openldap-technical August 2015

openldap-technical@openldap.org

55 participants
62 discussions

disable simple paged results control support?!
by Igor Shmukler 02 Sep '15

02 Sep '15

Hello, I am trying to make my client, developed for OpenLDAP also compatible with Oracle DSEE. Oracle DSEE is missing support for simple paged results, which I use. Yet, ODSEE supports virtual list view with server-side sorting. I adjusted my code, to use that - VLV+SSS as a fallback whenever the server does not support paged results and supports VLV+SSS, like ODSEE. Is it possible to disable OpenLDAP server-side support of simple paged results control, so the OpenLDAP server would respond that this control is unavailable? I don't have an LDAP proxy, nor ODSEE configured. OpenLDAP saved me many times, in past. Can OpenLDAP be configured to do what I need, so I could test my fallback code in the client using an OpenLDAP server? Thank you, Igor Shmukler

3 7

ppolicy and pwdGraceUseTime
by Craig White 01 Sep '15

01 Sep '15

Openldap 2.4.39 Adding in policy in already running OpenLDAP installation. Mostly functional - I was locked out after failed password attempts as expected. Existing user with password beyond expiration is an issue. It is extended grace logins as expected but when I try to change the password, I get an error which appears to be "error 16 - modify/delete: pwdGraceUseTime: no such attribute" But there is that attribute. # ldapsearch -x -h localhost '(uid=craig.white)' + Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=obscured> (default) with scope subtree # filter: (uid=craig.white) # requesting: + # # craig.white, People, obscured dn: uid=craig.white,ou=People,dc=obscured entryUUID: c4ae47b4-c3e9-1033-8b0f-497efc42df64 creatorsName: cn=root,dc=obscured createTimestamp: 20140829170048Z pwdChangedTime: 20150730153646Z structuralObjectClass: inetOrgPerson pwdPolicySubentry: cn=personnelpp,ou=Policies,dc=obscured pwdGraceUseTime: 20150827230337Z pwdGraceUseTime: 20150827230344Z pwdGraceUseTime: 20150827230351Z pwdGraceUseTime: 20150827230430Z pwdGraceUseTime: 20150827230441Z pwdGraceUseTime: 20150827230847Z pwdGraceUseTime: 20150827230855Z pwdGraceUseTime: 20150827231032Z pwdGraceUseTime: 20150827231039Z pwdGraceUseTime: 20150828152032Z pwdGraceUseTime: 20150828152038Z pwdGraceUseTime: 20150828152404Z pwdGraceUseTime: 20150828152410Z pwdGraceUseTime: 20150828152527Z pwdGraceUseTime: 20150828152533Z pwdGraceUseTime: 20150828152643Z pwdGraceUseTime: 20150828152648Z pwdGraceUseTime: 20150828153349Z pwdGraceUseTime: 20150828153354Z pwdGraceUseTime: 20150828153619Z pwdGraceUseTime: 20150828153623Z entryCSN: 20150828154229.701657Z#000000#000#000000 modifiersName: cn=admin,dc=obscured modifyTimestamp: 20150828154229Z entryDN: uid=craig.white,ou=People,dc=obscured subschemaSubentry: cn=Subschema hasSubordinates: FALSE # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Why won't it let me change my password? Craig White System Administrator O 623-201-8179 M 602-377-9752 [cid:image001.png@01CF86FE.42D51630] SkyTouch Technology 4225 E. Windrose Dr. Phoenix, AZ 85032

