openldap-technical April 2013

openldap-technical@openldap.org

69 participants
74 discussions

Augmented data in a proxy?
by Yoann Gini 14 Apr '13

14 Apr '13

Hello, Actually working on a Samba 3.x integration on an Apple OpenDirectory, I’m wondering one thing. Is it possible to use proxy feature of LDAP to augment existing data ? For example, I would like to extend the Apple LDAP schema by adding the Samba support but I don’t want to store this additional data in the main store. If it’s possible, I would like to use a dedicated LDAP server configured to use my original LDAP server as backend and who can be allowed to store locally extra data from specific schema. Do you know a way to do that? Best regards, Yoann

2 2

help -- Regarding the jks certificate error
by Sontha, Sridhar 13 Apr '13

13 Apr '13

Hi There, I am using an ldap server created using unbounded ldap API (Java). And the server is started to support both ldap and ldaps. Sever uses java keystore (.jks) certificates namely 123keystore.jks and 456truststore.jks and some 789server.cer (all these files are protected by some passoword). The server is listening at port # 1636 for all ldaps connections. I am able to connect to the server using (ldaps) some java ldap clients and able to bind and search successfully. But when I try to connect to the server using openldap client, it is NOT working, getting SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed error. I get the below error when I try to do the search using ldaps://<ip>:1636 ldapsearch -w 'xxxxxx1234' -H ldaps://xx.xx.xx.xxx:1636 -b "o=person,o=hp" -D "id=xxxx89,o=person,o=hp" [bea@devcg4sdmbl01 ldapsearch -w 'xxxxxx1234' -H ldaps://xx.xx.xx.xxx:1636 -b "o=person,o=hp" -D "id=xxxx89,o=person,o=hp" ldap_create ldap_url_parse_ext(ldaps://x.x.x.x:1636) ldap_pvt_sasl_getmech ldap_search put_filter: "(objectclass=*)" put_filter: simple put_simple_filter: "objectclass=*" ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP xx.x.xx.xx:1636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.0.59.164:1636 ldap_connect_timeout: fd: 3 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 18, subject: /C=xxx/ST=x/L=xxx/O=xxxx/OU=xxx/CN=xxx, issuer: /C=xxx/ST=xxx/L=xxxx/O=xxxxx/OU=xxx/CN=xxxxx TLS certificate verification: Error, self signed certificate TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. ldap_perror ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Here is my ldap.conf : located at /etc/openldap/ldap.conf URI ldaps://x.x.x.x:1636/ BASE o=person,o=hp HOST <IP> PORT 1636 #TLS_CACERT /etc/openldap/cacerts/123keystore.jks // server is started using jks certificates for secure connections.. this is not working TLS_CACERT /etc/openldap/cacerts/789server.cer // This didn't work # TLS_CACERT /etc/openldap/cacerts/789server.pem // I converted the cer to pem file.. But even this didn't work TLS_CACERTDIR /etc/openldap/cacerts TLS_REQCERT require What is the correct configuration to make this work? Can I use the jks certificates in openldap client to connect to server which is using jks for ldaps connections? What is missing here? Pls help fix this issue. Same openldap client works fine for non-secure and simple authentication ldap connections. The problem is only when I try to use ldaps from the client. Thanks in advance. Let me know if you need more info. Regards, Sridhar Sontha

2 2

pwdReset - ldapmodify : Undefined attribute type (17)
by cbulist＠gmail.com 12 Apr '13

12 Apr '13

Hi, I'm trying to add pwdReset attribute to a user in order to reset the user password but It fails. I added the pwdReset attribute to the schema using Apache Directory Studio but I'm getting the same error. Any recommendation?...Thanks!! This is the command that I run: ldapmodify -c -H ldap://localhost -x -D "cn=Manager,dc=sample,dc=com" -w "password" <<EOF dn: uid=aaa,ou=People,dc=sample,dc=com changetype: modify replace: userPassword userPassword:test changetype: modify add: pwdReset pwdReset: TRUE EOF This is the output: ldapmodify: Undefined attribute type (17) additional info: changetype: attribute type undefined

