openldap-technical February 2009

openldap-technical@openldap.org

63 participants
67 discussions

Re: Forgotten password recovery
by Vincent Panel 04 Feb '09

04 Feb '09

Thanks, but as discussed, even creating a user able to reset all the userPassword attributes of all other users is not security risk free. This is what I call a privileged user and I would like to avoid it. Drupal already supports such a solution, but I don't find it secure enough. I had an interesting suggestion on the list : to create a database of temporary security objects where drupal is the only one who knows the passwords. Each temporary security object is able to reset one password in the main database (by the use of regex ACLs) and only once. On 2/4/09, Brett Maxfield <brett.maxfield(a)gmail.com> wrote: > If we are talking about openldap, not drupal, there are probably many ways > of doing so.. My thoughts.. > > You cannot bind as the user in this case, as presumably the reason they want > to reset password is that they dont know it. > > You should probably give the website it's own standard read-only user, which > has been (only) allowed to update userPassword. > > Giving the website manager/root access just to change a password would be > extremely unwise and inasvisable. > > Drupal should let you specify any ldap user for password resers.. > > -----Original Message----- > From: Vincent Panel <yohonet(a)gmail.com> > Sent: Wednesday, 4 February 2009 2:16 AM > To: openldap-technical(a)openldap.org > Subject: Forgotten password recovery > > Hello, > > Many websites now provide a feature which allow users to reset their > password on their own, without being helped by an administrator or > another privileged person. > > A website I'm working on is using drupal which is able to handle such > a situation by sending a mail to the user. The body of this mail > contains a specific url crafted by drupal so that when the user clicks > on the link, drupal can automatically authenticate the user. This URL > is only valid once. > > If you try to integrate drupal with openldap, you'll find that > openldap does not support such an authentication scheme. So you are > either forced to create a privileged user in LDAP which is able to > reset all users' passwords or live with it and give up this feature. > > So I'm writing to this list to know if anyone already had a similar > issue and which solution was found ? Would it be possible for openldap > or an openldap overlay to implement such an authentication mechanism ? > Is there any IETF draft about it (one can dream) ? > > Vincent > >

2 1

user home directory perms
by Geoffrey 04 Feb '09

04 Feb '09

We are using a combination of ldap and samba, therefore are adding users via the smbldap-useradd script. How do we set the permissions for the home directory when the user logs in for the first time. The directories are being created, but not with the permissions we want. Thanks. -- Until later, Geoffrey Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. - Benjamin Franklin

1 0

Forgotten password recovery
by Vincent Panel 04 Feb '09

04 Feb '09

Hello, Many websites now provide a feature which allow users to reset their password on their own, without being helped by an administrator or another privileged person. A website I'm working on is using drupal which is able to handle such a situation by sending a mail to the user. The body of this mail contains a specific url crafted by drupal so that when the user clicks on the link, drupal can automatically authenticate the user. This URL is only valid once. If you try to integrate drupal with openldap, you'll find that openldap does not support such an authentication scheme. So you are either forced to create a privileged user in LDAP which is able to reset all users' passwords or live with it and give up this feature. So I'm writing to this list to know if anyone already had a similar issue and which solution was found ? Would it be possible for openldap or an openldap overlay to implement such an authentication mechanism ? Is there any IETF draft about it (one can dream) ? Vincent

3 4

best practices - dn:
by Brian Krusic 03 Feb '09

03 Feb '09

Hi all, I've read and config'd my ldifs as follows; option 1; dn: uid=fbar,ou=People,dc=company,dc=com uid: foo sn: Bar mail: foo(a)company.com cn: Foo Bar objectClass: inetOrgPerson objectClass: apple-user objectClass: shadowAccount objectClass: posixAccount objectClass: top uidNumber: 1000 gidNumber: 20 loginShell: /bin/tcsh homeDirectory: /homes/fbar apple-user-homeDirectory: /homes/fbar userPassword:: agbeirrklflhfihverrrknv= option 2; dn: cn=Foo Bar,ou=People,dc=company,dc=com uid: foo sn: Bar mail: foo(a)company.com cn: Foo Bar objectClass: inetOrgPerson objectClass: apple-user objectClass: shadowAccount objectClass: posixAccount objectClass: top uidNumber: 1000 gidNumber: 20 loginShell: /bin/tcsh homeDirectory: /homes/fbar apple-user-homeDirectory: /homes/fbar userPassword:: agbeirrklflhfihverrrknv= My OpenLDAP server is used for company white pages and authentication for Linux, OSX clients. What do you think the most reliable dn value should be; with uid or with cn? - Brian

