openldap-technical May 2011

openldap-technical@openldap.org

91 participants
81 discussions

OpenLdap Proxy for testing network behaviour
by Echedey Lorenzo 26 May '11

26 May '11

Hi, I need to simulate 3 OpenLdaps instances. I was thinking about using a proxy that could listen to 3 different ports and route all the packets to the the standard 389 in which OpenLdap is listening. The proxy should be capable of open/close these ports dinamically and also throw custom error codes. I would like someone to point me in the right direction to start working. Thanks a lot

2 2

Schemas design
by jm.rodriguez＠andaluciajunta.es 25 May '11

25 May '11

Hi, I have doubts when designing new schemes. What advantages and drawbacks exist when creating a new structural objectclass with attributes that inherit from other basic attributes or define auxiliary objectclass with attributes completely new ? Is it harmful to define new attributes or objectclass assigning oids? Thanks. -- Jose Manuel Rodriguez Caro jm.rodriguez(a)andaluciajunta.es

1 0

Openldap ssl with translucent proxy
by joaosf 24 May '11

24 May '11

Hi all, I'm trying to configure a ldap server proxy with overlay translucent, in this way I can add group's to users on the default Ldap Server. Everything is ok until I try to use the SSL: Ldap Server (solaris)<----(389 ldap)---> My Openladap proxy <------(389 ldap)---> Client (everything ok) When I try to use certificates and secure Ldap, I have a problem: Ldap Server (solaris)<----(389 ldap)---> My Openladap proxy <------(636 ldaps)---> Client (still ok) But I have no success when I try to configure the 636 ldaps between main Ldap server (on solaris) and my openldap proxy :( the answer is "No such user". My slapd.conf on my openldap proxy: database bdb suffix "dc=mycompany,dc=pt" rootdn "cn=Admin,dc=mycompany,dc=pt" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg rootpw {SSHA}blablabla overlay translucent #uri ldaps://solaris_ldap_server02:636 uri ldaps://solaris_ldap_server01:636 #uri ldap://solaris_ldap_server01 #uri ldap://solaris_ldap_server02 So, if I use the "uri ldap://solaris_ldap_server01" everything is ok and wonderful but if I want something more secure like "uri ldaps://solaris_ldap_server01:636" I got a "No such user" grrrrrr. The beautifull part is that I have all certificates and I can use wiht success the ldapsearch (636 ldaps) against the solaris_ldap_server from my openldap proxy and/or from my linux client, like: ldapsearch -H ldaps://solaris_ldap_server01:636 -x -b "dc=mycompany,dc=pt" And if I configure a Linux client to connect directly to Solaris Server on port 636 ldaps (without my proxy), everything is ok and no problem. When I put a tcpdump running on my Ldap Proxy the Solaris server answer with a "TLSv1 Record Layer: Alert (Level: Fatal, Description: Unknown CA)" but this is bull sheet, I have the correct certificate other way I was not able to do search querys. The big question is, why the "overlay translucent" (proxy) does not work on secure mode? what I'm doing wrong?

1 0

Re: (ITS#6666) Feature Request: Triggers implementation
by Buchan Milne 23 May '11

23 May '11

On Thursday, 7 October 2010 20:32:49 Nick Milas wrote: > It all started for me when I wanted to watch a serial number value from > an ldap-stored SOArecord (using powerdns with openldap backend) and when > it changes to fire a bash script. I reached the conclusion it was not > easy to be done with higher-level means within openldap and I created a > bash script which scans (using ldapsearch and other linux tools) the > SOArecords regularly (using cron) to find out if any change has happend > and do whatever is required. It would be much more elegant if I could > get a trigger from openldap when the SOArecord changes. Maybe you need this: http://memberwebs.com/stef/software/slapi-dnsnotify/ A more generic solution would be nice, but as far as I can tell, this software satisfies your current need. Regards, Buchan

