ClearOS LDAP configuration

Need to install the Certificate Manager and Directory Server modules.

• Create an okmAdmin user in ClearOS.
• Create ROLE_ADMIN, ROLE_USER groups in ClearOS, populate.

LDAP Structure

dc=local
    dc=mydomain
	    ou=Accounts
		    ou=Groups
			    cn=ROLE_ADMIN
				    member=okmAdmin
				    member=user1
				    member=user2
				    objectClass=posixGroup
			    cn=ROLE_USER
				    member=user3
				    member=user4
				    objectClass=posixGroup
			    cn=ROLE_XXXX
				    objectClass=posixGroup
			    cn=ROLE_YYYY
				    objectClass=posixGroup
			    ...

                    ou=Users
			    uid=okmAdmin
				    memberOf=CN=ROLE_ADMIN,ou=Groups,ou=Accounts,dc=mydomain,dc=local
				    mail=okmAdmin@mail.com
				    cn=OpenKM Administrator
				    objectClass=inetOrgPerson
			    uid=user1
				    memberOf=CN=ROLE_ADMIN,ou=Groups,ou=Accounts,dc=mydomain,dc=local
				    mail=user1@mail.com
				    cn=User Name 1
				    objectClass=inetOrgPerson
			    uid=user2
				    memberOf=CN=ROLE_ADMIN,ou=Groups,ou=Accounts,dc=mydomain,dc=local
				    mail=user2@mail.com
				    cn=User Name 3
				    objectClass=inetOrgPerson

Configuration parameters

Go to Administration > Configuration parameters 

OpenKM.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns:beans="http://www.springframework.org/schema/beans"
             xmlns:security="http://www.springframework.org/schema/security"
             xmlns:task="http://www.springframework.org/schema/task"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://www.springframework.org/schema/beans
                                 http://www.springframework.org/schema/beans/spring-beans.xsd
                                 http://www.springframework.org/schema/security
                                 http://www.springframework.org/schema/security/spring-security.xsd
                                 http://www.springframework.org/schema/task
                                 http://www.springframework.org/schema/task/spring-task.xsd">
 
 
  <!-- Security configuration -->
  <security:authentication-manager alias="authenticationManager">
  	<security:authentication-provider ref="ldapAuthProvider" />
  </security:authentication-manager>
 
  <beans:bean id="contextSource" class="org.springframework.security.ldap.DefaultSpringSecurityContextSource">
    	<beans:constructor-arg value="ldaps://ldap.mydomain.local:636/dc=mydomain,dc=local"/>
  		<beans:property name="userDn" value="cn=Manager,ou=Internal,dc=mydomain,dc=local"/>
    	<beans:property name="password" value="pass1234"/>
  </beans:bean>
 
  <beans:bean id="ldapAuthProvider" class="org.springframework.security.ldap.authentication.LdapAuthenticationProvider">
	<beans:constructor-arg>
		<beans:bean class="org.springframework.security.ldap.authentication.BindAuthenticator">
			<beans:constructor-arg ref="contextSource"/>
			<beans:property name="userSearch" ref="userSearch"></beans:property>
  		</beans:bean>
	</beans:constructor-arg>
	<beans:constructor-arg>
		<beans:bean class="org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator">
			<beans:constructor-arg ref="contextSource"/>
			<beans:constructor-arg value="ou=groups,ou=Accounts"/>
			<beans:property name="groupSearchFilter" value="member={0}"/>
			<beans:property name="groupRoleAttribute" value="cn"/>
			<beans:property name="searchSubtree" value="true" />
			<beans:property name="convertToUpperCase" value="true" />
			<beans:property name="rolePrefix" value="" /> 
 
		</beans:bean>
	</beans:constructor-arg>
  </beans:bean>
 
   <beans:bean id="userSearch" class="org.springframework.security.ldap.search.FilterBasedLdapUserSearch">
       <beans:constructor-arg index="0" value="ou=Users,ou=Accounts" />
       <beans:constructor-arg index="1" value="uid={0}" />
       <beans:constructor-arg index="2" ref="contextSource" />
       <beans:property name="searchSubtree" value="true" />
   </beans:bean>
 
</beans:beans>

Create a Certificate

ClearOS by default only allows LDAPS.

Add the CA cert to the nssdb:

The LDAP server certificate needs to be saved in the nssdb with the name of Server-Cert.

Edit the file/etc/openldap/slapd.conf:

TLSCACertificatePath    /etc/pki/nssdb
TLSCertificateFile      Server-Cert
TLSVerifyClient         never

Allow LDAP in ClearOS to be queried by OpenKM - edit the end of slapd.conf thusly:

access to *
    by self write
    by peername.ip=127.0.0.1 read
    ...
    by peername.ip=<OpenKM's IP address> read

Copy ClearOS' public CA certificate to the OpenKM server and add it to OpenKM's keystore: