- openldap-technical - openldap.org

Serious performance problems
by Mikel.Santos＠idom.com 28 Apr '08

28 Apr '08

Hi guys, First of all, I would like to thank the community for such a great piece of software and encourage the developers to keep up the good work. Until now, the setup of the ldap and the file configuration has been pretty straightforward. The ldap was performing great with few entries, but things got worse as the number of entries in the ldap increased. Currently we are experiencing serious performance problems when the searches performed exceed certain amount of entries. The "ldap_search" calls usually return after a few seconds but as the number of results matching the filter entered increases, the waiting time varies from one minute to many minutes. The scenario is the following: * We are accessing openldap via PHP function calls * The number of entries in the ldap is close to 100.000 * The hardware is the following: Intel(R) Xeon(TM) CPU 3.33GHz 1Gb RAM * The slapd.conf file is the following: /************************************************************************************************************/ modulepath /usr/lib/ldap moduleload back_bdb sizelimit -1 tool-threads 1 backend bdb checkpoint 512 30 database bdb directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 cachesize 100000 /************************************************************************************************************/ We have tried to increase both set_cachesize and cachesize (multiplying both by 100) and have not noticed a performance increase. I hope any of you can point us in the right direction since we are beginning to get desperated... Thanks in advance, Mikel

3 4

ldap_sasl_interactive_bind_s: Local error (-2)
by Rodrigo Castro 28 Apr '08

28 Apr '08

Hi, can anyone help me find what's causing this error? ldapwhoami SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Unknown code krb5 7) -- __________________________________ Rodrigo de Castro Cosme Ciência da Computação - Universidade Federal do Espírito Santo Suporte mailing list - suporte(a)inf.ufes.br MSN - rdccosmo(a)gmail.com

1 0

RE: Compiling openldap-2.4.8 on cygwin
by Gavin Henry 28 Apr '08

28 Apr '08

> Thanks for the reply. > Anyone know of a decent dummies guide to compiling mingw exes? > I've never done this before. > Thanks, > > Chris > > IIRC, it's the same as normal on *unix, that's the point: /configure --blah make depend make make test

2 1

OpenLDAP Updating Schema Definition
by Jimmy Liang 24 Apr '08

24 Apr '08

I've read that OpenLDAP supports runtime schema modifications but I can't figure out the extensiveness of this feature. On Sun's page ( http://java.sun.com/products/jndi/tutorial/ldap/schema/object.html under the header "Adding a New Object Class") it's telling me that OpenLDAP does not support this kind of modification. When I try the code on that page, I run into Exception in thread "main" javax.naming.directory.InvalidAttributeValueException: [LDAP: error code 21 - objectClasses: value #0 invalid per syntax]; remaining name '' And in the syslog I noticed this Apr 24 15:38:14 localhost slapd[6532]: daemon: read activity on 12 Apr 24 15:38:14 localhost slapd[6532]: connection_get(12) Apr 24 15:38:14 localhost slapd[6532]: connection_get(12): got connid=14 Apr 24 15:38:14 localhost slapd[6532]: connection_read(12): checking for input on id=14 Apr 24 15:38:14 localhost slapd[6540]: do_modify Apr 24 15:38:14 localhost slapd[6540]: do_modify: dn (cn=Subschema) Apr 24 15:38:14 localhost slapd[6540]: => get_ctrls Apr 24 15:38:14 localhost slapd[6540]: => get_ctrls: oid="2.16.840.1.113730.3.4.2" (noncritical) Apr 24 15:38:14 localhost slapd[6532]: ber_get_next on fd 12 failed errno=11 (Resource temporarily unavailable) Apr 24 15:38:14 localhost slapd[6540]: <= get_ctrls: n=1 rc=0 err="" Apr 24 15:38:14 localhost slapd[6540]: >>> dnPrettyNormal: <cn=Subschema> Apr 24 15:38:14 localhost slapd[6540]: <<< dnPrettyNormal: <cn=Subschema>, <cn=subschema> Apr 24 15:38:14 localhost slapd[6540]: send_ldap_result: conn=14 op=3 p=3 Apr 24 15:38:14 localhost slapd[6540]: send_ldap_result: err=21 matched="" text="objectClasses: value #0 invalid per syntax" Apr 24 15:38:14 localhost slapd[6540]: send_ldap_response: msgid=4 tag=103 err=21 Apr 24 15:38:14 localhost slapd[6540]: conn=14 op=3 RESULT tag=103 err=21 text=objectClasses: value #0 invalid per syntax Apr 24 15:38:14 localhost slapd[6532]: daemon: select: listen=6 active_threads=0 tvp=NULL Apr 24 15:38:14 localhost slapd[6532]: daemon: activity on 1 descriptor Apr 24 15:38:14 localhost slapd[6532]: daemon: activity on: Apr 24 15:38:14 localhost slapd[6532]: 13r Does OpenLDAP allow programmic (hopefully but necessarily Java) schema changes at runtime?