2 2

RE: authz-regexp behavior with GSSAPI
by Peter Heinemann 31 Aug '15

31 Aug '15

Dan, Here are version details: openldap 2.4-39 RHEL 6.5 cyrus-sasl and cyrus-sasl-gssapi 2.1.23-15 krb5-libs 1.10.3-42 The tests I'm running (ldapclient) are on the same system as is slapd. It appears that cross-realm authentication is problematic. In the following results, "success" means that the search specified by the regex occurred and the identity was remapped. Both commands used GSSAPI (-Y for ldapwhoami, -M for slapauth): krb5.conf default TEST.NET.ISC.UPENN.EDU ldapwhoami -R TEST.NET... success ldapwhomai no -R success slapauth -R TEST.NET... success slapauth no realm fail krb5.conf default UPENN.EDU ldapwhoami -R TEST.NET... fail ldapwhoami no realm fail slapauth -R TEST.NET... success slapauth no realm specified fail so: slapauth appears to work if a realm is explicitly specified with -R (either cross-realm or within realm), but won't remap if the realm isn't specified. ldapwhoami (and ldapsearch) works within a realm whether or not the realm is specified with -R; but won't remap if -R specifies a different realm. Here's output from slapauth that shows the different behavior when the realm is specified or not. Note that in this case, the ]$ sudo slapauth -d 4 -M GSSAPI -R TEST.NET.ISC.UPENN.EDU netmon 55e45abb mdb_db_open: "dc=upenn,dc=edu" 55e45abb slap_sasl_getdn: conn 18446744073709551615 id=netmon [len=6] 55e45abb [rw] authid: "uid=netmon,cn=test.net.isc.upenn.edu,cn=gssapi,cn=auth" -> "ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}netmon@TEST.NET.ISC.UPENN.EDU)" 55e45abb mdb_idl_fetch_key: [b49d1940] 55e45abb mdb_idl_fetch_key: [4f7f6931] 55e45abb send_ldap_result: err=0 matched="" text="" ID: <netmon> check succeeded authcID: <uid=netmon,ou=entities,dc=upenn,dc=edu> $ sudo slapauth -d 4 -M GSSAPI netmon 55e45ac6 mdb_db_open: "dc=upenn,dc=edu" 55e45ac6 slap_sasl_getdn: conn 18446744073709551615 id=netmon [len=6] 55e45ac6 [rw] authid: "uid=netmon,cn=gssapi,cn=auth" -> "uid=netmon,cn=gssapi,cn=auth" ID: <netmon> check succeeded authcID: <uid=netmon,cn=gssapi,cn=auth> Peter ________________________________________ From: Dan White [dwhite(a)olp.net] Sent: Sunday, August 30, 2015 10:09 AM To: Peter Heinemann Cc: openldap-technical(a)openldap.org Subject: Re: authz-regexp behavior with GSSAPI On 08/26/15 12:51 +0000, Peter Heinemann wrote: >I am trying to figure out different behaviors with authz-regexp in slapd.conf. >In production is: > >sasl-host pennid.upenn.edu >sasl-realm UPENN.EDU >authz-regexp uid=(.*),cn=UPENN.EDU,cn=gssapi,cn=auth > ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}$1@UPENN.EDU) > >and the authentication mapping works as desired; the user@realm gets mapped to the just the username and the search succeeds: > > ldapwhoami -Y GSSAPI -U netmon -H ldaps://pennid.upenn.edu >SASL/GSSAPI authentication started >SASL username: netmon(a)UPENN.EDU >SASL SSF: 56 >SASL data security layer installed. >dn:uid=netmon,ou=entities,dc=upenn,dc=edu > >However, on development in a different kerberos realm, that statement will not map properly. The mapping doesn't take place, so user@realm is used for the (unsuccessful) search: > >sasl-host pennid-dev.net.isc.upenn.edu >sasl-realm TEST.NET.ISC.UPENN.EDU >authz-regexp uid=(.*),cn=TEST.NET.ISC.UPENN.EDU,cn=gssapi,cn=auth > ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}$1@TEST.NET.ISC.UPENN.EDU) > >no mapping takes place: > >ldapwhoami -Y GSSAPI -U netmon -H ldaps://pennid-dev.net.isc.upenn.edu >SASL/GSSAPI authentication started >SASL username: netmon(a)TEST.NET.ISC.UPENN.EDU >SASL SSF: 56 >SASL data security layer installed. >dn:uid=netmon@test.net.isc.upenn.edu,cn=test.net.isc.upenn.edu,cn=gssapi,cn=auth > >However, a change to the regexp on the development system will cause mapping to work there: > >authz-regexp uid=(.*)(a)TEST.NET.ISC.UPENN.EDU,cn=TEST.NET.ISC.UPENN.EDU,cn=gssapi,cn=auth > ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}$1@TEST.NET.ISC.UPENN.EDU) > >$ ldapwhoami -Y GSSAPI -U netmon -H ldaps://pennid-dev.net.isc.upenn.edu >SASL/GSSAPI authentication started >SASL username: netmon(a)TEST.NET.ISC.UPENN.EDU >SASL SSF: 56 >SASL data security layer installed. >dn:uid=netmon,ou=entities,dc=upenn,dc=edu > >But a similar regexp in production will not map properly: > >Can anyone shed light on the different behavior? >- only the authz-regexp has been modified >- slapd was restarted after the changes. Any differences in your /etc/krb5.conf? What is your default realm? Any differences in the libraries you're using (cyrus-sasl and kerberos)? -- Dan White <dwhite(a)olp.net>

