LDAP Account Manager (LAM) manages user, group and host accounts in an LDAP directory. LAM runs on any webserver with PHP5 support and connects to your LDAP server unencrypted or via SSL/TLS. Currently LAM supports these account types: Samba 3, Unix, Kolab 2, address book entries, NIS mail aliases and MAC addresses. There is a tree viewer included to allow access to the raw LDAP attributes. You can use templates for account creation and use multiple configuration profiles. LAM is translated to Catalan, Chinese (Traditional + Simplified), Czech, Dutch, English, French, German, Hungarian, Italian, Japanese, Polish, Portuguese, Russian and Spanish. http://www.ldap-account-manager.org/ Copyright (C) 2003 - 2012 Roland Gruber <post@rolandgruber.de> Key features: managing user/group/host/domain entries account profiles account creation via file upload multiple configuration profiles LDAP browser schema browser OU editor PDF export for all accounts manage user/group Quota and create home directories Requirements: PHP5 (>= 5.2.4) Openldap (2.0 or greater) A recent web browser that supports CSS2 and JavaScript, at minimum: Firefox 3 Internet Explorer 8 (compatibility mode turned off) Opera 10 The default password to edit the configuration options is "lam". License: LAM is published under the GNU General Public License. The complete list of licenses can be found in the copyright file. Default password: The default password for the LAM configuration is "lam". Have fun! The LAM development team There are basically two groups of users for LAM: LDAP administrators and support staff: These people administer LDAP entries like user accounts, groups, ... Users: This includes all people who need to manage their own data inside the LDAP directory. E.g. these people edit their contact information with LAM self service (LAM Pro). Therefore, LAM is split into two separate parts, LAM for admins and for users. LAM for admins allows to manage various types of LDAP entries (e.g. users, groups, hosts, ...). It also contains tools like batch upload, account profiles, LDAP schema viewer and an LDAP browser. LAM for users focuses on end users. It provides a self service for the users to edit their personal data (e.g. contact information). The LAM administrator is able to specify what data may be changed by the users. The design is also adaptable to your corporate design. LAM for admins/users is accessible via HTTP(S) by all major web browsers (Firefox, IE, Opera, ...). LAM runtime environment: LAM runs on PHP. Therefore, it is independant of CPU architecture and operating system (OS). You can run LAM on any OS which supports Apache or other PHP compatible web servers. Home directory server: You can manage user home directories and their quotas inside LAM. The home directories may reside on the server where LAM is installed or any remote server. The commands for home directory management are secured by SSH. LAM will use the user name and password of the logged in LAM administrator for authentication. LDAP directory: LAM connects to your LDAP server via standard LDAP protocol. It also supports encrypted connections with SSL and TLS.

LAM has the following requirements to run: Apache webserver (SSL recommended) with PHP module (PHP 5 (>= 5.2.4) with ldap, gettext, xml and optional mcrypt) Some LAM plugins may require additional PHP extensions (you will get a note on the login page if something is missing) Perl (optional, needed only for lamdaemon) OpenLDAP (>2.0) A recent web browser that supports CSS2 and JavaScript, at minimum: Firefox 3 Internet Explorer 8 (compatibility mode turned off) Opera 10 MCrypt will be used to store your LDAP password encrypted in the session file. See LDAP schema fles for information about used LDAP schema files.

LAM is available as prepackaged version for various platforms.

LAM is part of the official Debian repository. New releases are uploaded to unstable and will be available automatically in testing and the stable releases. You can run apt-get install ldap-account-managerto install LAM on your server. Additionally, you may download the latest LAM Debian packages from the LAM homepage or the Debian package homepage.Installation of the latest packages on Debian Squeeze Install php-fpdf 1.7.dfsg-1 from here: http://packages.debian.org/wheezy/all/php-fpdf/download Install the LAM package dpkg -i ldap-account-manager_*.deb Install the lamdaemon package (optional) dpkg -i ldap-account-manager-lamdaemon_*.deb

There are RPM packages available on the LAM homepage. The packages can be installed with these commands:rpm -e ldap-account-manager ldap-account-manager-lamdaemon (if an older version is installed)rpm -i <path to LAM package>

The RPM packages for Suse/Fedora are very generic and should be installable on other RPM-based distributions, too. The Fedora packages use apache:apache as file owner and the Suse ones use wwwrun:www.

LAM is part of the official FreeBSD ports tree. For more details see these pages:FreeBSD-SVN: http://svnweb.freebsd.org/ports/head/sysutils/ldap-account-manager/FreshPorts: http://www.freshports.org/sysutils/ldap-account-manager

Please extract the archive with the following command: tar xzf ldap-account-manager-<version>.tar.gz

Copy the files into the html-file scope of the web server. For example /apache/htdocs. Then set the appropriate file permissions: lam/sess: write permission for apache user lam/tmp: write permission for apache user lam/config (with subdirectories): write permission for apache user lam/lib: lamdaemon.pl must be set executable

Instead of manually copying files you can also use the included configure script to install LAM. Just run these commands in the extracted directory: ./configure make install Options for "./configure": --with-httpd-user=USER USER is the name of your Apache user account (default httpd) --with-httpd-group=GROUP GROUP is the name of your Apache group (default httpd) --with-web-root=DIRECTORY DIRECTORY is the name where LAM should be installed (default /usr/local/lam)

Copy config/config.cfg_sample to config/config.cfg and config/lam.conf_sample to config/lam.conf. Open the index.html in your web browser: Follow the link "LAM configuration" from the start page to configure LAM. Select "Edit general settings" to setup global settings and to change the master configuration password (default is "lam"). Select "Edit server profiles" to setup your server profiles. There should be the lam profile which you just copied from the sample file. The default password is "lam". Now change the settings to fit for your environment.

LAM runs with PHP5 (>= 5.2.4). Needed changes in your php.ini: memory_limit = 64M If you run PHP with activated Suhosin extension please check your logs for alerts. E.g. LAM requires that "suhosin.post.max_name_length" and "suhosin.request.max_varname_length" are increased (e.g. to 256).

If you want to use a translated version of LAM be sure to install the needed locales. The following table shows the needed locales for the different languages. Language Locale Catalan ca_ES.utf8 Chinese (Simplified) zh_CN.utf8 Chinese (Traditional) zh_TW.utf8 Czech cs_CZ.utf8 Dutch nl_NL.utf8 English no extra locale needed French fr_FR.utf8 German de_DE.utf8 Hungarian hu_HU.utf8 Italian it_IT.utf8 Japanese ja_JP.utf8 Polish pl_PL.utf8 Portuguese pt_BR.utf8 Russian ru_RU.utf8 Slovakian sk_SK.utf8 Spanish es_ES.utf8 You can get a list of all installed locales on your system by executing: locale -a Debian users can add locales with "dpkg-reconfigure locales".

Upgrading from LAM to LAM Pro is like installing a new LAM version. Simply install the LAM Pro packages/tar.gz instead of the LAM ones.

Backup configuration files Configuration files need only to be backed up for .tar.gz installations. DEB/RPM installations do not require this step. LAM stores all configuration files in the "config" folder. Please backup the following files and copy them after the new version is installed. config/*.conf config/config.cfg config/pdf/*.xml config/profiles/* LAM Pro only: config/selfService/*.* Uninstall current LAM (Pro) version If you used the DEB/RPM installation packages then remove the ldap-account-manager and ldap-account-manager-lamdaemon packages. Otherwise, remove the folder where you installed LAM via configure or by copying the files. Install new LAM (Pro) version Please install the new LAM (Pro) release. Skip the part about setting up LAM configuration files. Restore configuration files This step can be skipped if you installed the DEB/RPM packages. Please restore your configuration files from the backup. Copy all files from the backup folder to the config folder in your LAM Pro installation. Do not simply replace the folder because the new LAM (Pro) release might include additional files in this folder. Overwrite any existing files with your backup files. Final steps Now open your webbrowser and point it to the LAM login page. All your settings should be migrated. Please check also the version specific instructions. They might include additional actions.

The account profiles and PDF structures are now separated by server profile. This means that if you edit e.g. an account profile in server profile A then this change will not affect the account profiles in server profile B. LAM will automatically migrate your existing files as soon as the login page is loaded. Special install instructions: Debian: none, config files will be migrated when opening LAM's login page Suse/Fedora RPM: Run "rpm -e ldap-account-manager ldap-account-manager-lamdaemon" You may get warnings like "warning: /var/lib/ldap-account-manager/config/profiles/default.user saved as /var/lib/ldap-account-manager/config/profiles/default.user.rpmsave" Please rename all files "*.rpmsave" and remove the file extension ".rpmsave". E.g. "default.user.rpmsave" needs to be renamed to "default.user". Install the LAM packages with "rpm -i". E.g. "rpm -i ldap-account-manager-4.0-0.suse.1.noarch.rpm". Open LAM's login page in your browser to complete the migration tar.gz: standard upgrade steps, config files will be migrated when opening LAM's login page

No changes.

Asterisk extensions: The extension entries are now grouped by extension name and account context. LAM will automatically assign priorities and set same owners for all entries.

Debian users: LAM 3.6 requires to install FPDF 1.7. You can download the package here. If you use Debian Stable (Squeeze) please use the package from Testing (Wheezy).

LAM Pro: The global config/passwordMailTemplate.txt is no longer supported. You can setup the mail settings now for each LAM server profile which provides more flexibility. Suse/Fedora RPM installations: LAM is now installed to /usr/share/ldap-account-manager and /var/lib/ldap-account-manager. Please note that configuration files are not migrated automatically. Please move the files from /srv/www/htdocs/lam/config (Suse) or /var/www/html/lam/config (Fedora) to /var/lib/ldap-account-manager/config.

