{"id":4919,"date":"2020-01-16T21:17:44","date_gmt":"2020-01-16T18:17:44","guid":{"rendered":"https:\/\/kifarunix.com\/?p=4919"},"modified":"2024-03-13T07:46:31","modified_gmt":"2024-03-13T04:46:31","slug":"install-phpldapadmin-on-centos-8","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/install-phpldapadmin-on-centos-8\/","title":{"rendered":"Install phpLDAPadmin on CentOS 8"},"content":{"rendered":"\n

In this guide, we are going to learn how to install phpLDAPadmin on CentOS 8. phpLDAPadmin is web application written in PHP for administering LDAP and thus it comes in very handy for system administrators who are gui centric. With it, you can administer LDAP via the browser.<\/p>\n\n\n\n

Before you can proceed, learn how to install OpenLDAP on CentOS 8 by following the link below;<\/p>\n\n\n\n

Install and Setup OpenLDAP on CentOS 8<\/a><\/p>\n\n\n\n

Installing phpLDAPadmin on CentOS 8<\/h2>\n\n\n\n

Install PHP and Required Modules<\/h3>\n\n\n\n

Run the command below to install PHP and other required PHP modules.<\/p>\n\n\n\n

dnf install php php-cgi php-mbstring php-common php-pear php-{gd,json,zip} php-ldap<\/code><\/pre>\n\n\n\n
Install phpLDAPadmin<\/h3>\n\n\n\n
phpLDAPadmin is not available on the default CentOS 8 repositories. Further, it doesn’t support PHP 7.2, which is installed when above commands are run.<\/p>\n\n\n\n
php -v<\/code><\/pre>\n\n\n\n
PHP 7.2.11 (cli) (built: Oct  9 2018 15:09:36) ( NTS )\nCopyright (c) 1997-2018 The PHP Group\nZend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies<\/code><\/pre>\n\n\n\n
However, somebody has made an effort to ensure that phpLDAPadmin supports PHP 7.2. This is none other than breisig<\/a>. In this guide, we are going to clone breisig’s phpLDAPadmin github repository and install it on CentOS 8.<\/p>\n\n\n\n
dnf install git<\/code><\/pre>\n\n\n\n
git clone https:\/\/github.com\/breisig\/phpLDAPadmin.git \/usr\/share\/phpldapadmin<\/code><\/pre>\n\n\n\n
This will install phpLDAPadmin under \/usr\/share\/phpldapadmin <\/code>directory.<\/p>\n\n\n\n
Configure phpLDAPadmin on CentOS 8<\/h3>\n\n\n\n
After installing phpLDAPadmin, proceed to configure it to connect to your openLDAP server.<\/p>\n\n\n\n
To begin with, rename the sample configuration file provided;<\/p>\n\n\n\n
cp \/usr\/share\/phpldapadmin\/config\/config.php{.example,}<\/code><\/pre>\n\n\n\n
Open the configuration file, \/usr\/share\/phpldapadmin\/config\/config.php<\/code> for editing;<\/p>\n\n\n\n
vim \/usr\/share\/phpldapadmin\/config\/config.php<\/code><\/pre>\n\n\n\n
Scroll down the configuration file to the section;<\/p>\n\n\n\n
\/*********************************************\n * Define your LDAP servers in this section  *\n *********************************************\/<\/code><\/pre>\n\n\n\n
Define a suitable name for your LDAP server. This name will appear on phpLDAPadmin web interface.<\/p>\n\n\n\n
$servers->setValue('server','name','Kifarunix-demo LDAP master');<\/code><\/pre>\n\n\n\n
Set your OpenLDAP address, this can be a resolvable hostname or an IP address.<\/p>\n\n\n\n
$servers->setValue('server','host','192.168.56.152');<\/code><\/pre>\n\n\n\n
If your OpenLDAP server is listening on non default port, define the port under the section. (Default is used here)<\/p>\n\n\n\n
\/* The port your LDAP server listens on (no quotes). 389 is standard. *\/\n\/\/ $servers->setValue('server','port',389);<\/code><\/pre>\n\n\n\n
Define your OpenLDAP base DNs.<\/p>\n\n\n\n
$servers->setValue('server','base',array('dc=ldapmaster,dc=kifarunix-demo,dc=com'));<\/code><\/pre>\n\n\n\n
If you want to define a static bind DN, set it under the section;<\/p>\n\n\n\n
