openldap-software

openldap-software@openldap.org

2719 discussions

Proxy Authz interoperability of Sun's JNDI LDAP boost pack and OpenLDAP
by Michael Ströder 20 Jun '07

20 Jun '07

HI! I'm currently testing proxy authorization with the control implementation com.sun.jndi.ldap.ctl.ProxiedAuthorizationControl in Sun's LDAP boost pack for JNDI. slapd seems to be configured correctly since this command-line works: ldapsearch -x -H "ldap://localhost:1390" -D "uid=proxyuser,ou=proxyauthztests,ou=Testing,dc=stroeder,dc=de" -w testproxy -b "ou=Testing,dc=stroeder,dc=de" -s sub -e \!authzid="dn:uid=proxieduser,ou=proxyauthztests,ou=Testing,dc=stroeder,dc=de" "(objectClass=*)" Now I'm trying to do the same via JNDI (see attached Test2.java). But this results in: Exception: javax.naming.NamingException: [LDAP: error code 47 - authzId mapping failed]; remaining name 'ou=Testing,dc=stroeder,dc=de' If starting slapd with debugging (-d args,trace,packets) I get the log I've also attached. Note the extra char before "dn:" in line starting with "parseProxyAuthz". I extracted the control from Wireshark and even dumpasn1.c did not manage to decode it properly. So I suspect something's wrong with the encoding. Can anybody please confirm this? Any hint how to reach Sun's JNDI developers? Ciao, Michael. -- Michael Ströder michael(a)stroeder.com http://www.stroeder.com

4 4

rootpw ignored if userPassword exists
by Andreas Hasenack 20 Jun '07

20 Jun '07

I was just wondering if this is expected behaviour. If rootdn happens to match an existing entry in the directory, and that entry has a userPassword attribute, the rootpw value in slapd.conf is ignored and userPassword is used instead. I find this a bit unexpected. Suppose someone manages to create an entry matching rootdn. Then this person would be able to become rootdn, bypassing the rootpw setting in slapd.conf.

3 3

Checking authzTo case-sensitive
by Michael Ströder 20 Jun '07

20 Jun '07

HI! checking a DN sent by proxy authorization control against authzTo seems to be case-sensitive. Or better said: DNs in the attribute value of authzTo must be lower-cased to make matching work. Is that by purpose? Ciao, Michael.

2 3

OpenLDAP for Windows Available
by Matthew Hardin 20 Jun '07

20 Jun '07

Hi All, There's been a lot of conversation about OpenLDAP for Windows lately, and we thought it would nice to make a package available free of charge. CDS Silver 3.7.1 for Windows (32-bit) is based on OpenLDAP 2.3.35 plus patches. It's been tested on Windows 2000, Windows XP, and Windows 2003 Server, and it's packaged in a nice InstallShield wrapper. No extra software is needed. The package can be downloaded from CDS 3.x Silver Edition section of our download site at http://www.symas.net/portal. Check the release notes and the ReadMe file for additional information. Enjoy! Matt (the elder), Howard, Marty, Chuck, and Matt (the younger) Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: http://www.symas.com

2 1

Replication, ACL's - newbie questions.
by lauro＠npd.ufsc.br 20 Jun '07

20 Jun '07

Hi, I have about 10 locations on my tree where specific DN's have write access. To get the ACL's properly processed I have these ACL's before an ACL to resource "*" to the LDAP admin (access to * \ by "admin,suffix" write \ by * read). On the slaves I should not have an ACL to each of those entries (those 10 before), cause if so, on each one I have to add an extra line to the replication agent for that slave. I need just one like this: access to * by "admin,suffix" write by replication-agent-for-this-slave,suffix write by * read on the slave the replication DN is the only one requesting write access on syncronization(?), at least on the logs that's what I get, and it makes more sense. Despite the DN used to write on the master, always the replication agent is the one to request write access to the slave tree. And another thing: If I try to write anything on the slave with any DN (even admin DN) I get a referral error/message, ok, but when using the replication DN for that slave, I can write with no problems..then the databases are out of sync. I know nobody but the slapd and slurpd will have access to that DN pass, but is that right? Should the replication DN be able to write to the slave tree directly? Is there a way to make it right just when called by slurpd? (*Of course* it does have to write directly to the slave db, that's why it exists, if there were a way to make it do so just when called by slurpd..(I don't know who starts the write process if it's slapd or slurpd.) thanks, lauro ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

