openldap-software February 2007

openldap-software@openldap.org

94 participants
112 discussions

Re: ldap client can't contact server with SubjectAltName used
by Seed, Steven 12 Feb '07

12 Feb '07

Sending again, because I'm not sure if the first message got through since I had not acknowledged my membership... Steven Seed wrote: > I have an ldap server set up with a SSL certificate such that the > CN=hostname.fqdn. In the same certificate I have created a > SubjectAltName with several DNS aliases. With everything configured > properly in my ldap.conf file, I can make TLS connections to my ldap > server as long as I use the hostname that matches the CN, but if I > change my connection to use one of the aliases in the SubjectAltName I > get: > > ldap_start_tls: Can't contact LDAP server (-1) > additional info: TLS: hostname does not match CN in peer > certificate > > Here is the end of the debug output...I can supply the full output, > but it's quite large: > > tls_read: want=5, got=5 > 0000: 16 03 01 00 30 ....0 > tls_read: want=48, got=48 > 0000: 43 2b a5 b7 12 ef 88 f7 76 30 63 78 4c 16 99 0b > C+......v0cxL... > 0010: 5f 26 f8 34 db 15 1b 24 e7 e2 bd 60 c4 25 b4 e4 > _&.4...$...`.%.. > 0020: 0b d4 e7 27 f0 93 1b 6e 40 2a 5c ce a2 69 cd 2d > ...'...n@*\..i.- > TLS: hostname (fatestldap.fas.fa.disney.com) does not match common > name in certificate (Proton.fas.fa.disney.com). > ldap_start_tls: Can't contact LDAP server (-1) > additional info: TLS: hostname does not match CN in peer > certificate > > An openssl dump of the certificate yields the following in the > SubjectAltName section: > > Certificate: > Data: > CN=Proton.fas.fa.disney.com > X509v3 Extended Key Usage: > TLS Web Server Authentication > X509v3 Subject Alternative Name: > > email:dns:faldap,dns:fatestldap,dns:faldap.fas.fa.disney.com,dns:fatestldap… > > X509v3 CRL Distribution Points: > DirName:/DC=com/DC=disney/OU=PKI/CN=The Walt Disney Company > Enterprise CA/CN=CRL27 > URI:http://cdp.disney.pvt/CRL/EnterpriseCRL.crl > URI:http://cdp.disney.com/CRL/EnterpriseCRL.crl > > Can anyone help me figure out what is going wrong? This is the same > with both version 2.2.13 and 2.3.32 of openldap. Does the > SubjectAltName format look correct? > -- Steven L. Seed Sr. Systems Administrator Walt Disney Feature Animation (818) 460-9453 (tl:8426-9453) Steven.Seed(a)disney.com ================================================================= () __/\__ |\ .-"` `"-. /| I HAVE BEEN CHOSEN... | \.'( ') (' ) (. )`./ | FAREWELL MY FRIENDS... \_ _/ I GO ONTO A BETTER PLACE! \ `~"'=::='"~` / `-.__ __.-' ( `""~~""` ) [_____[##]_____] =================================================================

2 1

cn=config && (ACI || ACL)
by Turbo Fredriksson 12 Feb '07

12 Feb '07

I managed to get cn=config working by following http://www.openldap.org/faq/index.cgi?_highlightWords=cn%20config&file=1365 to the letter (meaning: I had to setup a rootdn/rootpw pair to be able to do searches). How can this be used, _without_ using the rootdn/rootpw? I want ordinary users to be able to search/modify 'stuff' there (eventually, when I know exactly what it is and how to use it :). I tried 'access to * by * write' as only ACL, but I _still_ got 'Insufficient access' whether or not I authenticated... And running with '-d 128' shows NOTHING for anonymous access (and only 'auth access to userPassword' when using bind DN). Also (when on the subject of cn=config), in what way is 'cn=schema,cn=config' different from 'cn=Subschema'? The devil is in the details, but why wasn't 'cn=Subschema' enough? It have everything (?) that 'cn=schema,cn=config' have... ?

3 2

Listening on multiple ports for openldap 2.3.33
by Douglas B. Jones 12 Feb '07

12 Feb '07

I want to listen on multiple ports for openldap. Not ldaps, just ldap. I have tried (let's say port 100 and 200 - not the real ports): ldap.conf: URI ldap://0.0.0.0:100 ldap://0.0.0.0:200 and slapd -h ldap://:100/ -h ldap://:200/ It always only comes up on port 100, never sees port 200. If I swap the numbers, then port 200 comes up and not 100. I am not sure what I am missing. Thanks for any help!