\/* The DN of the user for phpLDAPadmin to bind with. For anonymous binds or\n    'cookie','session' or 'sasl' auth_types, LEAVE THE LOGIN_DN AND LOGIN_PASS\n    BLANK. If you specify a login_attr in conjunction with a cookie or session\n    auth_type, then you can also specify the bind_id\/bind_pass here for searching\n    the directory for users (ie, if your LDAP server does not allow anonymous\n    binds.<\/strong> *\/\n \/\/ $servers->setValue('login','bind_id','');\n#  $servers->setValue('login','bind_id','cn=Manager,dc=example,dc=com');<\/strong>\n\n\/* Your LDAP password. If you specified an empty bind_id above, this MUST also\n   be blank. *\/\n\/\/ $servers->setValue('login','bind_pass','');\n#  $servers->setValue('login','bind_pass','secret');<\/strong>\n<\/code><\/pre>\n\n\n\n
In this guide, we have chosen not define a static bind DN. Read the highlighted section above.<\/p>\n\n\n\n
You can as well define a login attribute.<\/p>\n\n\n\n
$servers->setValue('login','attr','dn');<\/code><\/pre>\n\n\n\n
This will require a full DN for logging in.<\/p>\n\n\n\n
Those are just but a few phpLDAPadmin configurations made in this guide. Be sure to make configurations to suit your needs.<\/p>\n\n\n\n
Save and exit the configuration file and set the proper ownership as shown below;<\/p>\n\n\n\n
chown -R apache:apache \/usr\/share\/phpldapadmin<\/code><\/pre>\n\n\n\n
Create Apache for phpLDAPadmin<\/h3>\n\n\n\n
Next, you need to create web configuration for phpLDAPadmin to define how it is going to be access from the browser.<\/p>\n\n\n\n
vim \/etc\/httpd\/conf.d\/phpldapadmin.conf<\/code><\/pre>\n\n\n\n
Alias \/phpldapadmin \/usr\/share\/phpldapadmin\/htdocs\n\n<Directory \/usr\/share\/phpldapadmin\/htdocs>\n  <IfModule mod_authz_core.c>\n    Require all granted\n  <\/IfModule>\n<\/Directory><\/code><\/pre>\n\n\n\n
Save and exit the configuration file. With this configuration, you will have to access phpLDAPadmin on browser using the URL, http:\/\/ldap-server-hostname-OR-IP\/phpldapadmin<\/code><\/strong>.<\/p>\n\n\n\n
On the other hand, you can create an Apache VirtualHost for phpLDAPadmin as shown below. Be sure to make appropriate replacements in the configurations.<\/p>\n\n\n\n
vim \/etc\/httpd\/conf.d\/phpldapadmin.conf<\/code><\/pre>\n\n\n\n
<VirtualHost *:80>\n        ServerName ldapmaster.kifarunix-demo.com\n        DocumentRoot \/usr\/share\/phpldapadmin\/htdocs\n        \n        <Directory \/usr\/share\/phpldapadmin\/htdocs>\n          <IfModule mod_authz_core.c>\n            # Apache 2.4\n            Require all granted\n          <\/IfModule>\n        <\/Directory>\n        ErrorLog \/var\/log\/httpd\/ldapmaster.kifarunix-demo.com.error.log\n        CustomLog \/var\/log\/httpd\/ldapmaster.kifarunix-demo.com.access.log combined\n<\/VirtualHost><\/code><\/pre>\n\n\n\n
With this configuration, you can access phpLDAPadmin using the URL, http:\/\/ldap-server-hostname-OR-IP<\/code><\/strong>. <\/p>\n\n\n\n
Check apache for syntax errors.<\/p>\n\n\n\n
httpd -t<\/code><\/pre>\n\n\n\n
If you get the output, Syntax OK<\/code>, then you good to go. Otherwise, fix any would be error before you can proceed.<\/p>\n\n\n\n
Configure FirewallD<\/h3>\n\n\n\n
Allow external access to Apache on firewalld, if it is running.<\/p>\n\n\n\n
firewall-cmd --add-port=80\/tcp --permanent<\/code><\/pre>\n\n\n\n
firewall-cmd --reload<\/code><\/pre>\n\n\n\n
Configure SELinux<\/h3>\n\n\n\n
If SELinux is running, run the following commands to;<\/p>\n\n\n\n
Allow httpd to connect to the network.<\/p>\n\n\n\n
setsebool -P httpd_can_network_connect 1<\/code><\/pre>\n\n\n\n
Allow httpd to connect to OpenLDAP server.<\/p>\n\n\n\n
setsebool -P httpd_can_connect_ldap 1<\/code><\/pre>\n\n\n\n
Resolve user passwd entries directly from ldap<\/p>\n\n\n\n
setsebool -P authlogin_nsswitch_use_ldap 1<\/code><\/pre>\n\n\n\n
To allow system to run with NIS.<\/p>\n\n\n\n
setsebool -P nis_enabled 1<\/code><\/pre>\n\n\n\n
Running Apache<\/h4>\n\n\n\n
Start and enable Apache to run on system boot.<\/p>\n\n\n\n
systemctl enable --now httpd<\/code><\/pre>\n\n\n\n
Accessing phpLDAPadmin on CentOS 8<\/h3>\n\n\n\n
You can now access phpLDAPadmin from any browser using the url. http:\/\/server-hostname-or-IP\/phpldapadmin<\/code><\/strong> or http:\/\/server-hostname-or-IP<\/code><\/strong> depending on your configuration.<\/p>\n\n\n\n
This will take you the phpLDAPadmin web interface.<\/p>\n\n\n\n
\"Install<\/figure>\n\n\n\n
