February 2019 - openldap-technical

Problem with "force user to password reset at first login

by Rajagopal Rc

Hi, I am trying to force users to change their password at first login or after password reset by administrator. Tried following: 1)Password policy 'pwdMustChange TRUE' doesn't seems to be working as non of the users get prompt to change their password at first login. 2) used the 'pwdReset TRUE' attribute in users attributes, and it won't prompt to change the password and didn't allow to login i observe below messages in log "slapd[12684]: connection restricted to password changing only slapd[12684]: send_ldap_result: err=50 matched="" text="Operations are restricted to bind/unbind/abandon/StartTLS/modify password" slapd[12684]: conn=1053 op=1 SEARCH RESULT tag=101 err=50 nentries=0 text=Operations are restricted to bind/unbind/abandon/StartTLS/modify password" Please help me configure the option to force all users to change their password at first login or after pwd reset by administrator. Thanks & Regards Raj Tata Consultancy Services Mailto: rajagopal.rc(a)tcs.com Website: http://www.tcs.com ____________________________________________ Experience certainty. IT Services Business Solutions Consulting ____________________________________________ =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

1 month

5
9
0 / 0

help needed for further investigation

by Thomas.Meller＠t-systems.com

Hello together. I am the heir of a setup based on RHEL 6.10 and Openldap 2.4.45 (ltb) A master syncrepls to a slave in type=refreshOnly using bindmethod=sasl, saslmech=external. The mapped techuser resides in ou=ServiceUser. All Clients also use user objects in the same ou to bind to the servers. I need to set new acls and decided to include a dedicated acl- and limits-configfile. The ACLs checked via slapacl look fine and run without problems on the test environment. (Which is based on the same 2.4.45 rpms, but the replica runs on RHEL 7.5) All slapd configuration make use of database mdb and an explicitly set maxsize. (which is sized sufficiently: 12 GB, 49 MB used) When implementing the configuration on a running system, the replica deletes the ou (that one with all the service user objects). Which is not what I want 8-/ How can I find out more about the reason for this peculiar result? I set the loglevel to 'stats sync' on the replica and 'sync' on the master. (fs size is limited for logs) The access limits are in place for this replication account and read access is granted as well. (might be I need to set something extra for operational attributes?) limits dn.subtree="ou=ServiceUser,..." size=unlimited (this is the replica) sizelimit unlimited timelimit 10 and limits dn.subtree="ou=ServiceUser,..." size=unlimited time=120 (in this order, this is the master) What do I need to look at to find what's missing? I am no openldap crack, but no newbie as well. Yet my openldap knowledge ist not very extended. Which further infos do I need to supply to maybe get help? The include statements for limits and acls are defined before the database configuration. I avoid using dynamic configuration to keep it all simple. Overlays in use: chain dynlist valsort memberof ppolicy (replica) syncprov ppolicy unique dynlist memberof refint valsort (master) Thank you, Thomas

4 years, 9 months

3
4
0 / 0

setting up openldap to proxy to AD on SUSE ENT 12

by N6Ghost

hi all, I am trying to setup an openldap proxy to AD and i need to use SUSE Enterprise Linux 12. Hostname:/etc/openldap # rpm -qa|grep -i openldap openldap2-2.4.41-18.43.1.x86_64 openldap2-client-2.4.41-18.43.1.x86_64 what I am trying to do, is proxy an application (with 1000s of users) from talking directory to AD, to talking to openldap. and then have openldap talk to AD. look across the net is a bunch of stuff, but most of it does not seem to apply, or work. look at the offical doc, says use sasl but you must have an local entry with a {sasl] tag on the user thats not really ideal and work make a huge problem. a few of the posts online just said point to AD via ldap is possible? and this application also has a group lookup as part of its auth process... eg, only member of groupX can access.... any help in this would be huge. seems, i am mixing up a few different ways of doing this whats the bets way to do this? Thanks -N6ghost

4 years, 9 months

5
7
0 / 0

Expected operation of pwdFailureCountInterval

by Tom Jay

Hello, Can someone explain the expected operation of the pwdFailureCountInterval attribute please? The documentation seems to be fairly clear, but if I add it to the password policy, along with some other attributes, the account remains locked, even after the pwdFailureCountInterval time. Despite authenticating with a valid password, the pwdFailureTime entries remain and the account remains locked. These are the attributes in use: pwdLockout: TRUE pwdMaxFailure: 5 pwdFailureCountInterval: 1200 Thanks. Tom