7 18

Error updating entry with openldap 2.4.23
by JOSE L MARTINEZ-AVIAL 23 May '11

23 May '11

Hi all, I'm triying to update an entry, and it's failing. The server just crashes, so I started it with debug 4, and that's what I got: connection_get(15) conn=1002 op=2 do_modify: dn (cn=xxxxxxx,ou=External Users,dc=eco,dc=spb,dc=com) => ldap_bv2dn(cn=xxxxxxx,ou=External Users,dc=eco,dc=spb,dc=com,0) <= ldap_bv2dn(cn=xxxxxxx,ou=External Users,dc=eco,dc=spb,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=xxxxxxx,ou=External Users,dc=eco,dc=spb,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=xxxxxxx,ou=external users,dc=eco,dc=spb,dc=com)=0 conn=1002 op=2 modifications: add: displayName one value, length 19 add: mail one value, length 16 add: sAMAccountName one value, length 8 add: givenName one value, length 6 add: userPassword one value, length 10 add: objectclass multiple values add: sn one value, length 12 base_candidates: base: "cn=xxxxxxx,ou=external users,dc=eco,dc=spb,dc=com" (0x0000000d) send_ldap_result: err=0 matched="" text="" bdb_modify: cn=xxxxxxx,ou=External Users,dc=eco,dc=spb,dc=com bdb_modify_internal: add displayName slapd: attr.c:478: attr_merge: Assertion `( nvals == ((void *)0) && (*a)->a_nvals == (*a)->a_vals ) || ( nvals != ((void *)0) && ( ( (*a)->a_vals == ((void *)0) && (*a)->a_nvals == ((void *)0) ) || ( (*a)->a_nvals != (*a)->a_vals ) ) )' failed. Aborted The attribute displayName is defined as follows: attributetype ( 1.2.840.113556.1.2.13 NAME 'displayName' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE ) What am I doing wrong? Thanks. Jose

1 0

Get last SSL Error?
by Eric Nichols (DirWiz) 23 May '11

23 May '11

After attempting ldap_sasl_bind on a LDAPS connection I am trying to determine the return error message from openssl. I am using the following: ldap_get_option(ld,LDAP_OPT_X_TLS_SSL_CTX,&sslptr); rc=SSL_get_error(sslptr,ret); What I cannot find is how to populate 'ret' for the SSL_get_error function. Is the last return code from OpenSSL stored in OpenLDAP somewhere so I can get a clearer picture on an SSL connection failure? Many thanks in advance, Eric

1 0

Re: Need help to create a new DN "myNewDN: cn=testUser, ou=testOU, dc=test, dc=local"
by Mahmudur Rahman Jami 23 May '11

23 May '11

Hi Bill, May thanks for your reply. I am running an openldap server with around 12,000 users. I was looking to replace "dn:" with "myNewDN:". However, i have got the solution. I have added the following to schema, ### attributetype ( 1.3.6.1.4.1.XXXX.2.3.XXX NAME 'myNewDN' DESC 'Test DN replacement' SUP distinguishedName ) ## Cheers........JAMI. On Mon, May 23, 2011 at 5:31 PM, Bill MacAllister <whm(a)stanford.edu> wrote: > > > --On Monday, May 23, 2011 11:01:33 AM +1000 Mahmudur Rahman Jami < > infojami(a)gmail.com> wrote: > > Hi, >> >> I want to create a new distinguishedName as follows (NOT as "dn: >> cn=testUser,ou=testOU,dc=test,dc=local"), >> >> "myNewDN: cn=testUser,ou=testOU,dc=test,dc=local" >> >> I have got a ldif with similar definition to import. I googled and found >> lot >> of examples related to "attributetype" and "objectClass" only, not related >> to this. >> Any help will be highly appreciated. >> >> Thanks, >> Jami >> > > Assuming that the root of your directory is dc=test,dc=local then you > need to created an entry for ou=testOU before you attempt to create > the entry for cn=testUser. > > For example you might try: > > ldapadd -h somehost -b dc=test,dc=local<<EOF > dn: ou=testOU,dc=test,dc=local > objectClass: top > objectClass: organizationalUnit > ou: testOU > > > dn: cn=testUser,ou=testOU,dc=test,dc=local > objectclass: top > objectclass: person > cn: testUser > sn: Smith > EOF > > Of course, you will need to bind to the directory some credentials > that will allow you to write to the directory. > > Bill > > -- > > Bill MacAllister > Infrastructure Delivery Group, Stanford University > >

