openldap-software February 2007

openldap-software@openldap.org

94 participants
112 discussions

OpenLDAP 2.3 using ACI
by Eugenia Candida Oliveira de Moura 21 Feb '07

21 Feb '07

Hi, Is possible to use ACI to control the access in openLDAP 2.3? What the difference between ACI and ACL? Thanks. Eugênia Moura.

2 1

Re: LDAP+TLS
by Net Warrior 21 Feb '07

21 Feb '07

Hi. Never could make it work, and I gave up I tried everything they told me to do in the mailing list I followed the how-tos' ( official one and others ) but no way cannot force it to ask for a certificate, so I setted it up like. Try instead of Demand. Maybe I'm too lame, and do not understad it complexity, hope some day to make it work. Thank for your help, time, and interest. Greets. 2007/2/13, Brian A. Seklecki <lavalamp(a)spiritual-machines.org>: > > > Any resolution ? > > ~BAS > > On Mon, 13 Nov 2006, Net Warrior wrote: > > > Hi. > > > > Using the -cert or -key options returns the same > > error, this error arises only when I use > > the TLSClientVerify demand option as I explained before. > > > > Any clues? > > > > > > Thanks for your time. > > > > > > > > 2006/11/6, Howard Chu <hyc(a)symas.com>: > >> > >> Net Warrior wrote: > >> > >> > With this configuration everything seems to work fine, but now, what > I > >> > want to do is to force my clients to use a certificate to connect, > >> > so, if I did not misundestrand it wrong, the demand options is a > must. > >> > > >> > So, when I change TLSVerifyClient never to demand. I've get the > >> > following ( alway on my server ) > >> > > >> > linux:/etc/ssl # openssl s_client -connect localhost:636 -state > >> > -showcerts -CAfile cacert.pem > >> > >> This invocation of s_client didn't provide the -cert or -key options, > so > >> no client certificate was used. Naturally the handshake fails. > >> > >> Learn to use the OpenSSL tools. > >> > >> > CONNECTED(00000003) > >> > SSL_connect:before/connect initialization > >> > SSL_connect:SSLv2/v3 write client hello A > >> > SSL_connect:SSLv3 read server hello A > >> > depth=1 /C=AU/ST=Some State/L=City/O=Internet Widgits Pty > >> > Ltd/OU=Section/CN=localhost/emailAddress= test(a)company.com > >> > <mailto:test@company.com> > >> > verify return:1 > >> > depth=0 /C=AU/ST=Some Even State/L=City/O=Internet Widgits Pty > >> > Ltd/OU=Section/CN=localhost/emailAddress=test(a)company.com > >> > <mailto:test@company.com> > >> > verify return:1 > >> > SSL_connect:SSLv3 read server certificate A > >> > SSL_connect:SSLv3 read server certificate request A > >> > SSL_connect:SSLv3 read server done A > >> > SSL_connect:SSLv3 write client certificate A > >> > SSL_connect:SSLv3 write client key exchange A > >> > SSL_connect:SSLv3 write change cipher spec A > >> > SSL_connect:SSLv3 write finished A > >> > SSL_connect:SSLv3 flush data > >> > SSL3 alert read:fatal:handshake failure > >> > SSL_connect:failed in SSLv3 read finished A > >> > 6274:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert > handshake > >> > failure:s3_pkt.c:1052:SSL alert number 40 > >> > 6274:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake > >> > failure:s23_lib.c:226: > >> > > >> > > >> > Making some searches in the mailing list I found a guy who had the > same > >> > problem, and he was told that with the > >> > demand option we force slapd to ask for a client certificate, and > that > >> > the client certificate is a must. > >> > Well, now, I do not get it, cuz I'm authenticating against myself, > with > >> > teh certificates I generated before, > >> > maybe ai have to generate a separate pair of certificates, do not > know. > >> > > >> > With never, and always it works as suggested by someone in the list, > who > >> > said that first we need try a lower option (never, allow ) > >> > to test if the server works ) my problem is with the demand option. > >> > > >> > > >> > What am I mising here? > >> > Sorry for my stupidity, I do not get it yet. > >> > > >> > Thanks in advance and or your valuable time. > >> > > >> > Greets. > >> > > >> > >> -- > >> -- Howard Chu > >> Chief Architect, Symas Corp. http://www.symas.com > >> Director, Highland Sun http://highlandsun.com/hyc > >> OpenLDAP Core Team http://www.openldap.org/project/ > >> > > > > l8* > -lava (Brian A. Seklecki - Pittsburgh, PA, USA) > http://www.spiritual-machines.org/ > > "...from back in the heady days when "helpdesk" meant nothing, "diskquota" > meant everything, and lives could be bought and sold for a couple of pages > of laser printout - and frequently were." >

