Versions Compared

Old Version 44

changes.mady.by.user Robert A Basch

Saved on

compared with

New Version 45

changes.mady.by.user Robert A Basch

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  • Install the mit-moira RPM; the daemon uses the blanche client.
  • yum install perl-LDAP (This will also bring in perl-IO-Socket-SSL and perl-Net-SSLeay as dependencies)
  • yum install perl-Convert-ASN1
  • Unpack the cams-ldap binary tarball , from the root directory(available in the builds directory in the touchstone locker), and run its install script:
    No Format
    
# mkdir /tmp/cams-ldap
# cd /tmp/cams-ldap
# tar xzf /path/to/cams-ldap.tgz
# ./install.sh
    The install script will not overwrite an existing trigger library is mysqld is running, so you may need to move it into place manually. If installing a new version of the library, you may also need to (re)apply the SQL input file which creates the necessary function and triggers (see below).
  • Make sure the trigger library is configured for the run-time linker (required for mysqld to be able to load it):
    No Format
    # ldconfig
  • On the slave only, disable the cron job which purges the Cams Moira list:
    No Format
    # rm /etc/cron.d/cams-ldap
  • Install a daemon keytab in /usr/local/cams/ldap/keytab. It must be owned by the mysql user. The principal must be added to the from-cams-admin list, which is the owner of the from-cams list, e.g.:
    No Format
    # blanche from-cams-admin -a kerberos:daemon.idpe@ATHENA.MIT.EDU
    (For staging, add the daemon.idpe-staging principal to the list on ttsp)
  • Configure /etc/syslog.conf with the following patch; the daemon uses the LOCAL5 facility:
    No Format
    40,41c40,41
< # msql apps
< local5.info					/var/log/db
---
> # cams-ldap (originally msql apps)
> local5.*				/var/log/cams-ldap.log
    Make this change effective:
    No Format
    # kill -HUP `cat /var/run/syslogd.pid`
  • Install the configuration file /usr/local/cams/ldap/cams-ldap.conf. This file is in Perl syntax. Edit it to make sure that the usernames and passwords for DB and LDAP access are set properly ($dbuser, $dpassword, $ldap_dn, $ldap_password), and that $krb5_princ is set to the daemon principal in the keytab. Make sure that $cafile is set to point at mitCA.pem (install if not already there). Make sure the file is owned by the mysql user and only readable by the owner.
  • Make sure that the camsldap user is added to the MySQL database (see above).
  • Restart mysqld, to make sure that it can link in the trigger library.
  • Start the cams-ldap daemon, and make sure it starts at boot time:
    No Format
    # /etc/init.d/cams-ldap start
# chkconfig --add cams-ldap
    The daemon should run on both the slave and master servers; the daemon detects when it is running on the slave, and treats the trigger as a no-op.
  • Make sure the trigger function is defined properly in the database. This should be executed on the slave first; check the slave status afterward to make sure it is still running, and restart if necessary.
    No Format
    # mysql -u root -p cams < /usr/local/pathcams/toldap/cams-ldap-trigger.sql

Install Shibboleth IdP

...