No changes.

If you use custom images for the PDF export then these images need to be 5 times bigger than before (e.g. 250x250px instead of 50x50px). This allows to use images with higher resolution.

No changes.

LAM supported to set a list of valid workstations on the "Personal" page. This required to change the LDAP schema. Since 3.1.0 this is replaced by the new "Hosts" module for users. Lamdaemon: The sudo entry needs to be changed to ".../lamdaemon.pl *".

No changes.

LAM Pro: There is now a separate account type for group of (unique) names. Please edit your server profiles to activate the new account type.

No changes.

If you used the prepackaged installation packages then remove the ldap-account-manager and ldap-account-manager-lamdaemon packages. Otherwise, remove the folder where you installed LAM via configure or by copying the files.

After you installed LAM you can configure it to fit your needs. The complete configuration can be done inside the application. There is no need to edit configuration files. Please point you browser to the location where you installed LAM. E.g. for Debian/RPM this is http://yourServer/lam. If you installed LAM via the tar.gz then this may vary. You should see the following page: If you see an error message then you might need to install an additional PHP extension. Please follow the instructions and reload the page afterwards. Now you are ready to configure LAM. Click on the "LAM configuration" link to proceed. Here you can change LAM's general settings, setup server profiles for your LDAP server(s) and configure the self service (LAM Pro). You should start with the general settings and then setup a server profile.

After selecting "Edit general settings" you will need to enter the master configuration password. The default password for new installations is "lam". Now you can edit the general settings.

Here you can set a time period after which inactive sessions are automatically invalidated. The selected value represents minutes of inactivity. You may also set a list of IP addresses which are allowed to access LAM. The IPs can be specified as full IP (e.g. 123.123.123.123) or with the "*" wildcard (e.g. 123.123.123.*). Users which try to access LAM via an untrusted IP only get blank pages.

This allows you to specify a central password policy for LAM. The policy is valid for all password fields inside LAM admin (excluding tree view) and LAM self service. Configuration passwords do not need to follow this policy. You can set the minimum password length and also the complexity of the passwords.

LAM can log events (e.g. user logins). You can use system logging (syslog for Unix, event viewer for Windows) or log to a separate file. Please note that LAM may log sensitive data (e.g. passwords) at log level "Debug". Production system should be set to "Warning" or "Error".

If you would like to change the master configuration password then enter a new password here.

The server profiles store information about your LDAP server (e.g. host name) and what kind of accounts (e.g. users and groups) you would like to manage. There is no limit on the number of server profiles. See the typical scenarios about how to structure your server profiles.

Select "Manage server profiles" to open the profile management page. Here you can create, rename and delete server profiles. The passwords of your server profiles can also be reset. You may also specify the default server profile. This is the server profile which is preselected at the login page. It also specifies the language of the login and configuration pages. You can create a new server profile by simply entering its name and password. After you created a new profile you can go back to the profile login and edit your new server profile. All operations on the profile management page require that you authenticate yourself with the configuration master password.

Please select you server profile and enter its password to edit a server profile. Each server profile contains the following information: General settings: general settings about your LDAP server (e.g. host name and security settings) Account types: list of account types (e.g. users and groups) that you would like to manage and type specific settings (e.g. LDAP suffix) Modules: list of modules which define what account aspects (e.g. Unix, Samba, Kolab) you would like to manage Module settings: settings which are specific for the selected account modules on the page before

Here you can specify the LDAP server and some security settings. The server address of your LDAP server can be a DNS name or an IP address. Use ldap:// for unencrypted LDAP connections or TLS encrypted connections. LDAP+SSL (LDAPS) encrypted connections are specified with ldaps://. The port value is optional. TLS cannot be combined with ldaps://. LAM includes an LDAP browser which allows direct modification of LDAP entries. If you would like to use it then enter the LDAP suffix at "Tree suffix". The search limit is used to reduce the number of search results which are returned by your LDAP server. The access level specifies if LAM should allow to modify LDAP entries. This feature is only available in LAM Pro. LAM non-Pro releases use write access. See this page for details on the different access levels. LAM is translated to many different languages. Here you can select the default language for this server profile. The language setting may be overriden at the LAM login page. LAM can manage user home directories and quotas with an external script. You can specify the home directory server and where the script is located. The default rights for new home directories can be set, too. LAM supports two methods for login. The first one is to specify a fixed list of LDAP DNs that are allowed to login. Please enter one DN per line. The second one is to let LAM search for the DN in your directory. E.g. if a user logs in with the user name "joe" then LAM will do an LDAP search for this user name. When it finds a matching DN then it will use this to authenticate the user. The wildcard "%USER%" will be replaced by "joe" in this example. This way you can provide login by user name, email address or other LDAP attributes. Additionally, you can enable HTTP authentication when using "LDAP search". This way the web server is responsible to authenticate your users. LAM will use the given user name + password for the LDAP login. You can also configure this to setup advanced login restrictions (e.g. require group memberships for login). To setup HTTP authentication in Apache please see this link and an example for LDAP authentication here. You may also change the password of this server profile. Please just enter the new password in both password fields.

LAM supports to manage various types of LDAP entries (e.g. users, groups, DHCP entries, ...). On this page you can select which types of entries you want to manage with LAM. The section at the top shows a list of possible types. You can activate them by simply clicking on the plus sign next to it. Each account type has the following options: LDAP suffix: the LDAP suffix where entries of this type should be managed List attributes: a list of attributes which are shown in the account lists Additional LDAP filter: LAM will automatically detect the right LDAP entries for each account type. This can be used to further limit the number of visible entries (e.g. if you want to manage only some specific groups). Hidden: This is used to hide account types that should not be displayed but are required by other account types. E.g. you can hide the Samba domains account type and still assign domains when you edit your users. On the next page you can specify in detail what extensions should be enabled for each account type.

The modules specify the active extensions for each account type. E.g. here you can setup if your user entries should be address book entries only or also support Unix or Samba. Each account type needs a so called "base module". This is the basement for all LDAP entries of this type. Usually, it provides the structural object class for the LDAP entries. There must be exactly one active base module for each account type. Furthermore, there may be any number of additional active account modules. E.g. you may select "Personal" as base module and Unix + Samba as additional modules.

Depending on the activated account modules there may be additional configuration options available. They can be found on the "Module settings" tab. E.g. the Personal account module allows to hide several input fields and the Unix module requires to specify ranges for UID numbers.

This is a list of typical scenarios how your LDAP environment may look like and how to structure the server profiles for it.

This is the easiest and most common scenario. You want to manage a single LDAP server and there is only one or a few admins. In this case just create one server profile and you are done. The admins may be either specified as a fixed list or by using an LDAP search at login time.

Large organisations may have one big LDAP directory for all user/group accounts. But the users are managed by different groups of admins (e.g. departments, locations, subsidiaries, ...). The users are typically divided into organisational units in the LDAP tree. Admins may only manage the users in their part of the tree. In this situation it is recommended to create one server profile for each admin group (e.g. department). Setup the LDAP suffixes in the server profiles to point to the needed organisational units. E.g. use ou=people,ou=department1,dc=company,dc=com or ou=department1,ou=people,dc=company,dc=com as LDAP suffix for users. Do the same for groups, hosts, ... This way each admin group will only see its own users. You may want to use LDAP search for the LAM login in this scenario. This will prevent that you need to update a server profile if the number of admins changes. Attention: LAM's feature to automatically find free UIDs/GIDs for new users/groups will not work in this case. LAM uses the user/group suffix to search for already assigned UIDs/GIDs. As an alternative you can specify different UID/GID ranges for each department. Then the UIDs/GIDs will stay unique for the whole directory.

You can manage as many LDAP servers with LAM as you wish. This scenario is similar to the advanced scenario above. Just create one server profile for each LDAP server.

LAM was tested to work with 10 000 users. If you have a lot more users then you have basically two options. Divide your LDAP tree in organisational units: This is usually the best performing option. Put your accounts in several organisational units and setup LAM as in the advanced scenario above. Increase memory limit: Increase the memory_limit parameter in your php.ini. This will allow LAM to read more entries. But this will slow down the response times of LAM.

This chapter will give you instructions how to manage the different LDAP entries in your directory. Please note that not all account types are manageable with the free LAM release. LAM Pro provides some more account types and modules to support additional LDAP object classes. Additional types: Group of names Aliases NIS objects Sudo roles Additional modules: Group of names (groupOfNames) Group of unique names (groupOfUniqueNames) Unix (rfc2307bisPosixGroup) Alias (aliasEntry) User name (uidObject) NIS object (nisObject) Custom scripts (customScripts) Sudo role (sudoRole) Basic page layout: After the login LAM will present you its main page. It consists of a header part which is equal for all pages and the content area which covers most the of the page. The header part includes the links to manage all account types (e.g. users and groups) and open the tree view (LDAP browser). There is also the logout link and a tools entry. When you login the you will see an account listing in the content area. Here you can create, delete and modify accounts. Use the action buttons at the left or double click on an entry to edit it. The suffix selection box allows you to list only the accounts which are located in a subtree of your LDAP directory. You can change the number of shown entries per page with "Change settings". Depending on the account type there may be additional settings. E.g. the user list can convert group numbers to group names. When you select to edit an entry then LAM will show all its data on a tabbed view. There is one tab for each functional part of the account. You can set default values by loading an account profile.

