7. LDAP

OpenCA provides an LDAP interface for users to download certificates from a central repository. This interface can be utilised by browser address books and specialised LDAP clients.

Before the OpenCA Online components can write certificates and CRLs to the directory you must have an LDAP compliant directory installed and available to the online components (this can be on the same or different machine). One example of an appropriate directory is the OpenLDAP project.

7.1. Configuration of the Directory

A full description of the configuration of your LDAP directory is outside the scope of this document. Important points to note are:
  • Ensure that the following schemas are included (probably in the slapd.conf file):
    • core.schema

    • cosine.schema

    • inetorgperson.schema

    • openca.schema

  • Ensure the directory is started with the appropriate suffix (e.g. o=myorg,c=gb).

  • Ensure the rootdn is specified.

  • Ensure the root password is specified.

7.2. Configuration of the online components

Three configuration files must be configured for the online components to make use of the LDAP directory to store certificates; OPENCADIR/etc/servers/node.conf, OPENCADIR/etc/servers/ldap.conf and OPENCADIR/etc/ldap.xml. If you don't understand the configuration options then please read Chapter 15, LDAP in the technology guide for more informations. Usually it is enough to set the correct options in ldap.xml or in config.xml.

7.3. Writing Certificates to the Directory

As long as the option updateLDAPautomatic is set to yes the online components will attempt to upload certificates to the directory after an import. Before this can happen the directory must be initialised and the appropriate structure must be implemented. In this version of OpenCA this initialization is done automatically.

7.4. Adding an attribute to the LDAP schema

The common situation in large directory projects is a big schema and at the end a small request for certificate integration. This is usually no problem if OpenCA has to create and add certificates to an existent and filled LDAP server. OpenCA gets a problem if you want that OpenCA initialize this LDAP server and should create all missing nodes in the directory tree. If this is the case then you must integrate your schema specification into OpenCA's ldap configuration. You can find this schema specification in ldpa.xml. The path to the schema specification is openca/ldap/schema.

First you have to understand the general design of OpenCA's LDAP schema support. We have a very pragmatical idea of directory trees because it is not possible to handle all full featured ideas. We simply use the least significant attribute to select an appropriate schema definition for a distinguished name. Do you want to know what this mean? If you have a RFC 2253 conform distinguished name then you take the RDN on the left side. The used attribute type is used to detect the appropriate schema.

Before you can select a schema with the atribute type you must know what you want to create for a node in the directory tree. If the used distinguished name is the complete subject of a certificate then you must select the schema specification from the XML path openca/ldap/schema/certificate. Otherwise you you have to use openca/ldap/schema/default. If you need to store a CA certificate then you must specify the schema in openca/ldap/schema/ca.

Every RDN entry in the described sections specifies the characteristics for one attributetype. This include things like required (must) or optional (may) attributes and used objectclasses (structural and auxiliary). If you have for example a new attributetype uid_special and a new class MY_CLASS then your RDN section for certificates with this attributetype as last one should looks like this. OpenCA's schema definition is perhaps not so flexible as you need but we are open for new ideas. Be free to mail us your ideas. If they are not too proprietary then perhaps we can integrate them :)