openldap-technical September 2015

openldap-technical@openldap.org

59 participants
57 discussions

Virtual list view problem
by Venish Khant 31 May '16

31 May '16

Hi all I am using cpan Net::LDAP module to access LDAP entries. I want to search LDAP entries using Net::LDAP search method. When I do search, I want some limited number of entries from search result, for this(searching) process I am using Net::LDAP::Control::VLV module. But I get error on VLV response control. Please, any one have idea about this error. * Error:* Died at vlv.pl line 50, This is my example. I changed the font style of line 50 #!/usr/bin/perl -w use Net::LDAP; use Net::LDAP::Control::VLV; use Net::LDAP::Constant qw( LDAP_CONTROL_VLVRESPONSE ); use Net::LDAP::Control::Sort; sub procentry { my ( $mesg, $entry) = @_; # Return if there is no entry to process if ( !defined($entry) ) { return; } print "dn: " . $entry->dn() . "\n"; @attrs = $entry->attributes(); foreach $attr (@attrs) { #printf("\t%s: %s\n", $attr, $entry->get_value($attr)); $attrvalue = $entry->get_value($attr,asref=>1); #print $attr.":". $entry->get_value($attr)."\n"; foreach $value(@$attrvalue) { print "$attr: $value\n"; } } $mesg->pop_entry; print "\n"; } $ldap = Net::LDAP->new( "localhost" ); # Get the first 20 entries $vlv = Net::LDAP::Control::VLV->new( before => 0, # No entries from before target entry after => 19, # 19 entries after target entry content => 0, # List size unknown offset => 1, # Target entry is the first ); my $sort = Net::LDAP::Control::Sort->new( order => 'cn' ); @args = ( base => "dc=example,dc=co,dc=in", scope => "subtree", filter => "(objectClass=inetOrgPerson)", callback => \&procentry, # Call this sub for each entry control => [ $sort, $vlv ], ); $mesg = $ldap->search( @args ); # Get VLV response control *($resp) = $mesg->control( LDAP_CONTROL_VLVRESPONSE ) or die;* $vlv->response( $resp ); # Set the control to get the last 20 entries $vlv->end; $mesg = $ldap->search( @args ); # Get VLV response control ($resp) = $mesg->control( LDAP_CONTROL_VLVRESPONSE ) or die; $vlv->response( $resp ); # Now get the previous page $vlv->scroll_page( -1 ); $mesg = $ldap->search( @args ); # Get VLV response control ($resp) = $mes # Now page with first entry starting with "B" in the middle $vlv->before(9); # Change page to show 9 before $vlv->after(10); # Change page to show 10 after $vlv->assert("B"); # assert "B" $mesg = $ldap->search( @args );g->control( LDAP_CONTROL_VLVRESPONSE ) or die; $vlv->response( $resp ); -- Venish Khant www.deeproot.co.in

4 11

storing HA1 password hash for HTTP DIGEST, SIP, TURN
by Daniel Pocock 06 Mar '16

06 Mar '16

Hi all, There are a few protocols that use a HA1[1] password hash, such as HTTP DIGEST[1], SIP DIGEST[2] and TURN[3] (which uses HMAC rather than DIGEST) Is there a standard LDAP attribute name for storing a HA1 value or should it be stored in a regular userPassword attribute as described in the manual[4]? I came across smbk5pwd for keeping SMB password attributes in sync. Is there a similar facility for keeping HA1 passwords in sync when a user changes the password or how could a developer go about adding that, would the smbk5pwd source be a useful model? Regards, Daniel 1. http://tools.ietf.org/html/rfc2617#section-3 2. https://tools.ietf.org/html/rfc3261#section-22.4 3. https://tools.ietf.org/html/rfc5389#section-15.4 4. http://www.openldap.org/doc/admin24/security.html#Password%20Storage

3 5

empty ldapmodify refused with slapo-unique
by Geert Hendrickx 08 Oct '15

08 Oct '15

When slapo-unique constraints are in effect, it seems empty updates are no longer allowed: > $ ldapmodify -x -h localhost -D cn=Manager,dc=my-domain,dc=com -w secret > dn: cn=test1,dc=my-domain,dc=com > changetype: modify > > modifying entry "cn=test1,dc=my-domain,dc=com" > ldap_modify: Invalid syntax (21) > additional info: unique_modify() got null op.orm_modlist Why is this considered invalid syntax? Without slapo-unique constraint, empty updates like these are accepted. Geert -- geert.hendrickx.be :: geert(a)hendrickx.be :: PGP: 0xC4BB9E9F This e-mail was composed using 100% recycled spam messages!

2 2

Allow users to change ldap password with passwd
by Real, Elizabeth (392K) 05 Oct '15

