I want my OpenBSD 6.4 services to authenticate users from a remote LDAP server ; namely a Synology Directory Server (DSM 6.2.x). It turns out that this a standard OpenLDAP 2.4.x configured to accept replication refreshAndPersist mode. So let’s configure a Master / Slave Replication system between Synology and OpenBSD.

Get stuff from Synology (Master)

From the DSM instance, we’ll need extra LDAP schemas (that don’t come with OpenLDAP release on OpenBSD) and an initial dump of data:

root@synology:~# cd /usr/syno/etc.defaults/openldap/schema/
root@synology:/usr/syno/etc.defaults/openldap/schema/# tar cvzpf ~/syno-schemas.tar.gz apple.schema apple_auxillary.schema samba.schema syno.schema
apple.schema
apple_auxillary.schema
samba.schema
syno.schema

root@synology:~# slapcat -F /var/packages/DirectoryServer/target/etc/data/slapd.d > syno-dump.ldif
5bd85e20 [monitor.c:362] bdb_monitor_db_open: monitoring disabled; configure monitor database to enable

Then, simply transfer both files to the OpenBSD server.

Configure stuff on OpenBSD (Slave)

First of all, install and enable OpenLDAP:

# pkg_add openldap-server-2.4.45p5
# rcctl enable slapd
# rcctl set slapd flags -h ldap://127.0.0.1

Then install the schema files:

# tar xvzpf syno-schemas.tar.gz -C /etc/openldap/schema/
apple.schema
apple_auxillary.schema
samba.schema
syno.schema

There a small modification to apply to the syno.schema file:

# diff -U2 /etc/openldap/schema/syno.schema.orig /etc/openldap/schema/syno.schema
--- /etc/openldap/schema/syno.schema.orig Fri Sep 7 10:56:21 2018
+++ /etc/openldap/schema/syno.schema Tue Oct 30 15:00:13 2018
@@ -146,5 +146,5 @@

attributetype ( 1.3.6.1.4.1.6574.5.2.1.25
- NAME 'SynoExcludeCommonPwd'
+ NAME 'pwdSynoExcludeCommonPwd'
EQUALITY booleanMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7

Configure OpenLDAP using the Synology schemas, suffix and enable replication:

# vi /etc/openldap/slapd.conf
(...)
include /etc/openldap/schema/samba.schema
include /etc/openldap/schema/apple_auxillary.schema
include /etc/openldap/schema/apple.schema
include /etc/openldap/schema/syno.schema
(...)
suffix          "dc=synology,dc=tumfatig,dc=local"
rootdn          "uid=root,cn=users,dc=synology,dc=tumfatig,dc=local"
(...)
syncrepl rid=000
  provider=ldaps://synology.tumfatig.local
  type=refreshAndPersist
  retry="5 10 300 +"
  searchbase="dc=synology,dc=tumfatig,dc=local"
  attrs="*,+"
  bindmethod=simple
  binddn="uid=root,cn=users,dc=synology,dc=tumfatig,dc=local"
  credentials=change_me

overlay syncprov
syncprov-checkpoint 100 10
syncprov-sessionlog 250
#EOF

# doas -u _openldap slaptest -u
config file testing succeeded

Before starting the OpenLDAP daemon, restore the initial dump.

# doas -u _openldap slapadd -f /etc/openldap/slapd.conf -l syno-dump.ldif
5bd86476 hdb_monitor_db_open: monitoring disabled; configure monitor database to enable
_#################### 100.00% eta none elapsed none fast!
Closing DB...

Finally, the OpenLDAP daemon can be started:

# rcctl start slapd
slapd(ok)
# rcctl check slapd
slapd(ok)

In my case, I only use the slave locally. So it only listens on localhost without SSL.

# ldap search -x -b "cn=users,dc=synology,dc=tumfatig,dc=local" -H ldap://localhost "(mail=*)" gecos
dn: uid=joe,cn=users,dc=synology,dc=tumfatig,dc=local
gecos: Joel Carnat

# ldap search -x -b "cn=groups,dc=synology,dc=tumfatig,dc=local" -H ldap://localhost "(member=*)" description member
dn: cn=users,cn=groups,dc=synology,dc=tumfatig,dc=local
description: Directory default group
member: uid=joe,cn=users,dc=synology,dc=tumfatig,dc=local
member: uid=tom,cn=users,dc=synology,dc=tumfatig,dc=local
(...)

Changing attributes is done from the Synology DSM interface. And in seconds, the changes are accessible from the localhost slave instance.

Every services can now use this local user database copy. Even when OpenBSD would lose connexion to the OpenLDAP master.

It should be possible to maintain an LDAP copy on the OpenBSD server using the native ldapd(8) and scheduling some ldapsearch/ldapsadd commands. So far I didn’t try it…