openldap-technical February 2025

openldap-technical@openldap.org

28 participants
31 discussions

EAP-TLS extend logged lines
by Alexey D. Filimonov 19 Feb '25

19 Feb '25

Hello. Currently I have EAP-TLS auth. On successfull auth, it logs Wed Feb 19 15:23:13 2025 : Auth: (9) Login OK: [anonymous-xxx] (from client name_of_client1 port 8 cli ee:ee:ee:ed:ae:ee) I'd like to extend or replace this line with UPN from certiificate and other attributes. Where should I start from ?

2 2

Attribute value as glue
by mbalakri＠opentext.com 18 Feb '25

18 Feb '25

We have multimaster replication in place, and sync replication is working. However, we have noticed some glue values for certain entries. What could be the reason for these glue entries, and how can we avoid them? This is a sample entry wit glue values for objectClass and structuralObjectClass attribtues. Please suggest how to avoid these glue values. dn: cn=organizational users,o=test,cn=test,cn=acd,o=in.bbn.ac entryUUID: 2acd5574-47fb-4414-b930-65d3fefc40cb creatorsName: cn=Directory Manager,o=in.bbn.ac createTimestamp: 20240730130003Z entryCSN: 20240730130003.412795Z#000000#001#000000 modifiersName: cn=Directory Manager,o=in.bbn.ac modifyTimestamp: 20240730130003Z objectClass: top objectClass: glue structuralObjectClass: glue

4 11

External LDAP authentication depending on user attributes?
by alexey＠filimonic.net 17 Feb '25

17 Feb '25

I have two LDAP servers (ActiveDirectory) with users: On AD horns-and-hooves.org: cn=Jane Smith,ou=users,dc=horns-and-hooves,dc=org cn: jane.smith(a)contoso.com On AD bells-and-whistles.com: cn=John Snow,ou=users,ou=europe,dc=bells-and-whistles,dc=com mail: john.snow(a)contoso.com And for mail system, I need to grab some of those users to single OpenLDAP database (dc=internal), add some mail system-specific attributes (that dont exist in source ADs) and add passthrough authentication for them to the AD server where they belong. Like this: cn=jane.smith,ou=horns-and-hooves,dc=internal mailQuota: 10 imapHost: imap1 mail: jane.smith(a)contoso.com sourceOrg: horns-and-hooves cn=john.snow,ou=bells-and-whistles,dc=internal mailQuota: 20 imapHost: imap2 mail:: john.snow(a)contoso.com sourceOrg: bells-and-whistles I expect algorithm like this: First, I manually create users in OpenLDAP directory without passwords with correct attributes. When Jane makes simple_bind to OpenLDAP server, the server determines if user is related to horns-and-hooves organization or to bells-and-whistles. If "horns-and-hooves" then server makes a search against ldap://horns-and-hooves.org:389/dc=horns-and-hooves,dc=org for '(mail=$1)' where $1 is value of mail from `mail` attribute. it finds one item, OpenLDAP tries to make bind to ldap://horns-and-hooves.org:389 with DN of item found and password provided by Jane to OpenLDAP. If "bells-and-whistles" then backend server is ldap://bells-and-whistles.com:389/dc=bells-and-whistles,dc=com , other is same. How server determines if user is a hosn-an-hooves user or bells-and-whistles user - based on some attriburte value (sourceOrg) or based on DN value (ou=horns-and-hooves,dc=internal vs ou=bells-and-whistles,dc=internal) - IDK if any of this is possible. Does this algorithm implementation requires SALSd, or it can be done with OpenLDAP-only? Could you please help me getting this configuration done?

3 2

Few questions about replica (mirror mode?)
by alexey＠filimonic.net 17 Feb '25

17 Feb '25

I plan few OpenLDAP servers: N readonly secondaries and single writable main. In my case OpenLDAP is critical as readonly database, and changes are allowed to fail. But I need all readonly replicas contain the same data same time, and I have possibilities to temporarily disconnect readonly secondaries from master. Is there a some kind of operational\replication mode when: - Transactional changes over all servers: Writable main fails writing to database and propagating them to secondaries in case any of secondaries can not receive same changes - Secondary server may start "empty" and self-register as secondary server on writeable main, then get in sync. Until sync complete, secondary server will not satisfy any requests from clients.

