openldap-technical November 2014

openldap-technical@openldap.org

66 participants
69 discussions

pwdCheckModule not allowed on openldap 2.4.40 (ubuntu server 12.04)
by Guruprasad Kulkarni 14 Nov '14

14 Nov '14

Hi, I installed openldap 2.4.40 on ubuntu 12.04LTS I enabled ppolicy while configuring the installation. ./configure --enable-hdb --enable-ppolicy --enable-syncprov --with-tls I want to specify a password check module (to check for minimum upper cases, lower cases, digits, etc). I got the module from http://ltb-project.org/wiki/documentation/openldap-ppolicy-check-password I created a password policy very similar to the one given in the documentation: dn: cn=default,ou=policies,dc=example,dc=com cn: default objectClass: pwdPolicy objectClass: person objectClass: top pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 1 pwdCheckModule: check_password.so pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 0 pwdInHistory: 5 3 pwdLockout: TRUE pwdLockoutDuration: 60 0 pwdMaxAge: 1200 pwdMaxFailure: 3 pwdMinAge: 0 pwdMinLength: 8 pwdMustChange: FALSE pwdSafeModify: FALSE sn: dummy value slapd.conf: modulepath /usr/local/lib moduleload check_password.so While adding this password policy to ldap, I get the error: ldap_add: Object class violation (65) attribute info: attribute 'pwdCheckModule' not allowed The log level is 256 and doesn't say much besides giving the same error. Let me know where I have gone wrong. -Guruprasad

2 1

Re: adding VLV support to OpenLDAP 2.4.31
by Igor Shmukler 13 Nov '14

13 Nov '14

Hello, I want to thank everyone who reads this mailing list and especially those who provided advice, which helped me to finally configure my server. You are amazing. Thank you

1 0

Re: adding VLV support to OpenLDAP 2.4.31
by Igor Shmukler 13 Nov '14

13 Nov '14

Hi Chris, vq@vq-HVM-domU:~$ ldapsearch -x -w Vq0106%% -D "cn=admin,dc=nodomain" -b cn=config # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 vq@vq-HVM-domU:~$ cat /usr/share/slapd/sssvlv.ldif dn: olcOverlay=sssvlv,olcDatabase={1}bdb,cn=config objectClass: olcSssVlvConfig olcOverlay: sssvlv olcSssVlvMax: 10 olcSssVlvMaxKeys: 5 In order to actually get the search working, I use base dc=nodomain It is not my choice. I inherited the server and the configuration. Nor do I know much about OpenLDAP configuration. I am a programmer and my job is [among other things] hacking the client piece. Unfortunately, there is nobody else [better] qualified to configure the server. Hence, I am filling in for an administrator. The "ldapsearch -x -w SECRET -D "cn=admin,dc=nodomain" -b dc=nodomain" version works fine and I do in fact get results. Sincerely, Igor Shmukler On Wed, Nov 12, 2014 at 11:47 AM, Chris Card <ctcard(a)hotmail.com> wrote: > > > >> Hi Chris, >> >> Sorry to bother you again. >> >>>>>>> ldapadd -x -w <password> -D cn=config -f <ldif file> >> >> -D cn=config was giving me an authentication error. I used >> credentials, which work for ldapsearch and got a syntax error. >> >> vq@vq-HVM-domU:~$ ldapadd -x -w SECRET -D "cn=admin, dc=nodomain" -f >> /usr/share/slapd/sssvlv.ldif >> ldap_add: Invalid syntax (21) >> additional info: objectClass: value #0 invalid per syntax >> > Is cn=admin,dc=nodomain the rootdn for the cn=config directory? > > Does > > ldapsearch -x -w SECRET -D "cn=admin,dc=nodomain" -b cn=config > > work? > > What are the contents of sssvlv.ldif? (it's possible I made a typo, it was untested) > > Chris > >

7 17

OpenLDAP Proxy for Active Directory Authentication (slapd.d)
by Šmucr Jan 13 Nov '14

