openldap-technical April 2008

openldap-technical@openldap.org

56 participants
87 discussions

some help required LDAP - GSSAPI issue.
by Austin Cherian 08 Apr '08

08 Apr '08

Hi, I hope some one can answer this query regarding LDAP and GSSAPI as i really dint find substantial info for this on the net for what i was trying to accomplish. I have some limitations on using OpenLDAP with Cyrus SASL and hence have to manufacture my own GSSAPI client to use with LDAP. However i have run into some technical issues here with my implementation and MS AD. Here's my problem in short: I am using the kerberos mechanism with GSSAPI, i first use kerberos API's to get a TGT for SPN that i have obtained a keytab for previously. I then use GSSAPI gss_init_sec_context to obtain a service ticket for the ldap server. I then call ldap_init and then subsequently call ldap_sasl_bind_s with mech as GSS-SPNEGO and supplying the GSSAPI token ( obtained from gss_init_sec_context ) as credential ( i set the DN in the ldap_sasl_bind_s to NULL ). >From the network traces and the return code i see that the bind was successful. The bind result shows success (0x00) and negTokenTarg shows negResult as accept-completed. This shows that Bind was indeed a success also to note here the krb-blob that comes with the bind result is successfully consumed by subsequent calls to gss_init_sec_context to complete context establishment. The issue that im facing now is that when i pass GSS wraped search request ( i.e. i build a search request and pass it to gss_wrap API to get a token ) token to the ldap_search_ext api. From the network traces i see that the search request has been received by the ldap server properly. However the LDAP server ( MS AD LDAP server ) responds with the following message : LdapErr: DSID-0C09062.27 comment: In order to perform this operation a successful bind must be completed on the connection. Can some one please throw some light on as to why the search query is getting back with an error that there was no bind done in spite of the server responding success for the LDAP bind prior to sending the search request ?? Any help will be greatly appreciated... Thanks, Austin.

1 0

First question...
by Daniel Padula 08 Apr '08

08 Apr '08

Hi! I am Daniel from argentina, I have an strange problem that, after been looking for it, I am really lost. I have made an objectClass in open ldap 2.4.7-6.1 and it works perfectly, but when I implemented in an open ldap 2.3.27-1. it did't work. It fails with the message, ldap_add: Invalid syntax (21) additional info: objectClass: value #0 invalid per syntax. Are there any main difference in schema 's structure between those ldap versions? Where could be the problem? attributetype ( 1.3.6.1.4.1.4203.666.1.124 NAME 'dynastyName' DESC ' Nombre dynasty.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) attributetype ( 1.3.6.1.4.1.4203.666.1.125 NAME 'vars' DESC ' Valores obtenidos de dynasty.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) objectclass (1.3.6.1.4.1.4203.666.1.54775 NAME 'jxfsDevice' SUP top STRUCTURAL DESC 'Estructura de un dispositivo jxfs' MAY ( cn $ vars $ dynastyName)) Thanks in advance! -- Daniel Padula. MSN, Gtalk, Jabber: daniel.padula(a)gmail.com

2 2

mail distribution list problem
by Aniruddha Karanjkar 07 Apr '08

07 Apr '08

Hi I have configured ldap on fedora 8 for contact list. It is working absolutely fine. Only thing is I am not able to create mail distribution list, which can be browsed in OL OE or TB. Please HELP.

1 0

error while accessing through Java "javax.naming.AuthenticationNotSupportedException: simple"
by Sai 07 Apr '08

07 Apr '08

Hi I am new to openLDAP. I am configuring it (version: OpenLDAP: slapd 2.3.27) on a Linux machine to use with our Web Application (java). When I try and make a connection I am getting the following error. =============== javax.naming.AuthenticationNotSupportedException: simple [4/7/08 10:42:01:887 EDT] 00000026 SystemErr R at com.sun.jndi.ldap.sasl.LdapSasl.saslBind(LdapSasl.java:115) =============== These are the code / attributes I used. ================= Hashtable env = new Hashtable(); env.put( Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory" ); env.put( Context.PROVIDER_URL, "ldap://<machine name>:<port>" ); env.put( Context.SECURITY_PRINCIPAL, "cn=uimadmin,ou=UIM,o=nhes,dc=nh,dc=gov" ); env.put( Context.SECURITY_AUTHENTICATION, "simple" ); env.put( Context.SECURITY_CREDENTIALS, "<password in plaintext>" ); try { context = new InitialDirContext(env); System.out.println("CONTEXT OPENED WITH ADMIN ACCOUNT"); } catch (NamingException ne) { ne.printStackTrace(); LogManager.logMessage("LDAPManager.getAdminJndiContext()", ne); } return context; ================= When I try and do an ldapsearch with a -x option (simple authentication) on the command line, it is returning results successfully. I am also able to connect using ldapbrowser v2.8.2 and see the results. Any help regarding this is greatly appreciated. Thanks in advance. -Bangaru.

