FireWall-1 FAQ: Integration with OpenLDAP
Please note: This content was from when I was operating my FireWall-1 FAQ site, which I stopped operating in August 2005. For some reason people still have links to this stuff on the Internet that people are still clicking on.
I am making this information available again AS IS. Given how old this information is, it is likely wildly inaccurate. I have no plans to update this information.
If you're still running versions of Check Point VPN-1/FireWall-1 where this information is still relevant to you, do yourself a favor and upgrade to a more recent release. If you happen to be running a current release and the information is useful, it's by happenstance :)
FireWall-1 easily integrates with OpenLDAP provided that you have the proper schema defined. Using an OpenLDAP v1 server, you will not be able to fetch directory branches via the various FireWall-1 GUI tools, but all other functionality appears to be there. OpenLDAP v2 appears to support fetching of the directory branches.
The schema file included in FireWall-1 assumes you have a Netscape Directory Server, which supports modification of the schema directly through LDAP. OpenLDAP, and possibly several other LDAP Servers, do not support this. The following is schema which is known to work in OpenLDAP version 1.2.7. It may work in others, though I have not tried this.
The way to include this schema is to put an entry in your slapd.conf file that looks like this:
include /etc/openldap/firewall-1.conf
The link to firewall-1.conf will contain the correct schema for both 4.1 and NG. You will then restart your LDAP Server.
If you’re using OpenLDAP 2.x, a different schema file is needed. To use this schema file, add the following lines to your slapd.conf file. These lines assume the core, cosine, and inetorgperson schemas are stored in /etc/openldap/schema:
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/firewall1.schema
The link to firewall1.schema will contain the correct schema for both 4.1 and NG. You will then restart your LDAP Server.
