openldap-software May 2007

openldap-software@openldap.org

85 participants
123 discussions

[Rivendell] idassert-bind not working as expected?
by Federico Grau 17 May '07

17 May '07

With minimal information as requested by the moderators multiple times. Why doesn't idassert-bind work as expected? When I try an anonymous query to an "LDAP" server via an OpenLDAP server configured as a proxy (backend meta , or backend ldap), the query fails because the OpenLDAP server does not bind (even when I try setting the "idassert-bind" option). # sample failed anonymous query to AD via OpenLDAP ldapsearch -H "ldap://localhost/" -b "ou=windows,dc=rfa,dc=org" -x # expected query to be performed by ldap server ldapsearch -H "ldap://dc1.rfa.org/" -b "cn=users,dc=rfa,dc=org" \ -D "CN=LDAP Proxy user account,OU=Windows,DC=rfa,DC=org" -W \ -x # using (tcpdump -x -s0 port 389) I never see a bind sent from OpenLDAP, # and instead I see an error returned from the "LDAP" server because a # bind not successful. # backend meta portion of the slapd.conf file ##database ldap database meta suffix "ou=windows,dc=rfa,dc=org" uri "ldap://dc1.rfa.org/ou=windows,dc=rfa,dc=org" suffixmassage ou=windows,dc=rfa,dc=org cn=users,dc=rfa,dc=org idassert-authzFrom "dn:*" #Xidassert-bind bindmethod=simple binddn="ldap-proxy(a)rfa.org" credentials="222222" idassert-bind bindmethod=simple binddn="CN=LDAP Proxy user account,OU=Windows,DC=rfa,DC=org" credentials="222222" mode=none dncache-ttl 60 My environment is made up of Debian stable (4.0 Etch) on the workstations and OpenLDAP server, OpenLDAP 2.3.30-5 on the server. "LDAP" Server on the remote end. thank you, donfede -- Federico Grau Free Software Developer and Sysadmin Radio Free Asia 2025 M Street, NW Suite 300 Washington, DC 20036 202-587-2046 Telephone 202-721-7468 Facsimile CONFIDENTIAL COMMUNICATION This e-mail message is intended only for the use of the addressee and may contain information that is privileged and confidential. Any unauthorized dissemination, distribution, or copying is strictly prohibited. If you receive this transmission in error, please contact network(a)rfa.org. _______________________________________________ Rivendell mailing list Rivendell(a)techweb.rfa.org http://techweb.rfa.org/mailman/listinfo/rivendell

2 3

LDAP replications for dummies ;)
by Antuan Avdioukhine 17 May '07

17 May '07

Greetengs. About two years ago I theoreticaly learned with docs and this forum, but had no practice at all. Now I have to resolv some problems with OpenLDAP in a rush, and, unforunatelly, I have no much time to search archives and documentation and make experimental works. So I will be very greatfull if you share your experience. URLs for FAQs and examples are welcome. So. We have an e-mail MTA distributed system based on sendmail, courier imap, and OpenLDAP as user database and authentication backend. Our ex-sysadmin installed master LDAP and two slave OL-servers on relays, using SLURP technique. I beleive that it is not right choice, so I want to migrate replication scheme to better one. So some questions I have for now. 1. I know SLURP and LDAP sync techniques, is there another ones? 2. LDAP sync looks for me much better than SLURP. Is there any "compare chart" or "best practice" tips which helps to choose right way? 3. Is there any version restrictions for replications schemes? E.g. if I setup new OpenLDAP server have I install exactly same version as other LDAP servers? 4. Some days ago my master LDAP was dead for good, so I'd changed software configuration and now it uses one of my ex-slaves. It works fine but as a result I lost backup LDAP server -- now my slaves out of sync. I guess that the simplest way is setup another OpenLDAP, copy base and make it master ldap server using SLURP. But if sync scheme better than SLURP I prefer to setup LDAP sync scheme. So if I choose sync, I want to make my today's master 'provider' and stand-alone-today-ex-slave 'consumer'. Am I right? 5. Can I perform any setup steps but setup consumer to syncronize my LDAPs? -- Antuan Avdioukhine (DEKA-RIPE). Convey Plus Telecommunications St.Petersburg, Russia.