1 0

Re: entryDN attribute
by Brandon McCombs 20 Feb '07

20 Feb '07

Kurt Zeilenga wrote: > On Feb 20, 2007, at 3:26 PM, Brandon McCombs wrote: >> I want to use the entryDN attribute as a unique identifier. Is there >> any particular reason why I can't read this attribute using >> openldap.org's server? It won't return in searches I do. > > % ldapsearch -LLL -H ldap://ldap.openldap.org -x -b > 'dc=openldap,dc=org' -s base entryDN > dn: dc=OpenLDAP,dc=Org > entryDN: dc=OpenLDAP,dc=Org > Thanks. I was able to fix my problem.

1 0

RE: entryDN attribute
by Srilakshmanan, Kumuthiny 20 Feb '07

20 Feb '07

1.What is your search criteria? 2.Is there any data in the LDAP that much search criteria? -----Original Message----- From: openldap-software-bounces+kumuthiny.srilakshmanan=auspost.com.au(a)OpenLDAP.or g [mailto:openldap-software-bounces+kumuthiny.srilakshmanan=auspost.com.au@Ope nLDAP.org] On Behalf Of Brandon McCombs Sent: Wednesday, 21 February 2007 10:26 AM To: openldap-software(a)openldap.org Subject: entryDN attribute I want to use the entryDN attribute as a unique identifier. Is there any particular reason why I can't read this attribute using openldap.org's server? It won't return in searches I do. thanks Australia Post is committed to providing our customers with excellent service. If we can assist you in any way please telephone 13 13 18 or visit our website. The information contained in this e-mail communication may be proprietary, confidential or legally professionally privileged. It is intended exclusively for the individual or entity to which it is addressed. You should only read, disclose, re-transmit, copy, distribute, act in reliance on or commercialise the information if you are authorised to do so. Australia Post does not represent, warrant or guarantee the integrity of this e-mail communication has been maintained nor that the communication is free of errors, virus or interference. If you are not the addressee or intended recipient please notify us by replying direct to the sender and then destroy any electronic or paper copy of this message. Any views expressed in this e-mail communication are taken to be those of the individual sender, except where the sender specifically attributes those views to Australia Post and is authorised to do so.

1 0

AW: AW: slapcat hangs without error message
by Voigtlaender＠hansenet.com 20 Feb '07

20 Feb '07

I did recover all my data from a backup. Then I did a slapcat without slapd running twice a day, just for paranoia reasons. It did work on the first day for the first two slapcats, but on the second day slapcat hung again. Is my database corrupt again ? What is happening here ? We did use ldbm before, and had never any problems like this. Should I go back to ldbm instead of bdb ? Marcella -----Ursprüngliche Nachricht----- Von: Adam Pordzik [mailto:ap@d-dt.de] Gesendet: Thursday, February 15, 2007 3:39 AM An: Voigtländer, Marcella HTK Cc: richton(a)nbcs.rutgers.edu; openldap-software(a)openldap.org Betreff: Re: AW: slapcat hangs without error message Voigtlaender(a)hansenet.com wrote: > It seems you are right. I did try db_recover, after that slapcat runs, > but the data is not complete. bdb specific. > Furthermore my slapd doesn't start anymore after the recover. Is there > anything else I could try to get my data ? > Is everything chown'ed properly after dbrecovery? I assume, slapd runs as another user. A --

4 6

Error at make : libdb-4.3.so: could not read symbols: File in wrong format
by Raphael Berlamont 20 Feb '07

