openldap-software

openldap-software@openldap.org

2719 discussions

Re: access control
by Quanah Gibson-Mount 06 Dec '07

06 Dec '07

--On December 5, 2007 1:41:49 PM -0500 Nathan Nobbe <quickshiftin(a)gmail.com> wrote: > i have not read any material on ideal directory layout. can you refer me > to good > resource? the design i have created is based only on intuition. that, > and the schema > reference available in phpLdapAdmin. truth be told, ive found the > documentation in > the openldap administration guide only marginally helpful. at least i > havent seen much > in there about ldap itself; the guide seems to presume preexisting > knowledge of ldap; > of which mine is scant :) Well, there's not hard rule. The general principal is, as flat as possible, as deep as necessary. The problem of course is compounded that bad design decisions at the beginning can haunt you for years. ;) > if i were to have a tree for organizationalUnit objects and another for > organizationalPerson > objects, what would the ideal root objectClass of those trees? The root objectClass of a tree really does not have to pertain to the objects contained in that tree. I tend to make my branch roots fairly benign, like: dn: cn=people,dc=myorg,dc=com objectclass: organizationalRole description: people cn: people > In answer to your question, however, you may find that using sets helps > with some of what you want to do. > > > what are sets in the context of ldap? That's an excellent question. Some day they'll be documented, hopefully. :) But here are some examples: access to dn.children="cn=people,dc=myorg,dc=com" by set.exact="this/uid & user/uid" read If THIS ENTRY and the BINDING USER have the same value for UID, allow READ access to dn.children="cn=nis,dc=myorg,dc=com" by set.exact="this/host & user" read if THIS ENTRY's host attribute matches the USER, allow READ --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

slave-to-master replica
by A Molchanov 06 Dec '07

06 Dec '07

Hellow, its about for ldap-2.3 replication with syncrepl I need slave-to-master replica, have making slapd.conf like http://www.openldap.org/faq/data/cache/1434.html... but it's not working. Its even imposable to make changes on the slave directly,.. I hope anybody have a working sample, ..please show me

2 1

syncrepl - ldap_start_tls failed (-11)
by Cristian Laufer 06 Dec '07

06 Dec '07

Hello All, Im trying to setup syncrepl with TLS. But so far it won´t work. Actually Im a bit confused because Provider.log says "TLS established" and consumer.log "ldap_start_tls failed (-11)". My settings are as follows: provider slapd.conf: overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 consumer slapd.conf: index entryCSN,entryUUID eq syncrepl rid=123 starttls=yes provider=ldap://ldapmaster:389 type=refreshAndPersist interval=00:00:00:01 searchbase="dc=test,dc=de" filter="(objectclass=*)" scope=sub attrs="*" schemachecking=off updatedn="cn=syncuser,ou=system,dc=test,dc=de" credentials="xxx" bindmethod=simple binddn="cn=admin,dc=uni-koblenz-landau,dc=de" credentials="xxx" provider.log: Dec 5 15:40:57 testldap slapd[8997]: conn=2 op=3 UNBIND Dec 5 15:40:57 testldap slapd[8997]: conn=2 fd=15 closed Dec 5 15:41:01 testldap slapd[8997]: conn=3 fd=15 ACCEPT from IP=192.168.1.2:50400 (IP=0.0.0.0:389) Dec 5 15:41:01 testldap slapd[8997]: conn=3 op=0 STARTTLS Dec 5 15:41:01 testldap slapd[8997]: conn=3 op=0 RESULT oid= err=0 text= Dec 5 15:41:01 testldap slapd[8997]: conn=3 fd=15 TLS established tls_ssf=256 ssf=256 Dec 5 15:41:01 testldap slapd[8997]: conn=3 op=1 BIND dn="cn=admin,dc=test,dc=de" method=128 Dec 5 15:41:01 testldap slapd[8997]: conn=3 op=1 BIND dn="cn=admin,dc=test,dc=de" mech=SIMPLE ssf=0 Dec 5 15:41:01 testldap slapd[8997]: conn=3 op=1 RESULT tag=97 err=0 text= Dec 5 15:41:01 testldap slapd[8997]: conn=3 op=2 SRCH base="dc=test,dc=de" scope=2 deref=0 filter="(objectClass=*)" Dec 5 15:41:01 testldap slapd[8997]: conn=3 op=2 SRCH attr=* structuralObjectClass entryCSN consumer.log: Dec 5 14:49:50 TESTNETZ-BDC slapd[6513]: slapd starting Dec 5 14:49:51 TESTNETZ-BDC slapd[6513]: Warning: rid 123 ldap_start_tls failed (-11) Dec 5 14:49:51 TESTNETZ-BDC slapd[6513]: conn=0 fd=25 ACCEPT from IP=127.0.0.1:54163 (IP=0.0.0.0:389) Dec 5 14:49:51 TESTNETZ-BDC slapd[6513]: conn=0 op=0 BIND dn="" method=128 Dec 5 14:49:51 TESTNETZ-BDC slapd[6513]: conn=0 op=0 RESULT tag=97 err=0 text= Dec 5 14:49:51 TESTNETZ-BDC slapd[6513]: conn=0 op=1 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" Dec 5 14:49:51 TESTNETZ-BDC slapd[6513]: conn=0 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Dec 5 14:49:51 TESTNETZ-BDC slapd[6513]: conn=0 op=2 UNBIND Dec 5 14:49:51 TESTNETZ-BDC slapd[6513]: conn=0 fd=25 closed Does someone know what part of the setup could be wrong? Are there more config files needed? I would appreciate any help or hint! Thank you! Cristian

