -1 | cut -f2- -d' '
52+
53+
Get Information about a 389-DS Group
54+
------------------------------------
55+
56+
Use the following command to get information about a specific group:
57+
58+
.. code-block:: shell
59+
60+
dsidm accounts group get alice
61+
62+
Add a User to a 389-DS Group
63+
----------------------------
64+
65+
Use the following command to add a user to a group:
66+
67+
.. code-block:: shell
68+
69+
dsidm accounts group add_member "<DN>"
70+
71+
You can get the DN of a user by running:
72+
73+
.. code-block:: shell
74+
75+
dsidm accounts user get <username> | head -1 | cut -f2- -d' '
576
6-
.. contents::
7-
:local:
77+
It is important to note that, by default, referential integrity is **not**
78+
preserved between users and groups. This means that you will need to manually
79+
remove users from groups if you decide to delete a user.
880

9-
.. todo::
81+
If you want to change this behavior, you can enable the Referential Integrity
82+
Postoperation plug-in manually. However, this has ramifications in clustered
83+
environments so please read the `related documentation`_ before proceeding.
1084

11-
Add Stuff
85+
.. _related documentation: https://directory.fedoraproject.org/docs/389ds/design/referint-replication-design.html

‎docs/user_guide/User_Management/LDAP/389_DS/manage_users.rst

+99-5
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,105 @@
11
.. _ug-user_management-ldap-389_ds-manage_users:
22

3+
User Management in 389-DS
4+
=========================
5+
6+
List 389-DS Users
7+
-----------------
8+
9+
You can list all users in the default SIMP :term:`389-DS` instance by running:
10+
11+
.. code-block:: shell
12+
13+
dsidm accounts user list
14+
315
Add a User to 389-DS
4-
====================
16+
--------------------
17+
18+
To add a user to 389-DS, you can either run ``dsidm user create`` and it will
19+
prompt you for input or you can provide most parameters at the command line as
20+
follows:
21+
22+
.. code-block:: shell
23+
24+
dsidm accounts user create --uid alice --cn "Alice User" --displayName 'Alice' \
25+
--uidNumber 1000 --gidNumber 1000 --homeDirectory /home/alice
26+
27+
Remove a User from 389-DS
28+
-------------------------
29+
30+
To remove our `alice` user, run the following command:
31+
32+
.. code-block:: shell
33+
34+
dsidm accounts user delete <DN>
35+
36+
It will prompt you to type ``Yes I am sure`` to confirm deletion.
37+
38+
To get the DN for the user run:
39+
40+
.. code-block:: shell
41+
42+
dsidm accounts user get alice | head -1 | cut -f2- -d' '
43+
44+
Add a Password to a 389-DS User
45+
-------------------------------
46+
47+
You may notice that this user has been created without a password. The command
48+
line options do not provide this capability so a password will need to be added
49+
afterwards.
50+
51+
.. NOTE::
52+
53+
No matter which of the following methods you choose, the user will be prompted
54+
to change their password at the next login by default.
55+
56+
Interactive Reset
57+
^^^^^^^^^^^^^^^^^
58+
59+
To be prompted for the user credentials, you can run the following:
60+
61+
.. code-block:: shell
62+
63+
dsidm accounts account reset_password "<DN>"
64+
65+
To obtain the ``DN`` run:
66+
67+
.. code-block:: shell
68+
69+
dsidm accounts user get alice | head -1 | cut -f2- -d' '
70+
71+
Direct Reset
72+
^^^^^^^^^^^^
73+
74+
If you want to set the user's password directly, first generate the password
75+
using ``pwdhash``:
76+
77+
.. code-block:: shell
78+
79+
pwdhash -D /etc/dirsrv/slapd-accounts "<plain_text_password>"
80+
81+
Then run the following, pasting the output of the previous command into
82+
``<GENERATED_HASH>``:
83+
84+
.. code-block:: shell
85+
86+
dsidm accounts user modify alice add:userPassword:<GENERATED HASH>
87+
88+
89+
Add a SSH Public Key to a 389-DS User
90+
-------------------------------------
91+
92+
You can use the following command to add a SSH key to a 389-DS user:
93+
94+
.. code-block:: shell
95+
96+
dsidm accounts user modify alice add:nsSshPublicKey:"<ssh-rsa AAA...>"
97+
98+
Remove a SSH Public Key from a 389-DS User
99+
------------------------------------------
5100

6-
.. contents::
7-
:local:
101+
You can use the following command to remove a SSH key from a 389-DS user:
8102

9-
.. todo::
103+
.. code-block:: shell
10104
11-
Add Stuff
105+
dsidm accounts user modify alice delete:nsSshPublicKey:"<ssh-rsa AAA...>"

0 commit comments

Comments
 (0)