openldap-technical February 2013

openldap-technical@openldap.org

68 participants
72 discussions

ACL and New users binding as anonym haveous
by cbulist 15 Feb '13

15 Feb '13

Hi, We have openldap 2.4.33 running without problem. In our first configuration we created a simple ACL in order to get access to every user. access to * by * read Then we changed it to: access to * by self write by anonymous auth by * none This ACL rules works perfectly with users that were logged by ssh before to change but users created and that never were logged after this ACL can not login. I review the openldap log file and I can see the user is trying to bind using anonymous instead of its uid. Are there any way to send the full user DN (uid=user,ou=People,dc=company,dc=com) to Ldap? Thanks in advance!

2 1

Advice request : LDAP server discovering
by Olivier 15 Feb '13

15 Feb '13

Hello, in the case I was not knocking at the right door, please accept my apologies, but as I suspect that some of you could provide some advices I post this here. In summary the issue I try to solve is "which mecanism should I deloy to route ldap requests to the right ldap server". Here is the situation : My hosts and services are distributed in 3 distinct operationnal sites (site A, site B, site C). I have three ldap servers (one on each site) that are configured to be exact replication of the others (I use openldap syncrepl in multimaster mode). On the client side (linux boxes), authentication on my hosts are based on ldap (posixaccounts/nsswitch/pam/ldap.conf and sssd). I also have deployed things such as centralized sudoer rules in ldap. At this stage, I have configured hosts so that ldap queries are sent to "the closer" ldap server first, then to another one if the first timeout : nsswitch.conf tells to query ldap (sss), and here is an extract of my ldap.conf for a host located in site A: > URI ldap://ldapA.mydom.fr ldap://ldapB.mydom.fr ldap://ldapC.mydom.fr For a host located in site C, I have declared this in ldap.conf: > URI ldap://ldapC.mydom.fr ldap://ldapB.mydom.fr ldap://ldapA.mydom.fr I would like to change that. Rather than declaring three ldap server references in configurations on the client side, I would like to implement some sort of mecanism thanks to which I would only need to declare one reference on the client side (routing ldap queries to ldap service, not to ldap servers). I see different possibilities to do that, such as setting up some sort of "heartbeat" or using some DNS trick such as multiple IN A for the same DNS RR, using sortlist option, or DNS SRV records ( _ldap._tcp. ) See: http://www-01.ibm.com/software/network/directory/library/publications/jndid… http://www.rjsystems.nl/en/2100-dns-discovery-openldap.php http://www.ietf.org/proceedings/50/I-D/ldapext-locate-05.txt http://ipamworldwide.com/bind-options/sortlist-option.html Intuitively, my preference would go to use an "_ldap._tcp" srv record, but I'm not sure if nsswitch (or clients such as sssd) would interpret this kind of DNS responses correctly (what I mean by "correctly" is "client would query an up and running ldap server found in the NS response list." Even better: "would query the faster one to respond" ). Any advice ? Experience ? Article to read ? Thanks, --- Olivier

2 2

Why is DN invalid?
by David Cunningham 13 Feb '13

13 Feb '13

Hello all, I've installed openldap 2.4.33 on OpenSUSE 11 and am trying out the perl backend. I got my certificate issues sorted out and everything seems good - until I search our university server which returns dn's such as: unbCaId=9e3454b178993cc73619606d22c7882755c9cb0d,ou=people,dc=unb,dc=ca When I return entry from search routine in perl module I get error "str2entry: entry -1 has invalid DN". I can't see anything wrong with the dn (other than it is ugly). Are there length restrictions for individual components of a dn? All similar problems I've discovered on the net are issues with commas, plus signs, quotes or unicode characters. No doubt there is something I've overlooked so please point me in the right direction. cheers, Dave C.

