openldap-software

openldap-software@openldap.org

2719 discussions

1.3.6.1.4.1.42.2.27.9.5.8 (Account Usability Control) supported?
by Alexander Skwar 03 Oct '07

03 Oct '07

Hello. I'd like to know if the "Account Usability Control" (oid=1.3.6.1.4.1.42.2.27.9.5.8) is supported by OpenLDAP. I ran: --($:~)-- ldapsearch -h winds06 -p 389 -b '' -s base '(objectClass=*)' supportedControl # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectClass=*) # requesting: supportedControl # # dn: supportedControl: 2.16.840.1.113730.3.4.18 supportedControl: 2.16.840.1.113730.3.4.2 supportedControl: 1.3.6.1.4.1.4203.1.10.1 supportedControl: 1.2.840.113556.1.4.319 supportedControl: 1.2.826.0.1.334810.2.3 supportedControl: 1.2.826.0.1.3344810.2.3 supportedControl: 1.3.6.1.1.13.2 supportedControl: 1.3.6.1.1.13.1 supportedControl: 1.3.6.1.1.12 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 According to this, the required control isn't listed. Is this just because of a misconfiguration of my OpenLDAP 2.3.35 server? Some other server implements that, but I'd rather like to use OpenLDAP instead of this other server, as OpenLDAP is available for more platforms. One source of information I found is at http://www.willeke.com:9080/wikildap/Wiki.jsp?page=DefinitionAccountUsabili… Because of the non-standard port of this server, I'm copying the information: The account usability control provides a pair of request and response controls that can be used to determine whether a user account may be used for authenticating to the server. The request control has an OID of 1.3.6.1.4.1.42.2.27.9.5.8 and does not include a value. It should only be included in search request messages. The corresponding response control has an OID of 1.3.6.1.4.1.42.2.27.9.5.8 (the same as the request control), and it will be included in any search result entry messages for a search request that includes the account usability request control. The value for the account usability response control will be encoded as follows: ACCOUNT_USABLE_RESPONSE ::= CHOICE { is_available [0] INTEGER, -- Seconds before expiration -- is_not_available [1] MORE_INFO } MORE_INFO ::= SEQUENCE { inactive [0] BOOLEAN DEFAULT FALSE, reset [1] BOOLEAN DEFAULT FALSE, expired [2] BOOLEAN DEFAULT_FALSE, remaining_grace [3] INTEGER OPTIONAL, seconds_before_unlock [4] INTEGER OPTIONAL } If the user account is available, then the control will include the number of seconds until the user's password expires, or -1 if password expiration is not enabled. If the user's account is not available, then the control will provide the reason it is unavailable. This control is required to get password less logins to work. Thanks a lot, Alexander

3 2

Question about attribute name
by Rana Biswas 02 Oct '07

02 Oct '07

Hi, When I add an attribute named "cm.host" in my OpenLDAP schema, I get an invalid name error. The attribute I added is: attributeType ( 2.5.4.2.2 NAME 'cm.host' DESC 'host name' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) I am getting the following error: Invalid NAME: "cm.host" Does this mean attribute in OpenLDAP schema cannot have dot in attribute name or I am doing something wrong. Is there any way around, I cannot change the schema and our application depend on this data. Thanks in advance. Regards, Rana Biswas

4 8

delete entries Delta syncrepl
by Julien Garnier 02 Oct '07

02 Oct '07

Hi, Central ldap -----> ldap_relay ----->ldap I retrieve information from a central ldap to my local relay (ldap_relay). I can't modify these data. I use delta syncrepl and multimaster (openldap 2.3.37) between ldap_relay and my ldap (ldap) I can modify the last one and add some atributes etc... If someone update the central ldap i retrive the information in my ldap_relay and in my ldap thats OK If I add an attribute to my ldap and the central ldap is update, i retreive the new ibnformations and my own attributes are not erase OK If a person is deleted from the central ldap, she is not delete in my ldap relay. NoOK In a shorter way : all is OK for me exept when someone is deleted from the central ldap Someone have an idea in how I can resolve this probleme (via syncrepl or other application) And exuse me for my English ... Thanks in advance Julien

3 3

Writing an ACL for Anonymous Searches
by Julius Squeezer 02 Oct '07

02 Oct '07

Hello I am new to ldap and ACL but I need to write an ACL that will prevent anonymous (cn=everyone?) users from viewing (read?) members of a certain group (e.g. cn=restricted_group,ou=groups,o=xxx) in their search/dump results. Any help or pointer to documentations is much appreciated. Thanks. _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar - get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/

3 2

Rewrite searchDN based on searchFilter
by Andrew Bidwell 02 Oct '07

02 Oct '07

Hi everyone, I have a question regarding the best way to enable rewriting of the searchDN based on the searchFilter. I have searched through the archives, and I see that my question was expressed in this 2004 email: http://www.openldap.org/lists/openldap-software/200401/msg00612.html. I couldn't seem to find any other relevent posts. As this response is a number of years old, do those recommendations still stand? Is this operation slapd.conf configurable? Is the best way forward to develop a separate overlay to perform this operation? Any information greatly appreciated. Thanks, Andrew

3 3

slapo-unique. several unique_base with different unique_attributes sets
by Dmitriy Kirhlarov 02 Oct '07