4 3

cleaning up logs from bdb db and upgrading ldap
by Douglas B. Jones 12 Feb '07

12 Feb '07

I noticed the that I am getting a number of bdb logs (log.0000000000 .. 210) so far for one db. What is the proper procedure for consolidating these with openldap while keeping the server process running. We have version 2.3.27, but plan on upgrading to 2.3.33. The second question: is the best way to migrate from one ldap version to another to slapcat from the old one and the slapadd to the new one? I realize if I do this way, I would in essence have an answer for the first question, but the first one I was wondering from a live point of view. Thank you for any help, I have not had much time finding an answer in the archives o slapd.conf or slapd.bdb man pages. Thanks!

5 7

RE: Listening on multiple ports for openldap 2.3.33
by Douglas B. Jones 12 Feb '07

12 Feb '07

Thanks to you and another user who both pointed this out to me. Thanks! -----Original Message----- From: Adam Pordzik [mailto:ap@d-dt.de] Sent: Monday, February 12, 2007 1:59 PM To: douglas(a)gpc.edu Cc: openldap-software(a)openldap.org Subject: Re: Listening on multiple ports for openldap 2.3.33 Douglas B. Jones wrote: > I want to listen on multiple ports for openldap. Not ldaps, just ldap. > I have tried (let's say port 100 and 200 - not the real ports): > > ldap.conf: > > URI ldap://0.0.0.0:100 ldap://0.0.0.0:200 > > and > > slapd -h ldap://:100/ -h ldap://:200/ We already had this a few days ago. Quote all your URIs so it is passed as a single argument. A --

1 0

SASL GSSAPI authentication with Sun Java Directory Server 5.2P4
by Andrew Deason 12 Feb '07

12 Feb '07

I am trying to use OpenLDAP's ldapsearch to connect to a Sun DS 5.2 server using SASL/GSSAPI to authenticate. The setup works perfectly fine on Solaris clients, but not on Linux ones using OpenLDAP's ldapsearch (Debian sid on x86). Instead, it always gives the following error: SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): authentication failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Unknown code 188) This error is coming from the DS server (right?), so I know this may not be OpenLDAP's problem. I was just wondering if anyone else had encountered this problem, or if there are any workarounds or anything, or if this is known to just not work at all. I'm using the Cyrus SASL implementation with MIT Kerberos. I tried this with ldapsearch 2.3.30 and 2.2.23. -- Andrew Deason adeason2(a)uiuc.edu

3 4

Trying to get "changetype: moddn" to work
by Dave Horsfall 11 Feb '07

11 Feb '07

OpenLDAP 2.3.32. ldapmodify -v ... << EOF dn: cn=dhtest,dc=coreng,dc=com,dc=au changetype: moddn newrdn: cn=dhtest1 deleteoldrdn: 0 EOF generates: ldap_initialize( ldap://xxx... ) Enter LDAP Password: modifying rdn of entry "cn=dhtest,dc=coreng,dc=com,dc=au" new RDN: "cn=dhtest1" (keep existing values) rename completed ldap_rename: No such object (32) matched DN: dc=coreng,dc=com,dc=au Is this a supported operation? Similarly, keeping the RDN but moving it to a new hierarchy with: ldapmodify -v ... << EOF dn: cn=dhtest,dc=coreng,dc=com,dc=au changetype: moddn newrdn: cn=dhtest deleteoldrdn: 1 newsuperior: ou=systems,dc=coreng,dc=com,dc=au EOF generates: ldap_initialize( ldap://xxx... ) Enter LDAP Password: modifying rdn of entry "cn=dhtest,dc=coreng,dc=com,dc=au" new RDN: "cn=dhtest" (do not keep existing values) rename completed ldap_rename: No such object (32) matched DN: dc=coreng,dc=com,dc=au -- Dave Horsfall DTM VK2KFU daveh(a)ci.com.au Ph: +61 2 9552-5509 (d) -5500 (sw) Corinthian Eng'ng P/L, Ste 54 Jones Bay Whf, 26-32 Pirrama Rd, Pyrmont 2009, AU

