openldap-technical February 2015

openldap-technical@openldap.org

66 participants
63 discussions

Re: plz provide me any simple authentication code in ldap
by Andrew Findlay 06 Feb '15

06 Feb '15

On Fri, Feb 06, 2015 at 10:42:45AM +0530, Bharath K wrote: > To: Andrew Findlay <andrew.findlay(a)skills-1st.co.uk> Please keep your replies on-list so that others with similar problems can learn from the archive. > Subject: Re: plz provide me any simple authentication code in ldap > > i configured openldap and i added user in ldif file,,without authentication its > working.. when i use simple authenticaion its not working its showing as > invalid credentials so what might be the problem??.. I expect the credentials that you are presenting to the LDAP server are invalid (the DN or the password is wrong or is missing). If you want help you need to supply more information. Your code does not include the DN and password that you are trying to use, and you have not supplied any information about the entry that you are trying to bind as. You need to tell us or we cannot help you. When you run this program, what do you put on the command line? Did you turn up the logging as I suggested? What is in the log? Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

Compaction after a lot of appending dublicate keys
by Tom Kirchner 06 Feb '15

06 Feb '15

1 0

Chinese display garbled
by Tian Zhiying 05 Feb '15

05 Feb '15

Hello My ldif file type is UTF-8 as below. # file test.ldif test.ldif: UTF-8 Unicode text The test.ldif content includes Chinese, as below: # cat test.ldif dn: cn=行政部,ou=domain,dc=domain,dc=com cn: 行政部 gidnumber: 500 objectclass: posixGroup I can add it to the LDAP server. Then excuting this command “# ldapsearch -x -H ldap://localhost -b dc=domain,dc=com” , it display as below: # \E7\94\B0\E5\BF\97\E8\8B\B1, domain, domain.com dn:: Y24955Sw5b+X6IuxLG91PXRodW5kZXJzb2Z0LGRjPXRodW5kZXJzb2Z0LGRjPWNvbQ== cn:: 55Sw5b+X6Iux gidNumber: 500 objectClass: posixGroup objectClass: top How can I deal with it? Can you help me? Thanks!!!

5 5

FW: API to check if LDAP connection is valid?
by Bin Lu 05 Feb '15

05 Feb '15

Hi, Is there a public API that does the same work as LDAP_VALID()? I maintain a group of long live ldap connections but sometimes I get assertions from the library. Wondering if there is a way to check if the connection is still valid before I use it. Thanks, -binlu

1 0

regarding openldap
by Bharath K 05 Feb '15

05 Feb '15

i configured openldap and i added user in ldif file,,without authentication its working.. when i use simple authenticaion its not working its showing as invalid credentials so what might be the problem??..or else for whom shall i concern plz give any suggestions

1 0

Openldap migration from 2.4.11 to 2.4.40 for 4-way multimaster servers
by Gary Ho 05 Feb '15

05 Feb '15

Dear all, I have a 4-way multi-master openldap servers running in version 2.4.11. Let's say the servers name are A, B, C, D. I have another 4-way multi-master openldap servers running in version 2.4.40. Let's say the servers name are W,X,Y,Z. What's the proper procedure of migrating the data from servers A,B,C,D to W,X,Y,Z ? My procedure is as follows :- Export data from server A using slapcat command.- Delete the first 6 lines of the ldif files (the lines contains the contextCSN).- Shutdown the process slapd in servers W,X,Y,Z and remove all the openldap data files under /usr/local/var/openldap-data.- Import the ldif files to server W, then start the slapd process in server W.- Export the ldif files from server W.- Import the ldif files to server X,Y,Z respectively.- Start the slapd process in X,Y,Z. What I observe is that all four servers then has 100% CPU and never drop back to idle ? So, is there anything I do wrong ? Thanks

2 1

plz provide me any simple authentication code in ldap
by Bharath K 05 Feb '15

05 Feb '15

below is my code....by executing this i am getting as error as invalid credentials ############################################################################ import java.util.Hashtable; import javax.naming.Context; import javax.naming.InitialContext; import javax.naming. NamingEnumeration; import javax.naming.NamingException; public class SimpleBindDemo { public static void main(String[] args) throws NamingException { if (args.length < 2) { System.err.println("Usage: java SimpleBindDemo <userDN> <password>"); System.exit(1); } Hashtable env = new Hashtable(); env.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory"); env.put(Context.PROVIDER_URL, "ldap://localhost:389/"); env.put(Context.SECURITY_AUTHENTICATION, "simple"); //env.put(Context.SECURITY_PRINCIPAL,"cn=Manager,ou=People,dc=example,dc=com"); //env.put(Context.SECURITY_CREDENTIALS,"ldap123"); env.put(Context.SECURITY_PRINCIPAL,args[0]); env.put(Context.SECURITY_CREDENTIALS,args[1]); try { Context ctx = new InitialContext(env); NamingEnumeration enm = ctx.list(""); while (enm.hasMore()) { System.out.println(enm.next()); } enm.close(); ctx.close(); } catch (NamingException e) { System.out.println(e.getMessage()); } } }

