openldap-software November 2006

openldap-software@openldap.org

81 participants
81 discussions

Re: ACL using netgroups
by Claudio Strizzolo 25 Nov '06

25 Nov '06

Hi Dieter, >> Hello Dieter, >> thanks for your reply. >> I tried as you suggested: >> >> by dn="cn=ldapauth,dc=example,dc=com" \ >> group/nisNetgroup/nisNetgroupTriple=cn=linuxa,ou=netgroup,dc=example,dc=com >> read >> >> Unfortunately it does not work: >> >> [...] >> >> If that matters, I am using openldap 2.2.13. > Ah your historic version might be a problem. I can't remember, in > which version the group expansion has been implemented. > My slapd.access(5) OpenLDAP-2.3.27 states > THE <WHO> FIELD > > [...] > It can have the forms > > [ other forms deleted ] > group[/<objectclass>[/<attrname>]] Actually I have the same syntax available in my slapd.access: <who> ::= [ * | anonymous | users | self | dn[.<dnstyle>]=<DN> ] [dnattr=<attrname>] [group[/<objectclass>[/<attrname>]][.<style>]=<group>] [peername[.<peernamestyle>]=<peer>] [sockname[.<style>]=<name>] [domain[.<domainstyle>]=<domain>] [sockurl[.<style>]=<url>] So probably the error is somewhere else. I report it again for the list (sorry, I replied to Dieter only instead of the list the first time): Checking configuration files for slurpd: /etc/openldap/userauth.acl: line 82: group "cn=linuxa,ou=netgroup,dc=example,dc=com": inappropriate syntax: 1.3.6.1.1.1.0.0 <access clause> ::= access to <what> [ by <who> <access> [ <control> ] ]+ (...) Any hints? Thanks again Claudio

3 3

Re: ppolicy - getting to work
by Prakash Velayutham 25 Nov '06

25 Nov '06

Thanks again. Makes sense. Now that I am locked out for SSH access, I will just ask questions of interest without actually trying things out. For all the different ppolicy-related things to work, I am guessing the following is the procedure. Please correct me. a) Editing slapd.conf and adding "include", "modulepath", "loadmodule ppolicy.la", "overlay", "ppolicy_use_lockout", "ppolicy_default" statements. b) Adding necessary policy-related objects to LDAP (policy object and standard policy sub-object). These will inherit from pwdPolicy objectclass. c) Adding the users that will be managed by the password policy to the directory. Do I have to add "objectClass=pwdPolicy" attribute to all the users that need to be managed by ppolicy and leave it out for the other users? I will try all these out on monday. Prakash >>> Aaron Richton <richton(a)nbcs.rutgers.edu> 11/24/06 8:06 PM >>> Note that I build static modules, so this may need verification/clarification, but I'll try: The .la files are libtool archives. If you examine them (e.g. cat(1)), then you'll see that they point to .so files (among other details). A libtool-aware application--note that slapd(8) should be one of them--can parse the .la file, which allegedly offers advantages (mostly platform independence). So, following a 'make install', you should be able to specify in slapd.conf > moduleload /path/to/ppolicy.la and that should parse OK. At least, that's the way I remember it... Then again, you should be able to moduleload the .so also. If the .la doesn't work out, try that. On Fri, 24 Nov 2006, Prakash Velayutham wrote: > Thanks Aaron. So I built openldap with: > > $ ./configure --with-tls=no --with-cyrus-sasl=no --enable-slurpd=no > --enable-ipv6=no --enable-ppolicy=mod --enable-hdb=yes --enable-modules > --enable-bdb=no --enable-ldif=no --enable-monitor=no --enable-relay=no > --enable-syncprov=no > > Why do I have a ppolicy*.so and a ppolicy*.la file in the install > location? When do you use the ppolicy*.so? > > I have temporarily lost access to the system because of PAM. Will have > access again on monday. > > Thanks, > Prakash > >>>> Prakash Velayutham 11/24/06 5:13 PM >>> >>>> Aaron Richton <richton(a)nbcs.rutgers.edu> 11/24/06 4:04 PM >>> > configure --enable-hdb --enable-ppolicy={yes|mod} should handle it. > "yes" will build it into slapd, "mod" will give you a module. (You can > do > the same for --enable-hdb.) > > On Fri, 24 Nov 2006, Prakash Velayutham wrote: > >> Hello All, >> >> I am trying to get ppolicy working on my openldap-2.3.29 server. I > want >> this setup to work with hdb backend and either static or dynamic > ppolicy >> module. What compile time options would be sufficient? >> >> Thanks, >> Prakash >

