Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

LDAP Database Management

|

231

Luckily, there’s a much faster way to determine the same information: the gq LDAP

tool allows you to browse all supported attributes in all supported schema on your

LDAP server. Figure 7-5 contains a screenshot illustrating my LDAP server’s support

for

uid, according to gq.

Note the “Used in objectclasses” box in Figure 7-5, which tells us that the selected

attribute,

uid, is used in the object classes uidObject, posixAccount, shadowAccount,

and

inetOrgPerson, all four of which we identified earlier via grep. The object class

OpenLDAPperson does not appear in the gq screen: this is because the LDAP server in

question doesn’t have an

include statement in its /etc/openldap/slapd.conf file for the

file openldap.schema. When in doubt, therefore, you should include even schemas

you’re not sure you need: after you settle on an LDAP record format, you can always

uninclude schemas that don’t contain object classes you need.

All this probably sounds like a lot of trouble, and indeed it can be, but it’s extremely

important for you to be able to create records that contain the kinds of information

pertinent to your LDAP needs, and since LDAP is so flexible, figuring out precisely

how to assemble that information in the form of attributes can take some tinkering.

Building ...