LAM manages various types of user accounts. This includes address book entries, Unix, Samba, Zarafa and much more. Account list settings: The user list includes two special options to change how your users are displayed. Translate GID number to group name: By default the user list can show the primary group IDs (GIDs) of your users. There are often cases where it is more suitable to show the group name instead. This can be done by activating this option. Please note that LAM will execute more LDAP queries which may result in decreased performance. Show account status: If you activate this option then there will be an additional column displayed that shows if the account is locked. You can see more details when moving the mouse cursor over the lock icon. This function supports Unix, Samba and PPolicy. Quick account (un)locking: When you edit an user then LAM supports to quickly lock/unlock the whole account. This includes Unix, Samba and PPolicy. LAM can also remove group memberships if an account is locked. You will see the current status of all account parts in the title area of the account. If you click on the lock icon then a dialog will be opened to change these values. Depending on which parts are locked LAM will provide options to lock/unlock account parts.

This module is the most common basis for user accounts in LAM. You can use it stand-alone to manage address book entries or in combination with Unix, Samba or other modules. The Personal module provides support for managing various personal data of your users including mail addresses and telephone numbers. You can also add photos of your users. If you do not need to manage all attributes then you can deactivate them in your server profile. Attribute name Name inside LAM businessCategory Business category carLicense Car license cn/commonName Common name departmentNumber Department(s) description Description employeeNumber Employee number employeeType Employee type facsimileTelephoneNumber/fax Fax number givenName/gn First name homePhone Home telephone number initials Initials jpegPhoto Photo l Location mail/rfc822Mailbox Email address manager Manager mobile/mobileTelephoneNumber Mobile number organizationName/o Organisation physicalDeliveryOfficeName Office name postalAddress Postal address postalCode Postal code postOfficeBox Post office box registeredAddress Registered address roomNumber Room number sn/surname Last name st State street/streetAddress Street telephoneNumber Telephone number title Job title uid/userid User name userPassword Password

The Unix module manages Unix user accounts including group memberships. Group memberships can be changed when clicking on "Edit groups". Here you can select the Unix groups and group of names memberships. To enable "Group of names" please either add the groups module "groupOfNames"/"groupOfUniqueNames" or add the account type "Group of names". You can also create home directories for your users if you setup lamdaemon. This allows you to create the directories on the local or remote servers. It is also possible to check the status of the user's home directories. If needed the directories can be created or removed at any time.

This module manages memberships in group of (unique) names. To activate this feature please add the user module "Group of names (groupOfNamesUser)" to your LAM server profile. Please note that this module cannot be used if the Unix module is active. In this case group memberships may be managed with the Unix module. The module automatically detects if groups are based on "groupOfNames" or "groupOfUniqueNames" and sets the correct attribute.

LAM supports the management of the LDAP substitution of /etc/shadow. Here you can setup password policies for your Unix accounts and also view the last password change of a user.

LAM Pro allows your users to reset their passwords by answering a security question. The reset link is displayed on the self service page. Additionally, you can set question + answer in the admin interface. Please note that self service and LAM admin interface are separated functionalities. You need to specify the list of possible security questions in both self service profile(s) and server profile(s). Schema Please install the schema that comes with LAM Pro: docs/schema/passwordSelfReset.schema or docs/schema/passwordSelfReset.ldif This allows to set a security question + answer for each account. Activate password self reset module Please activate the password self reset module in your LAM Pro server profile. Now select the tab "Module settings" and specify the list of possible security questions. Only these questions will be selectable when you later edit accounts. Edit users After everything is setup please login to LAM Pro and edit your users. You will see a new tab called "Password self reset". Here you can activate/remove the password self reset function for each user. You can also change the security question and answer.

You can specify a list of valid host names where the user may login. If you add the value "*" then the user may login to any host. This can be further restricted by adding explicit deny entries which are prefixed with "!" (e.g. "!hr_server"). Please note that your PAM settings need to support host restrictions. This feature is enabled by setting pam_check_host_attr yes in your /etc/pam_ldap.conf. When it is enabled then the account facility of pam_ldap will perform the checks and return an error when no proper host attribute is present. Please note that users without host attribute cannot login to such a configured server.

LAM supports full Samba 3 user management including logon hours and terminal server options.

You can manage file system quotas with LAM. This requires to setup lamdaemon. LAM connects to your server via SSH and manages the disk filesystem quotas. The quotas are stored directly on the filesystem. This is the default mechanism to store quotas for most systems. Please add the module "Quota (quota)" for users to your LAM server profile to enable this feature. If you store the quota information directly inside LDAP please see the next section.

You can store your filesystem quotas directly in LDAP. See Linux DiskQuota for details since it requires quota tools that support LDAP. You will need to install the quota LDAP schema to manage the object class "systemQuotas". Please add the module "Quota (systemQuotas)" for users to your LAM server profile to enable this feature. If you store the quota information on the filesystem please see the previous section.

This module supports to manage Kolab accounts with LAM. E.g. you can set the user's mail quota and define invitation policies. Please enter an email address at the Personal page and set a Unix password first. Both are required that Kolab accepts the accounts. Kolab users should not be directly deleted with LAM. You can mark an account for deletion which then is done by the Kolab server itself. This makes sure that the mailbox etc. is also deleted.

LAM supports Asterisk accounts, too. See the Asterisk section for details.

EDU person accounts are mainly used in university networks. You can specify the principal name, nick names and much more.

OpenLDAP supports the ppolicy overlay to manage password policies for LDAP entries. LAM Pro supports managing the policies and assigning them to user accounts. Please add the account type "Password policies" to your LAM server profile and activate the "Password policy" module for the user type. You can assign any password policy which is found in the LDAP suffix of the "Password policies" type. When you set the policy to "default" then OpenLDAP will use the default policy as defined in your slapd.conf file.

FreeRadius is a software that implements the RADIUS authentication protocol. LAM allows you to mange several of the FreeRadius attributes. To activate the FreeRadius plugin please activate the FreeRadius user module in your server profile: You can disable unneeded fields on the tab "Module settings": Now you will see the tab "FreeRadius" when editing users. The extension can be (de)activated for each user. You can setup e.g. realm, IP and expiration date.

You can manage your Heimdal Kerberos accounts with LAM Pro. Please add the user module "Kerberos (heimdalKerberos)" to activate this feature. Setup password changing LAM Pro cannot generate the password hashes itself because Heimdal uses a propietary format for them. Therefore, LAM Pro needs to call e.g. kadmin to set the password. The wildcards @@password@@ and @@principal@@ are replaced with password and principal name. Please use keytab authentication for this command since it must run without any interaction. Example to create a keytab: ktutil -k /root/lam.keytab add -p lam@LAM.LOCAL -e aes256-cts-hmac-sha1-96 -V 1 Security hint: Please secure your LAM Pro server since the new passwords will be visible for a short term in the process list during password change. User management You can specify the principal/user name, ticket lifetimes and expiration dates. Additionally, you can set various account options.

You can manage your MIT Kerberos accounts with LAM Pro. Please add the user module "Kerberos (mitKerberos)" to activate this feature. If you want to manage entries based on the structural object class "krbPrincipal" please use "Kerberos (mitKerberosStructural)" instead. Setup password changing LAM Pro cannot generate the password hashes itself because MIT uses a propietary format for them. Therefore, LAM Pro needs to call kadmin/kadmin.local to set the password. LAM will add "-q 'cpw -pw PASSWORD PRINCIPAL'" to the command to set the password. Please use keytab authentication for this command since it must run without any interaction. Keytabs may be created with the "ktutil" application. Security hint: Please secure your LAM Pro server since the new passwords will be visible for a short term in the process list during password change. Example commands: /usr/sbin/kadmin -k -t /home/www-data/apache.keytab -p realm/changepwd sudo /usr/sbin/kadmin.local User management You can specify the principal/user name, ticket lifetimes and expiration dates. Additionally, you can set various account options.

LAM Pro manages all qmail attributes for users. This includes mail addresses, ID numbers and quota settings. Please note that the main mail address is managed on tab "Personal" if this module is active. Otherwise, it will be on the qmail tab. You can hide several qmail options if you do not want to manage them with LAM. This can be done on the module settings tab of your LAM server profile.

LAM supports to manage mail routing for user accounts. You can specify a routing address, the mail server and a number of local addresses to route. This feature can be activated by adding the "Mail routing" module to the user account type in your server profile.

You can manage your public keys for SSH in LAM if you installed the LPK patch for SSH. Activate the "SSH public key" module for users in the server profile and you can add keys to your user entries.

You can setup PAM to check if a user is allowed to run a specific service (e.g. sshd) by reading the LDAP attribute "authorizedService". This way you can manage all allowed services via LAM. To activate this PAM feature please setup your /etc/libnss-ldap.conf and set "pam_check_service_attr" to "yes". Inside LAM you can now set the allowed services. You may also setup default services in your account profiles. You can define a list of services in your LAM server profile that is used for autocompletion. The autocompletion will show all values that contains the entered text. To display the whole list you can press backspace in the empty input field. Of course, you can also insert a service name that is not in the list.

LAM may create and delete mailboxes on an IMAP server for your user accounts. You will need an IMAP server that supports either SSL or TLS for this feature. To activate the mailbox management module please add the "Mailbox (imapAccess)" module for the type user in your LAM server profile: Now configure the module on the tab "Module settings". Here you can specify the IMAP server name, encryption options, the authentication for the IMAP connection and the valid mail domains. LAM can use either your LAM login password for the IMAP connection or display a dialog where you need to enter the password. The mail domains specify for which accounts mailboxes may be created/deleted. E.g. if you enter "lam-demo.org" then mailboxes can be managed for "user@lam-demo.org" but not for "user@example.com". You need to install the SSL certificate of the CA that signed your server certificate. This is usually done by installing the certificate in /etc/ssl/certs. Different Linux distributions may offer different ways to do this. For Debian please copy the certificate in "/usr/local/share/ca-certificates" and run "update-ca-certificates" as root. It is not recommended to disable the validation of IMAP server certificates. When you edit an user account then you will now see the tab "Mailbox". Here you can create/delete the mailbox for this user.

