Hello, and welcome to this Pluralsight presentation! My name is Andrew Mallett,
and in this module,
we're going to go through and take a look at implementing
identity management with OpenLDAP and SSSD.
So come on, what are we waiting for?
Let's go through and look at our menu.
As we work our way through this module,
we're going to take a look at centralizing our user accounts so that's
our main topic that we're going to be uncovering.
So we're going to take a look at what we mean by identity
management and different identity management solutions
that we can use within Linux.
We'll be taking a look at an OpenLDAP install, and this
will be on our Ubuntu 20.04 server.
The System Security Services Daemon, or SSSD is the client that we
can use for our authentication. Using this backend daemon, we're able
to connect to different types of directory servers, such as OpenLDAP
or Active Directory domains.
We, of course, will be using OpenLDAP as we previously mentioned.
The lab systems that we're using are going to be our AlmaLinux 8.5 system, and
this we've already configured as our certificate authority.
We're going to need then the certificates that we've issued to work with
our LDAP server so we can communicate with the LDAP server securely. On
the AlmaLinux 8.5 system, we'll be installing our LDAP client to work with
SSSD so we can authenticate users on AlmaLinux that exist in our LDAP
directory On Ubuntu 20.04, this is essentially going to be our OpenLDAP
server. But we're also going to have the LDAP Client, so we can also log
onto this system as user accounts that are located in the directory itself.
So we can share our user accounts between AlmaLinux and Ubuntu 20.04 and any
other systems that are using the same directory server.
And this is really what we mean by identity management,
centralizing our user and group accounts in a directory.
Now, the directory then might be within FreeIPA. This is a
solution that's available that gives identity management, policy
management, and authentication via Kerberos.
Just the directory side of that,
it's a 389‑ds, essentially an OpenLDAP server with a whole load
of Python scripts written around it to make management a little
bit more simple. OpenLDAP itself,
which we'll be looking at, and it could also include Active
Directory. Even when we're using Linux systems,
the Linux systems can either act as an Active Directory server using Samba
4, or we can be members of an Active Directory Domain.
All of this has given us then the idea of one user account that
we can have to access all of our systems,
so I only need the user account _____ once.
I don't need a _____ account on each system that I need to
authenticate to. The client is SSSD. This then provides
authentication access to our identity management solutions.
It does actually require secure communication, so we have to then have
LDAPS, or at least TLS over our LDAP communication.
And we'll investigate these possibilities as we go through.
When we're installing on Ubuntu, any Debian‑based systems will create
an LDAP domain based on your system domain name.
So we're making sure then that we've got a fully qualified domain name set.
I'm calling my system ubuntu.example.com. I'm keeping with the host
name of Ubuntu by adding in then the domain example.com. I've already
had a certificate issued to Ubuntu, and I want to make sure that I can
continue using that certificate.
When I look inside of my host file, we can then put the IP address that you
are using, 192.168.33.13 as the IP address of my system, and then the fully
qualified domain name and the alias, so we can still access it as Ubuntu.
Now, obviously, you can use your own IP address. If you want to use another
domain name, you can, but then you're going to have to adjust the examples as
we go through so they work with your domain. With that done, it's very easy
then to install OpenLDAP. We can make sure our metadata is up to date, and
then we can install the slap daemon and LDAP utilities. We'll be prompted for
the LDAP administrator for the domain that we are creating.
It will be the default account of admin, and obviously, we're
adding in a brand‑new password for this account.
When we take a look at the open ports, 389, our LDAP port should be
open by default. When we're connecting to our identity solutions using
LDAP, we can use then a variety of tools.
The lddapwhoami command then literally will show who are you when
you're connected through to the LDAP system.
If we just do ldapwhoami ‑x, we're using very simple authentication,
and that will then connect as an anonymous user.
Another mechanism that we can use is ldapi. This is making
use of sockets within the Linux interface.
We are then connecting as our own user account, so we're going to be able to see
information coming back relating as to who we are when we're connecting. This
type of connection is often used for managing the system. As the root user is
the main directory manager, the user that is able to manage the LDAP
infrastructure rather than necessarily the account information in each one of
our domains. To begin with, when we're not connecting via ldapi, we'll be
connecting using LDAP. Later on, we're going to add in our TLS configuration so
we can have secure communication, or LDAPS, between our clients and the
directory system.
This is required when we're using SSSD. Come on,
let's go through and take a look at installing LDAP and getting it up and running with the very basics.