SAC:LDAP - Revision history

Robe at 14:11, 30 September 2025

2025-09-30T14:11:26Z

Strk: /* User registration */

2025-09-30T14:09:55Z

User registration

Cvvergara: /* Command line interface */

2025-02-20T17:32:02Z

Command line interface

Robe: /* Editing the LDAP database config */

2024-10-28T14:30:13Z

Editing the LDAP database config

Darkblueb: change Mediawiki migration summary

2022-05-06T00:44:15Z

change Mediawiki migration summary

Robe: Reverted edits by Strk (talk) to last revision by Robe

2021-12-23T19:28:34Z

Reverted edits by Strk (talk) to last revision by Robe

Strk: Reverted edits by Robe (talk) to last revision by Strk

2021-12-19T15:27:48Z

Reverted edits by Robe (talk) to last revision by Strk

Robe: /* Querying the LDAP database */

2020-05-18T01:21:46Z

Querying the LDAP database

Robe: /* Editing the LDAP database config */

2020-05-17T18:42:27Z

Editing the LDAP database config

Robe: /* Editing the LDAP database */

2020-05-17T18:40:10Z

Editing the LDAP database

@@ Line 24: / Line 24: @@
-IP access filter is set by via OSGeo7 ufw firewall:
+IP access filter is set by via  ufw firewall configs store in ansible:
-refer to [https://git.osgeo.org/gitea/sac/osgeo7 OSGeo7 host for details]
+refer to [https://gitea.osgeo.org/sac/ansible-deployment/src/branch/master/deployment/roles/osgeo9/tasks/host-setup.yml#L180 OSGeo9 host for details]
 == LDAP structure ==

@@ Line 166: / Line 166: @@
   https://id.osgeo.org/ldap/create
-'''''NOTE''': as of June 2016 the public user registration form may require entering a "mantra" (a pseudo-secret passphrase) - already registered trusted users can find out what the mantra is and how to share on https://git.osgeo.org/gitea/sac/userid-mantra/wiki (requires login and access grant, otherwise the page will appear as 404).''
+'''''NOTE''': as of June 2016 the public user registration form may require entering a "mantra" (a pseudo-secret passphrase) - already registered trusted users can find out what the mantra is and how to share on https://gitea.osgeo.org/sac/userid-mantra/wiki (requires login and access grant, otherwise the page will appear as 404).''
 === User edit ===

@@ Line 239: / Line 239: @@
     $ /osgeo/tools/ldap/ldap_reset_user_password "account-to-be-reset"
     # A new random password will be sent to the user. Asks for confirmation.
 === Editing the LDAP database config ===

@@ Line 244: / Line 244: @@
 Increasing default page limit -
-  $ ssh root@osgeo7-secure
+  $ ssh root@osgeo9-secure
   $ ldapmodify -H ldapi:/// -Y EXTERNAL -f modify_max_page_limit.ldif
   $ systemctl restart slapd

@@ Line 4: / Line 4: @@
 It is currently used for [[Subversion]], [[Trac Instances|Trac]], [[SAC_Service_Status#Web|Drupal]], [[SAC_Service_Status#QGIS|QGIS services]] (hub.qgis.org and plugins.qgis.org), www.osgeo.org, [[SAC:Gitea|Gitea]], [[SAC_Service_Status#Nextcloud_nextcloud.osgeo.org|Nextcloud]], [[SAC:MatrixSynapse|Matrix-Synapse]] and shell access (opt-in).
-It is hoped to also use it for [[SAC_Service_Status#Wiki|mediawiki]] and possibly some other [[SAC_Service_Status|services]] in the future.
+A staged migration to internal LDAP for [[SAC_Service_Status#Wiki|mediawiki]] was initiated in 2021. Other [[SAC_Service_Status|services]] may be possible in the future.
 LDAP management is the responsibility of [[SAC]] (the System Administration Committee).

@@ Line 16: / Line 16: @@
   $ service slapd [start|stop|restart]
-The main ldap config file '''was''',
+We have moved to OLC:
 http://www.zytrax.com/books/ldap/ch6/slapd-config.html#intro
@@ Line 221: / Line 218: @@
 All ``ldap-utils`` commands will use systemwide or user-specific files for default configuration so things like LDAP Base (-b dc=osgeo,dc=org) and LDAP URI (-H ldaps://ldap.osgeo.org) need not be specified on each commandline from properly configured machines (grep URI /etc/ldap/ldap.conf; grep BASE /etc/ldap/ldap.conf).
-=== Editing the LDAP database ===
+=== Editing the LDAP database users and groups ===
-Editing LDAP database requires an admin password. The -W switch asks for a password prompt (known by [[SAC:Primary Administrators]]).
+Editing LDAP database requires an admin password or root access to secure container. The -W switch asks for a password prompt (known by [[SAC:Primary Administrators]]).
 Loading an ldif file into an ldap directory:
@@ Line 242: / Line 239: @@
     $ /osgeo/tools/ldap/ldap_reset_user_password "account-to-be-reset"
     # A new random password will be sent to the user. Asks for confirmation.
 === Querying the LDAP database ===
@@ Line 247: / Line 260: @@
 The ldapsearch command is used to query a LDAP database.
-This command seems to dump the whole LDAP database. Use with care, but sometime it's the easiest way to search (using grep):
+This command dumps the first 500 entries of the ldap database.  Note that secure-dev on osgeo4 has limit set to 40000 for easier pull by admins. refer to modify section for instructions how to set the limits.
    $ ldapsearch -x
@@ Line 261: / Line 274: @@
    $ ldapsearch -x "createTimestamp>=20160401100000Z"
-Example: list all entries created in 2017:
+Example: list all entries created in 2019:
-   $ ldapsearch -x '(&(createTimestamp>=20170101000000Z)(!(createTimestamp>=20180101000000Z)))'
+   $ ldapsearch -x '(&(createTimestamp>=20190101000000Z)(!(createTimestamp>=20200101000000Z)))'
 The fields to be shown in the output can be specified as additional parameters, like: