openldap-technical April 2014

openldap-technical@openldap.org

61 participants
55 discussions

not able to use idassert-bind successfuly
by Charles Bueche 05 May '14

05 May '14

Dear members, We are trying to create a LDAP proxy to hide two distinct AD servers behind a "single LDAP view". The goal is to authentify and authorize extranet and internal users using a single LDAP server, as LDAP clients (eg Apache) should only talk to a single LDAP server, and not be aware about the multiple AD servers behind the proxy. Our understanding is that we can create a meta database with two back-ends, using distinct uri/suffix/etc. What works: - using an AD user to talk to the proxy, which then is re-used by the proxy to talk to the back-end What does not work: - one "front-end", simple-bind LDAP-user used to access the LDAP-proxy, and only known to the proxy - one back-end user per back-end (known in AD). So we want to first search where a user is by using a front-end account, and then retry a bind with the user's effective username and password using its correct DN. Our config: -------------------------------------------------------------------- database meta suffix dc=meta,dc=x1,dc=ch uri "ldaps://ad1.ad.x1.ch/OU=O3,dc=meta,dc=x1,dc=ch" suffixmassage "OU=O3,dc=meta,dc=x1,dc=ch" "OU=O3,dc=ad,dc=x1,dc=ch" idassert-authzFrom "dn:*" idassert-bind bindmethod=simple tls_reqcert=allow binddn="CN=ldapsrvusr,OU=Service Accounts,OU=O3,dc=ad,dc=x1,dc=ch" credentials="abcdef12345" -------------------------------------------------------------------- When we try to use idassert-bind above, we always get the following error in the log: ... 535a1f25 conn=1000 op=1 <<< meta_search_dobind_init[0]=4 535a1f25 conn=1000 op=1 <<< meta_back_search_start[0]=4 535a1f25 conn=1000 op=1 meta_back_search: ncandidates=1 cnd="*" 535a1f25 conn=1000 op=1 >>> meta_search_dobind_init[0] 535a1f25 conn=1000 op=1 meta_search_dobind_init[0] mc=0x7f17fc008ef0: non-empty dn with empty cred; binding anonymously ... so it looks our identity is never used beyond the proxy to talk to the AD. help welcome. TIA, Charles