1 0

Questions about Active Directory Password Cache overlay
by Wes Modes 07 Apr '08

07 Apr '08

Thanks to Buchan Milne, I'm looking into the Active Directory Password Cache overlay for OpenLDAP, which seems to offer more or less what I'm trying to do. Is anyone here experienced with it? Is this the right place to ask or is there an openLDAP overlays list? I understand this description of ADPC: Active Directory Password Cache =============================== Active Directory does not provide any means to read user credentials on any public API. It is possible, to install additional libraries as password sniffer to catch and forward cleartext passwords on changes. In case you cannot or simply dont want to install such libraries, the Active Directory Password Cache overlay is your option. The Active Directory Password Cache overlay allows to mirror user account credentials without any modification on the AD server. It only takes one occasional simple bind authentication against the OpenLDAP server. If the credential has not been mirrored yet, the overlay uses the krbPrincipalName and the password provided by the user to perform a Kerberos init against the Active Directory. A successful Kerberos init guarantees a correct password for this principal, and therefor the bind finally succeeds. Within this overlay operation, the password gets encrypted with the default OpenLDAP hash alorithm and stored as userPassword attribute. There is an option to update the sambaNTPassword also (using code borrowed from Howard Chu's smbk5pwd overlay). All following simple bind authentications will first try these cached credentials, making the OpenLDAP server independent from AD. In case the user changes its password on the Active Directory server, the old password stays valid in OpenLDAP until the user first presents the new password for an simple bind. Within this bind operation, the overlay performs another Kerberos init and updates the cached credentials in OpenLDAP. It is clear to me that after a password change, that a failure to authenticate initiates a new auth attempt against the KDC, and if it succeeds, ADPC caches the passwd as a hash in OpenLDAP. But if Samba fails to authenticate against the hash stored in sambaNTPassword, is a new authentication attempt made against the KDC? And if it does, where does it get the passwd to hash (since Samba never gets the passwd in NTLM authentication)? Practically speaking, it seems that the password that the overlay hashes has to come from a source other than Samba. A web app? How have people used it in the past? W. -- Wes Modes Server Administrator & Programmer Analyst McHenry Library Computing & Network Services Information and Technology Services 459-5208

2 1

RE: openLDAP controls‏
by Quanah Gibson-Mount 06 Apr '08

06 Apr '08

--On Saturday, April 05, 2008 9:23 PM -0700 Gene Kupfer <kupferg(a)msn.com> wrote: > I'm using Jumpbox beta which uses the latest OpenLDAP release I believe. > My application is a software streaming app on which I can configure > provisioning to users or groups. However, I am not able to list users in > my openLDAP server so I am not able to configure what apps they have > access to. These controls I referenced are required by my app to return a > list of user accounts. Keep your replies to the list if you want responses. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

4 5

openLDAP controls‏
by Gene Kupfer 05 Apr '08

05 Apr '08

Hello, I’m trying to figure out how to enable some controls, but can’t find a single thing online that references this topic. The controls are defined in the ldap.h file (please see below), but when I query my directory for supported controls it does not show them in the list. #define LDAP_CONTROL_SORTREQUEST "1.2.840.113556.1.4.473" #define LDAP_CONTROL_SORTRESPONSE "1.2.840.113556.1.4.474" #define LDAP_CONTROL_VLVREQUEST "2.16.840.1.113730.3.4.9" #define LDAP_CONTROL_VLVRESPONSE "2.16.840.1.113730.3.4.10" I’m trying to connect an application that lists these controls as CRITICAL and fails to show the LDAP users and groups. Thank you very much for your help. Gene

3 2

Samba authentication to Kerberos via OpenLDAP, third and last try
by Wes Modes 04 Apr '08

