Infrastructure Readied For LDAP

Sometimes there are circumstances where we know that certain technologies will make us more effective, but we don't have people on staff to implement.  This was the case with LDAP publishing of user accounts.  Clearly it's wonderful, but no one is on staff to properly maintain it.  It's easy to fear the situation where even if one person gets it working, if they are out of the office you have the potential for longer down times if something breaks or fails.  Do you really want System Administrators punching in phone numbers and making updates?  We reached the point where it's needed, we have too many external applications that need shared information.  How best to deploy?

After consideration and discussion we decided to create a screen in our support portal that allows all IT staff to make modifications to basic information and it creates a LDIF file which is housed on the GNOME server.  While we perfect our work flow, these files will be uploaded into the LDAP server by our admins, with the goal of automating that once it's been proven.  This approach is clean to me because we have all of the "source" files out of LDAP.  If something gets damaged, it's easily repaired and recovered.  So I wrote a little vcf2ldif utility that sucked out all of the data out of Evolution/Groupwise and created LDIF files. 


The support portal software already had a "user detail" screen, so the fields that we needed were added to another tab and are easily editable.  When the save button is pressed, it generates a LDIF file with all of the exact formatting that we want and fields locked down from free form text entry when appropriate.  Very easy to use, and integrated into the software used mostly heavily by out support staff.  I saw that LDAP supports a JPG image, so our security guy downloaded all of our photos from our badges and I added a place in the UI to add them.  We can now see the pictures of all employees, which will assist us with identity confirmation.

Pictures were also thumbnailed automatically when doing a user name or department search:

After trial and error and a few runs of the vcf2ldif utility, the files were compliant in all fields.  So I did a cat *.ldif > merged.ldif and then ldapadd'd them all into the software with success.  It's a very exciting step, all done easily with open source tools.


And the data was verified with a LDAP browser, and appears as expected:

My current area of focus is now accessing this data from our first new project: Zimbra.  Zimbra supports auto-provisioning, whereby it verifies if you have a mail: LDAP entry and if so, it verifies your password.  If this is the first time you have logged in, all of the phone numbers are downloaded and the account is automatically created.  This will save our support staff a lot of time.

LDAP will also be used for our Wifi, Alfresco and our web proxy appliance in the coming months. 

There are always many ways to accomplish goals, but I think we have found a good balance with our staff size, budget and existing skills.  I'm looking forward to seeing this all deployed.