1 0

Re: ppolicy - getting to work
by Prakash Velayutham 25 Nov '06

25 Nov '06

Thanks Aaron. So I built openldap with: $ ./configure --with-tls=no --with-cyrus-sasl=no --enable-slurpd=no --enable-ipv6=no --enable-ppolicy=mod --enable-hdb=yes --enable-modules --enable-bdb=no --enable-ldif=no --enable-monitor=no --enable-relay=no --enable-syncprov=no Why do I have a ppolicy*.so and a ppolicy*.la file in the install location? When do you use the ppolicy*.so? I have temporarily lost access to the system because of PAM. Will have access again on monday. Thanks, Prakash >>> Prakash Velayutham 11/24/06 5:13 PM >>> >>> Aaron Richton <richton(a)nbcs.rutgers.edu> 11/24/06 4:04 PM >>> configure --enable-hdb --enable-ppolicy={yes|mod} should handle it. "yes" will build it into slapd, "mod" will give you a module. (You can do the same for --enable-hdb.) On Fri, 24 Nov 2006, Prakash Velayutham wrote: > Hello All, > > I am trying to get ppolicy working on my openldap-2.3.29 server. I want > this setup to work with hdb backend and either static or dynamic ppolicy > module. What compile time options would be sufficient? > > Thanks, > Prakash

2 1

ppolicy - getting to work
by Prakash Velayutham 25 Nov '06

25 Nov '06

Hello All, I am trying to get ppolicy working on my openldap-2.3.29 server. I want this setup to work with hdb backend and either static or dynamic ppolicy module. What compile time options would be sufficient? Thanks, Prakash

2 1

Reg openLDAP config
by shilpa muramkar 24 Nov '06

24 Nov '06

Hi, I hv installed openLDAP on windowsxp. Now im trying to populate it with our company specific values using java code.It is giving me the following error. error result (53); modification of subschema subentry not supported; DSA is unwilling to perform i have provided access previlages in slapd.conf as access to dn.base="" by * write access to dn.base="cn=subschema by * write access to * by self write by users write by anonymous auth but still i get an error saying i cannot modify the subschema entry. can anyone just let me knwo where exactly is the error?? How do i add my values into the subschema.l

4 3

Client passing "NTLM" as DN
by AW W 24 Nov '06

24 Nov '06

ldap_read: want=75, got=75 0000: 3a 60 84 00 00 00 44 02 01 03 04 04 4e 54 4c 4d :`....D.....NTLM 0010: 8a 39 4e 54 4c 4d 53 53 50 00 01 00 00 00 07 b2 .9NTLMSSP....... 0020: 08 a2 09 00 09 00 30 00 00 00 08 00 08 00 28 00 ......0.......(. 0030: 00 00 05 02 ce 0e 00 00 00 0f 5a 54 43 46 56 30 ..........ZTCFV0 0040: 4e 32 41 4d 45 52 49 43 41 53 45 N2AMERICASE >>>dnPrettyNormal: <NTLM> => ldap_bv2dn(NTLM,0) ldap_err2string <= ldap_bv2dn(NTLM)=-4 Decoding error bind: invalid dn (NTLM) Is slapd(8) responding properly to this ldap client request and is it possible to influence this behavior somehow? Can somewhat speculate as to what is going on here? _________________________________________________________________ Ready for the world's first international mobile film festival celebrating the creative potential of today's youth? Check out Mobile Jam Fest for your a chance to WIN $10,000! www.mobilejamfest.com

