openldap-technical October 2014

openldap-technical@openldap.org

69 participants
76 discussions

LDAP, autofs and nested directories
by Lasse Knudsen 13 Oct '14

13 Oct '14

Greetings, I have run into a little snag, i know this is possible but, there is something that escapes me, my issue is as follows. I would like to have nested directories available, something to this effect, i need all directories to be created by the automounter, the problem is that i can't make configuration changes that always work, there is something that seems not to work as i would. what i would like to achieve is that the automounter creates my entire structure. for instance /fpc/apps (for some reason this works) and the two chess directories mount /fcp/co/home (co is created but home is not) i would like the ldap structure to be clean and neat, but it looks messy and its not clear to me when i make changes that it will work. So my question how do i go about creating this structure in a reliable way, most guides i have found only deal with creating a directory in / but does not go any further? And it bothers me that i have to use the slashes, like this “cn=/fpc/apps” Any suggestions how i can create this in a way that works? I have included my automount structure and my autofs confs thank you in advance lk

1 0

Q. null-modification with ppolicy?
by Ulrich Windl 13 Oct '14

13 Oct '14

Hi! Is it possible that ppolicy overlay does null-modifications on login for user entries that don't have a password policy? I see changes like this (diff of LDIF dump): -entryCSN: 20130910073734.028691Z#000000#001#000000 +entryCSN: 20141013114030.580239Z#000000#001#000000 modifiersName: cn=Admin,dc=domain,dc=org -modifyTimestamp: 20130910073734Z +modifyTimestamp: 20141013114030Z That is only the modification times seem changed. Regards, Ulrich

1 0

Antw: Questions on ppolicy (SLES11)
by Ulrich Windl 13 Oct '14

13 Oct '14

>>> I wrote: > Hello! > > I started to configure ppolicy in SLES11 SP3, and I think I succeeded with > the LDAP part. However I did not understand how to integrate ppolicy to the > OS, specifically: > > I created one test user with a ppolicy, and expectation is that on first > login the passowrd should be canged (minus grace logins). According to the > syslog ppolicy triggers an expired password: > > slapd[3990]: ppolicy_bind: Setting warning for password expiry for > uid=windl2,ou=domain,dc=org = 0 seconds > > However the user when logging in gets no type of message at all. It also > seems that nothing is changed in the LDAP database when this message occurs. The answer to this part is: If nscd is stil using the same connection, it won't detect ppolicy. After restarting nscd, things work as expected on that client. > So what is actually "set" there? > > When the user actually changes the password, I see the following attributes > changed in LDAP: > userPassword, pwdHistory, shadowLastChange > > What's not quite clear is when using SSHA-hashed passwords, what changes can > be done regarding pwdCheckQuality. I can imagine that some checks will work > if the client uses the extended operation to change the password, but not if > the password is changed by an ordinary LDAP modify request. Is that correct? It seems password history and minimum length can still be checked. Unsure about the rest. I also discovered that the attempt to change the password (after being logged in) may consume another grace login. This may be of interest if the actual password change failed or was aborted. > > Finally, maybe a stupid question: How does authentication against LDAP work? > In the classical UNIX mechanism, the authenticating process would query the > user name, then fetch the hashed password for that user, get the password > from the user, hash it using the same salt, and then compare the results for > a match. To my understanding you cannot get the hashed password from LDAP > until authenticated, so that looks like a egg-hen paradoxon to me. > > If anybody could enlighten me, I'd be glad. > > Regards, > Ulrich > >