This is a very simple module to manage accounts based on the object class "account". Usually, this is used for host accounts only. Please pay attention that users based on the "account" object class cannot have contact information (e.g. telephone number) as with "inetOrgPerson". You can enter a user/host name and a description for your accounts.

This module is used to manage Unix group entries. This is the default module to manage Unix groups and uses the nis.schema. Suse users who use the rfc2307bis.schema need to use LAM Pro.

Some applications (e.g. Suse Linux) use the rfc2307bis schema for Unix accounts instead of the nis schema. In this case group accounts are based on the object class groupOf(Unique)Names or namedObject. The object class posixGroup is auxiliary in this case. LAM Pro supports these groups with a special account module: rfc2307bisPosixGroup Use this module only if your system depends on the rfc2307bis schema. The module can be selected in the LAM configuration. Instead of using groupOfNames as basis for your groups you may also use namedObject.

LAM supports managing Samba 3 groups. You can set special group types and also create Windows predefined groups like "Domain admins".

You can manage file system quotas with LAM. This requires to setup lamdaemon. File system quotas are not stored inside LAM but managed directly on the specified servers.

Please see the description here.

The device object class allows to manage general information about all sorts of devices (e.g. computers, network hardware, ...). You can enter the serial number, location and a describing text. It is also possible to specify the owner of the device.

You can manage Samba 3 host entries by adding the Unix and Samba 3 account modules.

You can manage the IP addresses of host accounts with the ipHost module. It manages the following information: IP addresses (IPv4/IPv6) location of the host manager: the person who is responsible for the host You can activate this extension by adding the module ipHost to the list of active host modules.

Hosts can have an unlimited number of MAC addresses. To enable this feature just add the "MAC address" module to the host account type.

LAM supports to manage your Puppet configuration. You can edit all attributes like environment, classes, variables and parent node. Configuration To activate this feature please edit your LAM server profile and add the host module "Puppet (puppetClient)" on tab "Modules". This will add the Puppet tab to your host pages. On tab "Module settings" in your LAM server profile you may also setup some common environment names. LAM will use them to provide autocompletion hints when editing the environment for a node. Editing nodes When you edit a host entry then you will see the tab "Puppet". Here you can add/remove the Puppet extension and edit all attributes.

Samba 3 stores information about its domain settings inside LDAP. This includes the domain name, its SID and some policies. You can manage all these attributes with LAM. Please activate the account type "Samba domains" in your LAM server profile. Please notice that Samba by default uses the LDAP root for domain objects (e.g. dc=example,dc=com). This will add a new tab to LAM where you can manage domain information. The domain name, SID and RID base can only be specified for new domains and are not changeable via LAM at a later time. You may setup several password policies for your Samba domains and also some RID options that influence the creation of SIDs for users/groups/hosts.

These classes can be used to represent group relations. Since they allow DNs as members you can also use them to represent nested groups. Activate the account type "Group of names" in your LAM server profile to use these account modules. Group of (unique) names have four basic attributes: Name: a unique name for the group Description: optional description Owner: the account which owns this group (optional) Members: the members of the group (at least one is required) You can add any accounts as members. This includes other groups which leads to nested groups.

LAM includes large support for Asterisk. You can add Asterisk extensions (including voicemail) to your users and also manage Asterisk extensions. The Asterisk support for users can be added by selecting the Asterisk and Asterisk voicemail modules for users in your LAM server profile. This will add the following tabs to your user accounts. The Asterisk module allows to edit a large amount of attributes. Therefore, you can hide unused fields. Please edit you server profile (Module settings) to do so. Of course, the voicemail part of Asterisk is also supported. If you also want to manage Asterisk extensions then simply add the account type "Asterisk extensions" and its module to your server profile. LAM groups your Asterisk extension entries by extension name and account context. If you edit an extension then you will see the Asterisk entries as rules. LAM manages that all rule entries have the same owners and assigns the priorities.

Zarafa is an OpenSource collaboration software. LAM Pro provides support to manage Zarafa server entries, users and groups. It covers all settings for these types including resource and quota settings. LAM Pro is an official Zarafa Certified Integration.

To enable Zarafa support in LAM Pro please activate the Zarafa modules for the Users, Groups and Hosts account types in you server profile: You can configure which parts of the Zarafa user options should be enabled. E.g. if you do not want to manage quotas per user then you can hide these options on the tab "Module settings". "Send as" attribute: Here you can specify how "Send as" privileges should be managed. LAM supports "uid" and "dn". If you select "uid" the LAM will store user names in the zarafaSendAsPrivilege attribute. This way you are restricted to specify user accounts as "Send as" allowed. You can also set this option to "dn" and LAM will store DNs in the zarafaSendAsPrivilege attribute. In this case you may specify users and groups as "Send as" allowed. Examples for your Zarafa ldap.cfg: "Send as" attribute: dn ldap_user_sendas_attribute_type = dn "Send as" attribute: uid ldap_user_sendas_attribute_type = text ldap_user_sendas_relation_attribute = uid Features: Zarafa 7 allows to enable IMAP/POP3 for each user. Please hide the option "Features" if you use Zarafa 6.x.

This is an example of the user edit page with all possible settings. This includes email settings, quotas and some options (e.g. hide from address book). You can also set the resource type and capacity for meeting rooms and equipment. The Zarafa extension can be added and removed at any time for every user. Please note that the option "Features" requires Zarafa 7. Please hide this option in the LAM server profile if you run Zarafa 6.x.

LAM Pro can manage your Zarafa contact entries. You can set the email aliases and "send as" privileges. Additionally, accounts may be hidden in the address book or disabled. Please note that you can either use the Zarafa user module or Zarafa contact. LAM Pro will disable the other tab when enabling one of them.

This is the edit page for groups. You can enter an email address and additional aliases for your groups. It is also possible to specify options (e.g. hide from address book). The extension can be added/removed dynamically. Please note that the option "Send-as privileges" requires the Zarafa 7.0.3 schema. Please hide this option in the LAM server profile if you run Zarafa < 7.0.3.

The Zarafa extension for host accounts allows to set the connection ports and file path. You can add/remove the extension at any time. Setting the public store option is only possible for new host entries. Please note that the proxy URL option requires the Zarafa 7.1 schema. Please hide this option in your LAM server profile if you use an older version.

Zarafa allows to store address lists in LDAP. You need to define a search base and LDAP filter for each address list. E.g. entering "ou=people,dc=company,dc=com" as base and "uid=*" will select all users that are stored in "ou=people,dc=company,dc=com". You can also hide your lists from the address book or temporarily disable them.

Zarafa allows to define dynamic groups in LDAP. You need to define a search base and LDAP filter for each group. E.g. entering "ou=people,dc=company,dc=com" as base and "uid=*" will select all users that are stored in "ou=people,dc=company,dc=com". Dynamic groups may have an email address and multiple email alias addresses. You can also hide your dynamic groups from the address book or temporarily disable them.

You can mange your DHCP server with LAM. It supports to manage subnets, fixed IP entries, IP ranges and DDNS. The DHCP can be activated by adding the account type DHCP to your server profile. Please also add the DHCP modules. LAM requires that you use an LDAP entry with the object class "dhcpServer" as suffix for this account type. Example server entry: dn: cn=server,ou=dhcp,dc=ldap-account-manager,dc=org objectclass: dhcpServer objectclass: dhcpOptions objectclass: top cn: server dhcpcomments: My DHCP server dhcpoption: domain-name "ldap-account-manager.org" dhcpoption: domain-name-servers 192.168.1.1 dhcpoption: routers 192.168.1.1 dhcpoption: netbios-name-servers 192.168.1.1 dhcpoption: subnet-mask 255.255.255.0 dhcpoption: netbios-node-type 8 dhcpstatements: default-lease-time 3600 dhcpstatements: max-lease-time 7200 dhcpstatements: include "mykey" dhcpstatements: ddns-update-style interim dhcpstatements: update-static-leases true dhcpstatements: ignore client-updates Example settings for dhcpd.conf: ddns-update-style none; deny unknown-clients; ldap-server "server"; ldap-dhcp-server-cn "server"; ldap-port 389; ldap-username "uid=dhcp,ou=people,dc=ldap-account-manager,dc=org"; ldap-password "{SSHA}XXXXXXXXXXXX"; ldap-base-dn "ou=dhcp,dc=ldap-account-manager,dc=org"; ldap-method dynamic; ldap-debug-file "/var/log/dhcp-ldap-startup.log"; slapd.conf changes: include /etc/ldap/schema/dhcp.schema index dhcpHWAddress eq index dhcpClassData eq Run slapindex to rebuild the index. You can manage the settings of your DHCP server entry: You can easily create new subnet entries. It is also possible to specify a list of fixed IPs. IP ranges may be specified. If you activated DDNS in the server entry then you may also specify the DDNS settings for this subnet.

Some applications use the object class "alias" to link LDAP entries to other parts of the LDAP tree. Activate the account type "Aliases" in your LAM server profile to use this account type. Currently, only user accounts can be aliased with the "uidObject" object class.

