openldap-technical August 2008

openldap-technical@openldap.org

63 participants
81 discussions

Changing the structural objectclass within the same hierarchy
by Vincent Panel 29 Aug '08

29 Aug '08

On Wed, Jul 30, 2008 at 4:55 PM, Vincent Panel <yohonet(a)gmail.com> wrote: > Hi, > > It seems that openldap didn't allow changing the structural > objectclass of an object, even if both classes are in the same > "branch", back in 2006 : > http://www.openldap.org/lists/openldap-software/200602/msg00459.html > > I now have a similar problem : is it still planned to be solved ? > > Specififaclly, my object is from class "inetOrgPerson" and I want to > change it to "myClass" which SUP is inetOrgPerson. > > Thanks, > > Vincent > About this problem, I've seen this FAQ entry : http://www.openldap.org/faq/data/cache/1341.html Quote : "In 2.4, support for a new control will (hopefully) be introduced to allow the (authorized) user to request this (and various other model restrictions) be temporarily relaxed." Has this really been introduced ? Actually, I'm using openldap 2.3, but it's definitely an argument for me to upgrade to 2.4... In particular, am I allowed to change the object class from "fruit" to "pear" (I refer the FAQ) ?

1 0

LDAP + PAM, authentication of users in certain group
by Peter V 29 Aug '08

29 Aug '08

Hi, I have got users and groups in LDAP and I use it for authentication from several servers. I need users to be able to log into the servers only if they are in "admin" group. I use pam_ldap.so module for the authentication. I added these lines into /etc/pam_ldap.conf pam_groupdn cn=admins,ou=Groups,dc=domain,dc=com pam_member_attribute memberUid And the following line into /etc/pam.d/ssh: account required pam_ldap.so Basically, this works alright, BUT I have got root account in local databse /etc/passwd and I need root to be able to log in even if he is not in the "admin" group and also if the LDAP server is off. This does not work, because with this setting, the PAM module requires also root to be in the "admin" group and when the LDAP server is off, there is no admin group. Does anyone know how to set this up? Thanks, Peter

2 1

Create EntryDN
by LITLE TUX 29 Aug '08

29 Aug '08

Hi all ..... Would Like know as create entry DN in my ldap server???? Thanks

1 0

Problem allow bind_v3
by LITLE TUX 29 Aug '08

29 Aug '08

Hi list.... would like know to lieve version OpenLdap in can use option "allow bind_v3" ? Thanks!

1 0

OpenLDAP Client + IBM Directory Server + TLS
by Klaus Heinrich Kiwi 29 Aug '08

29 Aug '08

Hi, has anyone ever managed to set-up an TLS connection between an OpenLDAP client and an IBM LDAP Server (more specifically, ITDS 6.1, linux platform)? I can submit queries in the standard way, but using TLS seems to be a bit of a problem. I have the server certificate specified as TLS_CACERT in my client config since it's self-signed. The query result goes like this: ------ klausk@klausk:~/sandbox/Kerberos_work$ ldapsearch -D cn=root -W -H ldap://fqdn -s sub -x -ZZ -d 9 objectclass=* ldap_url_parse_ext(ldap://fqdn) ldap_create ldap_url_parse_ext(ldap://fqdn:389/??base) ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP fqdn:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 2.2.2.222:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush2: 31 bytes to sd 3 ldap_result ld 0x8059240 msgid 1 wait4msg ld 0x8059240 msgid 1 (infinite timeout) wait4msg continue ld 0x8059240 msgid 1 all 1 ** ld 0x8059240 Connections: * host: fqdn port: 389 (default) refcnt: 2 status: Connected last used: Thu Aug 28 13:43:57 2008 ** ld 0x8059240 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x8059240 request count 1 (abandoned 0) ** ld 0x8059240 Response Queue: Empty ld 0x8059240 response count 0 ldap_chkResponseList ld 0x8059240 msgid 1 all 1 ldap_chkResponseList returns ld 0x8059240 NULL ldap_int_select read1msg: ld 0x8059240 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 38 contents: read1msg: ld 0x8059240 msgid 1 message type extended-result ber_scanf fmt ({eAA) ber: read1msg: ld 0x8059240 0 new referrals read1msg: mark request completed, ld 0x8059240 msgid 1 request done: ld 0x8059240 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ber_scanf fmt ({eAA) ber: ber_scanf fmt (a) ber: ber_scanf fmt (O) ber: ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (x) ber: ber_scanf fmt (x) ber: ber_scanf fmt (}) ber: ldap_msgfree TLS: can't connect: Decryption has failed.. ldap_err2string ldap_start_tls: Connect error (-11) klausk@klausk:~/sandbox/Kerberos_work$ ------ Note: the server is configured to accept TLS in the standard port (389), after a START_TLS extended LDAP operation. It works fine using the IBM Client. After sniffing the packets I could see that the OpenLDAP Client sends a "Client Hello" message advertising TLS 1.1 support (0x0302), whereas the IBM Client asks for TLS 1.0 (0x0301). In both cases the server replies with a TLS 1.0 "Server Hello" message, with the certificate and TLS_RSA_WITH_AES_128_CBC_SHA (0x002f) Cipher Suite. The following client messages are TLS 1.0, indicating that the OpenLDAP correctly fell back the version. But with the OpenLDAP Client, after Change Cipher Spec and Encrypted Handshake, the server sends an "Encrypted Alert" message and the connection is dropped, with the output above. I'm using a certificate generated using GSKIT in the server box, and exported the .PEM key, which OpenSSL appears to recognize fine. Is there anything more I can do to debug this error? I'm particularly interested in further debugging the TLS connection. Maybe there is an environment variable that will enable debugging output from OpenSSL? Any pointers are helpful. Thanks, -Klaus K. -- Klaus Heinrich Kiwi <klausk(a)linux.vnet.ibm.com> Linux Security Development, IBM Linux Technology Center

