openldap-technical December 2011

openldap-technical@openldap.org

88 participants
101 discussions

Re: Solaris 10 Native Client connecting to OpenLdap How to needed
by adam＠spoontech.biz 11 Dec '11

11 Dec '11

Hi, I have scripted the following which is what we use when joining a new client to ldap: setup_ldap.sh #!/bin/sh if [ ! -d /var/ldap ] ; then mkdir /var/ldap chown root:sys /var/ldap chmod 755 /var/ldap fi cd /var/ldap rm -rf /var/ldap/* >/dev/null 2>&1 /usr/sfw/bin/sparcv9/certutil -N -d /var/ldap if [ -f /etc/ssl/our_CA_cert.pem ] ; then /usr/sfw/bin/sparcv9/certutil -A -n "ca-cert1" -i /etc/ssl/our_CA_cert.pem -a -t CT -d . else echo 'Could not find /etc/ssl/our_CA_cert.pem' fi if [ -f /etc/ssl/our_CA_cert2.pem ] ; then /usr/sfw/bin/sparcv9/certutil -A -n "ca-cert2" -i /etc/ssl/our_CA_cert2.pem -a -t CT -d . else echo 'Could not find /etc/ssl/our_CA_cert2.pem' fi if [ -f /etc/ssl/our_root_CA.pem ] ; then /usr/sfw/bin/sparcv9/certutil -A -n "ca-cert-root" -i /etc/ssl/our_root_CA.pem -a -t CT -d . else echo 'Could not find /etc/ssl/our_root_CA.pem' fi ldapclient init -v -a profileName=ldapprofilename -a domainName=example.com -a proxyDN=cn=proxyagent,ou=profile,dc=example,dc=com -a proxyPassword=examplepasswd ldapserver1 svcadm enable svc:/network/ldap/client:default svcadm restart svc:/network/ldap/client:default svcadm enable svc:/system/name-service-cache:default svcadm restart svc:/system/name-service-cache:default Obviously from the script above you can see that we have created profiles in ldap storing settings like uri etc. We did this so that machines authenticate to our local ldap server first, then connect to remote servers if unable to get a response from the local server. Let me know if you need anything else. Cheers, > Adam, > > What is the ldapclient init command you are using? > > > > On Sun, Dec 11, 2011 at 5:14 AM, <adam(a)spoontech.biz> wrote: > >> Hi, I manage an OpenLDAP environment consisting of Linux, Solaris and >> AIX. >> >> Here is the Schema I use for Solaris 10. >> >> Hope this helps. >> >> # Sun nisMapEntry attributes >> attributetype ( 1.3.6.1.1.1.1.28 >> NAME 'nisPublickey' >> DESC 'nisPublickey' >> EQUALITY caseIgnoreIA5Match >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) >> >> attributetype ( 1.3.6.1.1.1.1.29 >> NAME 'nisSecretkey' >> DESC 'nisSecretkey' >> EQUALITY caseIgnoreIA5Match >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) >> >> attributetype ( 1.3.6.1.4.1.1.1.1.12 SUP name >> NAME 'nisDomain' ) >> >> # Sun additional attributes to RFC2307 attributes (NIS) >> attributetype ( 2.16.840.1.113730.3.1.30 >> NAME 'mgrpRFC822MailMember' >> DESC 'mgrpRFC822MailMember' >> EQUALITY caseIgnoreIA5Match >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) >> >> #attributetype ( 1.3.6.1.4.1.42.2.27.2.1.15 >> # NAME 'rfc822MailMember' >> # DESC 'rfc822MailMember' >> # EQUALITY caseIgnoreIA5Match >> # SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.1.1.12 >> NAME 'nisNetIdUser' >> DESC 'nisNetIdUser' >> EQUALITY caseExactIA5Match >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.1.1.13 >> NAME 'nisNetIdGroup' >> DESC 'nisNetIdGroup' >> EQUALITY caseExactIA5Match >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.1.1.14 >> NAME 'nisNetIdHost' >> DESC 'nisNetIdHost' >> EQUALITY caseExactIA5Match >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) >> >> # Sun NIS publickey objectclass >> objectclass ( 1.3.6.1.1.1.2.14 >> NAME 'NisKeyObject' >> DESC 'NisKeyObject' >> SUP top >> MUST ( cn $ nisPublickey $ nisSecretkey ) >> MAY ( uidNumber $ description ) ) >> >> # Sun NIS domain objectclass >> objectclass ( 1.3.1.6.1.1.1.2.15 >> NAME 'nisDomainObject' >> DESC 'nisDomainObject' >> SUP top AUXILIARY >> MUST ( nisDomain ) ) >> >> # Sun NIS mailGroup objectclass >> objectclass ( 2.16.840.1.113730.3.2.4 >> NAME 'mailGroup' >> DESC 'mailGroup' >> SUP top >> MUST ( mail ) >> MAY ( cn $ mgrpRFC822MailMember ) ) >> >> # Sun NIS nisMailAlias objectclass >> #objectclass ( 1.3.6.1.4.1.42.2.27.1.2.5 >> # NAME 'nisMailAlias' >> # DESC 'nisMailAlias' >> # SUP top >> # MUST ( cn ) >> # MAY ( rfc822mailMember ) ) >> >> # Sun NIS nisNetId objectclass >> objectclass ( 1.3.6.1.4.1.42.2.27.1.2.6 >> NAME 'nisNetId' >> DESC 'nisNetId' >> SUP top >> MUST ( cn ) >> MAY ( nisNetIdUser $ nisNetIdGroup $ nisNetIdHost ) ) >> >> # Below is optional unless you want to use ldap_gen_profile >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.15 SUP name >> NAME 'SolarisLDAPServers' >> DESC 'SolarisLDAPServers' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.16 SUP name >> NAME 'SolarisSearchBaseDN' >> DESC 'SolarisSearchBaseDN' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.17 >> NAME 'SolarisCacheTTL' >> DESC 'SolarisCacheTTL' >> EQUALITY integerMatch >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.18 SUP name >> NAME 'SolarisBindDN' >> DESC 'SolarisBindDN' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.19 SUP name >> NAME 'SolarisBindPassword' >> DESC 'SolarisBindPassword' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.20 SUP name >> NAME 'SolarisAuthMethod' >> DESC 'SolarisAuthMethod' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.21 SUP name >> NAME 'SolarisTransportSecurity' >> DESC 'SolarisTransportSecurity' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.24 SUP name >> NAME 'SolarisDataSearchDN' >> DESC 'SolarisDataSearchDN' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.25 SUP name >> NAME 'SolarisSearchScope' >> DESC 'SolarisSearchScope' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.26 >> NAME 'SolarisSearchTimeLimit' >> DESC 'SolarisSearchTimeLimit' >> EQUALITY integerMatch >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.27 SUP name >> NAME 'SolarisPreferedServer' >> DESC 'SolarisPreferedServer' ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.28 SUP name >> NAME 'SolarisPreferedServerOnly' >> DESC 'SolarisPreferedServerOnly' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.29 SUP name >> NAME 'SolarisSearchReferral' >> DESC 'SolarisSearchReferral' >> SINGLE-VALUE ) >> >> objectclass ( 1.3.6.1.4.1.42.2.27.5.2.7 >> NAME 'SolarisNamingProfile' >> DESC 'Solaris LDAP NSS Profile' >> SUP top STRUCTURAL >> MUST ( cn $ SolarisLDAPServers ) >> MAY ( SolarisBindDN $ SolarisBindPassword $ >> SolarisSearchBaseDN $ SolarisAuthMethod $ >> SolarisTransportSecurity $ SolarisSearchReferral $ >> SolarisDataSearchDN $ SolarisSearchScope $ >> SolarisSearchTimeLimit $ SolarisCacheTTL ) ) >> >> # End of solaris.schema >> > I am working on getting a bunch of Solaris 10 hosts connected to >> OpenLdap. >> > I am not Ldap expert by far however I must get this working. >> > >> > I have 0 issues getting Linux clients to connect but Solaris 10 how >> to's >> > docs are very evasive. >> > >> > I have searched everywhere the best I can find is a few online docs >> that >> > say you need to load a custom schema. >> > >> > I just need user / passwd authentication to a directory nothing more. >> Will >> > not be using TLS.. >> > >>