2 1

ldapadd failing with mdb backend
by Chris Card 12 Apr '13

12 Apr '13

Hi, I'm doing some testing with an mdb backend with the openldap 2.4.35, and I'm seeing an issue where ldapadd is failing for an object which worked fine with a bdb backend. The error from ldapadd is "ldap_add: Other (e.g., implementation specific) error (80)" and when I run slapd with "-d -1" I see the error "mdb_add: dn2id_add failed: Invalid argument (22)" in the debug logging. Running an unoptimized slapd under gdb I have traced the error to lines 4887-8 in mdb.c, in mdb_cursor_put: if (F_ISSET(mc->mc_db->md_flags, MDB_DUPSORT) && data->mv_size > MDB_MAXKEYSIZE) return EINVAL; and from gdb I can see that data->mv_size = 512: (gdb) p *data $1 = {mv_size = 512, mv_data = 0x2f2e858} The error appears to be related to the length of the DN of the object being added, but there are longer DNs in the directory which were loaded successfully with slapadd. Any ideas? Chris

2 1

Users quotas with LDAP.
by Luis H. Forchesatto 12 Apr '13

12 Apr '13

Greetings. What is the best wat to store user disk quotas on LDAP. I got two (and there will be more) servers running and both will authenticate on LDAP. What are the best ways to manage user quotas with LDAP? -- Att.* *** Luis H. Forchesatto

2 1

LDAP search from Active Directory 2008r2
by John 11 Apr '13

11 Apr '13

Hi all, We are doing LDAP search from our Active Directory, the AD enabled "Require signing" option, please see the attachement. We can't let it work right now. I did online google search, LDAP SASL should be the way. But are there any reference or guide to install and configure LDAP SASL? Thanks John

1 0

back-perl not working with cn=config
by Benin Technologies 11 Apr '13

11 Apr '13

Hi, I'm unable to set up a back-perl backend directly in cn=config mode. However, if I set it up in slapd.conf mode, and then convert it to cn=config mode, it works fine. It's not convenient, because I have to set all my perl backends up before converting to cn=config. Here's the ldif file I'm using to set up a back-perl backend in cn=config mode (it's inspired from the files I get by converting slapd.conf into cn=config with slaptest) # Load dynamic backend modules dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/local/libexec/openldap olcModuleload: back_perl.la # Database settings dn: olcDatabase=perl,cn=config objectClass: olcDatabaseConfig objectClass: olcDbPerlConfig olcDatabase: perl olcSuffix: dc=mydomain,dc=org olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=Manager,dc=mydomain,dc=org olcRootPW:: c2VjcmV0 olcSyncUseSubentry: FALSE olcMonitoring: FALSE olcPerlModulePath: /usr/local/etc/openldap/perl olcPerlModule: SampleLDAP olcPerlFilterSearchResults: FALSE And here's what I get when I try to load the file: ldapadd -Y EXTERNAL -H ldapi:/// -f perl-backend.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "cn=module,cn=config" adding new entry "olcDatabase=perl,cn=config" ldap_result: Can't contact LDAP server (-1) After that, if I start OpenLDAP I get a segmentation fault: root@ldap:/tmp# /usr/local/libexec/slapd -u openldap -g openldap -h "ldap:/// ldapi:///" -d 16383 .... 51585496 perl backend db init Segmentation fault Like I said, if I set back-perl up in slapd.conf mode and then convert it to cn=config, everything works fine. Something must be wrong with my LDIF file, but what ??? It seems to be the same as the one generated by slaptest when converting from slapd.conf mode. Ben

2 5

Re: How to improve performance with MDB backend?
by Saša-Stjepan Bakša 11 Apr '13

