openldap-software

openldap-software@openldap.org

2719 discussions

WARNING: No dynamic config support for overlay ppolicy?
by Errol Neal 19 Jan '07

19 Jan '07

I've been trying to play with the ppolicy features of openldap for a few months now I have been very unsucessful. Here is my slapd.conf file: [root@dgovit-pap02 openldap]# cat slapd.conf ############################################################ include /usr/local/ldap/etc/openldap/schema/core.schema include /usr/local/ldap/etc/openldap/schema/cosine.schema include /usr/local/ldap/etc/openldap/schema/nis.schema include /usr/local/ldap/etc/openldap/schema/corba.schema include /usr/local/ldap/etc/openldap/schema/inetorgperson.schema include /usr/local/ldap/etc/openldap/schema/misc.schema include /usr/local/ldap/etc/openldap/schema/openldap.schema include /usr/local/ldap/etc/openldap/schema/ppolicy.schema include /usr/local/ldap/etc/openldap/schema/ttpua.schema pidfile /var/run/ldap/slapd.pid argsfile /var/run/ldap/slapd.args # Load dynamic backend modules: modulepath /usr/local/ldap/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la # moduleload ppolicy.la overlay ppolicy ppolicy_default "cn=std,ou=portal,ou=policies,dc=ttpua,dc=portal" ppolicy_use_lockout access to dn="" by * read password-hash {SSHA} database bdb suffix "dc=ttpua,dc=portal" rootdn "cn=scoobydoo,dc=ttpua,dc=portal" rootpw {SSHA}hPdD1ypslgiUX6ANvpBoQRdJ7rAK9ab2 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/ldap/var/openldap-data # indexing index default eq # basic use index objectClass,uid,dc,o,ou # references index member,owner,seeAlso # mail index mail # names index cn,sn,givenName,displayName eq,sub access to attrs=userPassword by self write by anonymous auth by * none access to attrs=shadowLastChange by self write by * auth access to * by * read loglevel 255 database monitor EOF I compiled openldap-2.3.32 as follows: ./configure --with-threads=posix --with-tls=openssl --enable-dynamic --with-cyrus-sasl --enable-modules--enable-ldbm=mod --enable-crypt --enable-lmpasswd --enable-ldap=mod --enable-meta=mod --enable-rewrite --enable-null=mod --enable-monitor=mod --enable-accesslog --enable-denyop --enable-dyngroup --enable-dynlist --enable-lastmod --enable-ppolicy --enable-proxycache --enable-refint --enable-retcode --enable-rwm --enable-syncprov --enable-translucent --enable-unique --enable-valsort --enable-aci --enable-bdb=mod --enable-hdb=mod --enable-ldbm-api=berkeley --enable-spasswd --enable-wrappers --prefix=/usr/local/ldap Can someone help me out here. Not sure what I'm doing wrong. I've followed every example I can find on the net but its still not working out for me. TIA, Errol Neal

2 1

Problem when trying to add an entry.
by Jean-Yves Avenard 19 Jan '07

19 Jan '07

Hello Context: I am trying to add an entry to the field GPG/Key in turba, which is using an OpenLDAP backend. The entry in question is of type: turbaPGPPublicKey define as in the schema as: attributetype ( 1.3.6.1.4.1.13040.4.1.4 NAME 'turbaPGPPublicKey' DESC 'PGP/GPG Public Key' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{4000} ) The error I get in OpenLDAP is: Entry (cn=common name,ou=avenardj,ou=personal_addressbook,dc=hydrix,dc=com), attribute 'turbaPGPPublicKey' not allowed entry failed schema check: attribute 'turbaPGPPublicKey' not allowed conn=19 op=3 RESULT tag=103 err=65 text=attribute 'turbaPGPPublicKey' not allowed I can't see what the issue could be. How does the turbaPHPPublicKey attribute should be defined? Thank you Jean-Yves

3 2

Re: WARNING: No dynamic config support for overlay ppolicy?
by Prakash Velayutham 19 Jan '07

