openldap-software

openldap-software@openldap.org

2719 discussions

OpenLDAP and SASL
by Jittinan Suwanrueangsri 11 Sep '09

11 Sep '09

Hi I have seen configuration which sasl get password from sasldb .I must run saslpasswd2 to create user and password for authentication but Is it possible to configure openldap and sasl verify authentication by getting password from openldap self like it happen in simple binding(userPassword attribute).How can I do it? jittinan

4 8

TLS negotiation failure
by manu＠netbsd.org 10 Sep '09

10 Sep '09

Hello I experience a wierd problem with OpenLDAP and TLS connexions. slapd will randomly reject connexions, with "TLS negotiation failure" error message. That happens with various clients (MacOS, NetBSD, Linux), and it happens on multiples machines that run slapd, the current setup is below: OpenLDAP 2.4.16 OpenSSL 0.9.9-dev 09 May 2008 NetBSD 5.0.1 But the problem also existed before upgrades with NetBSD 4.0 and OpenLDAP 2.4.14. It seems to become worse over time. Here is a trace obtained with a breakpoint set on the error message in slapd. conn=0 fd=19 ACCEPT from IP=193.54.82.248:59782 (IP=193.54.82.23:636) TLS: can't accept: (null). Breakpoint 1, connection_read (s=19, cri=0xa63ff8ac) at connection.c:1326 1326 connection_closing( c, "TLS negotiation failure" ); (gdb) bt #0 connection_read (s=19, cri=0xa63ff8ac) at connection.c:1326 #1 0x08078bf9 in connection_read_thread (ctx=0xa63ff900, argv=0x13) at connection.c:1216 #2 0xbbbaad3a in ldap_int_thread_pool_wrapper (xpool=0xbb540080) at tpool.c:663 #3 0xbb85e9df in pthread_create () from /usr/lib/libpthread.so.0 #4 0xbb7aa640 in swapcontext () from /usr/lib/libc.so.12 (gdb) c Continuing. conn=1 fd=20 ACCEPT from IP=193.54.82.248:59783 (IP=193.54.82.23:636) conn=0 fd=19 closed (TLS negotiation failure) So connection_read() reports an error from ldap_pvt_tls_accept(), which is caused by tls_imp->ti_session_accept(). For OpenSSL, that is tlso_session_accept(), which just calls SSL_accept() Does that ring a bell to anyone? Any suggestion for a workaround? -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

2 3

set.regex and substring substitution
by Ronie Gilberto Henrich 10 Sep '09

10 Sep '09

Hi, I am trying to grant users access to a ldap object when user/allowedDomain match the Mail object ou. To accomplish that I have to use set.regex and substring substitution, but I was not able to figure out what I am doing wrong. This is the current ACL: access to dn.regex="^(.+,)?ou=([^,]+),ou=Mail,o=example,c=BR$" by set="user/allowedDomain & this/ou" write result: ======= "ou=example.com,ou=Mail,o=example,c=BR" = write(=wrscxd) "mail=test(a)example.com,ou=example.com,ou=Mail,o=example,c=BR" = 0 This is the ACL that I am trying to build. It was expecting both results as = write(=wrscxd), but I am getting only = 0. access to dn.regex="^(.+,)?ou=([^,]+),ou=Mail,o=example,c=BR$" by set.regex="user/allowedDomain & $2" write result: ======= "ou=example.com,ou=Mail,o=example,c=BR" = 0 "mail=test(a)example.com,ou=example.com,ou=Mail,o=example,c=BR" = 0 Any ideas about what I should do for this to work? Thanks! Ronie

1 0

TLS Info?
by Eric Nichols 09 Sep '09

09 Sep '09

I have not been able to figure out how to dump more info on the encryption levels, certificate CN & expiration date etc. Should this be done through the openssl functions? If so, what do I hook them to? -- Thanks, Eric Directory Wizards Inc. www.dirwiz.com

4 5

Strange issue with replication in mirror mode
by Jérémie Grauer 09 Sep '09

09 Sep '09

3 4

ldap_result(), Posix signals and error checking
by John Miller 07 Sep '09

07 Sep '09

Hi all, I have noticed a problem with my program (which is supposed to generate and receive many Posix signals ) and the function ldap_result(). It happened to both my code and those library functions that used it (the synchronous versions of various add/search/modify functions). They all failed randomly with a "Can't contact LDAP server" error. I tracked the issue down to the poll() function in os-ip.c : it's return value is not checked to see if it has been interrupted by a signal. Patching the library ( making the poll function to restart if errno == EINTR after failure ), resolved my problem. Is it a bug or a choice? The patch is trivial, but if that error is not checked by choice that should be documented imho. Cheers, JM

