openldap-technical August 2015

openldap-technical@openldap.org

55 participants
62 discussions

Virtual list view problem
by Venish Khant 31 May '16

31 May '16

Hi all I am using cpan Net::LDAP module to access LDAP entries. I want to search LDAP entries using Net::LDAP search method. When I do search, I want some limited number of entries from search result, for this(searching) process I am using Net::LDAP::Control::VLV module. But I get error on VLV response control. Please, any one have idea about this error. * Error:* Died at vlv.pl line 50, This is my example. I changed the font style of line 50 #!/usr/bin/perl -w use Net::LDAP; use Net::LDAP::Control::VLV; use Net::LDAP::Constant qw( LDAP_CONTROL_VLVRESPONSE ); use Net::LDAP::Control::Sort; sub procentry { my ( $mesg, $entry) = @_; # Return if there is no entry to process if ( !defined($entry) ) { return; } print "dn: " . $entry->dn() . "\n"; @attrs = $entry->attributes(); foreach $attr (@attrs) { #printf("\t%s: %s\n", $attr, $entry->get_value($attr)); $attrvalue = $entry->get_value($attr,asref=>1); #print $attr.":". $entry->get_value($attr)."\n"; foreach $value(@$attrvalue) { print "$attr: $value\n"; } } $mesg->pop_entry; print "\n"; } $ldap = Net::LDAP->new( "localhost" ); # Get the first 20 entries $vlv = Net::LDAP::Control::VLV->new( before => 0, # No entries from before target entry after => 19, # 19 entries after target entry content => 0, # List size unknown offset => 1, # Target entry is the first ); my $sort = Net::LDAP::Control::Sort->new( order => 'cn' ); @args = ( base => "dc=example,dc=co,dc=in", scope => "subtree", filter => "(objectClass=inetOrgPerson)", callback => \&procentry, # Call this sub for each entry control => [ $sort, $vlv ], ); $mesg = $ldap->search( @args ); # Get VLV response control *($resp) = $mesg->control( LDAP_CONTROL_VLVRESPONSE ) or die;* $vlv->response( $resp ); # Set the control to get the last 20 entries $vlv->end; $mesg = $ldap->search( @args ); # Get VLV response control ($resp) = $mesg->control( LDAP_CONTROL_VLVRESPONSE ) or die; $vlv->response( $resp ); # Now get the previous page $vlv->scroll_page( -1 ); $mesg = $ldap->search( @args ); # Get VLV response control ($resp) = $mes # Now page with first entry starting with "B" in the middle $vlv->before(9); # Change page to show 9 before $vlv->after(10); # Change page to show 10 after $vlv->assert("B"); # assert "B" $mesg = $ldap->search( @args );g->control( LDAP_CONTROL_VLVRESPONSE ) or die; $vlv->response( $resp ); -- Venish Khant www.deeproot.co.in

4 11

storing HA1 password hash for HTTP DIGEST, SIP, TURN
by Daniel Pocock 06 Mar '16

06 Mar '16

Hi all, There are a few protocols that use a HA1[1] password hash, such as HTTP DIGEST[1], SIP DIGEST[2] and TURN[3] (which uses HMAC rather than DIGEST) Is there a standard LDAP attribute name for storing a HA1 value or should it be stored in a regular userPassword attribute as described in the manual[4]? I came across smbk5pwd for keeping SMB password attributes in sync. Is there a similar facility for keeping HA1 passwords in sync when a user changes the password or how could a developer go about adding that, would the smbk5pwd source be a useful model? Regards, Daniel 1. http://tools.ietf.org/html/rfc2617#section-3 2. https://tools.ietf.org/html/rfc3261#section-22.4 3. https://tools.ietf.org/html/rfc5389#section-15.4 4. http://www.openldap.org/doc/admin24/security.html#Password%20Storage