4 years, 9 months

2
1
0 / 0

slapd-sock Overlay gives no RESULT on Successful BIND

by Kamal Advani

Hello, We are attempting to sync over some data from OpenLDAP into Win AD. The approach thus far has been to use slapd-sock in overlay mode and attach a listener. Our configuration snippet is as follows: --- moduleload back_sock overlay sock extensions connid socketpath /var/run/openldap/winad-sync-overlay.sock sockops add bind delete modify modrdn sockresps result --- What I have noticed is that on a successful BIND, no corresponding RESULT is received. However, on a BIND failure, we do, with a non-zero code (as expected). Another interesting situation is as follows: * On an unsuccessful BIND, we get 2 messages, a BIND and a MODIFY -- we also use the `ppolicy` module, so it sets the pwdFailureTime, an 'add' change, on a BIND failure. This is fine. * However, both the BIND and MODIFY have the same msgid. * Finally, we get one RESULT back with the same msgid. Continuing on, if I then BIND successfully, as above, I get: * BIND and MODIFY -- this time the MODIFY clears pwdFailureTime, a delete change. Same msgid on both BIND and MODIFY. * Again, only one RESULT, with the corresponding msgid. Have I misconfigured something, or is this expected behaviour? In all cases, have made sure I'm sending through CONTINUE after each message. I guess, I'd expect a RESULT for each request message, it would certainly make message processing much simpler and deterministic: * Receive request, store, keyed by conn id and msg id. * Receive RESULT, find corresponding request, and process accordingly. I only have this issue on BIND, as far as I can tell, at least for the `sockops` I'm interested in. Any suggestions are much appreciated. Thanks very much. Regards, Kamal PS. Happy to provide transcripts of output, just keeping the initial email size manageable. Please let me know. PPS. Another quirk is, it appears that I get a RESULT for a SEARCH, even though I am not subscribed to it in `sockops`, but happy to ignore this for now! -- There is more to life than increasing its speed. -- Mahatma Gandhi

4 years, 9 months

1
0
0 / 0

Get values of Telephone Tab ( A.D. ) using ldapsearch.

by - -

Hi, I am trying to get the values of Telephone tab in a Active Directory Server using ldapsearch. http://www.windows-active-directory.com/telephone-tab-in-ad-user-properti... Active Directory User properties – Telephone tab<http://www.windows-active-directory.com/telephone-tab-in-ad-user-properti...> The telephone tab of the user properties window allows you to add detailed telephone contacts for the user. www.windows-active-directory.com I get other values like mail or telephoneNumber at the first tab but I can't get neither information of Telephone Tab . I am using this command: ldapsearch -x -H ldap://IP:PORT -D "cn=userldap,OU=users,DC=domain,DC=local" -w PASSWORD -b "DC=domain,DC=local" "(&(objectclass=person)(mail=user1(a)domain.com))" mail telephoneNumber mobile # extended LDIF # # LDAPv3 # base <DC=domain,DC=local> with scope subtree # filter: (&(objectclass=person)(mail=user1(a)domain.com)) # requesting: mail telephoneNumber mobile # # User 1, Users, domain.local dn: CN=User 1,OU=Users,DC=domain,DC=local l telephoneNumber: 1 mail: user1(a)domain.com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Is posible get this information using ldapsearch tool?. Thanks in advance . Best Regards

