openldap-technical September 2011

openldap-technical@openldap.org

101 participants
119 discussions

How do you have LDAP Setup for Apps
by criderkevin＠aol.com 29 Sep '11

29 Sep '11

I'm learning and testing different ways of configure my LDAP to handle multiple apps. I gave up on groupofnames because I couldn't get searches to pull out the Users in a Group. I have probably 6 or so apps that will use the LDAP. I am leaning towards a simple structure, where each app has it's own branch in the LDAP. My reasoning is: it's easy to configure, may make ACL's easier to setup and manage, it will make searches easier to setup and test, and...why not...after all this isn't a database and duplicated "people" records don't matter. We may end up with 2 synching LDAPS, one for our network and email, and the other for our other apps, simply because the email system requires a very specific structure. Just curious to hear from the more experienced what they do in their structure to handle multiple apps, and how sound my thinking is.

6 6

pwcheck module for slapo-ppolicy
by Lukas Grässlin 29 Sep '11

29 Sep '11

Hi there, I wrote a new pwcheck module for the slapo-ppolicy overlay which is able to handle multiple different policies. My problem was: I have multiple password policies which are applied to different users. The policies differ in strength etc. The problem was that with the only pwcheck modul you can find on the net (https://ltb-project.org/svn/openldap-ppolicy-check-password/trunk/) you just define one 'policy-thing' which will be checked if check-password.so is run. I wanted to have something were you also can define multiple policies which also can differ, so I wrote my own module which reads two config files: $CONFDIR/ppolicies: There are the policies defined. Example: [Default] min_len = 8 min_digit = 1 min_lower = 1 min_special = 1 min_upper = 1 $CONFDIR/users: These file holds the relation between users and policies: uid=lukas,ou=People,dc=example,dc=com : Default Well, it would have been nicer if that policy definition & co would also be stored in ldap, but the config-file-way was the faster one as it had to be finished quick. Whatever, maybe some of you could need this or improve it: http://dl.dropbox.com/u/32193848/pwcheck.tar.bz2 You have to build it within ldap (like the old one). So put it there: $ldapsrcdir/contrib/slapd-modules -- Lukas Grässlin Software Developer Collax GmbH . Basler Str. 115a . 79115 Freiburg . Germany p: +49 (0) 89-990 157-23 Collax - Flexible IT. Geschäftsführer: Bernd Bönte, Boris Nalbach Amtsgericht München, HRB 173695 USt-ID: DE270819312

3 3

Pass-Through Authentication
by Tim Gustafson 28 Sep '11

28 Sep '11

How hard would it be to create a new pass-through authentication mechanism (something other than SASL) for OpenLDAP? Can this be done in an overlay? The reason I ask is that I'm investigating using two-factor authentication. If I understand the marketing materials correctly, both the RSA SecureID system and the WiKID system expose a RADIUS server that clients can authenticate with. The suggested set-up seems to be: OpenLDAP -> SASL -> pam -> RADIUS (on 3rd party token server) This seems like a lot of intermediaries, and a lot of potential "breaking" points. I wonder if there isn't any way to just cut the middle man out, so to speak, and have OpenLDAP talk directly to a RADIUS server, eliminating the other layers inbetween: OpenLDAP -> RADIUS (on 3rd party token server) Perhaps a password scheme like: {RADIUS}user@radius-server I've worked with RADIUS before, and it's not all that bad from a client implementation perspective, especially if you ignore the challenge/response part of the protocol (which most simple authentication services seem to do). Or should I just shut up and use the first method? :) -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Tim Gustafson tjg(a)soe.ucsc.edu Baskin School of Engineering 831-459-5354 UC Santa Cruz Baskin Engineering 317B -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

3 3

keep posixGroup, memberUID and groupOfNames with member synchronous
by andreas.moroder＠sb-brixen.it 28 Sep '11

28 Sep '11

Hello, for samba, pam on linux, squid and others we use the standard posixGroup with memberUID attributes for the groupmemebershios. Now we would like to user the LDAP autentication module in the checkpoint firewall. This expects the members of a group as groupOfNames member attributes with the full dn . Is there a way to configure openLDAP to keep keep the groupofNames automatically in sync with the posixGroup ? Thanks Andreas

