openldap-technical April 2013

openldap-technical@openldap.org

69 participants
74 discussions

LDAP proxy
by Šerých Jakub 19 Apr '13

19 Apr '13

Dear group, I manage the school network in which we have two separate MS-AD servers (one for teachers and the other for students). We also have mySQL database of our alumni. I would like to connect this three information bases to one "virtual" LDAP server (for authentication purposes on various LAMP web servers etc.). Is it possible to configure such virtual or proxy server using OpenLDAP? And if yes, could anybody be so kind and redirect me to some how-to resources? I was trying to search this using Google, but as I'm OpenLDAP newbie, I don't know the terminology exactly and my search results are not good. Thanks in advance for any help Jakub

2 1

Re: Alias dereferencing
by Saša-Stjepan Bakša 19 Apr '13

19 Apr '13

Compiled from source, version current OpenLDAP RE24 (from GIT) ./configure --prefix=/opt/openldap Data was added with same ldapadd progy, schema is the same version. Here it is - config, slapcat from slapd.d (lengthy schema omitted): dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /opt/openldap/var/run/slapd.args olcLogLevel: none olcPidFile: /opt/openldap/var/run/slapd.pid structuralObjectClass: olcGlobal creatorsName: cn=config entryUUID: a8df00ce-80fb-1031-8652-fff9cf1d6a3e createTimestamp: 20120822232009Z olcServerID: 1 ldap://spr1.lab.os olcServerID: 2 ldap://spr2.lab.os olcThreads: 2 olcToolThreads: 32 olcIdleTimeout: 10 entryCSN: 20130402101823.578807Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20130402101823Z contextCSN: 20130402101823.578807Z#000000#001#000000 contextCSN: 20130329141804.133907Z#000000#002#000000 dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema structuralObjectClass: olcSchemaConfig entryUUID: 9c79c918-80fb-1031-92fa-11190a1d893e creatorsName: cn=config createTimestamp: 20120822231948Z entryCSN: 20120822231948.419573Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20120822231948Z snip-----------------------------------------------------------------------------------------snip dn: olcBackend={0}mdb,cn=config objectClass: olcBackendConfig olcBackend: {0}mdb structuralObjectClass: olcBackendConfig entryUUID: 8c59fb88-2cc3-1032-9b7c-c7b2eb845e03 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20130329135149Z entryCSN: 20130329135149.548491Z#000000#001#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20130329135149Z dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break olcAccess: {1}to dn.exact="" by * read olcAccess: {2}to dn.base="cn=Subschema" by * read structuralObjectClass: olcDatabaseConfig creatorsName: cn=config entryUUID: a8df0ace-80fb-1031-8653-fff9cf1d6a3e createTimestamp: 20120822232009Z olcSizeLimit: 5000000 entryCSN: 20130326133336.496532Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20130326133336Z dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break structuralObjectClass: olcDatabaseConfig entryUUID: a8df1960-80fb-1031-8654-fff9cf1d6a3e creatorsName: cn=config olcRootDN: cn=admin,cn=config createTimestamp: 20120822232009Z olcRootPW:: e1NTSEF9eDRVRTBiV2Z4YnFSNnZDVDdKRWEwSWRhWFRhMDN2M3I= olcSyncrepl: {0}rid=001 provider=ldap://spr1.lab.os binddn="cn=admin,cn=config " bindmethod=simple credentials=siemens searchbase="cn=config" type=refreshAn dPersistretry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=002 provider=ldap://spr2.lab.os binddn="cn=admin,cn=config " bindmethod=simple credentials=siemens searchbase="cn=config" type=refreshAn dPersistretry="5 5 300 5" timeout=1 olcMirrorMode: TRUE entryCSN: 20130329141804.133907Z#000000#002#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20130329141804Z dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth entryUUID: 36e07d68-2cc7-1032-8bf6-1905ee7d8e9d createTimestamp: 20130329141804Z entryCSN: 20130329141804.132859Z#000000#002#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20130329141804Z dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /opt/openldap/var/openldap-data olcSuffix: dc=spr olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=spr" write by * none olcAccess: {1}to attrs=shadowLastChange by self write by * read olcAccess: {2}to dn.base="" by * read olcAccess: {3}to * by self write by dn="cn=admin,dc=spr" write by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=spr olcRootPW:: e1NTSEF9eDRVRTBiV2Z4YnFSNnZDVDdKRWEwSWRhWFRhMDN2M3I= olcDbCheckpoint: 