All groups of resources with ldap_lsaai service assigned to them will propagate to the LDAP running on a server specified in the resource’s facility’s destination(s). The setup requires preparations on both the Perun and LDAP owner’s side - this manual sums up the Perun setup.

1. Perun admin (LS AAI Operator) sets entityless attributes for UID and GID ranges in the desired namespace and creates the relevant attribute definitions if missing.

2. Perun admin  (LS AAI Operator)  prepares service configuration - creates service objects, and adds required attributes into the service configuration.

Open

The service ldap_lsaai can now be used repetitively for different destinations.

Provisioning specific steps:

3. Creation of a facility object in Perun UI (LS AAI operator or LDAP owner with correct permissions)

4. Setting up facility attributes (LS AAI operator or LDAP owner with correct permissions)

   1. urn:perun:facility:attribute-def:def:ldapBaseDN = base DN for all entries. Users will be added to the ou=perun,ou=users,{ldapBaseDn}, groups to the ou=perun,ou=groups,{ldapBaseDn}.

   2. urn:perun:facility:attribute-def:def:uid-namespace = namespace in which assigned users get UID generated in Perun. It takes the available UIDs range from the pre-set range set by the Perun admin. Multiple facilities in Perun can assign UIDs in the same namespace; the generated UIDs should be unique and within the allowed range.

   3. urn:perun:facility:attribute-def:def:login-namespace = namespace of logins to be used as user identifiers.

   4. urn:perun:facility:attribute-def:def:unixGID-namespace = namespace in which assigned groups get GID generated by Perun. It takes the available GIDs range from the pre-set range set by the Perun admin. Multiple facilities in Perun can assign GIDs in the same namespace; the generated GIDs should be unique and within the allowed range.

   5. urn:perun:facility:attribute-def:def:unixGroupName-namespace = namespace for which the group is given its unix group name. The same GID will be generated if some group already has the same UNIX group name.

If set correctly, the GID and UID range attributes will be generated automatically.

Open

5. Creation of a resource object in Perun (LDAP owner)

===== repeat this part for all groups you want to provision =====

6. Assigning groups to the resource (LDAP owner, VO / group manager)

7. Setting group attributes (LDAP owner, VO / group manager):

   1. urn:perun:group:attribute-def:def:unixGroupName-namespace:healthri: the name will be used as the group name in LDAP, and GID will be automatically generated.

===== end of the repeating part =====

8. Assigning service to a resource = will mark the resource as one of the sources for the LDAP provisioning - all groups assigned to it will be sent to LDAP if the service is enabled. (LDAP owner)

9. Adding a destination to the facility = specifies the server where the Perun slave script, which fills up the provisioned data into LDAP, is running. The server must allow SSH connection from the Perun server and have both the slave script and the prescript set up. (LDAP owner)

Perun to LDAP attributes mapping

Group-related attributes

User-related attributes