You can manage mail aliases (e.g. for NIS) inside LAM. This can be used to replace local /etc/aliases files with LDAP. All accounts of this type are based on the "nisMailAlias" object class and may have "cn" and "rfc822MailMember" attributes. To activate this type please add "Mail aliases" in your LAM server profile: The mail aliases will appear as separate tab inside LAM. You may then manage the aliases with their names and recipient addresses.

LAM supports to define NIS netgroups. You can use them e.g. to restrict SSH access to your machines. Add the NIS net group account type and its module to your server profile. Then you can manage net groups in LAM. Net groups may contain other net groups as child groups. You can either insert the host/user names manually or print the search buttons next to the input fields to find existing entries in your directory.

You can manage NIS objects with LAM Pro. This allows you define network mount points in LDAP. Add the NIS objects type to your LAM configuration and then the NIS objects module. This will add the NIS objects tab to LAM.

LAM Pro allows you to manage automount entries. Please activate the account type "Automount objects" in your LAM Pro server profile. Then add the correct automount module. Usually, this is "Automount entry (automount)". If you use Suse Linux with RFC2307bis schema please select "Automount entry (rfc2307bisAutomount)". This will add a new tab to LAM Pro's main screen which includes a list of all automount entries. Here you can easily create new entries. Please see the following external HowTos for more information on automounting and LDAP: AutofsLDAP Automount über LDAP (German)

OpenLDAP supports the ppolicy overlay to manage password policies for LDAP entries. This allows you to set password policies which are independent from your applications. The policies are managed internally by the LDAP server. You can manage these policies with LAM Pro with the account type "Password policies". You will need to add the ppolicy schema to your OpenLDAP configuration and activate the ppolicy overlay module in slapd.conf to use this feature.

This module allows you to manage LDAP attributes that are not covered by the other LAM modules (e.g. if you use custom LDAP schemas). You can fully define how your input fields look like: Label LDAP attribute name Unique name for field Read-only display Field type: text, password, text area, checkbox, radio buttons, select list Validation via regular expression Error message if validation fails Limitations: Custom fields cannot manage structural object classes (binary) attributes that require file uploads multi-value attributes attributes that require validation rules across multiple attributes or cannot be described by a simple regular expression Activating the custom fields module: You may specify custom fields for all of your account types. Please enter tab "Modules" in your server profile. Now activate the "Custom fields (customFields)" module for all needed account types. Defining groups: All input fields are devided into groups. A group may contain one or more object classes and allows you to add/remove a certain set of input fields. E.g. you may define two groups - "My application A" and "My application B" - that manage different LDAP attributes and object classes. This way you will be able to control both attribute sets independently. To create a group please edit your server profile and switch to tab "Module settings". You will see the section "Custom fields" which allows you to add new groups. Now select your account type (e.g. Users) and specify an alias for your group. This alias will be printed as group header when you later edit an account in the admin interface. After you created your new group you can setup the managed object classes. If you specify any object classes then you will later be able to add/remove a complete set of attributes including their object classes. Skipping the object classes field is only useful if you want to manage some attributes that are not yet supported by LAM but there is already a LAM module that manages the object class. The group may look like when you edit a user. Adding fields: Now you can add a new field that manages an LDAP attribute. Simply fill the fields and press on "Add". Please note that the field name cannot be changed later. It is the unique ID for this field. Examples for fields and their representation: Text field: Text fields allow to specify a validation expression and error message. Presentation: Password field: You can also manage custom password fields. LAM Pro will display two fields where the user must enter the same password. You can hash the password if needed. Presentation: Text area: This adds a multi-line field. The options are similar to text fields. Additionally, you can set the size with the number of columns and rows. Please note that the validation expression should be set to multi-line. This is done by adding "m" at the end. Presentation: Checkbox: Sometimes you may want to allow only yes/no values for your LDAP attributes. This can be represented by a checkbox. You can specify the values for checked and unchecked. The default value is set if the LDAP attribute has no value. Presentation: Radio buttons: This displays a list of radio buttons where the user can select one value. You can specify a mapping of LDAP attribute values and their display (label) on the Self Service page. To add more mapping fields please press "Add more mapping fields". Presentation: Select list: Select lists allow the user to select a value in a large list of options. The definition of the possible values and their display is similar to radio buttons. You can also allow multiple values. Presentation: Validation expressions: The validation expressions follow the standard of Perl regular expressions. They start and end with a "/". The beginning of a line is specified by "^" and the end by "$". Examples: /^[a-z0-9]+$/ allows small letters and numbers. The value must not be empty ("+"). /^[a-z0-9]+$/i allows small and capital letters ("i" at the end means ignore case) and numbers. The value must not be empty ("+"). Special characters that must be escaped with "\": "\", ".", "(", ")" E.g. /^[a-z0-9\.]$/i

LAM Pro allows you to execute scripts whenever an account is created, modified or deleted. This can be useful to automate processes which needed manual work afterwards (e.g. sending your user a welcome mail or register a mailbox). Additionally, you can specify manual scipts that can be executed from within LAM Pro. To activate this feature please add the "Custom scripts" module to all needed account types on the configuration pages. You can specify multiple scripts for each action type (e.g. modify) and account type (e.g. user). The scripts need to be located on the filesystem of your webserver and will be executed in its user environment. E.g. if you webserver runs as user www-data with the group www-data then the custom scripts will be run under this user with his rights. The output of the scripts will be shown in LAM. You can specify the scripts on the LAM configuration pages. Syntax: Please enter one script per line. Each line has the following format: <account type> <action> <script> E.g.: user preModify /usr/bin/myCustomScript -u $uid$ Account types: You can setup scripts for all available account types (e.g. user, group, host, ...). Please see the help on the configuration page about your current active account types. Actions: Action name Description preCreate executed before creating a new account (cancels operation if a script returns an exit code > 0, not available for file upload) postCreate executed after creating a new account preModify executed before the account is modified (cancels operation if a script returns an exit code > 0) postModify executed after an account was modified preDelete executed before an account was modified (cancels operation if a script returns an exit code > 0) postDelete executed after an account was modified manual can be run manually on account page Script: You can execute any script which is located on the filesystem of your webserver. The path may be absolute or relative to the PATH-variable of the environment of your webserver process. It is also possible to add commandline arguments to your scripts. Additionally, LAM will resolve wildcards to LDAP attributes. If your script includes an wildcard in the format $ATTRIBUTE$ then LAM will replace it with the attribute value of the current LDAP entry. The values of multi-value attributes are separated by commas. E.g. if you create an account with the attribute "uid" and value "steve" then LAM will resolve "$uid$" to "steve". Please note that manual scripts can only use the current LDAP attribute values of the account. Any modifications done that are not saved will not be available. Manual scripts are also not available for new accounts that are not yet saved to LDAP. You can switch LAM's logging to debug mode if you are unsure which attributes with which values are available. The following special wildcards are available for automatical scripts: $INFO.userPasswordClearText$: cleartext password when Unix password is changed (e.g. useful for external password synchronisation) for new/modified accounts $INFO.userPasswordStatusChange$: provides additional information if the password locking status was changed, possible values: locked, unlocked, unchanged $INFO.passwordSelfResetAnswerClearText$: cleartext answer to security question $NEW.<attribute>$: the value of a new attribute (e.g. $NEW.telephoneNumber$) for modified accounts $DEL.<attribute>$: the value of a deleted attribute (e.g. $DEL.telephoneNumber$) for modified accounts $MOD.<attribute>$: the new value of a modified attribute (e.g. $MOD.telephoneNumber$) for modified accounts $ORIG.<attribute>$: the original value of an attribute (e.g. $ORIG.telephoneNumber$) for modified accounts Output may contain HTML: If your scripts generate HTML output then activate this option. Hide command in messages: You may want to prevent that your users see the executed commands. In this case activating this option will only show the command output but not the command itself. You can see a preview of the commands which will be automatically executed on the "Custom scripts" tab. Here you can also run the manual scripts.

You can manage your sudo roles in LDAP if you have installed the sudo-ldap package or compiled sudo with LDAP support. To activate sudo management in LAM Pro edit your server profile and add the type "Sudo roles". The sudo roles in LDAP work similar to those in /etc/sudoers. You can specify who may run which commands as which user. It is also possible to specify options like NOPASSWD.

This module is available for all account types. It shows some internal information about the LDAP entries like the creation time and who modified the entry. If you use the "memberOf" overlay in OpenLDAP then this will also show group memberships done by the overlay.

The tree view provides a raw view on your LDAP directory. This feature is for people who are experienced with LDAP and need special functionality which the LAM account modules not provide. E.g. if you want to add a special object class to an account or edit attributes ignoring LAM's syntax checks. There are also some special functions available: Export: This allows you to export entries to a file (e.g. LDIF or CSV format). Show internal attributes: Shows internal attributes of the current entry. This includes information about the creator and creation time of the entry.

Here is a list of typical usage scenarios and what account types and modules you need to configure. Address book entries: Account types: Users (Personal) Unix accounts: Account types: Users (Personal + Unix) Groups (Unix (posixGroup)) Suse users may need to use Group (Group of names + Unix (rfc2307bisPosixGroup)) because of Suse's special LDAP schema. Samba accounts: Account types: Users (Personal + User + Samba 3) Groups (Unix + Samba 3) Hosts (Account + Unix + Samba 3) Samba domains (Samba domain) Asterisk: Account types: Users (Personal + Asterisk) Asterisk extensions (Asterisk extension) Zarafa: Account types: Users (Personal + Unix + Zarafa (+ Zarafa contact)) Groups (Unix + Zarafa) Zarafa dynamic groups (Zarafa dynamic group) Zarafa address lists (Zarafa address list) Hosts (Device + Zarafa + IP Address)

The account profiles are templates for your accounts. Here you can specify default values which can then be loaded when you create accounts. You may also load a template for an existing account to reset it to default values. When you create a new account then LAM will always load the profile named "default". This account profile can include default values for all your accounts. You can enter the LDAP suffix, RDN identifier and various other attributes depending on account type and activated modules. Import/export: Profiles can be exported to and imported from other server profiles. There is a special export target called "*Global templates". All profiles exported here will be copied to all other server profiles (incl. new ones). But existing profiles with the same name are not overwritten. So a profile in global templates is treated as default profile for all server profiles. Use this if you would like to setup default profiles that are valid for all server profiles.