2 3

using syncrepl to create a backup
by Maria McKinley 17 May '07

17 May '07

Hi there, Couldn't find this addressed anywhere in the manual or the mailing list, so please forgive me if this is a silly question. I am looking to use syncrepl to create a backup of my ldap server. I was wondering how difficult it is to change setups between consumers and producers. Is it enough to just change the slapd config file on the consumer to a copy of what was on the producer when the producer goes down for some reason, and just have the clients configured with both ips (I'm assuming they will just go down the list until they find one working, and the consumer will otherwise just point them to the producer)? A related question, can ldap.conf always point to localhost if localhost is always either a consumer or a producer, or do consumer ldap.conf need to be pointed to the producer? thanks a bunch, Maria

3 2

openldap proxy bind username
by Federico Grau 16 May '07

16 May '07

Is it possible to configure slapd(8) to proxy a simple bind operation where the username provided by the client is not a LDAP DN string? Right now this query works: ldapsearch -H "ldap://localhost/" \ -b "ou=windows,dc=rfa,dc=org" \ -D "CN=LDAP Proxy user account,OU=Windows,DC=rfa,DC=org" \ -W -x Now how can I get a query like this to work: ldapsearch -H "ldap://localhost/" \ -b "ou=windows,dc=rfa,dc=org" \ -D "ldap-proxy(a)rfa.org" \ -W -x My environment is made up of Debian stable (4.0 Etch) on the workstations and OpenLDAP server, OpenLDAP 2.3.30-5 on the server. MS Windows 2003 Server Enterprise edition for the AD server with Services For Unix 3.5 NIS server (and corresponding schema changes) applied. thank you, donfede -- Federico Grau Free Software Developer and Sysadmin Radio Free Asia 2025 M Street, NW Suite 300 Washington, DC 20036 202-587-2046 Telephone 202-721-7468 Facsimile CONFIDENTIAL COMMUNICATION This e-mail message is intended only for the use of the addressee and may contain information that is privileged and confidential. Any unauthorized dissemination, distribution, or copying is strictly prohibited. If you receive this transmission in error, please contact network(a)rfa.org.

2 1

chain-overlay question
by Markus Krause 16 May '07

16 May '07

Hi list! i have several consumer and one provider (lets call them ldapconX and ldapprov). syncrepl works fine, but i actually do not want any clients to contact the provider directly (and i have in addition some clients which would not understand referrals anyway), so reading through the admin guide and man pages i thought slapo-chain would be the solution! (correct me if i am wrong ;-)) But somehow a can not get it working... the slapd.conf of the provider is untouched, the consumer have (simplified in some places; please tell me if you need it in more details): ----- /etc/openldap/slapd.conf # consumer include ... acls ... databse bdb suffix ... rootdn "cn=manager,o=test" rootpw xxx index ... overlay smbk5pwd syncrepl ... updateref ldaps://ldapprov overlay chain chain-rebind-as-user FALSE chain-uri "ldaps://ldapprov" chain-rebind-as-user TRUE chain-idassert-bind bindmethod="simple" binddn="cn=manager,o=test" credentials="secret" mode="self" ---- end of slapd.conf but when trying to change the password via ldappasswd i get: ldappasswd -x -h localhost <...> New password: Re-enter new password: Enter LDAP Password: Result: Referral (10) Referral: ldaps://ldapprov i also tried to remove the line "updateref ...", but then i get: Result: Server is unwilling to perform (53) Additional info: shadow context; no update referral i also read different postings and the man pages but maybe overlooked or did not understand something. what am i am doing wrong? or do i missunderstand some conceptual basics? thanks in advance for any hints! regards markus +-----------------------------------------------------------------+ | Markus Krause, Mogli-Soft | | Support for Mac OS X, Webmail/Horde, LDAP, RADIUS, MySQL | | by order of the | | Computing Center of the Max-Planck-Institute of Biochemistry | +--------------------------------+--------------------------------+ | E-Mail: krause(a)biochem.mpg.de | Tel.: 089 - 89 40 85 99 | | markus.krause(a)mac.com | Fax.: 089 - 89 40 85 98 | | Skype: markus.krause | iChat: markus.krause(a)mac.com | +--------------------------------+--------------------------------+ ---------------------------------------------------------------------- This message was sent using https://webmail2.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 10

should I modify attribute definition in core.schema to suit my need?
by Zhang Weiwu 16 May '07