20 Feb '07

Hello list, I'm trying to compile openldap v2.3.31 (same happens with v2.3.34), on a FC6 _EMT64_ (I don't have the problem on a i386). At the make step, I have the following error : ------8<------------- /bin/sh ../..//libtool --mode=link cc -static -g -O2 -o slapd main.o globals.o bconfig.o config.o daemon.o connection.o search.o filter.o add.o cr.o attr.o entry.o backend.o backends.o result.o operation.o dn.o compare.o modify.o delete.o modrdn.o ch_malloc.o value.o ava.o bind.o unbind.o abandon.o filterentry.o phonetic.o acl.o str2filter.o aclparse.o init.o user.o repl.o lock.o controls.o extended.o kerberos.o passwd.o schema.o schema_check.o schema_init.o schema_prep.o schemaparse.o ad.o at.o mr.o syntax.o oc.o saslauthz.o oidm.o starttls.o index.o sets.o referral.o root_dse.o sasl.o module.o mra.o mods.o sl_malloc.o zn_malloc.o limits.o operational.o matchedValues.o cancel.o syncrepl.o backglue.o backover.o ctxcsn.o ldapsync.o frontend.o slapadd.o slapcat.o slapcommon.o slapdn.o slapindex.o slappasswd.o slaptest.o slapauth.o slapacl.o component.o aci.o alock.o version.o libbackends.a liboverlays.a ../../libraries/liblunicode/liblunicode.a ../../libraries/librewrite/librewrite.a ../../libraries/liblutil/liblutil.a ../../libraries/libldap_r/libldap_r.la ../../libraries/liblber/liblber.la -ldb-4.3 -lsasl2 -lssl -lcrypto -lresolv -pthread \ cc -g -O2 -o slapd main.o globals.o bconfig.o config.o daemon.o connection.o search.o filter.o add.o cr.o attr.o entry.o backend.o backends.o result.o operation.o dn.o compare.o modify.o delete.o modrdn.o ch_malloc.o value.o ava.o bind.o unbind.o abandon.o filterentry.o phonetic.o acl.o str2filter.o aclparse.o init.o user.o repl.o lock.o controls.o extended.o kerberos.o passwd.o schema.o schema_check.o schema_init.o schema_prep.o schemaparse.o ad.o at.o mr.o syntax.o oc.o saslauthz.o oidm.o starttls.o index.o sets.o referral.o root_dse.o sasl.o module.o mra.o mods.o sl_malloc.o zn_malloc.o limits.o operational.o matchedValues.o cancel.o syncrepl.o backglue.o backover.o ctxcsn.o ldapsync.o frontend.o slapadd.o slapcat.o slapcommon.o slapdn.o slapindex.o slappasswd.o slaptest.o slapauth.o slapacl.o component.o aci.o alock.o version.o -pthread libbackends.a liboverlays.a ../../libraries/liblunicode/liblunicode.a ../../libraries/librewrite/librewrite.a ../../libraries/liblutil/liblutil.a ../../libraries/libldap_r/.libs/libldap_r.a /home/raphux/utils/openldap/openldap-2.3.31/libraries/liblber/.libs/liblber.a ../../libraries/liblber/.libs/liblber.a /usr/lib/libdb-4.3.so -lpthread -lsasl2 -lssl -lcrypto -lresolv -pthread /usr/lib/libdb-4.3.so: could not read symbols: File in wrong format collect2: ld returned 1 exit status make[2]: *** [slapd] Error 1 make[2]: Leaving directory `/home/raphux/utils/openldap/openldap-2.3.31/servers/slapd' make[1]: *** [all-common] Error 1 make[1]: Leaving directory `/home/raphux/utils/openldap/openldap-2.3.31/servers' make: *** [all-common] Error 1 [raphux@rt-preprod openldap-2.3.31]$ ------8<------------- I googlised a little, and try to add --includedir=/lib64/ to the configure step, but it doesn't change anything. I did the following thing that made the make working : - removed the /usr/lib/libdb-4.3.so symbolic link to /lib/libdb-4.3.so - recreate a link to /lib64/libdb-4.3.so Now compilation works, but I'm afraid that my system may be unstable, because a lot of installed software uses that library, and may have been compiled with the 32bits version. Is there a way to force the build of openldap to use /lib64/libdb-4.3.so instead of /usr/lib/libdb-4.3.so? For info purpose : -------8<---------- /usr/lib/libdb-4.3.so -> ../../lib/libdb-4.3.so /lib/libdb-4.3.so: ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), for GNU/Linux 2.4.20, stripped /lib64/libdb-4.3.so: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), for GNU/Linux 2.4.20, stripped -------8<---------- Regards, -- Raph.

4 3

SSL/TLS Inquiry
by Steve Finkelstein 19 Feb '07

19 Feb '07

Hi all, Apologies for not grasping some rudimentary TLS/SSL concepts with the LDAP protocol, but I have a basic question. I've configured my OpenLDAP server and have successfully been able to use the posixAccount objectClass to have a user login with pam_ldap over SSH on a client server. However, on the same token, when I try from the client server below to conduct and ldap search, I receive an error: [root@bar cacerts]# ldapsearch -x -h "ldap.domain.com" -p 636 -v ldap_start_tls: Can't contact LDAP server (-1) ldap_bind: Can't contact LDAP server (-1) On the server's log file: Feb 18 23:03:11 firewall slapd[4775]: conn=3 fd=12 ACCEPT from IP=10.0.0.5:1072 (IP=0.0.0.0:636) Feb 18 23:03:11 firewall slapd[4775]: conn=3 fd=12 closed (TLS negotiation failure) Clearly SSL/TLS is not properly negotiating here, but that's something I need to figure out in a few. My real question here is, when I established an ssh connection with my client server and the client server grabbed the credentials from LDAP server, does the above inadvertently imply that the packets were not negotiated via SSL/TLS? I was only testing ldapsearch to ensure that I have anonymous searches disabled, but the concern that I'm working without encryption spiked my curiosity if my logins are going unencrypted also because that's something I'd ultimately need to address. Thanks much for any knowledge anyone can pass along! - Steve

