openldap-technical August 2010

openldap-technical@openldap.org

83 participants
85 discussions

OpenLDAP as a proxy for Active Directory (missing attributes)
by Marius Flage 20 Aug '10

20 Aug '10

I've been banging my head against the wall with this project for the last months and still haven't found a decent solution for my problem. I'm trying to set up OpenLDAP to act as a proxy for Active Directory. OpenLDAP should be the internet-facing interface for all external queries for the AD catalog. I've gotten the connection set up and I'm able to retrieve and search for most important values. However, when I try to get out the group membership of the different objects, I've encountered some problems. When doing a search directly towards Active Directory I can see the memberOf attributes for the objects [1], but when I perform the very same search through the proxy, those attributes have been ignored/stripped away from the result [2]. I've tried including schemas for Active Directory found on the internet (like http://www.grotan.com/ldap/microsoft.schema), but if I try to include this in OpenLDAP I get lots and lots of errors and I have to start commenting out different attributes and objecttypes to get OpenLDAP to start. Example of errors are stuff like: /etc/ldap/schema/microsoft2.schema: line 30 objectclass: AttributeType not found: "remoteSource" And then I comment out the objectclass and retry. And this basically goes on and on forever. I've also tried just including the attribute I'm looking for, namely memberOf, like so: attributetype ( 1.2.840.113556.1.2.102 NAME 'memberOf' SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' NO-USER-MODIFICATION ) And then I get the following error when I try to start slapd: /etc/ldap/schema/activedirectory.schema: line 60 attributetype: AttributeType inappropriate USAGE: "memberOf" /etc/ldap/slapd.conf: line 15: <include> handler exited with 1! So my question is basically; how can I get the memberOf attribute included in my searches through OpenLDAP? Do I need to include the schema or am I approaching this from the wrong angle? What needs to be done to set up OpenLDAP as a complete transparent proxy towards Active Directory - basically having it behave as it was the AD itself answering whenever you query the proxy? I'd be very grateful for whatever question or feedback I can get, since this has been bothering me for a very long time now. I've also included my slapd.conf file [3] and the schema [4] I've tried including. - Marius [1] http://pastebin.com/E6GVViGE [2] http://pastebin.com/W28KPSky [3] http://pastebin.com/T5Wd4JEB [4] http://pastebin.com/8AGtnj2Q

2 1

Dynamic posixGroup, dynlist overlay
by Wiktor Warmus 19 Aug '10

19 Aug '10

Hi, I'm trying to use dynlist overlay as dynamic group container. system config: OS: debian lenny slapd: 2.4.11-1 slapd.conf [...] moduleload dynlist overlay dynlist dynlist-attrset groupOfNames labeledURI member When I do a search like: ldapsearch -x cn=ssh_admin I get: # extended LDIF # # LDAPv3 # base <dc=domain,dc=com> (default) with scope subtree # filter: cn=ssh_admin # requesting: ALL # # ssh_admin, Server, domain.com dn: cn=ssh_admin,ou=Server,dc=domain,dc=com objectClass: groupOfNames objectClass: labeledURIObject objectClass: top objectClass: posixGroup cn: ssh_admin member: uid=user1,ou=People,dc=domain,dc=com member: uid=user2,ou=People,dc=domain,dc=com labeledURI:ldap:///ou=People,dc=domain,dc=com??sub?(&(objectClass=posixAccount)) gidNumber: 30000 user1 is added manually, since at least one member attribute is required by groupOfNames (posixGroup is an auxiliary type) And such a request: ldapsearch -x "(member=uid=user1,ou=People,dc=domain,dc=com)" results in: # extended LDIF # # LDAPv3 # base <dc=domain,dc=com> (default) with scope subtree # filter: (member=uid=user1,ou=People,dc=domain,dc=com) # requesting: ALL # # ssh_admin, Server, domain.com dn: cn=ssh_admin,ou=Server,dc=domain,dc=com objectClass: groupOfNames objectClass: labeledURIObject objectClass: top objectClass: posixGroup cn: ssh_admin member: uid=user1,ou=People,dc=domain,dc=com member: uid=user2,ou=People,dc=domain,dc=com labeledURI:ldap:///ou=People,dc=domain,dc=com??sub?(&(objectClass=posixAccount)) gidNumber: 30000 BUT with this one, which is a search done by a linux system when, e.g. doing id user2: ldapsearch -x "(member=uid=user2,ou=People,dc=domain,dc=com)" I get: # extended LDIF # # LDAPv3 # base <dc=domain,dc=com> (default) with scope subtree # filter: (member=uid=user2,ou=People,dc=domain,dc=com) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 My question is: how to make use of dynlist to get it working with a linux system, to automate group assignments. Or is there another way to do it? The goal is to have a dynamic posixGroups generated upon some specified filters, as shown in the example, to manage the authorization to a service (for instance sshd). Thanks for any suggestions and help. -- Wiktor Warmus