1 0

Questions on ppolicy (SLES11)
by Ulrich Windl 13 Oct '14

13 Oct '14

Hello! I started to configure ppolicy in SLES11 SP3, and I think I succeeded with the LDAP part. However I did not understand how to integrate ppolicy to the OS, specifically: I created one test user with a ppolicy, and expectation is that on first login the passowrd should be canged (minus grace logins). According to the syslog ppolicy triggers an expired password: slapd[3990]: ppolicy_bind: Setting warning for password expiry for uid=windl2,ou=domain,dc=org = 0 seconds However the user when logging in gets no type of message at all. It also seems that nothing is changed in the LDAP database when this message occurs. So what is actually "set" there? When the user actually changes the password, I see the following attributes changed in LDAP: userPassword, pwdHistory, shadowLastChange What's not quite clear is when using SSHA-hashed passwords, what changes can be done regarding pwdCheckQuality. I can imagine that some checks will work if the client uses the extended operation to change the password, but not if the password is changed by an ordinary LDAP modify request. Is that correct? Finally, maybe a stupid question: How does authentication against LDAP work? In the classical UNIX mechanism, the authenticating process would query the user name, then fetch the hashed password for that user, get the password from the user, hash it using the same salt, and then compare the results for a match. To my understanding you cannot get the hashed password from LDAP until authenticated, so that looks like a egg-hen paradoxon to me. If anybody could enlighten me, I'd be glad. Regards, Ulrich

