Install phpLDAPadmin on Rocky Linux 8

0
150

In this guide, we are going to learn how to install phpLDAPadmin on Rocky Linux 8. phpLDAPadmin is web application written in PHP for administering LDAP and thus it comes in very handy for system administrators who are gui centric. With it, you can administer LDAP via the browser.

Before you can proceed, learn how to install OpenLDAP on Rocky Linux 8 by following the link below;

Install and Setup OpenLDAP on Rocky Linux 8

Install phpLDAPadmin on Rocky Linux 8

Install Required Third Party Repositories

Some of the required packages such phpLDAPadmin and php-ldap module, are not available on the default Rocky Linux 8 repositories.

As such, you need to install some third party repo.

  • Install EPEL repos on Rocky Linux:
dnf install epel-release
  • Install Lux YUM repository, which provides phpLDAPadmin packages:
dnf install http://repo.iotti.biz/CentOS/8/noarch/lux-release-8-1.noarch.rpm
  • Install Remi repository, which provides required PHP-LDAP modules:
dnf install https://rpms.remirepo.net/enterprise/remi-release-8.rpm

Enable PHP 7.4 Remi module

dnf module reset php
dnf module enable php:remi-7.4

Install phpLDAPadmin on Rocky Linux 8

Once the repos are in place, then run the command below to install phpLDAPadmin on Rocky Linux 8.

dnf install phpldapadmin
Dependencies resolved.
============================================================================================================================================================================
 Package                                   Architecture                       Version                                        Repository                                Size
============================================================================================================================================================================
Installing:
 phpldapadmin                              noarch                             1.2.6.2-1.el8.lux                              lux                                      799 k
Installing dependencies:
 oniguruma5php                             x86_64                             6.9.7.1-1.el8.remi                             remi-safe                                210 k
 php-common                                x86_64                             7.4.20-1.el8.remi                              remi-modular                             1.2 M
 php-fpm                                   x86_64                             7.4.20-1.el8.remi                              remi-modular                             1.6 M
 php-gd                                    x86_64                             7.4.20-1.el8.remi                              remi-modular                              93 k
 php-json                                  x86_64                             7.4.20-1.el8.remi                              remi-modular                              77 k
 php-ldap                                  x86_64                             7.4.20-1.el8.remi                              remi-modular                              97 k
 php-mbstring                              x86_64                             7.4.20-1.el8.remi                              remi-modular                             529 k
 php-xml                                   x86_64                             7.4.20-1.el8.remi                              remi-modular                             215 k

Transaction Summary
============================================================================================================================================================================
Install  9 Packages

Total download size: 4.8 M
Installed size: 26 M
Is this ok [y/N]: y

Configure phpLDAPadmin on Rocky Linux 8

After installing phpLDAPadmin, proceed to configure it to connect to your openLDAP server.

To begin with, backup the default configuration file provided;

cp /etc/phpldapadmin/config.php{,.orig}

Open the configuration file, /etc/phpldapadmin/config.php for editing;

vim /etc/phpldapadmin/config.php

Scroll down the configuration file to the section;

/*********************************************
 * Define your LDAP servers in this section  *
 *********************************************/

Define a suitable name for your LDAP server. This name will appear on phpLDAPadmin web interface.

$servers->setValue('server','name','Kifarunix-demo LDAP master');

Set your OpenLDAP address, this can be a resolvable hostname or an IP address.

$servers->setValue('server','host','192.168.60.29');

If your OpenLDAP server is listening on non default port, uncomment the highlighted line below and define the port. (Default port, 389/tcp is used here)

/* The port your LDAP server listens on (no quotes). 389 is standard. */
// $servers->setValue('server','port',389);

Define your OpenLDAP base DNs.

$servers->setValue('server','base',array('dc=ldapmaster,dc=kifarunix-demo,dc=com'));

If you want to define a static bind DN, set it under the section;

/* The DN of the user for phpLDAPadmin to bind with. For anonymous binds or
    'cookie','session' or 'sasl' auth_types, LEAVE THE LOGIN_DN AND LOGIN_PASS
    BLANK. If you specify a login_attr in conjunction with a cookie or session
    auth_type, then you can also specify the bind_id/bind_pass here for searching
    the directory for users (ie, if your LDAP server does not allow anonymous
    binds. */
 // $servers->setValue('login','bind_id','');
#  $servers->setValue('login','bind_id','cn=Manager,dc=example,dc=com');

/* Your LDAP password. If you specified an empty bind_id above, this MUST also
   be blank. */
// $servers->setValue('login','bind_pass','');
#  $servers->setValue('login','bind_pass','secret');

In this guide, we have chosen not define a static bind DN. Read the highlighted section above.

Define phpLDAPadmin login attribute. We use dn in this guide. You can use uid, if you want.

// $servers->setValue('login','attr','uid');
$servers->setValue('login','attr','dn');

This will require a full DN for logging in.

Those are just but a few phpLDAPadmin configurations made in this guide. Be sure to make configurations to suit your needs.

Create Web Server configuration for phpLDAPadmin

First, you need a web server, which can be Apache or Nginx to be able to access phpLDAPadmin from the web browser.