2 1

How can I solve "OpenLdap additional info:objectClass value#0 invalid per syntax" Error?
by Jason Long 29 Aug '15

29 Aug '15

Hello. I used below URL for configure my OpenLdap on CentOS 7 but when I want to add a user I got an error " OpenLdap additional info:objectClass value#0 invalid per syntax" How can I solve it? http://docs.adaptivecomputing.com/viewpoint/hpc/Content/topics/1-setup/inst… Thank you.

3 13

RHEL7 OpenLDAP server is not enforcing password expirations
by Real, Elizabeth (392K) 28 Aug '15

28 Aug '15

Hello, I’ve done a lot or research and re-read the OpenLDAP configuration guides but I cannot get my OpenLDAP 2.39 server to not allow users with expired passwords to login to ldap enabled clients. What directive in the /etc/pam.d/ files controls the users password expiration attribute? pam_unix or pam_ldap? Setup: Server: RHEL7 OS Software: OpenLdap 2.4.39 server using slapd service Client: RHEL7 OS Software: enabled Ldap via authconfig, using sssd service Thank you, Liz

2 1

2.4.17 -> 2.4.39 replication: null callback : error code 0x10
by Andrei Valoshyn 28 Aug '15

28 Aug '15

Hello! > > Aug 21 01:42:45 slapd[4658]: null_callback : error code 0x10 > Aug 21 01:42:45 slapd[4658]: syncrepl_entry: rid=107 be_modify failed > (16) > Aug 21 01:42:45 slapd[4658]: do_syncrepl: rid=107 rc 16 retrying (9 > retries left) > > Master (OpenLDAP: slapd 2.4.17, 64bit openSUSE 11.2) and slave > (OpenLDAP: slapd 2.4.31, 64bit openSUSE 12.2) > > master slapd.conf syncprov configuration : > ....... > overlay syncprov > syncprov-checkpoint 100 10 > syncprov-sessionlog 100 > .......... > > slave master slapd.conf syncprov configuration: > ................................... > syncrepl rid=107 provider=ldaps://master.domen.com \ > type=refreshOnly \ > interval=00:00:02:00 \ > scope=sub \ > schemachecking=off \ > searchbase="dc=domen,dc=com" \ > bindmethod=simple \ > binddn="dc=domen,dc=com" \ > credentials=**** \ > retry="60 10 300 10" > ...................... > > I have these errors on all my slaves. What may be the cause of those > errors? I have no idea about that. Please HELP! > >

2 1

openLDAP upgrate
by mdii 28 Aug '15

28 Aug '15

Hi all, I'm starting as an openLDAP administrator, and here in my company they are running the openLDAP 2.4.35. - I found this avec la commande ldapsearch -VV I want to upgrade to the letest version available (2.4.42), how should I procede ? I read that I just need to download the new package, stop the server, install the new version and then restart the server, is that all? Thanks in advance for your help, Marc

2 1

disable unique overlay from member attributes
by Fischer, Johannes 27 Aug '15

27 Aug '15

Hi @all, I try to allow double entries for the attribute member. I’ve tried it with the ldif: dn: olcOverlay=unique,olcDatabase={1}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcUniqueConfig olcOverlay: unique olcUniqueUri: ignore ldap:///?members?sub but when I load it to the config with: ldapmodify the Error: ldap_add: invalid syntax (21) additional info: objectClass: value #1 invalid per syntax What is going wrong here? Greetings John -- Johannes Fischer Wissenschaftlicher Angestellter Fraunhofer-Institut für Produktionstechnik und Automatisierung IPA Kompetenzzentrum Digitale Werkzeuge in der Produktion Nobelstraße 12 │ 70569 Stuttgart Telefon +49 711 970-1217 johannes.fischer(a)ipa.fraunhofer.de<mailto:johannes.fischer@ipa.fraunhofer.de> www.ipa.fraunhofer.de<http://www.ipa.fraunhofer.de/> [cid:image001.png@01D0DE8D.A482B990]