2 2

Another ACL question about set usage
by manu＠netbsd.org 17 Feb '07

17 Feb '07

Hello sets ACL are definitvely hard to work with. But perhaps my schema is just plain wrong. Any hint (how to build the ACL or how to redesign the schema) is welcome. Here is the problem: A) The schema I have three clases:, ou, person, mailAddress 1) persons are children of ou. They have three interesting attribute: ou: the ou they belong to mail: the mail addresses they receive mail from (multivalued) uid: the person's acount login A person's DN is like uid=jdoe,ou=sales,dc=example,dc=net 2) mailAddress holds a bunch of parameters about a mail address. It has a mail attribute. A mailAddress DN is like mail=John.Doe(a)example.net,dc=example,dc=net mailAddress are not children of ou, since several persons of different ou may receive mail through the same address. 3) ou have two interesting attrbiutes: ou: the unit name manager: DN of persons acting as managers (multivalued) An ou DN is like ou=sales,dc=example,dc=net B) The goals 1) a person must be able to modify a mailAddress when it receives mail from this address. This is done by an ACL clause like this (obtained from this mailing list) by set.exact="this/mail & user/mail" write It works very well. That goal is fullfilled. 2) a user listed as a manager for an ou must be able to modify the persons within the ou. I've came to the following: access to dn.regex="uid=.+,ou=(.+),dc=example,dc=net$" by set.expand="[ou=$1,dc=example,dc=net]/manager* & user" write That works, though it seems to be very poor on the performance front. I tried something more simplier, such as: by set.exact="this/ou/manager & user" or that way: by set.exact="(this/ou+[,dc=example,dc=net])/manager & user" but it does not work, I have no idea why. I'm very curious to learn what's wrong here. 3) The trickiest part, for which I have no solution: a user listed as a manager for an ou must be able to modify the mailAddress that a user he can modify could modify. I can try to rephrase this a bit better. If I have the following (mailAddress, person, ou) triplet dn: mail=W,dc=example,dc=net dn: uid=X,ou=Y,dc=example.dc=net mail: W dn: ou=Y,dc=example,dc=net manager: Z I want user Z to be able to modify mailAddress W Here is an attempt that does not work by set.exact=" ([uid=*,ou=] + ([manager=] + user)/ou*) + [,dc=example,dc=net])/mail & this/mail" write I also attempted various tricks with ldap:/// lookups, but no luck. -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

3 5

Authenticating via relaying - binding questions
by Douglas B. Jones 17 Feb '07

17 Feb '07

ldap version: openldap-2.3.33 If I have a relay set up from server A to server B via: A: database ldap suffix "" uri ldap://B:389/ lastmod off B: database relay suffix "o=gpc,c=us" relay "dc=new,dc=gpc,dc=edu" message This works fine for searches. When someone binds via uid=user,o=gpc,c=us it fails with 49 - invalid credentials. The bind dn in the B server logs is: uid=user,o=gpc,c=us when I would want it to translate to uid=user,dc=new,dc=gpc,dc=edu. I do not see, so far, in the doc. where this is discussed. My guess is that I am missing something in front of me again, but I am not sure. Thanks for any help.

2 2

objectClass in entry attribute order
by Donn Cave 16 Feb '07

16 Feb '07

I find that if I `replace' the values of objectClass, its order moves to the end of the attribute list -- like, $ ldapsearch ... dn: ... objectClass: top attributeOne: ... $ ldapmodify dn: ... changetype: modify replace: objectClass objectClass: top $ ldapsearch ... dn: ... attributeOne: ... objectClass: top I don't that I have ever seen objectClass appear anywhere but at the top of the entry, before this. Evidently it isn't a serious problem - these entries are still retrievable, modifiable and slapadd works on them. I personally would prefer to avoid it anyway, but I'm not the one who's been doing it. Anyone know of undesirable consequences if objectClass moves to a location other than the first attribute? thanks! Donn Cave, donn(a)u.washington.edu

4 3

← Newer
1
2
3
4
5
6
7
8
...
12
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software February 2007