2 2

multiple groups not showing up in "groups" cmd
by Justin Lintz 03 Feb '09

03 Feb '09

Hi, I've configured a user to be a member of another posixGroup as so... dn: cn=dev2,ou=groups,dc=test,dc=net cn: dev2 gidNumber: 1003 objectClass: posixGroup objectClass: top memberUid: dave The users info: dn: cn=David FooBar,ou=people,dc=test,dc=net givenName: David sn: FooBar cn: David FooBar uid: dave userPassword:: uidNumber: 1009 gidNumber: 1004 homeDirectory: /home/dave loginShell: /bin/bash objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: top If I log into a server with the users account, it shows him properly a member of gid 1004, but does not list his seconday group of dev2. My /etc/ldap.conf file is base dc=test,dc=net binddn cn=Manager,dc=test,dc=net bindpw timelimit 15 bind_timelimit 15 idle_timelimit 3600 nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman pam_filter objectclass=posixaccount pam_member_attribute memberuid nss_base_passwd ou=People,dc=test,dc=net?one nss_base_shadow ou=People,dc=test,dc=net?one nss_base_group ou=Groups,dc=test,dc=net?one uri ldaps://prodldap01/ ldaps://prodldap02/ ssl on tls_cacertdir /etc/openldap/cacerts tls_checkpeer no pam_password md5 I also tried changing the value of memberUid to the DN of the user, but that did not work as well. Any suggestions are appreciated. Thanks - Justin Lintz

2 2

Active Directory & Open LDAP Synchronization
by Paul bob 03 Feb '09

03 Feb '09

Hi - I have installed Active directory authentication for windows servers and users and LDAP for Linux servers, now I am planning to use single sign on system windows and Linux. How can I sync with these two directory? I would appreciate your advice! Thanks, PB

3 2

supportedSASLMechanisms not Work in Debian Lenny
by Jarbas Peixoto Júnior 02 Feb '09

02 Feb '09

I have two servers: * Server A: Debian Etch - Works Fine * Server B: Debian Lenny - Do not Works supportedSASLMechanisms EXTERNAL In Server A I have: # ldapsearch -v -H ldap://server-Etch -b "" -LLL -s base supportedSASLMechanisms -ZZ ldap_initialize( ldap://server-Etch ) SASL/EXTERNAL authentication started SASL username: emailAddress=jarbas.peixoto(a)previdencia.gov.br,CN=jarbas.peixoto,OU=DATAPREV,O=Previdencia Social,L=Campo Grande,ST=Mato Grosso do Sul,C=BR SASL SSF: 0 filter: (objectclass=*) requesting: supportedSASLMechanisms dn: supportedSASLMechanisms: PLAIN supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: LOGIN supportedSASLMechanisms: NTLM supportedSASLMechanisms: CRAM-MD5 supportedSASLMechanisms: EXTERNAL In Server B I have: # ldapsearch -v -H ldap://server-Lenny -b "" -LLL -s base supportedSASLMechanisms -ZZ ldap_initialize( ldap://server-Lenny:389/??base ) ldap_start_tls: Connect error (-11 # ldapsearch -v -H ldap://server-Lenny -b "" -LLL -s base supportedSASLMechanisms -ZZ -d 1 ldap_url_parse_ext(ldap://server-Lenny) ldap_create ldap_url_parse_ext(ldap://server-Lenny:389/??base) ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP server-Lenny:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.82.0.234:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush2: 31 bytes to sd 3 ldap_result ld 0x9d73280 msgid 1 wait4msg ld 0x9d73280 msgid 1 (infinite timeout) wait4msg continue ld 0x9d73280 msgid 1 all 1 ** ld 0x9d73280 Connections: * host: www-mmldap port: 389 (default) refcnt: 2 status: Connected last used: Thu Jan 29 18:17:22 2009 ** ld 0x9d73280 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x9d73280 request count 1 (abandoned 0) ** ld 0x9d73280 Response Queue: Empty ld 0x9d73280 response count 0 ldap_chkResponseList ld 0x9d73280 msgid 1 all 1 ldap_chkResponseList returns ld 0x9d73280 NULL ldap_int_select read1msg: ld 0x9d73280 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 12 contents: read1msg: ld 0x9d73280 msgid 1 message type extended-result ber_scanf fmt ({eAA) ber: read1msg: ld 0x9d73280 0 new referrals read1msg: mark request completed, ld 0x9d73280 msgid 1 request done: ld 0x9d73280 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ber_scanf fmt ({eAA) ber: ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (}) ber: ldap_msgfree ldap_err2string ldap_start_tls: Connect error (-11) In the /var/log/syslog I have: Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 fd=21 ACCEPT from IP=10.82.0.234:50441 (IP=0.0.0.0:389) Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 op=0 STARTTLS Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 op=0 RESULT oid= err=0 text= Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 fd=21 closed (TLS negotiation failure) This is very important for use openldap with user certificates. Anybody have a help for me? Tanks!

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical February 2009