Configuring LDAP

• You can store DHCP client information in unused attributes. For example, you could use the givenname attribute to hold the DHCP client-class name.

• You can add new attributes to an object class if you disable schema checking. For example, you could add the attribute client-class-name to the organizational person object class.

• You can create a new object class and define the appropriate attributes. For example, you could create the DHCPclient object class and define the client attributes that you want to use.

Table 11-2: LDAP-to-DHCP Mapping, Example 1

LDAP Attribute	DHCP Client Entry
common name	MAC address
givenname	client-class-name
localityname	domain-name
surname (sn)	host-name

(a) Search for the surname (sn) to use for the DHCP host name.

(b) Search for the first name (givenname) to use for the specific client-class name.

nrcmd> ldap myserver setEntry query-dictionary givenname=client-class-name
 

(c) Search for the localityname to use for the domain name.

nrcmd> ldap myserver setEntry query-dictionary localityname=domain-name

Step 6 Enable queries for the LDAP server. The following example enables queries for myserver.

Each time the state of a lease changes, the DHCP server makes a copy of the data and then transfers it to the LDAP server that you have configured to store lease-state data.

---

Note Although the MAC addresses in LDAP have to be formatted exactly the way they are formatted by Network Registrar when it creates local client-entries, they are separate instances and thus unique to lease data.

---

Not every lease has all of these attributes. The client-mac-addr and client-id are not present if a lease has been released by its client, or forced available through Network Registrar. In addition, the lease-renewal-time may not be present if the save-lease-renewal-time property is disabled through DHCP. Similarly, the vendor-class-identifier property may not be present if the save-vendor-class-id property is disabled through DHCP, using the CLI.

Step 2 Add entries to the directory or modify existing entries to store the lease state information. You may need to extend entries through the addition of attributes or custom object classes.

Step 3 Configure Network Registrar to perform the updates.

Given the flexibility of directories, there are many different ways in which you could choose to store a copy of lease-state attributes in a directory. For example, you could choose to store the lease-state data as part of an existing entry, or you could store the lease-state data independently.

• Map attributes from the entry.

• Add attributes to the entry.

• Extend the entry by creating a new object class.

The advantage to this method is that lease data is stored directly with other associated client information. The disadvantage is that there are scenarios, albeit unlikely, related to client-class and reservations that could result in stale data being in the directory for a short period of time when a client is moved off a lease by the server.

Also, this method requires two LDAP interactions to write the lease information. When updating lease-state information, the DHCP LDAP service contacts the directory twice because when updating an entry it is not enough just to know how to find the entry. You must specifically know the entry's distinguished name.

To update the lease-state information, the DHCP LDAP service contacts the directory service once. When performing the update, DHCP LDAP service uses the IP address to construct the distinguished name.

• The DHCP server only reads from a single object and writes to a single object. You can use separate objects to hold the client-entry data read and the lease-state date written, but Network Registrar cannot read some attributes from one object, and some from another.

• The performance of LDAP queries is, like all database access, dependent upon indexed attributes. If you have not indexed the attributes that you have configured to use in query filters, you will experience poor performance.

• When configured for update, Network Registrar does not create new objects in the directory. The DHCP server only writes to existing objects. However, if you configur for update and create, it does create new objects (if no object exists).

Step 1 Tell DHCP about your LDAP server.

You must supply the server's host name. The following example creates the LDAP server object myserver with a host name of myserver.example.com.

The following example sets the admin to be joe and his password to be access. Use the distinguished name for the user.

The following example sets the search path to begin at the organizational unit (ou) IT, the organization Example Corporation, and country US.

The following example sets the search attribute to be the client's MAC address.

This expression must contain a %s, which indicates where the search-attribute's data should be substituted.

The following example specifies the LDAP uid should be updated to contain the IP address, and the attribute carlicense should be updated to contain the DHCP lease-state information.

nrcmd > ldap myserver_option2 set dn-format="cn=\"%s\", ou=IT, o=Example Corp, c=US"
 

Step 4 Set the dn-attribute you want the dn-format string to refer to.

The following example sets the dn-attribute to be the client's MAC address.

nrcmd > ldap myserver_option2 set dn-attribute=client-mac-addr
 

Step 5 Specify the entries to be updated.

nrcmd > ldap myserver_option2 setEntry update-dictionary uid=address carlicense=state
 

Step 6 Enable the can-update feature.

nrcmd > ldap myserver_option2 enable can-update
 

Step 7 Reload the server.

nrmcd > server dhcp reload
 

Step 1 Set the dn-attribute property for the LDAP server for the lease object attribute, such as client-mac-addr field, and set the dn-format string.

The LDAP attributes indicate the entry attributes set to the value of their corresponding lease-state attributes.

nrcmd> ldap myserver setEntry create-dictionary sn=client-host-name
 
nrcmd> ldap myserver setEntry create-dictionary givenname=client-class-name
 
nrcmd> ldap myserver setEntry create-dictionary localityname=client-domain-name
 

nrcmd> ldap myserver set create-object-classes = "top,person,organizationalPerson,inetorgperson"
 

Step 5 Enable entry creation for the LDAP server myserver.

Step 6 Save and reload the DHCP server.