openldap-technical November 2011

openldap-technical@openldap.org

80 participants
91 discussions

AW: OpenLDAP 2.4 and cn=config replication
by Michael Kolowicz 10 Nov '11

10 Nov '11

In a book about Openldap i have read the way to replicate the cn=config-data. But the author descripte the slapd.conf method. My OpenLDAP use the database-backend. so I try to combine it and most of them works fine On the Master I have import following LDIF dn: cn=config changetype: modify add: olcReferral olcReferral: "ldap://ldap.example.de" dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: syncprov dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncrepl olcSyncrepl: rid=002 provider=ldap://ldap.example.de type=refreshAndPersist retry="5 +" searchbase="cn=config" filter="(!(olcDatabase={0}config))" bindmethod=simple binddn="cn=admin,dc=example,dc=de" credentials=secret add: olcUpdateRef olcUpdateRef: ldap://ldap.example.de dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://ldap.example.de type=refreshAndPersist retry="5 +" searchbase="dc=example,dc=de" bindmethod=simple binddn="cn=admin,dc=example,dc=de" credentials=secret add: olcUpdateRef olcUpdateRef: <ldap://ldap.example.de> ldap://ldap.example.de On the Client-LDAP I import the following LDIF dn: cn=config #objectClass: olcGlobal #cn: config changetype: modify add: olcReferral olcreferral: ldap://ldap.example.de dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcSyncRepl: rid=002 provider="ldap://ldap.example.de" binddn="cn=admin,dc=example,dc=de" bindmethod=simple credentials=secret searchbase="cn=config" filter="(!olcDatabase={0}config)" type=refreshAndPersist retry="10 +" olcRootDN: cn=admin,dc=example,dc=de olcUpdateRef: <ldap://ldap.example.de> ldap://ldap.example.de As result the complete ldap will be replicated. But when i restart the Slave-LDAP-Server then come up following error: Starting OpenLDAP: slapd - failed. The operation failed but no output was produced. For hints on what went wrong please refer to the system's logfiles (e.g. /var/log/syslog) or try running the daemon in Debug mode like via "slapd -d 16383" (warning: this will create copious output). Below, you can find the command line options used by this script to run slapd. Do not forget to specify those options if you want to look to debugging output: slapd -h 'ldap:/// ldapi:///' -g openldap -u openldap -F /etc/ldap/slapd.d/ And in syslog i find following entry: Nov 9 20:54:03 SMS002092 slapd[3376]: @(#) $OpenLDAP: slapd 2.4.21 (Jun 2 2011 19:36:19) $#012#011buildd@allspice:/build/buildd/openldap-2.4$ Nov 9 20:54:03 SMS002092 slapd[3376]: config error processing olcDatabase={2}config,cn=config: Nov 9 20:54:03 SMS002092 slapd[3376]: slapd stopped. Nov 9 20:54:03 SMS002092 slapd[3376]: connections_destroy: nothing to destroy. I can understand this error: ALL data will replicated and on the Slave another config [olcDatatbase={2}config) will be created. How can I avoid the creation of the second , incomplete database? Freundliche Grüße / Best regards Michael

