Set up LDAP for a source control integration server

Using LDAP on an integration server can speed up performance for users.

1. Ensure that the following RPMs are installed:
   • openldap
   • openldap-clients
   • openldap-servers
2. Verify that /etc/openldap/cacerts exists.
3. In the /etc/openldap/slapd.conf file, change the following values:

   Option	Value
   suffix	"dc=teamforge,dc=com"
   rootdn	"cn=Admin,dc=teamforge,dc=com"
   rootpw	sfee
   sizelimit	30000

   Tip: To supply an encrypted password instead of clear text for rootpw, run the command

   • slappasswd

   You are prompted for a password, and a string that looks like the following is displayed:

   {SSHA} 7hC2H5OoEZOaT6rL3hAvyxy11jrZYB2

   Use that string instead of the sfee used in the rootpw example.

4. Configure the LDAP service to start on boot.
   • chkconfig --level 345 ldap on
5. Make sure the LDAP database directory is clean and has the correct permissions.
   • rm -f /var/lib/ldap/* chown -R ldap.ldap /var/lib/ldap
6. Start the LDAP server.
   • /etc/init.d/ldap start
7. Create an initial LDIF (LDAP Interchange Format) file for your groups.
   Important: Make sure no lines in the ldif content start with white space.

   Refer to the following for LDIF content:

   • dn: dc=teamforge,dc=com dc: teamforge objectClass: top objectClass: domain dn: ou=Users,dc=teamforge,dc=com ou: Users objectClass: organizationalUnit dn: ou=Groups,dc=teamforge,dc=com ou: Groups objectClass: organizationalUnit dn: cn=sfee,ou=Groups,dc=teamforge,dc=com cn: sfee objectClass posixGroup gidNumber: 30000
8. Add the LDIF information.
   • ldapadd -x -D cn=Admin,dc=teamforge,dc=com -W < initial.ldif

   When you are prompted for a password, type the password you used in slapd.conf.

9. Manually remove groups and users created by CollabNet TeamForge from /etc/group and /etc/passwd. These are usually grouped at the end of the respective files. The groups include sfall, sfunrest, and all groups named reps with a numeric suffix (for example: reps1001).
   Note:

   • If users are left in the /etc/passwd or /etc/shadow files, those users may get permission errors when committing code to repositories on that integration server.
   • If groups created by an old TeamForge version are left in the /etc/group and /etc/gshadow files, users of those groups may get permission errors when checking in. If groups are removed from these files, a synchronize external system call will be required to restore correct permissions.
10. Configure the server to authenticate from LDAP.
    1. Open the authentication GUI tool with the authconfig command.
    2. Select Use LDAP.
    3. Specify the base DN and server.
       Note: Do not select Use TLS.
    4. Click Next.
    5. Select Use LDAP Authentication. Fill in the DlDAP basedn and host information.
    6. Click OK.
    This program modifies some /etc/pam.d entries and writes out a valid /etc/ldap.conf file.
11. Restart sshd.
    • /etc/init.d/sshd restart
12. In /etc/nsswitch.conf, verify that the passws, shadow, and group entries look like this: passwd: files ldap shadow: files ldap group: files ldap
13. Verify that /etc/ldap.conf contains these values: nss_base_passwd ou=Users,dc=teamforge,dc=com?one nss_base_shadow ou=Users,dc=teamforge,dc=com?one nss_base_group ou=Groups,dc=teamforge,dc=com?one pam_filter objectClass=posixAccount pam_login_attribute uid
14. Log onto the integration server.
15. To configure the CollabNet TeamForge integration server to update LDAP, add these entries to /conf/site-options.conf:

    Entry	Value	Description
    CVS_LDAP_HOST	localhost	The host of the LDAP server.
    CVS_LDAP_PORT	389	The port of the LDAP server.
    CVS_LDAP_USERS_DN	Example: ou=Users,dc=teamforge,dc=com	Schema address that users are added into.
    CVS_LDAP_GROUPS_DN	Example: ou=Groups,dc=teamforge,dc=com	Schema address that groups are added into.
    CVS_LDAP_USERS_STARTID	30000	The numeric userid to start counting from when creating new users.
    CVS_LDAP_GROUPS_STARTID	30005	The numeric groupid to start counting from when creating new groups.
    CVS_LDAP_BIND_DN	Example: cn=Admin,dc=teamforge,dc=com	The "root dn" for the LDAP server. This must be the value specified in slapd.conf.
    CVS_LDAP_BIND_PASSWORD		The password for the root dn.
    INTEGRATION_OS	linux_ldap
    CVS_USER_DEFAULT_GROUP	sfee

16. Restart the integration server.
    • /opt/collabnet/teamforge/runtime/scripts/teamforge-integration-init.sh restart
17. Log into the CollabNet TeamForge site's web interface as site administrator.
18. On the Integration Systems page, synchronize permissions for all managed source code integration servers.
    Note: Running synchronize permissions will send email to your entire user community. This occurs because the users need to click on the link in the email to set their LDAP password (by entering their current SoureceForge password). The password cannot be set automatically during migration because only the encrypted version is available.
19. When synchronize permissions has completed, correct the permissions on the home directories of your users. On each source code server that you have converted to LDAP, run these commands:
    • cd /home for i in * do chown -R $i.root $i done
    Note: You may see some errors. This is normal and indicates disabled/deleted users.