openldap-technical December 2015

openldap-technical@openldap.org

53 participants
66 discussions

openldap newbie - olcAccess ACL configuration
by Gary Spencer 23 Dec '15

23 Dec '15

Hi, I have deployed a new OpenLDAP server (RHEL 7.1 / openldap-2.4) and have read Matt Butcher's 'Mastering ...' book and the OpenLDAP-Admin-Guide but I'm continuing to struggle to find the information I need to satisfactorily configure using the dynamic way of working instead of using the legacy slapd.conf method. (Any reference to administering ldap using dynamic method would be appreciated) I have OpenLDAP basically configured to answer queries using the Manager object, but I want to remove current privileges and have just two accounts in the system ou - one with read only to the users ou and all objects therein, and one with the equivalent of Manager rights to the users OU that I can give to my devs to create their own users. I would retain the Manager account for full access, but would just like to give out the readonly and readwrite accounts in system OU permissions to users OU, and remove users permissions to anything but themselves. My intention is to delete the existing olcAccess rules and implement a new set, but I can't get rid of the old rules as it's not letting me. When I try 'ldapmodify -x -W -H "ldap://HOSTNAME" -D "cn=Manager,dc=SUBDOMAIN,dc=DOMAIN,dc=TLD" -f acl_delete_file.ldif' I receive :- 'modifying entry "olcDatabase={2}hdb,cn=config" ldap_modify: Insufficient access (50)' The delete ldif looks like this :- # {2}hdb, config dn: olcDatabase={2}hdb,cn=config delete: olcAccess I am using the default hdb database. I understood 'Manager' had full access to everything regardless, can anyone shed any light on why this request would be refused ? Gary Spencer Infrastructure Project Engineer [http://www.sis.tv/contentAsset/raw-data/369d823c-5153-4089-a9b6-4d868930a68…]<http://www.sis.tv/contact/streaming-from-sis.html> ********************************************************************** Satellite Information Services Limited. Registered Office: Whitehall Avenue, Kingston, Milton Keynes, Buckinghamshire, MK10 0AX. Company No. 4243307 The information in this email (which includes any files transmitted with it) is confidential and is intended for the addressee only. Unauthorized recipients are required to maintain confidentiality. If you have received this email in error please notify the sender immediately, destroy any copies and delete it from your computer system. **********************************************************************

2 1

Server Side Searching Overlay
by Michael 23 Dec '15

23 Dec '15

So I have a request from developers to enable the sssvlv overlay. They would like the server to return sorted searches on I enabled the overlay and then to test the functionality I added the following "ordering" rule to the core.schema. attributetype ( 2.5.4.4 NAME ( 'sn' 'surname' ) DESC 'RFC2256: last (family) name(s) for which the entity is known by' ORDERING caseIgnoreOrderingMatch SUP name ) The following ldapsearch works as expected and returns the "sn" attribute in alphabetical order. ldapsearch -x -ZZ -D cn=root,dc=testlott,dc=lott -w password objectclass=person -E sss=sn sn Based on this information I have several questions. 1. Will I be violating any RFC by modifying the core.schema?2. The developers want the same functionality with the "cn" attribute. Is this supported or even possible?3. They also request this functionality on a couple of attributes in a custom schema. Is adding an "ordering" rule as I did with the "sn" attribute the proper way to do this? Thanks.

3 8

access log or last bind overlay working with bind_anon?
by Tan, Eric 22 Dec '15

22 Dec '15

Hello, I have been doing a lot of research into OpenLDAP and it’s functionalities.. While I have set up a few OpenLDAP servers before, there are many facets of the software I am unfamiliar with. Recently, I was asked to find a way to obtain a list of users and their last login for auditing reasons (We need to disable the users after a certain amount of time of inactivity) I have looked into a few different solutions but have been unable to reach anyone with enough knowledge for some reason so here is an email with some hope as to get some information to point me in the right direction. I think there are two things that may work for my purposes.. The last bind overlay or the access log overlay. For the Lastbind overlay, since we are using anonymous bind, do you know if this will still work for us? For the access log, how would I pull this specific information out of the database? According to the man pages: logops <operations> Specify which types of operations to log. The valid operation types are abandon, add, bind, compare, delete, extended, modify, modrdn, search, and unbind. Aliases for common sets of operations are also available: writes add, delete, modify, modrdn reads compare, search Session Would this work if are using anonymous binding as well? Any help would be greatly appreciated! -Eric

