== HBP HPC LDAP server ==

The HBP HPC LDAP server is hosted by JSC. The server provides both LDAP protocol and REST API access to the central HBP HPC LDAP server. 

=== Connection points ===
||Protocol||URL||Example call||
||LDAP||ldaps://localhost:636|| {{{ldapsearch -v -W -H ldaps://localhost:636 -D <LDAPBINDDN> -b "ou=users,dc=hbp,dc=eu" uid}}} ||
||REST|| https://hbpacc.zam.kfa-juelich.de/hpcmanagement/v1/doc || {{{curl -X GET --header 'Accept: application/json' 'https://hbpacc.zam.kfa-juelich.de/hpcmanagement/v1/accounts'}}} ||

Both protocols can be used for read and write access. The REST API is intended to be simpler to use, as it offers powerful dispatch commands, which combine multiple LDAP protocol operations in a single REST call. E.g. by calling the REST function {{{https://hbpacc.zam.kfa-juelich.de/hpcmanagement/v1/accounts?oidcid=123&action=create&project=bp01}}} a bp0-account is created for the user with oidcid 123 within project bp01. To achieve that with plain LDAP protocol, the people entry for that person needs to be searched, imported into the users branch and the new account needs to be stored as member of the project entry.

=== Trouble shooting ===

==== Missing certificates for LDAP ====
If ldapsearch commands fail with the following error message:
{{{
ldap_start_tls: Can't contact LDAP server (-1)
        additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (self signed certificate in certificate chain)
}}}
Try to add the root certificate for our server certificate to the trusted certificates. The root certificate can be found at https://www.pki.dfn.de/fileadmin/PKI/zertifikate/deutsche-telekom-root-ca-2.pem
Download that certificate, then do the following:
{{{
export LDAPTLS_CACERT=/path/to/certificate/deutsche-telekom-root-ca-2.pem
ldapsearch -v -W -H ldaps://hbpacc.zam.kfa-juelich.de:636 -D o=FZJ,ou=sites,dc=hbp,dc=eu -b "ou=users,dc=hbp,dc=eu" uid
}}}
Afterwards, the LDAP commands should work.