3 5

2.4.42 RPMs for openSUSE
by Michael Ströder 10 Sep '15

10 Sep '15

HI! I've updated my OpenLDAP builds for openSUSE and SLES12 to release 2.4.42. Build status and files: <https://build.opensuse.org/package/show/home:stroeder:branches:network:ldap…> Important note: If you're using the openldap packages shipped with openSUSE make sure to read the .changes files to see whether something could break your current setup. As usual I've tested the packages openSUSE Tumbleweed x86_64 and Factory_ARM on rasperry pi. The download repos are here: <http://download.opensuse.org/repositories/home:/stroeder:/branches:/network…> Make yourself familiar with zypper commands. Example: Add the repo in openSUSE 13.2 (command in one line): zypper addrepo --refresh http://download.opensuse.org/repositories/home:/stroeder:/branches:/network… Please test. Your feedback is appreciated. Especially have a look at whether the RPMs behave well regarding config files, package descriptions etc. Compared to stock SUSE packages there are two additional packages: 1. openldap2-contrib with a selection of overlays from, you might have guessed, the contrib/ source directory: allop, allowed, autogroup, cloak, denyop, lastbind, noopsrch, nops, pw-sha2, pw-pbkdf2, smbk5pwd 2. openldap2-back-sock (see http://www.openldap.org/software/man.cgi?query=slapd-sock) Ciao, Michael.

1 1

uniqueness constraint violated when using ldapadd -M
by Geert Hendrickx 07 Sep '15

07 Sep '15

Hi, I noticed uniqueness constraints enforced by the slapo-unique overlay can be bypassed when using the manage DSA IT control (ldapadd -M). Using the following simple constraint: overlay unique unique_uri ldap:///?mail?sub I get: $ ldapadd -x -h localhost -D cn=Manager,dc=my-domain,dc=com -w secret dn: cn=test1,dc=my-domain,dc=com objectClass: inetOrgPerson cn: test1 sn: test1 mail: test(a)my-domain.com adding new entry "cn=test1,dc=my-domain,dc=com" dn: cn=test2,dc=my-domain,dc=com objectClass: inetOrgPerson cn: test2 sn: test2 mail: test(a)my-domain.com <===== duplicate, violates uniqueness constraint adding new entry "cn=test2,dc=my-domain,dc=com" ldap_add: Constraint violation (19) additional info: some attributes not unique <===== ok, as expected Retrying with -M $ ldapadd -M -x -h localhost -D cn=Manager,dc=my-domain,dc=com -w secret dn: cn=test2,dc=my-domain,dc=com objectClass: inetOrgPerson cn: test2 sn: test2 mail: test(a)my-domain.com <===== duplicate, violates uniqueness constraint adding new entry "cn=test2,dc=my-domain,dc=com" <===== but it is accepted? $ ldapsearch -x -h localhost -b dc=my-domain,dc=com mail=test(a)my-domain.com # extended LDIF # # LDAPv3 # base <dc=my-domain,dc=com> with scope subtree # filter: mail=test(a)my-domain.com # requesting: ALL # # test1, my-domain.com dn: cn=test1,dc=my-domain,dc=com objectClass: inetOrgPerson cn: test1 sn: test1 mail: test(a)my-domain.com # test2, my-domain.com dn: cn=test2,dc=my-domain,dc=com objectClass: inetOrgPerson cn: test2 sn: test2 mail: test(a)my-domain.com # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 The uniqueness constraint has been violated when using -M, while it was correctly enforced without -M. Feature or bug? Geert -- geert.hendrickx.be :: geert(a)hendrickx.be :: PGP: 0xC4BB9E9F This e-mail was composed using 100% recycled spam messages!

3 6

Permission management with LDAP
by Fischer, Johannes 02 Sep '15

02 Sep '15

Hi again, I didn’t want to do a thread high jacking so here a second mail with a complete other question If I’have a structure like: User - Role Role - User - Permission Permission - Role Now I want to get the authorization for some permission, So I have the information which user and which Permission. Now I need to match the list. The way it already work: Get all Roles for a Permission Search in the user for the Role If found Authorization Else no Therefore I need at least two requests to the LDAP server My Question: Is it possible to send only the DN of a Permissions and tell the Server, that he/she need to extract the Role attributes and check in the DN of a user for those Roles? Can I Implement an overlay on the Server to manage this task or is it senseless to think about such a task for the server? Greetings John -- Johannes Fischer Wissenschaftlicher Angestellter Fraunhofer-Institut für Produktionstechnik und Automatisierung IPA Kompetenzzentrum Digitale Werkzeuge in der Produktion Nobelstraße 12 │ 70569 Stuttgart Telefon +49 711 970-1217 johannes.fischer(a)ipa.fraunhofer.de<mailto:johannes.fischer@ipa.fraunhofer.de> www.ipa.fraunhofer.de<http://www.ipa.fraunhofer.de/> [cid:image002.png@01D0E168.63E7FA20]