1 0

Need help with failing test
by Gabriella Turek 10 Nov '11

10 Nov '11

Hello, I have built openldap 2.4.23 (with Berkeley DB 5.2.36) on a Suse SLES11 64bit machine and I am trying to verify the install by running the tests. The following test fails: >>>>> Starting test005-modrdn for bdb... running defines.sh Running slapadd to build slapd database... Starting slapd on TCP/IP port 9011... Testing slapd modrdn operations... Testing modrdn(deleteoldrdn=0)... ./scripts/test005-modrdn: line 65: 2291 Segmentation fault $SLAPD -f $CONF1 -h $URI1 -d $LVL $TIMING > $LOG1 2>&1 ldapmodrdn failed (255)! ./scripts/test005-modrdn: line 70: kill: (2291) - No such process >>>>> ./scripts/test005-modrdn failed for bdb (exit 255) make: *** [bdb-yes] Error 255 The log output for this test is: >>> slap_listener(ldap://localhost:9011/) conn=1001 fd=21 ACCEPT from IP=127.0.0.1:60661 (IP=127.0.0.1:9011) connection_get(21) connection_get(21): got connid=1001 connection_read(21): checking for input on id=1001 ber_get_next ber_get_next: tag 0x30 len 46 contents: op tag 0x60, time 1320032341 ber_get_next conn=1001 op=0 do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: >>> dnPrettyNormal: <cn=Manager,dc=example,dc=com> => ldap_bv2dn(cn=Manager,dc=example,dc=com,0) <= ldap_bv2dn(cn=Manager,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Manager,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=manager,dc=example,dc=com)=0 <<< dnPrettyNormal: <cn=Manager,dc=example,dc=com>, <cn=manager,dc=example,dc=com> conn=1001 op=0 BIND dn="cn=Manager,dc=example,dc=com" method=128 do_bind: version=3 dn="cn=Manager,dc=example,dc=com" method=128 ==> bdb_bind: dn: cn=Manager,dc=example,dc=com conn=1001 op=0 BIND dn="cn=Manager,dc=example,dc=com" mech=SIMPLE ssf=0 do_bind: v3 bind: "cn=Manager,dc=example,dc=com" to "cn=Manager,dc=example,dc=com" send_ldap_result: conn=1001 op=0 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=1 tag=97 err=0 ber_flush2: 14 bytes to sd 21 conn=1001 op=0 RESULT tag=97 err=0 text= connection_get(21) connection_get(21): got connid=1001 connection_read(21): checking for input on id=1001 ber_get_next ber_get_next: tag 0x30 len 104 contents: op tag 0x6c, time 1320032341 ber_get_next conn=1001 op=1 do_modrdn ber_scanf fmt ({mmb) ber: do_modrdn: dn (cn=James A Jones 1, ou=Alumni Association, ou=People, dc=example, dc=com) newrdn (cn=James A Jones III) n ewsuperior () ber_scanf fmt (}) ber: >>> dnPrettyNormal: <cn=James A Jones 1, ou=Alumni Association, ou=People, >>>dc=example, dc=com> => ldap_bv2dn(cn=James A Jones 1, ou=Alumni Association, ou=People, dc=example, dc=com,0) <= ldap_bv2dn(cn=James A Jones 1, ou=Alumni Association, ou=People, dc=example, dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=James A Jones 1,ou=Alumni Association,ou=People,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=james a jones 1,ou=alumni association,ou=people,dc=example,dc=com)=0 <<< dnPrettyNormal: <cn=James A Jones 1,ou=Alumni Association,ou=People,dc=example,dc=com>, <cn=james a jones 1,ou=alumn i association,ou=people,dc=example,dc=com> >>> dnPrettyNormal: <cn=James A Jones III> => ldap_bv2dn(cn=James A Jones III,0) <= ldap_bv2dn(cn=James A Jones III)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=James A Jones III)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=james a jones iii)=0 <<< dnPrettyNormal: <cn=James A Jones III>, <cn=james a jones iii> conn=1001 op=1 MODRDN dn="cn=James A Jones 1,ou=Alumni Association,ou=People,dc=example,dc=com" bdb_dn2entry("cn=james a jones 1,ou=alumni association,ou=people,dc=example,dc=com") ==>bdb_modrdn(cn=James A Jones 1,ou=Alumni Association,ou=People,dc=example,dc=com,cn=James A Jones III,NULL) slap_queue_csn: queing 0x2b3f483d6210 20111031033901.351643Z#000000#000#000000 bdb_dn2entry("cn=james a jones 1,ou=alumni association,ou=people,dc=example,dc=com") => bdb_dn2id_children("cn=james a jones 1,ou=alumni association,ou=people,dc=example,dc=com") <= bdb_dn2id_children("cn=james a jones 1,ou=alumni association,ou=people,dc=example,dc=com"): no (-30988) bdb_modrdn: wr to children of entry ou=alumni association,ou=people,dc=example,dc=com OK bdb_modrdn: parent dn=ou=Alumni Association,ou=People,dc=example,dc=com >>> dnNormalize: <cn=James A Jones III,ou=Alumni >>>Association,ou=People,dc=example,dc=com> => ldap_bv2dn(cn=James A Jones III,ou=Alumni Association,ou=People,dc=example,dc=com,0) <= ldap_bv2dn(cn=James A Jones III,ou=Alumni Association,ou=People,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=james a jones iii,ou=alumni association,ou=people,dc=example,dc=com)=0 <<< dnNormalize: <cn=james a jones iii,ou=alumni association,ou=people,dc=example,dc=com> bdb_modrdn: new ndn=cn=james a jones iii,ou=alumni association,ou=people,dc=example,dc=com => bdb_dn2id("cn=james a jones iii,ou=alumni association,ou=people,dc=example,dc=com") <= bdb_dn2id: get failed: BDB0073 DB_NOTFOUND: No matching key/data pair found (-30988) => bdb_dn2id_delete 0xc: "cn=james a jones 1,ou=alumni association,ou=people,dc=example,dc=com" Any ideas what may be wrong? Is this a significant failure? Thank you Gaby -- Gabriella Turek Sr. Software Engineer National Institute for Water & Atmospheric Research (NIWA)