4096 10 olcDbNoSync: TRUE olcDbMaxSize: 107374182400 structuralObjectClass: olcMdbConfig entryUUID: 804a8ede-2cc3-1032-9b7a-c7b2eb845e03 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20130329135129Z olcDbIndex: objectClass eq olcDbIndex: uid eq olcDbIndex: MSISDN eq olcDbIndex: IMSI eq olcDbIndex: pfUsername eq olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcDbIndex: contextCSN eq olcMirrorMode: TRUE olcSyncrepl: {0}rid=003 provider=ldap://spr1.lab.os binddn="cn=admin,dc=spr" b indmethod=simple credentials=siemens searchbase="dc=spr" type=refreshOnly int erval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=004 provider=ldap://spr2.lab.os binddn="cn=admin,dc=spr" b indmethod=simple credentials=siemens searchbase="dc=spr" type=refreshOnly int erval=00:00:00:10 retry="5 5 300 5" timeout=1 entryCSN: 20130329141637.442296Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20130329141637Z dn: olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth entryUUID: e2aa5b24-2cc6-1032-8bf5-1905ee7d8e9d createTimestamp: 20130329141542Z entryCSN: 20130329141542.849443Z#000000#002#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20130329141542Z Output from ldapsearch done on server with mdb: root@test7kde:~# ldapsearch -x -h 172.17.103.200 -D cn=admin,dc=spr -s sub -a always -W -b pfUsername=user1,dc=USERNAME,dc=spr Enter LDAP Password: # extended LDIF # # LDAPv3 # base <pfUsername=user1,dc=USERNAME,dc=spr> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 Output from ldapsearch done on server with hdb: root@test7kde:~# ldapsearch -x -h 172.17.103.215 -D cn=admin,dc=spr -s sub -a always -W -b pfUsername=user1,dc=USERNAME,dc=spr Enter LDAP Password: # extended LDIF # # LDAPv3 # base <pfUsername=user1,dc=USERNAME,dc=spr> with scope subtree # filter: (objectclass=*) # requesting: ALL # # 1, USERS, STANDARD, SPR dn: uid=1,ds=USERS,o=STANDARD,dc=SPR objectClass: sprUser uid: 1 # userData, 1, USERS, STANDARD, SPR dn: subdata=userData,uid=1,ds=USERS,o=STANDARD,dc=SPR roamingAllowed: TRUE objectClass: sprUserData subdata: userData prepaidFlag: TRUE sn: TestProv pfUsername: user1 givenName: pcrfUser loginPassword: 123 pfPassword: 123 # applicationData, 1, USERS, STANDARD, SPR dn: subdata=applicationData,uid=1,ds=USERS,o=STANDARD,dc=SPR objectClass: sprUserData subdata: applicationData # aaa, applicationData, 1, USERS, STANDARD, SPR dn: ds=aaa,subdata=applicationData,uid=1,ds=USERS,o=STANDARD,dc=SPR objectClass: sprDs ds: aaa # 2g3g, aaa, applicationData, 1, USERS, STANDARD, SPR dn: ds=2g3g,ds=aaa,subdata=applicationData,uid=1,ds=USERS,o=STANDARD,dc=SPR objectClass: sprDs ds: 2g3g # pcrf, aaa, applicationData, 1, USERS, STANDARD, SPR dn: ds=pcrf,ds=aaa,subdata=applicationData,uid=1,ds=USERS,o=STANDARD,dc=SPR objectClass: sprDs ds: pcrf # 2g3gProf, 2g3g, aaa, applicationData, 1, USERS, STANDARD, SPR dn: subdata=2g3gProf,ds=2g3g,ds=aaa,subdata=applicationData,uid=1,ds=USERS,o=S TANDARD,dc=SPR service2g3g: defaultService profile2g3g: profile1 productCode2g3g: prodCode barringStatus2g3g: barringStatus objectClass: spr2g3gUser uniqueId2g3g: user1 apnGroup2g3g: apnGG provider2g3g: me-myself-and-i framedIPAddress2g3g: 1.1.1.1 accountGroup2g3g: acctGroup subdata: 2g3gProf msisdn: 1234560001 flagStatus2g3g: flagStatus class2g3g: classs type2g3g: type creationDate2g3g: 01.10.2010. classification2g3g: 111 poolGroup2g3g: poolGroup status2g3g: ACTIVE # pcrfProf, pcrf, aaa, applicationData, 1, USERS, STANDARD, SPR dn: subdata=pcrfProf,ds=pcrf,ds=aaa,subdata=applicationData,uid=1,ds=USERS,o=S TANDARD,dc=SPR profile: 3100 totalUsedVolume: 3 msisdn: 1234560001 objectClass: sprPcrfProf totalMaximumVolume: 5 imsi: 1991234560001 subdata: pcrfProf subscriberServiceProfile: TM00003100 featureList: Faeture1 paymentTypexy: NeverPaid pfUsername: user1 tariffId: 1 pcrfServiceId: 3100 # search result search: 2 result: 0 Success # numResponses: 9 # numEntries: 8 On Thu, Apr 18, 2013 at 4:11 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, April 18, 2013 1:55 PM +0200 Saša-Stjepan Bakša < > ssbaksa(a)gmail.com> wrote: > > >> >> >> I am using alias dereferencing with hdb backed because that was >> application requirement. Now I am switching to mdb but I can't get the >> same answer with ldapsearch. >> >> Does dereferencing work for mdb? >> > > OpenLDAP version? Example configuration? > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