19 Jan '07

>>> "Errol Neal" <eneal(a)dfi-intl.com> 01/19/07 11:07 AM >>> I've been trying to play with the ppolicy features of openldap for a few months now I have been very unsucessful. Here is my slapd.conf file: [root@dgovit-pap02 openldap]# cat slapd.conf ############################################################ include /usr/local/ldap/etc/openldap/schema/core.schema include /usr/local/ldap/etc/openldap/schema/cosine.schema include /usr/local/ldap/etc/openldap/schema/nis.schema include /usr/local/ldap/etc/openldap/schema/corba.schema include /usr/local/ldap/etc/openldap/schema/inetorgperson.schema include /usr/local/ldap/etc/openldap/schema/misc.schema include /usr/local/ldap/etc/openldap/schema/openldap.schema include /usr/local/ldap/etc/openldap/schema/ppolicy.schema include /usr/local/ldap/etc/openldap/schema/ttpua.schema pidfile /var/run/ldap/slapd.pid argsfile /var/run/ldap/slapd.args # Load dynamic backend modules: modulepath /usr/local/ldap/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la # moduleload ppolicy.la overlay ppolicy ppolicy_default "cn=std,ou=portal,ou=policies,dc=ttpua,dc=portal" ppolicy_use_lockout access to dn="" by * read password-hash {SSHA} database bdb suffix "dc=ttpua,dc=portal" rootdn "cn=scoobydoo,dc=ttpua,dc=portal" rootpw {SSHA}hPdD1ypslgiUX6ANvpBoQRdJ7rAK9ab2 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/ldap/var/openldap-data # indexing index default eq # basic use index objectClass,uid,dc,o,ou # references index member,owner,seeAlso # mail index mail # names index cn,sn,givenName,displayName eq,sub access to attrs=userPassword by self write by anonymous auth by * none access to attrs=shadowLastChange by self write by * auth access to * by * read loglevel 255 database monitor EOF I compiled openldap-2.3.32 as follows: ./configure --with-threads=posix --with-tls=openssl --enable-dynamic --with-cyrus-sasl --enable-modules--enable-ldbm=mod --enable-crypt --enable-lmpasswd --enable-ldap=mod --enable-meta=mod --enable-rewrite --enable-null=mod --enable-monitor=mod --enable-accesslog --enable-denyop --enable-dyngroup --enable-dynlist --enable-lastmod --enable-ppolicy --enable-proxycache --enable-refint --enable-retcode --enable-rwm --enable-syncprov --enable-translucent --enable-unique --enable-valsort --enable-aci --enable-bdb=mod --enable-hdb=mod --enable-ldbm-api=berkeley --enable-spasswd --enable-wrappers --prefix=/usr/local/ldap Can someone help me out here. Not sure what I'm doing wrong. I've followed every example I can find on the net but its still not working out for me. TIA, Errol Neal Hi, I don't see a problem description anywhere in this email. What exactly is the issue you are facing with ppolicy? Prakash

1 0

How to see ppolicy related state values
by Sadique Puthen 19 Jan '07

19 Jan '07

An ldapsearch with bind dn does not does not show the values of these attributes. How can I see the values of pwdChangedTime, pwdAccountLockedTime, pwdReset and etc of any entry? Regards, Sadique

1 0

ldapsearch certificate handling
by Sabo, Eric 19 Jan '07

19 Jan '07

I have no knowledge of OPENLDAP so that is why I am emailing this list. I have an vendor that is trying to connect to my active directory (which is windows 2003 native for the forest level and the domain level) via SSL (port 636) using LDAPSEARCH. They want to authenticate users against my active directory. My certificates that I created (microsoft assisted me on this part) One question I have - My certificates contain multiple DNS names (domain name and a simple DNS name - which I want the vendor to use) Does OPENLDAP have a problem with this setup on the certificate? Question about the command lines they are trying. 1st cmd - ldapsearch -H ldaps://servername -x -D 'CN=name of user' | grep usernameofusertheywanttofind 2nd cmd - ldapsearch -H ldaps://servername -x -s base -D 'cn=name of user' Any thoughts or opinions on this subject would greatly be appreciated. Eric Sabo Senior Windows Systems Engineer Department of Computing Systems California University of Pennsylvania