2 2

OpenLDAP slapd 2.4.3 alpha
by Rafal Swiderski 10 Feb '07

10 Feb '07

Hello How configure slapd (with backend sql) for authorized from sasl because my slapd is crashed before correct authorization (all software is install on clear system - freebsd 6.1 relase with sasl 2.21), in mysql database is default data from example. with unixODBC ./slapd -d -1 " slap_parseURI: parsing uid=test,cn=digest-md5,cn=auth ldap_url_parse_ext(uid=test,cn=digest-md5,cn=auth) >>> dnNormalize: <uid=test,cn=digest-md5,cn=auth> => ldap_bv2dn(uid=test,cn=digest-md5,cn=auth,0) <= ldap_bv2dn(uid=test,cn=digest-md5,cn=auth)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=test,cn=digest-md5,cn=auth)=0 <<< dnNormalize: <uid=test,cn=digest-md5,cn=auth> <==slap_sasl2dn: Converted SASL name to uid=test,cn=digest-md5,cn=auth slap_sasl_getdn: dn:id converted to uid=test,cn=digest-md5,cn=auth SASL Canonicalize [conn=1]: slapAuthcDN="uid=test,cn=digest-md5,cn=auth" SASL Canonicalize [conn=1]: authzid="test" SASL proxy authorize [conn=1]: authcid="test" authzid="test" slapd in free(): error: chunk is already free Abort (core dumped) s1# ----- slapd.conf --------- s1# cat /usr/local/etc/openldap/slapd.conf # $OpenLDAP: pkg/ldap/servers/slapd/back-sql/rdbms_depend/mysql/slapd.conf,v 1.5.2.1 2005/01/20 18:04:03 kurt Exp $ # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema # Define global ACLs to disable default read access. access to * by * write # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel -1 #authz-police all #sasl-host example.com #sasl-realm example.com #require SASL authz-regexp uid=(.*),cn=(.*),cn=(.*),cn=auth ldap:///dc=example,dc=com??sub?(uid=test) #sasl-secprops none #authzTo: uid=[^,]*,dc=example,dc=com ####################################################################### # sql database definitions ####################################################################### database sql suffix "dc=example,dc=com" #rootdn "cn=test,dc=example,dc=com" #rootpw secret dbname ldap dbuser ldap dbpasswd ldap123zxc subtree_cond "ldap_entries.dn LIKE CONCAT('%',?)" insentry_stmt "INSERT INTO ldap_entries (dn,oc_map_id,parent,keyval) VALUES (?,?,?,?)" has_ldapinfo_dn_ru no #access to attrs=userPassword # by * auth #access to * by * none

1 0

Re: map custom attribute to another non custom attribute
by matthew sporleder 10 Feb '07

10 Feb '07

On 1/19/07, P. Martinez <martinezino(a)googlemail.com> wrote: > Hello List, > > before i start, i am very new to directory > services, therefore please be patient to > me. I am with myself ;) > > I am writing an custom schema - and thought > about a way to mapping attributes. > > attributeType ( OIDXXX NAME ( 'cn' 'commonName' ) > SUP name ) > > Here we have two ways to query for entries - cn > and commonName, right. > > My question: Is is possible to construct a > schema that maps attributes to another > attribute of a different objectclass/schema. > > Why? - Lets say an application ask for > "unordinaryattributeName". Now i want to > map it to cn transparently. So i need only > to manipulate cn fields etc. > > This idea comes to me as a flash of genius. > But i hope that it is quite old and therefore > possible. > Although this might be possible, (I'm not sure how many NAME's you're allowed in a schema), openldap provides mechanisms to do this already. And you wouldn't have to hijack namespace, or get into other nasty things like that. See slapo-rwm(5) --- DESCRIPTION The rwm overlay to slapd(8) performs basic DN/data rewrite and object- Class/attributeType mapping. Its usage is mostly intended to provide virtual views of existing data either remotely, in conjunction with the proxy backend described in slapd-ldap(5), or locally, in conjunction with the relay backend described in slapd-relay(5).

2 1

Ldap authenticate group members
by Mr raju varghese 10 Feb '07

10 Feb '07

Hi, We are planning to construct ldap Domain strucure as Ou=Users,dc=mycompany,dc=com and another organizational unit Groups and Cn groups Staff and Customers in it. Added some of users from Ou=Users to member of Staffs and Customers. Now i want only the guys who are member of Staffs group should authenticate from a patricular application . How can i achive it? thanks, ____________________________________________________________________________________ No need to miss a message. Get email on-the-go with Yahoo! Mail for Mobile. Get started. http://mobile.yahoo.com/mail

2 1

← Newer
1
...
4
5
6
7
8
9
10
11
12
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software February 2007