2 1

Complementing "set" ACLs documentation
by Ignacio Gallegos 13 Oct '14

13 Oct '14

Hi, I will try to explain "set" ACLs complementing the information originally written by Mark Valence in the openldap-devel archive (http://www.openldap.org/lists/openldap-devel/200006/msg00046.html). Set ACLs are a bit tricky and difficult to understand without the appropiate documentation. I hope this information helps to understand this kind of ACLs. 1. SYNTAX --------- First of all, the sintax in Backus-Naur form: <set> := <base> | "(" <set> ")" | <set> <conj> <set> | <set> "/" <attribute> "*" | <set> "/" <attribute> | <set> "/-" <level> | <set> "/-*" <base> := "this" | "user" | "[" <any text> "]" <conj> := "&" | "|" | "+" <attribute> := an attributeType as defined in the schema Of course, anywhere in the string, submatch replacements can appear in the form $<digit> or ${<digits>} if "set.regex=" is used instead "set=". 1.1. this, user and [] ---------------------- Keyword "this" means the object being accessed. So, if you are trying to read "cn=ignacio,ou=users,dc=foo,dc=com", "this" refers to "cn=ignacio,ou=users,dc=foo,dc=com" object. Keywork "user" means the object used to authenticate. If you are trying to read "cn=ignacio,ou=users,dc=foo,dc=com" authenticated as "cn=admin,dc=foo,dc=com", "user" refers to "cn=admin,dc=foo,dc=com" object. Keyword "[<text>]" means any text you need to use. For example "[cn=admin,dc=foo,dc=com]", "[FOO]". In other words, like strings in any programming language. 1.2. Object attributes ---------------------- Using the keywords of the previous section, you can access to the value of an attribute of a given object using the "/" operator. So, with an object like the next: dn: cn=ignacio,ou=users,dc=foo,dc=com uid: ignacio cn: ignacio description: Ignacio Gallegos Sanchez homeDirectory: /home/ignacio objectClass: posixAccount objectClass: top objectClass: account uidNumber: 800 structuralObjectClass: account gidNumber: 800 userPassword: MyPassword The expression "[cn=ignacio,ou=users,dc=foo,dc=com]/cn" will return "ignacio". The expression "this/uidNumber" will return "800" only if the target object is "cn=ignacio,ou=users,dc=foo,dc=com". 1.3. Operators &, | and + ------------------------- With a brief explanation: * & is a logic AND operator * | is a logic OR operator * + concatenates strings With examples: * "[A] & [A]" will return "A" * "[A] & [B]" will return an empty set * "[A] | [B]" will return "{ A, B }" * "[A] + [B]" will return "AB" * "[ignacio] & user/cn" will return "ignacio" ONLY if the client is authenticated with a user with a "CN" with value "ignacio" * "this & user" will return the object DN if the object used to authenticate is the target object, and will return nothing if not. 1.4. Group recursion -------------------- Using the "*" character we can obtain the group members in a recursive manner. The sintax is: <object>/<attribute>* For example, if we have the next objects: dn: cn=mail,ou=groups,dc=foo,dc=com objectClass: groupOfNames objectClass: top cn: mail member: cn=ignacio,ou=users,dc=foo,dc=com member: cn=claudia,ou=users,dc=foo,dc=com member: cn=clara,ou=users,dc=foo,dc=com dn: cn=web,ou=groups,dc=foo,dc=com objectClass: groupOfNames objectClass: top cn: web member: cn=oliver,ou=users,dc=foo,dc=com member: cn=sandra,ou=users,dc=foo,dc=com dn: cn=all_services,ou=groups,dc=foo,dc=com objectClass: groupOfNames objectClass: top cn: all_services member: cn=web,ou=groups,dc=foo,dc=com member: cn=mail,ou=groups,dc=foo,dc=com member: cn=julian,ou=users,dc=foo,dc=com The expression "[cn=all_services,ou=groups,dc=foo,dc=com]/member*" will return: { "member: cn=ignacio,ou=users,dc=foo,dc=com", "member: cn=claudia,ou=users,dc=foo,dc=com", "member: cn=clara,ou=users,dc=foo,dc=com", "member: cn=oliver,ou=users,dc=foo,dc=com", "member: cn=sandra,ou=users,dc=foo,dc=com", "member: cn=julian,ou=users,dc=foo,dc=com" } 1.5. Distingued Name Levels --------------------------- We can have the different levels of the DN of a given object using the /-<number> operator, or all levels with "/-*". So if the user is "cn=ignacio,ou=admins,ou=users,dc=foo,dc=com": * "user" resolves to "cn=ignacio,ou=admins,ou=users,dc=foo,dc=com" * "user/-1" resolves to "ou=admins,ou=users,dc=foo,dc=com" * "user/-2" resolves to "ou=users,dc=foo,dc=com" * "user/-3" resolves to "dc=foo,dc=com" * "user/-*" resolves to { "cn=ignacio,ou=admins,ou=users,dc=foo,dc=com", "ou=admins,ou=users,dc=foo,dc=com", "ou=users,dc=foo,dc=com", "dc=foo,dc=com", "dc=com", "" } 2. ACCESS CONTROL EVALUATION ---------------------------- After the previous examples, it's time to put it all together. -- The way "set" ACLs works is to grant the access if the expression returns something, don't grant access if the expression returns an empty set --, independtly the authenticated user is. This seems very simple (it's indeed) but can be very dangerous: we can grant access to an object by an unwanted user if we dont write the expression carefully. As usual, it's better to understand it with examples: * access to dn="ou=users,dc=foo,dc=com" by set="[A]" write Will grant write access to any user, because the set expression always return "A" * access to dn="ou=users,dc=foo,dc=com" by set="[A] & [B]" write Will NOT grant write access to any user, because the set expressions always returns an empty set. * access to dn="ou=users,dc=foo,dc=com" by set="user" write Will grant write access to any user, because the set expression always return the user DN. * access to dn="ou=users,dc=foo,dc=com" by set="user/description" write Will grant write access only if the object used to authenticate has the attribute "description" * access to dn="ou=users,dc=foo,dc=com" by set="user & [cn=ignacio,ou=users,dc=foo,dc=com]" write Will grant write access if the user DN is "cn=ignacio,ou=users,dc=foo,dc=com", because this is the only case the expression "user & [cn=ignacio,ou=users,dc=foo,dc=com]" will return something. * access to dn="ou=users,dc=foo,dc=com" by set="user/-2 & [dc=foo,dc=com]" write Will grant write access to any user two levels over "dc=foo,dc=com" domain, independly the "ou" is. In other words, "cn=ignacio,ou=users,dc=foo,dc=com" and "cn=clara,ou=admins,dc=foo,dc=com" will have write access, but "cn=claudia,ou=mail,ou=admins,dc=foo,dc=com" will not. * access to dn="ou=users,dc=foo,dc=com" by set="user/description & this/description" write Will grant write access to any user which description match the accessed object description. * access to dn="ou=users,dc=foo,dc=com" by set="(user/domain & this/domain)/-2 & [dc=foo,dc=com]" write Will grant write access to any user wich domain attribute match accessed object attribute and also domain is equal to "dc=foo,dc=com". * access to dn.regex="cn=(.+?),ou=users,(.+?)$" by set.regex="($1 & [ignacio]) & ($2 & [dc=foo,dc=com])" write Will grant write access if the user cn is "ignacio" and domain is "dc=foo, dc=com". Best Regards, Ignacio Gallegos Sánchez

