Showing posts with label openldap. Show all posts
Showing posts with label openldap. Show all posts

How to make BDB to auto remove log file


Jephe Wu - http://linuxtechres.blogspot.com

Objective: to understand how BDB (DB4) log file remove works and automatically remove old logfiles to prevent disk space full
background:  Ubuntu 8.04.2 , Berkeley DB 4.2.52, OpenLDAP


Steps:

1.  BDB version used by openldap

root@ldap1:~/ # ldd /usr/sbin/slapd
linux-gate.so.1 =>  (0xb7faa000)
libldap_r-2.4.so.2 => /usr/lib/libldap_r-2.4.so.2 (0xb7f62000)
liblber-2.4.so.2 => /usr/lib/liblber-2.4.so.2 (0xb7f55000)
libdb-4.2.so => /usr/lib/libdb-4.2.so (0xb7e7c000)


root@ldap1:~/ # dpkg -l| grep db
ii  console-tools                              1:0.2.3dbs-65ubuntu7        Linux console and font utilities
ii  dbus                                       1.1.20-1ubuntu3.2           simple interprocess messaging system
ii  libconsole                                 1:0.2.3dbs-65ubuntu7        Shared libraries for Linux console and font
ii  libdb4.2                                   4.2.52+dfsg-4               Berkeley v4.2 Database Libraries [runtime]


2. log file removal
http://sepp.oetiker.ch/db-4.2.52-mo/ref/transapp/logfile.html

Log files may be removed at any time, as long as:


  • the log file is not involved in an active transaction.
  • a checkpoint has been written subsequent to the log file's creation.
  • the log file is not the only log file in the environment.


method 3:

Call the DB_ENV->set_flags method from the application, with the DB_LOG_AUTOREMOVE (http://sepp.oetiker.ch/db-4.2.52-mo/api_c/env_set_flags.html#DB_LOG_AUTOREMOVE) flag, to remove any log files that are no longer needed on an ongoing basis. With this configuration, Berkeley DB will automatically remove log files, and the application will not have an opportunity to copy the log files to backup media.

Two ways to implement checkpoint (besides DB_LOG_AUTOREMOVE flag in DB_CONFIG)


a. checkpoint settings in slapd.conf

checkpoint kbyte min
The checkpoint directive defines the time between checkpoint operations in BDB (the database can only be recovered from the last checkpoint).

The frequency of checkpointing determines the time during which data may be unrecoverable by BDB in the event of a system failure. If NOT using the dbnosync this time could be set to a reasonably long period, say, 10 mins or more, if the dbnosync directive is being used 5 - 15 mins or less if practical. kbytes is the number of kilobytes written to the directory and min is the time in minutes. Whichever occurs first determines the period between checkpoints.

OpenLDAP default is NO CHECKPOINTING - you should always supply a checkpoint directive. See the BDB Chapter 12 Section 15 documentation for more information. This directive may be replaced by using DB_CONFIG file with the txn_checkpoint directive. Examples:

checkpoint 128 15
# check point whenever 128k data bytes written or
# 15 minutes has elapsed whichever occurs first


b.  txn_checkpoint in DB_CONFIG file


# more DB_CONFIG
# see more detail config parameter at http://sepp.oetiker.ch/db-4.2.52-mo/ref/env/intro.html

set_flags DB_LOG_AUTOREMOVE
txn_checkpoint 1024 5 0



DB_CONFIG example:
http://www.zytrax.com/books/ldap/ch6/bdb.html#db-config




root@ldap1:/etc/ldap/ # grep checkpoint slapd.conf
# first DIT definition
database bdb
...
# DIT will act as a provider
overlay syncprov
checkpoint  1024 5
syncprov-checkpoint 100 10


3. working configuration example:
The following configuration makes logfile auto remove possible in my testing environment.


  • DB_CONFIG (sitting at the same directory as BDB database files)

set_cachesize 0 2097152 0
# default cache size is 256KB
# sets a database cache of 0G(first column) + 2M(2*1024*1024=2097152) and 
# do not allows fragmentation 
# does NOT replace slapd.conf cachesize 
# this is a database parameter, for slapd.conf cachesize paramter, refer to
# http://www.zytrax.com/books/ldap/ch6/bdb.html#cachesize
# see http://sepp.oetiker.ch/db-4.2.52-mo/api_c/env_set_cachesize.html
# The database environment's cache size may also be set using the environment's DB_CONFIG file. The syntax of the entry in that file is a single line with the string "set_cachesize", one or more whitespace characters, and the cache size specified in three parts: the gigabytes of cache, the additional bytes of cache, and the number of caches, also separated by whitespace characters. For example, "set_cachesize 2 524288000 3" would create a 2.5GB logical cache, split between three physical caches. Because the DB_CONFIG file is read when the database environment is opened, it will silently overrule configuration done before that time.
set_lk_max_objects 1500 
set_lk_max_locks 1500
set_lk_max_lockers 1500
set_flags DB_LOG_AUTOREMOVE
txn_checkpoint 1024 5 0
# replaces checkpoint in slap.conf
# writes checkpoint if 128K written or every 15 mins
# 0 = no writes - no update 

  • slapd.conf  (put the following checkpoint in the every BDB definition)
checkpoint  1024 5

4. References:


http://www.openldap.org/doc/admin24/maintenance.html

Administrators can change the size limit of a single log file (by default 10MB), and have old log files removed automatically, by setting up DB environment (see below). The reason Berkeley DB never deletes any log files by default is that the administrator may wish to backup the log files before removal to make database recovery possible even after a catastrophic failure, such as file system corruption.

Log file names are log.XXXXXXXXXX (X is a digit). By default the log files are located in the BDB backend directory. The db_archive tool knows what log files are used in current transactions, and what are not. Administrators can move unused log files to a backup media, and delete them. To have them removed automatically, place set_flags DB_LOG_AUTOREMOVE directive in DB_CONFIG.

Note: If the log files are removed automatically, recovery after a catastrophic failure is likely to be impossible.


http://www.zytrax.com/books/ldap/ch6/bdb.html#samples

cachesize  in slapd.conf
Format:
cachesize integer
The cachesize directive defines the number of entries that the LDAP backend will maintain in memory. Do not confuse this directive with the BDB set_cachesize directive - they control different behaviours.

