Installing OpenLDAP on OpenBSD

Install the OpenLDAP server package

To start slapd, configure it in /etc/openldap/slapd.conf then add the following line to /etc/rc.conf.local:

slapd_flags="-u _openldap"
	

and to /etc/rc.local (be sure to start it _before_ any daemon that may need it):

if [ "$slapd_flags" != "NO" -a -x /usr/local/libexec/slapd ]; then
    install -d -o _openldap /var/run/openldap
    /usr/local/libexec/slapd $slapd_flags
    echo -n ' slapd'
fi
	

Turn the daemon on at boot time

Do as it says. Into /etc/rc.local goes:

if [ "$slapd_flags" != "NO" -a -x /usr/local/libexec/slapd ]; then
    install -d -o _openldap /var/run/openldap
    /usr/local/libexec/slapd $slapd_flags -h "$slapd_URLs"
    echo -n ' slapd'
fi
	 

And into /etc/rc.conf.local:

slapd_URLs="ldap://127.0.0.1 ldaps://127.0.0.1 ldap://10.0.12.1 ldaps://10.0.12.1 ldap://10.0.13.1 ldaps://10.0.13.1"
slapd_flags="-u _openldap -g _openldap -4"
	 

Note

Note that the separation of flags and URLs is a trick to make slapd behave as it should. I haven't figured it out yet, but it seems to me that the routine used to parse the command line (optargs?) is a bit picky on OpenBSD. When started from the command line, slapd -h ldap://127.0.0.1 ldap://10.0.41.1 only starts a listener at the localhost interface, and the second URL is silently ignored. To start both listeners, slapd -h "ldap://127.0.0.1 ldap://10.0.41.1" should be used. However, when run fro a script, both versions fail. The first case hasn't changed, and in the second case, slapd rejects the parameters on the premise that a double quote is not recognized in an URL list. Only when quoted as in /etc/rc.local above does the command succeed, presumably because the shell expands the double quotes, but still delivers the string that contains the URLs as a single positional parameter to slapd.

Configure the service

Now configure in /etc/openldap/slapd.conf:

include         /etc/openldap/schema/core.schema

pidfile         /var/run/openldap/slapd.pid
argsfile        /var/run/openldap/slapd.args

database        ldbm
suffix          "dc=mydomain"
rootdn          "cn=boss,dc=mydomain"
rootpw          secret
directory       /var/openldap-data
index   objectClass     eq

loglevel 239
	

Configure the firewall

Edit /etc/pf.conf:

pass in log on $intranet_if proto {tcp, udp} from $intranet to $intranet_if:0 port { ldap, ldaps }
	

and restart the firewall: sudo pfctl -f /etc/pf.conf

And start the daemon

	Note
	Note that the double quotes are necessary, or the daemon will only listen on the loopback interface (see

Test whether the server can be contacted:

On the client:

Put some content in the tree

On the client, try:

If that succeeds, pick the entry method of your choice. I'm using luma.