2 1

schema for host info?
by Doug OLeary 09 Oct '14

09 Oct '14

Hi; I'm looking to store some host information in an ldap directory. Example attributes are: * Hostname * IP * Netmask * Default gateway * Remote console info * H/W * Serial number * Distribution List addresses to contact if the system has issues. Some of those are obvious: host, iphostnumber, ipnetmasknumber and serialnumber; the others somewhat less so. Any suggestions on how I could approach getting this information in my directory? Best case would be a pre-defined schema that I'm unable to find. Runner up would be a pointer from someone who's already faced and solved this issue. Thanks for any help/hints/tips. Doug O'Leary ------------ Senior UNIX/Security Admin CISSP, CISA, RHCE, CEH O'Leary Computers Inc dkoleary(a)olearycomputers.com (w) 630-904-6098 (c) 630-248-2749 linkedin: http://www.linkedin.com/in/dkoleary resume: http://www.olearycomputers.com/resume.html

3 2

Phpldapadmin can't connect openldap
by Onni Hakala 09 Oct '14

09 Oct '14

Hey! I need help with configuring openldap so that it allows logging in to phpldapadmin. Can you please give me hints how to debug my ldap authentication? I have a freshly installed server with ubuntu 14.04. I installed openldap and phpldapadmin following digitalocean tutorial [1]. My goal is to have all my user accounts in openldap. Services which will be using openldap are owncloud and dovecot. I don't have strong experience with openldap so I wanted to have phpldapadmin for easy administration of ldap database. Openldap is now installed and I can verify that it's working by running command below and entering ldap-root password: $ ldapsearch -x -W -D 'cn=admin,dc=XYZXYZ,dc=fi' -b "" -s base -H ldap://localhost Enter LDAP Password: # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: ALL # # dn: objectClass: top objectClass: OpenLDAProotDSE # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Phpldapadmin is also installed and I have verified that it's connecting to ldap. When I try to login to phpldapadmin with same credentials as ldapsearch above. It fails with message: Error: Invalid credentials (49) for user Why are these credentials wrong? I'm sure that password is correct and dn ('cn=admin,dc=XYZXYZ,dc=fi') is correct. Is there something I need to enable in openldap authentication to allow requests from phpldapadmin? I have verified that phpldapadmin is connecting to correct ldap. Firstly I had this error message from phpldapadmin: Error: Can't contact LDAP server (-1) for user But changed /etc/phpldapadmin/config.php to have: $servers->setValue('server','host','ldap://localhost'); I have tried to reinstall both of them several times and still getting this same error. I checked Php error logs (/var/log/apache2/error.log) and they are empty. OPENLDAP VERSION: $ slapd -V @(#) $OpenLDAP: slapd (Ubuntu) (Mar 17 2014 21:20:08) $ buildd@aatxe:/build/buildd/openldap-2.4.31/debian/build/servers/slapd PHPMYADMIN VERSION: 1.2.2 Thanks in advance :)! [1] https://www.digitalocean.com/community/tutorials/how-to-install-and-configu… - Onni Hakala

