Manage 389 Directory Server Graphically Using 389 Management Console

In our previous tutorial, we have discussed how to install and configure LDAP server in CentOS 7. Check the following link to install and configure 389 Directory Server.

Today, we will see how to manage 389-DS more easily via a graphical interface.

About 389 Management Console

389 management console is a built-in, Java based remote management console that can be used to manage your LDAP server (389-DS) server from any remote or local system. This console helps you to easily create, edit or delete Organizational units, groups, users more easily via a cool graphical interface. You don’t need to memorize or know all commands to manage LDAP server. Everything can be done via 389 management console.

Please be mindful that if you want to manage your 389 ds server graphically, you LDAP server should have installed with a GUI desktop environment. If you did a minimal installation and don’t have GUI in your LDAP server, then, you can’t access the management console.

As I had installed LDAP server in minimal CentOS 7 server, Here, I am going to install XFCE desktop on my server.

yum groupinstall Xfce

After installing GUI, reboot the server to take effect the changes.

reboot

Log in to server.

Now, you can access the 389 ds admin console either from the local server itself or from a remote desktop client.

To access 389 ds admin console locally, type the following command in the Terminal:

389-console

To access 389-ds admin console from the remote system, enter the following command in Terminal.

ssh -X [email protected] /usr/bin/389-console -a http://192.168.1.150:9830

Replace the IP address with your own.

Now, you’ll be asked to enter your LDAP server administrative log in details. In my case my LDAP admin name is admin and password is centos.

win0 (server1.unixmen.local)_001
This is how my admin server console looks.

389 Management Console (server1.unixmen.local)_002

From here, you can create, delete or edit LDAP organizational units, groups and users graphically.

389-ds admin server console has two groups by default:

  • Administration Server
  • Directory Server

You can use any one of the server group.

1. Administration Server

To access Administration Server interface, click on your LDAP domain name to expand.

Go to Server Group –> Administration Server and click Open on the right side. Refer the following screenshot.

389 Management Console (server1.unixmen.local)_003

The following screen should appear.

The Admin server has tabs.

  • Tasks,
  • Configuration.

Tasks Tab:

In the Tasks section, you can Stop/Restart/Configure admin server.

Administration Server (server1.unixmen.local)_004

Configuration tab:

In the Configuration tab, you change/edit your Admin server ip address, default port, LDAP admin password, default user directory. Also you can define which host names to allow and which ip addresses to allow to access your LDAP server.

Administration Server (server1.unixmen.local)_005

2. Directory server

To access Directory Server interface, click on your LDAP domain name to expand.

Go to Server Group Directory Server and click Open on the right side. Refer the following screenshot.

389 Management Console (server1.unixmen.local)_006

In Directory Server section, you can do all necessary configuration for your LDAP server. You can change/modify default port, create users, groups, organizational units etc.

server1.unixmen.local - 389 Directory Server - server1 (server1.unixmen.local)_007

There are lot of options available in Directory Server section. Go thorough the each section and configure your LDAP server as per your requirement.

Create Organization units, Groups And Users

Create organizational unit:

Go to your Directory Server from the main console.

Select Directory tab.

server1.unixmen.local - 389 Directory Server - server1 (server1.unixmen.local)_012

Right click on your Domain name (Ex. Unixmen). Select New -> Organization Unit. Refer the following screen.

Menu_011

Enter your OU name (ex. Support Division) and click Ok.

Create New Organizational Unit (server1.unixmen.local)_013

The new OU (ex. Support Division) will be created under Unixmen domain.

server1.unixmen.local - 389 Directory Server - server1 (server1.unixmen.local)_014

Create a Group:

Now navigate to Support Division OU and create a new group (ex. support_group).

Menu_015

Enter group name and click Ok.

Create New Group (server1.unixmen.local)_016

The new group will be created under Unixmen/Support Division.

Create User:

Right click on the Support_group, and click New -> User.

Menu_021

Enter the user details such as first name, last name, userid, mail id etc., and click Ok.

