openldap-technical March 2015

openldap-technical@openldap.org

51 participants
70 discussions

How to use ldapsearch -Esync ?
by Thomas Cort 16 Mar '15

16 Mar '15

Hi, I'm writing a script that acts on changes in LDAP. I want it to watch the stream of changes, and if the script gets restarted, pick up where it left off. I'm hoping to just be able to pipe ldapsearch -Esync into an LDIF parser -- instead of using the C API. I can get all of the changes with the -Esync=ro option and stream the changes with -Esync=rp, but I can't seem to find the magic combination to pick up where it left off. I tried the command mentioned in the "Replication from OpenLDAP to Fedora 389 DS" thread[1], but no matter what cookie I use (the final control value either as a base64 string or decoded) I can't seem to get it to pick up where it left off. Is my understanding wrong or am I missing something? This is how I understand/expect it to work: ldapsearch ... -Esync=ro # get everything, plus a cookie at the end. # feed the cookie to the next command ldapsearch ... -Esync=ro/cookie # get everything since the last search Any help would be greatly appreciated. Thanks, Thomas [1] http://www.openldap.org/lists/openldap-technical/201402/msg00327.html

1 0

external authentication source
by Dieter Klünter 16 Mar '15

16 Mar '15

Hi, rfc-4422 describes an EXTERNAL mechanism. Is there any means of defining and configuring an external authentication and authorization source, like an external sasl server? Or is this just confined to the client to provide an appropriate authorization string? -Dieter -- Dieter Klünter | Systemberatung http://sys4.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

3 3

openldap mirror mode replication does the versions of client matter
by Rakesh Rajasekharan 14 Mar '15

14 Mar '15

Hi, I have set up mirror mode replication with both my masters running 2.4.39 version. I have around 1000 clients connecting. The versions of openldap on these clients varies from 2.3.43( thats really old I know) , 2.4.23 and few have 2.4.39. My problem is the ldap servers almost hangs or freezes when the clients start connecting. In the error logs , I see this pattern " conn=6005 fd=4199 closed (TLS negotiation failure " Is this something to do with the client versions and will upgrading help. I was skeptical as this is in production. One more question, In mirror mode is it ok to have more than 2 masters. Thanks, Rakesh

2 1

Is CA issued certificate using OpenSSL as good as GoDaddy
by jeevan kc 12 Mar '15

