openldap-technical February 2012

openldap-technical@openldap.org

98 participants
113 discussions

Password-less operation
by Jean-Luc Wasmer 08 Feb '12

08 Feb '12

Hi, The user db on my system is stored in LDAP and integrated with PAM and NSS. The LDAP db also contain address book data for each user. I would like to be able to call ldap utilities (e.g. ldapsearch) without having the user to enter his/her password everytime. I would also like for scripts running as those users to have access to the respective LDAP entries. I noticed ldapsearch supports SASL binds, so I was wondering if that could be used in conjunction with Kerberos to accomplish my goal (from what I understand, the kinit command would have to be called before ldapsearch). Is there any other way to do this? Thanks, Jean-Luc

3 2

RE: Chinese characters in mail search causes failed assertion in slapd
by Alfie John 07 Feb '12

07 Feb '12

On Tue, Feb 7, 2012, at 11:34 AM, Charles T. Brooks wrote: > Non-english character sets are going to become part of hostnames and > DNS. That's inevitable. > > Mail addresses are based on DNS hostnames. > > Ergo, mail attributes will one day need to support all possible > characters. Thanks for that. It makes sense and it was enough to convince me to submit a bug. Alfie -- Alfie John alfiej(a)opera.com

2 1

SYNC_ID_SET missing?
by Marc Patermann 07 Feb '12

07 Feb '12

Hi, on a consumer with two replicated databases I get this on startup: # grep sync Feb 7 17:16:52 rfas099 slapd[4263]: Config: ** successfully added syncrepl rid=401 "ldap://master.foo.de" Feb 7 17:16:52 rfas099 slapd[4263]: line 124 (syncrepl ***) Feb 7 17:16:52 rfas099 slapd[4263]: Config: ** successfully added syncrepl rid=402 "ldap://master.foo.de" Feb 7 17:16:52 rfas099 slapd[4264]: do_syncrep2: rid=401 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Feb 7 17:16:52 rfas099 slapd[4264]: do_syncrep2: rid=402 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Feb 7 17:16:52 rfas099 slapd[4264]: do_syncrep2: rid=402 LDAP_RES_INTERMEDIATE - REFRESH_DELETE There is do_syncrep2: rid=402 LDAP_RES_INTERMEDIATE - SYNC_ID_SET for one database, but not for the other. From the list archive I got this: "The SYNC_ID_SET messages in this case are the provider telling the consumer what entries it has, so the consumer can delete entries not present on the provider. This is normal operation in some situations. It shouldn't happen too often if you specify a sufficient sessionlog size on the provider." http://www.openldap.org/lists/openldap-technical/201104/msg00079.html So, if there is no SYNC_ID_SET for a database, is this a bad sign? Marc

1 0

Non-personal mail accounts
by Nick Milas 07 Feb '12

07 Feb '12

Hello, We are storing user accounts in OpenLDAP. Main classes used are: objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: eduPerson User email address(es) is (are) stored in the "mail" attribute and are also used by Postfix (which uses virtual accounts based on LDAP). I would like to define some email accounts (with associated email addresses) which do NOT belong to a particular user; so, in these accounts a mail attribute would not be associated (both conceptually and practically) with a person objectClass. Is there a suggestion on which existing objectClass(es) (and associated schemas, if applicable) should we use for such use? I thought of "account" (defined in cosine.schema), but it does not accept a mail attribute. The idea would be to use something like an extended "account" objectClass, (or "account" itself, with some additional auxiliary class to define an email address) together with simpleSecurityObject to allow definition of a password. Any experiences, suggestions will be appreciated. Thanks, Nick

2 1

dynlist and DSA IT Control
by Angel L. Mateo 07 Feb '12

07 Feb '12

Hello, I have an openldap using dynlist to get some attributes of the entries. When I manually performs search, I can get these attributes (obtained through the dynlist overlay) without any problem, but when an application (a CAS server to be precise) tries to do the same search, with the same bind dn, I can't see those attributes. I have used wireshark to check any difference and I have found that the only difference between my search and the one made by the application is that this one use a control parameter in the search, to be precise the control 2.16.840.1.113730.3.4.2.. Then I have checked and I have realized that if I used the -M option then I get the same behaviour and I can't get the attributes from the dynlist overlay. As far as I know I can't configure this behaviour in my application (although I'm also looking for any way to configure CAS not to use that control), so, why openldap does not use the dynlist overlay when this dsa it control is used? Is there any way to change this behaviour? Any help? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

2 2

Re: Global modifications
by Nick Milas 07 Feb '12

07 Feb '12

On 31/1/2012 9:52 μμ, Charles T. Brooks wrote: > T > Hi Charles, (Note that your last message was strangely encoded and I had some trouble reading it.) Thanks for all this info. I noticed that most (if not all) of the sendmail.schema definitions are actually included in the misc.schema bundled in openldap package. I guess I could use: inetLocalMailRecipient objectClass (attribute: mailLocalAddress); the only thing that disturbs me is that mailLocalAddress does not have a substring match rule (contrary to mail attribute) and I am afraid this might cause issues under particular scenarios... Best regards, Nick.