For maximum performance this figure should be as high as practical or as close as practical to the number of records maintained in the directory. The default is 1000. Examples:

cachesize 10000
# LDAP maintains 10,000 entries in memory 
See also Performance chapter.


http://www.openldap.org/faq/data/cache/1072.html


How to use new cn=config in Openldap under CentOS 5/6


Jephe Wu - http://linuxtechres.blogspot.com

Objective: understanding Openldap new feature cn=config and configure openldap as centralized user login and address book
Environment: CentOS 5
Concept:

Historically, Openldap uses static configuration, which means if you need to modify configuration, you have to stop/start slapd again, it needs downtime. Now we have options to use OLC(On-Line configuration), cn=config and slapd.d configuration.

The feature is (at version 2.4) still optional which means that slapd.conf, while formally deprecated, will continue to work.


Steps:
1. make sure /etc/openldap/slapd.conf contains inetorgperson.schema


include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/nis.schema

Add the following into slapd.conf:

database config
rootdn "cn=admin,cn=config"
rootpw {SSHA}QoTQ3JyrnNgDiMPEYncHY43tDxaezh5w

Note: add it before the first database definition if you need to use the unique feature brought by cn=config configuration.

2. use slappasswd to generate password which will be put in /etc/openldap/slapd.conf 

3. to avoid warnings about performance
cp /etc/openldap/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
or
maybe cp /usr/share/doc/openldap-servers-2.*/DB_CONFIG.example /var/lib/ldap/DB_CONFIG


4. convert format to cn=config

# test it first before convert
[root@wordpress schema]# /usr/sbin/slaptest -f //etc/openldap/slapd.conf -v
bdb_db_open: Warning - No DB_CONFIG file found in directory /var/lib/ldap: (2)
Expect poor performance for suffix dc=jephe,dc=com.
config file testing succeeded


# convert slapd.conf to cn=config format
cd /etc/openldap
mkdir slapd.d
/usr/sbin/slaptest -f //etc/openldap/slapd.conf -v -F slapd.d
chown -R ldap:ldap *
mv slapd.conf slapd.conf.bak  [not necessary, just for ensuring we are using slapd.d, not slapd.conf]
/etc/init.d/ldap restart


5. view all content of ldap server

slapcat


6. prepare to import data into ldap 

vi /etc/openldap/slapd.conf to modify dn, dc line

If you are using slapd.d(cn=config), you should modify file /etc/openldap/slapd.d/cn=config/olcDatabase={1}bdb.ldif file, change
olcSuffix, olcRootDN and olcRootPW(no by default) lines.

Then use the command below to import:
ldapadd -x -D 'cn=Manager,dc=jephe,dc=com' -W -f test.ldif

[root@wordpress openldap]# more root.ldif
dn: dc=jephe,dc=com
dc: jephe
objectClass: dcObject
objectClass: organization
organizationName: Openlogic

# for normal shadow account for only login authentication ldap

[root@wordpress openldap]# more /tmp/jwu.ldif
dn: uid=jwu,dc=jephe,dc=com
uid: jwu
cn: Jephe Wu
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: {crypt}$1$TEDFGNB3$VDJn0DD1e5OjG04.Uz7NH0
shadowLastChange: 14335
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 10000
gidNumber: 10000
homeDirectory: /home/jwu
gecos: usuario1

Note: GECOS
This field is optional and used only for informational purposes. Usually, it contains the full username. GECOS stands for "General Electric Comprehensive Operating System", please refer to http://linux.die.net/man/5/passwd.

# for normal shadow account as well as address book purpose

[root@wordpress openldap]# more zwu.ldif
dn: uid=zwu,dc=jephe,dc=com
uid: zwu
cn: Zhitan Wu
sn: Wu
#objectClass: account   #comment out, otherwise it will conflict with inetorgperson
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
objectClass: inetorgperson
userPassword: {crypt}$1$TEDFGNB3$VDJn0DD1e5OjG04.Uz7NH0
shadowLastChange: 14335
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 10001
gidNumber: 10001
homeDirectory: /home/zwu
gecos: usuario1
mail: zwu@jephe.com

# for usrpassword authentication only [for Cognos LDAP login]

[root@ldap1 scripts]# more batchuser.ldif
# entry-id: 1
dn: dc=dev,dc=com
dc: dev
objectClass: top
objectClass: domain

# entry-id: 2
dn: ou=Special Users,dc=dev,dc=com
objectClass: top
objectClass: organizationalUnit
ou: Special Users
description: Special Administrative Accounts

# entry-id: 3
dn: ou=People,dc=dev,dc=com
objectClass: top
objectClass: organizationalunit
ou: People

# entry-id: 4
dn: ou=Groups,dc=dev,dc=com
objectClass: top
objectClass: organizationalunit
ou: Groups

dn: cn=admin,ou=Groups,dc=dev,dc=com
cn: admin
objectClass: top
objectClass: groupofuniquenames
ou: Groups
uniqueMember: uid=jephe,ou=People,dc=dev,dc=com
uniqueMember: uid=zhitan,ou=People,dc=dev,dc=com

# entry-id: 5
dn: uid=zhitan,ou=People,dc=dev,dc=com
uid: zhitan
objectClass: inetorgperson
givenName: Zhitan
sn: Wu
cn: Zhitan Wu
userPassword: {SSHA}h7HBuirlNhYJl1TwVEtKqJlJVCb53cqm


7. References:

http://www.howtoforge.com/install-and-configure-openldap-on-centos-5
http://www.zytrax.com/books/ldap/ch6/slapd-config.html
http://olex.openlogic.com/wazi/2011/using-openldap-for-remote-authentication/

phpldapadmin
http://www.padl.com/OSS/MigrationTools.html

http://www.zytrax.com/books/ldap/ch5/ - OpenLDAP Samples

Get openldap to authenticate with ldap server without TLS/SSL under CentOS 6


Jephe Wu - http://linuxtechres.blogspot.com

Objective: use ldap to authenticate user with openldap server without TLS/SSL
environment: CentOS 6.1 64bit (ldap client), openldap server


Concepts:

Since RHEL6/CentOS6, it uses sssd and nslcd in ldap client to authenticate with ldap server by default. And it requires TLS/SSL cert during authentication because it will transit password in plaintext otherwise.

Refer to http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/SSSD-Troubleshooting.html
----------
To perform authentication, SSSD requires that the communication channel be encrypted. This means that if sssd.conf is configured to connect over a standard protocol (ldap://), it attempts to encrypt the communication channel with Start TLS. If sssd.conf is configured to connect over a secure protocol (ldaps://), then SSSD uses SSL.