1 0

Bug in last LMDB GitHub commit (Windows + VL32)
by Jeremiah Morrill 21 Dec '15

21 Dec '15

Pretty excited about the 32bit support! I was just kicking the tires on it today and I realize this is still a work in progress, but I wanted to report a possible bug with VL32/Windows. When I open a database with MDB_RDONLY and seek a cursor to MDB_LAST, I get a system error code of 0xc000004e (STATUS_SECTION_PROTECTION) from NtMapViewOfSection. This is presumably because of the MEM_RESERVE_FLAG is present on the open of the db when MDB_RDONLY is used. After patching up the NtMapViewOfSection, I get a 0xc000001f(STATUS_INVALID_VIEW_SIZE) from NtMapViewOfSection. I believe this happens because it is requesting a view that goes beyond the size of the db. A quick adjustment on the “len” being requested seems to have “fixed” it. I have included a diff patch below. I realize this is a naïve hack, but hoped it could be useful in reproducing and fixing. -Jer diff --git a/src/lmdb/mdb.c b/src/lmdb/mdb.c index 297d3e3..d594a6f 100644 --- a/src/lmdb/mdb.c +++ b/src/lmdb/mdb.c @@ -5655,7 +5655,7 @@ mdb_rpage_get(MDB_txn *txn, pgno_t pg0, MDB_page **ret) #define MAP(rc,env,addr,len,off) \ addr = NULL; \ rc = NtMapViewOfSection(env->me_fmh, GetCurrentProcess(), &addr, 0, \ - len, &off, &len, ViewUnmap, MEM_RESERVE, PAGE_READONLY) + len, &off, &len, ViewUnmap, ((env->me_flags & MDB_RDONLY) == 0) ? MEM_RESERVE : 0, PAGE_READONLY) #else off_t off; size_t len; @@ -5835,6 +5835,14 @@ retry: } } SET_OFF(off, pgno * env->me_psize); + +#ifdef MDB_VL32 + if(off.QuadPart + len > env->me_mapsize) + { + len = env->me_mapsize - off.QuadPart; + } +#endif + MAP(rc, env, id3.mptr, len, off); if (rc) { fail:

2 1

Re: pass-through authentication
by Chuck Theobald 21 Dec '15

21 Dec '15

Sounds like a SASL2 pass-through solution could work, esp. if you can get an account there with query capabilities. I will look for some references that could get you started. Chuck Sent from my Verizon Wireless 4G LTE DROID Timothy Keith <timothy.g.keith(a)gmail.com> wrote: >We have limited access to the servers. Same company, different IT organization. Our LDAP requirement must be transparent to those servers. We want to inherit the LDAP directory information from the Unix servers - mostly the user Id and passwords, and add information that is needed by applications that our servers will manage. > > >Tim > > >On Fri, Dec 18, 2015 at 4:01 PM, Chuck Theobald <chuckt(a)uoregon.edu> wrote: > >Details of your authn server would be helpful. Do you have access to the admins of that server? Are they cooperative? > >I tried to set this up using SASL to communicate with the campus Active Directory. Reliability is a bit suspect, it will typically take 3-4 attempts to get a successful authentication. Also, the setup requires an account on AD that is capable of making queries. The particulars of our installation force me to use my own - not ideal. > >Anyway, your situation may vary, so send us some details on what you are trying to talk to for autn. > >Chuck > > > > >On 12/17/2015 04:32 PM, Timothy Keith wrote: > >We are attempting to set up an LDAP server which will answer queries >from an application. The database will contain metadata on a set of >users in the application. The application will also query the server >to authenticate the user’s password, however, this server will not >house the password. That resides on another server, which our server >will query. We do not have administrative rights to the other >server. > > The difficulty we are having now is setting up the pass-through >authentication for the passwords. Any pointers in how to proceed with >this would be greatly appreciated. > >Regards, > >Tim > > > >-- >Chuck Theobald >System Administrator >The Robert and Beverly Lewis Center for Neuroimaging >University of Oregon >P: 541-346-0343 >F: 541-346-0345 > > >

1 0

LMDB: question about MDB_RESERVE
by Christian Sell 21 Dec '15

21 Dec '15

Hello all, I have a question about the MDB_RESERVE flag. The documentation in some places says "reserve space for data of the given size, but don't copy the given data. Instead, return a pointer to the reserved space, which the caller can fill in later - before the next update operation or the transaction ends." My question is specifically about the "before the next update operation or the transaction ends" part. Does this mean the reserved buffer becomes unusable as soon as another put is executed? What exactly happens? This statement does not appear consistently, which is why I am doubting.. thanks + happy holidays, Chris

3 3

Regarding Transactions that span Multiple files
by Mohammed Muneer 21 Dec '15

21 Dec '15

Create Env - staff Create Env - payroll Create Txn_staff Create Txn_payroll Begin write transaction for Txn_staff Insert staff data Set Txn_payroll parent to Txn_staff Begin write transaction for Txn_payroll Insert payroll data Commit Txn_payroll Commit Txn_staff ------------------------------------------------------------------ Can the above Pseudocode work in lmdb ? Or in other words can a transactions span multiple env's? Thanks.