Create New User (server1.unixmen.local)_022

That’s it. Now, we have created OU, Group and an user in LDAP server.

Test LDAP server

Verify whether the newly created Organizational Unit, Group, User with following command on our server.

ldapsearch -x -b "dc=unixmen,dc=local"

Sample output:

Check the result that I have marked as bold at the end.

# extended LDIF
#
# LDAPv3
# base <dc=unixmen,dc=local> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# unixmen.local
dn: dc=unixmen,dc=local
objectClass: top
objectClass: domain
dc: unixmen

# Directory Administrators, unixmen.local
dn: cn=Directory Administrators,dc=unixmen,dc=local
objectClass: top
objectClass: groupofuniquenames
cn: Directory Administrators
uniqueMember: cn=Directory Manager

# Groups, unixmen.local
dn: ou=Groups,dc=unixmen,dc=local
objectClass: top
objectClass: organizationalunit
ou: Groups

# People, unixmen.local
dn: ou=People,dc=unixmen,dc=local
objectClass: top
objectClass: organizationalunit
ou: People

# Special Users, unixmen.local
dn: ou=Special Users,dc=unixmen,dc=local
objectClass: top
objectClass: organizationalUnit
ou: Special Users
description: Special Administrative Accounts

# Accounting Managers, Groups, unixmen.local
dn: cn=Accounting Managers,ou=Groups,dc=unixmen,dc=local
objectClass: top
objectClass: groupOfUniqueNames
cn: Accounting Managers
ou: groups
description: People who can manage accounting entries
uniqueMember: cn=Directory Manager

# HR Managers, Groups, unixmen.local
dn: cn=HR Managers,ou=Groups,dc=unixmen,dc=local
objectClass: top
objectClass: groupOfUniqueNames
cn: HR Managers
ou: groups
description: People who can manage HR entries
uniqueMember: cn=Directory Manager

# QA Managers, Groups, unixmen.local
dn: cn=QA Managers,ou=Groups,dc=unixmen,dc=local
objectClass: top
objectClass: groupOfUniqueNames
cn: QA Managers
ou: groups
description: People who can manage QA entries
uniqueMember: cn=Directory Manager

# PD Managers, Groups, unixmen.local
dn: cn=PD Managers,ou=Groups,dc=unixmen,dc=local
objectClass: top
objectClass: groupOfUniqueNames
cn: PD Managers
ou: groups
description: People who can manage engineer entries
uniqueMember: cn=Directory Manager

# Support Division, unixmen.local
dn: ou=Support Division,dc=unixmen,dc=local
ou: Support Division
objectClass: top
objectClass: organizationalunit

# support_group, Support Division, unixmen.local
dn: cn=support_group,ou=Support Division,dc=unixmen,dc=local
objectClass: top
objectClass: groupofuniquenames
cn: support_group

# skumar, support_group, Support Division, unixmen.local
dn: uid=skumar,cn=support_group,ou=Support Division,dc=unixmen,dc=local
mail: [email protected]
uid: skumar
givenName: senthil
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
sn: kumar
cn: senthil kumar

# search result
search: 2
result: 0 Success

# numResponses: 13
# numEntries: 12

As you see in the above output, a new OU called Support Division, a new group called support_vision, a new user called skumar have been created. Voila! Our LDAP server is working.

Conclusion

In this tutorial, I covered only installation part and basic configuration. There are lot to learn about 389 ds. Refer the link provided at the bottom to know more about 389 ds.

In my personal experience, 389-ds is much easier than openldap in terms of installation and configuration. We will see how to configure client systems to authenticate using LDAP server in our next article.

Good luck. Cheers!

Reference:

  • Nitan

    My question is also belongs to below mention questions .I’ve configure 389DS server.But now i want to access it on client side please suggest me any url.

  • Sarvesh Manjrekar

    Hi, This is a good guide on 389-directory server.

    Could it be possible that I can replace existing Windows 2003 AD with all users/groups/OU migrated to a 389-directory server?