openldap-technical January 2017

openldap-technical@openldap.org

47 participants
80 discussions

(host) and (uid) not indexed (after creating an account)
by Peng Yu 04 Jan '17

04 Jan '17

Hi, I can use the following command to change the password in openldap after I create an entry le. ~~~ $ sudo ldapsetpasswd le Changing password for user uid=le,ou=Users,dc=mydomain,dc=example New Password: Retype New Password: Successfully set password for user uid=le,ou=Users,dc=mydomain,dc=example ~~~ And I can see the userPassword field is changed upon calling the above command. ~~~ $ sudo ldapmodifyuser le [sudo] password for pengy: # About to modify the following entry : dn: uid=le,ou=Users,dc=mydomain,dc=example objectClass: account objectClass: posixAccount objectClass: shadowAccount cn: le uid: le uidNumber: 10103 gidNumber: 10002 homeDirectory: /home/le loginShell: /bin/bash gecos: le description: User account shadowMax: 180 shadowLastChange: 0 userPassword:: e1NTSEF9VzZHdlFnTkdDMitzUk5BRStpMGMzcElVWG9hVTYzRjk= # Enter your modifications here, end with CTRL-D. dn: uid=le,ou=Users,dc=mydomain,dc=example Successfully modified user entry uid=le,ou=Users,dc=mydomain,dc=example in LDAP ~~~ (BTW, why whenever I run ldapsetpasswd to set the same password, the userPassword field is set differently?) But the user le is not able to login to the servers (the servers connected to openldap for authentication) with the new password. In /var/log/syslog of the openldap server (ubuntu), I see the following lines. ~~~ Jan 2 12:17:22 openldapserver slapd[1082]: conn=2884 fd=39 ACCEPT from IP=172.17.1.6:51975 (IP=0.0.0.0:389) Jan 2 12:17:22 openldapserver slapd[1082]: conn=2884 op=0 BIND dn="" method=128 Jan 2 12:17:22 openldapserver slapd[1082]: conn=2884 op=0 RESULT tag=97 err=0 text= Jan 2 12:17:22 openldapserver slapd[1082]: conn=2884 op=1 SRCH base="dc=domain,dc=example" scope=2 deref=0 filter="(&(&(|(host=\2A)(host=elnath))(!(host=!elnath)))(&(|(host=\2A)(host=elnath))(!(host=!elnath)))(uid=le))" Jan 2 12:17:22 openldapserver slapd[1082]: <= bdb_equality_candidates: (host) not indexed Jan 2 12:17:22 openldapserver slapd[1082]: message repeated 3 times: [ <= bdb_equality_candidates: (host) not indexed] Jan 2 12:17:22 openldapserver slapd[1082]: <= bdb_equality_candidates: (uid) not indexed Jan 2 12:17:22 openldapserver slapd[1082]: conn=2884 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= ~~~ On the server to be logged in (named as elnath and is also a ubuntu server), /var/log/auth.log has the following line. ~~~ Jan 2 12:17:22 elnath sshd[21249]: Failed password for le from xxx.xx.xx.xx port 57155 ssh2 ~~~ I have tried to stop slapd service then run slapindex as root and then start slapd service on the openldapserver. But it still does not work. Could anybody let me know how to fix this issue? Thanks. -- Regards, Peng

3 4

Re: mdb_stat question
by Howard Chu 04 Jan '17

04 Jan '17

Frank Swasey wrote: > I have noticed that the mdb_stat (-e parameter) now shows the number of pages > used, so I can use that instead of running a du and compare it to the Max > pages value to see how "full" the data.mdb has become. > > We use nagios to monitor such things... is there a frequency of running > mdb_stat that would be too frequent and could cause issues with a moderately > loaded (handling 14 million operations per day) ldap server? It takes more CPU time to fork a process and load the mdb_stat binary than it takes to read and print the statistic. > Should I have nagios not perform the mdb_stat check more frequently than some > recommended amount of time? Whatever, it's your CPU load. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

mdb_stat question
by Frank Swasey 04 Jan '17

04 Jan '17

I have noticed that the mdb_stat (-e parameter) now shows the number of pages used, so I can use that instead of running a du and compare it to the Max pages value to see how "full" the data.mdb has become. We use nagios to monitor such things... is there a frequency of running mdb_stat that would be too frequent and could cause issues with a moderately loaded (handling 14 million operations per day) ldap server? Should I have nagios not perform the mdb_stat check more frequently than some recommended amount of time? Thanks, Frank

1 0

Re: help with ACL
by Quanah Gibson-Mount 04 Jan '17

04 Jan '17

--On Friday, December 23, 2016 11:16 AM +0100 Alberto Aldrigo <alberto.aldrigo(a)h-farm.com> wrote: > uid=user1 and uid=user6 are company1's administrators, so they can write > in whole o=company1 subtree Might be best to make an LDAP group with those users as members, and then write an ACL based off of that group for its specific privileges. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Syncrepl and multipe values
by Matheus Eduardo Bonifacio Morais 03 Jan '17