13 Nov '14

Hello. I need to integrate local OpenLDAP and remote Active directory DS wereas the result is expected to work like this: User wants to authenticate --> Client (Gerrit 2.9.1) connects to the local OpenLDAP server --> The OpenLDAP server searches its local database for a relevant entry * Entry found --> Inform the client * Entry not found --> Delegate the request to the remote Active directory server o Entry found --> Inform the OpenLDAP server --> Inform the client o Entry not found --> Inform the OpenLDAP server --> Inform the client I came across this article [1], but my server uses the slapd.d configuration schema and I can't make it work as there's too little helpful documentation to it. I'll be thankful for every help. Jan [1] http://ltb-project.org/wiki/documentation/general/sasl_delegation

3 3

questions on overlay sssvlv
by Nicolas RENAULT 13 Nov '14

13 Nov '14

Hello, I already post some question about this but without succes, perhaps because i made a mistake and replys in another question thread. So I restart here. testing env so i can make all that i want. openldap 2.4.40 build on opensuse 13.1. try to make a proxy ldap, with use of meta to relay informations from one AD , one EDir and one openLDAP. (just use openLDAP for now) I create a database to get locally the root "dc=example,dc=fr" and firstlevel OU : "ou=TOUT,dc=example,dc=fr" , "ou=TEST,dc=example,dc=fr" I bind the openLDAP on "ou=LDAP,ou=TOUT,dc=example,dc=fr" I add users on the local ou "TEST" simple requests are working without problem. (on "TEST" and on "TOUT" ) activate sssvlv on slapd.conf (because of meta) globally (ie before the statement for the meta database) overlay sssvlv just this line. when a try this search ldapsearch -E 'sss=displayName' -H ldap://localhost -x -D "cn=Manager,dc=example,dc=fr" -b "ou=TEST,dc=example,dc=fr" -w xxxx -s sub "(&(objectClass=user)(displayName=ag*))" displayName I got the user list sort by display name ( they are local user) when i try this : ldapsearch -E 'sss=displayName' -H ldap://localhost -x -D "cn=Manager,dc=example,dc=fr" -b "ou=LDAP,ou=TOUT,dc=example,dc=fr" -w xxxx -s sub "(&(objectClass=user)(displayName=ag*))" displayName I got this : # extended LDIF # # LDAPv3 # base <ou=LDAP,ou=TOUT,dc=example,dc=fr> with scope subtree # filter: (&(objectClass=user)(displayName=ag*)) # requesting: displayName # with server side sorting control # # search result search: 2 result: 0 Success control: 1.2.840.113556.1.4.474 false MAMKAQA= sortResult: (0) Success # numResponses: 1 I understand that the request as been successfull but whitout any results ? any idea ? I'm thinking of a problem with : * bad place for "overlay ssvlv" in slapd.conf (actually it take place juste after moduleload section and just before the ACL statements * problem with remap attribute when asking the distant LDAP * overlay sssvlv not working with meta ? but need some clues to find where is the problem. Regards -- Nicolas

2 2

allow to pass on "undefined" filters in meta
by Markus.Storm＠t-systems.com 12 Nov '14

12 Nov '14

Hi I've run into a problem trying to deploy back-meta in front of an Active Directory target. I believe that to resolve it, I need to get a new option implemented. I need to issue a request through a back-meta proxy . That query happens to contain a matching rule which is not implemented in OpenLDAP so slapd does not know to evaluate the query. The target that the query will ultimately be passed on to (an Active Directory) does know to process the query, though. OpenLDAP, however, considers the filter to be "undefined" and thus on relaying the request to the AD target, back-meta replaces a portion of the original query with a "(?=undefined)" filter as documented in e.g. slapd-meta manpage "noundeffilter" option. But I need the original query to be passed on. It's in fact a _valid_ LDAP request, just OpenLDAP happens to be unable to parse it. But at least in my setup, slapd does not have to do _anything_ about the query other than to pass it on, so I find it inacceptable that it replaces the query just because it doesn't understand it. Please, can you add an option switch to the code to allow for passing on original queries *without* replacing undefined portions ? I have not found any other solution to my problem. I tried to make OpenLDAP aware of the undefined portion by adding the matching rule to the schema but I failed. Seems that would need to be planted into the code, and not being a programmer, that's not as easy as it is with expanding the schema by some new attributes. Also, while of course any parser/feature enhancement will always be appreciated, I would think that to implement the matching rule is not the best way of fixing things: I believe there will always be situations where OpenLDAP cannot parse the input while another LDAP server can. For a proof of concept, I hacked servers/slapd/back-meta/map.c (around line 581 as of 2.4.39) and but - again, I'm not a programmer - I feel incapable of turning this into a full-blown patch free of side effects, also I want the modification to become available to anyone. So I'm hoping for you to implement the switch mentioned above, maybe as a third possible setting for the "noundeffilter" option. Thanks a lot in advance, best regards Markus Storm