1 0

Help on ACL
by Hanns Mattes 06 Feb '12

06 Feb '12

Dear list-members, I want to grant write access to users to a kind of personal addressbook. User-DNs are for example: uid=user(a)example.com,ou=example.com,ou=virtualmail,dc=my,dc=company The personal Addressbook is stored under ou=user(a)example.com,ou=addressbook,dc=my,dc=company and an entry in the addressbook looks: uid=someuniqeid@mail.my.company,ou=user@example.com,dc=addressbook,dc=my,dc=company so far I didn't have success with constructing an ACL, which grants write access. I've tried modifying the example found in http://www.horde.org/apps/turba/docs/LDAP (in fact that's the application, which the addressbook is for), but no success so far (but a lot of "no such object"-entries in the log). Any help appreciated Regards Hanns

2 2

LDAP authentication fails
by Abhinav Jauhri 06 Feb '12

06 Feb '12

Hi, I have two client machines(CLIENT1 & CLIENT2) on which users are authenticated using a LDAP_SERVER. They also have autofs to mount the home directory at login. The issue is that on CLIENT1 authentication and mount works fine, but not on CLIENT2. Although, both have the same configuration files. Errors on CLIENT2: *Case 1:* When PasswordAuthentication is set to No in sshd_config ssh user(a)client2.isl.com <user(a)client1.isl.com> Permission denied (publickey). *Case 2*: When PasswordAuthentication is commented in sshd_config ssh user(a)client2.com <user(a)client1.com> user(a)clent2.isl.com <user(a)clent1.isl.com>'s password: Linux client2.isl.com <http://client1.isl.com> 2.6.31-14-generic #48-Ubuntu SMP Fri Oct 16 14:05:01 UTC 2009 x86_64 Creating directory '/home/user'. Unable to create and initialize directory '/home/user'. Configurations files on CLIENT2: 1) /etc/pam.d/sshd auth required pam_env.so # [1] auth required pam_env.so envfile=/etc/default/locale @include common-auth account required pam_nologin.so @include common-account @include common-session session optional pam_motd.so # [1] session optional pam_mail.so standard noenv # [1] session required pam_limits.so session required pam_mkhomedir.so skel=/etc/skel/ umask=0022 @include common-password 2) /etc/ldap.conf base dc=auth,dc=ldap_server,dc=isl,dc=com uri ldaps://192.169.214.54 ldap_version 3 rootbinddn cn=admin,dc=ldap_server,dc=isl,dc=com pam_password md5 ssl start_tls ssl on tls_checkpeer yes tls_cacertfile /etc/ssl/certs/ldap_server.isl.com.pem 3) /etc/nsswitch.conf passwd: compat ldap group: compat ldap shadow: compat ldap hosts: files dns networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis 4) /etc/ssh/sshd_config Port 22 Protocol 2 HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_dsa_key UsePrivilegeSeparation yes KeyRegenerationInterval 3600 ServerKeyBits 768 SyslogFacility AUTH LogLevel INFO LoginGraceTime 120 PermitRootLogin yes StrictModes yes RSAAuthentication yes PubkeyAuthentication yes #AuthorizedKeysFile %h/.ssh/authorized_keys IgnoreRhosts yes RhostsRSAAuthentication no HostbasedAuthentication no PermitEmptyPasswords no ChallengeResponseAuthentication no #PasswordAuthentication no X11Forwarding yes X11DisplayOffset 10 PrintMotd no PrintLastLog yes TCPKeepAlive yes AcceptEnv LANG LC_* Subsystem sftp /usr/lib/openssh/sftp-server UsePAM yes 5) /etc/auto.home * 192.169.214.54:/home/& 6) /etc/auto.master +auto.master /home /etc/auto.home Also, there exist no local user by the same name in any of the client machines. The public keys are correctly inserted in the //LDAP_SERVER/home/user/.ssh/authorized_keys or else login wouldn't have been possible on CLIENT1. `getent passwd` on CLIENT2 shows all LDAP users. Any suggestions would be of great help. Thanks! -- Abhinav

1 0

Search on whole tree gives result, search on subtree not
by Karsten Heymann 06 Feb '12

06 Feb '12

Hi, I've started playing around with slapd (2.4.23-7.2 from debian squeeze) again and stumbled across a very strange phenomenon: When searching the whole tree for an entry it is found immediately: 0|kheymann@ds1-01:~$ ldapsearch -x -h localhost -b o=mycompany uid=aaa uid # extended LDIF # # LDAPv3 # base <o=mycompany> with scope subtree # filter: uid=aaa # requesting: uid # # aaa, 2, customers, marketing, mycompany dn: uid=aaa,contractID=2,ou=customers,ou=marketing,o=mycompany uid: aaa # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 But when searching any of the intermediate subtrees, no result is returned after a short delay: 0|kheymann@ds1-01:~$ ldapsearch -x -h localhost -b ou=marketing,o=mycompany uid=aaa uid # extended LDIF # # LDAPv3 # base <ou=tc,o=mycompany> with scope subtree # filter: uid=aaa # requesting: uid # # search result search: 2 result: 0 Success # numResponses: 1 The uid attribute is indexed with 0|root@ds1-01:/etc/ldap/slapd.d/cn=config# grep -e ' uid ' *ldif olcDatabase={1}hdb.ldif:olcDbIndex: uid eq and slapindex generated the index without any error messages. This also seems to happen only with entries created while the slapd is running while the entries from the initial import do not whoe this. This seems very weird to me. Any hints what could cause this behaviour and what could possibly fix it? Thanks in advance, Karsten

3 4

Does openldap support multicore CPU.
by arun.sasi1＠wipro.com 06 Feb '12

06 Feb '12

Hello Team, I have a small question... does OpenLDAP support multi core CPU... Thanks & Regards, Arun Sasi V ------------------------------------------------------------------------ ------------------------------------------------------------- Sr. Engineer - Server Management (UNIX), Wipro Infotech (GSMC) |Direct +918213029356 Mob: +919731031500 | E: arun.sasi1(a)wipro.com <mailto:koresh.dash@wipro.com> Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

3 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical February 2012