1 0

Need help to create a new DN "myNewDN: cn=testUser, ou=testOU, dc=test, dc=local"
by Mahmudur Rahman Jami 23 May '11

23 May '11

Hi, I want to create a new distinguishedName as follows (NOT as "dn: cn=testUser,ou=testOU,dc=test,dc=local"), "myNewDN: cn=testUser,ou=testOU,dc=test,dc=local" I have got a ldif with similar definition to import. I googled and found lot of examples related to "attributetype" and "objectClass" only, not related to this. Any help will be highly appreciated. Thanks, Jami

3 3

syncrepl unbinds every 24 hours
by Curt Blank 23 May '11

23 May '11

We're using openLDAP 2.3.43 on RedHat 5 ES with delta syncrepl, one master four consumers. Every 24 hours at the same time syncrepl on the four consumers disconnect from the master then don't reconnect for 60 seconds. We have retry=60 so we know that but the question is can this disconnect behavior be stopped completely? We have type=refreshAndPersist set, that to me means refresh and persist not refresh and persist for 24 hours. Data getting to the consumers is time sensitive to the point that 5 seconds might be too long and cause confusion for our users from an authentication standpoint. Is there any way to stop this syncrepl disconnect behavior? -- Curt Blank Systems Administrator Technical Services Specialist University Information Technology Services University of Wisconsin-Milwaukee e-mail: curt(a)uwm.edu phone : (414) 229-3814

3 2

TLS replication/SALS bindmethod
by Darouichi, Aziz 23 May '11

23 May '11

Hi, I configured Muti-master replication, everything worked fine till I hashed rootpw to confirm to a hardcoded password in Oracle. I configured OpenLDAP servers to us SALS. This is my configuration. provider=ldap://xxx.xxx.xxx:389 bindmethod=sasl saslmech=external starttls=yes tls_cert=/etc/pki/tls/certs/slapd.pem tls_key=/etc/pki/tls/private/ldap.pem tls_cacert=/etc/pki/tls/certs/ca-bundle.crt tls_reqcert=demand binddn="cn=ldap,dc=establishment,dc=edu" credentials={SSHA}2vNffW+5hEolqIykgH9tCpxq9jTTVSSu searchbase="dc=establishment,dc=edu" schemachecking=on type=refreshAndPersist retry="60 +" when I run ldapsearch against servers I get response from both machines. ldapsearch -H ldap://server.establishment.edu -D "cn=ldap,dc=establishment,dc=edu" -w "PASSWORD" -x -b "dc=establishment ,dc=edu" "(objectclass=*)" uid. This what I get in the logs: May 23 09:37:01 ldap1 slapd[1559]: slap_client_connect: URI=ldap://xxx.xxx.edu:389 ldap_sasl_interactive_bind_s failed (-6) May 23 09:37:01 ldap1 slapd[1559]: do_syncrepl: rid=002 rc -6 retrying May 23 09:37:58 ldap1 slapd[1559]: conn=5220 op=0 do_extended: unsupported operation "1.3.6.1.4.1.1466.20037" May 23 09:38:01 ldap1 slapd[1559]: slap_client_connect: URI=ldap://xxx.xxx.edu:389 Warning, ldap_start_tls failed (2) May 23 09:38:01 ldap1 slapd[1559]: slap_client_connect: URI=ldap://xxx.xxx.edu:389 ldap_sasl_interactive_bind_s failed (-6) May 23 09:38:01 ldap1 slapd[1559]: do_syncrepl: rid=002 rc -6 retrying Thanks

2 2

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical May 2011