openldap-technical June 2013

openldap-technical@openldap.org

58 participants
71 discussions

converting schemas
by Bruno Furtado 18 Jun '13

18 Jun '13

Hi folks! I need to upgrade my LDAP server 2.2 to 2.4 and I'm trying to convert the schemas file with slaptest . But when I run the command bellow I get the follow message. And some schema files aren't converted. # slaptest -f schema.conf -F /tmp/ldap/slapd/ 51c0725d config_build_attrs: error 21 on olcAttributeTypes value #10 51c0725d config_build_entry: build "cn={7}phpgwaccount" failed: "" 51c0725d backend_startup_one (type=config, suffix="cn=config"): bi_db_open failed! (-1) slap_startup failed (test would succeed using the -u switch) [s] -- Bruno Furtado

1 0

slapd+syncrepl+mirrormode_connection_hang
by michal 18 Jun '13

18 Jun '13

Hi, I have two ldap servers on two different machines (one is working under debian another is a qnap). I would like to create a mirrormode servers. So I configure slapd.conf like it is described here (http://www.openldap.org/doc/admin24/replication.html) I've changed my personal data. First server: serverID 001 syncrepl rid=001 provider=ldap://another-server bindmethod=simple binddn="cn=root,o=zpcir" credentials="pass" searchbase="database-path" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 Second server has changes only in serverID = 002, provider=ldap://another-server2, rid=002 I run slapd daemon in debug "slapd -d256 -u root -h "ldap:///" -f /etc/ldap/slapd.conf" And my syncrepl is working because on the other server (where I run slapd in the same mode) I have response: conn=1000 fd=11 ACCEPT from IP=First-serwer:34579 (IP=0.0.0.0:389) conn=1000 op=0 BIND dn="bind-info" method=128 conn=1000 op=0 BIND dn="bind-info" mech=SIMPLE ssf=0 conn=1000 op=0 RESULT tag=97 err=0 text= conn=1000 op=1 SRCH base="cn=database-path" scope=2 deref=0 filter="(objectClass=*)" conn=1000 op=1 SRCH attr=* + And slapd is in this state for a long time and nothing is happening. It is answering for another calls, however conn=1000 is still running (I suppose). There is no result databases aren't updated. Do you have any ideas what is wrong with my replication?

2 2

LDAP and TLS
by Rodney Simioni 17 Jun '13

17 Jun '13

Hi, In order to for LDAP to work with TLS, does the certificate names need to match the server name? My admin gave me a certificate but it's called wildcard.com.cert, the name of my server is not 'wildcard'. usaims This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free. Thank you.

5 8

translucent overlay and "orphaned" local entry when remote entry moves
by Steve Eckmann 14 Jun '13

14 Jun '13

Is there a standard way to recover a local entry when its proxied entry is moved, that is, when a remote DN changes? It looks like the local entry and its attribute values become inaccessible via ldapsearch. I found the orphaned entry in the output of slapcat, but the man page warning about stopping slapd before running slapcat makes that seem like an impractical way to find and recover the orphans. Thank you.

2 2

What version of OpenSSL is required for OpenLDAP 2.4.35
by Ashwin Kumar 14 Jun '13

14 Jun '13

I am compiling OpenLDAP 2.4.35 with OpenSSL 1.0.0a. The compilation and building the library works fine. However, when I am using the OpenLDAP client "ldapsearch" the tool fails with these errors: [root@xMachine openldap-2.4.35]# ./ldaplib/bin/ldapsearch -H ldaps:// 192.168.1.51:10636 -d 5 ldap_url_parse_ext(ldaps://192.168.1.51:10636) ldap_create ldap_url_parse_ext(ldaps://192.168.1.51:10636/??base) ldap_pvt_sasl_getmech ldap_search put_filter: "(objectclass=*)" put_filter: simple put_simple_filter: "objectclass=*" ldap_build_search_req ATTRS: supportedSASLMechanisms ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 192.168.1.51:10636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 192.168.1.51:10636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 attempting to connect: connect success TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:error in SSLv3 read server hello B TLS trace: SSL_connect:error in SSLv3 read server hello B TLS: can't connect: error:1411809D:SSL routines:SSL_CHECK_SERVERHELLO_TLSEXT:tls invalid ecpointformat list. ldap_msgfree ldap_err2string ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) additional info: error:1411809D:SSL routines:SSL_CHECK_SERVERHELLO_TLSEXT:tls invalid ecpointformat list 1. Why does this happen? 2. Is it the issue with the OpenSSL 1.0.0a? 3. What is the minimum version of OpenSSL required to build the LDAP clients? -- Ashwin kumar (http://ashwinkumar.me)

2 1

password policy error: Password policy only allows one password value
by Joke de Buhr 14 Jun '13

