openldap-technical February 2014

openldap-technical@openldap.org

85 participants
90 discussions

slapd.ldif beginner
by Sonny Taberman 01 Mar '14

01 Mar '14

Hi all ldap people. I have been trying this new way of configuring a slapd server from scratch. Sorry to say total failure on my side. I'm not sure where to begin. I have built a linux system from LFS Linux from scratch. So I want to install openldap from source, so far no problems. When my installation is done i have a directory in /etc/ named openldap and the content inside is this: DB_CONFIG.example ldap.conf ldap.conf.default schema slapd.conf slapd.conf.default slapd.ldif slapd.ldif.default To start configure my slapd using slapd.conf there is no problem. Actually I'm beginning to think I'm pretty good att this. :-) But then I try to read all I can find about configure a new slapd using slapd.ldif, not that easy. I understand that I need a new directory named slapd.d. After that I have no clue. I guess something is hardcoded in slapd but what am I supposed to do next? How can i communicate with slapd ? I guess I have to define a password somewhere for a manager or administrator but how and where? Is there a tutorial somwhere ? All I need is how to start. :-) best regards Sonny

3 3

Re: ldap_add: Object class violation (65), additional info: attribute 'host' not allowed
by W Forum W 27 Feb '14

27 Feb '14

Thanks!!! I found the same solution just before, it saved my day :-) Kind Regards On 02/27/2014 05:20 PM, Harry Jede wrote: > W Forum W wrote: >> Hi I tried to create a custom auxiliary class but I get this error >> >> attributetype: Inconsistent duplicate attributeType: "host" >> >> If I change the attributeType: "host" to attributeType: "hosts" >> it works. But I need the 'host' attribute.not 'hosts' > Its simple. "host" is defined in "account". So dont declare it twice, > just use it. > > # exists already in account > #attributetype ( 1.3.6.1.4.1.9554.1 > # NAME 'host' > # DESC 'host computer' > # EQUALITY caseIgnoreMatch > # SUBSTR caseIgnoreSubstringsMatch > # SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} > # ) > > objectclass ( 1.3.6.1.4.1.9554.0 > NAME 'teststuff' > SUP top > AUXILIARY > DESC 'Abstraction of an account with extra attributes' > MAY ( host ) > ) > >> How can I solve this? >> >> My schema looks like >> >> attributetype ( 1.3.6.1.4.1.9554.1 >> NAME 'host' >> DESC 'host computer' >> EQUALITY caseIgnoreMatch >> SUBSTR caseIgnoreSubstringsMatch >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} >> ) >> >> objectclass ( 1.3.6.1.4.1.9554.0 >> NAME 'teststuff' >> SUP top >> AUXILIARY >> DESC 'Abstraction of an account with extra attributes' >> MAY ( host ) >> ) >> >> Thanks

1 0

ldap_add: Object class violation (65), additional info: attribute 'host' not allowed
by W Forum W 27 Feb '14

27 Feb '14

Hi I try to add a user but the host attribute is not accept (everything else is fine) ldapadd -x -W -D "cn=admin,dc=example,dc=com" -f user.ldif Enter LDAP Password: adding new entry "uid=user,ou=Users,dc=example,dc=comt" ldap_add: Object class violation (65) additional info: attribute 'host' not allowed how can i add a host attribute i have following schema installed core.schema cosine.schema nis.schema inetorgperson.schema samba.schema thanks in advance

3 9

"entries aggregation"
by Alexandre Santos 27 Feb '14

27 Feb '14

Hi, I have a question about "entries aggregation". If for example I have ou=users,dc=exemple,dc=com and ou=info,dc=exemple,dc=com, and both have to be related, how can i do that? The uid must be different for integrity. Example people "test" data in ou=users and info in ou=info uid=test,ou=users,dc=exemple,dc=com ... mail: test(a)exemple.com uid=test_info,ou=info,dc=exemple,dc=com ... address: Street test if i search address and mail for "uid=test" it should give me both entries. Thanks