03 Jan '17

Hi, I have one replication tool which makes some modifications in my OpenLDAP master. For some shitty reason, that tool tries to modify one dn with duplicated attributes. Here is the snippet of accesslog: dn: reqStart=20170103135721.000411Z,cn=accesslog objectClass: auditModify reqStart: 20170103135721.000411Z reqEnd: 20170103135721.000413Z reqType: modify reqSession: 1184351 reqAuthzID: cn=manager,dc=br reqControls: {0}{2.16.840.1.113730.3.4.2} reqDN: ou=marili_advogados,ou=terceiros,cn=sistema,cn=entities,dc=sicredi,dc=c om,dc=br reqResult: 0 reqMod:: U2ljcmVkaU1lbW86PSBt77+9Hu+/veKdqu+/vTA0LjUyOC4yNzYvMDAwMS0wNg1BVi4gT UFSRUNIQUwgRkxPUklBTk8gUEVJWE9UWA== reqMod: SicrediEntidadePai:= ou=terceiros,cn=sistema,cn=entities,dc=sicredi,dc =com,dc=br reqMod: SicrediEntidadePai:= ou=terceiros,cn=sistema,cn=entities,dc=sicredi,dc =com,dc=br reqMod: entryCSN:= 20170103135721.874447Z#000000#000#000000 reqMod: modifiersName:= cn=manager,dc=br reqMod: modifyTimestamp:= 20170103135721Z reqEntryUUID: 61dfd779-5799-4988-927b-914e75d6ae90 As you can see, the attribute "SicrediEntidadePai" is modified two times with the same value, which results in syncrepl to stuck, as described in one of our slaves logs: 2017-01-03T19:14:21.043501-02:00 ds1openldap5p slapd[2245]: syncrepl_message_to_op: rid=000 mods check (SicrediEntidadePai: multiple values provided) 2017-01-03T19:14:21.043599-02:00 ds1openldap5p slapd[2245]: do_syncrepl: rid=000 rc 19 retrying 2017-01-03T19:15:21.039822-02:00 ds1openldap5p slapd[2245]: syncrepl_message_to_op: rid=000 mods check (SicrediEntidadePai: multiple values provided) 2017-01-03T19:15:21.039863-02:00 ds1openldap5p slapd[2245]: do_syncrepl: rid=000 rc 19 retrying My workaround is remove the database on the slaves and let it to do a full replication. I'm looking in the replication tool to fix that modification bug but meanwhile I have two questions about that: 1 - Why that modification happen with no problem in OpenLDAP master and stuck syncrepl? 2 - Should I fill an issue on ITS or this is working as expected? 3 - There is any other workaround for this case? OpenLDAP: slapd 2.4.42 Thanks. Matheus Eduardo Bonifácio Morais Analista de Infraestrutura de TI, Plataforma e Aplicações Confederação Sicredi Centro Administrativo Sicredi - Porto Alegre +55 51 3358 7143 sicredi.com.br [1474907760585_sicredilogo.png] Esta mensagem é somente para uso do destinatário informado e pode conter informações privilegiadas, proprietárias ou privadas. Se você recebeu esta mensagem por engano, por favor, notifique o remetente imediatamente e apague a original. Qualquer outro uso deste e-mail é proibido. This message is for the designated recipient only and may contain privileged, proprietary, or otherwise private information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the email by you is prohibited.

1 0

ldapsearch filter question
by Zhang,Jun 03 Jan '17

03 Jan '17

ldapsearch -x -b dc=myinstitute,dc=edu uid=user1 gidnumber gives me gidnumber=1234 I then tried, ldapsearch -x -b dc=myinstitute,dc=edu "(&(objectclass=groupofnames)(gidnumber=1234))" intending to find out the name of the group, but I got nothing. Thanks Jun The information contained in this e-mail message may be privileged, confidential, and/or protected from disclosure. This e-mail message may contain protected health information (PHI); dissemination of PHI should comply with applicable federal and state laws. If you are not the intended recipient, or an authorized representative of the intended recipient, any further review, disclosure, use, dissemination, distribution, or copying of this message or any attachment (or the information contained therein) is strictly prohibited. If you think that you have received this e-mail message in error, please notify the sender by return e-mail and delete all references to it and its contents from your systems.