I can't delete a shell DB
by Diego Woitasen 18 Apr '13

18 Apr '13

Hi, I was using shell backend and now switched to sock backend (shell looks unstable). My problem not is that I can't delete the shell DB. This is the entry in cn=config: dn: olcDatabase={3}shell,cn=config objectClass: olcShellConfig objectClass: olcDatabaseConfig olcDatabase: {3}shell When I try to remove it I get Error 53 - Unwilling to perform. Looks like there is a dependency with this entry, but I don't see where. Is the last one, i removed the suffix.... hints? And don't see anything usefull in the logs. Regards, Diego -- Diego Woitasen

4 11

Stable schema definition for dynlist overlay?
by Paolo Miotto 18 Apr '13

18 Apr '13

Hello, I'm trying dynamic groups on ldap via dynlist overlay. In the documentation (slapo-dynlist man page, openldap administrator guide) the examples are using the dyngroup.schema, which is marked as experimental. There are more reliable schemas? The experimental label is only due to the lack of an rfc, or other issues can be found using this schema? Or it is better to define new attributes and objectclass in our internal schema? The authorization attributes and objectclass are required or it is safe to ignore them if not used? I have tried a schema without them and I have only a warning in the log, but it is a test environment and maybe it is not exaustive. Best regards Paolo Miotto ---------------------------------------------------------------------- SEMEL (SErvizio di Messaging ELettronico) - AINF, Universita' di Udine

2 1

Alias dereferencing
by Saša-Stjepan Bakša 18 Apr '13

18 Apr '13

I am using alias dereferencing with hdb backed because that was application requirement. Now I am switching to mdb but I can't get the same answer with ldapsearch. Does dereferencing work for mdb? Lp Sasa