This means that the LDAP server must be configured to run in SSL or TLS. TLS must be enabled for the standard LDAP port (389) or SSL enabled on the secure LDAPS port (636). With either SSL or TLS, the LDAP server must also be configured with a valid certificate trust.
---------

Steps:

1. make sure the following packages are installed 
pam_ldap
nss_pam_ldapd  (thanks Eric to point out it, it's not underscore, it's dash)
nss-pam-ldapd

run rpm -qa  | grep ldap to check

2. modify /etc/sysconfig/authconfig
change
FORCELEGACY=no
to
FORCELEGACY=yes

3. run setup command under putty
choose 'Use LDAP' in User Information
choose 'Use Shadow Password', 'Use LDAP Authentication', 'Use Fingerprint reader' and 'Local authorization is sufficient' ,then Next
type in Server and Base DN: part such as
ldap://ldap.jephe
dc=jephewu,dc=com

Note: it will stop sssd daemon and disable it from statup by running 'chkconfig sssd off'

If you run 'setup' before changing FORCELEGACY from no to yes, it have to change it then run setup again to stop sssd, and changing /etc/pam.d/system-auth, modify all pam_sss.so to pam_ldap.so.

Note: /etc/pam.d/system-auth is a symbolic link to /etc/pam.d/system-auth-ac

4. test it
ssh as root
# getent passwd # should show all ldap users such as jwu
# getent group
# id jwu
# su - jwu


5. Troubleshooting:

a. put debug_level = 9 in /etc/sssd/sssd.conf under domain/LDAP part
or directory run
#sssd -d4 , then check /var/log/sssd/* when login.

b. nss_initgroups_ignoreusers
The LDAP server is queried even for users found in /etc/passwd.

To setup permissions correctly, the login environment needs to find all the groups that a user is a member of. If you have configured NSS to lookup groups in LDAP (group: ldap in /etc/nsswitch.conf), then the NSS library will lookup group information in LDAP for users in /etc/passwd too. To avoid this lookup for users whose group membership information is not stored on LDAP, add that user to the nss_initgroups_ignoreusers option in /etc/ldap.conf.

c. http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/SSSD-Troubleshooting.html

d. make sure you started nslcd daemon, #chconfig nslcd on

e. ldap client, unable to login as root when ldap server is down.
put the following into /etc/pam.d/system-auth after pam_unix.so line

account     required      /lib/security/$ISA/pam_unix.so
account     sufficient   /lib/security/$ISA/pam_localuser.so

f. master-slave ldap sync
A syncrepl slave LDAP server doesn't sync with the master if the sync interval is more then 35 minutes on RHEL5

6. References:
http://www.server-world.info/en/note?os=CentOS_6&p=ldap&f=2
http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6-Beta/html/Deployment_Guide/SSSD-Troubleshooting.html
http://www.server-world.info/en/note?os=CentOS_6&p=ldap&f=3

Cognos and OpenLDAP authentication implementation best practice

Jephe Wu - http://linuxtechres.blogspot.com

Objective: design a better Openldap authentication machnisam for individual clients
Environment: Cognos 8.3 and OpenLDAP

Concept:
Company name corp1, some users are doing Cognos report for client name corp2 because corp1 provides outsourcing services for corp2.
There are some internal cognos ldap account in company corp1 and external users in client company corp2, all these users are trying to read pre-defined reports.


Steps:
1. create openldap database corp1 and corp2 as 2 different namespaces.
All company corp1 users will use namespace corp1 to login cognos and all client company corp2 users will use corp2 as namespace to login cognos.

2. create group 'admin' in openldap namespace corp1, add Jephe into that group. Jephe is the cognos administrator in corp1

3. In cognos security configuraiton 'cognos' namespace, add 'admin' group in namespace corp1 into 'System Administrators' group.

4. in client corp2 public folder , all reports can be granted to corp1 users.

5. you can also grant all users in corp2 into cognos default 'reports administrators' group and give above public folder full access for corp2 users so that corp2 users themselves can edit their reports and save it.

6. Directory access such as save report etc is different from report access. For giving directory full access including 'my folder', do this:

  • Launch Cognos Connection and Log on
  • When using IBM Cognos 8 BI 8.1 or IBM Cognos 8 BI 8.2, click on Tools > Directory
  • When using IBM Cognos 8 BI 8.3 or IBM Cognos 8 BI 8.4, click on Launch > Cognos Administration > Security
  • Click on your Namespace (e.g. Series 7 or LDAP)
  • Search the User Account and click on set properties for the affected User
  • Click on the Permissions tab and grant this user full permissions.
  • Select 'Delete the access permissions of all child entries' and click OK

How to configure a ldaps or starttls OpenLDAP server and configure ldapsearch/Softerra ldap products/tomcat/cognos/phpldapadmin to use ldaps

Jephe Wu  -  http://linuxtechres.blogspot.com   


Objective: make a normal openldap server to serve ldaps or starttls request and configure ldapsearch/Softerra ldap products/tomcat/cognos/phpldapadmin to use it
Environment: CentOS 4.8, openldap 2.2.13
Concepts:
server configuration file: /etc/openldap/slapd.conf
client configuration file: (used by such as ldapsearch, /etc/openldap/ldap.conf)

HOST ldap.jephe.com
BASE dc=jephe
TLS_CACERTDIR /etc/openldap/cacerts
tls_cacert /etc/openldap/cacerts/cacert.pem  -- most important one, used by ldapsearch, php-ldap(for phpldapadmin) etc, other 3 above might be optional

question: how do I know ldapsearch is reading /etc/openldap/ldap.conf?
Before and after running ldapsearch command line: stat /etc/openldap/ldap.conf to check access time.

The content of /etc/openldap/slapd.conf:

include        /etc/openldap/schema/core.schema
include        /etc/openldap/schema/cosine.schema
include        /etc/openldap/schema/inetorgperson.schema
include        /etc/openldap/schema/nis.schema
pidfile        /var/run/slapd.pid
argsfile    /var/run/slapd.args


[ TLSCipherSuite          HIGH:MEDIUM:+SSLv2:+SSLv3:RSA ]  -- optional
TLSCACertificateFile /etc/openldap/cacerts/cacert.pem
TLSCertificateFile /etc/openldap/cacerts/servercrt.pem
TLSCertificateKeyFile /etc/openldap/cacerts/serverkey.pem
[ TLSVerifyClient        never ]  -- optional


database    bdb
suffix        "dc=jephe"
rootdn        "cn=manager,dc=jephe"
rootpw        password
directory    /var/lib/ldap
index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub
access to attr=userPassword
        by self write
        by anonymous auth
        by dn="cn=manager,dc=jephe" write
        by * none
access to *
        by dn="cn=Manager,dc=jephe" write
        by users read

Steps:
1. self-signed CA certificate and server certificate creation
this part is mainly for creating ca and server certificates:
refer to http://www.openldap.org/faq/data/cache/185.html
on CentOS 4.8, you can find script called 'CA' under /usr/share/ssl/misc which is a part of openssl rpm package.

