Option 1: installing your own 389-ds

Installing your own(instructions from Fedora Core 11):

1. sudo su -

2. yum install 389-ds

3. setup-ds-admin.pl

   1. Option (2) Typical

   2. Fully qualified host name. Ex. test.youserver.com. Might just work with an ip address as well.

   3. System User (nobody)

   4. System Group (nobody)

   5. Do you want to register this software with an existing
      configuration directory server? (no)

   6. Administrator ID (admin)

   7. Password x 2 (something you pick)

   8. Administrator Domain (yourserver.com)

   9. Directory server network port (389)

   10. Directory server identifier (test)

   11. Suffix (dc=yourserver,dc=com)

   12. Directory manager DN (cn=Directory Manager)

   13. Password x 2 (something you pick)

   14. Administrator port (9830)

   15. Finish

4. Server and Directory server should be running, if not use

   1. /etc/init.d/dirsrv start

   2. /etc/init.d/dirsrv-admin start

5. On Fedora 15 and later, if the admin server fails to start due to a segmentation fault, the following workaround should fix things: http://lists.fedoraproject.org/pipermail/389-users/2012-January/013960.html

6. /usr/bin/389-console # start up admin console GUI

   1. User ID: admin

   2. Password : from above

   3. Administration URL: http://localhost:9830/

      1. Expand 'Server and Applications'-> your domain -> your server -> Server Group -> Directory Server and hit (Open).

      2. If you get an error similar to "Failed to install a local copy of 389-ds-1.2.3.jar or one of its supporting files. Please ensure that the appropriate console package is installed on the Administration Server. 389-ds-1.2.3.jar not found at http://localhost:9830/" here, then you probably have upgraded Fedora one or more times since you setup your 389 instance. The way to fix this is to blow away your instance config by running "sudo /usr/sbin/remove-ds-admin.pl -y" and then recreate it by running "sudo setup-ds-admin.pl" again.

      3. Directory Server expand 'your server' -> 'your domain' -> Groups.

         1. Create a new test user 'testuser1' in 'People'.

You should now have enough to test your integration with RHQ.

1. Log into RHQ with rhqadmin rights. Navigate to 'System' -> 'Settings' and populate the fields like 'Correct Configuration' Screenshot using your test user credentials. Settings slightly different for Active Directory. You should now be able to follow along with 'How LDAP Group Authorization Works' from LDAP overview, and finally test ldap authorization by attempting to log into rhq using your test user credentials(Ex. u:testuser1 p:pass1).

Option 2: Apache Directory Studio

Apache Directory Studio is an Eclipse RCP application for LDAP browsing. But it can also easily create an ApacheDS server for you.

1. First download Apache Directory Studio

2. Start it

3. In the "LDAP Servers" view right click to create a new server and choose ApacheDS 2.0.0 server type

4. Start the server and right click on the server line to create an associated connection

5. You should see new entries in the "LDAP Navigator" view and should be able to browse your LDAP content

6. Click the server line to open the config view

   • You can see ApacheDS listens to LDAP requests on port 10389

For further information please read Apache Directory Studio documentation

There are also plenty of tutorials on the web on how to create an LDAP structure.

Troubleshooting

LDAP is all about attributes. Getting the right attributes that work with your server can be initially confusing if you're not familiar with it. Download and run the following executable Jar 'TestLdapSettings.jar' to interactively mimic the LDAP calls to your external server if you're having difficulty getting the right configuration settings.

1. Requires JDK 1.6 or better.

   1. java -jar TestLdapSettings.jar