openldap-software February 2007

openldap-software@openldap.org

94 participants
112 discussions

Proxy to "other directory server" with authentication?
by Mark Colaluca 24 Feb '07

24 Feb '07

Hello: I'm looking to set up a few OpenLDAP servers as pure query-only proxies (no update at this point) to our "other directory" servers we happen to use in our environment. We'd like to keep the security settings we currently have on these "other directory" servers that only allows users with valid accounts on the said "other directory" server to query the server. What would be the simplest, quickest configuration to achieve this? Should I create a generic 'ldapuser' account on the "other directory" server and use those credentials every time? Can I "pass" a user's credentials as part of my proxy request? I've read through the Admin Guide and the sample slapd.conf files, and I'm a little stumped as to how to proceed - I only made it as far as setting up the very basic proxy server. current slapd.conf ---------------------------- database ldap lastmod off uri "ldap://ouradserver.ourdomain.com:389/DC=ourdomain,DC=com" suffix "dc=ourdomain,dc=com" Thanks for any tips and pointers, --Mark

2 1

WARNING: No dynamic config support for database ldbm
by Asrai khn 23 Feb '07

23 Feb '07

Hi, After upgrading our ldap server to FC5 and openldap-2.3.19-4 (we are using yum to update packages). We getting ... WARNING: No dynamic config support for database ldbm when starting ldap services, however it starts fine and we are not facing any issues while authentication from that openldap or adding new entries to it using phpldapadmin. I have read in archives of this mailing list that ldbm backend is going to be removed when 2.4 releases, now my concern is 1) how to fix this warning or just ignore it 2) If recommend to migrate to another backend database eg bdb, then how to convert the current records to it so that if we change 'database' directive in slapd.conf to 'bdb' it gives no error and migration would seem transparent. Another problem which we are facing is our ldap replication is broken after we upgraded our slave ldap server to FC6 which comes with newer version of openldap 'openldap-2.3.27-4', when we tries to start ldap services on slave it exit with error... Checking configuration files for slapd: WARNING: No dynamic config support for database ldbm. unable to open file "/var/run/slapd.pid": 13 (Permission denied) I am no expert of openldap neither is ldap is configured by me, now i have to fix the replication and all other warnings.. 1) Can we replication older version of openldap (master) to newer version of openldap (slave) currently master (FC5) < slave (FC6) Any help in this regards will be greatly appreciated. Thanks.

6 10

more questions regarding password hashes
by Brandon McCombs 23 Feb '07

23 Feb '07

I actually read the manpage this time on password-crypt-salt-format but still have some questions. It seems that only one salt format can be specified at a time but I'm wondering about the salt itself. A user can never specify what the salt string will be since the 2nd paragraph of that setting's description states the conversion will be substituted with a string of random characters, is that correct? And after reading the crypt(3) manpage it seems that the salt only applies to {CRYPT} passwords so that means it won't work (or be used) for SHA passwords (making them SSHA). Is that correct? I would guess it isn't correct based on the next paragraph. The manpage states the default hash is SSHA (although I recently found out that on Debian with OpenLDAP 2.2.30 cleartext is the default) so I guess the salts do work with SHA to make SSHA passwords. If that is the case how does one have control over whether a salted or unsalted password is created if programmatically modifying a password by using the LDAP password extension or some other API? Is it a matter of either having salted or unsalted passwords (but not both at the same time) depending on whether the password-crypt-salt-format setting is configured? One last question, if a salt is used with MD5 for example, is the password's hash prefixed with {SMD5} or is {MD5} still used? All these hashes are confusing so I'm trying to get things clear in my head. thanks

3 4

password hashes
by Brandon McCombs 23 Feb '07

23 Feb '07

I'm gathering from reading various sites that openldap doesn't allow a person to specify multiple hash algorithms in the slapd.conf file. Is this correct? If only one is able to be listed then when I specify a password in a custom client openldap will automatically hash the plaintext version of the password that I supply to it so that the password is stored in hashed form, is that correct? One last question, if multiple hashes can't be listed in the slapd.conf, would a user be able to specify which type of hash he/she wishes to use when they go to change their password using a client or would the hash specifier (e.g. {MD5} ) become part of the password when that is attempted? thanks

3 5

Creating a virtual DIT?
by Mads Orbesen Troest 22 Feb '07

22 Feb '07

Hi. I'm new to this list, but risk diving right in with a question: I am wondering whether the following scenario is possible to implement using OpenLDAP: We are a sub-organization within a larger organization and want to perform authentication against the central LDAP server yet augment query results with attributes from from the DIT of our own LDAP server. In effect, providing a virtual DIT hiding the details of which attributes comes from where to the applications using it. It is not just a matter of delegation, more of a selective merge of the attributes available in the 2 DITs. An example: Central DIT: cn: someone userPassword: something mail: someone(a)somewhere.org<mailto:someone@somewhere.org> irrelevantAttribute: whatever Our DIT: uid: someone inProjects: someProject, someOtherProject Virtual DIT (auth'ed against Central DIT): uid: someone mail: someone(a)somewhere.org<mailto:someone@somewhere.org> inProjects: someProject, someOtherProject Commercial products such as the Symlabs Directory Extender promise such capabilities but I'd like to stick with an open solution in at all possible. I guess it might possibly be implemented in a custom back_perl handler, but is it possible to achieve using fx back_meta or some other "native" OpenLDAP configuration? Thanks in advance, /\/\\ads Troest

2 2

entryDN attribute
by Brandon McCombs 22 Feb '07

22 Feb '07

I want to use the entryDN attribute as a unique identifier. Is there any particular reason why I can't read this attribute using openldap.org's server? It won't return in searches I do. thanks