3 3

Using SASL OTP
by Emmanuel Dreyfus 04 Sep '09

04 Sep '09

Hello Anyone has experience using SASL OTP with OpenLDAP? Here is what I understood so far: - OTP stuff is stored in SASL auxprop cmusaslsecretOTP, which can be stored in sasldb or in LDAP. - If OpenLDAP finds a cmusaslsecretOTP attribute for a user, and if the OTP plugin is installed both on the client and the server, then the OTP challenge is presented when requesting the OTP method. That leaves me with two problems: how to set cmusaslsecretOTP in LDAP? - if I use salspasswd2, it will store cmusaslsecretOTP in sasldb. I can copy paste it to the LDAP directory, which is not very satisfying. - If I install the Cyrus ldapDB plugin and add a sasl2/salspasswd.conf, it seems I can tell salspasswd2 to write to the directory: ldapdb_uri: ldaps://ldap.example.com I have not fully investigated, but it seems the thing cannot prompt for credentials: DN/password must be stored in salspasswd.conf, which makes multiuser utilization troublesome. - salspasswd2 calls sasl_setpass(), and a look at OpenLDAP sources shows that passwd_extop()/slap_sasl_setpass() does the same. That suggests it is possible to have slapd doing the thing, but how does it works? In passwd_extop(), slap_sasl_setpass() will only be called if op-o_bd is NULL. In what situation does it happen? - And my last problem is to generate OTP. setkey(1) does not seems to produce something acceptable by SASL OTP. I have to investigate further. -- Emmanuel Dreyfus manu(a)netbsd.org

3 6

ACL problem in slapd.conf
by Tomasz Chmielewski 04 Sep '09

04 Sep '09

I would like to allow a user to edit everything in a given subtree. For example, I would like to allow uid=Operator,ou=Users,dc=example,dc=com to edit all entries which are in *,ou=Users,dc=example,dc=com. I tried to follow http://www.zytrax.com/books/ldap/ch6/#access to set up access for that user, but I keep getting "insufficient access". onn=5 fd=15 ACCEPT from IP=127.0.0.1:46917 (IP=0.0.0.0:389) conn=5 op=0 BIND dn="uid=Operator,ou=Users,dc=example,dc=com" method=128 conn=5 op=0 BIND dn="uid=Operator,ou=Users,dc=example,dc=com" mech=SIMPLE ssf=0 conn=5 op=0 RESULT tag=97 err=0 text= conn=5 op=1 DEL dn="uid=d.user3,ou=Users,dc=example,dc=com" conn=5 op=1 RESULT tag=107 err=50 text=no write access to entry My rule in slapd.conf is: access to dn="ou=Users,dc=example,dc=com" by dn="uid=Operator,ou=Users,dc=example,dc=com" write by dn="uid=Operator,ou=Users,dc=example,dc=com" read I also tried to use: access to dn.subtree="ou=Users,dc=example,dc=com" ... But then I'm not even able to connect. -- Tomasz Chmielewski http://wpkg.org

5 8

Assertion failure in ldapsearch
by Guillaume Rousse 04 Sep '09

04 Sep '09

This server is frozen, and ldapsearch crashes: [root@etoile main]# ldapsearch -x ldapsearch: error.c:272: ldap_parse_result: Assertion `r != ((void *)0)' failed. Abandon This is openldap 2.4.15 client, with this specific configuration: TLS_CACERTDIR /etc/pki/tls/rootcerts TLS_REQCERT demand NETWORK_TIMEOUT 2 TIMEOUT 2 TIMELIMIT 2 On my own host, with 2.4.17 and no configuration, the client just hangs indefinitly. I'm joining the network capture. -- BOFH excuse #229: wrong polarity of neutron flow

4 6

Disk exhausting because of log.0000xxxx files
by Olivier Nicole 03 Sep '09

03 Sep '09

Hi, Because of a sputid script I wrote that was unduly modifying my LDAP directory, I endup exhausting my disk space with Berkeley DB log files of the type log.00000xxxx. My LDAP uses a database of type bdb, I have the option dbconfig set_flags DB_LOG_AUTOREMOVE and thought it would take care of removing the log files. It seems not so I must be missing something. (As for back-up safety, I have a script that does a slapcat every 2 hours keeping 10 days of back-ups, plus nightly back-up on a back-up server, so removing BDB logs should be quite safe) Any help will be warmly welcome. Best regards, Olivier

3 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software