1 0

Solaris 10 Native Client connecting to OpenLdap How to needed
by Jeremy Loukinas 11 Dec '11

11 Dec '11

I am working on getting a bunch of Solaris 10 hosts connected to OpenLdap. I am not Ldap expert by far however I must get this working. I have 0 issues getting Linux clients to connect but Solaris 10 how to's docs are very evasive. I have searched everywhere the best I can find is a few online docs that say you need to load a custom schema. I just need user / passwd authentication to a directory nothing more. Will not be using TLS..

3 3

Debugging OpenLDAP client: Where are the log files?
by daisy.wu＠emc.com 10 Dec '11

10 Dec '11

Hi, OpenLDAP developers, I've been able to successfully built OpenLDAP client libraries liblber and libldap for Window 64 bit OS. I wrote a test program to connect to Microsoft AD (hosted on Win 2008 R2, a 64 bit OS) over SSL. I made sure the root certificate file is converted to X509 base 64 PEM format. And the certificate file name is named using the hash value returned from "openssl" command. I made sure I can telnet to the AD host at port 636 from my test machine (where I run my test program). This is to make sure there's not network connectivity problem between my client test machine and the LDAP server host. Here's snippet of my source code: int debug_flag = -1; // debug all rc = ldap_set_option( ld, LDAP_OPT_DEBUG_LEVEL, &debug_flag); rc = ldap_sasl_bind_s( ld, dn, LDAP_SASL_SIMPLE, &passwd, NULL, NULL, NULL); if (rc != LDAP_SUCCESS) { trace("%15s: %s (%s: %d = %s)", "FAILED", "ldap_sasl_bind_s() failed!", "Return value is", rc, ldap_err2string(rc)); } However, my OpenLDAP client test program fails with the following error: 0011-12-10 16:08:59 [5296]: FAILED: ldap_sasl_bind_s() failed! (Return value is: -1 = Can't contact LDAP server) My question is: I need to troubleshoot this problem. I will need to examine the OpenLDAP log files to find the root cause. Where are the OpenLDAP log files located? I read that the log file location is configured in slapd.conf. But where is slapd.conf file on Windows? Considering I am not running OpenLDAP server on this test machine. Any input or feedback will be much appreciated. Thanks. Daisy

1 0

Syncrepl SSL fail
by Hugo Deprez 10 Dec '11

10 Dec '11

Dear community, I setup a syncrepl between my master openldap server and a consumer. I am trying to use SSL for this syncrepl I got the following error in the log when I start slapd on the consumer : Oct 13 17:04:59 server slapd[16905]: slapd starting Oct 13 17:04:59 server slapd[16905]: slap_client_connect: URI=ldaps://ldap.mydomain.fr:1024/ DN="cn=syncrepluser,o=others,dc=mydomain,dc=fr" ldap_sasl_bind_s failed (-1) Oct 13 17:04:59 server slapd[16905]: do_syncrepl: rid=003 rc -1 retrying (9 retries left) I don't understand why it is failing as a single ldapsearch from the same server with the syncrepl user is working. here is my syncrepl configuration : Syncrepl rid=003 provider=ldaps://ldap.mydomain.fr:1024/ type=refreshOnly retry="60 10 600 +" interval=00:00:00:10 searchbase="dc=mydomain,dc=fr" scope=sub schemachecking=on bindmethod=simple binddn="cn=syncrepluser,o=others,dc=mydomain,dc=fr" credentials=my_password Any idea ? Regards, Hugo