4 8

Re: ppolicy overlay unable to set pwdAccountLockedTime on to-be-locked users due to ACLs
by Quanah Gibson-Mount 03 Jan '17

03 Jan '17

--On Monday, January 02, 2017 2:40 PM +0100 Matthieu Cerda <matthieu.cerda(a)nbs-system.com> wrote: > Thank you very much Quanah ! > > Do you think adding a note about mandatory rootdn setting in > slapo-ppolicy manpage would be a worthy contribution ? (I'll gladly > submit a patch) Hi Matthieu, It's already currently noted in the 3rd paragraph of the man page: Note that some of the policies do not take effect when the operation is performed with the rootdn identity; all the operations, when performed with any other identity, may be subjected to constraints, like access control. Note the bit about "all the operations, ..." If you think of a way to reword it that you feel is a better explanation, that could certainly be considered. :) Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 2

Fwd: Help pls : KDC w/LDAP backend
by Pascal Jakobi 02 Jan '17

02 Jan '17

Hi there I am trying to install a KDC (kerberos) with an OpenLDAP backend, following instructions found on the MIT kerberos site. Installation went fine and I can see that the default principals have been created (kadmin, krbtgt & so on...). However, I cannot add new principals : kadmin.local -q "addprinc -pw password root" Authenticating as principal root/admin(a)JAKOBI.FR with password. WARNING: no policy specified for root(a)JAKOBI.FR; defaulting to no policy *add_principal: Principal add failed: Insufficient access while creating "root(a)JAKOBI.FR <root(a)JAKOBI.FR>".* Digging a bit further, I could see the following with wireshark (after binding to the Directory as kadmin) : 147 21.719670222 127.0.0.1 127.0.0.1 LDAP 1028 addRequest(7) "krbprincipalname=root(a)JAKOBI.FR,cn=JAKOBI.FR,cn=kerberos,dc=jakobi,dc=fr" 148 21.720138441 127.0.0.1 127.0.0.1 LDAP 107 addResponse(7) *insufficientAccessRights (no write access to parent) * My LDAP ACLs are as follows : {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=jakobi,dc=fr" write by anonymous auth by self write by * none {1}to dn.base="" by * read {2}to * by dn="cn=admin,dc=jakobi,dc=fr" write by * read {3}to dn.subtree="cn=JAKOBI.FR,cn=kerberos,dc=jakobi,dc=fr" by dn.exact="cn=kdc,ou=People,dc=jakobi,dc=fr" read * {4}to dn.subtree="cn=kerberos,dc=jakobi,dc=fr" by dn.exact="cn=kadmin,ou=People,dc=jakobi,dc=fr" write* if ACL #4 refers to *dn.subtree="**cn=JAKOBI.FR <http://JAKOBI.FR>,cn=kerberos,dc=jakobi,dc=fr"* (shouldn'it be the parent of the target principal?), result is the same. As far as I understand, rule #4 should allow me to to write within the realm subtree... Can someone enlighten me ? Thanks in adv. -- *Pascal*

3 2

Re: ppolicy overlay unable to set pwdAccountLockedTime on to-be-locked users due to ACLs
by Quanah Gibson-Mount 02 Jan '17

02 Jan '17

--On Thursday, December 22, 2016 11:23 AM +0100 Matthieu Cerda <kegeruneku+openldap(a)ironflake.org> wrote: > Hello Howard and Ozgur, > > My answers are inlined in the following text. > > I attached a copy of the slapd.conf if you would like to take a look. Your slapd.conf has no rootdn configured. You need to configure it if you want ppolicy to function correctly. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: memberOf overlay issues with 2.4.44 + ITS 8432 patch
by Quanah Gibson-Mount 02 Jan '17

02 Jan '17

Ok good to know! The issue I created occurred when deleting the group, which I believe is the original complaint in the ITS as well. So I will add individual membership deletes as a part of that test too. --Quanah > On Dec 30, 2016, at 9:31 PM, Paul B. Henson <henson(a)acm.org> wrote: > >> On Fri, Dec 30, 2016 at 02:41:06PM -0800, Quanah Gibson-Mount wrote: >> >> Well, it seems to be some sort of race condition. > > Yes, I'd agree; probably also load dependent as I never triggered it on > my dev systems which are mostly idle other than my test load. It only > showed up on my prod systems which tend to have continuous load from > various other things. > >> I did want to confirm that you see this on servers that are long running >> (I.e., they've been running for a long time, and had other group deletes >> that went through w/o issue during that time). If so, then I can modify >> the test to randomly add and delete groups as a part of the test, >> increasing the likelyhood of triggering the issue within the test. > > I don't have too many deletions of group objects themselves in > production, mostly just deletions of the members of groups. I didn't see > any issues with group deletions in dev, or during some basic initial > testing in prod. I'll go ahead and make a new test group, add some > members to it, and then delete it and see what happens now that I've > been running this code for about 3 weeks... > > I didn't see any errors deleting a group, although there were these > syncrepl messages that I don't believe used to show up: > > Dec 30 21:23:29 themis slapd[2607]: syncrepl_message_to_op: rid=001 be_delete uid=ldaptest5,ou=group,dc=cpp,dc=edu (32) > Dec 30 21:23:29 themis slapd[2607]: syncrepl_message_to_op: rid=003 be_delete uid=ldaptest5,ou=group,dc=cpp,dc=edu (32) > Dec 30 21:23:29 themis slapd[2607]: syncrepl_message_to_op: rid=002 be_delete uid=ldaptest5,ou=group,dc=cpp,dc=edu (32) > > The group and memberOf attributes are gone on all four servers, so other > than noise in the logs I'm not sure what these messages meant. > >

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical January 2017