4 5

Re: Using back-ldap as a dumb proxy
by Quanah Gibson-Mount 22 Feb '07

22 Feb '07

--On Wednesday, February 21, 2007 11:52 PM +0100 Pierangelo Masarati <ando(a)sys-net.it> wrote: > Quanah Gibson-Mount wrote: >> >> >> --On Wednesday, February 21, 2007 2:39 PM -0800 Quanah Gibson-Mount >> <quanah(a)stanford.edu> wrote: >> >>> I'm trying to set up a very simply slapd that takes incoming requests >>> locally, and forwards them on to a remote server using SASL/GSSAPI to >>> get the information, so that a internal app that doesn't understand >>> SASL/GSSAPI can get the information it needs. >> >> Never mind, I forgot to load the core schema. duh. :P > > The proxy was a bit too dumb ;) Heh. The problem I'm having now, is I can't get it to perform SASL/GSSAPI auth to the remote proxy. If I have: # /etc/ldap/slapd.conf -- LDAP proxy slapd configuration file. # $Id$ include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/krb5-kdc.schema include /etc/ldap/schema/suacct.schema # Global Options modulepath /usr/lib/ldap moduleload back_ldap.la readonly on access to * by * read # LDAP Proxy Options database ldap suffix "dc=stanford,dc=edu" uri "ldap://ldap-test1.stanford.edu" idassert-bind bindmethod=none It correctly talks to the remote server with an anonymous bind. However, if I change things around: idassert-bind bindmethod=sasl saslmech=gssapi realm=stanford.edu authcID=proxy credentials=proxy mode=self I get: ldapsearch -LLL -x -h localhost -b "dc=stanford,dc=edu" uid=quanah Inappropriate authentication (48) The KRB5CCNAME is set in slapd's environment, so it has access to the ticket cache it needs to use to perform SASL/GSSAPI. It is not talking to the remote server at all. Is there something here I'm missing? I've also tried: idassert-bind bindmethod=sasl saslmech=gssapi realm=stanford.edu authcID=service/mailrouter(a)stanford.edu authzID=dn:cn=mailrouter,cn=service,cn=applications,dc=stanford,dc=edu But then I get: Authentication method not supported (7) And again, it didn't talk to the remote server. Thanks, Quanah -- Quanah Gibson-Mount Principal Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

3 7

multiple replog?
by Emmanuel Dreyfus 22 Feb '07

22 Feb '07

Hello Is it possible to have slapd outputing muliple replog for the same database? I'd like to use one for slurpd, and one to keep a log of all changes, but it seems only the first replog statement is honoured. Is there a trick? Or another way to get a change log? -- Emmanuel Dreyfus manu(a)netbsd.org

3 2

This is a new thread: Re: slapd stopping with no error message
by Tony Earnshaw 22 Feb '07

22 Feb '07

Howard Chu wrote, with irony, on 21. feb 2007 16:43: [...] > Unix has this cool thing called I/O redirection, perhaps you've heard > of it? [...] and > There's also this other cool thing called job control... [...] This has nothing to do with that thread, but has been worrying me: Our production RHAS4 site with 4 OpenLDAP 2.3 servers (1 delta syncrepl provider, 3 consumers) has been running exemplararily (new word?) since ~= 2.3.27. All servers were running 2.3.33 perfectly, then I built 2.3.34 and on just one of the servers (the master), after around 4 hours of it doing hard work, I see (top) the slapd process consuming 98-99% CPU. The CPU consumption is never relinquished, even if I wait for hours (ouch). If I reinstall 2.3.33 this goes away and all is back to normal. On my (discrete=nothing to do with the others) test rig, 2.3.34 from the same batch also functions perfectly. Where should I be looking? System and build details for all rigs: OS Red Hat RHAS4, completely up2date All, but all software built and installed as rpms My own-built db4-4.2.52 rpms with all patches (Red Hat's doesn't have all patches) For the OpenLDAP 2.3 rpms I'm using Buchan Milne's 2.4.24 srpm spec file, basically only modified each build for the version, so that all the %prep, %configure and %build stages are the same for all builds - irrespective of OL version. Ta in advance, --Tonni -- Tony Earnshaw Email: tonni at hetnet dot nl

2 2

Using back-ldap as a dumb proxy
by Quanah Gibson-Mount 21 Feb '07

21 Feb '07

I'm trying to set up a very simply slapd that takes incoming requests locally, and forwards them on to a remote server using SASL/GSSAPI to get the information, so that a internal app that doesn't understand SASL/GSSAPI can get the information it needs. I'm trying to configure back-ldap thusly: # /etc/ldap/slapd.conf -- LDAP proxy slapd configuration file. # $Id$ # Global Options modulepath /usr/lib/ldap moduleload back_ldap.la readonly on access to * by * read # LDAP Proxy Options database ldap suffix "dc=stanford,dc=edu" uri "ldap://ldap-test1.stanford.edu/" idassert-bind bindmethod=sasl saslmech=GSSAPI protocol-version 3 but it keeps complaining that the DN for the suffix is invalid. I see nothing wrong with this suffix. line 17 (suffix "dc=stanford,dc=edu") >>> dnPrettyNormal: <dc=stanford,dc=edu> => ldap_bv2dn(dc=stanford,dc=edu,0) <= ldap_bv2dn(dc=stanford,dc=edu)=0 ldap_err2string /etc/ldap/slapd.conf: line 17: <suffix> invalid DN 21 (Invalid syntax) slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. --Quanah -- Quanah Gibson-Mount Principal Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

2 3

← Newer
1
2
3
4
5
6
7
...
12
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software February 2007