{{tag>[security openldap centos7 client]}}

=====CentOS 7 - OpenLDAP 2.4 consumer (client)=====
This works for Centos 6 and 7!

====Install packages====
  * Install the requisite packages:<code># yum install sssd openldap-clients</code>

====Configure OpenLDAP client====
===Import CA root certificate===
  * Export the CA certificate, **on provider or CA server**:<code># certutil -L -d /etc/openldap/certs -n "LDAP-CA" -a > /tmp/ca.crt</code>
  * Download the CA root certificate (ca.crt):<code># scp ldap.master.server:/tmp/ca.crt /etc/openldap/cacerts/</code>
  * Rehash the certificate directory:<code># cacertdir_rehash /etc/openldap/cacerts/</code>

===Authconfig====
  * Configure authentication:<code># authconfig \
--disablesmartcard \
--disablefingerprint \
--enablesssd \
--enablesssdauth \
--enablelocauthorize \
--disablemd5 \
--passalgo=sha512 \
--enablepamaccess \
--enableldap \
--enableldapauth \
--disableldaptls \
--ldapserver=ldaps://ldap.yourdomain.tld:636 \
--ldapbasedn=dc=domain,dc=tld \
--enablemkhomedir \
--disablecachecreds \
--disablekrb5 \
--disablekrb5kdcdns \
--disablekrb5realmdns \
--krb5kdc=" #" \
--updateall</code>

===SSSd====
  * If you have disabled anonymous bind, you'll need to configure a bind user. Edit /etc/sssd/sssd.conf:<code># vim /etc/sssd/sssd.conf

[domain/<domain name like 'default' or 'LDAP']
...
ldap_default_bind_dn = cn=...,ou=...
ldap_default_authtok_type = password # obfuscated_password: obfuscating the password provides no real security benefit
ldap_default_authtok = <your bind dn password>
...</code>

===Prevent unauthorized console access===
  * [[:centos_7_prevent_access|Configure the PAM access module.]]

===SSHd===
  * Disable root access.
  * Configure AllowGroups.
====Verify====
  * Restart sssd, log in and test the connection.<code># systemctl enable sssd
# systemctl start sssd
 Check if symlink has been created in: /etc/openldap/cacerts


# ldapwhoami -H ldaps://<FQDN> -x -D "cn=Manager,dc=<domain>,dc=<tld>" -W

# ldapsearch -H ldaps://<FQDN> -x -D "cn=Manager,dc=<domain>,dc=<tld>" -W

  
# getent -s sss passwd <username>
# getent -s sss group <groupname>
# id -a <username></code>

===Clear the SSSD cache===  
  * You can clear the cache (except sudo rules) with:<code>sss_cache -E</code>
  * If that didn't work, delete the contents of directory **/var/lib/sss/db** and restart sssd.