openldap-technical November 2016

openldap-technical@openldap.org

28 participants
53 discussions

Problem with "force user to password reset at first login
by Rajagopal Rc 30 Oct '23

30 Oct '23

Hi, I am trying to force users to change their password at first login or after password reset by administrator. Tried following: 1)Password policy 'pwdMustChange TRUE' doesn't seems to be working as non of the users get prompt to change their password at first login. 2) used the 'pwdReset TRUE' attribute in users attributes, and it won't prompt to change the password and didn't allow to login i observe below messages in log "slapd[12684]: connection restricted to password changing only slapd[12684]: send_ldap_result: err=50 matched="" text="Operations are restricted to bind/unbind/abandon/StartTLS/modify password" slapd[12684]: conn=1053 op=1 SEARCH RESULT tag=101 err=50 nentries=0 text=Operations are restricted to bind/unbind/abandon/StartTLS/modify password" Please help me configure the option to force all users to change their password at first login or after pwd reset by administrator. Thanks & Regards Raj Tata Consultancy Services Mailto: rajagopal.rc(a)tcs.com Website: http://www.tcs.com ____________________________________________ Experience certainty. IT Services Business Solutions Consulting ____________________________________________ =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

5 9

How to enable memberOf overlay with posixGroup?
by MegaBrutal 16 Aug '17

16 Aug '17

Hi all, I've spent days trying to figure out how could I enable the memberOf overlay, and it doesn't seem to be easy for an LDAP-noob. I've read like 50+ tutorials which didn't help me get it working. Use case: I want to have 2 main groups which control access to different services on my network. A "unixusers" which is a minimum to log in to Linux servers (having a hostObject entry for the user is another requirement, which is irrelevant to this question, as I already solved that problem); and a "cloudusers" group which enables log in to my ownCloud instance. The groups should enforce the following rules: – Only users in "cloudusers" should be allowed to log in to ownCloud. – Users in "unixusers" are allowed to log in to a set of Linux servers controlled by "host" (hostObject) entries. – Users not in the "unixusers" group may not log in to any Linux systems, even if they have "host" entries. Problems: – ownCloud complains that the memberOf overlay is not enabled, hence it doesn't let me restrict access to the "cloudusers" group. It would allow any users regardless of any group memberships, which is not acceptable. – I have a similar problem on Linux with PAM: I can't really get it to consider "unixusers" membership for user logins, although I got the "host" entries working correctly, so at least I can already restrict access with that. My guess is that it all boils down to the lack of memberOf overlay. I also figured that memberOf would need groupOfNames groups, while I need posixGroup type groups. I evaluated the possibility to use groupOfNames, but it lacks the necessary gidNumber attribute which is a requirement for Unix groups. But anyway, I can't enable memberOf even for groupOfNames. I can't enable memberOf by any means. My OpenLDAP uses the new configuration method and it completely ignores slapd.conf, so the config must be injected with ldapadd to cn=config. Could you please help me with this? Regards, MegaBrutal

5 6

[Q] "selective" ACL
by Zeus Panchenko 26 Jul '17

26 Jul '17

hi, I'm trying to configure a not complex (as I believe) ACL ... but have some difficulties I have two posixGroup groups cn=admins,ou=group,dc=foo cn=coadmins,ou=group,dc=foo my users resides in ou=People,dc=foo so, in subtree ou=People,dc=foo I need to allow anything to admins (and it is not difficult of course) for example this works for me: access to dn.subtree="ou=People,dc=foo" by set="[cn=admin,ou=group,dc=foo]/memberUid & user/uid" manage by self write by users read by * break but in addition I need to allow my coadmins to do the same things except manipulations upon the objects which belong to admins ( ...anyobject,uid=adminuser,ou=People,dc=foo ) so, the question is: how? (if it is possible at all) :( please, advise -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET)