2 2

Re: How to configure Unique Overlay in cn=config
by Quanah Gibson-Mount 10 Nov '11

10 Nov '11

--On Thursday, November 10, 2011 3:07 AM +0800 Stewart Walters <stewart.walters(a)gmail.com> wrote: > Hi Quanah, > > Could you please elaborate a bit more on what you mean by serious issues? > > Are you talking about missing features or just general bugs in the 2.4.23 > code base? Bugs. <http://www.openldap.org/software/release/changes.html> --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

How to configure Unique Overlay in cn=config
by Igor Blanco 10 Nov '11

10 Nov '11

Hello everyone, I'm trying to configure the uniqueness overlay in Debian Squeeze (OpenLDAP 2.4.23) using "cn=config" but I can't figure how to do it and can't find any good doc about it, the FAQ-O-Matic wasn't very helpful this time. I've added a new "olcModuleLoad=unique" attribute in "cn=module{0},cn=config" and it hasn't complained, but how and where do I set "olcUniqueURI" ? in "olcDatabase={1}hdb,cn=config" ? This attribute does not seem to be present in my OpenLDAP installation, do I have to add any new schema? Any reference to documentation explaining how to configure "unique" overlay within "cn=config" would be much appreciated. A dump of a "cn=config" branch correctly configured would be fantastic. Thanks. -- Igor Blanco González Binovo IT Human Project e-mail: iblanco(a)binovo.es Telf. : 943 493611 - 690229375 Dirección: Astigarraga Bidea 2 Planta 6. - Ofi. 3-2 20180 Oiartzun ( Gipuzkoa )

2 1

Help needed chaining to active directory for authentication
by Gabriella Turek 10 Nov '11

10 Nov '11

Hello, I've set up an openLDAP server (2.4.23) which chains to an Active Directory (2008). I can successfully search for users, it will find them in Active Directory if they are not in openLDAP, but I cannot authenticate the Active Directory users. The error is "Invalid credentials (49)" Everything is currently configured with clear text ldapSearch works fine when pointed directly to the Active Directory. The chaining configuration in the slapd.conf is: overlay chain chain-uri ldap://aucwdfp01.niwa.local:389 chain-rebind-as-user TRUE chain-idassert-bind bindmethod="simple" binddn="cn=SDT Tester,ou=NIWA Staff Accounts,ou=User Accounts, dc=niwa,dc=local" credentials=xxxxxxx mode="self" flags=non-prescriptive chain-return-error TRUE Any tips would be greatly appreciated. Cheers Gaby

2 1

loadbalancer in OopenLDAP environment
by Meike Stone 10 Nov '11

10 Nov '11

Hello, does anywhere use loadbalancer in his OpenLDAP setup? I have two locations (data center). In each location I want install a OpenLDAP server who replicate with the other (MM N-Way) Then I want install a few (depends on the load) OpenLDAP ro replicas (replicate from the local OpenLDAP). - In the location are setup loadbalancers who are asked from the local clients. - The loadbalancer direct the searches to the local ro replicas and writes/modifies to the local "rw Master". - Only if all local ro resources are down or have a long response time, the loadbalancer redirects the searches to the remote ro replicas. - Same way with write access, if local rw master is down, write/modify access is redirect to the remote rw master. Is this a possible setup? What are the experiences with such setups, can you share them? Are there snares? I saw one example in the admin guide, but it shows 4 loadbalancers. Thats to much for my budget. Thanks for help, Meike

3 5

Base64 Attribute Encryption
by Scot Hollingsworth 10 Nov '11

10 Nov '11

Hi. I'm upgrading from RHEL 5 to RHEL 6. I'm having no problem in RHEL 5. In RHEL 6 I'm using openldap-2.4.23-15.el6_1.3.x86_64. I have the master/slave setup and working. Now, I use ldapmodify to edit an entry and instead of plain text, I getting the attribute as base64. I don't want this. I'm looking everyone but haven't found where to disable this. Anyone know? Thanks. Scot This message may contain confidential and/or proprietary information, and is intended for the person/entity to whom it was originally addressed. Any use by others is strictly prohibited.