2 1

Backend meta and write access?
by Yoann Gini 18 Apr '13

18 Apr '13

Hello, I’m working on a setup with backend meta, the aim of the setup is to have a LDAP database for our Samba 3. We already have a LDAP but we don’t wan’t to change the schema, so I’ve build a LDAP server on Centos with a local database for samba (cn=samba) and I plan to use meta to do the merge (and the translucent to save locally new fields for existing users). I’ve successfully deploy the meta backend but it work in readonly mode, I can’t write on it… Here is my config, if someone can give me a clue, that would be great :-) ####################################################################### # Samba Database ####################################################################### database bdb directory "/var/db/openldap/samba-directory" suffix "cn=samba" rootdn "uid=samba_root,cn=users,cn=samba" rootpw {SSHA}--- access to * by dn.exact="uid=samba_root,cn=users,dc=example,dc=com,dc=meta" write by * read ####################################################################### # Meta Database ####################################################################### database meta suffix "dc=example,dc=com,dc=meta" ## Main database dc=example,dc=com mapped to dc=example,dc=com,dc=meta uri "ldap://192.168.2.200/dc=example,dc=com,dc=meta" suffixmassage "dc=example,dc=com,dc=meta" "dc=example,dc=com" ## Mapping for specific Samba node uri "ldap://127.0.0.1:1389/sambaDomainName=EXAMPLE,dc=example,dc=com,dc=meta" suffixmassage "sambaDomainName=EXAMPLE,dc=example,dc=com,dc=meta" "sambaDomainName=EXAMPLE,cn=samba" uri "ldap://127.0.0.1:1389/cn=idmap,dc=example,dc=com,dc=meta" suffixmassage "cn=idmap,dc=example,dc=com,dc=meta" "cn=idmap,cn=samba" uri "ldap://127.0.0.1:1389/cn=nt-computers,dc=example,dc=com,dc=meta" suffixmassage "cn=nt-computers,dc=example,dc=com,dc=meta" "cn=nt-computers,cn=samba" access to * by dn.exact="uid=samba_root,cn=users,dc=example,dc=com,dc=meta" write

1 0

database meta and overlay memberof
by David Bonnafous 17 Apr '13

17 Apr '13

hi, I have a meta directory with two uri (one is openldap directory, used by Linux, and the other is "Mac OS X directory"). This meta-directory is used for authentication and it works. I try to use the "memberof" overlay in the meta directory to build some groupOfNames... but it doesn't work: the memberOf attribute is not updated. More precisely the groupOfNames is created in the Linux directory (through the meta directory) and then I add members. If the members are dn in this directory: it works (memberOf attribute is updated). But if the members are in the Mac OS X it doesn't work (memberOf attribute is not updated). questions: Is it possible to get the groupOfNames/memberof to work ? If yes, how ? an extract of my slapd.conf: -------------------- database meta overlay memberof suffix "dc=laplace,dc=meta" # # Mac OS X # uri "ldap://192.168.0.1/dc=macosx,dc=labo,dc=meta" suffixmassage "dc=macosx,dc=labo,dc=meta" "dc=here,dc=gg" # # Linux # uri "ldap://192.168.0.2/dc=linux,dc=labo,dc=meta" suffixmassage "dc=linux,dc=labo,dc=meta" "dc=xxx,dc=yy,dc=gg" -------------------- Under Linux, I use openldap 2.4.23 (debian squeeze) and 2.4.11 (debian lenny). thank you. -- David Bonnafous, ingénieur CNRS Service Informatique LAboratoire PLAsma et Conversion d'Energie Université de Toulouse France