1 0

Notification of userPassword change in OpenLDAP?
by Tom Leach 19 Aug '10

19 Aug '10

I'm trying to work on a password sync scheme between OpenLDAP and some systems that use flat Unix passwd/shadow files. I have been able to update the LDAP server when someone changes their password on the standalone Unix systems, but I'm having problems trying to get any kind of notification from the LDAP server if someone from a system using the LDAP directory changes their password. So far, I'm looking at searching the LDAP directory every few minutes for any entries that have had their modifyTimestamp attribute change since the last time the search ran, then checking to see if the userPassword attribute in the LDAP directory is different then the shadow file on the Unix system. This seems like a real stupid scheme, especially when passwords are changed infrequently. I just don't want a long delay between syncing the directory and flat files in case someone changes their password on an LDAP client, then tries to log into the flat file system. Ideally, there could be some option in OpenLDAP that could call an external program when some attribute(s) have changed. That program could then perform the necessary searches and update the flat files if appropriate. So far, I've found nothing indicating that this is possible so I figured I'd ask and see if anyone else has tried this and what they found. Thanks! Tom Leach leach(a)coas.oregonstate.edu

3 2

Unable to start
by VANTASSLE, GEORDON M (ATTSI) 18 Aug '10

18 Aug '10

I finally got everything compiled, and the make test worked like a charm. However, when I try to manually start LDAP via the rc.openldap script, I get: $ ./test.rc.openldap start Starting test.rc.openldap service(s) --------------------------------- Tue-Aug-17-14.23.51-2010 --------------------------------- STATUS: LDAP start attempt logged to /opt/app/ivr/openldap/openldap-2.4.11/var/logs/SystemOut.log STATUS: Waiting for ldap to finish the start sequence STATUS: Waiting for ldap to finish the start sequence STATUS: Waiting for ldap to finish the start sequence STATUS: Waiting for ldap to finish the start sequence STATUS: Waiting for ldap to finish the start sequence STATUS: Waiting for ldap to finish the start sequence ERROR: Unable to successfully start ldap within time limit --------------------------------- Tue-Aug-17-14.24.54-2010 --------------------------------- Is there some way that I can see what is going on with this? I don't know anything about LDAP, but my client requires it for one of their apps, so I would appreciate the help. Thanks, Geordon