1 0

OpenLdap + Postfix
by LITLE TUX 29 Aug '08

29 Aug '08

Hello list.... look to me another .... after resolve problem witch ldap and squid ... i have a new problem.... now with POSTFIX Scenaries: server 01: openLdap + SambaPDC server 02: postfix + squi I trying make integration between systems OPEN LDAP and POSTFIX but all time that configure the server 02 to authentication in server 01 receving bellow error: Aug 29 08:30:19 gheorghe slapd[7485]: => bdb_search Aug 29 08:30:19 gheorghe slapd[7485]: bdb_dn2entry("ou=dns,dc=meudominio,dc=com,dc=br") Aug 29 08:30:19 gheorghe slapd[7485]: => send_search_entry: conn 31 dn="ou=DNS,dc=meudominio,dc=com,dc=br" Aug 29 08:30:19 gheorghe slapd[7485]: <= send_search_entry: conn 31 exit. Aug 29 08:30:19 gheorghe slapd[7485]: send_ldap_result: conn=31 op=7 p=3 Aug 29 08:30:19 gheorghe slapd[7485]: send_ldap_response: msgid=8 tag=101 err=0 Aug 29 08:30:19 gheorghe slapd[7485]: connection_get(31): got connid=31 Aug 29 08:30:19 gheorghe slapd[7485]: connection_read(31): checking for input on id=31 Aug 29 08:30:19 gheorghe slapd[7485]: do_search Aug 29 08:30:19 gheorghe slapd[7485]: >>> dnPrettyNormal: <zoneName= meudominio.com.br,ou=DNS,dc=meudominio,dc=com,dc=br> Aug 29 08:30:19 gheorghe slapd[7485]: <<< dnPrettyNormal: <zoneName= meudominio.com.br,ou=DNS,dc=meudominio,dc=com,dc=br>, <zoneName= meudominio.com.br,ou=dns,dc=meudominio,dc=com,dc=br> Aug 29 08:30:19 gheorghe slapd[7485]: => bdb_search Aug 29 08:30:19 gheorghe slapd[7485]: bdb_dn2entry("zoneName= meudominio.com.br,ou=dns,dc=meudominio,dc=com,dc=br") Aug 29 08:30:19 gheorghe slapd[7485]: => bdb_dn2id("zoneName= meudominio.com.br.br,ou=dns,dc=meudominio,dc=com,dc=br") Aug 29 08:30:19 gheorghe slapd[7485]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) Aug 29 08:30:19 gheorghe slapd[7485]: send_ldap_result: conn=31 op=8 p=3 Aug 29 08:30:19 gheorghe slapd[7485]: send_ldap_response: msgid=9 tag=101 err=32 Aug 29 08:30:19 gheorghe slapd[7485]: connection_get(31): got connid=31 Aug 29 08:30:19 gheorghe slapd[7485]: connection_read(31): checking for input on id=31 Aug 29 08:30:19 gheorghe slapd[7485]: do_add Aug 29 08:30:19 gheorghe slapd[7485]: >>> dnPrettyNormal: <zoneName= meudominio.com.br,ou=DNS,dc=meudominio,dc=com,dc=br> Aug 29 08:30:19 gheorghe slapd[7485]: <<< dnPrettyNormal: <zoneName= meudominio.com.br,ou=DNS,dc=meudominio,dc=com,dc=br>, <zoneName= meudominio.com.br,ou=dns,dc=meudominio,dc=com,dc=br> Aug 29 08:30:19 gheorghe slapd[7485]: send_ldap_result: conn=31 op=9 p=3 Aug 29 08:30:19 gheorghe slapd[7485]: send_ldap_response: msgid=10 tag=105 err=21 I tray all... our almost all ... rs ...but i don't resolver error..... Thanks for any help to me resolve this problem.