2 1

meta backend config trouble
by Julien Oix 19 Jan '07

19 Jan '07

hi everyone, I'm trying to deploy a meta directory using the OpenLdap meta backend. I'm using the slapd Debian package, version 2.3.27-1 when my target server includes the next ACL, eveything is fine, I can retrieve any data by the meta directory using ldapsearch, it works fine ## access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=toto,dc=fr" write by anonymous auth by self write by * none and access to * by dn="cn=admin,dc=toto,dc=fr" write by * read ## but I want only authentified connections to have read access, so I change the ACL like that ## access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=toto,dc=fr" write by anonymous auth by self write by * none and access to * by dn="cn=admin,dc=toto,dc=fr" write by self read by anonymous auth by * none ## So, for this specific target, i'm adding the acl-authcDN and acl-passwd directives, with the target's rootdn and rootpw values, in order to enable ACL checking and matching ! giving this in the meta backend conf ## database meta suffix "dc=meta-ufr-info-p7,dc=jussieu,dc=fr" uri "ldap://localhost:389/dc=meta-ufr-info-p7,dc=jussieu,dc=fr" suffixmassage "dc=meta-ufr-info-p7,dc=jussieu,dc=fr" "dc=toto,dc=fr" acl-authcDN "cn=admin,dc=toto,dc=fr" acl-passwd "xxxxx" ## But at this moment, I can't retrieve any data anymore, as I perform an ldapsearch by the meta directory .... Is there anything wrong in my conf ? the slapd-meta man page says about acl-authcDN directives : "it is supposed to have read access on the target server to attributes used on the proxy for acl checking." what does that mean exactly ? :) Thanks in advance ! -- Julien Oix UFR d'Informatique - Université Paris Diderot Bureau 5C01 (5ème étage) 175 rue du Chevaleret 75013 PARIS Tel : +33 (0) 144 278 504 Mobile : +33 (0) 664 392 207 --------------------------------------------- http://www.gnu.org/philosophy/no-word-attachments.html

1 0

Re: problem with sasl
by Rafal 19 Jan '07

19 Jan '07

> A thought (cos it happened to me years ago): you could be mixing SASL1 and > SASL2 libraries. You don't state OS or vendor, but if it's Linux make sure > you've included /usr/local/lib in /etc/ld.so.conf or one of the files in > /etc/ld.so.conf.d (if you have it) and run ldconfig. my system is freebsd 5.x I am create file ld.so.conf with /usr/local/lib and I am run ldconfig and slapd along crash after run ldapsearch -I and if I loged properly asl_interactive_bind_s: Can't contact LDAP server (-1) and slapd show this: ==>slap_sasl2dn: converting SASL name uid=test,cn=example.com,cn=digest-md5,cn=auth to a DN slap_authz_regexp: converting SASL name uid=test,cn=example.com,cn=digest-md5,cn=auth <==slap_sasl2dn: Converted SASL name to <nothing> slapd in free(): error: chunk is already free Abort (core dumped) but if I put bad password (when I login to slapd - digestmd5) - slapd along working.......... my installation dir for sasl2 is /usr/local/lib/sasl2 and with postfix is working correctly

2 1

Replication errors with slurpd and ppolicy
by Michael Steinmann 19 Jan '07

19 Jan '07

I'm currently using ppolicy in a replicated 2.3.30 environment. Most things wrt ppolicy work extremely well but I'm having issues with slurpd and ppolicy's internal attributes. Due to firewall restrictions I'm currently forced to use both syncrepl and slurpd for replication. Problem with slurpd is, that when a user changes her password the pwdHistory attribute gets replicated with an add/delete MOD. All attributes get replicated OK but I still get errors both on the master and on the slave. the master complains in .rej file with ERROR: No such attribute: modify/delete: pwdHistory: no such value the slave logs the following to syslog: Jan 12 11:09:58 slave slapd[11335]: conn=1 op=10 MOD dn="cn=ststm,ou=people,dc=example.com" Jan 12 11:09:58 slave slapd[11335]: conn=1 op=10 MOD attr=userPassword pwdChangedTime pwdHistory pwdHistory entryCSN modifiersName modifyTimestamp Jan 12 11:09:58 slave slapd[11335]: conn=2 op=10 MOD dn="cn=ststm,ou=people,dc=example.com" Jan 12 11:09:58 slave slapd[11335]: conn=2 op=10 MOD attr=userPassword pwdChangedTime pwdHistory pwdHistory entryCSN modifiersName modifyTimestamp Jan 12 11:09:58 slave slapd[11335]: conn=2 op=10 RESULT tag=103 err=16 text=modify/delete: pwdHistory: no such value Jan 12 11:09:58 slave slapd[11335]: conn=1 op=10 RESULT tag=103 err=0 text= To me this looks like the ppolicy overlay and slurpd are both trying to update the pwdHistory attribute at the same time but ppolicy kicks in faster and thus slurpd cannot see the old value and fails. My issue now is, that even though replication works OK (after replication all attrs are identical on master and slave, pwdHistiory is in sync) the logs are full of errors and the .rej is filling up. I'aware that the restriction of not being able to define what exactly gets replicated with slurpd is one of the reasons to phase it out, but maybe someone has already come up with a solution. Using 2.4 is also not an option (for now). -- mike

5 11

ldap.conf for syncrepl provider and consumer using tls
by Kent Nasveschuk 19 Jan '07

