openldap-technical January 2011

openldap-technical@openldap.org

91 participants
107 discussions

Alejandro Leyva wants to stay in touch on LinkedIn
by Alejandro Leyva via LinkedIn 05 Jan '11

05 Jan '11

LinkedIn ------------Alejandro Leyva requested to add you as a connection on LinkedIn: ------------------------------------------ Edward, I'd like to add you to my professional network on LinkedIn. - Alejandro Leyva Accept invitation from Alejandro Leyva http://www.linkedin.com/e/-48cabe-gikmn8dl-6g/IxIpDd2wsdsod7c6kW2TzgvFvx58f… View invitation from Alejandro Leyva http://www.linkedin.com/e/-48cabe-gikmn8dl-6g/IxIpDd2wsdsod7c6kW2TzgvFvx58f… ------------------------------------------ DID YOU KNOW LinkedIn can help you find the right service providers using recommendations from your trusted network? Using LinkedIn Services, you can take the risky guesswork out of selecting service providers by reading the recommendations of credible, trustworthy members of your network. http://www.linkedin.com/e/-48cabe-gikmn8dl-6g/svp/inv-25/ -- (c) 2010, LinkedIn Corporation

2 1

Re: DynList + posixGroup and permission to Dir
by masarati＠aero.polimi.it 05 Jan '11

05 Jan '11

> I read manual for slapo-dynlist and I tried found sth. about autogroup. > > Can you show my some example to this? > > Or this is possible to make that dyngroup and posixGroup in linux? Please keep replies on the list. Dyngroup works exactly like dynlist, as far as I remember. I know little about autogroup; perhaps someone else can help. Did you read the README? p.

1 0

Re: problem enabling ssl on openldap 2.2.13
by rui 05 Jan '11

05 Jan '11

Hi, The "is not readable by "ldap"" error happens when i start ldap using /etc/rc.d/init.d/ldap restart These three lines are the source of the problem, if i remove them then no warning message on restart. TLSCACertificateFile server.pem TLSCertificateFile server.pem TLSCertificateKeyFile server.pem I have moved this file to /etc/openldap/cacerts and changed the above three path accordingly. I have also modified ldap.conf to have TLS_CACERT which allows me to do ldapsearch(before it was giving ssl verify problem)now with ldaps://localhost on the same sytem. I still get this when i restart the ldap server using /etc/rc.d/init.d/ldap restart, notice the er.pem after ldap - is it not picking up the path. correctly or its a harmless warning now that ldaps is working i think it is harmless. is not readable by "ldap"er.pem [WARNING] is not readable by "ldap"er.pem [WARNING] is not readable by "ldap"er.pem [WARNING] Checking configuration files for slapd: [ OK ] Starting slapd: [ OK ] ------------------------------------------------ Problem on windows: pLdapConnection = ldap_sslinit(pHost,LDAP_SSL_PORT, 1); // fine - connecting to 636 iRtn = ldap_set_option(pLdapConnection, LDAP_OPT_PROTOCOL_VERSION, (void*)&version); //fine long option; printf("Checking if SSL is enabled\n"); iRtn = ldap_get_option(pLdapConnection,LDAP_OPT_SSL,(void*)&option); Here i get returned 0 in option meaning ssl is disabled. Also if i connect afterwards, i get 0x51(Cannot contact the LDAP server) connectSuccess = ldap_connect(pLdapConnection, NULL); How can i use ssl based openldap authentication on windows client? Do i have to move the self signed server.pem to windows, i tried to add it to certificate store by changing server.pem to server.cer? Regards, rui > On Wed, Jan 5, 2011 at 8:12 AM, Dieter Kluenter <dieter(a)dkluenter.de> wrote: >> Am Tue, 4 Jan 2011 16:52:06 +0000 >> schrieb rui <guideveloper(a)gmail.com>: >> >>> Hi >>> >>> I am trying to enable tls based session with openldap from a client. I >>> created a self signed certificate based on command from >>> http://www.openldap.org/pub/ksoper/OpenLDAP_TLS.html#4.1 >>> My server.pem file is in /etc/openldap directory where slapd.conf is >>> located. >> >> This document is not recommended >>> >>> Here are further settings in my slapd.conf >>> TLSCACertificateFile server.pem >>> TLSCertificateFile server.pem >>> TLSCertificateKeyFile server.pem >>> >>> TLSVerifyClient never >>> >>> >>> When I restart the ldap, it gives me the following warnings. >>> is not readable by "ldap" [WARNING] >>> is not readable by "ldap" [WARNING] >>> is not readable by "ldap" [WARNING] >>> Checking configuration files for slapd: [ OK ] >>> Starting slapd: [ OK ] >> >> This are not slapd warnings, what is the sosurce of this result report? >> >>> >>> I have checked the ps output and it is started as: >>> ldap 6883 1 0 16:18 ? 00:00:00 /usr/sbin/slapd -u >>> ldap -h ldap:/// ldaps:/// >>> >>> AND >>> netstat -anp | grep slapd >>> tcp 0 0 0.0.0.0:389 0.0.0.0:* >>> LISTEN 7850/slapd >>> tcp 0 0 0.0.0.0:636 0.0.0.0:* >>> LISTEN 7850/slapd >>> tcp 0 0 ip:389 ip:43165 >>> ESTABLISHED 7850/slapd >>> tcp 0 0 :::389 :::* >>> LISTEN 7850/slapd >>> tcp 0 0 :::636 :::* >>> LISTEN 7850/slapd >>> unix 2 [ ] DGRAM 302231743 7850/slapd >>> >> And what is your problem? slapd is listening on ports 389 and 636 >> >> -Dieter >> >> -- >> Dieter Klünter | Systemberatung >> http://dkluenter.de >> GPG Key ID:DA147B05 >> 53°37'09,95"N >> 10°08'02,42"E >> >