We use Apache in this setup. Thus install it.

dnf install httpd

Next, you need to create web configuration for phpLDAPadmin to define how it is going to be access from the browser.

cat > /etc/httpd/conf.d/phpldapadmin.conf << 'EOL'
Alias /phpldapadmin /usr/share/phpldapadmin/htdocs

<Directory /usr/share/phpldapadmin/htdocs>
  <IfModule mod_authz_core.c>
    Require all granted
  </IfModule>
</Directory>
EOL

Save and exit the configuration file.

With this configuration, you will have to access phpLDAPadmin on browser using the URL, http://ldap-server-hostname-OR-IP/phpldapadmin.

On the other hand, you can create an Apache VirtualHost for phpLDAPadmin as shown below. Be sure to make appropriate replacements in the configurations.

cat > /etc/httpd/conf.d/phpldapadmin.conf 'EOL'
<VirtualHost *:80>
        ServerName ldapmaster.kifarunix-demo.com
        DocumentRoot /usr/share/phpldapadmin/htdocs
        
        <Directory /usr/share/phpldapadmin/htdocs>
          <IfModule mod_authz_core.c>
            # Apache 2.4
            Require all granted
          </IfModule>
        </Directory>
        ErrorLog /var/log/httpd/phpldapadmin.error.log
        CustomLog /var/log/httpd/phpldapadmin.access.log combined
</VirtualHost>
EOL

With this configuration, you can access phpLDAPadmin using the URL, http://ldap-server-hostname-OR-IP.

Set the proper ownership of the document root as shown below;

chown -R apache:apache /usr/share/phpldapadmin

Check apache for syntax errors.

httpd -t

If you get the output, Syntax OK, then you good to go. Otherwise, fix any would be error before you can proceed.

Configure FirewallD

Allow external access to Apache on firewalld, if it is running.

firewall-cmd --add-port=80/tcp --permanent
firewall-cmd --reload

Configure SELinux

If SELinux is running, run the following commands to;

Allow httpd to connect to the network.

setsebool -P httpd_can_network_connect 1

Allow httpd to connect to OpenLDAP server.

setsebool -P httpd_can_connect_ldap 1

Resolve user passwd entries directly from ldap

setsebool -P authlogin_nsswitch_use_ldap 1

To allow system to run with NIS.

setsebool -P nis_enabled 1

Running Apache

Start and enable Apache to run on system boot.

systemctl enable --now httpd

Accessing phpLDAPadmin on Rocky Linux 8

You can now access phpLDAPadmin from any browser using the url. http://server-hostname-or-IP/phpldapadmin or http://server-hostname-or-IP depending on your configuration.

This will take you the phpLDAPadmin web interface.

Install phpLDAPadmin on Rocky Linux 8

Click login just below the name of your LDAP server to get a login interface. To login, you can specify your DN for example, cn=admin,dc=ldapmaster,dc=kifarunix-demo,dc=com.

Install phpLDAPadmin on Rocky Linux 8

Upon successful login, you should be able to see your LDAP structure.

Install phpLDAPadmin on Rocky Linux 8

If by clicking the schema you get the error below;

Our attempts to find your SCHEMA have failed (objectclasses)

Install phpLDAPadmin on Rocky Linux 8

Then you need to enable anonymous read access to Subschema on the frontend LDAP database in order to fix this.

If you followed our guide to install and setup OpenLDAP server on Rocky Linux 8 whose link is provided above, then our current access control lists on the frontend database are;

ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=config '(olcDatabase={-1}frontend)' olcAccess
dn: olcDatabase={-1}frontend,cn=config
olcAccess: {0}to *  by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=externa
 l,cn=auth" manage  by * none

To allow anyone to read the LDAP schema, you simply need to add the ACL below to frontend database as the first ACL.

to dn.base="cn=Subschema" by * read

Use LDIF file to implement this change.

vim read-access-to-subschema.ldif
dn: olcDatabase={-1}frontend,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to dn.base="cn=Subschema" by * read

Update the database.

ldapadd -H ldapi:/// -Y EXTERNAL -f read-access-to-subschema.ldif

List the access control lists again.

ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=config '(olcDatabase={-1}frontend)' olcAccess
dn: olcDatabase={-1}frontend,cn=config
olcAccess: {0}to dn.base="cn=Subschema" by * read
olcAccess: {1}to *  by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=externa
 l,cn=auth" manage  by * none

Restart both LDAP and Apache Service.

systemctl restart httpd slapd

You should now be able to read your OpenLDAP schema and directory tree as well as administer OpenLDAP server from web using phpLDAPadmin.

Install phpLDAPadmin on Rocky Linux 8

That marks the end of our guide on how to install phpLDAPadmin on Rocky Linux 8.

Related OpenLDAP Tutorials

Configure SSSD for LDAP Authentication on Rocky Linux 8

Setup Apache Guacamole OpenLDAP Authentication

Configure Squid Proxy OpenLDAP Authentication on pfSense

LEAVE A REPLY

Please enter your comment!
Please enter your name here