Firstly, you need to create your self-signed CA and server certificate:
cd /usr/share/ssl/misc
./CA -newca 
(enter your CA info) for common name part, just use name such as jephe
./CA -newreq
(enter your server info, common name must use server domain name such as ldap.jephe.com)
./CA -sign


after that, copy demoCA/cacert.pem to /etc/openldap/cacerts/

cp demoCA/cacert.pem /etc/openldap/cacerts/
cp newcert.pem /etc/openldap/cacerts/servercrt.pem
cp newreq.pem /etc/openldap/cacerts/serverkey.pem


2. startup server
slapd -h "ldap:/// ldaps:///"
note: this way, it will startup ssl/tls capable openldap server, it will accept starttls or ldaps connections


All client application configuration for using ldaps:

1. how to connect from ldapsearch command:
/usr/bin/ldapsearch -x -b 'dc=jephe' '(objectclass=*)' -H ldaps://ldap.jephe.com -D 'cn=manager,dc=jephe' -W  (use ldaps)
or
/usr/bin/ldapsearch -x -b 'dc=jephe' '(objectclass=*)' -Z -D 'cn=manager,dc=jephe' -W  (use starttls, connect at port 389, then starttls to switch to encrypted communication)

Other example commands:
ldapadd -x -W -D "cn=Manager,dc=jephe.dc=com" -f batchuser.jephe.ldif  -H ldaps://ldap.jephe.com

# more batchuser.jephe.ldif
dn: dc=jephe,dc=com
dc: jephe
objectClass: top
objectClass: domain

# entry-id: 3
dn: ou=People,dc=jephe,dc=com
objectClass: top
objectClass: organizationalunit
ou: People

# entry-id: 5
dn: ou=Groups,dc=jephe,dc=com
objectClass: top
objectClass: organizationalunit
ou: Groups

dn: cn=admin,ou=Groups,dc=jephe,dc=com
cn: admin
objectClass: top
objectClass: groupofuniquenames
ou: Groups
uniqueMember: uid=jephe,ou=People,dc=jephe,dc=com


dn: uid=jephe,ou=People,dc=jephe,dc=com
uid: jephe
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
givenName: Wu
sn: Jephe
cn: Jephe Wu
userPassword: {SSHA}EWo+m4UrXE0yjgefxa4yJ54hz8451234



2. how to connect from Softerra ldap Products
ldap Administrator 2010.1?
create a new profile, use secure connection, it will use ldaps only, then basedn is 'dc=jephe', at credential column, use other credential, simple/cn=manager,dc=jephe/password.

You will receive the warning saying windows cannot verify the certificate, you can import the /etc/openldap/cacerts/cacert.pem into Softerra ldap administrator tool/certificate manager trusted root certificate column.

ldap browser 2.6 [build 650]
look for the below cognos 8 part to generate 2 files (key3.db and cert7.db)
then configuring ldaps profile as follows:
a. Overwrite the key3.db and cert7.db files from the LDAP Browser root directory with the ones just created
b. Edit your existing LDAP profile and change the port to the secure one (eg. 636)
c. on the "LDAP Settings" tab, check the box "Try to use secure connection (only LDAP v.3)"

3. how to connect from tomcat to ldaps?
You have to import above cacert.pem into CA certs as trusted CA certs.
cd /usr/local/jdk/jre/lib/security
usr/local/jdk/bin/keytool -import -file /tmp/cacert.pem -alias ldapca -keystore cacerts


for deleting and listing CA certs, use commands:
/usr/local/jdk/bin/keytool -delete -alias ldapca -keystore cacerts
/usr/local/jdk/bin/keytool -list -keystore cacerts  -v | more


4. how to know the connection is encrypted for ldaps and starttls?
use wireshark rpm package, there's tool tshark.

tshark -n port 389 -i lo/eth0
tshare -n port 389 or port 636 -i lo/eth0


use slapd -h "ldap:/// ldaps:///" -d -1 on ldap server to debug  (refer to http://www.openldap.org/doc/admin24/runningslapd.html )


5. cannot contact LDAP server, CN does not match in certificate
when you use ldapsearch, with -H parameter, you should use the same common name which is used during your server certificate creation, otherwise, ldapsearch will fail.

If you use -Z parameter with ldapsearch, which means you will use starttls instead of ldaps, you should make sure the URI line in /etc/openldap/ldap.conf to match with the common name in server certificate.

6. how to configure cognos 8 to use ldaps instead of ldap?


http://www-01.ibm.com/support/docview.wss?uid=swg21344083 
(Configuring LDAPS (LDAP via SSL) for CRN/Cognos 8)
 
a. use IE to browse https://ldapserver:636 or use  
openssl s_client -connect serveripaddress:636 -showcerts 
to get the CA and server certificates, save it as base64 encoded PEM file
b. download NSS 3.3.2 and NSPR 4.1.2 
from http://www.mozilla.org/projects/security/pki/nss/release_notes_332.html 
extract them to a folder, then copy the contents of NSPR-4.1.2/lib to NSS-3.3.2/bin
go to NSs-3.3.2/bin, then run 
 
certutil -N -d .
certutil -A -n MyServer -d .  -i servercert.pem -t P
certutil -A -n MyCA -d . -i cacert.pem -t C,C,C  (should be optional)

then copy BOTH cert7.db file and  key3.db files under NSS-3.3.2/bin to cognos configuration directory or any meaning directory.

Change Cognos configuration parameters:
1. Provide the absolute path to the cert7.db file for the SSL Certificate Database property in Cognos Configuration.
2. provide ldap server hostname and port number such as jephe.domain.com:636 (must use domain name here, not IP address, the domain name must be same as the common name for server certificate )
3. then restart cognos, then ldaps is ready to use.
 
7. how to use ldaps for phpldapadmin ?

phpldapadmin use Apache php module (php-ldap) as extension to connect to ldap server.
php-ldap reads /etc/openldap/ldap.conf everytime it tries to connect to ldap server,  every time when apache restarts, it reads /etc/openldap/ldap.conf configuration for  tls_cacert /etc/openldap/cacerts/cacert.pem line, read it into memory for use through Apache session until next time web server gets restarted again.


