openldap-technical November 2021

openldap-technical@openldap.org

24 participants
29 discussions

compare operation behaves differently under 2.5
by Paul B. Henson 10 Nov '21

10 Nov '21

I've run into another quirk during my 2.5 upgrade process. We use the Apache ldap authnz module with a configuration such as: AuthLDAPURL ldaps://ldap.cpp.edu:636/DC=cpp,DC=edu?uid Require ldap-group uid=unxadmin,ou=group,dc=cpp,dc=edu This stopped working when accessing a server updated to 2.5. On the 2.4 server, the Apache logs look like: [Wed Nov 10 15:07:52.056237 2021] [authnz_ldap:debug] [pid 29887] mod_authnz_ldap.c(926): [client 10.104.223.117:51050] AH01714: auth_ldap authorize: require group: testing for member: uid=henson,ou=user,dc=cpp,dc=edu (uid=unxadmin,ou=group,dc=cpp,dc=edu) [Wed Nov 10 15:07:52.056264 2021] [authnz_ldap:debug] [pid 29887] mod_authnz_ldap.c(935): [client 10.104.223.117:51050] AH01715: auth_ldap authorize: require group: authorization successful (attribute member) [Comparison true (cached)][6 - Compare True] and the slapd logs look like: Nov 10 15:07:52 ldap-01 slapd[1233]: conn=224154 op=4 CMP dn="uid=unxadmin,ou=group,dc=cpp,dc=edu" attr="member" Nov 10 15:07:52 ldap-01 slapd[1233]: conn=224154 op=4 RESULT tag=111 err=6 text= Nov 10 15:08:42 ldap-01 slapd[1233]: conn=224154 fd=138 closed (connection lost) whereas on the 2.5 server, the Apache logs look like: [Wed Nov 10 15:03:52.375004 2021] [authnz_ldap:debug] [pid 29088] mod_authnz_ldap.c(926): [client 10.104.223.117:51022] AH01714: auth_ldap authorize: require group: testing for member: uid=henson,ou=user,dc=cpp,dc=edu (uid=unxadmin,ou=group,dc=cpp,dc=edu) [Wed Nov 10 15:03:52.375887 2021] [authnz_ldap:debug] [pid 29088] mod_authnz_ldap.c(945): [client 10.104.223.117:51022] AH01719: auth_ldap authorize: require group "uid=unxadmin,ou=group,dc=cpp,dc=edu": didn't match with attr member [Comparison false (adding to cache)][5 - Compare False] and the slapd logs look like: Nov 10 15:03:52 ldap-03 slapd[1197]: conn=208924 op=4 CMP dn="uid=unxadmin,ou=group,dc=cpp,dc=edu" attr="member" Nov 10 15:03:52 ldap-03 slapd[1197]: conn=208924 op=4 RESULT tag=111 err=5 qtime=0.000011 etime=0.000139 text= If I understand correctly, Apache is making a compare call to check to see if my DN (uid=henson,ou=user,dc=cpp,dc=edu) exists as a value of the member attribute in the group uid=unxadmin,ou=group,dc=cpp,dc=edu. It certainly does, on both the server running 2.4 and 2.5: dn: uid=unxadmin,ou=group,dc=cpp,dc=edu objectClass: groupOfNames objectClass: cppGroup objectClass: posixGroup uid: unxadmin cn: Unix Administrators gidNumber: 17730 member: member: uid=gkuri,ou=user,dc=cpp,dc=edu member: uid=henson,ou=user,dc=cpp,dc=edu memberUid: gkuri memberUid: henson Any thoughts on why this is behaving differently? The configuration should be pretty much identical, modulo required path changes and updating the memberOf handling. I was able to work around it by sitting a couple of additional parameters: AuthLDAPGroupAttribute memberUid AuthLDAPGroupAttributeIsDN off This now compares just my uid (henson) to the group memberUid attribute: Nov 10 15:24:54 ldap-03 slapd[1197]: conn=210708 op=4 CMP dn="uid=unxadmin,ou=group,dc=cpp,dc=edu" attr="memberUid" Nov 10 15:24:54 ldap-03 slapd[1197]: conn=210708 op=4 RESULT tag=111 err=6 qtime=0.000016 etime=0.000108 text= Apparently "err=6" is good and "err=5" is not :)? I was able to replicate this difference in behavior using the CLI tools: # ldapcompare -x -H ldaps://ldap-01.ldap.cpp.edu/ uid=unxadmin,ou=group,dc=cpp,dc=edu member:uid=henson,ou=user,dc=cpp,dc=edu TRUE # ldapcompare -x -H ldaps://ldap-03.ldap.cpp.edu/ uid=unxadmin,ou=group,dc=cpp,dc=edu member:uid=henson,ou=user,dc=cpp,dc=edu FALSE ldapsearch confirms that attribute exists for that group in both locations: ldapsearch -x -H ldaps://ldap-01.ldap.cpp.edu/ member=uid=henson,ou=user,dc=cpp,dc=edu dn | grep unxadmin # unxadmin, group, cpp.edu dn: uid=unxadmin,ou=group,dc=cpp,dc=edu # ldapsearch -x -H ldaps://ldap-03.ldap.cpp.edu/ member=uid=henson,ou=user,dc=cpp,dc=edu dn | grep unxadmin # unxadmin, group, cpp.edu dn: uid=unxadmin,ou=group,dc=cpp,dc=edu Help :)? Thanks much…