1 1

N-Way Multimaster replication
by Flatfender 04 May '14

04 May '14

All, I'm trying to get N-Way Multi-master replication working, and can see each server polling each other but replication doesn't see to update. I have two servers auth03 and auth04. Both servers are Centos 6.5 with OpenLDAP 2.4.23-34.el6_5.1 from the Base/Updates CentOS repository. What I see is that each server seems to contact the other and both get log entries like this. I can post more logs if need be. I haven't been able to find much on "got empty syncUUID" Apr 14 15:44:32 auth03 slapd[1467]: daemon: epoll: listen=11 active_threads=0 tvp=zero Apr 14 15:44:32 auth03 slapd[1467]: connection_get(22) Apr 14 15:44:32 auth03 slapd[1467]: connection_get(22): got connid=0 Apr 14 15:44:32 auth03 slapd[1467]: =>do_syncrepl rid=004 Apr 14 15:44:32 auth03 slapd[1467]: =>do_syncrep2 rid=004 Apr 14 15:44:32 auth03 slapd[1467]: do_syncrep2: rid=004 got empty syncUUID with LDAP_SYNC_ADD Apr 14 15:44:32 auth03 slapd[1467]: connection_get(22) Apr 14 15:44:32 auth03 slapd[1467]: connection_get(22): got connid=0 Apr 14 15:44:32 auth03 slapd[1467]: daemon: removing 22 Apr 14 15:44:32 auth03 slapd[1467]: do_syncrepl: rid=004 rc -1 retrying (29 retries left) Here is the configs for each server: Each server has a unique server ID as well. I haven't tried to get my main user database replicating, as it appears the config database isn't replicating yet. Auth03 Config: slapcat -s olcDatabase={0}config,cn=config dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth" manage by dn.base="cn=Admin,cn=config" manage by dn.exact="uid=sync repl,ou=System,dc=livegamer,dc=com" read by * none olcRootPW:: <redacted> olcAddContentAcl: TRUE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=config olcSyncUseSubentry: FALSE olcMonitoring: TRUE structuralObjectClass: olcDatabaseConfig olcSyncrepl: {0}rid=004 provider="ldaps://auth04.pax.livegamer.com" type=refre shAndPersist retry="60 30 300 +" searchbase="cn=config" bindmethod=simple bin ddn="uid=syncrepl,ou=System,dc=livegamer,dc=com" tls_reqcert=allow credential s=<redacted> olcSyncrepl: {1}rid=003 provider=ldaps://auth03.pax.livegamer.comtype=refresh AndPersist retry="60 30 300 +" searchbase="cn=config" bindmethod=simple bindd n="uid=syncrepl,ou=System,dc=livegamer,dc=com" tls_reqcert=allow credentials= <redacted> olcMirrorMode: TRUE entryCSN: 20140414153033.402795Z#000000#003#000000 modifiersName: cn=config modifyTimestamp: 20140414153033Z dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: 9cec0db6-5377-1033-940a-233ba8867211 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20140408144128Z olcSpCheckpoint: 100 10 entryCSN: 20140409154557.570189Z#000000#003#000000 modifiersName: cn=config modifyTimestamp: 20140409154557Z dn: olcOverlay={1}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: 4c7ef0fe-538c-1033-941d-1b46f26937f8 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20140408170933Z olcSpCheckpoint: 100 10 entryCSN: 20140409154608.786640Z#000000#003#000000 modifiersName: cn=config modifyTimestamp: 20140409154608Z Auth04 Config: slapcat -s olcDatabase={0}config,cn=config dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW:: <redacted> olcAddContentAcl: TRUE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=config olcSyncUseSubentry: FALSE olcMonitoring: TRUE structuralObjectClass: olcDatabaseConfig olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth" manage by dn.base="cn=Admin,cn=config" manage by dn.exact="uid=sync repl,ou=System,dc=livegamer,dc=com" read by * none olcSyncrepl: {0}rid=003 provider=ldaps://auth03.pax.livegamer.comtype=refresh AndPersist retry="60 30 300 +" searchbase="cn=config" bindmethod=simple bindd n="uid=syncrepl,ou=System,dc=livegamer,dc=com" tls_reqcert=allow credentials= <redacted> olcSyncrepl: {1}rid=004 provider=ldaps://auth04.pax.livegamer.comtype=refresh AndPersist retry="60 30 300 +" searchbase="cn=config" bindmethod=simple bindd n="uid=syncrepl,ou=System,dc=livegamer,dc=com" tls_reqcert=allow credentials= <redacted> olcMirrorMode: TRUE entryCSN: 20140414152957.400652Z#000000#004#000000 modifiersName: cn=config modifyTimestamp: 20140414152957Z dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: aabb3a20-5377-1033-8399-57009c40c824 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20140408144151Z olcSpCheckpoint: 100 10 entryCSN: 20140409154507.269469Z#000000#004#000000 modifiersName: cn=config modifyTimestamp: 20140409154507Z dn: olcOverlay={1}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: 5151199a-538c-1033-83f9-bd35daeffcf0 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20140408170941Z olcSpCheckpoint: 100 10 entryCSN: 20140409154526.632472Z#000000#004#000000 modifiersName: cn=config modifyTimestamp: 20140409154526Z Please let me know what additional info I may need to provide. Thank you Matt P.

3 3

Q: syncprov_sendresp IDs
by Ulrich Windl 02 May '14

02 May '14

Hi! Can anybody explain what the "rid", "sid", and "to" IDs refer to in the syncprov_sendresp message? Example: slapd[28206]: syncprov_sendresp: to=002, cookie=rid=006,sid=003,csn=20140430111351.287889Z#000000#001#000000 I guess the original is from SID==1, the local SID==003. Does it send to SID==2? If so, what is rid==6 referring to? Regards, Ulrich

2 3

Duplicate dynamically an OU with another RDN ?
by Sylvain 02 May '14

02 May '14

Hi ! I have a branch "ou=people" where RDN are in the form "X1234" and NEVER change for one people. Ex. : uid=X1234,ou=people,dc=example,dc=org In this node, I have the login under "eduPersonPrincipalName" attribute which MAY change. Some applications doesn't allow us to define which login to use and so take "uid" attribute by default, not so cool. Is there any possibility in OpenLDAP to duplicate dynamically an OU with another RDN to have for example : uid=sylvain,ou=peoplebis,dc=example,dc=org ? Best regards, Sylvain

5 5

Can't override TLS_REQCERT
by Andrew D. Arenson 01 May '14

01 May '14

I found the previous post of someone else who faced the same problem I'm encountering, but I did not see a posted solution: http://www.openldap.org/lists/openldap-technical/201310/msg00084.html In /etc/openldap/ldap.conf, TLS_REQCERT is set to 'allow'. I would like to leave this setting, but override it for a specific invocation of ldapsearch. I have attempted to do so by setting TLS_REQCERT in ~/.ldaprc and be setting the LDAPTLS_REQCERT environment variable. Neither has worked. Interestingly, I _HAVE_ found that I can override TLS_CACERTDIR in either of those locations. Is this a bug? Andy -- Andrew D. Arenson | aarenson (@) iu.edu Advanced Biomedical IT Core, Research Technologies, UITS | W (317) 278-1208 RT is a PTI Cyberinfrastructure & Service Center | C (317) 679-4669 Indiana University Purdue University Indianapolis | F (317) 278-1852

