PGP Corporation Tech Note

iPlanet™ Directory Server:
Setting Up and Troubleshooting the Querying and Storage of PGP Keys

Copyright © 2002 by PGP Corporation. All Rights Reserved.


This Tech Note describes how to set up and troubleshooting the querying and storage of PGP keys on iPlanet Directory Server.

  1. The pgpschema.ldif contains the schema definitions that are required to support the PGP key operations on iPlanet Directory Server. LDIF stands for LDAP (RFC 2251) Data Interchange Format and is an Internet Standard for a common file format for operating on LDAP compliant directory services from different vendors. Although this file has an .ldif extension, suggesting that it is in LDIF (RFC 2849) format, it is actually a custom schema file for iPlanet Directory Server SLAPD. In this document, iPlanet Console 5.1 was used to setup an iPlanet Directory Server v5.1 (build 2001.326.2045). If your software versions are different from these, some of the operations may have to be done differently than described here.
  2. When iPlanet Directory Server is used in a replicated environment, the schema must be consistent throughout all of the directory servers that participate in replication [if your server is a standalone server, you may go over to next step]. Therefore, the only way to guarantee consistency in replicated environment is to make schema modifications on a single master server, even in a multi-master replication environment. If you choose to add the PGP custom schema file and use replication to update the information on each of the consumers, please be aware that when the schema definitions are replicated to a consumer where they do not already exist, they will be stored in 99user.ldif. The PGP schema definitions currently have X-ORIGIN set to ‘Pretty Good Privacy (PGP)’ whereas the only way to make sure that schema definitions are not removed from 99user.ldif by the directory is by using an X-ORIGIN value of ‘user defined’. Therefore, if you choose to use replication for updates, you should set all the X-ORIGIN values in pgpschema.ldif to ‘user defined’ (by any editor capable of search and replace). If you do not wish to use replication for the changes, you should manually copy the custom schema file (after renaming it appropriately as discussed in step 3) to all your servers, which requires the restart of each server.
  3. You need to rename and prefix the schema file name with a number (such that it is of form [00-99]pgpschema.ldif) before copying it to the appropriate SLAPD directory. The server loads the schema files in alpha-numerical order (numerically and then alphabetically). For this reason, you should choose a prefix number that is higher than any of the prefixes of standard schema files. You may look at the standard schema files in use by peeking at the <install dir>/slapd-<host>/config/schema directory. That is the directory where the server keeps its schema files. Currently, the PGP schema introduces only new objects and does not extend any system objects. In that sense, strictly speaking, there should be no problem with any prefix. But as a general practice, it is better and safer to be at a high prefix. Keep in mind that the schema file name cannot be numerically or alphabetically higher than 99user.ldif or the server will experience problems such as duplicate schema definitions and loss of class/attribute definitions. A good name for the file could be 98pgpschema.ldif. Copy the renamed pgpschema.ldif to the schema directory. You should see other ldif files in the same directory such as 00core.ldif and 99user.ldif.
  4. Restart the server(s). Login to iPlanet Console and double click on the tree node that represents your directory server in the Servers and Applications tab. You should be seeing a popup with various tabs starting with the Tasks tab. Choose Restart Directory Server. You may also restart the server by running the restart-slapd command script in the <install dir>/slapd-<host> directory. The server should start with the schema just fine. But if it encounters errors while reading the new file, it may not start. You will need to peek at the files in the <install dir>/slapd-<host>/logs directory to find the exact reason why the failure occurred. Although less likely, you may need to edit the ldif file to eliminate the error condition and then start the server again. If iPlanet Directory Server is running on Windows, check the Application Log in the system event log for events reported by SLAPD.
  5. Now you may verify that the PGP attributes and classes have indeed been incorporated into the schema by browsing the schema of the directory server and looking for classes and attributes that have names starting with 'pgp."

PGP clients use the LDAP operational attribute namingContexts on root DSE (DSA Specific Entry) of LDAP Server to do automatic key space discovery. The automatic discovery works as follows. The PGP client tries to find <namingContexts>,CN=PGPServerInfo for each DN returned in the attribute value. This object is expected to be of class pgpServerInfo, which stores the DN of the PGP key store in its pgpBaseKeySpaceDN attribute. If your server returns non-blank value(s) in the attribute, you would need to create a pgpServerInfo object under any one of the naming contexts returned and the CN of this object must be "PGPServerInfo" and the mandatory attribute pgpBaseKeySpaceDN should be set to a valid DN that will be used as the key store. But when the server root DSE does not return this attribute or returns blank (meaning that it is a gateway or the server believes it contains the entire directory), you will need to specify the DN of your key space directly in your server definition in PGP client.

This version of iPlanet (and previous versions) does return this attribute on root DSE. The value(s) returned can be found by using any of the popular LDAP clients. If you use ldapsearch, the command should be something like ldapsearch –h <host> -p <port> -b “” –s base “(objectClass=*)” Look for all namingContexts returned. You would need to create the pgpServerInfo object under one of those nodes for automatic key space discovery to work. In the Directory tab page of the Directory Server, choose Object->New->Other… after choosing the parent node appropriately. Choose pgpServerInfo in the New Object pop-up and choose OK. Specify the DN of the PGP key store in the pgpbasekeyspacedn attribute. Make sure that the DN you specify is correct since there is no input check regarding syntax even though the attribute is specified to be of DN type. Change the naming attribute to be cn only by clicking the Change button. Press OK. Specify the cn to be PGPServerInfo after choosing the Show Attribute Names radio button in the View control group.

  1. Now you may create the container for the keys at the appropriate location of your directory hierarchy by choosing to create a new object of nscontainer object class. Make sure that the DN of this object is exactly same as you specified in pgpServerInfo object. Specify an Access Control Instruction (ACI) for everyone to read, compare, search, add and write attributes of pgpKeyInfo object. ACIs can be specified by right clicking on the nscontainer object and choosing Set Access Permissions. Choose New and name the ACI appropriately. On the Rights tab, make sure only the permissions required are checked. On the Target tab, the list that displays all attributes does not quite let you sort and check all the PGP attributes (attributes having names starting with pgp). So uncheck all and check only PGP attributes one by one in the target tab page. Press OK.
  2. Now try uploading and searching keys. If the access permissions are insufficient, PGP will report the this, in which case you might have to revisit step 6 and make sure the rights are sufficient. If you are able to upload the key but get an insufficient access error during key send for subsequent attempts, you may have missed one or more attributes in the target tab page attribute list in the ACI definition. You may sort on the attribute name and verify if you have checked all PGP attributes. Once the upload succeeds, you may want to check if more rights than required are not being granted accidentally. This is very important. Restrict all users to putting only pgpKeyInfo objects in the folder.

    Your iPlanet Directory is now integrated with PGP.