3 4

[PATCH] Fix OpenLDAP build when using LibreSSL
by Xin Li 12 Nov '14

12 Nov '14

Hi, A FreeBSD user have proposed the patch below to solve OpenLDAP compile issue when using LibreSSL, which I think would be good to share with upstream. The patch can be found at: https://svnweb.freebsd.org/ports/head/net/openldap24-server/files/patch-des… The patch was created by "Spil Oss <spil.oss(a)gmail.com>" so credit should go to the submitter: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=194841 Cheers, --- libraries/liblutil/passwd.c.orig 2014-09-19 03:48:49.000000000 +0200 +++ libraries/liblutil/passwd.c 2014-11-05 19:57:10.807555025 +0100 @@ -38,11 +38,11 @@ # include <openssl/des.h> -typedef des_cblock des_key; -typedef des_cblock des_data_block; -typedef des_key_schedule des_context; -#define des_failed(encrypted) 0 -#define des_finish(key, schedule) +typedef DES_cblock DES_key; +typedef DES_cblock DES_data_block; +typedef DES_key_schedule DES_context; +#define DES_failed(encrypted) 0 +#define DES_finish(key, schedule) #elif defined(HAVE_MOZNSS) /* @@ -53,9 +53,9 @@ */ #define PROTYPES_H 1 # include <nss/pk11pub.h> -typedef PK11SymKey *des_key; -typedef unsigned char des_data_block[8]; -typedef PK11Context *des_context[1]; +typedef PK11SymKey *DES_key; +typedef unsigned char DES_data_block[8]; +typedef PK11Context *DES_context[1]; #define DES_ENCRYPT CKA_ENCRYPT #endif @@ -664,10 +664,10 @@ * abstract away setting the parity. */ static void -des_set_key_and_parity( des_key *key, unsigned char *keyData) +DES_set_key_and_parity( DES_key *key, unsigned char *keyData) { memcpy(key, keyData, 8); - des_set_odd_parity( key ); + DES_set_odd_parity( key ); } @@ -677,7 +677,7 @@ * implement MozNSS wrappers for the openSSL calls */ static void -des_set_key_and_parity( des_key *key, unsigned char *keyData) +DES_set_key_and_parity( DES_key *key, unsigned char *keyData) { SECItem keyDataItem; PK11SlotInfo *slot; @@ -699,7 +699,7 @@ } static void -des_set_key_unchecked( des_key *key, des_context ctxt ) +DES_set_key_unchecked( DES_key *key, DES_context ctxt ) { ctxt[0] = NULL; @@ -712,37 +712,37 @@ } static void -des_ecb_encrypt( des_data_block *plain, des_data_block *encrypted, - des_context ctxt, int op) +DES_ecb_encrypt( DES_data_block *plain, DES_data_block *encrypted, + DES_context ctxt, int op) { SECStatus rv; int size; if (ctxt[0] == NULL) { /* need to fail here... */ - memset(encrypted, 0, sizeof(des_data_block)); + memset(encrypted, 0, sizeof(DES_data_block)); return; } rv = PK11_CipherOp(ctxt[0], (unsigned char *)&encrypted[0], - &size, sizeof(des_data_block), - (unsigned char *)&plain[0], sizeof(des_data_block)); + &size, sizeof(DES_data_block), + (unsigned char *)&plain[0], sizeof(DES_data_block)); if (rv != SECSuccess) { /* signal failure */ - memset(encrypted, 0, sizeof(des_data_block)); + memset(encrypted, 0, sizeof(DES_data_block)); return; } return; } static int -des_failed(des_data_block *encrypted) +DES_failed(DES_data_block *encrypted) { - static const des_data_block zero = { 0 }; + static const DES_data_block zero = { 0 }; return memcmp(encrypted, zero, sizeof(zero)) == 0; } static