2 1

ppolicy: pwdMinAge being enforced for managers
by Phil 04 Feb '15

04 Feb '15

Hi all, We're implementing a basic user directory with OpenLDAP and the ppolicy attributes pwdMaxAge and pwdMinAge give use some desired functionality, but we need the ability for managers to reset a user's password. If we use the “rootdn” then this works, but we need to have other user accounts designated as managers. Even if we define ACLs to give our management group “manage” access we can still get the following from ldappasswd: Result: Constraint violation (19) Additional info: Password is too young to change Is there any way to designate a group of users as "managers" such that pwdMinAge is not applied? These are the ACLs we've tried without success to give the “UserAdmin” group the rights: cat <<__EOF | ldapmodify -Y EXTERNAL -H ldapi:/// dn: olcDatabase={2}bdb,cn=config changetype: modify add: olcAccess olcAccess: to attrs=userPassword by self =xw by group.exact="cn=UserAdmin,${LDAP_SERVER_BASE}" manage by anonymous auth by * none olcAccess: to dn.base="ou=Users,${LDAP_SERVER_BASE}" by group.exact="cn=UserAdmin,${LDAP_SERVER_BASE}" manage by * read olcAccess: to dn.children="ou=Users,${LDAP_SERVER_BASE}" filter=(objectClass=posixAccount) by group.exact="cn=UserAdmin,${LDAP_SERVER_BASE}" write by * read olcAccess: to dn.base="cn=UserAdmin,${LDAP_SERVER_BASE}" attrs=member by group.exact="cn=UserAdmin,${LDAP_SERVER_BASE}" write by * read olcAccess: to * by * read - __EOF Thanks Phil

1 0

ldapadd(1) second DIT
by Igor Shmukler 04 Feb '15

04 Feb '15

Hello, I am having a problem executing the ldapadd(1) through ldapi for the below LDIF: dn: olcDatabase=hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: hdb olcDbDirectory: /var/lib/ldap/example.com olcSuffix: dc=example,dc=com olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=example,dc=com" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by self write by dn="cn=admin,dc=example,dc=com" write by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=example,dc=com olcRootPW:: e1NTSEF9NlZSbnN2bkJEWVdSbFFoS1ZWOE1TckxTdWhsc0NvSVg= olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq The error is below: ldapadd: invalid format (line 12) entry: "olcDatabase=hdb" The line 12 contains: olcRootDN, it seems. I successfully tried a similar setup earlier. Please advise what should I check for clues. Sincerely, Igor Shmukler

2 2

bind UID in DN instead of CN
by Dennis 04 Feb '15

04 Feb '15

Hi everyone, I'm new to the ldap stuff, therefore sorry if this is a silly question. My openldap (slapd) version is 2.4.28. To manage openldap I'm using phpldapadmin. I'm using a third party software which relies on ldap to manage users. I've added a test user to ldap via phpldapadmin. The 3rd party software tries to modify/add an object via the following bind: slapd[19030]: conn=1435 fd=18 ACCEPT from IP=X.X.X.X:35541 (IP=0.0.0.0:389) slapd[19030]: conn=1435 op=0 BIND dn="cn=admin,dc=dmp,dc=..." method=128 slapd[19030]: conn=1435 op=0 BIND dn="cn=admin,dc=dmp,dc=..." mech=SIMPLE ssf=0 slapd[19030]: conn=1435 op=0 RESULT tag=97 err=0 text= slapd[19030]: conn=1435 op=1 MOD dn="uid=test1003,ou=users,dc=dmp,dc=..." slapd[19030]: conn=1435 op=1 MOD attr=objectclass slapd[19030]: conn=1435 op=1 RESULT tag=103 err=32 text= slapd[19030]: conn=1435 fd=18 closed (connection lost) This fails because it tries to accomplish this by using dn="uid=...", but as shown in phpldapadmin the dn is cn=Test Testuser,ou=users,dc=dmp,dc=... Therefore the distinguished name for dn="uid=...,ou=users,dc=dmp,dc=..." doesn't exist (the user has a uid of course). Therefore my question is, is there a possibility to change / to configure openldap to use / allow the uid instead of the cn? Or did I something wrong? So far I couldn't find any information about this. Any help is welcome and I would really appreciate this :) Best regards and have a nice weekend! Dennis Wehrle

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical February 2015