1 0

A bit confused about rootpw
by D C 16 Apr '13

16 Apr '13

I'm trying to replicate a production problem, so I setup a test server. I rsynced everything from /etc/openldap and /var/lib/ldap, and confirmed that both systems have the same exact openldap packages installed. For some reason on the test box, I cannot bind as the rootdn, it keeps saying invalid credentials. reluctantly, i've updated slapd.conf with a new rootpw, but that doesn't seem to be working either. I've ran grep -RHi olcRootPW on the slapd.d directory, but it came back with nothing. Any thoughts? rsync options used "-avz --delete" Thanks, Dan

2 2

RE: help -- Regarding the jks certificate error
by Chris Jacobs 15 Apr '13

15 Apr '13

> Hi, > > // Either explicitly tell your tools to trust the CA for the cert via config or the > command line – How do I tell my tools (which tools?) to trust the CA for the > cert in config or the cmd line? > > I have put all the certs in my openldaps client ldap.conf file. All the jks certs > are created by kaytool command. > None of the below work : > > #TLS_CACERT /etc/openldap/cacerts/123keystore.jks // server is started > using jks certificates for secure connections.. this is not working TLS_CACERT > /etc/openldap/cacerts/789server.cer // This didn’t work # TLS_CACERT > /etc/openldap/cacerts/789server.pem // I converted the cer to pem file.. > But even this didn’t work TLS_CACERTDIR /etc/openldap/cacerts > > // Perhaps even (I'm mostly guessing) adding the CA to your systems trusted > CA certs Start by getting your CA's cert. – how to add CA to my clients trusted > CA certs? CJ: That's on a per OS basis. It's rarely made easy. But after more reading, unlikely to help you. > In openldap cmd ldapsearch, there is no option to specify the cert path. It > picks the cert files/dir from the /etc/openldap/ldap.conf CJ: I was mistaken. I thought there was. > Jks(java key store) certs(created by the server) work with openldap clients > by just copying the certs to client machine and adding the path in ldap.conf > file ? Or do we need pem certs only? CJ: We use base64 encoded certs. I tried looking into what type of cert was acceptable to openldap, but failed to find it. The cert should look similar to: -----BEGIN CERTIFICATE----- MIIF3jCCBMagAwIBAgIKf/7gwAAAAAAJ5zANBgkqhkiG9w0BAQUFADBVMRMwEQYK [plenty of lines similar] Vtm/MSZk5cBjnM84+MK3sVdE -----END CERTIFICATE----- > I am a newbie..Pls guide me..Thanks. CJ: I'm not that much better I'm afraid. Some things to consider: Make sure you're putting the CA's cert for openldap to ref, and not the actual cert being used. If you find yourself still stuck, try reading: http://www.openldap.org/faq/data/cache/185.html and make sure you understand CAs, certs signed by that CA, etc. We've some JKS certs we have to monitor in our environment, and we use the following to export java/JKS certs to x509 Base64 encoded PEM format: keytool -exportcert -keystore [store-with-CA-cert] -alias [alias-name-of-CA-cert] -storepass [password] -rfc Use that cert with your ldap toolset. > Regards, > Sridhar Sontha > > > > From: Chris Jacobs [mailto:Chris.Jacobs@apollogrp.edu] > Sent: Friday, April 12, 2013 9:39 PM > To: Sontha, Sridhar; 'openldap-technical(a)openldap.org'; 'openldap- > technical-request(a)openldap.org' > Subject: Re: help -- Regarding the jks certificate error > > Your cert is self signed and not trusted by your client. > > Either explicitly tell your tools to trust the CA for the cert via config or the > command line. Perhaps even (I'm mostly guessing) adding the CA to your > systems trusted CA certs. > > Start by getting your CA's cert, and reading the ldapsearch man page. > > - chris > > ________________________________________ > From: openldap-technical-bounces(a)OpenLDAP.org <openldap-technical- > bounces(a)OpenLDAP.org> > To: openldap-technical(a)openldap.org <openldap- > technical(a)openldap.org>; openldap-technical-request(a)openldap.org > <openldap-technical-request(a)openldap.org> > Sent: Fri Apr 12 20:24:03 2013 > Subject: help -- Regarding the jks certificate error Hi There, > I am using an ldap server created using unbounded ldap API (Java). And > the server is started to support both ldap and ldaps. Sever uses java > keystore (.jks) certificates namely 123keystore.jks and 456truststore.jks and > some 789server.cer (all these files are protected by some passoword). The > server is listening at port # 1636 for all ldaps connections. > I am able to connect to the server using (ldaps) some java ldap clients and > able to bind and search successfully. But when I try to connect to the server > using openldap client, it is NOT working, getting SSL > routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed error. > > I get the below error when I try to do the search using ldaps://<ip>:1636 > > ldapsearch -w 'xxxxxx1234' -H ldaps://xx.xx.xx.xxx:1636 -b > "o=person,o=hp" -D "id=xxxx89,o=person,o=hp" > > [bea@devcg4sdmbl01 ldapsearch -w 'xxxxxx1234' -H > ldaps://xx.xx.xx.xxx:1636 -b "o=person,o=hp" -D > "id=xxxx89,o=person,o=hp" > ldap_create > ldap_url_parse_ext(ldaps://x.x.x.x:1636) > ldap_pvt_sasl_getmech > ldap_search > put_filter: "(objectclass=*)" > put_filter: simple > put_simple_filter: "objectclass=*" > ldap_send_initial_request > ldap_new_connection 1 1 0 > ldap_int_open_connection > ldap_connect_to_host: TCP xx.x.xx.xx:1636 > ldap_new_socket: 3 > ldap_prepare_socket: 3 > ldap_connect_to_host: Trying 10.0.59.164:1636 > ldap_connect_timeout: fd: 3 tm: -1 async: 0 TLS trace: > SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 > write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS > certificate verification: depth: 0, err: 18, subject: > /C=xxx/ST=x/L=xxx/O=xxxx/OU=xxx/CN=xxx, > issuer: /C=xxx/ST=xxx/L=xxxx/O=xxxxx/OU=xxx/CN=xxxxx > TLS certificate verification: Error, self signed certificate TLS trace: SSL3 alert > write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server > certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B > TLS: can't connect. > ldap_perror > ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) > additional info: error:14090086:SSL > routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed > > Here is my ldap.conf : located at /etc/openldap/ldap.conf > > URI ldaps://x.x.x.x:1636/ > BASE o=person,o=hp > HOST <IP> > PORT 1636 > #TLS_CACERT /etc/openldap/cacerts/123keystore.jks // server is started > using jks certificates for secure connections.. this is not working TLS_CACERT > /etc/openldap/cacerts/789server.cer // This didn’t work # TLS_CACERT > /etc/openldap/cacerts/789server.pem // I converted the cer to pem file.. > But even this didn’t work TLS_CACERTDIR /etc/openldap/cacerts > TLS_REQCERT require > > What is the correct configuration to make this work? Can I use the jks > certificates in openldap client to connect to server which is using jks for > ldaps connections? What is missing here? Pls help fix this issue. > Same openldap client works fine for non-secure and simple authentication > ldap connections. The problem is only when I try to use ldaps from the > client. > > Thanks in advance. Let me know if you need more info. > > > Regards, > Sridhar Sontha > > > > > ________________________________________ > This message is private and confidential. If you have received it in error, > please notify the sender and remove it from your system. > This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

2 2

Merge two LDAP store in one proxy with attribute mapping?
by Yoann Gini 14 Apr '13

14 Apr '13

Hello, Actually working on a Samba 3.x integration on an Apple OpenDirectory, I’m wondering one thing. Is that possible to make a LDAP proxy composing record as a proxy from two existing LDAP database? For example, I’ve one LDAP db with my user and an other with my password hash, I would like to try to create a third LDAP access point to get a unified access to both informations. Best regards, Yoann

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical April 2013