14 Jun '13

Hi, I activated the password policy overlay but every time I try to update the password using ldappassw I get this error message: SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 Result: Constraint violation (19) Additional info: Password policy only allows one password value The user account has it attribute pwdPolicySubentry set to the policy listed below. The original account had multiple userPassword values with different hashes but I deleting every attribute userPassword but the last one didn't help. Deleting all userPassword attributes didn't work either. ldappasswd always returns the error. Any idea what causes the problem or what setting to check? Regards Joke ----------------------------------------------------------------------------- dn: cn=person,ou=policies,dc=seiken,dc=de objectClass: top objectClass: person objectClass: pwdPolicy cn: person pwdAttribute: userPassword sn: -none- description: password policy designed for real people logins pwdAllowUserChange: TRUE pwdCheckQuality: 1 pwdExpireWarning: 2592000 pwdFailureCountInterval: 5 pwdGraceAuthNLimit: 3 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 3600 pwdMaxAge: 7776000 pwdMaxFailure: 60 pwdMinAge: 0 pwdMinLength: 5 pwdMustChange: TRUE pwdSafeModify: FALSE -----------------------------------------------------------------------------

1 1

Re: openldap-technical Digest, Vol 67, Issue 12
by Mark Molenda 13 Jun '13

13 Jun '13

It's been awhile since I've messed with this but this sounds like a classic directory chaining or LDAP referral, where the LDAP client does not find the user and automatically refers the client to the directory having the entry. ============================ Message: 1 Date: Wed, 12 Jun 2013 09:20:56 -0500 From: Jason Brandt <jbrandt(a)fsmail.bradley.edu> To: openldap-technical(a)openldap.org Subject: OpenLDAP Proxy for Active Directory Authentication Message-ID: <CAJ-t26o1=bEWUuv4xeveTNG37jqD-hWCoGbSpofU4fCiywAiiw(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" We run in a mixed environment, with both Active Directory and LDAP directory servers. Some users exist in both LDAP and AD, while some are just in AD. As such, we always have obstacles with password sync between directories. Is it possible, to set up an OpenLDAP proxy (if that's the correct term), which would authenticate via Active Directory if the user exists there (or if a flag is present in the LDAP entry, etc), otherwise via LDAP if the user is not an AD user, thereby eliminating the need to store the password in both directories? Directory information would otherwise

1 0

How can OpenLDAP client process on FreeBSD authenticate a web user with active directory
by Ganesh Borse 12 Jun '13

12 Jun '13

Dear Friends I am new to OpenLDAP. We are migrating our application (integrated with webserver) from Windows to FreeBSD. However, this is adding a bit of a problem. Previously, I used Microsoft SSPI authentication loop mechanism to authenticate the users connecting from GUI client (launched from computers in MS active directory) to our application. AD authentication helped avoid maintaining separate passwords. Now, since we are moving to FreeBSD and web based interface, it is difficult to use the same SSPI mechanism and so, the users connecting to this application from web browser can be authenticated using the AD credentials. The function ldap_bind_s requires explicit password when connecting to directory server using a username other than logged in user. Also, pass-through authentication mechanism (14.5) outlined in OpenLDAP-Admin-Guide cannot be used as it is for slapd. Thus, can you please help me know, how can I authenticate a user configured in AD and connecting from web browser running on a computer in AD using openLDAP client on FreeBSD? I want to avoid maintaining or passing passwords on FreeBSD. Many thanks in advance for your time and help. Thanks and Regards, - ganesh

3 4

LMDB: MDB_MAP_FULL doesn't allow deletions
by Jeremy Bernstein 12 Jun '13

12 Jun '13

Hi OpenLDAP-Technical, First post, thanks in advance for any assistance. I am trying to manage database size for an application in which a fixed DB size is necessary (user-specified and these users are ornery). My preferred strategy is: - write to the DB until it's (nearly?) full - at that point, prune entries matching a certain criteria (either deleting them or backing them up to an auxiliary DB of some sort). I have all of this working, in fact, except that once I hit MDB_MAP_FULL on mdb_put(), I can no longer do anything with the DB, including deleting records. mdb_cursor_del() also returns MDB_MAP_FULL at that point. If I had some idea of when the DB was nearly full, I could do my pruning prophylactically, I guess. Resizing the database upward isn't really a solution, given the constraints of this particular application. Some other observations: - on OSX (BSD?), if I do not set MDB_WRITEMAP in mdb_env_open(), MDB_MAP_FULL is _never_ returned, even when the DB is full. Setting MDB_WRITEMAP disables DB sparseness, though (so my 64MB-mapsize db with one record is 64MB on disk). Bug or feature? - on Windows, the database size is always the same as the mapsize. Possibly there's simply no support for sparse MM files on Windows, but I thought it's worth checking. OK, that's enough for the first post, thanks once again for any insight. Jeremy Bernstein

2 10

Getting Openldap to Trigger Events On Add
by Bram Cymet 12 Jun '13

12 Jun '13

Hi, I am wondering if it is possible to have OpenLDAP trigger a script anytime something is added to the ldap tree. For example after a user entry is added to the tree I would like to run some commands to create a kerberos principle for that user. A user will always be "Kerberized" so it would be continent to just have this happen automatically. -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. 613-608-9752

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical June 2013