2 2

I need get random entries
by Elier Delgado 20 Jun '07

20 Jun '07

Hi guys, It's very strange but I need get random entries from the OpenLdap, specifically get randoms users (N users) .. it's a requirement of the system that I'm designing .... I'm using PHP and is not efficient get all results and do the random with the index of the result array ...because the results must be many .. And I'm not happy to apply a random to a filter values, for example generating randomly uid and getting near results ... So, I will appreciate any idea ... Regards, Elier

3 3

Re: Limiting attributes through ACL
by Pierangelo Masarati 20 Jun '07

20 Jun '07

[please keep replies on the list] >>Dan Ciarniello wrote: >># anyone can see the cn of inetOrgPersons >>access to filter="(objectClass=inetOrgPerson)" attrs=cn >> by * read >> >># only users can see anything else of inetOrgPersons >>access to filter="(objectClass=inetOrgPerson)" >> by users read > Unfortunately, that doesn't seem to do it. I set the above filters but > I still get back all attributes when binding anonymously (using > JXplorer). I don't know if it makes a difference but I'm using OpenLDAP > 2.2 rather than 2.4. Well, apart from any consideration strictly related to your issue, you should be using 2.3 (2.4 is not released yet but in alpha, so it's not recommended). The fact that the above rules do not seem to work sounds odd, as they're known to work as suggested. How can you tell they ever get used? Did you run slapd with "acl" debug level enabled (with 2.2, OR 128 to the log level). My guess is that you have broader ACLs in place that get called before the suggested ones. I suggest you post your entire slapd.conf (after appropriate sanitization for any sensistive info). p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

2 3

Data Store Question
by Jacques Voris 19 Jun '07

19 Jun '07

To All: My employers wish to use a SQL Database (specifically MySQL) as the data store for OpenLDAP. All of the information I have been able to find thus far seems to indicate that while this may be technically possible, it is a very bad idea. Therefore, I wish to know if any of you have any experience with using a SQL database for the data store, or if it is such a bad idea what specific reasons is it such? -- Thank You, Jacques Voris

3 3

Backend meta as a module errors
by Alexandre DUVAL 19 Jun '07

19 Jun '07

Hello, I tried hard but I can't manage to get back-meta to work as a module with OpenLDAP 2.3.34 to 2.3.35. (I'm actually trying to backport the Debian last "slapd-2.3.35" to "Etch" ) However, compiling back-meta and back-ldap --enable-ldap --enable-meta seems to solve my problem ... but why ? Here's the error message I get : @(#) $OpenLDAP: slapd 2.3.35 (Jun 15 2007 09:41:15) $ root@Lena:/root/openldap/sources/openldap-2.3.35/servers/slapd /usr/local/2.3.35/slapd-meta.conf: line 61: "pseudorootdn", "pseudorootpw" are no longer supported; use "idassert-bind" and "idassert-authzFrom" instead. /usr/local/2.3.35/libexec/slapd: symbol lookup error: /usr/local/2.3.35/libexec/ldap/back_meta-2.3.so.0: undefined symbol: slap_idassert_parse_cf The build options : ./configure --prefix=/usr/local/2.3.35 --exec-prefix=/usr/local/2.3.35 --enable-debug --enable-dynamic --enable-syslog --enable-proctitle --enable-ipv6 --enable-local --enable-slapd --enable-aci --enable-cleartext --enable-crypt --enable-spasswd --enable-modules --enable-rewrite --enable-rlookups --enable-slapi --enable-slp --enable-wrappers --enable-backends=mod --enable-ldbm=no --enable-overlays=mod --enable-slurpd --with-subdir=ldap --with-cyrus-sasl --with-threads --with-tls The config file : include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/openldap.schema include /etc/ldap/schema/nis.schema pidfile /var/run/slapd/slapd2.3.35.pid argsfile /var/run/slapd/slapd2.3.35.args loglevel stats # Where the dynamically loaded modules are stored modulepath /usr/local/2.3.35/libexec/ldap moduleload back_ldap.la moduleload back_meta.la database meta suffix "o=test,c=fr" rootdn "cn=proxy,o=test,c=fr" rootpw secretlies uri "ldap://10.56.20.30:389/ou=toto,o=test,c=fr" pseudorootdn cn=proxy,ou=applications,ou=tata,o=test,c=fr pseudorootpw secret2 uri "ldap://10.65.23.19:389/ou=tata,o=test,c=fr" pseudorootdn cn=proxy,ou=applications,ou=toto,o=test,c=fr pseudorootpw secret3 map attribute affe sage Thanks for your advices ... Alexandre DVL ___________________________________________________________________________________ You snooze, you lose. Get messages ASAP with AutoCheck in the all-new Yahoo! Mail Beta. http://advision.webevents.yahoo.com/mailbeta/newmail_html.html