2 1

OpenLDAP Proxy to Active Directory
by Allen, Dedrick 28 Sep '11

28 Sep '11

I am currently attempting to configure our OpenLDAP 2.4.26 (on SUSE Enterprise 10) server to act as an proxy to Active Directory as well as using a local database. The local database works fine but I cannot for the life of me get the ldap backend to authenticate/bind correctly to the AD ldap server. I can use ldapsearch to search AD just fine with the credentials passed as follows: ldapsearch -x -h ldap.mydomain.com -D 'myldapuser' -w 'myldappw' -b 'dc=mydomain,dc=com' '(sAMAccountName=myusername)' Returns all the associated data of "myusername" from AD. Here is the section of my slapd.conf for my databases and backends. I have read several different sites on how to configure this and they all use different methods and claim it works for them. None has worked for me. I continue to get bind errors. Any guidance would be much appreciated. database bdb suffix dc=zlinux,dc=mydomain,dc=com rootdn cn=admin,dc=zlinux,dc=mydomain,dc=com rootpw myrootdnpw directory /usr/local/openldap/var/openldap-data index objectClass,uidNumber,gidNumber eq index cn,sn,uid,displayName pres,sub,eq index memberUid,mail,givenname eq,subinitial # # database ldap suffix "dc=Company Users,dc=mydomain,dc=com" uri ldap://ldap.mydomain.com idassert-bind bindmethod=simple binddn="cn=myldapuser,dc=Company Service Accounts,dc=mydomain,dc=com" credentials=myldappw mode=none idassert-authzFrom "dn.exact:cn=cn=myldapuser,dc=Company Service Accounts,dc=mydomain,dc=com" chase-referrals no overlay rwm rwm-map objectclass account user rwm-map attribute uidNumber employeeID rwm-map attribute uid sAMAccountname rwm-map attribute cn name rwm-map attribute sn sn rwm-map attribute mail mail rwm-map attribute company company rwm-map attribute entry entry rwm-map attribute userPassword unicodePassword rwm-map attribute * Thanks Dedrick ----------------------------------------------------- Please see the following link for the BlueCross BlueShield of Tennessee E-mail disclaimer: http://www.bcbst.com/email_disclaimer.shtm

3 3

Installing OpenLDAP OpenSSL not found
by W.Siebert＠t-systems.com 28 Sep '11

28 Sep '11

Hello, I'm trying to install the openldap-2.4.26 on a RHEL 5 server. OpenSSL Version 0.9.8e installed and works pretty with other application e.g. Radiator Header files are present: # find / -name "ssl.h" /usr/include/openssl/ssl.h ./configure CPPFLAGS="-I/usr/include -I/usr/include/openssl/" Result: ................... checking openssl/ssl.h usability... no checking openssl/ssl.h presence... no checking for openssl/ssl.h... no checking gnutls/gnutls.h usability... no checking gnutls/gnutls.h presence... no checking for gnutls/gnutls.h... no checking nssutil.h usability... no checking nssutil.h presence... no checking for nssutil.h... no configure: error: MozNSS not found - please specify the location to the NSPR and NSS header files in CPPFLAGS and the location to the NSPR and NSS libraries in LDFLAGS (if not in the system location) Where is my mistake ? Can you help me please Kind Regards Waldemar Kind regards Waldemar Siebert

3 3

How to install ppolicy?
by Дмитрий Огородников 28 Sep '11

28 Sep '11

Hi dear all I need to install ppolicy overlay on my slapd configured via "cn=config". All that I can find for "cn=config" is a manpage (without describing installation), posts in blogs (mostly very poor) and this mailing list (with many unsolved problems). Is there an initial installation manual, an official documentation or so? Thanks in advance Dmitry