2 2

Change log timestamp: rsyslog changes don't work
by mdii 30 Nov '16

30 Nov '16

Hi all, I'm trying to change the timestamp appears in my openLDAP logs. Today it's the default timestamp (Nov 22 11:55:02), but for debugging reasons I need to show the milliseconds (something like Nov 22 11:55:02:987 or any other format with milliseconds). The logs output are managed by the /etc/rsyslog.d/openldap.conf file: > #Configuration specifique openldap > local4.* @10.2.32.95:514 > local4.* -/custom/log/openldap.log > local5.* @10.2.32.95:514 > local5.* -/custom/log/openldap-oldschema.log My /etc/rsyslog.conf configuration looks like: > # Use default timestamp format > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat For testing purposes, I change it to: > # Use default timestamp format > $ActionFileDefaultTemplate RSYSLOG_FileFormat Or even to: > # Use default timestamp format > $template myFormat,"PRI: %pri%, MSG: %msg%\n" > $ActionFileDefaultTemplate myFormat But I see no changes in the timestamp (I restart the rsyslog service at each modification) I also notice that I'm just getting the first instance log (-/custom/log/openldap.log), I'm not seeing the second one (-/custom/log/openldap-oldschema.log). Viewing this I have two questions: - why my second instance doesn't log? - why my log timestamp doesn't change when I change the configuration file? I would like to thank you in advance for all the help, Marc

2 1

Re: slapo-smbk5pwd build fixes
by Quanah Gibson-Mount 29 Nov '16

29 Nov '16

--On Saturday, November 05, 2016 7:30 PM -0700 Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Saturday, November 05, 2016 6:30 PM +0200 Emmanuel Dreyfus > <manu(a)netbsd.org> wrote: > >> Hello >> >> slapo-smbk5pwd does not link with newer OpenSSL,because the old des_* >> API was removed. This simple patch uses the new (but available for a >> long time) DES_* API to fix that: >> http://www.openldap.org/its/index.cgi/Incoming?id=8525;selectid=8525 > > Hi Emmanuel, > > The openldap-devel list would be the appropriate place to raise and > discuss this. I will try and look into it further on Monday. This is now in RE24, scheduled for the 2.4.45 release. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

replicate cn=config with exception of "ACLs"
by Stanislav Kopp 29 Nov '16

29 Nov '16

Hello, at the moment we're using master<->slave setup with slapd 2.4.31 using old slapd.conf. I want to migrate all to "cn=config" and if possible replicate cn=config DB to slaves for sake maintenance simplicity, but with exception ofr ACLs rules, because master and slaves have different ACLs. Is it possible, or ist it a good idea in general? The plus of slapd.conf was that I can deploy the same ACL file on all slaves with some automation (e.g. puppet). Thanks, Stan

1 0

Re: OID syntax and NAMEs
by Howard Chu 29 Nov '16

29 Nov '16

Michael Ströder wrote: > Howard Chu wrote: >> Michael Ströder wrote: >>> Eventual I'd like to have a constraint like this: >>> >>> # check whether appropriate password policy is assigned >>> constraint_attribute structuralObjectClass,pwdPolicySubentry >>> set "this/structuralObjectClass & this/pwdPolicySubentry/aeApplicableSOC" >> >> Not possible without custom code. > > Hmm, are this/structuralObjectClass and this/pwdPolicySubentry generally > unusable in set-constraints? > > Or does it not work because of the different matching rules? Yes, because of the matching rule issue. This seems to be a deficiency in either ASN.1 or the LDAP spec, I'm not sure which. The problem is that numeric OIDs are obviously unique, but there's no guarantee that string names are. Moreover, the same name might apply to the OID of an attribute, or an objectclass, or a syntax, or some other entity, and there's no way to tell the objectIdentifierMatch rule which context is relevant. So, we can only match on numeric OIDs. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Re: OID syntax and NAMEs
by Howard Chu 28 Nov '16