4 10

Re: RHEL7 OpenLDAP server is not enforcing password expirations
by Real, Elizabeth (392K) 02 Sep '15

02 Sep '15

Dan, I have RHEL5 ldap clients using pam_unix.so and pam_ldap.so directives and these do honor the ldap user password expiration, no issues at all. The /var/log/secure file shows: error: PAM: User account has expired However, the two RHEL7 ldap clients using the pam_unix.so and pam_sss.so directives do not even see/know that the user ldap password has expired. When I change the directive from pam_sss.so to pam_ldap.so, the client cannot communicate with the ldap server. RHEL5 /ETC/PAM.D/system-auth file: auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_ldap.so use_first_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore service_err=ignore system_err=ignore] pam_ldap.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 type=LINUX minlen=8 dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1 password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok md5 shadow remember=24 password sufficient pam_ldap.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_ldap.so RHEL7 CLIENTS /ETC/PAM.D/: password-auth file: auth sufficient pam_sss.so use_first_pass account [default=bad success=ok user_unknown=ignore] pam_sss.so password sufficient pam_sss.so use_authtok session optional pam_sss.so system-auth file: auth sufficient pam_sss.so use_first_pass account [default=bad success=ok user_unknown=ignore] pam_sss.so password sufficient pam_sss.so use_authtok session optional pam_sss.so Thank you, Liz From: Dan White <dwhite(a)olp.net<mailto:dwhite@olp.net>> Date: Friday, August 28, 2015 at 7:13 AM To: Elizabeth Real Chavez <Elizabeth.Real(a)jpl.nasa.gov<mailto:Elizabeth.Real@jpl.nasa.gov>> Cc: "openldap-technical(a)openldap.org<mailto:openldap-technical@openldap.org>" <openldap-technical(a)openldap.org<mailto:openldap-technical@openldap.org>> Subject: Re: RHEL7 OpenLDAP server is not enforcing password expirations On 08/27/15 22:56 +0000, Real, Elizabeth (392K) wrote: I’ve done a lot or research and re-read the OpenLDAP configuration guides but I cannot get my OpenLDAP 2.39 server to not allow users with expired passwords to login to ldap enabled clients. What directive in the /etc/pam.d/ files controls the users password expiration attribute? pam_unix or pam_ldap? That depends on your configuration. Consult the pam project's to determine that: http://www.linux-pam.org/ pam_ldap is a 3rd party product, so you'll need to consult it's documentation to see how expiration is handled, if at all. nssov, which is distributed with OpenLDAP, explicitly supports it. In the case you are using, or wish to use, pam_unix with an ldap nss module, expiration might be represented as an attribute underneath the user's DN. See its documentation for details. Setup: Server: RHEL7 OS Software: OpenLdap 2.4.39 server using slapd service Client: RHEL7 OS Software: enabled Ldap via authconfig, using sssd service -- Dan White