2 1

slapd + valsort using 100% CPU and causing slpad to become unresponsive
by Michael.Heep＠o2.com 24 Nov '06

24 Nov '06

Hello list, I've been recently experimenting with the valsort overlay. After enabling it on the servers in our test environment they became unresponsive after a few minutes and a simple "top" showed a 100% cpu utilization on the machines. Before filing an ITS I thought I'd first post my problem here. Maybe it's just something as simple as a misplaced configuration directive. Therefor I've included the relevant information below. The test-servers only have about 100 entries and usually no more than half a dozen clients access them simultaneously. OpenLDAP Version: 2.3.30 BerkeleyDB: 4.2.52 + 5 patches OS: RHES 2.1 and 3.0 Relevant slapd.conf parts: ... <ACL's, TLS opts, other global stuff> ... ... overlay chain chain-uri "ldap://<...>" chain-idassert-bind bindmethod=sasl binddn="<...>" saslmech=external mode=self chain-tls start ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=o2online,dc=de" rootdn <...> rootpw {SSHA}<...> directory /var/lib/ldap/openldap-data index objectClass eq index entryCSN eq index entryUUID eq index sudoUser pres,eq,sub index uid,cn pres,eq,sub index uidNumber eq index gidNumber eq index memberUid eq index uniqueMember eq index host eq ## Syncrepl provider settings #overlay syncprov #syncprov-checkpoint 50 5 #syncprov-sessionlog 1000 # Syncrepl consumer settings syncrepl rid=100 provider=ldap://<...> type=refreshAndPersist interval=00:00:00:10 retry="60 10 300 +" searchbase="dc=o2online,dc=de" filter="(objectclass=*)" scope=sub attrs="*,+" schemachecking=on starttls=critical bindmethod=sasl saslmech="external" updateref ldap://<...> limits dn.exact="<...>" size=unlimited time=unlimited cachesize 10000 idlcachesize 30000 checkpoint 1024 5 overlay unique unique_base "dc=o2online,dc=de" unique_attributes uid uidNumber overlay dynlist dynlist-attrset extensibleObject memberURL uniqueMember overlay valsort valsort-attr uniqueMember dc=o2online,dc=de alpha-ascend valsort-attr host dc=o2online,dc=de alpha-ascend authz-policy to authz-regexp email=<...> cn=<...> Any help or hints would be much apreciated. With kind regards Michael Heep

2 3

slow queries with long strings in filters
by Sylvain Amrani 24 Nov '06

24 Nov '06

Hi list, I've got an attribute that could contains very long strings (more than 150 chr). It's a string made of small tokens separated by spaces and slashes : departmentUID: BA/BAC ANDL/BAPZ IDF/GRPT YVLN/CIE GN ST GERM... The attibute is indexed with pres,eq,sub When I search for small substrings like (departmentUID=*/GRPT*) it's fast and ok. When I search for a long subset of the string, the query is _very_ long (many seconds) : (departmentUID=BA/BAC ANDL/BAPZ IDF/GRPT YVLN/CIE GN ST*) The more the string is long, the more the answer is slow. I can use very complex filters (&((|()())(|()()))... and the answer is very fast, unless I use a long string in it. The backend is BDB (berkeley 4.2) Openldap is 2.2.26 Is this a BDB or an Openldap related issue ? Using subinitial or subany in the index slap.conf parameter did not solve the problem. I found only one post in the archives related to a server were any query string with more than 3 characters makes slow answers. He was told to adjust : index_substr_if_minlen index_substr_if_maxlen index_substr_any_len index_substr_any_step But theses parameters are only available with openldap 2.3 and it doesn't seem to be exactly my problem (I've no differences between 2,3,4 or 5 characters query strings) Thanks, Sylvain.