When you need to create lots of accounts then you can use LAM's file upload to create them. LAM will read a CSV formatted file and create the related LDAP entries. Please check the data in you CSV file carefully. LAM will do less checks for the file upload than for single account creation. At the first page please select the account type and what extensions should be activated. The next page shows all available options for the file upload. You will also find a sample CSV file which can be used as template for your CSV file. All red options are required columns in the file. You need to specify a value for each account. When you upload the CSV file then LAM first does some checks on this file. This includes syntax checks and if all required data was entered. No changes in the LDAP directory are done at this time. If the checks were successful then LAM will ask again if you want to create the accounts. You will also have the chance to check the upload by viewing the changes in LDIF format.

This is a simple editor to add/delete organisational units in your LDAP tree. This way you can structure the accounts.

All accounts in LAM may be exported as PDF files. You can specify the page structure and displayed information by editing the PDF profiles. When you export accounts to PDF then each account will get its own page inside the PDF. There is a headline on each page where you can show a page title. You may also add a logo to each page. To add more possible logos simply copy the images to config/pdf/<server profile name>/logos. The main part is structured into sections of information. Each section has a title. This can either be static text or the value of an attribute. You may also insert a static text block as section. Sections can be moved by using the arrows next to the section title. Each section can contain multiple fields which usually represent LDAP attributes. You can simply add new fields by selecting the field name and its position. Then use the arrows to move the field inside the section. Import/export: PDF structures can be exported to and imported from other server profiles. There is a special export target called "*Global templates". All PDF structures exported here will be copied to all other server profiles (incl. new ones). But existing PDF structures with the same name are not overwritten. So a PDF structure in global templates is treated as default structure for all server profiles. Use this if you would like to setup default PDF structures that are valid for all server profiles.

Here you browse the schema of your LDAP server. You can view what object classes, attributes, syntaxes and matching rules are available. This is useful if you need to check if a certain object class is available.

This shows information and statistics about your LDAP server. This includes the suffixes, used overlays, connection data and operation statistics. You will need "cn=monitor" setup to see all details. Some data may not be available depending on your LDAP server software. Please see the following links how to setup "cn=monitor": OpenLDAP 389 server

This allows you to check if your LDAP schema is compatible with LAM and to find possible problems.

LAM provides an external script to manage home directories and quotas. You can test here if everything is setup correctly. If you get an error like "no tty present and no askpass program specified" then the path to the lamdaemon.pl may be wrong. Please see the lamdaemon installation instructions for setup details.

This will test if your LDAP schema supports all object classes and attributes of the active LAM modules. If you get a message that something is missing please check that you installed all required schemas. If you get error messages about object class violations then this test can tell you what is missing.

You can define different access levels for each profile to allow or disallow write access. The password reset page helps your deskside support staff to reset user passwords.

There are three access levels: Write access (default) There are no restrictions. LAM admin users can manage account, create profiles and set passwords. Change passwords Similar to "Read only" except that the password reset page is available. Read only No write access to the LDAP database is allowed. It is also impossible to manage account and PDF profiles. Accounts may be viewed but no changes can be saved. The access level can be set on the server configuration page:

This special page allows your deskside support staff to reset the Unix and Samba passwords of your users. Account may also be (un)locked If you set the access level to "Change passwords" then LAM will not allow any changes to the LDAP database except password changes via this page. The account pages will be still available in read-only mode. You can open the password reset page by clicking on the key symbol on each user account: There are three different options to set a new password: set random password and display it on screen This will set the user's password to a random value. The password will be 11 characters long with a random combination of letters, digits and ".-_". You may want to use this method to tell users their new passwords via phone. set random password and mail it to user If the user account has set the mail attribute then LAM can send your user a mail with the new password. You can change the mail template to fit your needs. Please configure your LAM server profile to setup the sender address, subject and mail body. Using this method will prevent that your support staff knows the new password. set specific password Here you can specify your own password. LAM will display contact information about the user like the user's name, email address and telephone number. This will help your deskside support to easily contact your users. Options: Depending on the account there may be additional options available. Sync Samba NT/LM password with Unix password: If a user account has Samba passwords set then LAM will offer to synchronize the passwords. Unlock Samba account: Locked Samba accounts can be unlocked with the password change. Update Samba password timestamps: This will set the timestamps when the password was changed (sambaPwdLastSet), may be changed again (sambaPwdCanChange) and must be changed again (sambaPwdMustChange). Only existing attributes are updated. No new attributes are added. Sync Kerberos password with Unix password: This will also update the Heimdal Kerberos password. Sync Asterisk (voicemail) password with Unix password: Changes also the Asterisk passwords. Force password change: This will force the user to change his password at next login. This option supports Shadow, Samba 3 and PPolicy (automatically detected). Account (un)locking: Depending if the account includes a Unix/Samba extension and PPolicy is activated the page will show options to (un)lock the account. E.g. if the account is fully unlocked then there will be no unlocking options printed.

By default only a few administrative users have write access to the LDAP database. Before your users may change their settings you must allow them to change their LDAP data. This can be done by adding an ACL to your slapd.conf which looks like this: access to attrs=mail,sn,givenName,telephoneNumber,mobile,facsimileTelephoneNumber,street,postalAddress,postOfficeBox,postalCode,roomNumber,userPassword,shadowLastChange by self write by * read If you do not want them to change all attributes then reduce the list to fit your needs. Some modules may require additional LDAP attributes. You can use the tree view to get the technical attribute names e.g. by selecting an user account. Usually, the slapd.conf file is located in /etc/ldap or /etc/openldap.

There exist many LDAP implementations. If you do not use OpenLDAP you need to write your own ACLs. Please check the manual of your LDAP server for instructions.

A self service profile defines what input fields your users see and some other general settings like the login caption. When you go to the LAM configuration page you will see the self service link at the bottom. This will lead you to the self service configuration pages Now we need to create a new self service profile. Click on the link to manage the self service profiles. Specify a name for the new profile and enter your master configuration password (default is "lam") to save the profile. Now go back to the profile login and enter your master configuration password to edit your new profile.

On top of the page you see the link to the user login page. Copy this link address and give it to your users. Below the link you can specify several options. Server address The address of your LDAP server LDAP suffix The part of the LDAP tree where LAM should search for users LDAP user + password The DN and password which is used to search for users in the LDAP database. It is sufficient if this DN has only read rights. If you leave these fields empty LAM will try to connect anonymously. LDAP search attribute Here you can specify if your users can login with user name + password, email + password or other attributes. HTTP authentication You can enable HTTP authentication for your users. This way the web server is responsible to authenticate your users. LAM will use the given user name + password for the LDAP login. To setup HTTP authentication in Apache please see this link. Login attribute label This is the description for the LDAP search attribute. Set it to something which your users are familiar with. Login caption This text is displayed at the login page. You can input HTML, too. Main page caption This text is displayed at self service main page where your users change their data. You can input HTML, too. Page header This HTML code will be placed on top of all self service pages. E.g. you can use this to place your custom logo. Any HTML code is permitted. Additional CSS links Here you can specify additional CSS links to change the layout of the self service pages. This is useful to adapt them to your corporate design. Please enter one link per line.

Here you can specify what input fields your users can see. It is also possible to group several input fields. Please use the arrow signs to change the order of the fields/groups. You may also set some fields as read-only for your users. This can be done by clicking on the lock symbol. Read-only fields can be used to show your users additional data on the self service page that must not be changed by themselves (e.g. first/last name). Possible input fields This is a list of input fields you may add to the self service page.

Self service fields

Account type	Option	Description
Asterisk (voicemail)	Sync Asterisk password with Unix password	This is a hidden field. It will update the Asterisk password each time the Unix password is changed.
Kerberos	Sync Kerberos password with Unix password	This is a hidden field. It will update the Kerberos password each time the Unix password is changed.
Kolab	Delegates	Allows to manage delegate permissions
	Invitation policy	Invitation policy management
Password self reset	Question	Security question selection
	Answer	Security answer
Personal	Business category
	Car license
	Department
	Email address
	Fax number
	First name
	Home telephone number
	Initials
	Job title
	Last name
	Location
	Mobile number
	Office name
	Photo	Shows the user photo if set. The user may also remove the photo or upload a new one.
	Postal address
	Postal code
	Post office box
	Registered address
	Room number
	State
	Street
	Telephone number
	Web site
Samba 3	Password	Input field to set a new NT/LM password. The attribute "sambaPwdLastSet" is updated if it existed before.
	Sync Samba LM password with Unix password	This is a hidden field. It will update the Samba LM password each time the Unix password is changed.
	Sync Samba NT password with Unix password	This is a hidden field. It will update the Samba NT password each time the Unix password is changed.
	Update attribute "sambaPwdLastSet" on password change	Updates the password timestamp when password is synchronized with Unix.
Unix	Common name
	Login shell
	Password	This is also the source for several password synchronization options.
Zarafa	"Send as" privileges	Define user who may send mails as this user
	Email aliases	Email aliases

This allows to configure some module specific options (e.g. custom scripts or password hash type).