1 2

Unique Overlay: attribute mail
by Simone Taliercio 02 Sep '15

02 Sep '15

Hi All! I'm trying to enforce the fact that the mail attribute has to be unique. In order to do it I tried to enable the unique overlay. Unfortunately, OpenLDAP still allow to insert an object with the same mail value. I cannot understand where the wrong configuration occurs. My config is still based con slapd.conf . I've recompiled OpenLDAP with the following steps: a) ./configure --enable-modules=yes --enable-rlookups=yes --with-tls --with-cyrus-sasl --enable-mdb=yes --enable-bdb=yes --enable-monitor=yes --enable-unique b) make depend c) make d) make install Then, I added those lines to my slapd.conf overlay unique unique_uri ldap:///?mail?sub So, my develop slapd.conf looks like the one below now. Thanks a lot for any hints you can give me! Simone === slapd.conf ==== include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args database config rootdn "cn=admin,cn=config" # Security - TLS section TLSCACertificateFile /certs/CA.pem TLSCertificateFile /certs/certificate.cer TLSCertificateKeyFile /certs/company.key TLSCipherSuite TLSv1+RSA:!NULL TLSVerifyClient never # Use LMDB database. database mdb overlay unique suffix "dc=com" rootdn "cn=Manager,dc=com" maxsize 16058941440 rootpw secret directory /usr/local/var/openldap-data/databases/com index mail eq index cn eq index objectClass eq # mail is a unique attribute unique_uri ldap:///?mail?sub? access to dn.subtree="ou=user,dc=company1,dc=com" attrs=cn,sn,givenName,mail,userPassword by dn.exact="cn=specificuser,ou=user,dc=company1,dc=com" search by anonymous auth access to dn.subtree="ou=user,dc=company2,dc=com" attrs=cn,sn,givenName,mail,userPassword by dn.exact="cn=specificuser,ou=user,dc=company2,dc=com" write by anonymous auth access to dn.subtree="dc=com" by users read by anonymous auth

3 10

load balancer
by Eileen(=^ω^=) 02 Sep '15

02 Sep '15

Hi team, I have two LDAP servers using mirrormode. I want to run a FREE service to achieve load balancer for these servers. Due to i can't find any load balancer information in OpenLDAP-Admin-Guide, so my question is which kind of service do you advice for load balancer, or which kind service openldap supported? THANKS & REGRADS

7 6

Send Success with first found entry
by Fischer, Johannes 02 Sep '15

02 Sep '15

Hi again, more and more I get a feeling how all this work together. But often you don't know what you actually need to look up... I've looked on the LDAP server of the Institute to get a feeling how the real IT-guys managed their server... (It was a disaster from a data protection perspective...) Some things were quit nice, for example that the server send a "success" with the first found entry in a subtree. On my openLDAP instance I receive a entry of a subtree after 20-30ms but the success packet need 200ms. For me this behavior is not clear due to the fact, that the entries in the directory need to be unique. The Example: I'm using the Spring security framework and trigger with "ldapTemplate.lookup("cn=" + _name + ",dc=users");" a lookup. On wireshark I see a search request with the scope "baseObject" and The Filter "objectClass=*". After 33ms I receive a searchResEntry packet, so the Server found something and could also stop. But I think in the background all the other entries in the Subtree "dc=users", are looked through also. After 230ms the success packet arrive at my computer. (see also Attachment) My Question, is there a possibility to emit a success together with the first found entry? Greetings and thanks John -- Johannes Fischer Research Fellow Fraunhofer Institute for Manufacturing Engineering and Automation IPA Competence Centre Digital Tools for Manufactoring Nobelstrasse 12 │ 70569 Stuttgart | Germany Phone +49 711 970-1217 Johannes.Fischer(a)ipa.fraunhofer.de<mailto:Johannes.Fischer@ipa.fraunhofer.de> www.ipa.fraunhofer.de<http://www.ipa.fraunhofer.de/> [cid:image003.png@01D0E165.1BE01080]

2 4

SASL/EXTERNAL not available
by Frank Crow 02 Sep '15

02 Sep '15

Hi, I'm trying to configure OpenLDAP 2.4.23 (running on RHEL6.5) to use client-side certificates via the SASL/EXTERNAL mechanism. I have successfully configured server-side certs with TLS and was wanting to expand my configuration on the client-side. If set the TLSClientVerify to "allow" or "try" and attempt to use "-Y EXTERNAL", I get the following message: SASL/EXTERNAL authentication started ldap_sasl_interactive_bind_s: Unknown authentication method (-6) additional info: SASL (-4): no mechaism available: If I do a search on the DSE, I get the following available methods: dn: supportedSASLMechanisms: GSSAPI supportedSASLMechanisms: LOGIN supportedSASLMechanisms: CRAM-MD5 supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: PLAIN I know that other people are using this but nobody (here at work) knows why my particular configuration is getting this error. Can anyone help me figure this out? Thanks, -- Frank Crow

4 5

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical August 2015