1 0

Not able to authenticate Windows and MAC client
by saurabh ohri 27 Feb '14

27 Feb '14

Hi all, I am new to openldap and i manage dto install and configure the same. My linux client is working well but not able to authenticate windows and mac clients. Have been trying since past 2 days by google and other posts but still facing issue. Any help would be highly appreciated. Details: using openldap-2.4.23-34 on RHEL6.5 Client details: Mac 10.8.5 -- tried configuring the network account server but it is showing RED. Error This server is not responding. Windows 7 – tried installing GINA but it is giving me invalid credentials error. Configuration file on server: Password: # extended LDIF # # LDAPv3 # base <dc=j,dc=example,dc=com> (default) with scope subtree # filter: (objectclass=*) # requesting: ALL # # j.example.com dn: dc=j,dc=example,dc=com objectClass: top objectClass: dcObject objectClass: organization o: example Organization description: example Inc DIT dc: j # Users, j.example.com dn: ou=Users,dc=j,dc=example,dc=com objectClass: organizationalUnit ou: Users # Groups, j.example.com dn: ou=Groups,dc=j,dc=example,dc=com objectClass: organizationalUnit ou: Groups # Admins, j.example.com dn: ou=Admins,dc=j,dc=example,dc=com objectClass: organizationalUnit ou: Admins # sohri, Users, j.example.com dn: uid=sohri,ou=Users,dc=j,dc=example,dc=com uid: sohri cn: sohri sn: 1 objectClass: top objectClass: posixAccount objectClass: inetOrgPerson loginShell: /bin/bash homeDirectory: /home/sohri uidNumber: 15000 gidNumber: 10000 userPassword:: e1NTSEF9eWdkWExpZUdIT01YRytRM3ZmZWdNY3QwSmd2bFNqSkcg mail: sam.ohri(a)example.com gecos: Local User # tpearce, Users, j.example.com dn: uid=tpearce,ou=Users,dc=j,dc=example,dc=com uid: tpearce cn: tpearce sn: 2 objectClass: top objectClass: posixAccount objectClass: inetOrgPerson loginShell: /bin/bash homeDirectory: /home/tpearce uidNumber: 15001 gidNumber: 10000 userPassword:: e1NTSEF9eWdkWExpZUdIT01YRytRM3ZmZWdNY3QwSmd2bFNqSkc= mail: tony.pearce(a)example.com gecos: local User # ldapusers, Groups, j.example.com dn: cn=ldapusers,ou=Groups,dc=j,dc=example,dc=com objectClass: posixGroup objectClass: top cn: ldapusers userPassword:: e2NyeXB0fXg= gidNumber: 10000 memberUid: uid=sohri memberUid: uid=tpearce # search result search: 2 result: 0 Success # numResponses: 8 # numEntries: 7 Regards Sam

4 8

memberOf values case
by Matteo Perego 27 Feb '14

27 Feb '14

Hi, I know that openldap usage behaviour is case insensitive. In my case a client use ldap attribute values in a case sensitive way. I've noticed that the memberOf value is created by the overlay using the DN case used in the query and not the DN case read from the database, I mean: dn: cn=test,ou=LOCAL,dc=example,dc=org changetype: modify replace: member member: uid=123,ou=people,dc=example,dc=org will create a memberOf: cn=test,ou=LOCAL,dc=example,dc=org attribute. dn: cn=test,ou=local,dc=example,dc=org changetype: modify replace: member member: uid=123,ou=people,dc=example,dc=org will create a memberOf: cn=test,ou=local,dc=example,dc=org attribute. The case of OU entry in the database is not considered and the values case depends on the writer client. I'm wondering if this's a known and desidered behaviour and I should deal with it or there's a chance to change it. -- Best Regards, Matteo Perego Xego di Perego Matteo & C. s.a.s. Via Giovanni Pascoli, 18 24040 Arzago d’Adda (BG) Part IVA/Cod Fis: 03126510167 R.E.A. 351612 tel +39-3395294954 fax +39-02700525082 http://www.xego.it email: info(a)xego.it

3 3

Re: strategy for getting groupOfNames (AD) and posixAccount (Unix) to coexist?
by harry.jede＠arcor.de 26 Feb '14

26 Feb '14

Am Mittwoch, 26. Februar 2014 schrieb Jefferson Davis: > Sorry to be dense, but it appears I create my schema file from the > attribute definitions in the RFC, is that correct? Yes -- Harry Jede

1 0

Re: strategy for getting groupOfNames (AD) and posixAccount (Unix) to coexist?
by Jefferson Davis 26 Feb '14