void -des_finish(des_key *key, des_context ctxt) +DES_finish(DES_key *key, DES_context ctxt) { if (*key) { PK11_FreeSymKey(*key); @@ -817,7 +817,7 @@ static void lmPasswd_to_key( const char *lmPasswd, - des_key *key) + DES_key *key) { const unsigned char *lpw = (const unsigned char *) lmPasswd; unsigned char k[8]; @@ -832,7 +832,7 @@ k[6] = ((lpw[5] & 0x3F) << 2) | (lpw[6] >> 6); k[7] = ((lpw[6] & 0x7F) << 1); - des_set_key_and_parity( key, k ); + DES_set_key_and_parity( key, k ); } static int chk_lanman( @@ -843,10 +843,10 @@ { ber_len_t i; char UcasePassword[15]; - des_key key; - des_context schedule; - des_data_block StdText = "KGS!@#$%"; - des_data_block PasswordHash1, PasswordHash2; + DES_key key; + DES_context schedule; + DES_data_block StdText = "KGS!@#$%"; + DES_data_block PasswordHash1, PasswordHash2; char PasswordHash[33], storedPasswordHash[33]; for( i=0; i<cred->bv_len; i++) { @@ -864,21 +864,21 @@ ldap_pvt_str2upper( UcasePassword ); lmPasswd_to_key( UcasePassword, &key ); - des_set_key_unchecked( &key, schedule ); - des_ecb_encrypt( &StdText, &PasswordHash1, schedule , DES_ENCRYPT ); + DES_set_key_unchecked( &key, &schedule ); + DES_ecb_encrypt( &StdText, &PasswordHash1, &schedule , DES_ENCRYPT ); - if (des_failed(&PasswordHash1)) { + if (DES_failed(&PasswordHash1)) { return LUTIL_PASSWD_ERR; } lmPasswd_to_key( &UcasePassword[7], &key ); - des_set_key_unchecked( &key, schedule ); - des_ecb_encrypt( &StdText, &PasswordHash2, schedule , DES_ENCRYPT ); - if (des_failed(&PasswordHash2)) { + DES_set_key_unchecked( &key, &schedule ); + DES_ecb_encrypt( &StdText, &PasswordHash2, &schedule , DES_ENCRYPT ); + if (DES_failed(&PasswordHash2)) { return LUTIL_PASSWD_ERR; } - des_finish( &key, schedule ); + DES_finish( &key, schedule ); sprintf( PasswordHash, "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x", PasswordHash1[0],PasswordHash1[1],PasswordHash1[2],PasswordHash1[3], @@ -1139,10 +1139,10 @@ ber_len_t i; char UcasePassword[15]; - des_key key; - des_context schedule; - des_data_block StdText = "KGS!@#$%"; - des_data_block PasswordHash1, PasswordHash2; + DES_key key; + DES_context schedule; + DES_data_block StdText = "KGS!@#$%"; + DES_data_block PasswordHash1, PasswordHash2; char PasswordHash[33]; for( i=0; i<passwd->bv_len; i++) { @@ -1160,12 +1160,12 @@ ldap_pvt_str2upper( UcasePassword ); lmPasswd_to_key( UcasePassword, &key ); - des_set_key_unchecked( &key, schedule ); - des_ecb_encrypt( &StdText, &PasswordHash1, schedule , DES_ENCRYPT ); + DES_set_key_unchecked( &key, &schedule ); + DES_ecb_encrypt( &StdText, &PasswordHash1, &schedule , DES_ENCRYPT ); lmPasswd_to_key( &UcasePassword[7], &key ); - des_set_key_unchecked( &key, schedule ); - des_ecb_encrypt( &StdText, &PasswordHash2, schedule , DES_ENCRYPT ); + DES_set_key_unchecked( &key, &schedule ); + DES_ecb_encrypt( &StdText, &PasswordHash2, &schedule , DES_ENCRYPT ); sprintf( PasswordHash, "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x", PasswordHash1[0],PasswordHash1[1],PasswordHash1[2],PasswordHash1[3], -- Xin LI <delphij(a)delphij.net> https://www.delphij.net/ FreeBSD - The Power to Serve! Live free or die

