openldap-technical August 2023

openldap-technical@openldap.org

20 participants
29 discussions

Help writing a slapd plugin
by John Scott 07 Aug '23

07 Aug '23

Hi, Inspired by the proprietary server at ldap.dnssek.info, I'd like to make a slapd plugin that, when queried for a particular email address, finds the OpenPGP keys and S/MIME certificates by doing DNS lookups (possibly aided by DANE), and then serves them back to the requestor. Currently the documentation in the OpenLDAP Administrator's Guide still needs to be written. Since not a lot of software supports DANE right now, but a lot of programs *do* support LDAP, I think a bridge between the two is something that could really benefit the Internet community. Could someone steer me in the right direction on how to get started? Thanks

3 2

Idea for security module: Using dnX509peerNormalize() to validate client certificates
by Sean Gallagher 06 Aug '23

06 Aug '23

Hi OpenLDAP team, I am investigating writing a module to perform certificate validation as has been discussed in previous posts (See the "Proposal to strengthen slapd EXTERNAL authentication" thread on the openldap-technical(a)openldap.org list). The idea is to inspect the subject name on the client certificate as soon as possible after TLS is established and close the connection if it does not match some predefined pattern. This would allow client certificates signed by public CAs to be used safely with slapd. Looking through the code, I see that dnX509peerNormalize() is called almost immediately after the TLS is established and that it may be handled by a callable handler installed by the register_certificate_map_function() entry point. This would be an ideal place to inspect the certificate. The only problem being it that there is no way to "reject" a certificate and force the connection to be closed. It may be possible to use the ssl context passed into the dnX509peerNormalize() function to close the connection but this would not be very clean and likely have undesirable side effects. What would be good is if dnX509peerNormalize() could return a particular error code to signal that the connection should be immediately closed. I see that LDAP_INVALID_CREDENTIALS is already used to signal benign invalid credentials. Maybe a new error code is required. something like "LDAP_HOSTILE_CREDENTIALS". connection.c: connection_read() could then detect this and close the connection in an orderly fashion by calling connection_closing( c, "TLS Client certificate rejected" ); connection_close( c ); This would seem to be a generally useful thing to have in the slapd core. Is this something the OpenLDAP project would consider doing? Sean. -- This email has been checked for viruses by AVG antivirus software. www.avg.com