3 2

lload backend-server connection issues
by Ben Poliakoff 17 Feb '25

17 Feb '25

I've successfully set up haproxy with current openldap slapd backend instances, the ldap client IP is passed on to my slapd instances, and things like IP based ACLs work. But now I'm exploring and comparing the features of the OpenLDAP lloadd backend. I've been using the embedded version, loading lloadd.a into slapd and I've been using the example configs from https://www.openldap.org/doc/admin26/loadbalancer.html as a starting point. I'm consistently seeing these errors on the backend slapd: Feb 4 10:45:33 test local4.debug slapd[508415]: proxyp(19): invalid header signature Feb 4 10:45:33 test local4.debug slapd[508415]: slapd(19): proxyp failed And on the frontend slapd (running lload) I'm seeing these sorts of errors: Feb 4 10:48:12 slapd-lb-a local4.debug slapd[271207]: operation_init: received a new operation, bind request with msgid=1 for client connid=6 Feb 4 10:48:12 slapd-lb-a local4.debug slapd[271207]: request_bind: connid=6, msgid=1 no available connection found When I compare the traffic between slapd w/lload and the backend slapd with traffic between haproxy and the same backend slapd, the main thing that I notice is that the slapd w/lload is doing a TLSv1 client hello whereas haproxy is doing a TLSv1.3 client hello. Is it possible that the lloadd code doesn't support TLSv1.3? I'd be surprised if that were the case, since the same slapd happily supports client connections with TLSv1.3, but I can't figure out why it's only trying TLSv1. I'm running openldap 2.6.9 packages from Symas on Debian 12, for what it's worth. While I've been working on this I've been using the slapd.conf style config, but would transition to cn=config if it were to go to production. I've tried configuring the backend server URI with ldap://, ldaps://, pldap://, and pldaps://, all with the same results. My current config follows. Thanks for any suggestions! Ben ------- current config ----------------------------------------------- TLSCertificateFile /etc/haproxy/haproxy.pem TLSCertificateKeyFile /etc/haproxy/haproxy.pem TLSCACertificatePath /etc/ssl/certs loglevel stats #loglevel -1 pidfile /var/symas/run/openldap-lload.pid allow bind_v2 include /opt/symas/etc/openldap/schema/core.schema modulepath /opt/symas/lib/openldap # require at least SSL/TLS for simple binds security simple_bind=1 moduleload lloadd.la backend lload # The Load Balancer manages its own sockets, so they have to be separate # from the ones slapd manages (as specified with the -h "URLS" option at # startup). listen ldaps://:10636 # Enable authorization tracking feature proxyauthz # Specify the number of threads to use for the connection manager. The default is 1 and this is typically adequate for up to 16 CPU cores. # The value should be set to a power of 2: io-threads 2 TLSShareSlapdCTX true # Authentication and other options (timeouts) shared between backends. bindconf bindmethod=simple tls_cacertdir="/etc/ssl/certs" binddn=uid=ldap-lb,ou=Services,dc=example,dc=com credentials=xxxxxxxxxxxxxxxxxxxxxxxxxxx network-timeout=5 tier bestof backend-server uri=pldaps://backend-slapd-hostname:8636 retry=5000 max-pending-ops=50 conn-max-pending=10 numconns=10 bindconns=5 ####################################################################### database monitor

2 1

Make OpenLDAP proxy only simple_bind requests to other LDAPs
by Alexey D. Filimonov 11 Feb '25

11 Feb '25

My goal is to [manually] maintain a database of users using OpenLDAP directory, with some set of attributes and values. All of those users have their second accounts in different external LDAP directories (2 directories). For those users, I want OpenLDAP server to passthrough simple_bind authentication to one of those directories. When I manually create a user in OpenLDAP directory, I want specify a `backend keys` in some attributes, that will tell OpenLDAP server how to process user's simple_bind authentication. For example, I can specify some sort of attributes like `backendRealm = ActiveDirectory1` and `mail = jack(a)contoso.com` to tell OpenLDAP to lookup object DN on servers from group `ActiveDirectory1` with `mail=jack(a)contoso.com` filter and try to simple_bind against one server from group `ActiveDirectory1` using DN it fount and password user provided originally. DNs of all users are not even partially equal between directories. Suffixes are different too. All OpenLDAP users and attributes are maintained manually, without proxying (except authentication). Please help me if I can do this somehow using OpenLDAP? Can I do this without using SASLD? Alex.