28 Nov '16

Michael Ströder wrote: > HI! > > I've declared an attribute type like this with LDAP syntax OID: > > ( 1.3.6.1.4.1.5427.1.389.100.4.18 > NAME 'aeApplicableSOC' > DESC 'AE-DIR: structural object classes for which policy is applicable' > EQUALITY objectIdentifierMatch > SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 > X-ORIGIN 'AE-DIR' ) > > Which is pretty similar to this: > > ( 2.5.4.0 > NAME 'objectClass' > DESC 'RFC4512: object classes of the entity' > EQUALITY objectIdentifierMatch > SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 ) > > Now I wonder why I can't use the object class NAMEs instead of the OIDs as > attribute or assertion values, e.g. why I can't find the entries with filter > (aeApplicableSOC=aeUser). > > This reminds me a bit of the similar OID vs. NAME issue with 'pwdAttribute' in > 'pwdPolicy' entries. It's the exact same issue. The objectIdentifierMatch function only works with numeric OIDs. The ppolicy overlay inserts its own matching function to make the name work. > > Eventual I'd like to have a constraint like this: > > # check whether appropriate password policy is assigned > constraint_attribute structuralObjectClass,pwdPolicySubentry > set "this/structuralObjectClass & this/pwdPolicySubentry/aeApplicableSOC" Not possible without custom code. > > Ciao, Michael. > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Re: Ldap not reachable/tuning
by Quanah Gibson-Mount 28 Nov '16

28 Nov '16

--On Friday, November 25, 2016 7:05 PM +0100 Thomas Hummel <thomas.hummel(a)pasteur.fr> wrote: > Hello, > > I'm using a simple setup on CentOS Linux release 7.2.1511 > (Core)/openldap-servers-2.4.40-9 /cn=config/mdb : one provider with the > syncprov overlay and 2 syncrepl consumers. The DIT itself is about 10000 > dn in size (about 3000 active users). > > Everything works fine except that sometimes, some clients report > (temporary) failure to reach the consumers (NAS servers for instance). Hi Thomas, A few notes: a) The CentOS7 build is hacked to support a broken TLS implementation. b) The version (2.4.40) is quite old, and has numerous known problems (it was a particularly broken release). I would also note the CentOS7 build has on occassion had its own problems introduced by patches from RedHat that do not exist in stock OpenLDAP builds. See <http://www.openldap.org/software/release/changes.html> for a list of changes since 2.4.40 was released. c) Nothing you presented indicates any issue on the server side. It could, for example, be an issue with your clients, a firewall, packet shaper, etc. d) You should fully disable rate limiting for rsyslogd. Then find out what the server side reports during the periods of time when you see issues with the client connections. You may wish to examine the LTB builds (<http://ltb-project.org/wiki/download#openldap>) if you are unable to build OpenLDAP yourself, or if you require support for your OpenLDAP installation, Symas (the company I work for) has support options. Hope this helps! --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

OID syntax and NAMEs
by Michael Ströder 28 Nov '16

28 Nov '16

HI! I've declared an attribute type like this with LDAP syntax OID: ( 1.3.6.1.4.1.5427.1.389.100.4.18 NAME 'aeApplicableSOC' DESC 'AE-DIR: structural object classes for which policy is applicable' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 X-ORIGIN 'AE-DIR' ) Which is pretty similar to this: ( 2.5.4.0 NAME 'objectClass' DESC 'RFC4512: object classes of the entity' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 ) Now I wonder why I can't use the object class NAMEs instead of the OIDs as attribute or assertion values, e.g. why I can't find the entries with filter (aeApplicableSOC=aeUser). This reminds me a bit of the similar OID vs. NAME issue with 'pwdAttribute' in 'pwdPolicy' entries. Eventual I'd like to have a constraint like this: # check whether appropriate password policy is assigned constraint_attribute structuralObjectClass,pwdPolicySubentry set "this/structuralObjectClass & this/pwdPolicySubentry/aeApplicableSOC" Ciao, Michael.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical November 2016