1 0

SSHD doesn't start
by Jordi Espasa Clofent 29 Aug '08

29 Aug '08

Hi all, I'm just learning about wonderful OpenLDAP. I want to build a AAAA server (with OpenLDAP, of course) that allows SSH. At present I've the next testing scenario: * OpenLDAP server (FreeBSD 7.0) * OpenLDAP client (FreeBSD 7.0 also) When server it's running, I can always perform ssh logins on client. Perfect. The problem is when I shutdown the server and after I reboot the client, the client systems completely hangs up when it tries to run up the sshd service. ?¿?¿?¿? If I restart the server, the client runs fine again. I'm not understand the real reason of that behavior, but one thing is clear: SSH deamon requires OpenLDAP server runs. So I thing the problem is focused probably in pam.d module conf. Useful info: ldapclient# more /etc/pam.d/sshd # # $FreeBSD: src/etc/pam.d/sshd,v 1.16 2007/06/10 18:57:20 yar Exp $ # # PAM configuration for the "sshd" service # # auth auth sufficient pam_opie.so no_warn no_fake_prompts #auth requisite pam_opieaccess.so no_warn allow_local #auth sufficient pam_krb5.so no_warn try_first_pass auth sufficient /usr/local/lib/pam_ldap.so no_warn try_first_pass auth sufficient pam_ssh.so no_warn try_first_pass auth required pam_unix.so no_warn try_first_pass # account account required pam_nologin.so #account required pam_krb5.so account required pam_login_access.so account sufficient /usr/local/lib/pam_ldap.so account required pam_unix.so # session #session optional pam_ssh.so session required /usr/local/lib/pam_mkhomedir.so debug #session required pam_permit.so # password #password sufficient pam_krb5.so no_warn try_first_pass password sufficient /usr/local/lib/pam_ldap.so use_authok password required pam_unix.so no_warn try_first_pass ldapclient# more /etc/nsswitch.conf # # nsswitch.conf(5) - name service switch configuration file # $FreeBSD: src/etc/nsswitch.conf,v 1.1 2006/05/03 15:14:47 ume Exp $ # group: ldap files passwd: ldap files #group: compat #group_compat: nis hosts: files dns #networks: files #passwd: compat #passwd_compat: nis shells: files #services: compat #services_compat: nis protocols: files rpc: files -- Thanks, Jordi Espasa Clofent

1 0

ldap query on imail
by Li Wen Bin 28 Aug '08

28 Aug '08

Hi all, We have a mail server known as imail which is a product of Ipswitch. It is using openldap database. We are now in the process of creating a web application for our office users which will authenticate using the openldap database in imail server. Below is the code that my programmer is trying to query to imail. However we got the error "The specified domain either does not exist or could not be contacted". Is the code below "LDAP://o=smtp2.mentormedia.com.sg" correct? Pls advise. Thks in advance. //****Connecting to LDAP active directory domainAndUsername = "LDAP://o=smtp2.mentormedia.com.sg"; userName = "USER1"; passWord = "testpass"; at= AuthenticationTypes.ReadonlyServer; //Create the object necessary to read the info from the LDAP directory DirectoryEntry entry = new DirectoryEntry(domainAndUsername,userName,passWord,at);