3 2

(no subject)
by VANTASSLE, GEORDON M (ATTSI) 18 Aug '10

18 Aug '10

I'm at a loss as to what to do next. I'm running on RHEL 5 and installing as a non-root user. I get the following message when trying to start a fresh install of openLdap: $ ./slapd ./slapd: error while loading shared libraries: libltdl.so.3: cannot open shared object file: No such file or directory $ locate libltdl.so.3 /usr/local/lib/libltdl.so.3 /usr/local/lib/libltdl.so.3.1.4 /usr/share/libtool/libltdl/.libs/libltdl.so.3 /usr/share/libtool/libltdl/.libs/libltdl.so.3.1.4 This is what I used to configure the install: CPPFLAGS="-DOPENLDAP_FD_SETSIZE=8192 -I /opt/app/ivr/openldap/tools /include -I/usr/local/opt/gnu/include -I/usr/include -I/usr/local/lib" \ CFLAGS="-g" \ LDFLAGS="-g -L${TOOLS_HOME}/lib -R /opt/app/ivr/openldap/tools /lib -L/usr/local/opt/gnu/lib -R/usr/local/opt/gnu/lib -I/usr/lib -R/usr/lib" \ LD_RUN_PATH /opt/app/ivr/openldap/tools /lib \ ./configure \ --without-subdir \ --with-tls \ --with-cyrus-sasl \ --enable-spasswd \ --enable-shared \ --enable-dynamic \ --enable-slapd \ --enable-modules \ --enable-rewrite \ --enable-rlookups \ --enable-wrappers \ --enable-backends=mod \ --disable-shell \ --disable-sql \ --enable-overlays=mod \ --disable-slurpd \ --enable-multimaster \ --enable-syslog \ --prefix= /opt/app/ivr/openldap/ openldap-2.4.11 Any suggestions on where I should go from here would be greatly appreciated. Thanks, Geordon

3 3

pwdMustChange and pwdExpireWarning
by Wei Gao 18 Aug '10

18 Aug '10

I have pwdMustChange set to true in my default ppolicy. I tried to change a user's password EITHER as Manager on LDAP server OR via the following command on my LDAP server ldappasswd -x -D "cn=Manager,dc=example,dc=company" -W -S "uid=user1,ou=People,dc=example,dc=company" Since I have pwdMustChange set to true, the user should be required to change his password when he tries to log in next time. But the system doesn't prompt the user to change his password. And when I ran slapcat -a '(uid=user1)', I saw most Operational Attributes except pwdReset. All my settings seem to be correct. I couldn't figure out what is wrong here. One other question I have is: In my default ppolicy, I have pwdExpireWarning set to 1209600 (14 days). My current password is going to expire in 12 days, how come I don't see a warning message when I ssh to my system? Thank you for your help. Regards Wei

3 5

Re: multi / standby master: incomplete replication after downtime (?)
by Elmar Marschke 18 Aug '10

18 Aug '10

Am 18.08.2010 17:16, schrieb Rein Tollevik: > On 08/18/2010 04:28 PM, Elmar Marschke wrote: > >> Here's the logfile of MASTER: >> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ >> ===_BEGIN_CHANGES_WHILE_BOTH_UP_=== >> Aug 18 15:30:04 ldapmaster slapd[8017]: slap_queue_csn: queing >> 0x7f00f317b580 20100818133004.663851Z#000000#000#000000 > > Your ServerID setting is incorrect, and you are using the default > ServerID=0 on both systems. The ServerID is included in the csn value, > the second to last number (#000# here). Ensure that the ServerID URL is > the exact hostname of the systems it runs on, or that slapd is able to > select the correct sid based on its -h listener argument. > > Start slapd with -d config and verify that both logs lines with > differing SID= values. > > Rein > hey folks, thanks a lot; hope is coming back ;) Unfortunately i'll be out of office from now on until 25th august, because of relocation. My testservers in the office are already switched off, and i'm at home already. So i can't check anything right now.. But /etc/hosts should be correct on both systems; i've written the names in there. I'd be glad to come back to you next wednesday ..:) best regards elmar

1 0

multi / standby master: incomplete replication after downtime (?)
by Elmar Marschke 18 Aug '10