2 1

pass-through authentication
by Timothy Keith 21 Dec '15

21 Dec '15

We are attempting to set up an LDAP server which will answer queries from an application. The database will contain metadata on a set of users in the application. The application will also query the server to authenticate the user’s password, however, this server will not house the password. That resides on another server, which our server will query. We do not have administrative rights to the other server. The difficulty we are having now is setting up the pass-through authentication for the passwords. Any pointers in how to proceed with this would be greatly appreciated. Regards, Tim

3 3

Attribute pwdPolicySubentry
by Borresen, John - 0444 - MITLL 19 Dec '15

19 Dec '15

I've been reading the Password Policy section of the Admin Guide. I am currently at this portion of the setup (the default policy is set up) You can create additional policy objects as needed. There are two ways password policy can be applied to individual objects: 1. The pwdPolicySubentry in a user's object - If a user's object has a pwdPolicySubEntry attribute specifying the DN of a policy object, then the policy defined by that object is applied. 2. Default password policy - If there is no specific pwdPolicySubentry set for an object, and the password policy module was configured with the DN of a default policy object and if that object exists, then the policy defined in that object is applied. When trying to add the pwdPolicySubentry attribute, I receive the following: "According to the schema attribute pwdPolicySubentry is not allowed." First, can someone explain the meaning of #2. The way, that I read that is that if the "pwdPolicySubentry" is not available, and the policy was created.then the policy is applied. Is that correct? My policy looks like: dn: cn=default,ou=pwpolicies,dc=example,dc=ldap objectClass: top objectClass: organizationalRole objectClass: pwdPolicy cn: default pwdAttribute: 2.5.4.35 pwdAllowUserChange: TRUE pwdExpireWarning: 14 pwdLockout: TRUE pwdLockoutDuration: 300 pwdMaxAge: 15552000 pwdMaxFailure: 5 pwdFailureCountInterval: 0 pwdMinAge: 1 pwdMinLength: 9 pwdMustChange: TRUE Thanks in advance. John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Humanitarian Assistance and Disaster Relief (HADR) Systems 244 Wood St Lexington, MA 02420 Email: <mailto:john.borresen@ll.mit.edu> john.borresen(a)ll.mit.edu

7 15

Re: Attribute pwdPolicySubentry
by Michael Ströder 19 Dec '15

19 Dec '15

Emmanuel Lécharny wrote: > Le 19/12/15 12:44, Michael Ströder a écrit : >> Howard Chu wrote: >>> Michael Ströder wrote: >>>> Borresen, John - 0444 - MITLL wrote: >>>>> Interesting! I was able to add it via command-line with ldapadd. But, when >>>>> viewing it in Apache Directory Studio, it still didn't show up -- that is >>>>> until I enabled Operational Attributes. >>>> Attribute 'pwdPolicySubentry' is somewhat special because it's not referenced by >>>> any object class. You can simply add it to any entry. >>> It is an operational attribute, so by definition, it can be added to any entry. >> But 'pwdPolicySubentry' is the only attribute typically set by a LDAP client in >> opposite to all other operational attributes like 'createTimestamp' etc. >> >> So it's special for schema-aware LDAP GUI clients. > That's irrelevant. > > It's an operational attribute that can be set by the users, which is > perfectly legit. There is nothing 'special' about it. As said: It's not special in regard to RFC 4512. But it's not that easy to implement a generic UI which guides the user to always do the right thing. And obviously there are some generic LDAP UIs out there which prevents the user from setting this attribute by false client-side schema check. > Re-read RFC 4512 section 3.4. Nothing in there describes how a client could find out which operational attribute(s) to always present in an input form. One could display input fields for all operational attrs which does not have NO-USER-MODIFICATION set. But not all servers use that consequently enough. (Not to speak of "experimental" schema used for years being hidden by errornous .666 OID policy making schema look incomplete at the client side.) Ciao, Michael.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical December 2015