2 1

Startup problem
by Andreas Rudat 28 Sep '11

28 Sep '11

Hello, I have big problems to setup my ldap server. I want it to use for samba later. Here my config. Samba 3.4.7 slapd 2.4.21 ldap.conf BASE dc=stud,dc=intern URI ldap://127.0.0.1 slapd.conf include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema database bdb suffix „dc=stud,dc=intern" rootdn „cn=root,dc=stud,dc=intern" rootpw test directory /var/lib/ldap admin.ldif dn: cn=root,dc=stud,dc=intern objectclass: organizationalRole cn: root uid: root uidNumber: 0 gidNumber: 100 ldapadd -D "cn=root,dc=stud,dc=intern" -x -W -f admin.ldif Enter LDAP Password: ldap_bind: Invalid credentials (49) debug output slapd starting connection_get(10) ldap_read: want=8, got=8 0000: 30 2d 02 01 01 60 28 02 0-...`(. ldap_read: want=39, got=39 0000: 01 03 04 19 63 6e 3d 72 6f 6f 74 2c 64 63 3d 73 ....cn=root,dc=s 0010: 74 75 64 2c 64 63 3d 69 6e 74 65 72 6e 80 08 54 tud,dc=intern..t 0020: 65 73 74 65 72 33 32 est ldap_read: want=8 error=Resource temporarily unavailable => ldap_bv2dn(cn=root,dc=stud,dc=intern,0) <= ldap_bv2dn(cn=root,dc=stud,dc=intern)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=root,dc=stud,dc=intern)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=root,dc=stud,dc=intern)=0 send_ldap_result: err=49 matched="" text="" ldap_write: want=14, written=14 0000: 30 0c 02 01 01 61 07 0a 01 31 04 00 04 00 0....a...1.... connection_get(10) ldap_read: want=8, got=0 any idea? Much Thanks Andreas

2 1

deref overlay
by Chris Card 28 Sep '11

28 Sep '11

Hi, I'm trying to use the deref overlay with openldap 2.4.26. I have added this to my slapd.d config: dn: olcOverlay={2}deref,olcDatabase={1}bdb,cn=configobjectClass: olcOverlayConfigobjectClass: olcConfigobjectClass: topolcOverlay: {2}deref which is my guess at what the config for the deref overlay should look like, but when I try and use it with ldap search I get this: /opt/ods/openldap/bin/ldapsearch -h localhost -x -w ***** -D "cn=admin,dc=********,dc=com" -b "dc=**********,dc=com" -E\!deref=member:mail '(objectclass=groupOfNames)'# extended LDIF## LDAPv3# base <dc=blackspider,dc=com> with scope subtree# filter: (objectclass=groupOfNames)# requesting: ALL# with dereference critical control# # search resultsearch: 2result: 12 Critical extension is unavailabletext: critical control unavailable in context # numResponses: 1 slapd was built with these options: ./configure --with-threads=posix \ --with-tls \ --with-cyrus-sasl \ --enable-ldap \ --enable-debug \ --prefix=%{ldapserverdir} \ --libdir=%{ldapserverdir}/%{_lib} \ --enable-spasswd \ --enable-overlays \ --enable-modules \ --enable-slapi so I assume that slapd has the deref overlay built into it ok. I guess my config for the deref overlay is wrong or incomplete. I looked for a slapo-deref man page, but couldn't find one. Is there documentation of the deref overlay config anywhere? Chris

1 0

HP-UX, BDB cache size, db_private
by Michael Ströder 27 Sep '11

27 Sep '11

HI! In a project we have to use HP-UX 11.31 for the OpenLDAP server. But for whatever reason it's not possible to configure more than a certain limit of shared memory cache on this system. The admins responsible for this system claim that there's no limit set for this system user and there's still plenty of RAM...hmmm...does anybody here have a clue? (I'm not familiar with HP-UX at all and the admin files cannot be viewed.) Now they suggested to set BDB-option db_private to use the heap instead of file-based shared memory. I pointed out that the caveats are that 1. one cannot query the cache hit ratio etc. with db_stat and 2. cache is always empty on server restart. db_private turned out to be even worse on this system but still this question: Anymore issues with db_private? Thanks in advance. Ciao, Michael.

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical September 2011