04 Apr '08

So far answers I've received about this have been inconsistent at best and downright inaccurate at worst. I'm going to try one more time and see if, at the very least, someone can give me a lead. I ask you to consider what I'm asking remotely possible, and then seek a solution. (Particularly before one blasts off an ill-thought out message that says simple, "Can't be done," simple because you've never done it or haven't heard of it being done.) So consider this a challenge or a riddle. 1. I have an OpenLDAP directory server that I am using for user and group information. I would like to use it also to authenticate against. This way, whatever I hook up to it (Samba, webstuff, PHP apps, CMS) can both authenticate and authorize from one source. 2. There is a separate Kerberos server that has users' campus-wide passwords. I have access to it, but do not control it. 3. I have a separate linux file server running Samba. PCs and Macs will connect to it. I know I can do Kerberos authentication directly from Samba, but I'd prefer OpenLDAP do the Kerberos connection. Here's why: a) I can solve the problem once, rather than have to work out BOTH LDAP and Kerberos connections for every new authenticated service I add, and b) LDAP hooks are more common than Kerberos hooks for other services for which I will eventually want authentication and authroization. And yes, I know it breaks the Kerberos model. The question and the challenge: Any leads on how I might convince Samba to pass the input password on to OpenLDAP so that OpenLDAP can authenticate it against Kerberos? Wes -- Wes Modes Server Administrator & Programmer Analyst McHenry Library Computing & Network Services Information and Technology Services 459-5208

4 6

Migration to 2.4.8 version
by uri_gr1＠tut.by 04 Apr '08

04 Apr '08

Hi, people! I'm atemptting to migrate to openldap-2.4.8(I realy need mirrormode replication). But some problems appear, first of all, number of ldap editors(gq, luma, JXplorer) can't add new entries into ldap tree, actually only phpldapadmin can do than; second, can't setup pam_ldap/nss_ldap to authenticate via openldap-2.4.8. Last one really makes new openldap version completely unusable. Is any way to solve this problems?

2 3

Need help to export ldap user home directory "/home/ldapuser" to client LDAP
by ashwani singh 04 Apr '08

04 Apr '08

Sorry correction in previews steps : Hi, I have created LDAP user "ldapuser" and exported its home directory "/home/LDAP/ldapuser" to LDAP client by following steps and its working but when I replace /home/LDAP/ with /home/testdir/ or only /home it is not allowing to modify  database. How can I export the user home directory from same location /home on client with "/home/ldapuser"? Please help me. [root@sc1435-7 home]# ldapmodify -x -D "cn=Manager,dc=ldapserver,dc=com" -W -f /etc/openldap/automount.ldif Enter LDAP Password: modifying entry "ou=auto.master,dc=ldapserver,dc=com" modifying entry "ou=auto.home,dc=ldapserver,dc=com" modifying entry "cn=/home, ou=auto.master,dc=ldapserver,dc=com" modifying entry "cn=testdir,ou=auto.home,dc=ldapserver,dc=com" ldap_modify: No such object (32)        matched DN: ou=auto.home,dc=ldapserver,dc=com Working Steps with "/home/LDAP/" Step 1. #mkdir /home/LDAP cp -dpR  /home/ldapuser /home/LDAP/Step 2. Modify data base for "ldapuser" home directory :(as bellow) Create ldif file for auto mount of home directory:(as bellow) Step 3. Edit /etc/exports for shard directory [root@sc1435-7 home]# cat /etc/exports /home/LDAP                  *(rw,sync) # /usr/sbin/exportfs -a Step 4. Add changes in LDAP data base : ldapmodify -x -D "cn=Manager,dc=ldapserver,dc=com" -W -f /etc/openldap/ldapuser.ldif ldapadd -x -D "cn=Manager,dc=ldapserver,dc=com" -W -f /etc/openldap/automount.ldif Modify data base for "ldapuser" home directory : # cat /etc/openldap/ldapuser.ldif dn: uid=ldapuser,ou=People,dc=ldapserver,dc=com uid: ldapuser cn: ldapuser objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {crypt}$1$lxxxxxxxxxxxxxxxxxxxxxx. shadowLastChange: 13968 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 500 gidNumber: 100 homeDirectory: /home/LDAP/ldapuser Create ldif file for auto mount of home directory: # cat /etc/openldap/automount.ldif dn: ou=auto.master,dc=ldapserver,dc=com objectClass: top objectClass: automountMap ou: auto.master dn: ou=auto.home,dc=ldapserver,dc=com objectClass: top objectClass: automountMap ou: auto.home dn: cn=/home, ou=auto.master,dc=ldapserver,dc=com objectClass: automount automountInformation: ldap:ou=auto.home,dc=ldapserver,dc=com --timeout 60 cn: /home dn: cn=LDAP,ou=auto.home,dc=ldapserver,dc=com objectClass: automount automountInformation: -rw,hard,intr sc1435-7:/home/LDAP cn: LDAP Thanks and regards, Ashwani

2 1

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical April 2008