LCMAPS_LDAP_ENF.MOD(8)

💖 lcmaps_ldap_enf.mod — it's giving "manual page, but make it cute" ✨

okay bestie, welcome to the LCMAPS_LDAP_ENF.MOD(8) page, living in the System Manager's Manual section. this one is a whole vibe: it's the LCMAPS plugin that goes into your LDAP directory and updates stuff. let's get into it 🦋

---

🌸 NAME 🌸

lcmaps_ldap_enf.mod — the LCMAPS plugin that updates ldap based on your credentials, no cap 💅

---

✨ SYNOPSIS ✨

lcmaps_ldap_enf.mod -maxuid maxuid -maxpgid maxpgid -maxsgid maxsgid
-hostname hostname -port port [-require_all_groups {yes|no}] -dn_manager
DN -ldap_pw filename -sb_groups searchbase -sb_user searchbase -timeout
seconds

okay so look at that synopsis, it's a lot, but we're gonna walk through every single flag together, don't even worry 🫶

---

🎀 DESCRIPTION 🎀

so the Ldap enforcement plugin will alter the user and group settings in the ldap database, using the user and group settings that the credential acquisition plugins handed over. that's the whole job, that's the main character energy right there 👑

⚠️ note this, bestie, it's important: LDAP has to be used as the source of account information for PAM or NSS, and it has to be RFC 2307 compliant. no exceptions, periodt.

---

💅 OPTIONS 💅

okay here's the full roster, every single one, we're not skipping anybody:

• -maxuid maxuid — the maximum number of uids that can be used. and listen, it is strongly advised to set this to 1. like, seriously. do it. 🙈
• -maxpgid maxpgid — the maximum number of primary gids that can be used.
• -maxsgid maxsgid — the maximum number of (secondary) gids that can be used, and no, the primary group does not count in this one. advised value? 1. iconic. ✨
• -hostname hostname — the hostname where the LDAP server is chillin', like asen.nikhef.nl
• -port port — the port number you connect to, like 389
• -require_all_groups {yes|no} — tells you whether all the groups that the PluginManager set shall be used. default is 'yes' 💜
• -dn_manager DN — the DN of the LDAP manager, like "cn=Manager,dc=root"
• -ldap_pw filename — the path to the file holding the LDAP manager's password.

😭 okay this one is a whole thing: the mode of the password file must be read-only for root (400), otherwise the plugin will not run. not even a little bit. so chmod accordingly, bestie.

• -sb_groups searchbase — the search base for the (secondary) groups, like "ou=LocalGroups, dc=example, dc=com"
• -sb_user searchbase — the search base for the user, like "ou=LocalUsers, dc=example, dc=com"
• -timeout timeout value — the timeout, in seconds, that gets applied to the ldap binding ⏳

---

🌈 RETURN VALUE 🌈

• LCMAPS_MOD_SUCCESS — success!! we ate 💅🎉
• LCMAPS_MOD_FAIL — failure. it's giving pain 💀

---

🦋 BUGS 🦋

found a bug? please report any errors to the Nikhef Grid Middleware Security Team <grid-mw-security-support@nikhef.nl>. they wanna hear about it, fr fr 🫶

---

🔥 SEE ALSO 🔥

lcmaps.db(5), lcmaps(3), ldap(3). go read those too, iykyk 📚

---

👑 AUTHORS 👑

LCMAPS and the LCMAPS plug-ins were written by the Grid Middleware Security Team <grid-mw-security@nikhef.nl>. legends, honestly. 💖

---

and that's the whole page, bestie!! 🎀 this little gem lives in the System Manager's Manual, and the version you're reading is dated March 22, 2011. go forth and enforce that ldap, you've got this 🌸💅✨