5 4

Re: ldap queries rewriting
by Aaron Richton 06 Dec '07

06 Dec '07

If the copier has a Bind DN option, then something along the lines of... access to dn.subtree="ou=Engineering,dc=example,dc=com" by dn.exact="cn=EngineeringCopier,ou=Engineering,dc=example,dc=com" read by [...everythingelse...] access to * by dn.exact="cn=EngineeringCopier,ou=Engineering,dc=example,dc=com" none by [...everythingelse...] If it doesn't, you could substitute the "dn.exact" with "peername.ip." Super disgusting, but it'd probably work. (NOTE: if you're going to write back "they're all in ou=People" try access to dn.subtree="ou=People,dc=example,dc=com" filter="(dept=Engineering)" by dn.exact="cn=EngineeringCopier,ou=Devices,dc=example,dc=com" read by [...everythingelse...])

2 1

access control
by Nathan Nobbe 06 Dec '07

06 Dec '07

hello all, i am working on my first installation of openldap, so please bear with me. i assure you in advance i have been digging through the manual and only resort to the mailing list after exhausting ability to understand how to write the access portion of slapd.conf by reading the administration guide. in particular, if some of the language i use in the email is a bit hazy, im trying my best. anyway here is the background; i have designed the tree structure as follows beneath the rootdn there are organizationalUnit objects and beneath those there are organizationalPerson objects. im trying to write the access control with the following *general* goal. the goal is authenticated users can only have read access to organizationalPerson objects beneath the organizationalUnit containing the organizationalPerson object the user authenticated against. the authenticated users should not be able to view any organizationalUnits except the one containing the organizationalPerson object they authenticated against. so now i will come to the problem. there is no way (that ive found in the administration guide) to access the entry a user authenticated against when writing the access control rules. therefore in order to support the above general goal i must hardcode the value of the ou attribute into an access rule for every organizationalUnit in the tree. obviously this is an maintenance nightmare as i would need to support modification of the slapd.conf file if i wanted to create an interface where administrators could add / remove organizationalUnits or modify the value of their ou attribute. please tell me there is a way to analyze the values of attributes in the entry an authenticated user authenticated against, or that there is some other way to tackle the problem. i am happy to send the relevant portions of slapd.conf. thanks, -nathan

