LDAPAuthentication
Please check the status of this specification in Launchpad before editing it. If it is Approved, contact the Assignee or another knowledgeable person before making changes.
Launchpad Entry: ldap-authentication-client
Packages affected: libpam-ldap, libnss-pam
Summary
Currently, in Ubuntu and Debian the packages libpam-ldap and libnss-ldap create separate configuration files and secret files. A ldap-auth-config package will be created that owns /etc/ldap.conf and /etc/ldap.secret. libpam-ldap and libnss-pam will depend on ldap-auth-config. An ldap-auth-config meta package will be created that depends on libpam-ldap, libnss-ldap. The ldap-auth-client meta source package will contain the ldap-auth-config package.
Release Note
ldap-auth-client enables simplified installation and configuration of LDAP client systems.
Rationale
It is currently difficult to configure an Ubuntu client to use LDAP for authentication. It is a good idea to put all necessary packages and configuration under one meta package, to allow easier installation and configuration.
Use Cases
A medium size business has existing Linux/UNIX infrastructure that uses LDAP for authentication, and wants to use Ubuntu as a desktop client, to replace Redhat. The Sys admin wants to provide simple instructions for jr admins to add clients to the network.
Bob wants to use LDAP for NSS on a SMTP server, but want to authenticate locally.
Alice configured openldap as a client in Dapper or Feisty, and wants to upgrade to Gutsy.
Assumptions
libpam-ldap and libnss-ldap, which are linked to openldap2.1, will at least be minimally useful when used with an openldap2.3 server, or other ldap implementation.
There are no packages not identified in the spec that rely on the current libpam-ldap or libnss-ldap configuration files.
Design
Implementation
libpam-ldap
Remove the following files from the package:
debian/patches/00chfn.patch
debian/patches/00chsh.patch
Modify debian/rules to prevent the following files from being created:
/etc/pam_ldap.conf
/etc/pam_ldap.secret
Modify debian/libpam-ldap.postinst to remove configuration information, which will be handled instead by ldap-auth-config.
Add ldap-auth-config dependancy to debian/control.
libnss-ldap
Remove the following files from the package:
debian/patches/00debian_conf.patch
Modify 00debian_conf.patch to specify the default location and name of ldap.secrets.
Modify debian/rules to prevent the following files from being created:
/etc/libnss-ldap.conf
/etc/libnss-ldap.secret
Modify debian/libnss-ldap.postinst to remove configuration information, which will be handled instead by ldap-auth-config.
Add ldap-auth-config dependancy to debian/control.
ldap-auth-client
Create a ldap-auth-client meta package that depends on libnss-ldap and libpam-ldap.
ldap-auth-config
Create a package that will install and configure /etc/ldap.conf and /etc/ldap.secret
Migration
Conflict resolution
If pam_ldap.so exists in common-auth and ldap exists in nssswitch.conf and they differ:
- use pam_ldap.conf and warn
If pam_ldap.so !exist in common-auth and ldap exists in nssswitch.conf:
- use libnss-ldap.conf
Test/Demo Plan
It's important that we are able to test new features, and demonstrate them to users. Use this section to describe a short plan that anybody can follow that demonstrates the feature is working. This can then be used during CD testing, and to show off after release.
This need not be added or completed until the specification is nearing beta.
Outstanding Issues
This should highlight any issues that should be addressed in further specifications, and not problems with the specification itself; since any specification with problems cannot be approved.
BoF agenda and discussion
Use this section to take notes during the BoF; if you keep it in the approved spec, use it for summarising what was discussed and note any options that were rejected.