4 years, 9 months

1
0
0 / 0

Help to understand "Paged results cookie is invalid"

by Andrea Patricelli

Good morning, I'm connecting to an OpenLdap through a JNDI client [1] and I "randomly" get this error: [LDAP: error code 2 - paged results cookie is invalid]; I suppose that the problem is related to multiple clients connecting to the LDAP with the same credentials (the same user), since the cookie is somehow related the user. Moreover since two different clients (different machines and IPs) are connecting simultaneously they invalidate the cookie to each other. Googling a bit and looking at the reference [1] and documentation I did not find something that confirm my thesis. Are my assumptions right or I'm misunderstanding the problem? If right, if there are multiple connections from the same client (same machine and IP) does OpenLdap manage this situation? I suppose (obviously) so, but asking anyway :) Thanks in advance, Andrea [1] https://github.com/Tirasa/ConnIdLDAPBundle/blob/net.tirasa.connid.bundles... [2] http://www.faqs.org/rfcs/rfc2696.html -- Dott. Andrea Patricelli Tel. +39 3204524292 Engineer @ Tirasa S.r.l. Viale Vittoria Colonna 97 - 65127 Pescara Tel +39 0859116307 / FAX +39 0859111173 http://www.tirasa.net Apache Syncope PMC Member

4 years, 9 months

1
0
0 / 0

Forbidden account password reuse of the last 5 password

by Tian Zhiying

Hi Is there a feature that OpenLDAP password policy can forbidden user password reuse of the last 5 password? Thanks.

4 years, 9 months

8
19
0 / 0

Re: Switch OpenLDAP backend database from HDB to MDB

by SHarbich＠t-online.de

Hi Ryan, | Note that the database config attributes for hdb and mdb differ a little bit. For example you should configure olcDbMaxSize for mdb. For example, how would I change the following entry in the config file? dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb olcModuleLoad: {1}dynlist.so olcModuleLoad: {2}ppolicy.la structuralObjectClass: olcModuleList entryUUID: 9495e2a6-da11-1033-97d9-c1ceaf236428 creatorsName: cn=admin,cn=config createTimestamp: 20140926214112Z entryCSN: 20170201184048.317884Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20170201184048Z Should the change be as follows? - - - olcModuleLoad: {0}back_hdb + + + olcModuleLoad: {0}back_mdb dn: olcBackend={0}hdb,cn=config objectClass: olcBackendConfig olcBackend: {0}hdb structuralObjectClass: olcBackendConfig entryUUID: 94960592-da11-1033-97da-c1ceaf236428 creatorsName: cn=admin,cn=config createTimestamp: 20140926214112Z entryCSN: 20140926214112.940239Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140926214112Z Should the change be as follows? - - - dn: olcBackend={0}hdb,cn=config + + + dn: olcBackend={0}hmdb,cn=config - - - olcBackend: {0}hdb + + + olcBackend: {0}mdb So I have everywhere the entry of hdb to mdb? Thank you in advance for your support. Greetings from Stefan Harbich

4 years, 9 months

1
0
0 / 0

help with mdb database recovery after crash

by Andrei Mikhailovsky

Hello everyone, I have a bit of an issue with my ldap database. I have a Zimbra community edition which uses openldap. A server crashed and I am unable to start the ldap services after the reboot. The description of my problem, after some digging about is: the initial error indicated problem with the ldap Starting ldap...Done. Search error: Unable to determine enabled services from ldap. Enabled services read from cache. Service list may be inaccurate. Having investigated the issue, I noticed the following errors in the zimbra.log slapd[31281]: mdb_entry_decode: attribute index 560427631 not recognized I also noticed that the /opt/zimbra/data/ldap/mdb/db/data.mdb is actually 81Gb in size and had reached the limit imposed by the ldap_db_maxsize variable. so over the weekend, the LDAP mdb file became no longer sparse. I tried following the steps described in https://syslint.com/blog/tutorial/solved-critical-ldap-primary-mdb-databa... but with no success, as the slapcat segfaults with the following message. /opt/zimbra/common/sbin/slapcat -ccc -F /opt/zimbra/data/ldap/config -b "" -l /opt/zimbra/RECOVERY/SLAPCAT/zimbra_mdb.ldiff 5c583982 mdb_entry_decode: attribute index 560427631 not recognized Segmentation fault (core dumped) the mdb_copy produces a file of 420 mb in size, but it still contains the "mdb_entry_decode: attribute index 560427631 not recognized" error. I've also tried mdb_dump, but had the same issues after using the mdb_load command. I found a post ( http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8360 ) in the openldap community that the mdb gets corrupted if it reaches the maximum defined size. but no solution of how to fix it. any advice on getting the database recovered and working again? Cheers Andrei

4 years, 9 months

3
5
0 / 0

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical February 2019