openldap-technical June 2009

openldap-technical@openldap.org

87 participants
100 discussions

Re: ldap not finding internal CA?
by gruntler-ldap＠yahoo.com 18 Jun '09

18 Jun '09

--- On Wed, 6/17/09, Howard Chu <hyc(a)symas.com> wrote: > From: Howard Chu <hyc(a)symas.com> > Subject: Re: ldap not finding internal CA? > To: "Kurt Yoder" <ktyopenldap(a)yoderhome.com> > Cc: openldap-technical(a)openldap.org > Date: Wednesday, June 17, 2009, 8:55 PM > Kurt Yoder wrote: [... skip ...] > > My openldap is version 2.4.15 on Ubuntu Jaunty. [... skip ...] > The GnuTLS issues with X.509v1 certs were fixed in 2.4.16, > so you need to upgrade. Sorry about any confusion but Jaunty doesn't actually have 2.4.15 but a custom version ("2.4.15-1ubuntu3") from Ubuntu: https://launchpad.net/ubuntu/jaunty/amd64/slapd The diff for ITS#5992 is in Jaunty $ cat gnutls-enable-v1-ca-certs ## Mathias Gug <mathiaz-at-ubuntu.com> ## Enable V1 CA certs to be trusted. ## ITS: 5992 - http://www.openldap.org/its/index.cgi?findid=5992 ## LP: https://bugs.launchpad.net/ubuntu/+source/openldap/+bug/305264 ## Fixed in > 2.4.15 ## Patch: http://bazaar.launchpad.net/%7Evcs-imports/openldap/main-src/diff/17238 --- openldap.orig/libraries/libldap/tls_g.c 2009-03-02 02:01:41 +0000 +++ openldap/libraries/libldap/tls_g.c 2009-03-05 03:35:49 +0000 @@ -1,5 +1,5 @@ /* tls_g.c - Handle tls/ssl using GNUTLS. */ -/* $OpenLDAP: pkg/ldap/libraries/libldap/tls_g.c,v 1.6.2.2 2009/02/10 16:41:01 quanah Exp $ */ +/* $OpenLDAP: pkg/ldap/libraries/libldap/tls_g.c,v 1.9 2009/03/05 03:35:49 hyc Exp $ */ /* This work is part of OpenLDAP Software <http://www.openldap.org/>. * * Copyright 2008-2009 The OpenLDAP Foundation. @@ -349,6 +349,13 @@ if ( rc < 0 ) return -1; rc = 0; } + + /* FIXME: ITS#5992 - this should go be configurable, + * and V1 CA certs should be phased out ASAP. + */ + gnutls_certificate_set_verify_flags( ctx->cred, + GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT ); + if ( is_server ) { gnutls_dh_params_init(&ctx->dh_params); gnutls_dh_params_generate2(ctx->dh_params, DH_BITS); However: Jaunty does not appear to contain the diff for ITS#5991. Both ITS#5991 and ITS#5992 are squashed into the same CVS delta for: openldap-*/libraries/libldap/tls_g.c diffs between version 1.6.2.3 and 1.6.2.4 of tls_g.c http://www.openldap.org/devel/cvsweb.cgi/libraries/libldap/tls_g.c.diff?r1=… Mathias Gug writes in ITS#5991: << Thanks for the workaround. It works as expected. I haven't tested the patch applied to CVS and thus haven't included it in Ubuntu yet. >> Link to ITS#5991 - http://www.openldap.org/its/index.cgi/Software%20Bugs?id=5991;selectid=5991… On a related note, Jaunty vs. pre-Jaunty does this: $ gnutls-cli -p 636 XXXX.XXX.XXX -d 4711 --x509cafile /etc/ldap/cacerts/my-ca.cert.pem --print-cert On Jaunty the output contains: - Peer's certificate is NOT trusted On previous Ubuntu releases (Intrepid, Hardy): - Peer's certificate is trusted Same certificate, same command line arguments, same /etc/ldap/ldap.conf file. Thanks, Ken

1 0

LDAP Sync Replication with Active Directory
by mailings＠atlantismedia.de 18 Jun '09

18 Jun '09

Hi, I have a Win 2k3 SBS and I want to replicate the users into my OpenLDAP 2.4.11. When I start slapd, I can see that one entry of a user is being sent, but after that I get the message "got search entry without Sync State control". I had hoped that replication not only works with OpenLDAP as a master, but also with Active Directory. Is it possible to get this to work? Lars

4 5

Cosine schema - RFC 4524
by Zdenek Styblik 18 Jun '09

18 Jun '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, my question is regarding updated Cosine schema [RFC 4524] which has been accepted in March 1991 by IANA. This obsoletes previous Cosine schema [RFC 1274]. OpenLDAP has support for RFC 4524, yet it comes with pre-defined older RFC 1274. So, I'm wondering, is there reason for keep using RFC 1274, or is it safe to define/create new Cosine schema by RFC 4524? Note: I've found ldif file which corresponds with RFC 4524, but no schema file. But I think [believe] it won't be that hard to define schema by published RFC. But, if somebody knows where I can get those files for OpenLDAP, I would be really happy. Thank you for your reply. Regards, Zdenek Styblik - -- Zdenek Styblik Net/Linux admin OS TurnovFree.net email: stybla(a)turnovfree.net jabber: stybla(a)jabber.turnovfree.net -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkoeUiMACgkQ8MreUbSH7ilMtACgwoLkn1KtS/D84yxCRrRfZHHv F9IAnjl8PNOaJ3P6Wm783u9c/J3reit4 =EtIk -----END PGP SIGNATURE-----