2 2

more too old cmp -1 output in the log
by Daniel Jung 08 Oct '14

08 Oct '14

Running on 2.4.39 centos 6.4 in MMR setup ( 4 servers ). 001 is the provider that was being written to at the time. The log is from 001. Could you advise whether my understanding of the log is correct? synrepl consumer on serverID=001 is polling syncrepl provider on serverID=001 and 003 and gets the CSN that is older that its own. We were doing a lot of writes during this time and there were cmp -1 104480 or simiar entries in the log. I had similar issue in the past while running 2.4.37 and it crashed slapd at that time but it didnt this time. The CSN were all synced at the end without any issue. Could you advise what could be causing this? Oct 8 20:36:50 servername slapd[58097]: srs csn 20141008181030.452659Z#000000#001#000000 Oct 8 20:36:50 servername slapd[58097]: log csn 20140723214017.586869Z#000000#001#000000 Oct 8 20:36:50 servername slapd[58097]: cmp -1, too old Oct 8 20:36:50 servername slapd[58097]: log csn 20140723214017.847644Z#000000#001#000000 Oct 8 20:36:50 servername slapd[58097]: cmp -1, too old Oct 8 20:36:50 servername slapd[58097]: log csn 20140723214122.276227Z#000000#001#000000 Oct 8 20:36:50 servername slapd[58097]: cmp -1, too old Oct 8 20:36:50 servername slapd[58097]: log csn 20140723214515.997173Z#000000#001#000000 Oct 8 20:36:50 servername slapd[58097]: cmp -1, too old Oct 8 20:36:50 servername slapd[58097]: log csn 20140723214734.650752Z#000000#001#000000 Oct 8 20:36:50 servername slapd[58097]: log csn 20140723220152.569135Z#000000#003#000000 Oct 8 20:36:50 servername slapd[58097]: cmp -1, too old Oct 8 20:36:50 servername slapd[58097]: log csn 20140723220328.184724Z#000000#001#000000 Oct 8 20:36:50 servername slapd[58097]: cmp -1, too old Oct 8 20:36:50 servername slapd[58097]: log csn 20140723222016.864642Z#000000#001#000000 Oct 8 20:36:50 servername slapd[58097]: cmp -1, too old Oct 8 20:36:50 servername slapd[58097]: log csn 20140723232832.307038Z#000000#003#000000 Oct 8 20:36:50 servername slapd[58097]: cmp -1, too old Oct 8 20:36:50 servername slapd[58097]: log csn 20140723232958.001298Z#000000#003#000000

2 3

syncrepl and LDAP_BUSY on LDBM by ITS#7904
by Леонид Юрьев 08 Oct '14

08 Oct '14

Hi all, We got a trouble with 2.4.40 syncrepl in the the multi-master mode. I think is too complex for analyse, and so not yet testcase is ready. But I noticed a change in ITS#7904 and the impact of LDAP_BUSY upon syncrepl. http://www.openldap.org/devel/gitweb.cgi?p=openldap.git&a=search&h=refs%2Ft… For instance, I assume that in case the LDAP_BUSY returned from ldap_sync_search(), then a syncrepl-connection would be closed and reestablished. Let see around the line 1554 of server/slapd/syncrepl.c and below. https://github.com/leo-yuriev/openldap-lmdb-challenge/blob/master/servers/s… Also, nowadays it is no repeatable read txn-isolation during the search and transfer data over a network. Does it influence upon syncrepl or not? Could anybody dispel my doubts? Leonid.

2 2

Map NFShomedirectory to new value
by Frans Lanting - IT Admin 08 Oct '14

08 Oct '14

Hi Folks, We are using an external OpenLDAP to authenticate users on a FreeBSD server and would like to re-map the NFSHomeDirectory to a different location. Currently that value looks like: /afs/home.example.com/users/t/jsmith We'd like to map it to something along the lines of: /users/jsmith If anyone could please point me in the right direction of how to do this, I'd be much appreciated. Cheers, Dan

4 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical October 2014