3 2

how to compile an openldap dll to use with LabVIEW?
by Amrbar, Mehran (356E) 12 Feb '13

12 Feb '13

Hi, I want to know how can I compile the openldap C library into a dll so I can use it with LabVIEW? Or if a dll with header is already available? Thanks, Mehran

1 0

inconsistent sshPublicKey entries
by Michael W. Lucas 12 Feb '13

12 Feb '13

Hi, I'm running OpenLDAP 2.4.21 on FreeBSD. We do a lot of administration via phpLDAPAdmin, but I do some command-line stuff. And I've seen an inconsistency between the two in the ldapPublicKey object class. When I look in phpLDAPAdmin, my SSH keys start like this: ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAw9zmtbk8b... ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDfZ/p... If I do a ldapsearch, however, I get: sshPublicKey:: c3NoLXJzYSBBQUFBQjNOemFD.... sshPublicKey: ssh-rsa AAAAB3NzaC1 The ssh-rsa or ssh-dss string is missing from all public keys except the last one displayed. The entries without a key type have a double colon. slapcat behaves like ldapsearch. But I have to believe that the key type information is in the database, somewhere, because phpLDAPAdmin reports it's there. I didn't notice this while we used the LPK patch for our SSH servers, but we're now migrating to the official OpenSSH AuthorizedKeysCommand feature. I have a script to retrieve the keys, but my SSH servers only recognize the last key. It rejects the others because they don't have a key type attached. Any suggestions? Thanks, ==ml -- Michael W. Lucas http://www.MichaelWLucas.com/, http://blather.MichaelWLucas.com/ Latest book: SSH Mastery http://www.michaelwlucas.com/nonfiction/ssh-mastery mwlucas(a)michaelwlucas.com, Twitter @mwlauthor

3 3

bdb_equality_candidates: cn=config
by Denny Schierz 12 Feb '13

12 Feb '13

hi, I get lot of messages like: <= bdb_equality_candidates: (ipHostNumber) not indexed <= bdb_equality_candidates: (ipHostNumber) not indexed <= bdb_equality_candidates: (memberUid) not indexed <= bdb_equality_candidates: (title) not indexed [...] and some more. I don't know why it happens, because I have all attributes in my index: olcDbIndex: ipHostNumber eq olcDbIndex: memberUID eq olcDbIndex: title eq [...] and also the files are there and automatically created: /var/lib/ldap/ou-company/{ ipHostNumber.bdb, memberUid.bdb, title.bdb } All index attributes are added via cn=config with my LDAP Browser. Also restarts doesn't help. I use Debian Squeeze packages in a n-way master configuration (two nodes) Any suggestions? cu denny

3 3

ldapsearch and LDAP_CONTROL_VALSORT
by Benin Technologies 12 Feb '13

12 Feb '13

Hi, I'm trying to use ldapsearch with LDAP_CONTROL_VALSORT (1.3.6.1.4.1.4203.666.5.14 ), does anybody know how to do that ? Here's what I did and the error I get: ldapsearch -x -W -D "cn=admin,dc=company,dc=com" -b "ou=people,dc=company,dc=com" -s subtree -e 1.3.6.1.4.1.4203.666.5.14 I get : # search result search: 2 result: 2 Protocol error text: valSort control value is absent Thanks Ben

1 0

weighted valsort for telephone Numbers
by Benin Technologies 12 Feb '13

12 Feb '13

Hi Quanah, I just found an old post of yours, and I'd be interested to know if and how you solved that problem, because I ran into the same need. Thanks Ben * *To*: *openldap-devel(a)OpenLDAP.org <mailto:openldap-devel%40OpenLDAP.org>* * *Subject*: *valsort & telephoneNumber* * *From*: *Quanah Gibson-Mount <quanah(a)stanford.edu <mailto:quanah%40stanford.edu>>* * Date: Mon, 28 Aug 2006 21:11:07 -0700 * Content-disposition: inline ------------------------------------------------------------------------ We would like to be able to use valsort to weight telephoneNumber values in OpenLDAP. However, modifications of that type get rejected by the SYNTAX validation for telephoneNumber because it contains {}'s. Is it reasonable to expect to be able to override the SYNTAX in this case? Should valsort be modified to do so? Basically, the desired behavior would be for the non-weighted part (i.e., the actual data) of the value to be validated via the SYNTAX rules, but the weight part at the beginning ignored. --Quanah -- Quanah Gibson-Mount Principal Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key:http://www.stanford.edu/~quanah/pgp.html <http://www.stanford.edu/%7Equanah/pgp.html>