2 5

ACL with filter memberOf
by Carsten Jäckel 06 Aug '23

06 Aug '23

Dear experts, an accessUser account used for application access has to be granted read access to member accounts of a group (groupOfNames). The list of attributes to be read by the accessUser is limited. The accessUser has to search in the limited attribute list (e. g. uid=abcd). Using OpenLDAP 2.4.49 (with configured overlay 'memberOf') we achieved this goal by configuring the following ACLs in olcAcces of olcDatabase={1}mdb,cn=config: {0}to * by self read by anonymous auth by * break {1}to dn.subtree="dc=example,dc=com" filter="(|(dc=example)(dc=users))" attrs="entry,Objectclass,dc" by dn.exact="cn=accessUser,dc=accessUsers,dc=example,dc=com" read by * break {2}to dn.subtree="dc=users,dc=example,dc=com" filter="(memberOf=cn=group1,dc=groups,dc=example,dc=com)" attrs="entry,objectclass,uid,cn,displayName,telephoneNumber,ou,mail,memberOf,entryDN" by dn.exact="cn=accessUser,dc=accessUsers,dc=example,dc=com" read by * break During migration to OpenLDAP 2.5 we eliminated the overlay 'memberOf' and replaced it's functionality by the overlay 'dynlist'. As a consequence we experienced that the filter statement in ACL {2} doesn't work any longer in OpenLDAP 2.5. Result of ldapsearch -x -W -D "cn=accessUser,dc=accessUsers,dc=example,dc=com" -b "dc=users,dc=example,dc=com" -s sub "(memberOf=cn=group1,dc=groups,dc=example,dc=com)" "entry objectclass uid cn displayName telephoneNumber ou mail memberOf entryDN" doesn't return any results alhough the group object contains members. We suppose that it has something to to with memberOf becoming some kind of 'virtual' attribute which may be only calculated when explicitly asked for. (Please correct this assumtion if it's incorrect.) These are the relevant parts of our configuration in OpenLDAP 2.5: Frontend: dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig olcDatabase: {-1}frontend olcAccess: {0}to dn.base="" by * read olcAccess: {1}to dn.base="cn=subschema" by * read mdb: dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/symas/openldap-data olcAccess: {0}to * by self read by anonymous auth by * break olcAccess: {1}to dn.subtree="dc=example,dc=com" filter="(|(dc=example)(dc=us ers))" attrs="entry,Objectclass,dc" by dn.exact="cn=accessUser,dc=accessUse rs,dc=example,dc=com" read by * break olcAccess: {3}to dn.subtree="dc=users,dc=example,dc=com" filter="(|(dc=examp le)(dc=users))" attrs="entry,Objectclass,dc" by dn.exact="cn=accessUser,dc= accessUsers,dc=example,dc=com" read by * break" olcDbIndex: cn olcDbIndex: default eq,sub olcDbIndex: departmentNumber pres,eq,sub olcDbIndex: displayName olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcDbIndex: gidNumber eq olcDbIndex: givenName olcDbIndex: host eq olcDbIndex: inetUserStatus olcDbIndex: mail eq olcDbIndex: mailLocalAddress eq olcDbIndex: member eq olcDbIndex: memberOf eq olcDbIndex: memberUid eq olcDbIndex: objectclass eq olcDbIndex: sn olcDbIndex: sudoHost eq,sub olcDbIndex: sudoUser eq,sub olcDbIndex: uid olcDbIndex: uidNumber eq olcDbIndex: uniqueMember eq olcDbMaxReaders: 126 olcDbMaxSize: 10000000000 olcReadOnly: FALSE olcRootDN: cn=manager,dc=example,dc=com olcRootPW:: <abcd1234> olcSuffix: dc=example,dc=com dn: olcOverlay={0}refint,olcDatabase={1}mdb,cn=config objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcRefintConfig objectClass: top olcOverlay: {0}refint olcRefintAttribute: member olcRefintNothing: cn=someone,dc=example,dc=com dn: olcOverlay={1}ppolicy,olcDatabase={1}mdb,cn=config objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcPPolicyConfig objectClass: top olcOverlay: {1}ppolicy olcPPolicyDefault: cn=passwordDefault,ou=password_policies,ou=configurations ,dc=example,dc=com olcPPolicyHashCleartext: TRUE dn: olcOverlay={2}dynlist,olcDatabase={1}mdb,cn=config objectClass: olcConfig objectClass: olcDynListConfig objectClass: olcOverlayConfig objectClass: top olcOverlay: {2}dynlist olcDynListAttrSet: {0}groupOfURLs memberURL member+memberOf@groupOfNames dn: olcOverlay={3}syncprov,olcDatabase={1}mdb,cn=config objectClass: olcSyncProvConfig olcOverlay: {3}syncprov olcSpCheckpoint: 10 1 olcSpSessionlog: 20000 dn: olcOverlay={4}dds,olcDatabase={1}mdb,cn=config objectClass: olcDDSConfig objectClass: olcOverlayConfig olcOverlay: {4}dds olcDDSinterval: 1h olcDDSmaxTtl: 10d olcDDSminTtl: 10s olcDDSstate: TRUE olcDDStolerance: 5s dn: olcOverlay={5}otp,olcDatabase={1}mdb,cn=config objectClass: olcConfig objectClass: olcOverlayConfig objectClass: top olcOverlay: {5}otp My question now is: what is the correct ACL configuration/filter statement to ask for a user's group memberships to achieve our goal in OpenLDAP 2.5? Any help would be greatly appreciated! --Carsten

2 1

rhel8 OS rpm spec file
by Kaushal Shriyan 05 Aug '23

05 Aug '23

Hi, Is there a way to generate openldap-servers.x86_64 rpm spec file from https://www.openldap.org/software/download/OpenLDAP/openldap-release/openld… # ll total 900 -rw-r--r-- 1 1001 1001 11109 Jul 10 21:59 aclocal.m4 -rw-r--r-- 1 1001 1001 6100 Jul 10 21:59 ANNOUNCEMENT drwxr-xr-x 2 1001 1001 4096 Jul 10 21:59 build -rw-r--r-- 1 1001 1001 14120 Jul 10 21:59 CHANGES drwxr-xr-x 3 1001 1001 38 Jul 10 21:59 clients -rwxr-xr-x 1 1001 1001 753489 Jul 10 21:59 configure -rw-r--r-- 1 1001 1001 99724 Jul 10 21:59 configure.ac drwxr-xr-x 7 1001 1001 129 Jul 10 21:59 contrib -rw-r--r-- 1 1001 1001 2345 Jul 10 21:59 COPYRIGHT drwxr-xr-x 8 1001 1001 102 Jul 10 21:59 doc drwxr-xr-x 3 1001 1001 4096 Jul 10 21:59 include -rw-r--r-- 1 1001 1001 3793 Jul 10 21:59 INSTALL drwxr-xr-x 8 1001 1001 123 Jul 10 21:59 libraries -rw-r--r-- 1 1001 1001 2214 Jul 10 21:59 LICENSE -rw-r--r-- 1 1001 1001 1029 Jul 10 21:59 Makefile.in -rw-r--r-- 1 1001 1001 3594 Jul 10 21:59 README drwxr-xr-x 4 1001 1001 52 Jul 10 21:59 servers drwxr-xr-x 5 1001 1001 93 Jul 10 21:59 tests # ./configure --help | grep spec To assign environment variables (e.g., CC, CFLAGS...), specify them as Defaults for the options are specified in brackets. --help=short display options specific to this package `/usr/local/bin', `/usr/local/lib' etc. You can specify --with-odbc with specific ODBC support compiler's sysroot if not specified). # Please guide me. Thanks in Advance. Best Regards, Kaushal