6 6

Re: Question about ldap_init, ldap_initialize, start_tls, LDAP_OPT_X_TLS_ALLOW and TLS/SSL
by Markus Moeller 19 Jun '07

19 Jun '07

Howard, I use OpenSuse 10.2 with libldap-2.3.so.0.2.15 and if I have an empty ~/.ldaprc file ldap_start_tls_s comes back with error -11 Connect error ldap_int_select read1msg: ld 0x8054608 msgid 1 all 1 read1msg: ld 0x8054608 msgid 1 message type extended-result read1msg: ld 0x8054608 0 new referrals read1msg: mark request completed, ld 0x8054608 msgid 1 request done: ld 0x8054608 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ldap_parse_result ldap_msgfree TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 20, subject: /CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, unable to get local issuer certificate TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. ldap_err2string Error while setting start_tls for ldap server: Connect error(-11) ldap_free_connection 1 1 ldap_send_unbind When I add tls_reqcert allow to ~/.ldaprc I get ldap_int_select read1msg: ld 0x8054608 msgid 1 all 1 read1msg: ld 0x8054608 msgid 1 message type extended-result read1msg: ld 0x8054608 0 new referrals read1msg: mark request completed, ld 0x8054608 msgid 1 request done: ld 0x8054608 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ldap_parse_result ldap_msgfree TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 20, subject: /CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, unable to get local issuer certificate TLS certificate verification: depth: 0, err: 27, subject: /CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, certificate not trusted TLS certificate verification: depth: 0, err: 21, subject: /CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, unable to verify the first certificate TLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write change cipher spec A TLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL_connect:SSLv3 read finished A TLS trace: SSL3 alert write:warning:bad certificate TLS: unable to get peer certificate. Successfully set up TLS protected connection to ldap server w2k3.windows2003.home:389 So, this setting definitely does something !! Regards Markus ----- Original Message ----- From: "Howard Chu" <hyc(a)symas.com> Newsgroups: gmane.network.openldap.general To: "Markus Moeller" <huaraz(a)moeller.plus.com> Cc: <openldap-software(a)openldap.org> Sent: Tuesday, June 19, 2007 12:33 AM Subject: Re: Question about ldap_init, ldap_initialize, start_tls,LDAP_OPT_X_TLS_ALLOW and TLS/SSL > Markus Moeller wrote: >> But it is allowed to be set in ldap.conf, > > That doesn't necessarily mean anything. Lots of things can be set in > ldap.conf that don't mean anything at all, since the parser ignores any > keywords it doesn't recognize. > > What evidence do you have that this particular setting actually does > anything? A quick scan of the source code proves that it actually does > nothing. > >> so why can't or shouldn't I be able to set it in my client without the >> pain of checking all the different config files ldap.conf, .ldaprc, >> ldaprc ... I'd like to be able to control my client options without the >> use of config files. > > Go ahead and do that then. But don't waste time with options that don't > actually have any meaning. >> >> Regards >> Markus >> >> ----- Original Message ----- >> From: "Howard Chu" <hyc(a)symas.com> >> To: "Markus Moeller" <huaraz(a)moeller.plus.com> >> Cc: <openldap-software(a)openldap.org> >> Sent: Tuesday, June 19, 2007 12:01 AM >> Subject: Re: Question about ldap_init, ldap_initialize, start_tls, >> LDAP_OPT_X_TLS_ALLOW and TLS/SSL >> >> >>> Markus Moeller wrote: >>>> Does anybody have some sample code of how to use LDAP_OPT_X_TLS_ALLOW >>>> in a client program with ldap_start_tls_s ? >>>> Is it a bug if it doesn't work ? >>> The LDAP_OPT_X_TLS option is incompatible with ldap_start_tls. You >>> cannot use both together. In general, the LDAP_OPT_X_TLS option is >>> deprecated and should not be used at all. > > -- > -- Howard Chu > Chief Architect, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ >

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software