openldap-technical February 2025

openldap-technical@openldap.org

28 participants
27 discussions

lload backend-server connection issues
by Ben Poliakoff 17 Feb '25

17 Feb '25

I've successfully set up haproxy with current openldap slapd backend instances, the ldap client IP is passed on to my slapd instances, and things like IP based ACLs work. But now I'm exploring and comparing the features of the OpenLDAP lloadd backend. I've been using the embedded version, loading lloadd.a into slapd and I've been using the example configs from https://www.openldap.org/doc/admin26/loadbalancer.html as a starting point. I'm consistently seeing these errors on the backend slapd: Feb 4 10:45:33 test local4.debug slapd[508415]: proxyp(19): invalid header signature Feb 4 10:45:33 test local4.debug slapd[508415]: slapd(19): proxyp failed And on the frontend slapd (running lload) I'm seeing these sorts of errors: Feb 4 10:48:12 slapd-lb-a local4.debug slapd[271207]: operation_init: received a new operation, bind request with msgid=1 for client connid=6 Feb 4 10:48:12 slapd-lb-a local4.debug slapd[271207]: request_bind: connid=6, msgid=1 no available connection found When I compare the traffic between slapd w/lload and the backend slapd with traffic between haproxy and the same backend slapd, the main thing that I notice is that the slapd w/lload is doing a TLSv1 client hello whereas haproxy is doing a TLSv1.3 client hello. Is it possible that the lloadd code doesn't support TLSv1.3? I'd be surprised if that were the case, since the same slapd happily supports client connections with TLSv1.3, but I can't figure out why it's only trying TLSv1. I'm running openldap 2.6.9 packages from Symas on Debian 12, for what it's worth. While I've been working on this I've been using the slapd.conf style config, but would transition to cn=config if it were to go to production. I've tried configuring the backend server URI with ldap://, ldaps://, pldap://, and pldaps://, all with the same results. My current config follows. Thanks for any suggestions! Ben ------- current config ----------------------------------------------- TLSCertificateFile /etc/haproxy/haproxy.pem TLSCertificateKeyFile /etc/haproxy/haproxy.pem TLSCACertificatePath /etc/ssl/certs loglevel stats #loglevel -1 pidfile /var/symas/run/openldap-lload.pid allow bind_v2 include /opt/symas/etc/openldap/schema/core.schema modulepath /opt/symas/lib/openldap # require at least SSL/TLS for simple binds security simple_bind=1 moduleload lloadd.la backend lload # The Load Balancer manages its own sockets, so they have to be separate # from the ones slapd manages (as specified with the -h "URLS" option at # startup). listen ldaps://:10636 # Enable authorization tracking feature proxyauthz # Specify the number of threads to use for the connection manager. The default is 1 and this is typically adequate for up to 16 CPU cores. # The value should be set to a power of 2: io-threads 2 TLSShareSlapdCTX true # Authentication and other options (timeouts) shared between backends. bindconf bindmethod=simple tls_cacertdir="/etc/ssl/certs" binddn=uid=ldap-lb,ou=Services,dc=example,dc=com credentials=xxxxxxxxxxxxxxxxxxxxxxxxxxx network-timeout=5 tier bestof backend-server uri=pldaps://backend-slapd-hostname:8636 retry=5000 max-pending-ops=50 conn-max-pending=10 numconns=10 bindconns=5 ####################################################################### database monitor

2 1

Make OpenLDAP proxy only simple_bind requests to other LDAPs
by Alexey D. Filimonov 12 Feb '25

12 Feb '25

My goal is to [manually] maintain a database of users using OpenLDAP directory, with some set of attributes and values. All of those users have their second accounts in different external LDAP directories (2 directories). For those users, I want OpenLDAP server to passthrough simple_bind authentication to one of those directories. When I manually create a user in OpenLDAP directory, I want specify a `backend keys` in some attributes, that will tell OpenLDAP server how to process user's simple_bind authentication. For example, I can specify some sort of attributes like `backendRealm = ActiveDirectory1` and `mail = jack(a)contoso.com` to tell OpenLDAP to lookup object DN on servers from group `ActiveDirectory1` with `mail=jack(a)contoso.com` filter and try to simple_bind against one server from group `ActiveDirectory1` using DN it fount and password user provided originally. DNs of all users are not even partially equal between directories. Suffixes are different too. All OpenLDAP users and attributes are maintained manually, without proxying (except authentication). Please help me if I can do this somehow using OpenLDAP? Can I do this without using SASLD? Alex.