2 4

Re: Are hyphens in attribute names supported when using sql backend?
by Grzesiek K 18 Jun '09

18 Jun '09

> > > Thanks for the prompt answer. > > I tried to perform queries in the database using AS 'attr-name' and AS > > "attr-name" - both don't work. > > OK, then you need to figure out a normalization rule that replaces "-" > with an acceptable character, possibly not allowed by LDAP, so that > bidirectional translation is possible. Yes, the other option is to change database because it looks that PostgreSQL DB doesn't support hyphens in aliases nor in table names. Thanks, greg

1 0

Are hyphens in attribute names supported when using sql backend?
by Greg K 18 Jun '09

18 Jun '09

Hi, I use OpenLDAP + PostgreSQL as a sql backend. Just for tests if hyphens are supported I defined object class and attribute having hyphen in the names: Schema: attributetype ( 1.3.6.1.4.1.3814.4.4 NAME ( 'person-type' ) SUP name) objectClass ( 1.3.6.1.4.1.3814.3.5 NAME 'person-oc' DESC 'Test Person' SUP ( inetOrgPerson ) MAY ( person-type) ) insert into ldap_oc_mappings (id,name,keytbl,keycol,create_proc,delete_proc,expect_return) values (4,'person-oc','persons','id',NULL,NULL,0); insert into ldap_attr_mappings (id,oc_map_id,name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return) values (10,4,'person-type','persons.name','persons',NULL,NULL,NULL,3,0); When I search for object having this object class and attribute I get the following in debug from slapd: <= ldap_dn2bv(cn=kori hutton,o=sql,c=ru)=0 Success <<< dnPrettyNormal: <cn=Kori Hutton,o=sql,c=RU>, <cn=kori hutton,o=sql,c=ru> backsql_id2entry(): retrieving all attributes ==>backsql_get_attr_vals(): oc="person-oc" attr="ref" keyval=12478 <==backsql_get_attr_vals() ==>backsql_get_attr_vals(): oc="person-oc" attr="objectClass" keyval=12478 <==backsql_get_attr_vals() ==>backsql_get_attr_vals(): oc="person-oc" attr="person-type" keyval=12478 backsql_get_attr_values(): error executing attribute query "SELECT persons.name AS person-type FROM persons WHERE persons.id=? ORDER BY persons.name" Return code: -1 Native error code: 7 SQL engine state: 42601 Message: ERROR: syntax error at or near "-"; Error while executing the query Looks that hyphen is not allowed in attribute name. Is it any workaround for this to support "-" in attribute names? Thank you, greg

3 3

ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
by mukim pathan 18 Jun '09

18 Jun '09

Hi, I have installed ldap 2.4.16 with bdb 4.5. When I am doing ldapsearch or ldapadd i am getting error "ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)". I tried searching for the answers but it seems none of them applies in this case, like permission to ldap, ldap server running on 389, configuration file is good without any spaces in rootdn and suffix. is there any solution to this?? Regards, Mukim Pathan

4 4

ldap not finding internal CA?
by Kurt Yoder 17 Jun '09

17 Jun '09

Hello all, On Ubuntu, I have set up an LDAP server and am authenticating to it over SSL for my LDAP queries. I had it working on previous Ubuntu releases, but something seems to have changed in the newest release (maybe this: http://www.debian-administration.org/users/dkg/weblog/ 42). I am having trouble figuring out exactly what is breaking. Some background: I have set up my own CA and generated a certificate for it, which the LDAP server is using. Without specifying this CA, I get "self-signed certificate" errors when connecting: root@host:# openssl s_client -connect my.ldap.server:636 -showcerts CONNECTED(00000003) <... trimmed certificate information ...> verify error:num=19:self signed certificate in certificate chain verify return:0 <... trimmed more certificate information ...> If I specify the path to my internal CA file, I receive no errors: root@host:# openssl s_client -connect my.ldap.server:636 -showcerts - CAfile /path/to/my/ca/file CONNECTED(00000003) <... trimmed certificate and internal CA information ...> verify return:1 <... trimmed more certificate information ...> That being said, I manually specified the path to my internal CA file in /etc/ldap/ldap.conf: BASE dc=my, dc=search, dc=base URI ldaps://my.ldap.server TLS_CACERT /path/to/my/ca/file TLS_REQCERT demand TIMEOUT 4 NETWORK_TIMEOUT 2 This still allows no secure ldap queries: root@host:# ldapsearch -x -d1 ldap_create ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP my.ldap.server:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying my.ldap.server.ip:636 ldap_pvt_connect: fd: 3 tm: 2 async: 0 ldap_ndelay_on: 3 ldap_int_poll: fd: 3 tm: 2 ldap_is_sock_ready: 3 ldap_ndelay_off: 3 ldap_pvt_connect: 0 TLS: peer cert untrusted or revoked (0x102) TLS: can't connect: (unknown error code). ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) Just to prove that the above configuration is the one being used, if I switch the above configuration to "TLS_REQCERT allow", the ldap queries bypass this issue: root@myhost:# ldapsearch -x -d1 > /dev/null ldap_create ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP auth01.rdc.internal:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 192.168.1.41:636 ldap_pvt_connect: fd: 3 tm: 2 async: 0 ldap_ndelay_on: 3 ldap_int_poll: fd: 3 tm: 2 ldap_is_sock_ready: 3 ldap_ndelay_off: 3 ldap_pvt_connect: 0 TLS: peer cert untrusted or revoked (0x102) ldap_open_defconn: successful <... trimmed rest of results ...> My openldap is version 2.4.15 on Ubuntu Jaunty. Interestingly, I had the same message about self-signed certificates on previous Ubuntu versions, but querying ldap with "TLS_REQCERT demand" works fine. So what is the solution to this problem? Do I switch to "TLS_REQCERT allow"? Or perhaps there's some way to debug why openldap is not seeing the internal CA file even though I've told it where to look? Thanks for any pointers... -Kurt