3 3

Re: Help with Cyrus configuration - testsaslauthd not working
by Gabriella Turek 08 Nov '11

08 Nov '11

Hi Dan, Awesome I got it to work, but I have a couple of comments to add for future reference: 1) I was using quotes around the ldap_bind_dn, because it has blanks in it, but by looking at wireshark I realized that the string is also being quoted by saslauthd so I was ending up with double quotes and therefore an invalid DN 2) The ldap_filter has to read (distinguishedName=%u), there is no "dn" attribute in Active Directory. If that's not correct then authentication also fails, because - as it was pointed out in some other list I was reading - authentication is a two pass affair. First it binds the ldap_bind_dn user with which it does a search for the authenticating user. Then, the result of that search is used to bind the authenticating user. Since the DN is required for binding, the filter must return the distinguishedName in case of AD. On 8/11/11 12:11 PM, "Dan White" <dwhite(a)olp.net> wrote: >On 07/11/11 21:49 +0000, Gabriella Turek wrote: >>Hello, I am trying to set up Cyrus sasl so I can use it for pass-through >>authentication with OpenLDAP. The OS is SUSE sles11 and I thought I'd >>start with what is already there preinstalled (v.2.1.22) I am trying to >>authenticate against Active Directory 2008. >>My configuration file looks like: >> >>ldap_servers: ldap://hamwdc01.niwa.local/ >>ldap_search_base: DC=niwa=,DC=local > >You have a typo here, with an extra equals sign. > >>ldap_scope: sub >>ldap_sasl_mech: plain > >Since you're not using ldap_use_sasl: yes, you should remove >ldap_sasl_mech from your config. > >>ldap_auth_method: bind >>ldap_bind_dn: "CN=SDT Tester,OU=NIWA Staff Accounts,OU=User >>Accounts,DC=niwa,DC=local" >>ldap_password: mypassword >>ldap_filter: (dn=%u) >> >>When I try authenticate using testsaslauthd I get: >>>Authentication failed for some-user: Bind to ldap server failed (invalid >>>user/password or insufficient access) (-7) >> >>If I try a ldap_bind_dn of the form >>sdttester(a)niwa.local<mailto:sdttester@niwa.local> in the config file I >>get: >>Authentication failed for some-user: Retry condition (ldap server >>connection reset or broken) (-3) > >You should be using the DN, when using 'ldap_auth_method: bind'. > >>This is all very puzzling, as I can ldapsearch perfectly fine with any >>valid user I chose in either form (DN or userPrincipalName) >> >>Is it possible that this installation of cyrus has not been compiled with >>ldap support? I would expect a bit more feedback. > >You can verify saslauthd was compiled with LDAP support with 'saslauthd >-v'. You use it by specifying '-a ldap' as a command line option. > >Your saslauthd.conf file should typically go in /etc, but you can specify >an >alternate location with '-O <path/file>'. > >See saslauthd/LDAP_SASLAUTHD in the source for documentation. > >You can simulate the function of saslauthd (in bind mode) with: > >ldapsearch -x -H ldap://hamwdc01.niwa.local/ -D "CN=SDT Tester,OU=NIWA >Staff Accounts,OU=User Accounts,DC=niwa,DC=local" -w mypassword -b >"DC=niwa,DC=local" "(dn=testusername)" dn > >and then with the returned dn: > >ldapwhoami -x -H ldap://hamwdc01.niwa.local/ -D "$DN" -w <user_password> > >and if successful, ldapwhoami should return the DN again. If so, then your >saslauthd.conf config is probably correct. > >For further trouble shooting, you can add 'ldap_debug: -1' to your >saslauthd.conf, and start saslauthd in debug mode. > >After verifying testsaslauthd is working, make sure that your OpenLDAP >user >(-u option) has filesystem permissions to access the saslauthd mux. > >For OpenLDAP pass-through documentation, see "14.5. Pass-Through >authentication" of the OpenLDAP Administrator's Guide. > >-- >Dan White