16 May '07

Generally I think I should not touch the attribute definition in system schema file like core.schema. However I got a problem here: our web application is designed to understand LDAP schema and provider proper user interface for each syntax. Our web application can understand syntax 1.3.6.1.4.1.1466.115.121.1.11 which is "Country String", two printable string characters as listed in ISO 3166. For this syntax the web application pops up a nice country selector. However when user enter 'c' (for country, defined in core.schema as *Directory String*) the web application treat it as all other Directory String, which is an input box. The users, being confused, typed their country name manually (like "American" or "U.S.A."), breaking compatibility because 'c' should be two printable string characters as listed in ISO 3166. We can update our web application to treat 'c' specially, but it's much easier to just modify syntax definition of 'c' in core.schema. Can I do that? Am I going to get more trouble from doing so? -- Zhang Weiwu Real Softservice http://www.realss.com +86 592 2091112

5 8

logleven pcache
by Dieter Kluenter 16 May '07

16 May '07

Hi, I'm testing HEAD with back-ldap, rwm and pcache. I have some issues with pcache and want to debug, but loglevel pcache is not known anymore, is there a particular reason why ist has been removed? -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6

2 1

Solaris MP Library Instead of GNU MP Library?
by ssoo＠siliconfile.com 16 May '07

16 May '07

Solaris 10 has a MP library. OpenLDAP-2.3.35 does not configure it. Will OpenLDAP support it near future?

1 0

problem with ldif; please help
by JOYDEEP 15 May '07

15 May '07

Dear list, I like to have a multidomain structure in openLDAP. below is my ldif but slapadd reports error because of the domain mis-configuration. could any one kindly help me to fix the problem ? ----------------------------------------------------------------------------- dn: dc=linux,dc=box ObjectClass: dcObject dc: linux structuralObjectClass:dcObject dn: o=kolkata.in,dc=linux,dc=box objectClass: domain o: kolkata.in structuralObjectClass: domain dn: ou=adrbook-kol,o=kolkata.in,dc=linux,dc=box ou: adrbook-kol objectClass: top objectClass: organizationalUnit structuralObjectClass: organizationalUnit dn: ou=Users,o=kolkata.in,dc=linux,dc=box ou: Users objectClass: top objectClass: organizationalUnit structuralObjectClass: organizationalUnit dn: ou=Groups,o=kolkata.in,dc=linux,dc=box ou: Groups objectClass: top objectClass: organizationalUnit structuralObjectClass: organizationalUnit dn: o=delhi.in,dc=linux,dc=box objectClass: domain o: delhi.in structuralObjectClass: domain dn: ou=adrbook-del,o=delhi.in,dc=linux,dc=box ou: adrbook-kol objectClass: top objectClass: organizationalUnit structuralObjectClass: organizationalUnit dn: ou=Users,o=delhi.in,dc=linux,dc=box ou: Users objectClass: top objectClass: organizationalUnit structuralObjectClass: organizationalUnit dn: ou=Groups,o=delhi.in,dc=linux,dc=box ou: Groups objectClass: top objectClass: organizationalUnit structuralObjectClass: organizationalUnit -----------------------------------------------------------------------------------

4 10

(raise question again) how to configure LDAP to allow each logged-in user to modify the subtree of the current user?
by Zhang Weiwu 15 May '07

15 May '07

Dear list I've posted this question before. Maybe it's my bad English but I didn't get a solution nor an answer of "it's impossible" too so I just post again (yes I knew people answer me for free and for being kind and I am really thankful for all feedback) Is it possible to define ACL that every user who successfully bind-ed (logged in) that this user can modify their own entry as well as the sub entries of them? e.g. dn: ou=support,xxx if one connection is bind to this dn, it can modify these entries: dn: cn=Wang Penghui,ou=support,xxx dn: cn=Zhang Weiwu,ou=support,xxx Now we have some 3000 people who can login to the LDAP database and each are logged in as an entry which is organization or organizationalUnit. They all need to be able to modify entries within their own organization or organizationalUnit. I know how to define one ACL rule for one to be able to modify an entry and its subtree, but in my case I need to define 3000 ACL rules (and this number is still growing). Can such permission requirement be defined within limited number of ACL rules? Best Regards -- Zhang Weiwu Real Softservice http://www.realss.com +86 592 2091112

3 3

← Newer
1
...
4
5
6
7
8
9
10
...
13
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software May 2007