2 4

DirSync support in OpenLDAP
by shekhar.shrinivasan＠gmail.com 10 Nov '21

10 Nov '21

Hi Team, We have a OpenLDAP Proxy in front of Active Directory servers and all client applications perform ldap operations via the Proxy. One of the applications seems to be not working as expected and when we checked the logs we see this error SEARCH RESULT tag=101 err=12 nentries=0 text=critical extension is not recognized After discussing with the app owner we understand that we need to enable support for dirsync. Can you please let us know if OpenLDAP supports DirSync and what exactly needs to be done on the OpenLDAP proxy. Thanks you for your help !

3 3

RE: [EXT]:Re: OpenLDAP SSLV3 disable
by Quanah Gibson-Mount 09 Nov '21

09 Nov '21

--On Tuesday, November 9, 2021 5:41 AM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > Is this possible to give slapd.conf reference file . > I did updated config section and restart the slapd but that did not > helped. This would be an extremely basic slapd.conf file: include /usr/local/etc/openldap/schema/core.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args loglevel stats TLSCACertificateFile /path/to/ca/cert TLSCertificateFile /path/to/server/cert TLSCertificateKeyFile /path/to/server/private/key TLSProtocolMin 3.3 modulepath /usr/local/lib/openldap moduleload back_mdb.la database config rootpw secret database mdb maxsize 1073741824 suffix "dc=my-domain,dc=com" rootdn "cn=Manager,dc=my-domain,dc=com" rootpw secret directory /usr/local/var/openldap-data index objectClass eq database monitor If you are still unable to set the minimum protocol, I would advise confirming what TLS library your slapd build is linked to. For example, the TLSProtocolMin parameter has no effect when slapd is linked to GnuTLS. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

TLS handshake callback
by Jérémie HUNEL 09 Nov '21

09 Nov '21

Hi, I would like to use a custom TLS handshake callback to verify the server's certificate, however it seems that there is not this option yet in openldap. I saw the LDAP_OPT_CONNECT_CB option but this is not exactly what I'm looking for. Is there a way to specify a custom callback? If not, is it a feature that you plan to develop? Regards, Jeremie Internal

1 0

OpenLDAP 2.6 Build Failure - undefined reference
by Simon Pichugin 03 Nov '21

03 Nov '21

Hi, I'm trying to build OpenLDAP 2.6 on Fedora Rawhide and I'm getting the error message: /usr/bin/ld: ./.libs/libldap.so: undefined reference to `ber_sockbuf_io_udp' I've checked commits from https://bugs.openldap.org/show_bug.cgi?id=9673 and found that 'ber_sockbuf_io_udp' was not added to https://git.openldap.org/openldap/openldap/-/blob/master/libraries/liblber/… Is it intentional? If I add 'ber_sockbuf_io_udp' there, my build passes the stage successfully. If 'ber_sockbuf_io_udp' absence is intentional, should I somehow account for it during './configure'? Thank you! Regards, Simon

