openldap-technical April 2012

openldap-technical@openldap.org

76 participants
80 discussions

CentOS 6.2 ldap client -> CentOS 5.8 server = all fields *but* password (kinda)?
by Phillippe Welsh 12 Apr '12

12 Apr '12

I know C6 client -> C5 ldap server works. I have a couple of systems that do it. I have one crazy system that just went into production that does not properly authenticate. Here is the scenario: 1. "getent passwd" will show *all* users *and* passwords. 2. "getent passwd USERNAME" will show all user info and *NOT* the password(the field is a "*"). Has anyone come across this behavior? There must be some option I messed up and did not realize it. I have checked for differences from a working system in nsswitch.conf, authconfig, sssd.conf, pam_ldap.conf, nslcd.conf and ldap.conf with no luck. I have looked at "rpm -V openldap" and "rpm -V openldap-clients" with no luck. This is making me crazy! It has to be something simple. Additionally, I have "nscd -i passwd" and tried to stop/start both the nslcd and nscd daemons. Google has not been of very much help with the pattern of search I've tried so far, either... Thanks for any help pj

1 0

Re: slow or inconsistent syncrepl
by Amol Kulkarni 12 Apr '12

12 Apr '12

As per the recommendations, we have done following : 1. Installed openldap 2.4.30 on master & all replicas. 2. We have cascaded the replication by adding another replica in lan which acts as provider for the consumers on wan. There are definite improvements but still we are observing following problem : 1. Bulk changes (1000 records changed) in LDAP on the provider, do not replicate to replicas with busy ldap unless a) the records are updated in smaller batches on provider b) the replication database on the consumer is reset - i.e ldap restarted with -c rid=001 Is there a buffer/queue at the consumer side which overflows? Can it be tuned? Does a busy server drop replication requests? Thanks, Amol. ----- Original Message ----- From: Quanah Gibson-Mount Sent: 03/12/12 03:36 AM To: Amol Kulkarni Subject: Re: slow or inconsistent syncrepl --On Sunday, March 11, 2012 8:51 AM +0100 Amol Kulkarni <amolkulkarni(a)gmx.com> wrote: > > I see that I'm outdated in my tuning as per > http://wiki.zimbra.com/wiki/OpenLDAP_Performance_Tuning. > I'll do these changes and observe the servers. > > In the mean time a new observation regarding syncrepl is that if I do > ldapmodify for 5 - 10 entries in one go the changes get replicated but if > I change about 300 entries in one go, then some entries do not get > replicated on some servers. These changes dont get replicated until I > change those entries again. > > Does this indicate provider resource problem or consumer resource problem > ( or normal behaviour ) ? Changes failing to replicate is not a desired behavior. It is expected to occur in older known buggy releases. If all of your masters & replicas are on 2.4.30, hopefully you won't see that issue any more. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

home directory of added user with him profile environment
by stefano malini 11 Apr '12

11 Apr '12

Hi, i installed an ldap server on debian squeeze. i've to add every user but i don't how to set him home directory with him profile environment. The home directory can be created using mkdir? how to keep the profile environment from /etc/skel? thanks

1 0

RE24 testing call #1 (2.4.31)
by Quanah Gibson-Mount 10 Apr '12

10 Apr '12

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.31 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

6 5

Referral Problem with SQL Backend
by Robert Eikermann 10 Apr '12

10 Apr '12

Hi, I have a problem with my Openldap Server 2.4.23 with SQL Backend. I have configured a referral to another Openldap server, but the referral dn is always the same as the bind dn from my ldapsearch command. So the referral dn is overwritten with the bind dn. The server localhost:389 has rootdn="dc=sselab,dc=de" And localhost:390 has rootdn="dc=tim,dc=sselab,dc=de" Following are the configuration and the Log files of the LDAP Server with SQL Backend at Loglevel -1. In the Logfile you can see the starting of the server + the search "ldapsearch -xLLL -h localhost:389 -b dc=sselab,dc=de". I think at line 4114 one can see how the referral is used. Slapd.conf : <http://pastebin.com/tvtdNaZ6> http://pastebin.com/tvtdNaZ6 sql attribute mappings: <http://image-upload.de/image/WcDeaB/fd191aa422.png> http://image-upload.de/image/WcDeaB/fd191aa422.png sql entries: <http://image-upload.de/image/qGiBOY/51496a9462.png> http://image-upload.de/image/qGiBOY/51496a9462.png sql object classes: <http://image-upload.de/image/Rei0X3/4f6b2b43f5.png> http://image-upload.de/image/Rei0X3/4f6b2b43f5.png sql oc mapping: <http://image-upload.de/image/TRscIQ/7141e04af6.png> http://image-upload.de/image/TRscIQ/7141e04af6.png sql referral: <http://image-upload.de/image/LGxZKQ/28773fadf7.png> http://image-upload.de/image/LGxZKQ/28773fadf7.png ldap Log: <http://pastebin.com/N8NCyLzt> http://pastebin.com/N8NCyLzt To demonstrate the behavior: Search for the referral Object: user@user-desktop:~$ ldapsearch -M -xLLL -h localhost:389 "(objectClass=referral)" '*' ref dn: dc=tim,dc=sselab,dc=de objectClass: referral objectClass: extensibleObject dc: tim ref: ldap://localhost:390/dc=tim,dc=sselab,dc=de# which is exactly what I want! But searching all objects: user@user-desktop:~$ ldapsearch -xLLL -h localhost:389 -b dc=sselab,dc=de dn: dc=sselab,dc=de objectClass: dcObject dc: sselab . # refldap://localhost:390/dc=sselab,dc=de??sub Results with the wrong dn in refldap! Search with the dc=tim DN : user@user-desktop:~$ ldapsearch -xLLL -h localhost:389 -b dc=tim,dc=sselab,dc=de Referral (10) Referral: ldap://localhost:390/dc=tim,dc=sselab,dc=de??sub If you need more Information please let me know. Best regards Robert Eikermann

