0

We've got openLDAP running, but a somewhat unique? situation that I'm not sure how to describe. Trying to find a better solution than what we've got.

tl;dr: How to allow:

  • a FooCo system to allow uid=oracle,ou=fooco AND uid=sysadmin1,ou=us login
  • a BarCo system to allow uid=oracle,ou=barco AND uid=sysadmin1,ou=us login

  • without duplicating uid=sysadmin1 in each fooco and barco subou:

    dc=ourorg
  ou=fooco
     uid=oracle
  ou=barco
     uid=oracle
  ...
  ou=us
    uid=sysadmin1
    uid=sysadmin2
  ...

More details: We provide services (systems) for multiple separate suborganizations (FooCo and BarCo for this example), but have our own "global accounts." We're trying to run a single LDAP (see below). And, for example, each suborganization is insistent that their oracle db service account (e.g. login that runs db processes) be called "oracle" (I lost that battle). So obviously we can't use same RDN, but we can use different DNs by putting the account uid's in different subtrees (as above). However, when authenticating against base dc (say RHEL7 and AIX), how would we specifically "help" a server owned by FooCo use the FooCo subtree, and BarCo to use Barco subtree (again, using RHEL7 and AIX)? The simple answer, i.e., is we configured a FooCo server to use ou=FooCo,dc=ourdc as BASEDN. However, we have other users (a sysadmin team) who ALSO need to be able to log in (ideally, using LDAP). It doesn't make sense at all to put sysadmins in EACH subtree, either - they should have one entry somewhere.

We tried aliases/extensibleObject (a little bit), ie uid=aliassa1,ou=fooco -> uid=sysadmin1,ou=us, and while it works fine for an ldapsearch, it will not work for a authentication/login/su/etc. (but ldap.conf has "DEREF always" set).

So, any ideas for solutions given the above? A creative way to get around this issue? Thanks!!

Sven
  • 98,649
  • 14
  • 180
  • 226
zenfridge
  • 41
  • 5

1 Answers1

1

What is possible is dependent on the specific environment and I can't really comment on AIX.

As an example, newer versions of SSSD on RHEL support multiple search bases

ldap_search_base = ou=fooco,dc=ourorg?subtree?ou=us,dc=ourorg?subtree?

and it should be possible to do something similar with other LDAP libraries (e.g. set a pam_filter that matches both ou=foo and ou=us when using pam_ldap on Linux).

Another option might be to restrict logins to specific groups (e.g. all users of ou=foo and ou=us belong to cn=foologin,cn=groups,dc=ourcorp. This could even be automated with some LDAP servers (e.g. with the dynlist overlay on OpenLDAP).

Sven
  • 98,649
  • 14
  • 180
  • 226