12 Mar '15

I followed the below OpenLDAP guide to create CA issued certificate using OpenSSL and was able to enable SSL in the ldap server and applications can connect via ldaps:// port 636. Now I have some questions from the management where this certificate is as safe as the commercial certificates out there. Can someone clarify this? I would appreciate it. I followed the same procedures mentioned in the guide. 4.2 CA Issued CertificateIf you have access to a trusted Certificate Authority (CA), then step through the CA process to get a CA certificate, server certificate and server private key. See section 5.0 for info on how to configure your server with these items.However, if a trusted CA is not available, OpenSSL makes the same process quick and easy.The steps: 1. Create any directory for creating and signing your certificates. For example, /var/myca.% mkdir /var/myca2. Change to /var/myca and run the OpenSSL CA script (in /usr/share/ssl/misc/ on my box):% cd /var/myca/ % /usr/share/ssl/misc/CA.sh -newca CA certificate filename (or enter to create) <enter> Making CA certificate ... Using configuration from /etc/ssl/openssl.cnf Generating a 1024 bit RSA private key ..........................++++++ .........................++++++ writing new private key to './demoCA/private/./cakey.pem' Enter PEM pass phrase: <ca pass> Verifying password - Enter PEM pass phrase: <ca pass again> ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:US State or Province Name (full name) [Some-State]:Texas Locality Name (eg, city) []:Austin Organization Name (eg, company) [Internet Widgits Pty Ltd]:Example Org Organizational Unit Name (eg, section) []:Example Unit Common Name (eg, YOUR name) []:example.com Email Address []:. %This creates demoCA/cacert.pem and demoCA/private/cakey.pem (CA cert and private key).3. Make your server certificate signing request (CSR):% openssl req -newkey rsa:1024 -nodes -keyout newreq.pem -out newreq.pem Using configuration from /etc/ssl/openssl.cnf Generating a 1024 bit RSA private key ..............++++++ ..........................++++++ writing new private key to 'newreq.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:US State or Province Name (full name) [Some-State]:Texas Locality Name (eg, city) []:Austin Organization Name (eg, company) [Internet Widgits Pty Ltd]:Example Org Organizational Unit Name (eg, section) []:Example Org Unit Common Name (eg, YOUR name) []:myserver.com Email Address []:ldap@myserver.com Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: <pass> An optional company name []:. %The result is newreq.pem.4. Have the CA sign the CSR:% /usr/share/ssl/misc/CA.sh -sign Using configuration from /etc/ssl/openssl.cnf Enter PEM pass phrase: <ca pass> Check that the request matches the signature Signature ok The Subjects Distinguished Name is as follows countryName :PRINTABLE:'US' stateOrProvinceName :PRINTABLE:'Texas' localityName :PRINTABLE:'Austin' organizationName :PRINTABLE:'Example Org' organizationalUnitName:PRINTABLE:'Example Org Unit' commonName :PRINTABLE:'myserver.com' emailAddress :IA5STRING:'ldap(a)myserver.com' Certificate is to be certified until Apr 10 18:58:58 2004 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: md5WithRSAEncryption Issuer: C=US, ST=Texas, L=Austin, O=Example Org, OU=Example Unit, CN=example.com Validity Not Before: Apr 11 18:58:58 2003 GMT Not After : Apr 10 18:58:58 2004 GMT Subject: C=US, ST=Texas, L=Austin, O=Example Org, OU=Example Org Unit, CN=myserver.com/Email=ldap@myserver.com Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): < ... > Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: D0:C0:9D:46:30:65:2A:9C:63:63:6A:E6:FE:E4:AC:F7:21:F8:33:61 X509v3 Authority Key Identifier: keyid:31:2E:0D:FB:A0:74:5A:0B:4B:C5:C4:E0:69:7F:32:6D:AF:46:82:F1 DirName:/C=US/ST=Texas/L=Austin/O=Example Org/OU=Example Unit/CN=example.com serial:00 Signature Algorithm: md5WithRSAEncryption < ... > -----BEGIN CERTIFICATE----- < ... > -----END CERTIFICATE----- Signed certificate is in newcert.pem %This creates newcert.pem (server certificate signed by CA) with private key, newreq.pem.5. Now the certificates can be moved to the desired certificate repository and renamed. I prefer /usr/var/openldap-data as my certificate directory.% cp demoCA/cacert.pem /usr/var/openldap-data/cacert.pem % mv newcert.pem /usr/var/openldap-data/servercrt.pem % mv newreq.pem /usr/var/openldap-data/serverkey.pem % chmod 400 /usr/var/openldap-data/serverkey.pem

3 2

Re: external authentication source
by Hallvard Breien Furuseth 12 Mar '15

12 Mar '15

On 12. mars 2015 14:13, Mattes wrote: > Wouldn't "lapwhoami -Y EXTERNAL -H ldapi://" be more usefull? Duh, right. (ldapwhoami) -- Hallvard