You can use command stat /etc/openldap/ldap.conf to check it actually reads this file.

For /var/www/html/phpldapadmin/config/config.php, you should config it as follows:

$ldapservers->SetValue($i,'server','name','LDAP SP');
$ldapservers->SetValue($i,'server','host','ldaps://ldap.jephe.com:636');
$ldapservers->SetValue($i,'server','base',array('dc=jephe'));
$ldapservers->SetValue($i,'login','dn','cn=Manager,dc=jephe');
$ldapservers->SetValue($i,'login','pass','password');
$ldapservers->setValue($i,'server','port',0);  -- optional


note: please refer to
http://phpldapadmin.sourceforge.net/wiki/index.php/Server:server:host
most important one: the server host part must use the domain name, cannot ip address, domain name must also match the one you created certificate. Cannot use it such as the following:
$ldapservers->SetValue($i,'server','host','ldaps://10.0.0.1:636');

Note: what if you have multiple ldaps servers for multiple dc in config.php in phpldapadmin? you need to take note of the following  facts:
a. the /etc/openldap/ldap.conf can only accept one line of tls_cacert, if you put multiple line of tls_cacert, the later one will be used.
b. you can solve this problem by put 2 CA certs together into one files like below, then both ca certs will be used in phpldapadmin config.php
-----BEGIN CERTIFICATE-----
MII...

......
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MII...

.....
-----END CERTIFICATE-----






FAQ:

1. ldapsearch doesn't work.
make sure you are using the default ldapsearch which comes with openldap rpm, not the one you compiled. Run 'which ldapsearch' to find out the full path.

2. Softerra ldap browser doesn't work.
See above client configuration part, you should configure key3.db and cert7.db.

3. how to get base64 encoded CA and server certificates for ldaps?
a. use IE to browse https://ldapserver:636 then save as file for both CA and server certificates
b. use openssl s_client -connect serveripaddress:636 -showcerts
Output:
1. [root@jephe /]# /usr/bin/ldapsearch -x -b 'dc=jephe'    '(objectclass=*)' -D 'cn=manager,dc=jephe' -Z -W
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base with scope sub
# filter: (objectclass=*)
# requesting: ALL
#

dn: dc=jephe
objectClass: dcObject
objectClass: organization
o: LDAP Server
dc: dev

# Manager
dn: cn=Manager,dc=jephe
objectClass: organizationalRole
cn: Manager

# People,
dn: ou=People,dc=jephe
ou: People
objectClass: top
objectClass: organizationalUnit


# jephe, People
dn: uid=jephe,ou=People,dc=jephe
cn: Jephe Wu
sn: Wu
uid: jephe
objectClass: inetOrgPerson
objectClass: top
userPassword:: e1NNRDV9enRmT1ppakNTeWljeVM0TytkakZlaEo0azE2Y3NBPT0A


# Groups,
dn: ou=Groups,dc=jephe
objectClass: top
objectClass: organizationalUnit
ou: Groups

# training, Groups,
dn: cn=training,ou=Groups,dc=jephe
cn: training
objectClass: groupOfUniqueNames
objectClass: top
uniqueMember: uid=jephe,ou=People,dc=jephe



2. how to use slappasswd or other program to generate SSHA password for rootpw or usrpassword?

Please refer to http://www.openldap.org/faq/data/cache/347.html, this FAQ states you can use the following program and other programs to generate SSHA password:


#! /usr/bin/perl
#
# This small script generates an Seeded SHA1 hash of 'secret'
# (using the seed "salt") for use as a userPassword or rootpw value.
#
use Digest::SHA1;
use MIME::Base64;
$ctx = Digest::SHA1->new;
$ctx->add('secret');
$ctx->add('salt');
$hashedPasswd = '{SSHA}' . encode_base64($ctx->digest . 'salt' ,'');
print 'userPassword: ' .  $hashedPasswd . "\n";
 
How to verify? -> you can use Softerra LDAP Administrator 2010.1 to verify usrpassword
part.
 
3. how to start ldap service to service ldaps only on CentOS?
If you use openldap rpm, you should find file /etc/init.d/ldap, you can modify this 
file to serve ldaps only when certificate is configured in /etc/openlda/ldap.conf 
 
References:
1. http://www.ldapadministrator.com/forum/viewtopic.php?t=506 (LDAP
 Browser SSL Support)
2. http://www-01.ibm.com/support/docview.wss?uid=swg21344083 
(Configuring LDAPS (LDAP via SSL) for CRN/Cognos 8)
3. http://phpldapadmin.sourceforge.net/wiki/index.php/Server:server:host 
 

Use Cognos 8.3 + Oracle 11g for business reporting

Part I: Configuring Cognos to use OpenLDAP Authentication

Environment: Cognos 8.3 on Windows 2003 server
Objective: use external OpenLDAP server on Linux for Cognos web authentication.


Steps:

1    OpenLDAP Installation
Download the latest stable release of OpenLDAP stable release.
./configure
make
make test
make install


2. configuring /usr/local/etc/openldap/slapd.conf

[root@ldap1 scripts]# cat ../slapd.conf| grep -v ^#  | grep -v ^$
include         /usr/local/etc/openldap/schema/core.schema
pidfile         /usr/local/var/run/slapd.pid
argsfile        /usr/local/var/run/slapd.args
include /usr/local/etc/openldap/schema/corba.schema
include /usr/local/etc/openldap/schema/cosine.schema
include /usr/local/etc/openldap/schema/inetorgperson.schema
include /usr/local/etc/openldap/schema/java.schema
include /usr/local/etc/openldap/schema/misc.schema
include /usr/local/etc/openldap/schema/nis.schema
include /usr/local/etc/openldap/schema/openldap.schema

# assume your company name is 'dev'. Firstly create database for your own company
database        bdb
suffix          "dc=dev,dc=com"
rootdn          "cn=root,dc=dev,dc=com"
rootpw          secret
directory       /usr/local/var/openldap-data-dev
index   objectClass     eq

# access control part
access to attr=userPassword
        by self write
        by anonymous auth
        by dn="cn=Manager,dc=dev,dc=com" write
        by * none
access to *
        by dn="cn=Manager,dc=dev,dc=com" write
        by users read
       
database        bdb
suffix          "dc=client1,dc=com"
rootdn          "cn=Manager,dc=client1,dc=com"
rootpw          {SSHA}gFuMY3m3Cb0P4px3TNuf4o7sG30jHcwgi3urEA==
directory       /usr/local/var/openldap-data-client1
index   objectClass     eq