18 Aug '10

Hi all, i set up a multi master scenario using 2.4.21 on two servers. Online config (slapd.d) and ldap content is replicated fine, as long as both servers are up (means: i can change objects using ANY of the servers; and changes are transferred immediately to the other one. (Later in production, there will just one server be used actively, the other one shall be used by the clients just in case of failure)). Then i shut down one of the servers, and do changes on the remaining one. I expect the switched-off server to get ALL the latest changes from the online-server as soon as it's up again. But this seems to happen only partially; for example: - deletion of a user object works ( = shows up on the former switched-off server immediately after coming up again) - adding of a user does not - changing just subordinate attributes of user objects, like telephone number, does not show up. It just gets replicated to the former switched-off machine, when something else of that object is changed while both servers are alive. So finally i end up with different content on every machine... Did i miss something about how that works ?? Or is my config wrong for that; example: syncrepl rid=001 provider="ldap://ldapmaster.local.site" type=refreshAndPersist retry="5 +" searchbase="dc=local,dc=site" bindmethod=simple binddn="cn=replicator,dc=local,dc=site" credentials="<secret>" Thanks for help... PS: my setup / slapd.conf is according to the book "openLDAP 2.4" by Oliver Liebel & John Martin Ungar. -- elmar

4 7

ldap_add: Invalid syntax (21)
by Cole 18 Aug '10

18 Aug '10

Hello. I'm trying to set up a computer cluster for a school project, and I am following a guide at debianclusters.org <http://www.debianclusters.org>. I'm trying to set up LDAP and I've followed the tutorial, but I keep getting this error. I saw this error in the FAQ, but I'm not sure how to fix it. Any ideas on what I am doing wrong? Here is a link to the tutorial: http://debianclusters.org/index.php/LDAP_Server ------------------------------------------------ root@durnik:/usr/share/migrationtools# ./migrate_all_online.sh Enter the X.500 naming context you wish to import into: [dc=muncc,dc=loc] Enter the hostname of your LDAP server [ldap]: durnik Enter the manager DN: [cn=admin,dc=muncc,dc=loc]: Enter the credentials to bind with: Do you wish to generate a DUAConfigProfile [yes|no]? no Importing into dc=muncc,dc=loc... Creating naming context entries... Migrating aliases... Migrating groups... Migrating hosts... Migrating networks... Migrating users... Migrating protocols... Migrating rpcs... Migrating services... Migrating netgroups... Migrating netgroups (by user)... Migrating netgroups (by host)... Importing into LDAP... adding new entry "ou=Hosts,dc=muncc,dc=loc" adding new entry "ou=Rpc,dc=muncc,dc=loc" adding new entry "ou=Services,dc=muncc,dc=loc" adding new entry "nisMapName=netgroup.byuser,dc=muncc,dc=loc" adding new entry "ou=Mounts,dc=muncc,dc=loc" adding new entry "ou=Networks,dc=muncc,dc=loc" adding new entry "ou=People,dc=muncc,dc=loc" adding new entry "ou=Group,dc=muncc,dc=loc" adding new entry "ou=Netgroup,dc=muncc,dc=loc" adding new entry "ou=Protocols,dc=muncc,dc=loc" adding new entry "ou=Aliases,dc=muncc,dc=loc" adding new entry "nisMapName=netgroup.byhost,dc=muncc,dc=loc" adding new entry "cn=mailer-daemon,ou=Aliases,dc=muncc,dc=loc" ldap_add: Invalid syntax (21) additional info: objectClass: value #0 invalid per syntax /usr/bin/ldapadd: returned non-zero exit status: saving failed LDIF to /tmp/nis.ldif.ImwnfdMVQr ----------------------------------------

2 1

Infrastructure for authentication using referrals
by Luiz M Oliveira 17 Aug '10

17 Aug '10

Hello everyone I'm having trouble configuring a distributed environment directories. I have the following scenario: A company with three departments (departments A, B and C) separated geographically. In each department a server is configured to store user input for authentication. The suffix of the directory of the three departments are configured as dc = company, dc = com Below the root directory of the three branches are configured. Using the example of the department A: Department_A dc =, dc = company, dc = com: has the user input in that department. departamento_B dc =, dc = company, dc = com: stores a referral to server B department departamento_C dc =, dc = company, dc = com: stores a referral to server B from the Department All departments follow this structure, but each department is set up a referral for other outlying departments. If a user of the department is located on the department network and B want to authenticate to that site, to query the server B, you receive a referral for their department of origin. Can I implement this authentication scenario, with all servers using the same suffix and below referrasl implemented for the branches of foreign departments? Thanks to all

2 1

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical August 2010