11 Apr '13

Is there any HOWTO document which explains how to get exact version out from repository? I have cloned openldap git repo but I am not sure that I have checked out RE24 or yust "plain" 2.4.35. May be that this is simple thing to do but I am new to git and I newer used source for openldap before, just binary packages. On Tue, Apr 9, 2013 at 4:15 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, April 09, 2013 2:07 PM +0200 Saša-Stjepan Bakša < > ssbaksa(a)gmail.com> wrote: > > >> >> Tnx. I will add what you suggest and try to run modify test with that. I >> didn't done that already because my mdb database is overflowed. I have >> set it to 100GB but it wasn't enough. I am not sure why. Are there logs >> inside? I have 1 mil users but they didn't use all data storage. Hmmm, >> maybe indexes, I have 8 of them. I know how to look for hdb/bdb problems >> but mdb is a puzzle for me (for now). >> > > Please keep replies to the list. I would suggest you try current OpenLDAP > RE24, there was a growth issue fixed since the 2.4.35 release (ITS#7565). > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Hi!!!
by Jim Vanes 11 Apr '13

11 Apr '13

http://www.poidslourdsoccasions.com/bnct/jlox61zde11fi.acjgf18jtuid7e?6qlkx…

1 0

translucent search and modify not working as expected
by Steve Eckmann 10 Apr '13

10 Apr '13

I am trying to "extend" a corporate Active Directory with application-specific user attributes by running a local OpenLDAP (2.4.34) with back-ldap and the translucent overlay. I can add local attributes associated with remote entries, and I can see these local attributes when searching on a remote attribute. But I cannot modify local attributes, and searching on a local attribute returns no results. For example, after ldapadd -x -H ldaps://localhost -D "cn=admin,dc=example,dc=com" -W -f addLocalUser.ldif where "cn=admin,dc=example,dc=com" is the local rootdn and addLocalUser.ldif contains dn: cn=John Doe,ou=myOrg,dc=example,dc=com objectclass: organizationalPerson objectclass: myPerson myAttribute: somevalue the search ldapsearch -x -H ldaps://localhost -LLL -b dc=example,dc=com \ -D "cn=remoteuser,cn=Users,dc=example,dc=com" -W \ '(mail=john.doe(a)example.com)' cn manager myattribute (where remoteuser has read access on the remote directory and read/write access on the local directory) returns one entry with the expected cn, manager, and myattribute values. But the search ldapsearch -x -H ldaps://localhost -LLL -b dc=example,dc=com \ -D "cn=admin,cn=Users,dc=example,dc=com" -W \ '(myattribute=somevalue)' cn manager myattribute returns nothing. And the modify commands ldapmodify -x -H ldaps://localhost \ -D "cn=admin,dc=example,dc=com" -W -f modUser.ldif ldapmodify -x -H ldaps://localhost \ -D "cn=remoteuser,cn=Users,dc=example,dc=com" -W -f modUser.ldif where modUser.ldif contains dn: cn=John Doe,ou=myOrg,dc=example,dc=com changetype: modify replace: myAttribute myAttribute: anothervalue both result in ldapmodify: No such object (32) additional info: attempt to modify nonexistent local record I've read the relevant parts of the Admin Guide and the relevant man pages numerous times, along with everything I found via google. I've also studied the translucent overlay test cases. It looks like what I'm trying to do is a mainstream use case, so obviously I'm missing some crucial aspects of configuration. Here are the slapd.conf backend configs that I'm using (with name changes to match the examples above): database mdb suffix "dc=example,dc=com" rootdn "cn=admin,dc=example,dc=com" rootpw {SSHA}blahblah directory /opt/openldap-2.4/var/local-data index objectClass eq,pres index myAttribute eq,pres,sub overlay translucent uri "ldaps://ldap.example.com/" acl-bind bindmethod=simple binddn=cn=remoteuser,cn=Users,dc=example,dc=com credentials={SSHA}blahblah tls_reqcert=demand idassert-bind bindmethod=simple binddn=cn=remoteuser,cn=Users,dc=example,dc=com credentials={SSHA}blahblah mode=none tls_reqcert=demand idassert-authzFrom dn.regex:.* rebind-as-user chase-referrals yes translucent_local cn,myAttribute translucent_remote cn,mail Are there glaring mistakes here? Thanks for reading this far :-) Steve

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical April 2013