8 14

Starting out with NSS overlay - Guidance required
by ptw 09 Dec '11

09 Dec '11

Hi gang! I'm looking for some guidance in what is most probably a very common objective. Which is to manage all authentication to network hosts from slapd. To begin, my goal is to have: 1. one machine (generically-configured LDAP client) running sshd (10.153.107.100) 2. multiple LDAP users 3. specify, from slapd, that only one user (tony) can log in over ssh to the machine Surprisingly, I have not found much documentation on this stuff beyond the slapo-nssov man page. Anyway, I have some LDIF entries ready to go but I'm feeling very uneasy about dumping them in and hoping for the best. I would rather learn more about how this all works together and hopefully get some pointers/gotchas from others who have done this before. That's why I'm writing this email. In particular, at this point I only want the bare necessities to achieve my simple goad specified above. My slapd server has the nis and ldapns schemas configured and the client machine has libnss-ldapd (applied to group and passwd services) and libpam-ldapd. All systems are running Ubuntu 11.10. I have manually disabled nslcd on the Ubuntu client machine (sudo update-rc.d nslcd disable). These are the entries I have so far: for slapd-config: # NSSOV dn: olcOverlay=nssov,ocDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcNssOvConfig olcOverlay: nssov olcNssSsd: passwd ldap:///ou=People,dc=example,dc=com??one olcNssSsd: group ldap:///ou=People,dc=example,dc=com??one olcNssSsd: hosts ldap:///ou=People,dc=example,dc=com??one olcNssPam: hostservice uid2dn olcNssPamSession: sshd # ACL dn: olcDatabase={1}hdb,cn=config olcAccess: to attrs=userPassword by anonymous auth by self write by * none olcAccess: to attrs=shadowLastChange by self write by * none olcAccess: to * by self write by * read olcAccess: to dn.exact=cn=host1.example.com,ou=Hosts,dc=example,dc=com attrs=authorizedservice by dn.exact=cn=ssh,ou=host1,ou=server_access,ou=Groups,dc=example,dc=com compare by * read ================== The sshd host, user & group entries from my regular hdb-based DIT: # NSSOV HOST and USER dn: cn=host1.example.com,ou=Hosts,dc=example,dc=com objectClass: device objectClass: top objectClass: ipHost objectClass: authorizedServiceObject cn=host1.example.com ipHostNumber: 10.153.107.100 authorizedService: sshd dn: cn=ssh,ou=host1,ou=server_access,ou=Groups,dc=example,dc=com objectClass: posixGroup cn: ssh-host1-server_access gidNumber: 6000 dn: uid=tony,ou=People,dc=example,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount uid: tony cn: Tony Doe uidNumber: 11000 gidNumber: 6000 userPassword: tonyldap loginShell: /bin/bash homeDirectory: /home/tony =================== Anyone? Thanks in advance, Peter

2 1

Seemingly broken database
by Peter Mogensen 09 Dec '11

09 Dec '11

Hi, I have a large database with several million entries, which for a few specific entries takes very long (several minutes) to search. Looking at the debug output the search suddenly goes into a mode where it tests a lot of completely irrelevant entries and outputs a lot of "bdb_search: <number> scope not okay" messages - which takes very long time before the query ends. I've tried deleting all indexes and re-indexing with slapdindex, but the problem persists - also with 2.4.28. It's BDB 4.8.26 with back_bdb. However... loading the entire database with slapadd made the problem go away. So I suspect the id2entry or dn2id database is broken. So now I'm wondering... how do these situations occur and is there anyway to fix the database without reloading. It takes several hourse to reload, so it's not an ideal situation to have to do that every time such an event occurs. They are rather rare compared to the total number of entries, but they pop up once in a while, so it'll be a rutine job to start the database over from ldif, if that's the solution. Is there any tool to inspect the BDB database, find the problem, fix it and re-index? /Peter