2 4

What is the option '-e ppolicy' ?
by Thierry Thelliez 01 May '14

01 May '14

Hello, Looking at the test source code of 2.4.39 for the ppolicy script, I can see the ldapsearch is using a '-e ppolicy' option. The man page for ldapsearch lists 'general extensions' under -e and -E options. But I cannot figure out what these extensions are. What is '-e ppolicy' ? and when do you need it? Thanks, Thierry

4 4

slapd forgets entries
by Emmanuel Dreyfus 30 Apr '14

30 Apr '14

Hello We had a nasty incident with OpenLDAP 2.4.33 (and DB 4.8.30). slapd started to forget about somes entries. There is no error in the logs, but we can see that SRCH operation on some objects that existed randomly returned nentries=0 instead of nentriees=1 We fixed it by destroying the DB and resync'ing from master. Is it a known problem? I upgraded to 2.4.39 after the problem, but I would like to be sure I will not encounter that again. -- Emmanuel Dreyfus manu(a)netbsd.org

1 0

slap_timestamp with microsecond granularity?
by Paul B. Henson 29 Apr '14

29 Apr '14

Reviewing current time handling code, while lutil_parsetime understands and can parse a generalized time that includes fractions of a second, there doesn't seem to be any code that can generate a generalized time string including fractions of a second, in particular to microsecond resolution (to match a struct timeval time)? I'd like to enhance the current password policy module to use microsecond resolution for the pwdFailureTime attribute, as the current 1 second resolution makes it less than ideal for account lockouts. Currently, it is using slap_timestamp to generate the generalized time to store, which only provides a generalized time with 1 second granularity. On initial review, it looks like simply storing a generalized time with microsecond resolution in the pwdFailureTime attribute is all that is required to enhance the ppolicy module for better account lockout support, because as previously mentioned lutil_parsetime already understands and can parse fractional seconds. I don't see any other code that would need to be modified so far. The question is how to generate the needed format? One option would be to enhance one way or another the existing generic support, perhaps adding a slap_timestamp_usec function? Another would be to just add a call to gettimeofday() next to the current call to time() in the ppolicy code, generate the generalized time string with slap_timestamp, and then mash the fractional seconds into it. Ideally I'd like to get this enhancement to ppolicy accepted into the code base, so I'd appreciate some feedback as to what implementation would be preferred for this. Thanks...

4 5

LMDB data corruption/alignment issues on ARM
by Martin Lucina 29 Apr '14

29 Apr '14

Hi, I've just spent about two days chasing down a bug in my application using LMDB, where if I ran the code on an ARM (and ARM only) platform, data returned from mdb_get() would appear to be corrupted. The symtomps were quite bizarre, I'm including them here in case someone else sees something similar; you can skip to the conclusion if you're in a hurry: a) data written by an application process using mdb_put() appeared correct and consistent b) the same data read by a different application process using mdb_cursor_get() would appear consistent when examined with a live GDB on the target c) however, when actually running the application code, even under GDB, some data would mysteriously be corrupted d) single-stepping through one case of corruption lead me to a single LDR instruction which appeared to load bogus data from memory. GDB showed the same data (at the exact same memory address) as correct, i.e. not corrupted. e) the problem only occured on ARM and was always reproducible. Much experimenting and googling later I found [1], the upshot of which is that on some ARM platforms unaligned word accesses to data using LDR produce *bogus* data. No exception, nothing, just silent data corruption. My question is: Given that I'm storing C structs directly in LMDB, I need to get at least word-aligned pointers back from LMDB in order to be able to access the data safely. I've not found anything in the documentation or the source about being able to tweak alignment of key and data values; I *think* that all I need is an option where LMDB would guarantee a minimum word (4 byte in this case) alignment of data. How hard would this be to implement? Would you consider such a feature? The only workaround I can think of is explicitly copying all data I get back from LMDB into aligned struct pointers; for obvious performance reasons I don't want to do that. Martin [1] http://stackoverflow.com/questions/21488501/strange-pointer-arithmetic See the second answer, and the link to the ARM documentation for the LDR instruction.

2 4

ppolicy module limited to catching 1 login failure per second?
by Paul B. Henson 28 Apr '14

28 Apr '14

We're testing the ppolicy module for the purposes of enabling account lockout on our ldap infrastructure. During initial testing, I noticed that it didn't seem to be catching all of the failed logins, and then realized that the pwdFailureTime attribute in which they are stored seems to have a granularity of only 1 second? So, if there are 100 failed logins in 1 second, for the purposes of account lockout, the password policy module only records them all as 1 failed login? Such that if you had a pwdMaxFailure set to 100, an intruder would actually be able to get in 10000 password guess attempts before the account was actually locked out? Am I misunderstanding something here? Is there anyway to get pwdFailureTime to use microsecond granularity like entryCSN? Thanks...

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical April 2014