# access control part
access to attr=userPassword
        by self write
        by anonymous auth
        by dn="cn=Manager,dc=client1,dc=com" write
        by * none
access to *
        by dn="cn=Manager,dc=client1,dc=com" write
        by users read



Note:
a. use slappasswd to generate rootpw, the default is to use SSHA encryption.
b. create directory /usr/local/var/openldap-data-dev and /usr/local/var/openldap-data-client1 fist before restarting slapd.
c. for configuring slapd.conf, please refer to http://www.openldap.org/doc/admin24/slapdconfig.html

3. source file to import

[root@ldap1 scripts]# more batchuser.ldif
# entry-id: 1
dn: dc=dev,dc=com
dc: dev
objectClass: top
objectClass: domain

# entry-id: 2
dn: ou=Special Users,dc=dev,dc=com
objectClass: top
objectClass: organizationalUnit
ou: Special Users
description: Special Administrative Accounts

# entry-id: 3
dn: ou=People,dc=dev,dc=com
objectClass: top
objectClass: organizationalunit
ou: People

# entry-id: 4
dn: ou=Groups,dc=dev,dc=com
objectClass: top
objectClass: organizationalunit
ou: Groups

dn: cn=admin,ou=Groups,dc=dev,dc=com
cn: admin
objectClass: top
objectClass: groupofuniquenames
ou: Groups
uniqueMember: uid=jephe,ou=People,dc=dev,dc=com
uniqueMember: uid=zhitan,ou=People,dc=dev,dc=com

# entry-id: 5
dn: uid=zhitan,ou=People,dc=dev,dc=com
uid: zhitan
objectClass: inetorgperson
givenName: Zhitan
sn: Wu 
cn: Zhitan Wu
userPassword: {SSHA}h7HBuirlNhYJl1TwVEtKqJlJVCb53cqm

# entry-id: 6
dn: uid=jephe,ou=People,dc=dev,dc=com
uid: jephe
objectClass: inetorgperson
givenName: Wu
sn: Jephe
cn: Jephe Wu
userPassword: {SSHA}EWo+m4UrXE0yjgefxa4yJ54hz845B3xz

4. commands used

4.1 ldap search everything
ldapsearch -x -b 'dc=dev,dc=com' '(objectclass=*)'

4.2  ldap add user

ldapadd -x -D 'cn=Manager,dc=dev,dc=com' -W -f jephe.ldif
Enter LDAP Password:
adding new entry "uid=jephe,ou=People,dc=dev,dc=com"

root@app1 scripts]# more jephe.ldif
# entry-id: 7
dn: uid=jephe,ou=People,dc=dev,dc=com
uid: jephe
givenName: Wu
objectClass: inetorgperson
sn: Jephe
cn: Jephe Wu
userPassword: {SSHA}hfJXE/3c8zK42rD6FL7mZB6SxG1DA2o+


4.3  ldap delete user
ldapdelete -x -D 'cn=Manager,dc=dev,dc=com' -W uid=jephe,ou=people,dc=dev,dc=com
Enter LDAP Password:

4.4 ldap change password for user
a. ldappasswd -D "cn=manager,dc=dev,dc=com" -x -W -s abcd1235 "uid=jephe,ou=people,dc=dev,dc=com"

b. ldappasswd -D "cn=manager,dc=dev,dc=com" -x -W  -S "uid=jephe,ou=people,dc=dev,dc=com"
New password: (new password for user)
Re-enter new password: (new password for user again)
Enter LDAP Password: manager password
Result: Success (0)

4.5  ldap add group
ldapadd -x -D 'cn=Manager,dc=dev,dc=com' -W -f group1.ldif
Enter LDAP Password:
adding new entry "cn=testgroup,ou=Groups,dc=dev,dc=com"

[root@app1 scripts]# more group1.ldif
dn: cn=testgroup,ou=Groups,dc=dev,dc=com
cn: testgroup
objectClass: top
objectClass: groupofuniquenames
ou: Groups
uniqueMember: uid=jephe,ou=People,dc=dev,dc=com
uniqueMember: uid=zhitan,ou=People,dc=dev,dc=com


4.6 ldap delete group
ldapdelete -x -D 'cn=Manager,dc=dev,dc=com' -W cn=testgroup,ou=Groups,dc=dev,dc=com
Enter LDAP Password:

4.7 ldap modify/delete groupmember

ldapmodify -x -D 'cn=Manager,dc=dev,dc=com' -W -f b
Enter LDAP Password:
modifying entry "cn=admin,ou=Groups,dc=dev,dc=com"

[root@app1 scripts]# more b
dn: cn=admin,ou=Groups,dc=dev,dc=com
changetype: modify
delete: uniquemember
uniquemember: uid=jephe,ou=people,dc=dev,dc=com

4.8 ldap modify/add member. ldapmodify -x -D 'cn=Manager,dc=dev,dc=com' -W -f b
Enter LDAP Password:
modifying entry "cn=admin,ou=Groups,dc=dev,dc=com"

[root@app1 scripts]# more b
dn: cn=admin,ou=Groups,dc=dev,dc=com
changetype: modify
add: uniquemember
uniquemember: uid=jephe,ou=people,dc=dev,dc=com

4.9. how to add user through phpldapadmin
4.9.1 manual way:
a. custom
b. uid=user1
c. ou=people,dc=dev,dc=com
d. inetorgperson
after done, add new attribute- userpasswd , then it will automatically encrypt it using md5 algorithm.
type in password, use mkpasswd.sh to generate

4.9.2 use tools from phpldapadmin
After adding existing users, you can copy the existing user setup to another user, even in different client.

4.10 how to reset password for user
use mkpasswd on linux to generate random password (4 digitals and 4 characters, mkpasswd -l 8 -s 0 )

Part II: install Cognos and configure web server and database

5. configuring Apache on Windows

We use apache server 2.2.2 for Windows.
In httpd.conf configuration, put the following:


options Indexes followsymlinks
allowoverride none
order allow,deny



allowoverride none
options none
order allow,deny
allow from all


in alias module, put
scriptalias /cgi-bin "C:/program files/apache software fouondation/apache 2.2/cgi-bin/"
scriptalias /cognos8/cgi-bin "C:/program files/cognos/c8/cgi-bin"
alias /cognos8 "C:/program files/cognos/c8/webcontent"

You can install cognos web gateway on Linux server also.

6. Configuring browser to use http://ipaddress/cognos8/ (in IE security, make http://ipaddress in the trusted website)

7. setup database for cognos
7.1 MS SQL database
a. go to enterprise manager,go to database, right click, create new one called 'cm'
b. go to security, logins, 'new login' put 'cmuser' as name, password is also 'cmuser', database is 'cm',
database access part, put 'cm' as public and 'db_owner'.