3 2

N-way Master synchronization
by Bad Guy 17 Jun '09

17 Jun '09

Dear all, I am using a 4-way LDAP servers version 2.4.11. (type=refreshOnly, interval="00:00:00:30",attrs="*,+") Everyday, there will be some records updated in any of the servers. >From time to time, I will dump the records in all 4 servers and checked the modifyTimestamp attribute. I find that there is some records where the modifyTimestamp attribute value are different from other 3 servers. But the other content seems synced. Only differ by the modifyTimestamp attribute. Any idea of how come such situation occur ? Thanks _________________________________________________________________ 5 GB 超大容量、創新便捷、安全防護垃圾郵件和病毒 — 立即升級 Windows Live Hotmail http://mail.live.com

3 2

Check ppolicy
by Jordi Espasa Clofent 17 Jun '09

17 Jun '09

Hi folks, I use a OpenLDAP as a central accounting servers through the sshd service and I use sudo also. All works like a charm. However I wanto to use SLAPO_PPOLICY(5). Well, I think I've implemented it correctly: xen-ldap01:~# ldapsearch -x -b 'cn=DefaultPassword,ou=Policies,dc=company,dc=com' # extended LDIF # # LDAPv3 # base <cn=DefaultPassword,ou=Policies,dc=company,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # DefaultPassword, Policies, company.com dn: cn=DefaultPassword,ou=Policies,dc=company,dc=com cn: DefaultPassword objectClass: top objectClass: device objectClass: pwdPolicy objectClass: pwdPolicyChecker pwdAttribute: userPassword pwdMinAge: 0 pwdMaxAge: 15552000 pwdExpireWarning: 604800 pwdGraceAuthNLimit: 3 pwdMinLength: 8 pwdMaxFailure: 5 pwdLockout: TRUE pwdInHistory: 5 pwdAllowUserChange: TRUE pwdSafeModify: TRUE # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 The main problem is I don't know how to ckeck it. I mean, when a user connects to a machine (a box which is OpenLDAP client) using sshd, sshd goes to OpenLDAP and query about the user and his password. But I don't see anymore that the classical "Password:" prompt. So ¿how can I check if ppolicy is really working? I want to test it, changing the password for example or blocking a user who type wrong their password for more tant 5 times. I suspect a PAM issue (after all, the sshd service goes to LDAP using PAM modules), but I'm not sure. ¿Any clue? -- Thanks, Jordi Espasa Clofent

2 3

ldap_bind: Invalid credentials (49)
by J. Bakshi 17 Jun '09

17 Jun '09

Hello list, Here is a very typical problem. I have already done some googling but I am more confused now. I like to query a user information with his own id and password. When I do this as cn=Manager the there is no problem ```````````````````````````````````````` ldapsearch -h 127.0.0.1 -b "ou=people,dc=example,dc=com" -x "(&(objectclass=inetOrgPerson)(cn=test2))" uid -D "cn=Manager,dc=example,dc=com" -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <ou=people,dc=example,dc=com> with scope subtree # filter: (&(objectclass=inetOrgPerson)(cn=test2)) # requesting: uid # # test2, people, example.com dn: cn=test2,ou=people,dc=example,dc=com uid: rbilly # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 ``````````````````````````````````````````````````````````````````` Now if I search with the user credential the problem starts `````````````````````````````````````````````````````` ldapsearch -h 127.0.0.1 -b "ou=people,dc=example,dc=com" -x "(&(objectclass=inetOrgPerson)(cn=test2))" uid -D "uid=rbilly,ou=people,dc=example,dc=com" -W Enter LDAP Password: ldap_bind: Invalid credentials (49) ```````````````````````````````````````````````` I have typed the correct password and repeated the above command a no. of times. But the same error. why Invalid credentials ? Any clue please ? Thanks

3 3

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical June 2009