1 0

LD_LIBRARY_PATH exported but libdb-4.6.so not found
by Pablo Chamorro C. 08 Nov '11

08 Nov '11

I updated from 2.4.21 to 2.4.23 in some old Fedoras and also in a CentOS 5.4. Before compiling, I run: export LD_LIBRARY_PATH=/usr/local/BerkeleyDB.4.6/lib export CPPFLAGS="-I/usr/local//BerkeleyDB.4.6/include" export LDFLAGS="-L/usr/local/BerkeleyDB.4.6/lib" and it compiles ok. But after installed, in 3 out 4 of the used servers, slapd doesn't start unless I execute first: export LD_LIBRARY_PATH=/usr/local/BerkeleyDB.4.6/lib Attached, the output of ldd /usr/local/libexec/slapd, before and after running export LD_LIBRARY_PATH=/usr/local/BerkeleyDB.4.6/lib. In short: without LD_LIBRARY_PATH defined: libdb-4.6.so => not found with LD_LIBRARY_PATH as above: libdb-4.6.so => /usr/local/BerkeleyDB.4.6/lib/libdb-4.6.so (0x00002b4eb2c16000) Could you please explain me why this might be happening? Is this a bug? This issue ocurred to me in at least 3 server, but I have another CentOS 5.4, where the compilation and the install process run just fine, and I didn't need that workaround. Thank you, Pablo Chamorro La informaci�n contenida en este mensaje y cualquiera de sus adjuntos es confidencial, para el uso exclusivo de la persona o entidad destinataria. Si usted ha recibido este mensaje por equivocaci�n, se le notifica que no est� autorizado para revisarlo, reenviarlo, imprimirlo, copiarlo o distribuirlo de forma parcial o total; por favor comunique el error a la persona que lo env�a y elim�nelo. Las opiniones y puntos de vista presentados en este mensaje son responsabilidad de quien firma el mensaje y no representan necesariamente la posici�n y puntos de vista de INGEOMINAS. Este mensaje de correo electr�nico ha sido analizado por el antivirus Mcafee. Confidentiality Notice The information in this message and any attachments is confidential, it is for exclusive use of the person or entity to which it is addressed. If you have received this message in error, you are notified that you are not authorized to review, re-transmit, print out, disseminate, copy or distribute it in partial or total way; please communicate the mistake to the person who sent this message and delete it. The opinions and points of view stated in this message with responsibility by who signed the message, do not necessarily represent the opinion or point of view of INGEOMINAS. This electronic mail message was scanned by the Mcafee anti-virus.