Settings You can allow your users to reset their passwords themselves. This will reduce your administrative costs for cases where users forget their passwords. To enable this feature please activate the checkbox "Enable password self reset link": You can now configure the minimum answer length for password reset answers. This is checked when you allow you users to specify their answers via the self service. Additionally, you can specify the text of the password reset link (default: "Forgot password?"). The link is displayed below the password field on the self service login page. Next, please enter the DN and password of an LDAP entry that is allowed to reset the passwords. This entry needs write access to the attributes shadowLastChange, pwdAccountLockedTime and userPassword. It also needs read access to uid, mail, passwordSelfResetQuestion and passwordSelfResetAnswer. Please note that LAM Pro saves the password on your server file system. Therefore, it is required to protect your server against unauthorised access. Please also specify the list of password reset questions that the user can choose. Please note that self service and LAM admin interface are separated functionalities. You need to specify the list of possible security questions in both self service profile(s) and server profile(s). You can inform your users via mail about their password change. The mail can include the new password by using the special wildcard "@@newPassword@@". Additionally, you may want to insert other wildcards that are replaced by the corresponding LDAP attributes. E.g. "@@uid@@" will be replaced by the user name. LAM Pro can send your users an email with a confirmation link to validate their email address. Of course, this should only be used if the email account is independent from the user password (e.g. at external provider). The mail must include the confirmation link by using the special wildcard "@@resetLink@@". Additionally, you may want to insert other wildcards that are replaced by the corresponding LDAP attributes. E.g. "@@uid@@" will be replaced by the user name. There is also an option to skip the security question at all if email verification is enabled. In this case the password can be reset directly after clicking on the confirmation link. Please handle with care since anybody with access to the user's mail account can reset the password. New fields for self service page There are two new fields that you may put on the self service page for your users. These fields allow them to change the reset question and its answer. This is an example how can be presented to your users on the self service page: Password reset link After activating the password self reset feature there will be a new link on the self service login page. The text can be configured as described above (default: "Forgot password?"). When a user clicks on the link then he will be asked for identification with his user name and email address. LAM Pro will use this information to find the correct LDAP entry of this user. It then displays the user's security question and input fields for his new password. If the answer is correct then the new password will be set. Additionally, pwdAccountLockedTime will be removed and shadowLastChange updated to the current time if existing.

With LAM Pro your users can create their own accounts if you like. LAM Pro will display an additional link on the self service login page that allows you users to create a new account including email validation. You enable this feature in your self service profile. Just activate the checkbox "Enable self registration link". Options: Link text: This is the label for the link to the self registration. If empty "Register new account" will be used. Admin DN and password: Please enter the LDAP DN and its password that should be used to create new users. This DN also needs to be able to do LDAP searches by uid in the self service part of your LDAP tree. Object classes: This is a list of object classes that are used to build the new user accounts. Please enter one object class in each line. Attributes: This is a list of additional attributes that the user can enter. Please note that user name, password and email address are mandatory anyway and need not be specified. Each line represents one LDAP attribute. The options are separated by "::". The first option specifies if the attribute is mandatory. It can have the values "optional" and "required". The second option is the LDAP attribute name and the third one is a descriptive label for it. Options four and five are used for input validation. Please enter the regular expression (e.g. "/^[0-9a-zA-Z]+$/") and an error message if the value does not match it. For a syntax description see here. Validation is optional. Example: optional::givenName::First name::/^[[:alnum:] ]+$/u::Please enter a valid first name. required::sn::Last name::/^[[:alnum:] ]+$/u::Please enter a valid last name. If you use the object class "inetOrgPerson" and do not provide the "cn" attribute then LAM will set it to the user name value. Please note that only simple input boxes are supported for account registration. The user may log in to self service when his account was created to manage all his attributes. User view: The user can register by clicking on a link on the self service login page: Here he can insert the data that you specified in the self service profile: LAM will then send him an email with a validation link that is valid for 24 hours. When he clicks on this link then the account will be created in the self service user suffix. The DN will look like this: uid=<user name>,...

This module allows you to manage LDAP attributes that are not covered by the other LAM modules (e.g. if you use custom LDAP schemas). You can fully define how your input fields look like: Label LDAP attribute name Unique name for field Read-only display Field type: text, password, text area, checkbox, radio buttons, select list Validation via regular expression Error message if validation fails To create custom fields for the Self Service please edit your Self Service profile and switch to tab "Module settings". Here you can add a new field. Simply fill the fields and press on "Add". Please note that the field name cannot be changed later. It is the unique ID for this field. After you created your fields please press on "Sync fields with page layout". Now you can switch to tab "Page layout" and add your new fields like any other standard field. Examples for fields and their representation in Self Service: Text field: Text fields allow to specify a validation expression and error message. Presentation in Self Service: Password field: You can also manage custom password fields. LAM Pro will display two fields where the user must enter the same password. You can hash the password if needed. Presentation in Self Service: Text area: This adds a multi-line field. The options are similar to text fields. Additionally, you can set the size with the number of columns and rows. Please note that the validation expression should be set to multi-line. This is done by adding "m" at the end. Presentation in Self Service: Checkbox: Sometimes you may want to allow only yes/no values for your LDAP attributes. This can be represented by a checkbox. You can specify the values for checked and unchecked. The default value is set if the LDAP attribute has no value. Presentation in Self Service: Radio buttons: This displays a list of radio buttons where the user can select one value. You can specify a mapping of LDAP attribute values and their display (label) on the Self Service page. To add more mapping fields please press "Add more mapping fields". Presentation in Self Service: Select list: Select lists allow the user to select a value in a large list of options. The definition of the possible values and their display is similar to radio buttons. You can also allow multiple values. Presentation in Self Service: Validation expressions: The validation expressions follow the standard of Perl regular expressions. They start and end with a "/". The beginning of a line is specified by "^" and the end by "$". Examples: /^[a-z0-9]+$/ allows small letters and numbers. The value must not be empty ("+"). /^[a-z0-9]+$/i allows small and capital letters ("i" at the end means ignore case) and numbers. The value must not be empty ("+"). Special characters that must be escaped with "\": "\", ".", "(", ")" E.g. /^[a-z0-9\.]$/i

LAM Pro allows you to integrate customs CSS style definitions and design the header of all self service pages. This way you can integrate you own logo and use your company's colors.

The default LAM Pro header includes a logo and a horizontal line. You can enter any HTML code here. It will be included in the self services pages after the body tag.

Usually, companies have regulations about their corporate design and use common CSS files. This assures a common appearance of all intranet pages (e.g. colors and fonts). To include additional CSS files just use the following setting for this task. The additional CSS links will be added after LAM Pro's default CSS link. This way you can overwrite LAM Pro's style.

Here is a list of needed LDAP schema files for the different LAM modules. For OpenLDAP we also provide a source where you can get the files. Account type Object class(es) Schema name Source Notes Unix accounts posixAccount, shadowAccount, hostObject, posixGroup nis.schema, rfc2307bis.schema, ldapns.schema (hostObject) Part of OpenLDAP installation, part of libpam-ldap (ldapns.schema) The rfc2307bis.schema is only supported by LAM Pro. Use the nis.schema if you do not want to upgrade to LAM Pro. Address book entries inetOrgPerson inetorgperson.schema Part of OpenLDAP installation Samba 3 accounts sambaSamAccount, sambaGroupMapping, sambaDomain samba.schema Part of Samba tarball (examples/LDAP/samba.schema) Kolab 2 users kolabUser kolab2.schema, rfc2739.schema Part of Kolab 2 installation Asterisk (extension) AsteriskSIPUser, AsteriskExtension asterisk.schema Part of Asterisk installation Mail routing inetLocalMailRecipient misc.schema Part of OpenLDAP installation Hosts hostObject, device ldapns.schema Part of libpam-ldap installation The device object class is only available in LAM Pro. Authorized services authorizedServiceObject ldapns.schema Part of libpam-ldap installation Mail aliases nisMailAlias misc.schema Part of OpenLDAP installation Qmail user qmailUser qmail.schema Part of qmail_ldap LAM Pro only MAC addresses ieee802device nis.schema Part of OpenLDAP installation IP addresses ipHost nis.schema Part of OpenLDAP installation LAM Pro only Puppet puppetClient puppet.schema Puppet on GitHub Simple Accounts account cosine.schema Part of OpenLDAP installation SSH public keys ldapPublicKey openssh-lpk.schema Included in patch from http://code.google.com/p/openssh-lpk/ Filesystem quotas systemQuotas quota.schema Linux DiskQuota Group of (unique) names groupOfNames, groupOfUniqueNames core.schema Part of OpenLDAP installation LAM Pro only DHCP dhcpOptions, dhcpSubnet, dhcpServer dhcp.schema docs/schema/dhcp.schema The LDAP suffix should be set to your dhcpServer entry. Aliases alias, uidObject core.schema Part of OpenLDAP installation LAM Pro only NIS netgroups nisNetgroup nis.schema Part of OpenLDAP installation NIS objects nisObject nis.schema Part of OpenLDAP installation LAM Pro only Automount objects automount autofs.schema, rfc2307bis.schema Autofs LDAP LAM Pro only Password policies pwdPolicy, device ppolicy.schema, core.schema Part of OpenLDAP installation LAM Pro only FreeRadius users radiusprofile openldap.schema Part of FreeRadius installation Heimdal Kerberos krb5KDCEntry hdb.schema Part of Heimdal Kerberos installation LAM Pro only MIT Kerberos krbPrincipal, krbPrincipalAux, krbTicketPolicyAux kerberos.schema Part of MIT Kerberos installation LAM Pro only Sudo roles sudoRole sudo.schema Part of sudo-ldap installation LAM Pro only Zarafa zarafa-user, zarafa-group, zarafa-server zarafa.schema Part of Zarafa installation LAM Pro only IMAP mailboxes - - - Does not require any schema.