2 1

Minimum length for uid attribute
by Priscilla V 10 Apr '12

10 Apr '12

Hi all, I am trying to use openldap users for authentication with postfix. For users with uid length 2 it says user unknown in local recipient table. But ldapsearch returns the result if queried. Is there any configuration for minimum length or what could be the issue? Kindly help. Regards Priscilla

3 3

Translucent overlay and local entities
by Eugene Vilensky 09 Apr '12

09 Apr '12

Greetings, Pardon if this is an RTFM, but is it possible to store entities locally using the translucent overlay? The overlay works for what we are trying to do when it comes to search and modifying attributes on an entry, but I would like to create a local groupofnames, consisting of remote UIDs. For example, this LDIF imports OK: #!RESULT OK #!CONNECTION ldap://xxxxx #!DATE 2012-04-09T16:01:33.961 dn: cn=instructors,ou=Groups,dc=xxxx,dc=zzz changetype: add objectClass: groupofnames member: uid=nate member: uid=penelope member: uid=rhonda cn: instructors But searching for it does not bring back a result. However, it must have gone somewhere since if I try to import the same LDIF again: #!RESULT ERROR #!CONNECTION ldap://xxxxx #!DATE 2012-04-09T16:21:28.221 #!ERROR [LDAP: error code 68 - Entry Already Exists] Kind regards, Eugene

1 0

Re: Hashing the userPassword
by Michael Ströder 09 Apr '12

09 Apr '12

Please post your follow-ups on the mailing list so others can respond and learn as well. Suneet Shah wrote: > So if create a user and then set the password on an existing user then, the > password-hash attribute will work? And I can send the password to OpenLDAP in > clear text? Yes. Also note the other poster's hint about using slapo-ppolicy and ppolicy_hash_cleartext if you're allowed to configure the server. > I am curious - if the client hashes the password, in my case it would be my > java program, how will openldap use that hashed password during authentication? > > Wouldnt both (openldap and my java program) need to have the salt used for > hashing? And in this case, only my java program would have that salt. The salt is part of the userPassword value. See more information in OpenLDAP's FAQ-O-MATIC: http://www.openldap.org/faq/data/cache/419.html Ciao, Michael.

2 3

ldapadd: invalid format (line 5) entry for LDAP replication
by Brajabasi Padhy 09 Apr '12

09 Apr '12

Hello Sir, I'm trying to set up a LDAP provider server, but facing problime with folowing command sudo ldapadd -Y EXTERNAL -H ldapi:/// -f provider_sync.ldif I followed all steps provided in th following link, but still failing. https://help.ubuntu.com/10.04/serverguide/C/openldap-server.html I'm getting this error ldapadd: invalid format (line 5) entry: "olcDatabase={1}hdb,cn=config" Please help me if possible. The provider_sync.ldif file copied from the above link. Thnaks for your support. Brajabasi

1 0

Replication and user password change
by Jacques Foucry 06 Apr '12

06 Apr '12

Hello the list, I'm new here, new at OpenLDAP and I have an issue. I've search for many time now an explanation but I saw nothing. Here is my problem. I ran a OpenLDAP server on a Debian VM # slapd -V @(#) $OpenLDAP: slapd 2.4.11 (Jul 23 2010 21:37:26) $ @barber:/build/buildd-openldap_2.4.11-1+lenny2-amd64-WJ2jlD/openldap-2.4.11/debian/build/servers/slapd I have many direct client (desktop computer who query the ldap server) and everything work well. I made this ACL on slapd.conf to allow users to change there password: access to attrs=userPassword,shadowLastChange by self write by dn="cn=syncuser,dc=example,dc=com" read by anonymous auth by * none access to * by self write by * read And it works fine. These are the only ACL I have. I also have 2 replications of this LDAP Server. syncrepl rid=002 provider=ldaps://ldap.example.com type=refreshOnly interval=00:01:00:00 retry="60 10 300 +" filter="(objectClass=*)" scope=sub attrs="*" bindmethod=simple schemachecking=off searchbase="dc=example,dc=com" binddn="cn=syncuser,dc=example,dc=com" credentials=youdonthavetoknow tls_reqcert=never The replications work well to and user can connect to those replication computer (I don't have client of those replication). But the trouble is when a user, connected to these replication try to change his password: % passwd Enter login(LDAP) password: New password: Re-enter new password: LDAP password information update failed: Strong(er) authentication required modifications require authentication passwd: Permission denied passwd: password unchanged In the /var/log/auth.log file I found: Apr 4 16:10:45 ovhstorage sshd[22056]: pam_unix(sshd:account): password for user test will expire in 4 days Apr 4 16:10:45 ovhstorage sshd[22056]: Accepted publickey for test from 88.162.182.86 port 49955 ssh2 Apr 4 16:10:45 ovhstorage sshd[22056]: pam_unix(sshd:session): session opened for user test by (uid=0) Apr 4 16:10:48 ovhstorage passwd[22064]: pam_unix(passwd:chauthtok): user "test" does not exist in /etc/passwd Apr 4 16:10:55 ovhstorage passwd[22064]: pam_unix(passwd:chauthtok): user "test" does not exist in /etc/passwd I know that modification must be done on the master server,but how can I send modifications to the master. Did I have to use "referrals"? Thanks in advance for giving the correct pointers. Best regards Jacques Foucry

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical April 2012