2 2

Error when creating realm in openldap from kerberos
by Ethan Koh 08 Nov '11

08 Nov '11

Hello I have been at this for a week now, and i would really appreciate any help. I'm setting up both kerberos and openldap on the same ubuntu VM for testing purposes. I was following the configuration for kerberos-ldap ( https://help.ubuntu.com/11.04/serverguide/C/kerberos-ldap.html) when I got this error: sudo kdb5_ldap_util -D cn=admin,dc=example,dc=com create -subtrees dc=example,dc=com -r EXAMPLE.COM -s -H ldap://ldap.example.com <......entered password for cn=admin and new KDC database.....> kdb5_ldap_util: Hostname cannot be canonicalized krb5_sname_to_principal, while adding entries to the database I think its something to do with the /etc/hosts file, but I'm not sure. Here are my configurations: ---------------------- kdc.conf ---------------------- [kdcdefaults] kdc_ports = 88 acl_file = /usr/local/var/krb5kdc/kadm5.acl admin_keytab = /usr/local/var/krb5kdc/kadm5.keytab dict_file = /usr/local/var/krb5kdc/kadm5.dict [realms] EXAMPLE.COM = { database_name = /usr/local/var/krb5kdc/principal admin_keytab = /usr/local/var/krb5kdc/kadm5.keytab acl_file = /usr/local/var/krb5kdc/kadm5.acl dict_file = /usr/local/var/krb5kdc/kadm5.dict key_stash_file = /usr/local/var/krb5kdc/.k5.EXAMPLE.COM kadmind_port = 749 max_life = 10h 0m 0s max_renewable_life = 7d 0h 0m 0s master_key_type = des3-hmac-sha1 supported_enctypes = des3-hmac-sha1:normal des-cbc-crc:normal } ---------------------- kdc.conf ---------------------- [libdefaults] ticket_lifetime = 2400 default_realm = EXAMPLE.COM default_tkt_enctypes = des3-hmac-sha1 des-cbc-crc default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc [realms] EXAMPLE.COM = { kdc = kerberos.example.com:88 admin_server = kerberos.example.com:749 default_domain = example.com database_module = openldap_ldapconf } [domain_realm] .example.com = EXAMPLE.COM example.com = EXAMPLE.COM [dbdefaults] ldap_kerberos_container_dn = dc=example,dc=com [dbmodules] openldap_ldapconf = { db_library = kldap ldap_kdc_dn = "cn=admin,dc=example,dc=com" # this object needs to have read rights on # the realm container, principal container and realm sub-trees ldap_kadmind_dn = "cn=admin,dc=example,dc=com" # this object needs to have read and write rights on # the realm container, principal container and realm sub-trees ldap_service_password_file = /etc/krb5kdc/service.keyfile ldap_servers = ldaps://ldap.example.com ldap_conns_per_server = 5 } [logging] kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmin.log default = FILE:/var/log/krb5lib.log ---------------------- backend.example.com.ldif ---------------------- # Load dynamic backend modules dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/lib/ldap olcModuleload: back_hdb.la # Database settings dn: olcDatabase=hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcSuffix: dc=example,dc=com olcDbDirectory: /var/lib/ldap olcRootDN: cn=admin,dc=example,dc=com olcRootPW: {SSHA}0tWXk3nWCfFXeyv3cGF39KmW3Wukbgj8 olcDbConfig: set_cachesize 0 2097152 0 olcDbConfig: set_lk_max_objects 1500 olcDbConfig: set_lk_max_locks 1500 olcDbConfig: set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcLastMod: TRUE olcDbCheckpoint: 512 30 olcAccess: to attrs=userPassword,shadowLastChange,krbPrincipalKey by dn="cn=admin,dc=example,dc=com" write by anonymous auth by self write by * none olcAccess: to dn.base="" by * read olcAccess: to * by dn="cn=admin,dc=example,dc=com" write by * read ---------------------- frontend.example.com.ldif ---------------------- # Create top-level object in domain dn: dc=example,dc=com objectClass: top objectClass: dcObject objectclass: organization o: Example Organization dc: Example description: LDAP Example # Admin user. dn: cn=admin,dc=example,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin1 description: LDAP administrator #userPassword: aa userPassword: {SSHA}0tWXk3nWCfFXeyv3cGF39KmW3Wukbgj8 dn: ou=people,dc=example,dc=com objectClass: organizationalUnit ou: people dn: ou=groups,dc=example,dc=com objectClass: organizationalUnit ou: groups dn: uid=john,ou=people,dc=example,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount uid: john sn: Doe givenName: John cn: John Doe displayName: John Doe uidNumber: 1000 gidNumber: 10000 userPassword: {SSHA}0tWXk3nWCfFXeyv3cGF39KmW3Wukbgj8 gecos: John Doe loginShell: /bin/bash homeDirectory: /home/john shadowExpire: -1 shadowFlag: 0 shadowWarning: 7 shadowMin: 8 shadowMax: 999999 shadowLastChange: 10877 mail: admin(a)example.com postalCode: 31000 l: Toulouse o: Example mobile: +33 (0)6 xx xx xx xx homePhone: +33 (0)5 xx xx xx xx title: System Administrator postalAddress: initials: JD dn: cn=example,ou=groups,dc=example,dc=com objectClass: posixGroup cn: example gidNumber: 10000 ---------------------- ldap.conf ---------------------- BASE dc=example,dc=com URI ldap://ldap.example.com ldapi://ldap.example.com ldaps:// ldap.example.com TLS_CACERT /etc/ssl/certs/cacert.pem SIZELIMIT 12 TIMELIMIT 15 DEREF never ---------------------- /etc/hosts ---------------------- 127.0.0.1 kerberos.example.com kerberos 127.0.0.1 ldap.example.com ldap 192.168.0.101 ubuntu # The following lines are desirable for IPv6 capable hosts ::1 localhost ip6-localhost ip6-loopback fe00::0 ip6-localnet ff00::0 ip6-mcastprefix ff02::1 ip6-allnodes ff02::2 ip6-allrouters ff02::3 ip6-allhosts

1 0

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical November 2011