2 1

RE: [EXT]:Re: OpenLDAP SSLV3 disable
by Quanah Gibson-Mount 03 Nov '21

03 Nov '21

--On Wednesday, November 3, 2021 11:13 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > Yes it just adding few CN entries to DB for active directory sync up. Not > sure where is the issue then in disabling SSLv3. Do you think is 2.4.54 > might not support TLSprotocolMin? I think it supports. > > I did run slapd in debug mode while starting not seeing any issue TLS > version. > > @(#) $OpenLDAP: slapd 2.4.54 (Oct 27 2020 18:47:58) I testing with 2.4.59 on RHEL7 linked to the RHEL7 OpenSSL libraries and could not reproduce the issue. There are no fixes between 2.4.54 and 2.4.59 related to OpenSSL or TLS. I would note that your TLS configuration directives are inside the database backend definition which is invalid. They are global options and should appear before any database xxxx configuration section. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

RE: [EXT]:Re: OpenLDAP SSLV3 disable
by Quanah Gibson-Mount 03 Nov '21

03 Nov '21

--On Wednesday, November 3, 2021 10:51 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > We do have slapd.conf and as part of config we add a few entries to DB > using LDIF file which has OU/CN/Object class information. > > Do we need to update any config over there or do I need to update > anywhere w.r.t CN=config in slapd.conf ? > > /opt/dirsvcs/sbin/slapadd -f /opt/dirsvcs/etc/openldap/slapd.conf -l > /opt/dirsvcs/etc/openldap/base.ldif That means you're telling slapadd to use that slapd.conf file, it says nothing about what slapd itself is using at startup. > Do we have a tarball option for the 2.6 version? I can look to upgrade it. The OpenLDAP website has a tarball of the source available for download. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

OpenLDAP SSLV3 disable
by Ballem, Narayanan 03 Nov '21

03 Nov '21

HI Team, Hope you can help with this issue. I am trying to disable SSLV3 on OpenLDAP servers we are using OpenLDAP as a proxy with upstream Active directory servers. we are using CA certs on this openssl we would like to disable SSLV3. Based on earlier update from OpenLdap Technical support team, I added "TLSProtocolMin 3.2" and able to restart slapd service as well without any issue. However when we tried to test SSLV3 connectivity it's still showing SSLv3 enabled . This OpenLDAP server built on RHEL server with locally compiled and openssl rpm/binaries are part of base RHEL OS image. cat /opt/dirsvcs/etc/openldap/slapd.conf|grep -i TLSProtocolMin TLSProtocolMin 3.2 openssl s_client -connect localhost:1636 -ssl3 -quiet depth=3 CN = XXX Root Certificate Authority verify return:1 SSLV3 is insecure as you know we are looking to disable this asap . Any help in addressing this much appreciated. Thanks Narayanan Linux Platform Engineering 500 Staples Drive, Framingham MA Office: 508-253-6909 | Mobile: 508-333-4395 [signature_1767107679]

3 6

memberof vs groupMembership
by Keith LeValley 01 Nov '21

01 Nov '21

Good afternoon, I am working to migrate my LDAP setup to openldap, however I have run into a problem around group membership. Specifically my old instance of ldap used the attribute "groupMembership" and I need to support this moving forward, so if you were to query the attribute "groupMembership" it needs to return the groups the user is part of. Currently in my test environment I have the memberof overlay working, and I found the option *memberof-memberof-ad* which should allow me to create a custom attribute named "groupMembership" and point the overlay at that attribute. I am really hoping to avoid this though and would much rather have a cleaner solution. Maybe some type of interface that just acts as a pointer to the memberof attribute when they query groupMembership? But I am not familiar enough with openldap to know whether this is even possible. So I guess my question is; is the custom attribute going to be the solution here or is there another tool that I am unaware of? -- Keith LeValley Identity Services Architect, Davenport University phone: (616) 732-1102 klevalley2(a)davenport.edu

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical November 2021