Click login<\/strong> just below the name of your LDAP server to get a login interface. To login, you can specify your DN for example, cn=admin,dc=ldapmaster,dc=kifarunix-demo,dc=com<\/strong><\/code>.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Upon successful login, you should be able to see your LDAP structure.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
If by clicking the schema you get the error below;<\/p>\n\n\n\n
Our attempts to find your SCHEMA have failed (objectclasses)<\/strong><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Then you need to enable anonymous read access to Subschema on the frontend LDAP database in order to fix this.<\/p>\n\n\n\n
If you followed our guide to install and setup OpenLDAP server on CentOS 8 whose link is provided above, then our current access control lists on the frontend database are;<\/p>\n\n\n\n
ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:\/\/\/ -b cn=config '(olcDatabase={-1}frontend)' olcAccess<\/code><\/pre>\n\n\n\n
dn: olcDatabase={-1}frontend,cn=config\nolcAccess: {0}to *  by dn.base=\"gidNumber=0+uidNumber=0,cn=peercred,cn=externa\n l,cn=auth\" manage  by * none<\/code><\/pre>\n\n\n\n
To allow anyone to read the LDAP schema, you simply need to add the ACL below to frontend database as the first ACL.<\/p>\n\n\n\n
to dn.base=\"cn=Subschema\" by * read<\/code><\/pre>\n\n\n\n
Use LDIF file to implement this change.<\/p>\n\n\n\n
vim read-access-to-subschema.ldif<\/code><\/pre>\n\n\n\n
dn: olcDatabase={-1}frontend,cn=config\nchangetype: modify\nadd: olcAccess\nolcAccess: {0}to dn.base=\"cn=Subschema\" by * read<\/code><\/pre>\n\n\n\n
Update the database.<\/p>\n\n\n\n
ldapadd -H ldapi:\/\/\/ -Y EXTERNAL -f read-access-to-subschema.ldif<\/code><\/pre>\n\n\n\n
List the access control lists again.<\/p>\n\n\n\n
ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:\/\/\/ -b cn=config '(olcDatabase={-1}frontend)' olcAccess<\/code><\/pre>\n\n\n\n
dn: olcDatabase={-1}frontend,cn=config\nolcAccess: {0}to dn.base=\"cn=Subschema\" by * read\nolcAccess: {1}to *  by dn.base=\"gidNumber=0+uidNumber=0,cn=peercred,cn=externa\n l,cn=auth\" manage  by * none<\/code><\/pre>\n\n\n\n
Restart both LDAP and Apache Service.<\/p>\n\n\n\n
systemctl restart httpd slapd<\/code><\/pre>\n\n\n\n
You should now be able to read your OpenLDAP schema and directory tree as well as administer OpenLDAP server from web using phpLDAPadmin.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Related OpenLDAP Tutorials<\/h3>\n\n\n\n
Implement OpenLDAP Password Policies<\/a><\/p>\n\n\n\n
Configure ownCloud OpenLDAP Authentication<\/a><\/p>\n\n\n\n
How to Configure SUDO via OpenLDAP Server<\/a><\/p>\n\n\n\n
Configure OpenLDAP Host Based Authentication<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
In this guide, we are going to learn how to install phpLDAPadmin on CentOS 8. phpLDAPadmin is web application written in PHP for administering LDAP<\/p>\n","protected":false},"author":1,"featured_media":9240,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[121,285,1099],"tags":[1142,4272,4273,286,1267,1266,1268],"class_list":["post-4919","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-howtos","category-directory-server","category-openldap","tag-centos-8","tag-install-phpldapadmin-on-centos","tag-install-phpldapadmin-on-centos-8","tag-openldap","tag-php-7-2","tag-phpdapadmin","tag-phpldapadmin-on-centos-8","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/4919"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=4919"}],"version-history":[{"count":5,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/4919\/revisions"}],"predecessor-version":[{"id":21300,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/4919\/revisions\/21300"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/9240"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=4919"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=4919"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=4919"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}