3 3

slapadd import/slapd startup:AttributeType errors in Buchan RPMs??
by R.B. 06 Dec '07

06 Dec '07

Hi; I've recently installed Buchan's OpenLDAP rpms because I wanted to use more features of OpenLDAP... mainly the overlays/modules. I downloaded them from http://staff.telkomsa.net/packages/... and installation was fine. I've exported my database to LDIF format and when I try to import the data via slapadd using the new openldap server config, I get the following error: ###### -bash-3.00# /usr/sbin/slapadd -f /opt/ldap-master/etc/slapd.conf -l ldif-dump-20071119.txt /usr/share/openldap2.3/schema/core.schema: line 366: AttributeType not found: "description" slapadd: bad configuration file! -bash-3.00# ###### Looking at the core.schema file, I see that the "description" AttributeType is commented out because it's a "system schema".... along with a few others, like "userPassword". As I keep uncommenting the several attributes, the slapadd process succeeds a bit more. However, when starting slapd, it errors about duplicate attribute types... the ones I uncommented. So I decide to go back to leaving them commented as was intended by the author. But this case causes the import to fail. So, where is the "system schema" found and how do I include it in the main slapd.conf file so that the import process finds these attributes? I've looked through the distribution to find it, but I've not come up with anything. My guess is that it's included in a library or compiled into the daemon. So how do I fix my problem? Thoughts? Thanks, Rafael

2 1

CRL expiration
by Matt Kelley 06 Dec '07

06 Dec '07

I am using OpenLDAP 2.3.39. I have enabled CRL checking by including "TLSCRLCheck peer" in my slapd.conf file. I am having a problem when CRLs expire. I find that, after retrieving an updated CRL, I must restart slapd in order for it to be used. This seems to be true whether using TLSCACertificateFile or TLSCACertificatePath. Is this expected? Is there any way to update CRLs (or certificates, for that matter) without recycling slapd? Thanks in advance, Matt

3 2

sync replication fails
by RUMI Szabolcs 06 Dec '07

06 Dec '07

Hello! I've got a syncrepl setup with the following settings: provider slapd.conf: overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 consumer slapd.conf: syncrepl rid=100 provider="ldaps://ldap-master.com.com" binddn="cn=syncrepl,ou=services,dc=com,dc=com" bindmethod=simple credentials="secret" searchbase="dc=com,dc=com" scope=sub type=refreshOnly interval=00:00:10:00 provider log: Dec 4 21:15:23 ldap-master slapd[18046]: conn=15053 fd=37 ACCEPT from IP=<slave_ip>:56390 (IP=0.0.0.0:636) Dec 4 21:15:24 ldap-master slapd[18046]: conn=15053 fd=37 TLS established tls_ssf=256 ssf=256 Dec 4 21:15:24 ldap-master slapd[18046]: conn=15053 fd=37 closed (connection lost) consumer log: Dec 4 21:15:24 ldap-slave slapd[6149]: do_syncrep1: rid 100 ldap_sasl_bind_s failed (-1) Dec 4 21:15:24 ldap-slave slapd[6149]: do_syncrepl: rid 100 quitting I've double checked the credentials, they're OK. /etc/openldap/ldap.conf has "TLS_REQCERT never" in order to exclude certificate issues. What could be wrong? Maybe it tries to authenticate by SASL despite bindmethod=simple? Thanks, Sab

2 2

Re: access control
by Quanah Gibson-Mount 05 Dec '07

05 Dec '07

1 0

custom schema oddness?
by Mike Eggleston 05 Dec '07

05 Dec '07

I have a custom schema for my site that has five fields. During the LISA '07 conference I had an idea for two more fields. I added the fields to the schema and restarted slapd. The fields do not appear in the ldif output from ldapsearch nor do the fields appear in phpLdapAdmin. Do I need to slapcat and slapadd the entire database to get these new fields to appear? openldap 2.3.30 fedora core 5 Mike

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software