openldap-technical March 2016

openldap-technical@openldap.org

51 participants
51 discussions

Syncrepl TLS woes
by Xavier Landreville 28 Mar '16

28 Mar '16

Hello, I am currently in the grips of trying to get syncrepl replication working with StartTLS. It was working fine until recently. The only change that occurred over the last 12 months (that relates to OpenLDAP) is that I've started requiring TLS for connections. My provider is running OpenLDAP 2.4.31 on Ubuntu 14.04, while one consumer is running the exact same version on a Ubuntu 14.04 machine and the other consumer is running OpenLDAP 2.4.28 on Ubuntu 12.04. The provider has, AFAIK, a correct TLS configuration, given that I can connect and search using the ldapsearch -ZZ utility from any of the servers. The syncprov overlay is loaded and configured on the provider. The consumers have the following (redacted, with unique rid values) olcSyncRepl: olcSyncrepl: {0}rid=1 provider=ldap://[LDAP_DNS] bindmethod=simple bi nddn="[SYNC_USER]" credentials=[SYNC_PASS] searchbase="[L DAP_BASE]" logbase="cn=accesslog" logfilter="(&(objectClass=auditWr iteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog starttls=critical tls_reqcert=demand Unfortunately, on both consumers can't seem to be able to actually start the TLS connection: slapd[1257]: slap_client_connect: URI=ldap://[LDAP_DNS] Error, ldap_start_tls failed (-11) slapd[1257]: do_syncrepl: rid=001 rc -11 retrying And the provider shows the following errors: slapd[2126]: conn=1586 fd=100 ACCEPT from IP=[CONSUMER_IP]:35500 (IP=0.0.0.0:389) slapd[2126]: conn=1586 op=0 EXT oid=1.3.6.1.4.1.1466.20037 slapd[2126]: conn=1586 op=0 STARTTLS slapd[2126]: conn=1586 op=0 RESULT oid= err=0 text= slapd[2126]: conn=1586 fd=100 closed (TLS negotiation failure) Is there anything that I'm missing? Cheers, -- Xavier

3 2

LDAP authentication with uid
by Mary Kao 23 Mar '16

23 Mar '16

Hello, This is a real newbie question ::) I have configured apache httpd to use LDAP for basic authentication (userid and password). I am not sure what the directory DN should look like when using "uid" rather than "cn"? In my LDAP directory I have: dn: cn=Christine Smith,ou=ELOGAccounts,ou=RavenApps,dc=my-domain,dc=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: uidObject cn: Christine Smith sn: Smith uid: christine userPassword:: Y2hyaXN0aW5l Where do I put the "uid" so that when the httpd sends over the uid the ldap server will search on it? Thank you,Mary

4 4

Safely Allow Users to Write self Attributes
by Daniel Howard 23 Mar '16

23 Mar '16

I would like to allow users to ldapmodify a few of their attibutes ... sshPublicKey,gecos .. This does not appear to do the trick: 0-14:08 djh@ldap0 ~$ *sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b \> cn=config '(olcDatabase={1}hdb)' olcAccess* dn: olcDatabase={1}hdb,cn=config olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=example,dc=com" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=admin,dc=example,dc=com" write by * read olcAccess: {3}to attrs=sshPublicKey,gecos by self write Why? I would guess the {2} rule "to * by * read" has precedence. As I understand it, if I wanted to re-order those rules, I would delete and rewrite the rules. This would require me to delete the rule that gives admin the access to write the rules in the first place ... sounds like a way to lock myself out of my LDAP database? So, my guess is that I want and LDIF like so: dn: olcDatabase={1}hdb,cn=config changetype: modify remove: olcAccess olcAccess: {3}to attrs=sshPublicKey,gecos by self write - add: olcAccess olcAccess: {2}to attrs=sshPublicKey,gecos by self write - add: olcAccess olcAccess: {3}to * by dn="cn=admin,dc=example,dc=com" write by * read - remove: olcAccess olcAccess: {2}to * by dn="cn=admin,dc=example,dc=com" write by * read If I run this as cn=admin then it should: 1) Remove ineffective {3} 2) Add an effective {2} (now there are two {2}s..) 3) Add a new {3} to match incumbent {2} 4) Remove incumbent {2} I shouldn't lock myself out because I add a new rule for admin access before deleting the old rule, and as far as LDAP is superficially concerned, all these olcAccess attributes are just unique records, so the conflicting number rules aren't going to be a problem .. ? Am I on the right track? Thanks, -danny -- http://dannyman.toldme.com

2 2

Translucent proxy and changing upstream DNs
by Sullivan, Daniel [AAA] 23 Mar '16

23 Mar '16

Hi, Please forgive my ignorance if this is a stupid question; I have only been messing around with OpenLDAP for a few days, but I believe I hit a roadblock that somebody must have seen somewhere. Basically, I am planning on using a translucent proxy to augment the attribute set served up by an external LDAP provider. Specifically I am provisioning uidNumber and gidNumbers for AD accounts. I cannot populate the upstream RFC2307 attributes. My problem is this; it is my understanding that a translucent proxy is going to match records in the local and remote databases based on DN. Admins are going to be moving user and group objects around upstream, which will reliably break the mapping between local and remote databases after the objects with uidNumber and gidNumbers are populated into the local database. I can think of a couple of algorithms that would reconcile this, although they would require custom coding and maintaining a localized external view of the data (i.e. in a SQL database). So, I suppose my question is this; Is there an elegant way to solve this problem, for example, having the translucent proxy map by an attribute other than DN, such as an AD SID? I appreciate your time and input :-) Thank you, Dan Sullivan ******************************************************************************** This e-mail is intended only for the use of the individual or entity to which it is addressed and may contain information that is privileged and confidential. If the reader of this e-mail message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is prohibited. If you have received this e-mail in error, please notify the sender and destroy all copies of the transmittal. Thank you University of Chicago Medicine and Biological Sciences ********************************************************************************