2 4

container image building and syncing
by Marc 11 Feb '25

11 Feb '25

I use echo "127.0.0.2 ldap.example.com" >> /etc/hosts to prevent the running ldap server from syncing during image building. However when using DOCKER_BUILDKIT=1 this is not possible any more (read only fs). I was wondering if it is possible to start slapd so it does not start syncing?

3 5

OpenLDAP Self Registration/Password Reset Portal
by killian.greig＠gmail.com 11 Feb '25

11 Feb '25

I have been working on an OpenLDAP Self Registration/Password Reset Portal in Go that I will be releasing under a BSD license. Its still very much embryonic but if you are interested in taking an early look, please let me know. I'd love to get feedback on it. Kind regards, Killian

8 14

ldap acl matching
by Marc 09 Feb '25

09 Feb '25

olcAccess: {9} to dn.subtree="...... by ssf=256 set="([ldap:///o=XXXX,ou=aaaa,dc=bbbbb,dc=cccc,dc=ddddd??sub?(cn=eeee)])/member & user" search by ssf=256 set="([ldap:///o=YYYY,ou=aaaa,dc=bbbbb,dc=cccc,dc=ddddd??sub?(cn=eeee)])/member & user" search by ssf=256 set="([ldap:///o=ZZZZ,ou=aaaa,dc=bbbbb,dc=cccc,dc=ddddd??sub?(cn=eeee)])/member & user" search Currenlty I have the above rules which seem to work. But for every entry in ou=aaaa I need to manually add an acl line. How can I rewrite this to 1 line that matches XXX, YYYY, ZZZZ and anything else I add in ou=aaaa?

1 0

Re: OpenLDAP 2.6 Long Term Support Announcement
by Geert Hendrickx 07 Feb '25

07 Feb '25

Hi What is now the status of OpenLDAP 2.5 / 2.6 / 2.7 ? The website still lists 2.5.x as the current LTS release, and 2.6.x as the Feature Release. Has the below plan been delayed, or is the website just not up to date? Thanks for any clarification Geert On Sat, Aug 10, 2024 at 15:24:56 +0000, project(a)openldap.org wrote: > The OpenLDAP Project is pleased to announce the promotion of OpenLDAP > 2.6 from Feature Release to Long Term Support (LTS) Release, effective > January, 2025. It is now the recommended OpenLDAP version for > deployments that prioritize stability over features. The projected > lifespan for OpenLDAP 2.6 as the LTS release is five years. > > OpenLDAP 2.5 is now in its end of life stage and, at the discretion of > the Project, will receive critical fixes until January 15, 2027. After > that it will be designated as a historical release and no longer > supported or maintained by the Project. Users are encouraged to develop > a plan that will help them upgrade quickly to the new LTS version so > that they can continue on a supported release. > > OpenLDAP 2.7 is the new Feature Release and will see its first public > availability in the fall of 2024. > > ------------- > Compatibility > ------------- > > Replication: > Replication compatibility between OpenLDAP 2.5 and 2.6 is excellent. > The Project expects this to remain the case throughout the remaining > end-of-life stage of OpenLDAP 2.5. > > Configuration Files: > Configuration file compatibility between OpenLDAP 2.5 and 2.6 is > excellent, but may require some manual intervention at upgrade time, > particularly if you are using the OpenLDAP Load Balancer daemon. > > > ---------------------- > Additional Information > ---------------------- > > * The OpenLDAP Release Maintenance Policy can be found at > https://lists.openldap.org/hyperkitty/list/openldap-announce@openldap.org/t… > > * Notes covering upgrading from OpenLDAP 2.5 to 2.6 can be found at > https://www.openldap.org/doc/admin26/appendix-upgrading.html >

2 1

ldap vs db auth
by Marc 06 Feb '25

06 Feb '25

I was actually wondering how ldap compares to mariadb or other databases for authentication. Has anyone actually tested this?

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical February 2025