05 Oct '15

This is my setup: Server: Openldap 2.4.39 installed on RHEL7 Ldap clients: RHEL7 and RHEL5 I set up this directive on the ldap clients (/etc/sssd/sssd.conf) to prevent users with expired accounts to login: ldap_pwd_policy = shadow. This works as expected. Now I need to allow users to reset their ldap password after logging in to an ldap client. This is what is logged when a user attempts to reset their password using passwd: rhel7 ldap client: # passwd Changing password for user real Current password: New password: Retype new password: passwd: Authentication token manipulation error rhel7 ldap server: /var/log/secure pam_unix(passwd:chauthtok): user “real” does not exist in the /etc/passwd pam_sss(passwd:chauthtok): Password change failed for user real: 28 (Module is unknown) Gkr-pam: couldn’t update the login keyring password: no old password was Entered In an attempt to allow users to change their ldap password, i edited my ACL on the ldap server and added 'shadowLastChange': dn: olcDatabase={2}hdb,cn=config add: olcAccess olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by dn.base="cn=Alien,dc=cluster,dc=sec312" write by anonymous auth by * none olcAccess: {1}to * by self write by dn.base="cn=Alien,dc=cluster,dc=sec312" write by * read However that did not work, on the ldap clients I get this on the logs: pam_unix(sshd:auth): authentication failure pam_sss(sshd:auth): authentication failure pam_sss(sshd:auth): received for user reaL 4 (System error) This is the /etc/pam.d/system-auth file on the rhel7 ldap client: #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_fprintd.so auth sufficient pam_unix.so try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth sufficient pam_sss.so use_first_pass auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_pwquality.so try_first_pass local_users_only retry=3 minlen=8 lcredit=-1 ucredit=-1 dcredit=-1 ocredit=-1 authtok_type= password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so ~ What other directive do I need to set to allow users to reset their ldap password when they call passwd? Thank you, Liz

4 14

BP build OpenLDAP and lmdb packages
by Michael Ströder 02 Oct '15

02 Oct '15

HI! I wonder what's considered best practice for building OpenLDAP and lmdb packages e.g. for a Linux distribution. Fortunately lmdb seems to be leveraged by more and more other software. So Linux distributions start to ship lmdb libs and tools as separate packages. 1. Do I have a chance to build OpenLDAP against those packages? Which releases have to be aligned? 2. Or should I link back-mdb statically into slapd when producing OpenLDAP packages? This would probably also require to build separate version of the mdb tools. Of course personally I'd prefer 1. Ciao, Michael.

5 8

parent DN and deref control
by Michael Ströder 02 Oct '15

02 Oct '15

Hmm... I have a use-case where it would be handy to use the deref control to request attributes from an entry's parent entry. But this would require kind of a pseudo-attribute 'parentDN' (similar to 'entryDN'). Anybody aware whether such a thing is already available? [1] https://tools.ietf.org/html/draft-masarati-ldap-deref-00 Nope, I don't want to use collective attributes. Ciao, Michael.

3 5

cannot delete pwdFailureTime attribute
by David Magda 01 Oct '15

01 Oct '15

Hello, How do I delete the pwdFailureTime attribute on a slave? I have a DN where pwdFailureTime entries are growing and its slowly filling up /var/lib/ldap/. Ive tried the following LDIF: dn: uid=foo,ou=People,dc=example,dc=com changetype: modify delete: pwdFailureTime But since the system is slave, its giving ldapmodify(1) a redirect to the master. I've also tried the script in ITS#8185: http://www.openldap.org/lists/openldap-bugs/201507/msg00012.html that connects to ldapi:///, and that also referral/redirects (since we have olcUpdateRef configured). We are not using the slapo-chain(5) funcionality. Is there any way to manipulate pwdFailureTime on the slaves without going into the raw databases files? Or do we have to enable slapo-chain(5) when using slapo-ppolicy(5) and then do things on the master? Thanks for any info. Regards, David

2 2

How to build contrib pw-radius?
by dev 01 Oct '15

01 Oct '15

Hi, I'm trying to build the pw-radius module in the contrib directory but can't seem to find the right library to add to the incantation. I've tried installing the freeradius-dev package as well as the libradiusclient-ng-dev but still no radlib.h. A google on the error message[1] returns *exactly* two results so I'm kind of at a loss. Can someone point me in the direction of the correct radius package to install to get this built? [1] test# gcc -shared -I../../../include -Wall -g -o pw-radius.so radius.c -lradius radius.c:27:20: fatal error: radlib.h: No such file or directory compilation terminated.

3 3

Is it possible to create something like an alias or mapping
by Christian Balz 01 Oct '15

01 Oct '15

Hi for all, We have an application that search an attribute named 'manager', however in our OpenLDAP this attribute is called 'DomainGestor'. Is it possible to create something like an alias or mapping. So, when the application is called the attribute 'manager' the ldap return the value of 'DomainGestor' DomainGestor uid=userX,cn=u,cn=users,dc=mydomain,dc=com Regards Christian

3 3

SSHA hash are stores as '{ssha}......' and '{SSHA}......'
by Matthias Apitz 30 Sep '15

30 Sep '15

Hello, We are authenticating from some Java written software against an OpenLDAP system by reading the users 'userPassword' LDAP attribute, calculating the clear text password against the SSHA hash string. It turned out that some (a few number) of these hash are stored in the form: userPassword:: e3NzaGF9R2tSOU91SGhOakFoZzBWeVNtY0JHRUE5b2NMVU5GZWZnY0VaMXc9PQ== which decodes to: $ echo 'e3NzaGF9R2tSOU91SGhOakFoZzBWeVNtY0JHRUE5b2NMVU5GZWZnY0VaMXc9PQ==' | openssl base64 -d {ssha}GkR9OuHhNjAhg0VySmcBGEA9ocLUNFefgcEZ1w== i.e. with SSHA in small letters. It's only 1 of thousand users having the tag as '{ssha}'. Why is this? Thanks matthias -- Matthias Apitz, ✉ guru(a)unixarea.de, 🌐 http://www.unixarea.de/ ☎ +49-176-38902045 No! Nein! ¡No! Όχι! -- Ευχαριστούμε!

4 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical September 2015