LAM supports a two level authorization system for its configuration. Therefore, there are two types of configuration passwords: master configuration password: needed to change general settings, create/delete server profiles and self service profiles server profile password: used to change the settings of a server profile (e.g. LDAP server and account types to manage) The master configuration password can be used to reset a server profile password. Each server profile has its own profile password. Both password types are stored as hash values in the configuration files for enhanced security.

The data which is transfered between you and LAM is very sensitive. Please always use SSL encrypted connections between LAM and your browser to protect yourself against network sniffers.

SSL will be used if you use ldaps://servername in your configuration profile. TLS can be activated with the "Activate TLS" option. You will need to setup ldap.conf to trust your server certificate. Some installations use /etc/ldap.conf and some use /etc/ldap/ldap.conf. It is a good idea to symlink /etc/ldap.conf to /etc/ldap/ldap.conf. Specify the server CA certificate with the following option: TLS_CACERT /etc/ldap/ca/myCA/cacert.pem This needs to be the public part of the signing certificate authority. See "man ldap.conf" for additional options. You may also need to specify the CA certificate in your Apache configuration by using the option "LDAPTrustedGlobalCert": LDAPTrustedGlobalCert CA_BASE64 /etc/ldap/ca/myCA/cacert.pem

If your server is chrooted and you have no access to /dev/random or /dev/urandom this can be a security risk. LAM stores your LDAP password encrypted in the session. LAM uses rand() to generate the key if /dev/random and /dev/urandom are not accessible. Therefore the key can be easily guessed. An attaker needs read access to the session file (e.g. by another Apache instance) to exploit this.

You have to install the MCrypt extension for PHP to enable encryption. Your LDAP password is stored encrypted in the session file. The key and IV to decrypt it are stored in two cookies. We use MCrypt/AES to encrypt the password. All data that was read from LDAP and needs to be stored in the session file is also encrypted.

LAM includes several .htaccess files to protect your configuration files and temporary data. Apache is often configured to not use .htaccess files by default. Therefore, please check your Apache configuration and change the override setting to: AllowOverride All If you are experienced in configuring Apache then you can also copy the security settings from the .htaccess files to your main Apache configuration. If possible, you should not rely on .htaccess files but also move the config and sess directory to a place outside of your WWW root. You can put a symbolic link in the LAM directory so that LAM finds the configuration/session files. Security sensitive directories: config: Contains your LAM configuration and account profiles LAM configuration passwords (SSHA hashed) default values for new accounts directory must be accessibly by Apache but needs not to be accessible by the browser sess: PHP session files LAM admin password in clear text or MCrypt encrypted cached LDAP entries in clear text or MCrypt encrypted directory must be accessibly by Apache but needs not to be accessible by the browser tmp: temporary files PDF documents which may also include passwords images of your users directory contents must be accessible by browser but directory itself needs not to be browseable

With HTTP authentication Apache will be responsible to ask for the user name and password. Both will then be forwarded to LAM which will use it to access LDAP. This approach gives you more flexibility to restrict the number of users that may access LAM (e.g. by requiring group memberships). First of all you need to load additional Apache modules. These are "mod_ldap" and "mod_authnz_ldap". Next you can add a file called "lam_auth_ldap" to /etc/apache/conf.d. This simple example restricts access to all URLs beginning with "lam" to LDAP authentication. <location /lam> AuthType Basic AuthBasicProvider ldap AuthName "LAM" AuthLDAPURL "ldap://localhost:389/ou=People,dc=company,dc=com?uid" Require valid-user </location> You can also require that your users belong to a certain Unix group in LDAP: <location /lam> AuthType Basic AuthBasicProvider ldap AuthName "LAM" AuthLDAPURL "ldap://localhost:389/ou=People,dc=company,dc=com?uid" Require valid-user # force membership of lam-admins AuthLDAPGroupAttribute memberUid AuthLDAPGroupAttributeIsDN off Require ldap-group cn=lam-admins,ou=group,dc=company,dc=com </location> Please see the Apache documentation for more details.

Some basic hints to configure the OpenLDAP server: Size limit: OpenLDAP allows by default 500 return values per search, if you have more users/groups/hosts change this in slapd.conf: e.g. "sizelimit 10000" or "sizelimit -1" for unlimited return values. Indices: Indices will improve the performance when searching for entries in the LDAP directory. The following indices are recommended: index objectClass eq index default sub index uidNumber eq index gidNumber eq index memberUid eq index cn,sn,uid,displayName pres,sub,eq # Samba 3.x index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq Lamdaemon.pl is used to modify quota and home directories on a remote or local host via SSH. If you want wo use it you have to set up the following things to get it to work:

Set the remote or local host in the configuration (e.g. 127.0.0.1) Path to lamdaemon.pl, e.g. /srv/www/htdocs/lam/lib/lamdaemon.pl If you installed a Debian or RPM package then the script will be located at /usr/share/ldap-account-manager/lib/lamdaemon.pl. Your LAM admin user must be a valid Unix account. It needs to have the object class "posixAccount" and an attribute "uid". This account must be accepted by the SSH daemon of your home directory server. Do not create a second local account but change your system to accept LDAP users. You can use LAM to add the Unix account part to your admin user or create a new account. Please do not forget to setup LDAP write access (ACLs) if you create a new account. OpenLDAP ACL location: The access rights for OpenLDAP are configured in /etc/ldap/slapd.conf or /etc/ldap/slapd.d/cn=config/olcDatabase={1}bdb.ldif.

The perl script has to run as root. Therefore we need a wrapper, sudo. Edit /etc/sudoers on host where homedirs or quotas should be used and add the following line: $admin All= NOPASSWD: $path_to_lamdaemon * $admin is the admin user from LAM (must be a valid Unix account) and $path_to_lamdaemon is the path to lamdaemon.pl. Example: myAdmin ALL= NOPASSWD: /srv/www/htdocs/lam/lib/lamdaemon.pl * You might need to run the sudo command once manually to init sudo. The command "sudo -l" will show all possible sudo commands of the current user. Attention: Please do not use the options "Defaults requiretty" and "Defaults env_reset" in /etc/sudoers. Otherwise you might get errors like "you must have a tty to run sudo" or "no tty present and no askpass program specified".

We need an extra Perl module - Quota. To install it, run: perl -MCPAN -e shell install Quota If your Perl executable is not located in /usr/bin/perl you will have to edit the path in the first line of lamdaemon.pl. If you have problems compiling the Perl modules try installing a newer release of your GCC compiler and the "make" application. Several Linux distributions already include a quota package for Perl.

Your SSH daemon must offer the password authentication method. To activate it just use this configuration option in /etc/ssh/sshd_config: PasswordAuthentication yes

If you have problems managing quotas and home directories then these points might help: There is a test page for lamdaemon: Login to LAM and open Tools -> Tests -> Lamdaemon test Check /var/log/auth.log or its equivalent on your system. This file contains messages about all logins. If the ssh login failed then you will find a description about the reason here. Set sshd in debug mode. In /etc/ssh/sshd_conf add these lines: SyslogFacility AUTH LogLevel DEBUG3 Now check /var/log/syslog for messages from sshd. Update Openssh. A Suse Linux user reported that upgrading Openssh solved the problem.

Here are some notes on managing Kolab accounts with LAM:

The mailbox server cannot be changed after the account has been saved. Please make sure that the value is correct. The email address ("Personal" page) must match your Kolab domain, otherwise the account will not work.

If you want to cleanly delete accounts use the "Mark for deletion" button on the Kolab subpage of an account. This will also remove the user's mailbox. If you delete the account from the account list (which is standard for LAM accounts) then no cleanup actions are made.

The Kolab GUI has some restrictions that LAM does not have. Please pay attention to the following restrictions: Common name in LAM The common name must have the format "<first name> <last name>". You can leave the field empty in LAM and it will automatically fill in the correct value. Changing first/last name in Kolab GUI Do not change the first/last name of your users in the Kolab GUI! The GUI will change the common name which leads to an LDAP object class violation. This is caused by a bug in the Kolab GUI.

If you upgrade existing non-Kolab accounts please make sure that the account has an Unix password.

You can install LAM in the directory "/kolab/var/kolab/www" which is the root directory for Apache. The PHP installation already includes all required packages.

If you get any strange errors like "Invalid syntax" or "Invalid DN syntax" please check if your LDAP schema matches LAM's requirements. Schema test: This can be done by running "Tools" -> "Tests" -> "Schema test" inside LAM. If there are any object classes or attributes missing you will get a notice. See LDAP schema files for a list of used schemas. You may also want to deactive unused modules in your LAM server profile (tab "Modules"). Logging: If your schema is correct you can turn on LDAP logging to get more detailed error messages from your LDAP server. OpenLDAP logging: slapd.conf: In /etc/ldap/slapd.conf turn logging on with the line "loglevel 256". slapd.d: In /etc/ldap/slapd.d/cn=config.ldif please change the attribute "olcLogLevel" to "Stats". Please add a line "olcLogLevel: Stats" if the attribute is missing. After changing the configuration please restart OpenLDAP. It usually uses /var/log/syslog for log output.