7.2 Oracle database
7.2.1 You have to create a separated instance only for cognos use, it requires AL32UTF8 character set.
can use dbca to create a new instance id 'cognos' with character set AL32UTF8.
After that, create a tablespace 'contentstore' and user 'contentstore' and give user contentstore as dba privileges.
Create tablespace contentstore datafile '/u01/app/oracle/oradata/cognos/contentstore.dbf' size 20m autoextend on next 5m flashback off;
Create user contentstore identified by contentstore default tablespace contentstore temporary tablespace temp;
Grant dba to contentstore;

7.2.2 Configuring Net manager
From start - All programs - Oracle oraClient11g_home1-configuration and Migration tools- net manager
Oracle Net Configuration-local -Servide Naming, add a new one called 'cognos' which has the following information:
Service name: cognos
Connection type: Database default
Protocol: TCP/IP
Hostname: 1.2.3.4 (replace with your oracle server IP)
Port number: 1521

7.2.3 create tablespace and users:
create tablespace cognos datafile '/u01/app/oracle/oradata/cognos.dbf' size 20m autoextend on next 10m flashback off;
create user cognos identified by password default tablespace cognos temporary tablespace temp;
grant connect,resource,create view to cognos;
revoke unlimited tablespace from cognos;
alter user cognos quota unlimited on cognos;

7.2.4 Important - Changing 'cursor sharing' mode in Oracle 11g database used for Cognos reporting
When using Cognos 8 framework manager to fetch tables from Oracle 11g database, by default, it will give you the following errors. It is okay for views.
'RQP-DEF-0177' an error occurred while performing operation sqlbulkfetch status =-9
UDA-SQL-0177 general exception has occurred during the operation fetch.

Solution: In Oracle, change the cursor sharing mode to 'Exact'
Steps:
By default, Oracle 11g use 'SIMILAR' mode for cursor sharing, you need to change it to 'EXACT' mode.

Alter system set cursor_sharing='EXACT' scope = both;

To verify what's the value for cursor sharing, use:

select name, value from gv$parameter where name like '%cursor%'

8    Cognos Installation
8.1    Install Cognos for Windows and Framework manager
Install everything including web content for use for apache later

8.2    Configuring 'Cognos configruaton'
8.2.1    Use Oracle as content store
You have to delete the default Microsoft sql server content store first before you can create Oracle content store
Download the oracle 10g latest JDBC driver class12.jar then put it under c:\Program files\cognos\c8\webapps\p2pd\WEB-INF\lib

Note: Oracle 11g JDBC driver doesn't work with Cognos 8
Now you can configure Data Access - Content Manager- contentstore part as follows:
Database server and port number: Serverip:1521
Userid and password: contentstore/contentstore/contentstore
Service name which is oracle instance sid : cognos
save and start cognos service

8.3    Configuring data source in Cognos
Use browser to access http://localhost/cognos8/, then go to 'cognos connection', go to 'tools' - 'directory' , to create a new data source to use Oracle database 11g.

8.4    Open framework manager to create a new project and data source.
For sql net connection string, use 'cognos' which is defined earlier in tnsname.ora
Remember: you must change Oracle 11g cursor sharing mode to 'EXACT' so that Framework manager can receive table information from database, otherwise, it will give errors. For views, it is okay

9. cognos configuration for LDAP
Authentication: dev
Namespace ID: DEV
Host and port: 10.0.0.18:389
base distinguished Name: dc=dev,dc=com
user lookup: uid=${userID},ou=people,dc=dev,dc=com
Bind user DN and password: cn=Manager,dc=dev,dc=com
Password is the Manager password
Size Limit: 0
Time out in Seconds: 0

note: you also need to disable anonymous access from default 'Cognos' namespace.

10. restart cognos configuration and test it ( http://server/cognos8/)

Part III Cognos user permission and how it works

11. system administrators in cognos namespace itself
You can put your admin group 'admin' in 'dev' openldap database (pointing to dev openldap database for authentication) in the cognos directory 'system administrators'.
After adding to system administrator, you can view all directories under 'public folder' in cognos for reports.

steps below:

1. use IE to login https://url/cognos/
2. go to 'launch' menu, cognos administration
3. go to 'security'-'cognos', the second page, the last second one which is 'system administrators'
4. go to properities, members, add 'admin' group in 'dev' namespace
5. you only need to add 'admin' group to system administrator, no need to add to other cognos directories.


12. how to create user and assign permission for reports
If a user needs to view multiple openldap database/ cognos namespace reports, you should add this user in dev openldap database
instead of individual client namespace.

Then you can assign this user to multiple namespace to view their reports.
steps: login as dev admin group user, go to 'home' and clien properity for each client folder, permission, add the user.

Part IV Cognos reporting
13. create data source connection, use a user which can read all client schemas data ( select any table) or use system user for creating data source connection which can read all schema data
14. modify datasource schema before creating and publishing a new package for another client.
Before publishing a package, you need to change 'schema' part in data source name properities then save so that that published package is only for that schema only. Don't enable data source view when publishing package, choose only 'english'.

How to let users to change OpenLDAP password themselves through Linux CLI

Environment: OpenLDAP on Linux (CentOS, Fedora, Redhat or OEL), already configured the userpassword attribute.
Objective:  to let users to change their LDAP userpassword attribute themselves.


Steps:  
1.  configure access control part in slapd.conf

access to attr=userPassword
        by self write
        by anonymous auth
        by dn="cn=Manager,dc=dev,dc=domain,dc=com" write
        by * none

# note: above 'by self write' and 'by anonymous auth' attibutes
are very important, otherwise the users cannot change password by
themselves.
 
access to attr=proxyAccess
        by self read
        by dn="cn=Manager,dc=dev,dc=domain,dc=com" write
        by * none

access to *
        by dn="cn=Manager,dc=dev,dc=domain,dc=com" write
        by users read
 
2.  user ldapmodify to change it.
  • Method 1:  use ldapmodify with Manager DN
ldapmodify -x -H ldap://10.0.0.1  -D 'cn=Manager,dc=dev,dc=domain,dc=com' -W -f jephe.ldapmodify

[root@mars openldap]# more jephe.ldapmodify
dn: uid=jephe,ou=people,dc=dev,dc=domain,dc=com
changetype:modify
replace: userpassword
userpassword: {MD5}risfylFZSeXVT7IrjtlVdQ==

