openldap-technical January 2008

openldap-technical@openldap.org

48 participants
57 discussions

sql to ldap MD5 conversion
by Antoine Jacoutot 18 Jan '08

18 Jan '08

Hi. After several failed attempts, I need some help regarding the following issue. I need to import some users from a MySQL database to OpenLDAP. I cannot find a working way of converting the md5 password stored in the database (using md5() ) to the {MD5} password format for Ldap. e.g: SQL: the md5 value of 'password' is 5f4dcc3b5aa765d61d8327deb882cf99 OpenLDAP: the result of `slappasswd -h {MD5} -s password` is {MD5}X03MO1qnZdYdgyfeuILPmQ== So obviously I won't be able to use {MD5}5f4dcc3b5aa765d61d8327deb882cf99 >From what I could gather it has to do with Base64 encoding but all my attemps at scripting something failed miserably :( Any hint would be appreciated. Thanks! -- Antoine

2 2

automatic charset conversion?
by Stefan Palme 18 Jan '08

18 Jan '08

Hi, using an OpenLDAP server installation for several things. One thing is a shared addressbook which is used by different persons with different client applications. Some of them have a locale of "de_DE.utf8", some of them work with "de_DE.latin1", some of them use windows and so have a win-1250-or-whatever encoding. When creating new addressbook entries these are transfered from the client to the server in the clients charset encoding. When clients with other encodings read these entries they seem somehow broken - of course. How to solve this problem? When the server known the "client encoding" the server could automatically convert clients data into e.g. utf8 before storing it. Before sending data back to a client it could convert all the stored utf8-data into client's encoding. But I did not found a way to tell the server the client's encoding, so this seems to be no way. Are there any working solutions for this? Regards -stefan- -- ------------------------------------------------------------------- Dipl. Inf. (FH) Stefan Palme email: kleiner(a)hora-obscura.de www: http://hbci4java.kapott.org http://converter-db.de icq: 36376278 key fingerprint: 1BA7 D217 36A1 534C A5AD F18A E2D1 488A E904 F9EC -------------------------------------------------------------------

2 2

Coverity Report for Openldap library
by meow＠computer.org 17 Jan '08

17 Jan '08

Hi : Our development project is using Openldap library, currently using version 2.2.26, planning to migrate to a newer version. And, recently, I saw in scan.coverity is generating Error report for Openldap library . So, I downloaded the latest stable release 2.3.39, check the CHANGES doc to see if coverity fixes were included; but this doc didn;t mention anything regarding fixes for Coverity Error . Just want to know if latest stable release 2.3.39 contain the fixes to the Error reported in the Coverity ? And, how can I get access to the Coverity Report for Openldap library ? Thanks in advance for your time and information! Regards, Yen

2 1

Re: sles 10 synchronize 2 ldapservers
by bakkerru 16 Jan '08

16 Jan '08

Hi, The two directories must contain the same users and groups, and when i add a user on ldapserver off.company.nl it also has to be automativcally create the user on the second ldapserver mail.company.nl. i use openldap 2.3.32 on off.company.nl and 2.2.24 on mail.company.nl regards ruurd -----Oorspronkelijk bericht----- Van: openldap-technical-bounces+ruurd.bakker=ppc.nl(a)OpenLDAP.org [ <mailto:openldap-technical-bounces+ruurd.bakker=ppc.nl@OpenLDAP.org> mailto:openldap-technical-bounces+ruurd.bakker=ppc.nl@OpenLDAP.org] Namens Buchan Milne Verzonden: woensdag 16 januari 2008 7:48 Aan: openldap-technical(a)openldap.org CC: bakkerru Onderwerp: Re: sles 10 synchronize 2 ldapservers On Tuesday 15 January 2008 17:42:08 bakkerru wrote: > Question: > > How can i sychronize the users and groups of 2 ldap servers. 1 is > setup as pdc with samba and openldap (SLES10) domain "off.company.nl" > and the other is our mailserver installed with ldap and openexchange > (SLES9.3) domain mail.company.nl. how can i sync the users between > both. The mailserver is in a DMZ. You seem to have two issues here, and you're not clear which one you are trying to address. 1)Are you trying to merge the contents of two different directories? or 2)Are you trying to ensure that the contents of the directory on one server is available on another server? or 3)both? I am not aware of tools to merge the contents of two directories, but you could either do it manually, or write some scripts (which would depend on the contents of the directories). Once you have one directory containing all the information, use the replication tools which are provided to keep the directory in sync across your two servers. To be able to recommend which replication tool to use, you need to supply the versions of OpenLDAP you are using (which may generate a recommendation to upgrade at least one of them ...). Regards, Buchan