26 Feb '14

So I've read, however, there is very little documentation on implementation, at least that I've been able to find. ----- Original Message ----- From: "Dieter Klünter" <dieter(a)dkluenter.de> To: openldap-technical(a)openldap.org Sent: Friday, February 21, 2014 10:55:58 PM So I've read, however, there is very little documentation on implementation, at least that I've been able to find. Subject: Re: strategy for getting groupOfNames (AD) and posixAccount (Unix) to coexist? Am Fri, 21 Feb 2014 11:14:12 -0800 (PST) schrieb Jefferson Davis <jdavis(a)standard.k12.ca.us>: > This has been beating me like a red-headed stepchild... > > In the AD world, groupOfNames is expected (in combination with the > member attribute, provides for reverse group resolution, ie users by > group membership AND groups by member inclusion). This can be achieved by overlay memberOf, man slapo-memberof(5). > On the unix side of the fence, groups REQUIRE a gidNumber in order to > resolve group membership, using posixGroup structural OC in > conjunction with memberUID. The rfc2307bis.schema provides auxiliary object classes to solve this. In addition you may use the groupOfNames objectclass. > In attempting to future-proof our ldap services, and to accommodate > the AD-Focused nature of commercial products, I'm attempting to get > this to all work automatically, ie use the same group setup for both > (probably naive and ill-advised?). But you CANNOT have multiple > structural objectclasses in a single entry. So these requirements put > group structures in direct opposition of one another. > > Has anyone resolved this successfully, and if so, how? Overlays > (which ones, examples)? Schema mods (examples?) > > Splitting groups off as unix groups vs windows groups (sync could get > ugly) and could run into other issues with respect to file and dir > permissions. > > I also need to avoid breaking smbldap-tools, which at the moment > appears NOT to support the groupofnames model. > > Building this on CentOS 6, OpenLDAP 2.4.23-34, and migrating from > older OpenLDAP version. I'm somewhat open to considering a different > LDAP service (389/Apache/OpenDJ) though I've found java to be a > resource pig in the extreme, and would prefer to avoid if possible. > > If you have this working I would love to see the relevant > configuration files. -Dieter -- Dieter Klünter | Systemberatung http://sys4.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E -- Jefferson K Davis Technology and Information Systems Manager Standard School District 1200 North Chester Ave Bakersfield, CA 93308 661.392.2110 ext 120 (office) http://district.standard.k12.ca.us District Users: Click here to report technology issues

2 2

Replication from OpenLDAP to Fedora 389 DS
by Italo Valcy 26 Feb '14

26 Feb '14

Dear all, I`m trying to setup replication from OpenLDAP to Fedora 389 DS. It used to work by running slurpd in a push mode initiated by the provider. With OL 2.4 this seems to be replaced by syncrepl proxy mode [1], which works by defining a LDAP backend that will write updates on the consumer from data received from syncrepl engine (provider), acting as a proxy (examples in [1]). This is not working in case of sincronization from OL to 389 DS, because operational attributes (entryCSN, structuralObjectClass, entryUUID, etc.) is not accepted in 389 DS, giving the following error in 389 DS: [22/Feb/2014:18:17:25 -0300] - Entry "uid=XXX,dc=sub,dc=example,dc=com" -- attribute "entrycsn" not allowed I've tried to filter those operational attributes on synrepl, by using "exattrs='structuralObjectClass,entryUUID,entryCSN'" but it didnt help. Another approach (the right one, see bellow) would be disable "lastmod", but then syncprov overlay complains and don't starts (lastmod TRUE is required by syncprov). >From LDAP backend man pages, it already gives a feeling that when proxying, then lastmod should be OFF (and this is the default behavior): "Note: In early versions of back-ldap it was recommended to always set 'lastmod off' for ldap and meta databases. This was required because operational attributes related to entry creation and modification should not be proxied, as they could be mistakenly written to the target server(s), generating an error." So, is there any way to don't export the operational attributes from OL in the above scenario? Thanks for any help! [1] http://www.openldap.org/doc/admin24/replication.html#Syncrepl%20Proxy%20Mode -- Saudações, Italo Valcy :: http://wiki.dcc.ufba.br/Main/ItaloValcy

5 12

Excluding attributes fom reqOld
by Mundry, Marvin 26 Feb '14

26 Feb '14

Hi, the accesslog in my production environment is growing quite large which makes backing it up challenging. The reason is that there are plenty of accesslog entires which originate from slapo-ppolicy (users who can't remember their passwords): dn: reqStart=20140219033229.000000Z,cn=accesslog reqOld: pwdFailureTime: 20140218152927Z reqOld: pwdFailureTime: 20140218152957Z reqOld: pwdFailureTime: 20140218153027Z reqOld: pwdFailureTime: 20140218153057Z as I don't need pwdFailureTime in reqOld I would like to exclude this attribute form reqOld. I is my understanding that: * olcAccessLogOld only allows me to exclude whole user objects from appearing in reqOld (as I need reqOld info for users I can't do this) olcAccessLogOldAttr - only allows specifying a positive list of attributes that gets logged no matter whether they changed or not. what I need is something like: dn: olcOverlay={3}accesslog,olcDatabase={5}mdb,cn=config olcAccessLogOldAttr: !pwdFailureTime (a way to specify a list of attribs that never get logged even if they have changed) is there a way I can get rid of the pwdFailureTime in the accesslog? Best regards, Marvin Mundry University of Hamburg Regional Computer Center (RRZ) Division Zentrale Dienste Schlueterstrasse 70 20146 Hamburg +49 (0)40 42838-9109

1 0

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical February 2014