4 5

samba-computer record at OpenLdap
by Roman Yushin 24 Nov '06

24 Nov '06

Hello. I have an old server with openldap-server-2.0.27_3 (+ samba schema), samba-3.0.8,1 as PDC All information stored at LDAP: domain-computers, domain-users So, i have a record for computer: dn: uid=ws01$,ou=People,o=campus,c=ru uidNumber: 2000 gidNumber: 553 homeDirectory: /dev/null loginShell: /bin/false objectClass: top objectClass: posixAccount objectClass: sambaAccount uid: ws01$ logonTime: 0 logoffTime: 2147483647 kickoffTime: 2147483647 pwdMustChange: 2147483647 displayName: ws01$ cn: ws01$ description: Computer rid: 5000 primaryGroupID: 2107 acctFlags: [W ] creatorsName: cn=Manager,o=campus,c=ru createTimestamp: 20060324104820Z pwdCanChange: 1162105007 ntPassword: A49B017193432C718AA03C008C681836 pwdLastSet: 1162105007 modifiersName: cn=Manager,o=campus,c=ru modifyTimestamp: 20061029065647Z I am commented lines "creatorsName, createTimestamp, modifiersName, modifyTimestamp" and obtained ldiff-record to add it to another ldap server. The problem is that i could not add domain-computers to new server with openldap-server-2.3.30! All users were added from old ldap to new, but i have a problem with computers! Here is the error adding new entry "uid=ws01$,ou=People,o=campus,c=ru" ldap_add: Internal (implementation specific) error (80) additional info: no structuralObjectClass operational attribute debug.log (256) Nov 23 13:40:38 new slapd[765]: conn=0 fd=12 ACCEPT from IP=127.0.0.1:57407 (IP=127.0.0.1:389) Nov 23 13:40:38 new slapd[765]: conn=0 op=0 BIND dn="cn=manager,o=campus,c=ru" method=128 Nov 23 13:40:38 new slapd[765]: conn=0 op=0 BIND dn="cn=Manager,o=campus,c=ru" mech=SIMPLE ssf=0 Nov 23 13:40:38 new slapd[765]: conn=0 op=0 RESULT tag=97 err=0 text= Nov 23 13:40:38 new slapd[765]: conn=0 op=1 ADD dn="uid=ws01$,ou=People,o=campus,c=ru" Nov 23 13:40:38 new slapd[765]: No structuralObjectClass for entry (uid=ws01$,ou=People,o=campus,c=ru) Nov 23 13:40:38 new slapd[765]: conn=0 op=1 RESULT tag=105 err=80 text=no structuralObjectClass operational attribute Nov 23 13:40:38 new slapd[765]: conn=0 op=2 UNBIND Nov 23 13:40:38 new slapd[765]: conn=0 fd=12 closed If i try to add this ldiff record at old openldap, it works fine.

4 3

ACL using netgroups
by Claudio Strizzolo 24 Nov '06

24 Nov '06

Hi all, I'd like to set up an ACL which allows access to a subtree only to a user, and only if the query is coming from a restricted set of hosts. Up to now I've been doing this: access to dn.subtree="ou=People,dc=example,dc=com" by self read by dn="cn=myuser,dc=example.com" \ peername.regex="10\.10\.10\.1[0-9]" read by * none This works. However, the number of hosts to be allowed in this way is rapidly increasing, and it is not easy to group their addresses in such a way to make them easily summarized by a single regex, or a limited group of regexp. Moreover, for other reasons I have grouped the hosts in a netgroup inside the same database: dn: cn=mynodes,ou=netgroup,dc=example,dc=com objectClass: nisNetgroup objectClass: top cn: mynodes nisNetgroupTriple: (node0.example.com,-,-) nisNetgroupTriple: (node1.example.com,-,-) (...) nisNetgroupTriple: (node9.example.com,-,-) My question is: is there any way to set the ACL above in such a way to use this netgroup definition to limit access to the hosts listed in the netgroup AND to the user as above, at the same time? I'm dreaming of something like: access to dn.subtree="ou=People,dc=example,dc=com" by self read by dn="cn=myuser,dc=example.com" \ netgroup="cn=mynodes,ou=netgroup,dc=example,dc=com" read by * none Any way to do something like this? I beg your pardon if this is a stupid question, I'm just a LDAP beginner. Thanks in advance Claudio

3 2

← Newer
1
2
3
4
5
6
7
8
9
Older →

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software November 2006