Re: ldap and key serving

On Tue, Mar 01, 2005 at 09:39:46PM +0100, Peter Palfrader wrote:
> Almost a year ago, on Tue, 20 Apr 2004, David Shaw wrote:
> 
> > On Tue, Apr 20, 2004 at 10:26:32PM +1000, Tony Lembke wrote:
> >
> > > I would value the advice of the list as to the status of running a LDAP 
> > > based keyserver.
> > 
> > Very recently, PGP and GnuPG became able to store keys in any LDAP
> > server (the schema is available from PGP.com).  This requires PGP 8 or
> > GnuPG 1.3.5 or later.
> 
> Does anybody know of some tools that would help populate an openldap
> tree (using the pgp.com schemas) with a set of keys to provide some
> read-only ldap keyserver?

One easy (though somewhat goofy) way to do it is to use GnuPG or PGP
to upload all the keys you like, then change the OpenLDAP config to
make the server read-only.

> Or, if that doesn't exist, is there some documentation that explains how
> such an ldap tree has to look like?  The schema has quite some
> attributes and it's not immediately clear what things are supposed to be
> set to.

The documentation is really aimed at LDAP server administrators and
not at people who want to implement tools to use the schema, which
makes it hard.  It helps to know the details of the old NAI semi-LDAP
keyserver as the schema is very similar.  One gotcha is that the
majority of the attributes are optional according to the schema - but
not optional for PGP to fully work.  For example, the pgpKeyID
attribute is optional, but you can't search by 8-digit key IDs without
it.  Similarly, pgpDisabled is optional, but if you don't include it
(set to 0 if necessary), then PGP searches by user ID don't work.

David