2 1

LDAP auth is failing when I disconnect and re-connect AD server
by Adarsha S 12 Nov '14

12 Nov '14

Hi All, I've a setup where I've installed openldap-2.4.25 on debian machine to access windows 2003 AD server. my radius server use the libraire of openldap-2.4.25. Along with this i'm using samba to join the AD domain and bring up winbindd. The senario is this way. After I've started my radius server, winbindd process autherthication works fine. Now I disconnect my AD server for a while.Try to authenticate. It fails. This is a valid senario. But after I re-connect my AD server still the authentication says invalid users. I would like to know how to debug this issue as i'm not able to get logs also. Thanks in Advance, Adarsha

1 0

adding VLV support to OpenLDAP 2.4.31
by Igor Shmukler 12 Nov '14

12 Nov '14

Hello, I apologize if I am posting to the wrong mailing list. I have a simple problem, which I am sure any OpenLDAP administrator can easily solve... I am not an administrator, however. Hence being unable to answer this trivial question presents a real problem. I am stuck. Any assistance would be greatly appreciated. I am trying to add Virtual List View support to an OpenLDAP server on hosted Ubuntu. The distro version is Ubuntu 14.04.1 LTS. The OpenLDAP server is already running. I receive responses to basic commands, but VLV is not working. When I run the version command, I get: vq@vq-HVM-domU:~$ slapd -VV @(#) $OpenLDAP: slapd (Ubuntu) (Mar 17 2014 21:20:08) $ buildd@aatxe:/build/buildd/openldap-2.4.31/debian/build/servers/slapd I added the following lines to the slapd.conf file (located for some reason in a funky place /usr/share/slapd/slapd.conf ) moduleload sssvlv.so overlay sssvlv My path seems to be OK: modulepath /usr/lib/ldap The dynamic library appears to be in the right place as well: vq@vq-HVM-domU:~$ ls -l /usr/lib/ldap/sssvlv.so lrwxrwxrwx 1 root root 19 Mar 17 2014 /usr/lib/ldap/sssvlv.so -> sssvlv-2.4.so.2.8.3 vq@vq-HVM-domU:~$ ls -l /usr/lib/ldap/sssvlv-2.4.so.2.8.3 -rw-r--r-- 1 root root 26872 Mar 17 2014 /usr/lib/ldap/sssvlv-2.4.so.2.8.3 I cut out a piece of dmesg, just in case: [ 0.000000] Linux version 3.13.0-32-generic (buildd@kissel) (gcc version 4.8. 2 (Ubuntu 4.8.2-19ubuntu1) ) #57-Ubuntu SMP Tue Jul 15 03:51:08 UTC 2014 (Ubuntu 3.13.0-32.57-generic 3.13.11.4) I tried to figure out how to see what OpenLDAP modules are loaded, but did not find the appropriate documentation, at least quickly. Sorry again. I am sure the list subscribers where where to look. I unfortunately do not. There is no slapd-config executable on this system. Hence, I am assuming that slapd.conf is being used. Please advise what I am missing and/or doing wrong. Any suggestions are welcome If this is a totally wrong place to ask, please direct me to an appropriate resource. The server fault forums did not produce immediate results. Thank you, Igor Shmukler

5 16

Fwd: interaction of LastBind and Accesslog modules
by David Tello 11 Nov '14

11 Nov '14

i have a problem with the modules lastbind and access log. Without lastbind modulo i can to audit the login of users finding the bind entries in the accesslog database. My problem is that when i active the lastbind module, this bind entries not appear in access log database. Instead appear modify entries that modify the AUTHTIMESTAMP attribute in the users that did the login, and the reqAuthnz of the modify is the rootDN of the directory. I can change the mode to audit the login finding this new entries, but i want to know if this is the normal funcionality or this a problem in the interaction of both. Thanks to all.

3 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical November 2014