1 0

question about binding to our new openldap server
by Wang, Hui 11 Mar '15

11 Mar '15

Hi We just upgrade our OS system and installed the most recent openldap version: 2.4.4. I moved the config file and related openldap data files from older version 2.3.4 onto this new server. I can't make successful binding at this moment. The following is from the log file. Should I install the same version of openldap on this new box since I am trying to binding with old data file? Thank you all. Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 fd=10 ACCEPT from IP=130.*.*.*:61404 (IP=0.0.0.0:389) Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=0 BIND dn="" method=128 Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=0 RESULT tag=97 err=0 text= Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=1 SRCH base="ou=Auth,o=csun" scope=0 deref=0 filter="(objectClass=*)" Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=1 SRCH attr=1.1 Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text= Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=2 SRCH base="ou=Auth,o=csun" scope=0 deref=0 filter="(objectClass=*)" Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=2 SEARCH RESULT tag=101 err=32 nentries=0 text= Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=3 SRCH base="ou=Auth,o=csun" scope=1 deref=0 filter="(objectClass=*)" Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=3 SRCH attr=objectclass subschemaSubentry Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=3 SEARCH RESULT tag=101 err=32 nentries=0 text= Mar 11 13:22:05 oldaptest01 slapd[28623]: conn=1040 fd=13 ACCEPT from IP=130.*.*.*:62211 (IP=0.0.0.0:389) Mar 11 13:22:05 oldaptest01 slapd[28623]: conn=1040 op=0 BIND dn="cn=directory manager,o=csun" method=128 Mar 11 13:22:05 oldaptest01 slapd[28623]: conn=1040 op=0 RESULT tag=97 err=49 text= Mar 11 13:22:07 oldaptest01 slapd[28623]: conn=1040 op=1 UNBIND Mar 11 13:22:07 oldaptest01 slapd[28623]: conn=1040 fd=13 closed Mar 11 13:22:08 oldaptest01 slapd[28623]: conn=1041 fd=13 ACCEPT from IP=130.*.*.*:62213 (IP=0.0.0.0:389) Mar 11 13:22:08 oldaptest01 slapd[28623]: conn=1041 op=0 BIND dn="cn=directory manager,o=csun" method=128 Mar 11 13:22:08 oldaptest01 slapd[28623]: conn=1041 op=0 RESULT tag=97 err=49 text= Mar 11 13:22:09 oldaptest01 slapd[28623]: conn=1041 op=1 UNBIND Mar 11 13:22:09 oldaptest01 slapd[28623]: conn=1041 fd=13 closed Hui Wang CSUN IT department

3 2

could not bind to openldap
by Wang, Hui 11 Mar '15

11 Mar '15

Hi We just installed openldap on a new server. I could not bind to it. I tried with anonymous user and also the user from the default conf file. But doesn't work. Can anyone help? Here is my conf file and my logs database bdb suffix "dc=my-domain,dc=com" rootdn "cn=Manager,dc=my-domain,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. # directory /usr/local/var/openldap-data directory /usr/local/var/openldap-data/defaultFromServerInstall # Indices to maintain index objectClass eq from log file: Mar 11 13:45:36 oldaptest01 slapd[27984]: slapd starting Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 fd=10 ACCEPT from IP=130.*.*.*:54015 (IP=0.0.0.0:389) Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=0 BIND dn="" method=128 Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=0 RESULT tag=97 err=0 text= Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=1 SRCH base="dc=my-domain,dc=com" scope=0 deref=0 filter="(objectClass=*)" Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=1 SRCH attr=1.1 Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text= Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=2 SRCH base="dc=my-domain,dc=com" scope=0 deref=0 filter="(objectClass=*)" Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=2 SEARCH RESULT tag=101 err=32 nentries=0 text= Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=3 SRCH base="dc=my-domain,dc=com" scope=1 deref=0 filter="(objectClass=*)" Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=3 SRCH attr=objectclass subschemaSubentry Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=3 SEARCH RESULT tag=101 err=32 nentries=0 text= Mar 11 13:50:52 oldaptest01 slapd[27984]: conn=1001 fd=13 ACCEPT from IP=130.*.*.*:62744 (IP=0.0.0.0:389) Mar 11 13:50:52 oldaptest01 slapd[27984]: conn=1001 op=0 BIND dn="cn=Manager,dc=my-domain,dc=com" method=128 Mar 11 13:50:52 oldaptest01 slapd[27984]: conn=1001 op=0 RESULT tag=97 err=49 text= Mar 11 13:50:53 oldaptest01 slapd[27984]: conn=1001 op=1 UNBIND Mar 11 13:50:53 oldaptest01 slapd[27984]: conn=1001 fd=13 closed Hui Wang (Holly) CSUN IT Department Identity and Directory Service 818-677-2031 holly.wang(a)csun.edu