1 0

AW: Re: [SOLVED] Re: SLAPD 2.4.9 and OpenSSL 0.9.8g on Ubuntu 8.04 server - client certificate not read
by Hauke Coltzau 28 Aug '08

28 Aug '08

Hi again, man, I mixed up a lot of things ... Hope, I finally understand what I did wrong: Ubuntu 8.04 creates a huge /etc/ldap.conf as a substitute for libnss_ldap.conf and libpam_ldap.conf. I misunderstood this file to be the LDAP client configuration, which it is obviously not. Instead, it's the configuration for libnss-ldap and libpam-ldap. In some wiki article, I read that it would be o.k. to softlink /etc/ldap/ldap.conf to /etc/ldap.conf to have a fewer number of configuration files. I did that and forgot to mention in my first mail. That's why I used keywords like tls_cacertfile and others, because that's just the way those parameters are called in that file. I hope to be smarter next time ;-) So, what I did now: I created a new /etc/ldap/ldap.conf with only a few entries: ===== /etc/ldap/ldap.conf ===== BASE dc=... URI ldaps://<fqdn>/ TLS_REQCERT yes TLS_CACERT /usr/lib/ssl/cacerts/<ca>.chain.crt === END /etc/ldap/ldap.conf === after that, ldapsearch -x was successful. Then I re-installed libnss/libpam-ldap and set the neccessary nss/pam values in the auto-generated /etc/ldap.conf. Finally, I adapted common-* in /etc/pam.d/ and getent passwd, id <user> and su worked the way I wanted them to. I still have a problem with TLSVerifyClient demand, but that's something for another thread and only after some more reading and testing ;-) Thanks again for your help, I learned a lot :-) Best regards, Hauke ----- Ursprüngliche Mail ----- Von: "Buchan Milne" <bgmilne(a)staff.telkomsa.net> An: openldap-technical(a)openldap.org CC: hyc(a)symas.com, "Hauke Coltzau" <hauke.coltzau(a)FernUni-Hagen.de> Gesendet: Donnerstag, 28. August 2008 13:31:58 GMT +01:00 Amsterdam/Berlin/Bern/Rom/Stockholm/Wien Betreff: Re: [SOLVED] Re: SLAPD 2.4.9 and OpenSSL 0.9.8g on Ubuntu 8.04 server - client certificate not read On Thursday 28 August 2008 12:28:25 Hauke Coltzau wrote: > Hi everybody, > > thank you all for your immediate replies. > > As you correctly pointed out, the options I used were wrong. > With following ldap.conf, everything works out fine. > > base dc=... > URI ldaps://<fqdn of ldap server>/ > ldap_version 3 > rootbinddn cn=... > bind_policy soft > pam_password md5 > > TLS_REQCERT yes > TLS_CACERT /usr/lib/ssl/certs/<ca>.chain.crt > > The ldap.conf I used before has been created by dpkg-reconfigure > and I simply changed the default values there. That was a mistake ;-) > Creating a new ldap.conf from scratch with a man-page at hand > obviously did the trick. You still seem to be confused between different ldap.conf files, bind_policy, pam_password etc. are not valid in the OpenLDAP ldap.conf file, most likely one belongs in /etc/libnss_ldap.conf and the the other in /etc/libpam_ldap.conf (on Debian-based systems, or /etc/ldap.conf on distros that use the default config file location for nss_ldap/pam_ldap as shipped upstream). While you may have a working configuration, it may be more by luck than good judgement. Regards, Buchan -- ------------------------------------ Fernuniversität in Hagen Lehrgebiet Kommunikationsnetze http://www.fernuni-hagen.de/kn Fon/Fax: +49 2331 987 -1142 / -353 ------------------------------------

1 0

Re: ldap_bind: Can't contact LDAP server (-1)
by Michael Ströder 28 Aug '08

28 Aug '08

Kristen, please stay on the mailing list you started the thread. Don't e-mail me solely personally. Kristen Walker wrote: > Thanks for your help. I can't seem to be able to start the server with the > -d flag. Here is what I tried: > > su root -c /usr/local/libexec/slapd -d 65535 > > I also tried: > > su root -d 65535 -c /usr/local/libexec/slapd > > And it complains in both cases that -d is an invalid option. Using -d works for me. Which version of OpenLDAP is this? Can you post any output it produces? Ciao, Michael.

4 6

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical August 2008