19 Jan '07

Hello, Can someone provide me with a sample provider and syncrepl consumer ldap.conf with TLS. I can connect to the provider and consumer using TLS and query the database. Syncrepl also runs fine without TLS on port 389, but when I try to configure and use TLS connections, it fails. Thanks Kent N. <- - - - - - - - - - - - - -> Kent L. Nasveschuk Linux Systems Administrator Fast Search and Transfer, Inc. 70 Innerbelt Rd, Somerville, MA 02143 www.fastsearch.com FASTforward '07 The Industry's Largest Business & Technology Conference Focused on Search February 7th - 9th, San Diego, CA www.fastforward07.com

2 3

ldap with sasl and odbc
by Rafal Swiderski 18 Jan '07

18 Jan '07

Why my slapd crash when I have login with SASL i am confiure line for slapd is: ./configure --with-cyrus-sasl --enable-sql --enable-hdb=no --enable-bdb=no CPPFLAGS="-I/usr/local/include -I/usr/local/unixODBC/include" LDFLAGS="-L/usr/local/lib -L/usr/local/unixODBC/lib" slapd work normal if I have loggin to it - if I write bad password - slapd normal working but if i write good login to slapd (correct login and pass) slapd is crash (always if I write correct my login and password ( ldapsearch -I ), please help me - how configure slapd with sasl....... but my slapd (last version) dont work with sasl :/ slapd -d 1: ........ >> slap_listener(ldap:///)connection_get(8): got connid=0 connection_read(8): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 62 contents: ber_get_next ber_get_next on fd 8 failed errno=35 (Resource temporarily unavailable) do_search ber_scanf fmt ({miiiib) ber: >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> ber_scanf fmt (m) ber: ber_scanf fmt ({M}}) ber: ==>select_backend: START ==>select_backend: dn: => send_search_entry: conn 0 dn="" ber_flush: 62 bytes to sd 8 <= send_search_entry: conn 0 exit. send_ldap_result: conn=0 op=0 p=3 send_ldap_response: msgid=1 tag=101 err=0 ber_flush: 14 bytes to sd 8 connection_get(8): got connid=0 connection_read(8): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 24 contents: ber_get_next ber_get_next on fd 8 failed errno=35 (Resource temporarily unavailable) do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt ({m) ber: ber_scanf fmt (}}) ber: >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> do_sasl_bind: dn () mech DIGEST-MD5 SASL [conn=0] Debug: DIGEST-MD5 server step 1 send_ldap_sasl: err=14 len=184 send_ldap_response: msgid=2 tag=97 err=14 ber_flush: 203 bytes to sd 8 <== slap_sasl_bind: rc=14 connection_get(8): got connid=0 connection_read(8): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 323 contents: ber_get_next ber_get_next on fd 8 failed errno=35 (Resource temporarily unavailable) do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt ({m) ber: ber_scanf fmt (m) ber: ber_scanf fmt (}}) ber: >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> do_sasl_bind: dn () mech DIGEST-MD5 SASL [conn=0] Debug: DIGEST-MD5 server step 2 slap_sasl_getdn: u:id converted to uid=test,cn=example.com,cn=DIGEST-MD5,cn=auth >>> dnNormalize: <uid=test,cn=example.com,cn=DIGEST-MD5,cn=auth> <<< dnNormalize: <uid=test,cn=example.com,cn=digest-md5,cn=auth> ==>slap_sasl2dn: converting SASL name uid=test,cn=example.com,cn=digest-md5,cn=auth to a DN slap_authz_regexp: converting SASL name uid=test,cn=example.com,cn=digest-md5,cn=auth <==slap_sasl2dn: Converted SASL name to <nothing> slapd in free(): error: chunk is already free Abort (core dumped) .... slad.conf file cat slapd.conf # $OpenLDAP: pkg/ldap/servers/slapd/back-sql/rdbms_depend/mysql/slapd.conf,v 1.5.2.1 2005/01/20 18:04:03 kurt Exp $ # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema # Define global ACLs to disable default read access. access to * by * write # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel -1 authz-police all sasl-host example.com sasl-realm example.com #require SASL authz-regexp uid=([^,]*),dc=example,dc=com uid=test,dc=example,dc=com #sasl-secprops none #authzTo: uid=[^,]*,dc=example,dc=com ####################################################################### # sql database definitions ####################################################################### database sql suffix "dc=example,dc=com" #rootdn "cn=test,dc=example,dc=com" #rootpw secret dbname ldap dbuser ldap dbpasswd ldap123zxc subtree_cond "ldap_entries.dn LIKE CONCAT('%',?)" insentry_stmt "INSERT INTO ldap_entries (dn,oc_map_id,parent,keyval) VALUES (?,?,?,?)" has_ldapinfo_dn_ru no #access to attrs=userPassword # by * auth #access to * by * none

4 4

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software