1 0

ppolicy configuration
by Igor Shmukler 10 Mar '15

10 Mar '15

Hello, I am trying to apply per domain password policy. [At some point, it seems, these scripts worked for me, but I must have messed something up either in the setup or the scripts.] I managed to load ppolicy.la and from lsof(8), I can see it. Now, I want to be able to turn password policy on each domain. I have a simple script invoked as: $sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f ppolicy.ldif The ppolicy.ldif is: dn: olcOverlay=ppolicy,olcDatabase={2}hdb,cn=config changetype: add objectClass: olcPPolicyConfig olcOverlay: ppolicy olcPPolicyDefault: cn=ppolicy,ou=policies,dc=example,dc=com olcPPolicyUseLockout: TRUE olcPPolicyHashCleartext: TRUE When I try to add the online configuration, I get: SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "olcOverlay=ppolicy,olcDatabase={2}hdb,cn=config" ldap_add: Other (e.g., implementation specific) error (80) additional info: User Schema load failed for attribute "pwdAttribute". Error code 17: attribute type undefined I also have an LDIF for default policy, added as: $ldapadd -x -D cn=admin,dc=example,dc=com -W -f default_ppolicy.ldif It contains: dn: ou=policies,dc=example,dc=com objectClass: top objectClass: organizationalUnit ou: policies dn: cn=ppolicy,ou=policies,dc=example,dc=com objectClass: top objectClass: device objectClass: pwdPolicyChecker objectClass: pwdPolicy cn: ppolicy pwdAttribute: userPassword pwdInHistory: 8 pwdMinLength: 8 pwdMaxFailure: 3 pwdFailureCountInterval: 1800 pwdCheckQuality: 0 pwdMustChange: TRUE pwdGraceAuthNLimit: 0 pwdMaxAge: 7776000 pwdExpireWarning: 1209600 pwdLockoutDuration: 900 pwdLockout: TRUE When I try to add default_ppolicy.ldif, I get: adding new entry "ou=policies,dc=example,dc=com" adding new entry "cn=ppolicy,ou=policies,dc=example,dc=com" ldap_add: Invalid syntax (21) additional info: objectClass: value #2 invalid per syntax It seems that OU=policies is created, but CN=ppolicy is not created. Is that right? I have four (4) values for objectClass. How can I find out which one is triggering the error? Any suggestions where I should start looking?! Thank you, Igor Shmukler

3 7

ldap_sasl_bind_s question
by Markus Moeller 05 Mar '15

05 Mar '15

Hi, I try to replace deprecated ldap_bind_s with ldap_sasl_bind_s but I am missing some details about how to do that. With ldap_bind_s I have method as a int and ldap.h has the following defined /* authentication methods available */ #define LDAP_AUTH_NONE ((ber_tag_t) 0x00U) /* no authentication */ #define LDAP_AUTH_SIMPLE ((ber_tag_t) 0x80U) /* context specific + primitive */ #define LDAP_AUTH_SASL ((ber_tag_t) 0xa3U) /* context specific + constructed */ #define LDAP_AUTH_KRBV4 ((ber_tag_t) 0xffU) /* means do both of the following */ #define LDAP_AUTH_KRBV41 ((ber_tag_t) 0x81U) /* context specific + primitive */ #define LDAP_AUTH_KRBV42 ((ber_tag_t) 0x82U) /* context specific + primitive */ but in ldap_sasl_bind_s it is a char variable and I do not know what the value would be for the above auth methods. Where can I find them documented ? int ldap_sasl_bind_s(LDAP *ld, const char *dn, const char *mechanism, struct berval *cred, LDAPControl *sctrls[], LDAPControl *cctrls[], struct berval **servercredp); Thank you Markus

3 5

ldap specifying host attribute
by Rakesh Rajasekharan 04 Mar '15

04 Mar '15

Hi, I am trying to set up a host based authentication. For that ,am modifying the host attribute of existing users through an ldif file as below dn: uid=sam,ou=People,dc=example,dc=com changetype: modify add: objectClass objectClass: hostObject - add: host host: abc host: xyz Is there a way I can put the lidt of hosts in a single line something like this host: xyz abc Thanks, Rakesh

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical March 2015