2 4

cn=config (MMR) replication causes ldapsearch -ZZ to hang on RHEL 6.7
by Frank Crow 22 Mar '16

22 Mar '16

I'm trying to move my OpenLDAP MMR configuration from RHEL 6.5 (OpenLDAP 2.4.23) to RHEL 6.7 (OpenLDAP 2.4.40). On RHEL 6.5 it is working no with no problems. On RHEL 6.7, the configuration causes "ldapsearch -ZZ" to hang indefinitely. The cn=config section in slapd.conf looks like this: # sync provider configuration overlay syncprov syncprov-checkpoint 1 1 syncrepl rid=001 provider=ldap://server1 searchbase="cn=config" filter="(|(objectClass=olcDatabaseConfig)(objectClass=olcOverlayConfig))" bindmethod=sasl saslmech=EXTERNAL starttls=critical tls_cert=/etc/openldap/csa-certs/config.crt tls_key=/etc/openldap/csa-certs/config.key tls_cacert=/etc/openldap/csa-certs/cacert.pem tls_reqcert=demand type=refreshAndPersist retry="5 10 10 10 30 +" timeout=1 syncrepl rid=002 provider=ldap://server2 searchbase="cn=config" filter="(|(objectClass=olcDatabaseConfig)(objectClass=olcOverlayConfig))" bindmethod=sasl saslmech=EXTERNAL starttls=critical tls_cert=/etc/openldap/csa-certs/config.crt tls_key=/etc/openldap/csa-certs/config.key tls_cacert=/etc/openldap/csa-certs/cacert.pem tls_reqcert=demand type=refreshAndPersist retry="5 10 10 10 30 +" timeout=1 mirrormode on If I comment out that section in slapd.conf then "ldapsearch -ZZ" works but (obviously) I don't get cn=config replication. Am I doing something wrong in the configuration? Is it a fluke that it is working on 2.4.23 in the first place? Or does anyone know what may have changed (or is more strict or whatever) in the 2.4.40 release? Should I try to just remove RHEL's version of OpenLDAP and install the latest from openldap.org instead? Any assistance is highly appreciated! Thanks, -- Frank

3 2

how to provide a way to user to change their password
by MichaelLeung 21 Mar '16

21 Mar '16

hi list i am wonder how to provide a way to LDAP user to change their password

3 3

Openldap allows to break schema (and doesn't start ever after)
by Daniel Fenert 21 Mar '16

21 Mar '16

Hi, I've accidentally broken my openldap schema when I've changed one of objectClass definitions. For example I have two objectClasses and one is a parent for second: olcObjectClasses: {0}( 1.2.3.4 NAME 'foo' DESC '' SUP top AUXILIARY X-ORIGIN 'user defined' ) olcObjectClasses: {1}( 1.2.3.5 NAME 'bar' DESC '' SUP foo AUXILIARY X-ORIGIN 'user defined' ) I've changed definition of foo - I've delete this object and (my mistake) put it without any number at bottom of all classes: dn: cn=config changetype: modify delete: olcObjectClasses olcObjectClasses: {0} - add: olcObjectClasses olcObjectClasses: ( 1.2.3.4 NAME 'foo' DESC '' SUP top AUXILIARY X-ORIGIN 'user defined' ) So now I have class bar at top of schema and foo at bottom. After restart slapd won't start. Slapcat says: 56d4678f olcObjectClasses: value #5 olcObjectClasses: ObjectClass not found: "foo" 56d4678f config error processing cn=config: olcObjectClasses: ObjectClass not found: "foo" slapcat: bad configuration file! I know that is my mistake, but I think openldap shouldn't allow to make something that could break schema. I think that there are should constraints that do not allow to remove objectClass which is parent for another class. Is it a known bug, or anyone has stumbled upon this and has a solution to start slapd afterwards? -- Daniel Fenert

1 0

looking for a graphic tool for openldap
by MichaelLeung 20 Mar '16

20 Mar '16

i am wondering is there a graphic openldap admin tool that run under Linux ?

9 12

slapd + bdb backend , some queries failing with "Internal error on get_nextid"
by Tobias Gierke 18 Mar '16

18 Mar '16

Hi, Recently we all of a sudden started getting this error message on certain queries (but not all of them). I had a brief look at back-bdb/search.c but unfortunately there are no comments that point to a possible cause. Does this mean the database is corrupted ? Can this be fixed with db_recover ? Thanks, Tobias P.S. We're running ClearOS 6.7.0 with openldap-servers-2.4.4.0-7-v6 on x64 -- Tobias Gierke Development VOIPFUTURE GmbH Wendenstraße 4 20097 Hamburg, Germany Phone +49 40 688 900 164 Fax +49 40 688 900 199 Email tobias.gierke(a)voipfuture.com Web http://www.voipfuture.com CEO Jan Bastian Commercial Court AG Hamburg HRB 109896, VAT ID DE263738086

2 3

Error with :mozillaOrgPerson removed from template as it is not defined in the schema
by MichaelLeung 17 Mar '16

17 Mar '16

hi list i got these two error, Courier Mail: Account: *courierMailAccount* removed from template as it is not defined in the schema Thunderbird: Address Book Entry: *mozillaOrgPerson* removed from template as it is not defined in the schema seems my phpadminldap lack of the schema. does any one have the schema for openldap ? or give me a link so that i can download it.

3 6

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical March 2016