NetworkAuthServer
Please check the status of this specification in Launchpad before editing it. If it is Approved, contact the Assignee or another knowledgeable person before making changes.
Launchpad entry: https://features.launchpad.net/distros/ubuntu/+spec/edubuntu-network-auth-server
Packages affected: edubuntu-server
Summary
Integrate network authentication by default into edubuntu servers.
Attendees
sbalneav, ogra, moquist, RichEd, eharrison, rodarvus, pips1, dtrask, wasabi , jammcq, ajmitch, stgraber (VOIP)
Rationale
Many schools we wish to deploy to manage their users and groups using LDAP. Currenly, Edubuntu doesn't fit into these environments easily, because we don't have automatic installation of tools that will enable this. If we wish to make a dent in these markets, we'll need this functionality.
Use cases
Dave Trask manages a single-building K-8 school network. His principal gives him a list of students, and he installs Edubuntu Authentication Services (EAS) and uses http://majen.net/smbldap smbldap-useradd-bulk to create user accounts in one fell swoop.
- Scottie administers a school with 2000 users, and he needs more than one Edubuntu/LTSP server to handle the workload. Scottie installs EAS and sets other Edubuntu/LTSP servers to authenticate there, and all users have single-sign on with centralized home directories. Job done!
- Mabel runs a heterogeneous network including Ubuntu, Windows, and Mac workstations. When an EAS server is in place, a user can sit down at any workstation and log in with the same username and password, and access the same home directory.
- Nikita administers the network for a school district with three buildings connected via a WAN. Nikita sets up an EAS master in the largest school and an EAS slave in each other school. Users can move from building to building and continue to use the same usernames, passwords, and home directories.
Scope
- provide single-sign on services for Linux/Windows/Mac OOTB
- provide GUI user managment
- provide a single home directory for each user that can be accessed from any Linux/Windows/Mac client
Packages affected
- smbldap-tools
- slapd
- nscd
- libnss-ldap
- libpam-ldap
- samba
Design and Implementation
- Move smbldap-tools which is used widely in k12LTSP setups for user and group management to main.
Package and install http://edsadmin.sourceforge.net/ as maintenance tool for the above server setup.
- moquist has done much work on smbldap-installer, which installs and configures smbldap-tools with openLDAP. Prepend useradd, group tools with smbldap-, and CLI user management works as per normal. We will integrate smbldap-tools into edubuntu so it works out of the box.
Create a configuration metapackage called edubuntu-auth-server which depends on the above listed packages and properly integrates the configuration created by smbldap-installer from http://www.majen.net/smbldap/ into edubuntu.
- Hide the usual user-management GUI tools from the menus and put esdadmin in their place through the postinst script of our config metapackage.
- Use preseeding for the dependant packages where possible (libnss-ldap, libpam-ldap)
- For the packages where preseeding isnt possible or desired (i.e. slapd and samba) the package will have an /etc/edubuntu-auth-server dir. Config files in this dir will override the default configuration (i.e. the initscript of slapd will be modified to use the slapd.conf file from this directory if it exists instead of its default file... very much like /etc/ltsp/dhcpd.conf does for dhcp3-server)
- For caching, we'll make sure nscd is installed.
- For now, we'll only concern ourselves with dealing with other Edubuntu (smbldap-tools+{openLDAP,FDS}) servers. Feisty+1 we'll deal with true enterprise-level server considerations (e.g., failover) and AD integration or switch to the solution the ubuntu-directory team will provide by then (plan is to operate as guineapig for the directory team with our setup so they have experience data to base their server implementation on.
- The e-a-s package will have a preseedable debconf option to set the domain name, this question needs to have the necessary priority to be asked in the installer.
- A crontab entry will be put into /etc/cron.d which backs up the ldap database on a regular base.
- /home will be added to /etc/exports on the server to provide the NFS mounts to the e-a-s clients.
Data preservation and migration
- A script will be shipped in the /usr/share/doc/e-a-s/examples dir to easily migrate an existing /etc/passwd, shadow and group into an installed EAS.
Unresolved issues
- We may consider FDS instead of OpenLDAP for later releases; needs much discussion.