openldap-technical August 2017

openldap-technical@openldap.org

32 participants
54 discussions

Re: searching userPassword value
by Howard Chu 02 Aug '17

02 Aug '17

Quanah Gibson-Mount wrote: > --On Wednesday, August 02, 2017 6:28 PM -0400 David Magda > <dmagda(a)ee.ryerson.ca> wrote: > >> Doing an "ldapsearch […] '(userpassword={SHA}*'" gets zero results. >> >> Thanks for any info. > > userPassword is base64 encoded, so no, you can't do that. False. The base64 encoding only happens in the ldapsearch tool just before it prints the result on stdout. The userPassword schema definition has no substring matching rule. And you should already know to check the schema definition for questions like this. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Re: searching userPassword value
by Quanah Gibson-Mount 02 Aug '17

02 Aug '17

--On Wednesday, August 02, 2017 6:28 PM -0400 David Magda <dmagda(a)ee.ryerson.ca> wrote: > Doing an "ldapsearch […] '(userpassword={SHA}*'" gets zero results. > > Thanks for any info. userPassword is base64 encoded, so no, you can't do that. You could find all the values, and then decode them. Or you could decode a specific value for a given user to see what sort of hash it is using. I'd probably use perl or python. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

searching userPassword value
by David Magda 02 Aug '17

02 Aug '17

Hello, Is there a way to search the value of the userPassword attribute? Specifically I’m hoping to determining to whether it begins with {SHA}, {CRYPT}, etc. Using the (olc)rootdn account is fine; it doesn’t have to be a regular user as this would be a rare/manual operational need. Doing an “ldapsearch […] ‘(userpassword={SHA}*'" gets zero results. Thanks for any info. Regards, David

1 0

Blacklists of simple values in LDAP attribute constraints overlay?
by Florian Best 02 Aug '17

02 Aug '17

Hello, I am searching for a way to add an LDAP constraint on attributes which prevents setting specific values. For example, I want to prevent that the attribute "uid" is equal to (case insensitive) "foo" or "bar". Using the manpage from https://linux.die.net/man/5/slapo-constraint it seems not possible, I tried a lot of things like: constraint_attribute uid set "this/uid & ([foo])" constraint_attribute uid set "this/uid & [foo]" constraint_attribute uid uri ldap:///dc=school,dc=local?forbidden?sub?(objectClass=forbiddenUsernames) constraint_attribute uid regex ^[^f][^o][^o]*$ Even if they were working (they don't) I needed to reverse the whole constraint because this would only allow me to add a whitelist while I want to add a blacklist. (Best would be If I could just add a "!" before the attribute contsraint.) I hope there is something which could help me. Best regards Florian -- Florian Best Open Source Software Engineer Univention GmbH be open Mary-Somerville-Str.1 28359 Bremen Tel.: +49 421 22232-0 Fax : +49 421 22232-99 best(a)univention.de http://www.univention.de Geschäftsführer: Peter H. Ganten HRB 20755 Amtsgericht Bremen Steuer-Nr.: 71-597-02876

2 6

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical August 2017