2 4

container image building and syncing
by Marc 11 Feb '25

11 Feb '25

I use echo "127.0.0.2 ldap.example.com" >> /etc/hosts to prevent the running ldap server from syncing during image building. However when using DOCKER_BUILDKIT=1 this is not possible any more (read only fs). I was wondering if it is possible to start slapd so it does not start syncing?

3 5

OpenLDAP Self Registration/Password Reset Portal
by killian.greig＠gmail.com 11 Feb '25

11 Feb '25

I have been working on an OpenLDAP Self Registration/Password Reset Portal in Go that I will be releasing under a BSD license. Its still very much embryonic but if you are interested in taking an early look, please let me know. I'd love to get feedback on it. Kind regards, Killian

8 14

ldap acl matching
by Marc 09 Feb '25

09 Feb '25

olcAccess: {9} to dn.subtree="...... by ssf=256 set="([ldap:///o=XXXX,ou=aaaa,dc=bbbbb,dc=cccc,dc=ddddd??sub?(cn=eeee)])/member & user" search by ssf=256 set="([ldap:///o=YYYY,ou=aaaa,dc=bbbbb,dc=cccc,dc=ddddd??sub?(cn=eeee)])/member & user" search by ssf=256 set="([ldap:///o=ZZZZ,ou=aaaa,dc=bbbbb,dc=cccc,dc=ddddd??sub?(cn=eeee)])/member & user" search Currenlty I have the above rules which seem to work. But for every entry in ou=aaaa I need to manually add an acl line. How can I rewrite this to 1 line that matches XXX, YYYY, ZZZZ and anything else I add in ou=aaaa?

1 0

Re: OpenLDAP 2.6 Long Term Support Announcement
by Geert Hendrickx 06 Feb '25

06 Feb '25

Hi What is now the status of OpenLDAP 2.5 / 2.6 / 2.7 ? The website still lists 2.5.x as the current LTS release, and 2.6.x as the Feature Release. Has the below plan been delayed, or is the website just not up to date? Thanks for any clarification Geert On Sat, Aug 10, 2024 at 15:24:56 +0000, project(a)openldap.org wrote: > The OpenLDAP Project is pleased to announce the promotion of OpenLDAP > 2.6 from Feature Release to Long Term Support (LTS) Release, effective > January, 2025. It is now the recommended OpenLDAP version for > deployments that prioritize stability over features. The projected > lifespan for OpenLDAP 2.6 as the LTS release is five years. > > OpenLDAP 2.5 is now in its end of life stage and, at the discretion of > the Project, will receive critical fixes until January 15, 2027. After > that it will be designated as a historical release and no longer > supported or maintained by the Project. Users are encouraged to develop > a plan that will help them upgrade quickly to the new LTS version so > that they can continue on a supported release. > > OpenLDAP 2.7 is the new Feature Release and will see its first public > availability in the fall of 2024. > > ------------- > Compatibility > ------------- > > Replication: > Replication compatibility between OpenLDAP 2.5 and 2.6 is excellent. > The Project expects this to remain the case throughout the remaining > end-of-life stage of OpenLDAP 2.5. > > Configuration Files: > Configuration file compatibility between OpenLDAP 2.5 and 2.6 is > excellent, but may require some manual intervention at upgrade time, > particularly if you are using the OpenLDAP Load Balancer daemon. > > > ---------------------- > Additional Information > ---------------------- > > * The OpenLDAP Release Maintenance Policy can be found at > https://lists.openldap.org/hyperkitty/list/openldap-announce@openldap.org/t… > > * Notes covering upgrading from OpenLDAP 2.5 to 2.6 can be found at > https://www.openldap.org/doc/admin26/appendix-upgrading.html >

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical February 2025