02 Oct '07

Hi, list I have container in my tree 'ou=cyrus,ou=mail,o=domain' and I need check 'uniqueMember' attribute -- user can be membered only in one group. Also, for 'ou=web,ou=groups,o=domain' with same types of objects, as 'ou=cyrus,ou=mail,o=domain' user can be membered in several groups, but I need uniques check for 'gidNumber' inside 'ou=groups,o=domain'. I need something: unique_base ou=users,o=domain uidNumber mail mailLocalAddress unique_base ou=groups,o=domain gidNumber unique_base ou=cyrus,ou=mail,o=domain uniqueMember I'm using openldap 2.3.35 Is it possible with this version or, may be, with 2.4.x? WBR. Dmitriy

3 4

FW: restricting attributes to become RDN , which objects are created
by Arunachalam Parthasarathy 02 Oct '07

02 Oct '07

Hello quanah, Sorry that i had not sent mail to the group... Below is the answer for your question "Actually I was saying the above for an example, I asked in a view that, if this restriction is there from server side. Then strict enforcement can be done (if needed)" Thanks a lot, Arunachalam. **************************************************************************** **************************** This e-mail and attachments contain confidential information from HUAWEI, which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction, or dissemination) by persons other than the intended recipient's) is prohibited. If you receive this e-mail in error, please notify the sender by phone or email immediately and delete it! -----Original Message----- From: Quanah Gibson-Mount [mailto:quanah@zimbra.com] Sent: Monday, October 01, 2007 9:05 PM To: arunachalamp(a)huawei.com; openldap-software(a)openldap.org Subject: RE: restricting attributes to become RDN , which objects are created --On Monday, October 01, 2007 3:23 PM +0530 Arunachalam Parthasarathy <arunachalamp(a)huawei.com> wrote: > > > Hello Gavin, > > Thanks for the reply. If this restriction is not there, any of the users > can create a dn with RDN as any attribute, which leads to non-uniformity > (for instance, one user may create uid as RDN and other may use > userPassword as RDN for inetOrgPerson) Why do you let users create their own objects? --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

restricting attributes to become RDN , which objects are created
by Arunachalam Parthasarathy 02 Oct '07

02 Oct '07

Hello all, In objectclass, Is there a way to restrict (only) an attribute to be RDN? For ex: only uid needs to be RDN , in organizational Unit Thanks in advance, Arunachalam. **************************************************************************** **************************** This e-mail and attachments contain confidential information from HUAWEI, which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction, or dissemination) by persons other than the intended recipient's) is prohibited. If you receive this e-mail in error, please notify the sender by phone or email immediately and delete it!

7 9

changing a user's password
by Adam Williams 01 Oct '07

01 Oct '07

I'm trying to learn openldap. I have a user that I want to change their password on, but I'm getting an error: [testuser@gomer ~]$ ldappasswd -WS -D "uid=testuser,ou=People,dc=gomer,dc=mdah,dc=state,dc=ms,dc=us" New password: Re-enter new password: Enter LDAP Password: SASL/DIGEST-MD5 authentication started ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database But the user does exist: [root@gomer ~]# ldapsearch -D 'cn=Manager,dc=gomer,dc=mdah,dc=state,dc=ms,dc=us' -b "uid=testuser,ou=People,dc=gomer,dc=mdah,dc=state,dc=ms,dc=us" -w xxxxxx -x # extended LDIF # # LDAPv3 # base <uid=testuser,ou=People,dc=gomer,dc=mdah,dc=state,dc=ms,dc=us> with scope subtree # filter: (objectclass=*) # requesting: ALL # # testuser, People, gomer.mdah.state.ms.us dn: uid=testuser,ou=People,dc=gomer,dc=mdah,dc=state,dc=ms,dc=us uid: testuser cn: test user telephoneNumber: 5766888 roomNumber: IS homePhone: 3738042 givenName: test sn: user mail: testuser@dc=mdah,dc=state,dc=ms,dc=us objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowLastChange: 13705 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 501 gidNumber: 101 homeDirectory: /home/testuser gecos: test user,IS,5766888,3738042 userPassword:: xxxxxxxxxxxxxx # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1

2 2

ACCESS LIST
by Isaac Gonzalez 30 Sep '07

30 Sep '07

Hi, > I've this estructure > > dc=empresa,dc=com > | > Dep1 > | > |---------User1 > |---------User11 > Dep2 > | > |---------User2 > |---------User22 > Dep3 > | > |---------User3 > |---------User33 > > > I want that User1 and User11 (users under Dep1) can only access to Dep1, > User1 and User11 data. --> Dep1 Subtree > I want that User2 and User22 (users under Dep2) can only access to Dep2, > User2 and User22 data. --> Dep2 Subtree > I want that User3 and User33 (users under Dep3) can only access to Dep3, > User3 and User33 data. --> Dep3 Subtree > > It's correct this ACL? Can't be more simple? > > #DEP1 ONLY ACCESS TO DEP1 > access to dn.subtree="ou=Dep1,dc=empresa,dc=com" > by dn.children="ou=Dep1,dc=empresa,dc=com" read > by anonymous auth > by * none > > #DEP2 ONLY ACCESS TO DEP2 > access to dn.subtree="ou=Dep2,dc=empresa,dc=com" > by dn.children="ou=Dep2,dc=empresa,dc=com" read > by anonymous auth > by * none > > #DEP3 ONLY ACCESS TO DEP3 > access to dn.subtree="ou=Dep3,dc=empresa,dc=com" > by dn.children="ou=Dep3,dc=empresa,dc=com" read > by anonymous auth > by * none > > #ADMIN > access to * > by dn="cn=admin,dc=empresa,dc=com" write > by anonymous auth > by * none > > > Thanks and bye. > > >

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software