2 1

requested some clean up / verification of my acls (paid)
by Marc 04 Aug '23

04 Aug '23

I have ~11 acl's that could use more attention, limiting access to what is required (to mta, system, cron). They are working, but I would to have an expert look at them. I think someone with experience could tune some things better. Anyone interested?

2 2

excluding attribute in acl
by Marc 03 Aug '23

03 Aug '23

Is it possible to specify something like allow access to all attributes - userPassword?

2 1

restricting acls more by adding a filter
by Marc 03 Aug '23

03 Aug '23

I have a ldapsearch that returns this object sendmailMTAClassName: w sendmailMTAClassValue: xxx sendmailMTAClassValue: yyy sendmailMTAClassValue: zzz objectClass: sendmailMTA objectClass: sendmailMTAClass I thought I could strengthen the acl by just appending to with a filter but if I add these below, the ldapsearch does not return anything err=32 filter=(objectClass=sendmailMTAClass) filter=(|(objectClass=sendmailMTAClass)(objectClass=sendmailMTA)) filter=(|(objectClass=sendmailMTAClass)(objectClass=sendmailMTA)) filter=(objectClass=sendmailMTA*) If I change the filter to this, I get the expected result again filter=(objectClass=*) Goal is to have ldapsearch only list the specific objectClasses. Or should I do this with listing only attributes.

3 6

Feature Request: slapd: expose SASL EXTERNAL identity to olcAccess rules
by Sean Gallagher 01 Aug '23

01 Aug '23

Hi All, This is loosely related to issue 10065 https://bugs.openldap.org/show_bug.cgi?id=10065, but can be read independently. I have devised a work-around to slapd's inability to check client names on Client certificates and am in the process of removing a proxy (haproxy) I had in front of my slapd server. I have however come across an annoying compromise and I'm offering here a suggestion on how to remove it. In particular, with the proxy, I could write rules targeting particular clients that worked, even before their initial "bind" operation by using the "sockname=" pattern in the access control rules. This does not seem possible when slapd talks directly to the clients. before the initial "bind" operation, only the IP address is available to tell clients apart, which are not very reliable. IP addresses are easily spoofed. It would be much better to use the client certificate to match against the particular client. Currently the client ID on the certificate is passed to the SASL layer with the sasl_setprop(...,SASL_AUTH_EXTERNAL,...) call. There it remains until the client performs a "bind" using the SASL EXTERNAL mechanism. At this point, the EXTERNAL client ID is used to derive a distinguished name by filtering it through the "olcAuthzRegexp". It should be noted that LDAP v3 does not require the client to perform such a bind operation. My Proposal is to expose the EXTERNAL identity to the ACL rules in a similar way to how the "real" prefix exposes the authentication identity - by creating an "external" prefix. As such, the matching rules externalanonymous externalusers externalself externaldn externaldnattr Could be used to restrict access to clients, even before or without a bind operation. To maintain naming consistency, The name passed to SASL could have the "olcAuthzRegexp" mapping applied before the ACL rule is applied. In this case, the "external" identity would be the same as the unprefixed identity, after a bind using SASL EXTERNAL mechanism had occured. This arrangement would have several advantages including: *) only exposing the userPassword to the particular client that needs it. *) enforcing client/IP address associations in a rigorous manner. *) general ACL rules for operations that do not need a "bind" operation. *) restricting SIMPLE binds to particular clients. Any Thoughts ? -- This email has been checked for viruses by AVG antivirus software. www.avg.com

6 27

updating from el7 to alpine openldap 2.6
by Marc 01 Aug '23

01 Aug '23

I am updating my ldap container and migrate from el7 to alpine. While running some test queries I noticed that the new 2.6 alpine has probably different defaults, I am getting "Size limit exceeded (4)". However this does not show in the ldap error log. What would be good loglevel config to see quickly if there is an issue with client queries? I am a little worried that if MTA's are getting incomplete results and dropping mail.

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical August 2023