3 3

Mail attribute: how to make it mandatory.
by Simone Taliercio 27 Aug '15

27 Aug '15

Hi again :p Since there's a lot of posting about attributes and unique overlay then I decided to make it even worse ;) I'm using OpenLDAP for storing entries which have *inetOrgPerson* as objectclass. What would be required to switch the "mail" attribute from optional to mandatory ? Thanks a lot for the support! Simone

2 4

authz-regexp behavior with GSSAPI
by Peter Heinemann 26 Aug '15

26 Aug '15

Good day, I am trying to figure out different behaviors with authz-regexp in slapd.conf. openldap 2.4-39 RHEL 6.5 cyrus-sasl and cyrus-sasl-gssapi 2.1.23-15 krb5-libs 1.10.3-42 We're mapping based on a search for the presence of the userPassword attribute. In production is: sasl-host pennid.upenn.edu sasl-realm UPENN.EDU authz-regexp uid=(.*),cn=UPENN.EDU,cn=gssapi,cn=auth ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}$1@UPENN.EDU) and the authentication mapping works as desired; the user@realm gets mapped to the just the username and the search succeeds: ldapwhoami -Y GSSAPI -U netmon -H ldaps://pennid.upenn.edu SASL/GSSAPI authentication started SASL username: netmon(a)UPENN.EDU SASL SSF: 56 SASL data security layer installed. dn:uid=netmon,ou=entities,dc=upenn,dc=edu However, on development in a different kerberos realm, that statement will not map properly. The mapping doesn't take place, so user@realm is used for the (unsuccessful) search: sasl-host pennid-dev.net.isc.upenn.edu sasl-realm TEST.NET.ISC.UPENN.EDU authz-regexp uid=(.*),cn=TEST.NET.ISC.UPENN.EDU,cn=gssapi,cn=auth ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}$1@TEST.NET.ISC.UPENN.EDU) no mapping takes place: ldapwhoami -Y GSSAPI -U netmon -H ldaps://pennid-dev.net.isc.upenn.edu SASL/GSSAPI authentication started SASL username: netmon(a)TEST.NET.ISC.UPENN.EDU SASL SSF: 56 SASL data security layer installed. dn:uid=netmon@test.net.isc.upenn.edu,cn=test.net.isc.upenn.edu,cn=gssapi,cn=auth However, a change to the regexp on the development system will cause mapping to work there: authz-regexp uid=(.*)(a)TEST.NET.ISC.UPENN.EDU,cn=TEST.NET.ISC.UPENN.EDU,cn=gssapi,cn=auth ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}$1@TEST.NET.ISC.UPENN.EDU) $ ldapwhoami -Y GSSAPI -U netmon -H ldaps://pennid-dev.net.isc.upenn.edu SASL/GSSAPI authentication started SASL username: netmon(a)TEST.NET.ISC.UPENN.EDU SASL SSF: 56 SASL data security layer installed. dn:uid=netmon,ou=entities,dc=upenn,dc=edu But a similar regexp in production will not map properly: authz-regexp uid=(.*)(a)UPENN.EDU,cn=UPENN.EDU,cn=gssapi,cn=auth ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}$1@UPENN.EDU) ldapwhoami -Y GSSAPI -U netmon -H ldaps://pennid.upenn.edu SASL/GSSAPI authentication started SASL username: netmon(a)UPENN.EDU SASL SSF: 56 SASL data security layer installed. dn:uid=netmon,cn=upenn.edu,cn=gssapi,cn=auth Can anyone shed light on the different behavior? - only the authz-regexp has been modified - slapd was restarted after the changes. Thanks, Peter

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical August 2015