5 10

Mirror mode difference from N-Way Multi-Master
by Покотиленко Костик 11 Feb '13

11 Feb '13

Hi, I've red replication documentation many times, and also many related mailing list threads. Some aspects are still not clear. So: 1. Can Mirror Mode be setup across more than 2 servers, say 3 mirrors? I found one thread saying that mirror can only be setup for 2 master servers: http://www.openldap.org/lists/openldap-software/200801/msg00046.html 2. How Mirror Mode of 2 servers differs in configuration comparing to N-Way Multi-Master of 2 servers? I don't see difference in setting up Mirror vs N-Way, both should have syncprov and syncrepl, both should have ServerID and MirrorMode TRUE, what am I missing? As far as I can see there is no difference in configuration. The only distinction I can see is the "use case", as N-Way supposed to accept writes on all Masters, but Mirror only on one at a time. This is not clearly stated anywhere, so do they really differ only in proxy/balancer in front of Mirrors? If so, why can't I do 3 Mirrors with proxy/balancer in front? 3. It is clearly stated in the docs that in Mirror Mode one can't use Delta-syncrepl. Can it be used in N-Way Multi-Master? There are posts saying Delta-syncrepl is not supported in Multi-Master: http://www.openldap.org/lists/openldap-devel/200708/msg00139.html http://www.openldap.org/lists/openldap-technical/201104/msg00241.html 4. In Mirror mode, can I use UpdateRef on one mirror to direct writes to another so proxy/balancer will become not required?

4 9

What is difference between basic search and search fired by ACL check.
by Tio Teath 11 Feb '13

11 Feb '13

I'm trying to setup Set ACL via ldap proxy with proxy cache. Problem is that proxy cache are not used during ACL checking. For example, I have next ACL to the local database: olcAccess: {0}to * by self write by set="[cn=test2,ou=group,dc=remote]/member & user" write by anonymous auth by * none And at the remote LDAP server I have next entry: dn: cn=test2,ou=group,dc=remote objectClass: groupOfNames member: uid=user,ou=user,dc=local member: uid=j_doe,ou=people,dc=remote Proxy cache works perfectly when fired by basic search request, I can see it in the debug log. But when search are fired by ACL check (i.e. search to local entry, which handled by Set ACL), proxy cache are completely ignored. And I am sure about that, because I have added 'Debug( pcache_debug ...' entry in every function from servers/slapd/overlays/pcache.c and could not see any of them in the trace output, during ACL check and could see them perfectly during basic search. Here are log entries from the remote server for cache search(1) and ACL search(2): 1) 5118f601 conn=1003 op=1 SRCH base="cn=test2,ou=group,dc=remote" scope=2 deref=0 filter="(objectClass=*)" 5118f601 conn=1003 op=1 SRCH attr=member objectClass 2) 5118f706 conn=1000 op=1 SRCH base="cn=test2,ou=group,dc=remote" scope=0 deref=0 filter="(objectClass=*)" 5118f706 conn=1000 op=1 SRCH attr=member For (1), seems search are fired by pcache itself, hence attr=member objectClass. Proper search request, which are fired by myself does not contain objectClass in the requested attribute list. I have not managed to find the place in the code, where the search are fired by ACL, seems it is servers/slapd/overlays/sets.c, but there is no direct search invocation there. Could you please give me a clue how to fix this issue? P.S. I have googled this post http://www.openldap.org/lists/openldap-devel/200908/msg00018.html. Seems, it is somehow related to the issue, only in my case entry is not in hand.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical February 2013