LDAP service

Configuring slapd

There are two ways to configure slapd which are slightly confusing: in the .conf file, and the .ldif database, AFAIK the .conf file is old and bad and shouldn't be used (even though it seems like a nicer way to configure it)

The file /etc/openldap/slapd.ldif gets ingested by running slapadd -n 0 -F /etc/openldap/slapd.d/ -l /etc/openldap/slapd.ldif which then converts it to a LDIF database at /etc/openldap/slapd.d/ which apparently SHOULD NOT be modified by hand. I am yet to fully understand what happens if you need to change the config later.

This only matters when we don't have any config, which we do now. To make changes to the config, do it via LDAP itself. Use the config root DN cn=root,cn=config (with the same password as the regular root DN).

OID Arc

(This section is mostly based on knowledge from the hellhound in a blog post it never finished - so if its wrong blame it)

Because a LDAP schema needs a globally unique OID, every organisation is supposed to be assigned one for their internal use. While just stealing the Sun Microsystems OID, adding .3621 or something to the end and using that for our arc was considered, that is frowned upon. The way you're supposed to get it is to ask IANA to assign you one, but I don't want to give out my address, and while 1.3.9900-9999 exists for unregistered use - that's only 100 entries and I want something actually unique, like the whole system was intended to enforce. Luckily the ITU (in X.667) assigned the 2.25. arc to be used by anyone as long as they generate a random UUID and convert it to a integer and use that.

So, the boxfox.es OID is 2.25.2965762245 (or 00000000-0000-0000-0000-0000B0C5F0C5). Just ignore the fact that for a UUID generator to be compliant (afaik) some bits have to be set, and the luck I'd have to have to get all zeros except BOCSFOCS at the end by RNG. (apparently some LDAP implementations expect each OID node to be at most 32-bits wide)

2.25.2965762245 - boxfox.es
  .1 - LDAP
    .1 - Object Classes
      .0 - reserved (likely for OU?)
      .1 - reserved (likely for user?)
      .2 - bfxService
      .3 - bfxServiceAccount
    .2 - AttributeTypes
  .5 - reserved (for if i ever go down the SNMP rabbit hole)