3 4

creating databases corruption
by mark cunningham 08 Dec '11

08 Dec '11

Default install with debian, dc=nodomain as the database... This is my ldif dn: olcDatabase=hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: hdb olcSuffix: o=myTestDB olcDbDirectory: /var/lib/ldap olcAccess: to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,o=myTestDB" write by * none olcAccess: to dn.base="" by * read olcAccess: to * by self write by dn="cn=admin,o=myTestDB" write by * read olcRootDN: cn=admin,o=myTestDB olcRootPW:: e1NTSEF9MERCYWRzYXpicy9zQ1dSRmJUbFRuRlUyVFdwK0p6Qi8= olcDbIndex: objectClass eq ldapadd -vH ldapi:/// -Y EXTERNAL -f filewithldif Now slapcat just freezes when run, doesn't end, doesn't give out any text. slapcat -n 0 does give: dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap olcSuffix: o=myTestDB olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,o=myTestDB" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by self write by dn="cn=admin,o=myTestDB" write by * read olcRootDN: cn=admin,o=myTestDB olcRootPW:: e1NTSEF9MERCYWRzYXpicy9zQ1dSRmJUbFRuRlUyVFdwK0p6Qi8= olcDbIndex: objectClass eq structuralObjectClass: olcHdbConfig entryUUID: 8f41159e-b658-1030-8ee3-253edcff5134 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20111209022343Z entryCSN: 20111209022343.389564Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20111209022343Z slapd -V @(#) $OpenLDAP: slapd 2.4.23 (Jun 16 2011 02:53:39) $ buildd@murphy :/build/buildd-openldap_2.4.23-7.2-i386-Y1mwvF/openldap-2.4.23/debian/build/servers/slapd Fresh install on squeeze debian along with nodomain one. Mark

1 0

Re: memberof overlay deployment
by Asplund Marko 08 Dec '11

08 Dec '11

Masarati wrote: > slapo-memberof(5) does not support tool mode; in order to populate the > memberOf attribute of an existing database you need to use ldapadd(1). > You could, for example, dump your group entries, remove them, and re-add > them via ldapadd(1). Thanks for clearing that out. Could this be mentioned in the documentation somewhere (e.g. slapo-memberof(5))? So, the procedure would look something like this? Scripting would be a lot easier if ldapsearch could optionally output DNs without wrapping lines. # dump existing groups ldapsearch -H ldap://localhost:389 -b dc=example,dc=org -x -w XXXX -D cn=manager,dc=example,dc=org '(objectclass=groupofnames)' > groups.ldif # list existing groups by DN cat groups.ldif | perl -p00e 's/\r?\n //g' |grep '^dn: ' | sed -e 's/^dn: //' > groups_to_del.ldif # remove existing groups ldapdelete -v -c -H ldap://localhost:389 -x -w XXXX -D cn=manager,dc=example,dc=org -f groups_to_del.ldif # re-add groups ldapadd -v -H ldap://localhost:389 -x -w XXXX -D cn=manager,dc=example,dc=org -f groups.ldif best regards, marko

3 5

Test - disregard
by Peter Matulis 08 Dec '11

08 Dec '11

Pardon the noise. I've had trouble sending to this mailing list so I'm testing with this (3rd) address. Peter

1 0

RootDSE search, add attributes
by W.Siebert＠t-systems.com 08 Dec '11

08 Dec '11

Hello, my application sends a root_dse search, (objectclass=*) without any attributes. So openldap answers with 2 lines: Top objectClass: top objectClass: OpenLDAProotDSE But I need all attributes and controls Application is a blackbox, I can't change the search filter. Question: is it posible to add an attribute with '+' to get all system features by using rewritting/remapping to substitute the ampty attribute witch '+' regards Waldemar

2 1

← Newer
1
...
4
5
6
7
8
9
10
11
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical December 2011