You can use command 'slappasswd -h {MD5}' to generate userpassword line above
New password: testing
Re-enter new password: testing
{MD5}risfylFZSeXVT7IrjtlVdQ==


  • Method 2 :  use ldapmodify with user own DN
ldapmodify -x -H ldap://10.0.0.1 -D 'uid=jephe,ou=people,dc=dev,dc=domain,dc=com' -W -f jephe.ldapmodify
Enter LDAP Password:
modifying entry "uid=jephe,ou=people,dc=dev,dc=domain,dc=com"

3. use ldappasswd to change it
  • Method 3:  use ldappasswd with Manager DN
ldappasswd -x  -D cn=Manager,dc=dev,dc=domain,dc=com -w password  -s password uid=jephe,ou=People,dc=dev,dc=domain,dc=com
Result: Success (0)

  • Method 4: use ldappasswd with user own DN
ldappasswd -x  -D uid=jephe,ou=People,dc=dev,dc=domain,dc=com -w abcd1234  -s 12345 uid=jephe,ou=People,dc=dev,dc=domain,dc=com
Result: Success (0)

3. ldapmodify to modify some attributes:

ldapmodify -c -x -D "cn=admin......" -w -f filename.ldif

# more filename.ldif
dn: cn=.....
changetype: modify
replace: loginShell
loginshell: /bin/bash

4. backup and restore ldap database


slapcat -b "dc=jephe,dc=com" -l ldif_file
/usr/local/openldap/sbin/slapadd -b "dc=jephe,dc=com" -l ldif_file


HP ILO2 Authentication through OpenLDAP on HP DL385G2

Jephe Wu http://linuxtechres.blogspot.com

Many companies are using HP servers because of the easier management of ILO(Integrated Lights-Out). After you deployed a large number of HP servers, you'll find one problem which is to manage all the ILO administrator password. Since the ILO provides the directory setting which you can use the centralized LDAP database for authentication, but HP doesn't documented how to configure it through OpenLDAP.

This articles guides you to configure a openldap server specially for doing HP ILO2 authentication. I'm using RedHat Enterprise Linux 4 update 5 and OpenLDAP. It's only being tested on HP DL385G2 server although it might be working for other models too.


The following is the some important concept for enabling ilo2 authentication through openldap.

On OpenLDAP:

  • Adding ‘memberOf’ attribute and ‘user’ objectclass into openldap (details later)
  • Allow version 2 binding in /etc/openldap/slapd.conf which is ‘allow bind_v2’
  • Slapd must also listen on port 636(ldaps)
On ILO2:

  • Using schema-free configuration in ILO
  • Specify port 636 and OpenLDAP servername or IP address
  • Configuring user context and group DN
Special schema for ilo auth in /etc/openldap/slapd.conf
[root@repo openldap]# grep -e ilo.schema -e bind_v2 /etc/openldap/slapd.conf
include /etc/openldap/schema/ilo.schema
allow bind_v2

[root@repo openldap]# grep TLS /etc/openldap/slapd.conf
TLSCACertificateFile /usr/share/ssl/certs/ca-bundle.crt
TLSCertificateFile /usr/share/ssl/certs/slapd.pem
TLSCertificateKeyFile /usr/share/ssl/certs/slapd.pem
Note: must enable TLS for listening on port 636 for ilo ldaps connection

[root@repo openldap]# more /etc/openldap/schema/ilo.schema
attributetype ( 1.3.6.1.4.1.15959.9.1.1
NAME 'memberOf'
DESC 'Group which user belongs to'
EQUALITY distinguishedNameMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )

objectclass ( 1.3.6.1.4.1.15959.9.2.1
NAME 'memberOf'
SUP top AUXILIARY
DESC 'Required by Integrated Lights-Out for OpenLDAP '
MUST ( memberOf )
)

objectclass ( 1.3.6.1.4.1.15959.9.2.2
NAME 'user'
SUP top AUXILIARY
DESC 'Required by Integrated Lights-Out for OpenLDAP '
)
Import ldif
Note: replace ou=linuxtechres and dc=blogspot,dc=com with your organization ones.

[root@repo ldif]# more base.ldif
dn: dc=blogspot,dc=com
dc: blogspot
description: Root LDAP entry
objectClass: dcObject
objectClass: organizationalUnit
ou: rootobject
dn: ou=linuxtechres,dc=blogspot,dc=com
objectclass: top
objectclass: organizationalunit
ou: linuxtechres

dn: ou=groups,ou=linuxtechres,dc=blogspot,dc=com
objectclass: top
objectclass: organizationalunit
ou: groups
dn: ou=users,ou=linuxtechres,dc=blogspot,dc=com
objectclass: top
objectclass: organizationalunit
ou: users
[root@repo ldif]# more user.ldif
dn: cn=jephe.wu,ou=users,ou=linuxtechres,dc=blogspot,dc=com
cn: jephe.wu
uid: jephe.wu
sn: Wu
uidnumber: 1000
homedirectory: /home/jephe.wu
objectClass: top
objectClass: posixAccount
objectClass: shadowAccount
objectclass: inetorgperson
objectClass: memberOf
objectClass: user
shadowLastChange: 13650
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
gidNumber: 100
displayname: Jephe Wu
userPassword: {SSHA}7znBGbK5/GMGWVryUuunxgQ87N8L38/b
memberOf: cn=iloadmin,ou=groups,ou=linuxtechres,dc=blogspot,dc=com
[root@repo ldif]# more groups.ldif
dn: cn=iloadmin,ou=groups,ou=linuxtechres,dc=blogspot,dc=com
cn: iloadmin
objectClass: top
objectClass: groupofnames
member: cn=jephe.wu,ou=linuxtechres,dc=blogspot,dc=com

ILO Configuration

Enable the following options on ILO2 (Administration-Security- Directory Settings)
Use Directory Default Schema
Local User Accounts Enabled
Directory Server Address: FQDN of openldap server or ip address
Directory Server LDAP Port 636
Directory User Context 1 ou=users,ou=linuxtechres,dc=blogspot,dc=com
 
Then go to ‘Administrator Groups’:
Security Group Distinguished Name cn=iloadmin,ou=groups,ou=linuxtechres,dc=blogspot,dc=com
Administer Group Accounts Allowed
Remote Console Access Allowed
Virtual Power and Reset Allowed
Virtual Media Allowed
Configure iLO 2 Settings Allowed

That's it. Now you can login ILO2 as jephe.wu with your openldap entry password for every HP servers in your data center which are configured with openldap authentication.