4 3

Script to check connections made
by Gustavo Mendes de Carvalho 16 Jan '08

16 Jan '08

Hi All, I would like to know if somebody has some script or knows where I can find one, that reads ldap.log file and creates a report where it's possible to check who logged in which machine, and when this connections was made. Regards --- Gustavo e-mail: gmcarvalho(a)gmail.com

5 5

Expired password notification
by Andris Eiduks 16 Jan '08

16 Jan '08

Hi! We use OpenLDAP for user's authentication. And now also implemented password policy. Authentication from Tomcat works without problem but customers find out about expired passwords only after unsuccessful binding when all limits are exceeded. ldapsearch with option "-e ppolicy" shows info about necessary password change. Is possible to get the same info by BIND operation performing from other systems side again OpenLDAP? Or we must create special functions in application for user attributes checking (pwdChangedTime, pwdGraceUseTime) and notification generation ? Thanks in advance,

4 6

how to change attribute display order
by Winanjaya - CBN 16 Jan '08

16 Jan '08

Dear All, How do I change attribute display order? ..(ie. sn, cn to cn, sn) .. pls advise thanks & regards Winanjaya *********************** Our outgoing mail has been scanned by MSS. ***********-***********

3 2

Subtree renames and memberOf handling
by Andrew Bartlett 16 Jan '08

16 Jan '08

I perhaps should have flagged this earlier, but I wanted to actually have the test to prove it. It appears that subtree renames and the memberOf plugin are not handled correctly. That is: I create cn=ldaptestuser4,cn=ldaptestcontainer,DC=samba,DC=example,DC=com I add it to a group: dn: cn=ldaptestgroup2,cn=users,DC=samba,DC=example,DC=com changetype: modify add: member member: cn=ldaptestuser4,cn=ldaptestcontainer,DC=samba,DC=example,DC=com Then I rename the container CN=ldaptestcontainer,DC=samba,DC=example,DC=com into CN=ldaptestcontainer2,DC=samba,DC=example,DC=com However, when I search: [abartlet@naomi source]$ bin/ldbsearch -H st/dc/private/sam.ldb "cn=ldaptestgroup2" # record 1 dn: CN=ldaptestgroup2,CN=Users,DC=samba,DC=example,DC=com member: cn=ldaptestuser,cn=useRs,dc=samba,dc=example,dc=com member: cn=ldaptestcomputer,cn=computers,dc=samba,dc=example,dc=com member: cn=ldaptestuser2,cn=users,dc=samba,dc=example,dc=com member: cn=ldaptestuser4,cn=ldaptestcontainer,dc=samba,dc=example,dc=com [abartlet@naomi source]$ bin/ldbsearch -H st/dc/private/sam.ldb "cn=ldaptestuser4" # record 1 dn: CN=ldaptestuser4,CN=ldaptestcontainer2,DC=samba,DC=example,DC=com cn: ldaptestuser4 memberOf: cn=ldaptestgroup2,cn=users,dc=samba,dc=example,dc=com The 'member' attribute on the group is wrong, most likely because such a subtree rename would never cause the memberOf module to fire and notice that this needs updating. Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

3 14

memberOf hidden?
by Andrew Bartlett 16 Jan '08

16 Jan '08

One of the odd things I've noticed since moving to OpenLDAP managing memberOf is that memberOf is a hidden attribute by default. Is that because it is treated as operational (due to being managed by the module)? I can un-hide it for Samba (I have code that adds a list of attributes to any query for *), but I just wanted to check there wasn't a more elegant way to do it. Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

4 19

LDAP and oracle
by florian.engelmann＠bt.com 16 Jan '08

16 Jan '08

Hi, We just migrated our unix/linux accounts to LDAP. We decided to migrate every user account that can login (except root) to LDAP. Now we have heavy load on our LDAP systems and I think this is because we also migrated the oracle users that are running our oracle databases. This is because the oracle admins log on the systems using the user the database is running with. I do not know that much about oracle but is it mandatory to administrate an oracle database with the same user? Does it make sense to migrate systemusers to ldap? Florian Engelmann

2 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical January 2008