2 1

DynList + posixGroup and permission to Dir
by Rafal Kaminski 05 Jan '11

05 Jan '11

Hi, I have problem with OpenLdap and permission to file. --- First - I set this in my slapd.conf: overlay dynlist dynlist-attrset labeledURIObject labeledURI --- Second - I make cn=test,ou=Projects,dc=example,dc=com with: dn: cn=test,ou=Projects,dc=example,dc=com gidNumber: 6789 objectClass: posixGroup objectClass: top objectClass: labeledURIObject labeledURI: ldap:///cn=testgroup,ou=Groups,dc=example,dc=com?memberUid?sub?(objectClass=posixGroup) memberUid: user1 (dynamic) memberUid: user2 (dynamic) in cn=testgroup,ou=Groups,dc=example,dc=com i have memberuid: user1 and memberUid: user2 --- Third - when i made getent group test I have: test:*:6789:user1,user2 But when i try id user1 i didn't see this group :( And next i set chmod 770 dir and chown root.test dir and try access to this dir. But of course it is not possible because the user is not in this group (that said "id"). Somebody know the resolve? Because i spent a lot of hours and i can't find the problem. Very thanks for help! BR, Rafal

2 2

Re: slapo-accesslog on remote ldap server
by masarati＠aero.polimi.it 05 Jan '11

05 Jan '11

> Hi all, > I would like to know if is it possibile to have accesslog overlay to > write > to a remote ldap server. > > I have 2 OL instances and I would like to aggregate accesslog data on 1 > server dedicated to serve accesslog query. In principle, yes (not tested). Log to an "ldap" database pointing to the real log database. Identity assertion may be needed. p.

1 0

Re: DynList + posixGroup and permission to Dir
by Rafal Kaminski 05 Jan '11

05 Jan '11

Hi, Please help me or tell - if this is possible to make this one? I fight with this 2 days and I can't found resolve. Thanks! BR, Rafal

2 1

slapo-accesslog on remote ldap server
by Marco Pizzoli 05 Jan '11

05 Jan '11

Hi all, I would like to know if is it possibile to have accesslog overlay to write to a remote ldap server. I have 2 OL instances and I would like to aggregate accesslog data on 1 server dedicated to serve accesslog query. Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

1 0

Re: dynlist and group membership (libnss-ldap, posixGroup, samba)
by Rafal Kaminski 05 Jan '11

05 Jan '11

Hi, I have the same problem. Did you find resolve for this? Thanks for help. BR, Rafal Kaminski

1 0

How does LDAP_OPT_RESTART work?
by Khaled Blah 05 Jan '11

05 Jan '11

Hello, I'd like to know what the meaning of LDAP_OPT_RESTART is and how it works? Is there someone here who could shed some light on this for me? First of all: next to the description in the manual is a "FIXME" and it doesn't say what needs to be fixed exactly. Second of all: I've tried my OpenLDAP based client with this option set to LDAP_OPT_ON when my client was still running and already had done one successfull bind and then stopped (with another bind while the server was stopped) and restarted my LDAP server. However, when the LDAP server was back online the connection was not restarted and the bind did not work. Did I miss something or do I misunderstand the purpose of this option? Thanks in avance to anyone who can tell me more about this. Regards, Khaled

1 0

problem enabling ssl on openldap 2.2.13
by rui 05 Jan '11

05 Jan '11

Hi I am trying to enable tls based session with openldap from a client. I created a self signed certificate based on command from http://www.openldap.org/pub/ksoper/OpenLDAP_TLS.html#4.1 My server.pem file is in /etc/openldap directory where slapd.conf is located. Here are further settings in my slapd.conf TLSCACertificateFile server.pem TLSCertificateFile server.pem TLSCertificateKeyFile server.pem TLSVerifyClient never When I restart the ldap, it gives me the following warnings. is not readable by "ldap" [WARNING] is not readable by "ldap" [WARNING] is not readable by "ldap" [WARNING] Checking configuration files for slapd: [ OK ] Starting slapd: [ OK ] I have checked the ps output and it is started as: ldap 6883 1 0 16:18 ? 00:00:00 /usr/sbin/slapd -u ldap -h ldap:/// ldaps:/// AND netstat -anp | grep slapd tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 7850/slapd tcp 0 0 0.0.0.0:636 0.0.0.0:* LISTEN 7850/slapd tcp 0 0 ip:389 ip:43165 ESTABLISHED 7850/slapd tcp 0 0 :::389 :::* LISTEN 7850/slapd tcp 0 0 :::636 :::* LISTEN 7850/slapd unix 2 [ ] DGRAM 302231743 7850/slapd Regards, rui

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical January 2011