Now it doesn't really matter whether we're adding entries,
removing entries, or even modifying entries within an LDAP database,
the change is going to be completed through an LDIF file,
Lightweight Directory Interchange Format.
When we take a look at this example,
this is all we need in the text file to create a new organizational unit.
We can see the structur ou=People, this is its fully qualified domain name,
and the names are always typed full, so we have the type of object,
and we have the full path.
We can see the type of object we're creating is an organizational unit,
and the only attribute we're populating is the ou
attribute being populated with People.
Once we've created the file, we can use ldapadd to add the entry,
again using simple authentication, and the uppercase D this time
because we don't want to connect as anonymous.
You can probably guess that the anonymous user isn't
going to be able to create objects.
So based on the basic access control lists that we have,
the admin user that we set the password for during the
installation will have full rights to our domain.
And we can see that we're making reference to the ou.ldif file.
Now, the best way to be able to see this,
as well as creating maybe a user account for us to use,
is the demonstration.
And again, I would make sure that you follow the demonstration through carefully,
and the best way to that is by following through yourself.
We're going to create our LDIF files, add entries,
and look at searching entries.
So here we are on our command line as a standard user.
We can go ahead and create our LDIF file. I'm just going to call it user.ldif.
Once we've created this file,
we can create it ourselves or we can cheat a little
bit and paste the information in.
Again,
the LDIF file is going to be available for you to
download through the course page.
But if I move to the top, we can see what we're doing.
In our first instance, we're creating our organizational unit,
People, and then below that with a clear line between each entry,
we're creating another organizational unit called Groups.
Inside of the Groups ou, we're creating a group called staff.
We see it's a posixGroup with a common name of staff and a group ID of 5000.
Below that, we create our user account.
Here the login name or user ID Is John, and it's based upon an inetOrgPerson,
posixAccount, and shadowAccount,
making sure that we've got all of the attributes necessary so we
can log in as a Linux user using this account.
The user ID is going to be the login name,
and then we've got things like a surname and given name,
a common name.
Now, we don't necessarily need these attributes,
but, of course,
we need a user ID number and a group ID number so these can be used by Linux.
Think of what we would normally have within our etc and shadow file.
As we continue down, we've got our userPassword.
The userPassword is commonly set up like this to
indicate that the password is not set.
We can set this later.
As we then go through, we're setting our gecos field,
our comment field, to the full name,
and then we've got our loginShell and homeDirectory.
We can go through and save the file.
Having saved the file,
then it's a matter of uploading it through to our directory.
And we can that with the ldapadd command.
We can use our simple authentication, ‑x,
but this time we're not going to connect as the anonymous user.
You can probably guess that user is not going to be allowed to
create objects or entries in the domain.
So we're using then our default administrative account.
We set the password during the installation,
so cn=admin,
‑w to prompt for a password and then ‑f so we can
specify the LDIF file that we are using.
We're prompted for the password,
remember the password that we set during the installation,
and we can see then that we've created those four objects.
So this is, of course, what we're expecting to see,
just be careful if you don't get the same output.
Having now created those entries,
we can go and take a look at searching to display those entries.
So again, the same thing as we saw before,
where we can go through and use ‑x,
but we should be able to use the anonymous account.
We can go through and specify the base DN to search for.
So again, we're going to search from example down,
and we can then specify what we want to search for.
We could search just for everything, just hit the Enter key at this stage,
but we can also then start including filters.
Our filters will go inside of our parentheses,
so we can say that we only want to see where the object class is,
then let's say an inetorgPerson,
one of the classes that we used to instantiate the John user.
As we again go through and close off our parentheses,
I'm just going to move this to the top of the screen.
So that bash doesn't interpret the parentheses in any other way,
we can quote this.
So we're passing it through, untouched by bash, to LDAP search.
If I don't put anything following the filter,
we would see all properties, but if we only want to see the common name,
then just put cn.
And we can see there then that we've got John Doe coming
back for the user that we've searched.
If I up arrow key and clear my screen again,
we could go ahead and maybe take out our initorgPerson,
change it to posixGroup, but this time we'll display all properties.
We don't have too many properties,
but you can see then that we've got our staff group,
the common name, and the group ID number.
Having created our user account, we just set a dummy hash for the password,
so we can now go through and set it properly.
So using the ldappasswd command,
we can go through again authenticating as our admin account.
So this is good, I can stay running, I don't even need the sudo command.
I can stay running as my ordinary Linux account,
the vagrant user, and, of course, I'm authenticating through to the LDAP system.
Having set up our authentication details,
we're then using the uppercase S to set the subject to the password change.
This is going to be our uid=john, ou=People,
this is case sensitive as well,
and we can then go through and paste in our dc=example,dc=com.
We put the uppercase W to prompt for our password.
Just be careful though,
we are first prompted for the password that we are setting for the John account.
So the first two prompts are for John's new password, it's the third
prompt where we're being asked for our own password.
It's very easy to get that wrong and then set your password
first and then the next two prompts you just go through and
put the password you want for John.
And they're probably not going to be the same,
so just be aware and read the screen carefully.
But look at this.
We've created our two new organizational units,
our new user, and set the password for that new user. We're well on our way to becoming LDAP administrators.