2 1

bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989)
by Srinidhi Sharma 24 Apr '08

24 Apr '08

Hi, I am using open ldap 2.4.8 with berkeley db 4.6.21 The installation of the open ldap went through successfully. But I have the following problem. 1. When tried accessing the dc=example,dc=com through ldapsearch it fails with no such object. ldapsearch -h my-openldap-host -p 9011 -D"cn=Manager,dc=example,dc=com" -w secret -b 'dc=example,dc=com' -s sub 'objectclass=*' ldap_search: No such object Following the error msgs from slapd ========================== => bdb_search bdb_dn2entry("dc=example,dc=com") => bdb_dn2id("dc=example,dc=com") <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) send_ldap_result: conn=2 op=1 p=3 send_ldap_response: msgid=2 tag=101 err=32 ber_flush2: 14 bytes to sd 11 0000: 30 0c 02 01 02 65 07 0a 01 20 04 00 04 00 0....e... .... ldap_write: want=14, written=14 0000: 30 0c 02 01 02 65 07 0a 01 20 04 00 04 00 0....e... .... connection_get(11): got connid=2 connection_read(11): checking for input on id=2 ber_get_next ldap_read: want=8, got=7 0000: 30 05 02 01 03 42 00 0....B. ber_get_next: tag 0x30 len 5 contents: ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=2 op=2 do_unbind connection_closing: readying conn=2 sd=11 for close connection_resched: attempting closing conn=2 sd=11 contents of slapd.conf are =================== database bdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory <myhost-dir>/openldap/install/openldap-2.4.8/var/openldap-data # Indices to maintain index objectClass eq However, when I try ldapbind to the open ldap it works fine.. ldapbind -h my-openldap-host -p 9011 -D"cn=Manager,dc=example,dc=com" -w secret And also , base search goes through fine. ldapsearch -h my-openldap-host -p 9011 -D"cn=Manager,dc=example,dc=com" -w secret -b '' -s base 'objectclass=*' How do I get around this error !!!, is there any configuration mismatch ??? The slapd is running as a normal unix user and not as a "ldap "user. Command used to run the slapd is: ./slapd -h ldap://my-openldap-host:9011 -f ../etc/openldap/slapd.conf -d3 Please help -- Thanks, Srinidhi

1 0

OpenLDAP: slave is not being updated by master and replog is empty
by brad davison 24 Apr '08

24 Apr '08

I am working in a test environment to construct a SAMBA / LDAP domain for windows clients. There is a PDC with OpenLDAP server 2.3.35 and SAMBA 3.026 running on ubuntu server 7.10. The PDC is functioning; I am able to create users and login with them, as well as join workstations to the domain. The slave slapd was populated with an output from an ldif file that was exported from the master via: slapcat -l >> master.ldif I had entered the 'replica' line in the master-slapd, and the updatedn and updateref lines in the slave-slapd as stated in 14.4 in the OpenLDAP 2.3 admin's guide. The 'openldap' user has rights to the replog file. Problem 1) The master (dc01-ubuntu.example.local) is not updating the replog file with either a success or failure. Problem 2) The slave (bdc01-ubuntu.example.local) is not getting updates from the master when changes occur. I am relatively new to LDAP and I might be missing something core. I have the OpenLDAP admin guide printed out and I am referring to it, but I believe I had entered the lines as the book instructed. Attached are my master-slapd.conf and slave-slapd.conf files. Again, this is a test environment for now. I understand the current setup is not secure. What I would like to achieve is a working PDC -> BDC replication. When I start slapd on the master i get:Starting OpenLDAP: slapd slurpd. with no errors. When I start slapd on the slave I get : Starting OpenLDAP: slapd with no errors. master-slapd.conf include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/misc.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 0 modulepath /usr/lib/ldap moduleload back_bdb sizelimit 500 tool-threads 1 backend bdb checkpoint 512 30 database bdb suffix "dc=example,dc=local" rootdn "cn=admin,dc=example,dc=local" rootpw 12345 replica uri=ldap://bdc01-ubuntu.example.local:389 binddn="cn=admin,dc=example,dc=local" credentials=12345 bindmethod=simple tls=no replogfile /var/log/replog.bdc01-ubuntu.example.local directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass eq lastmod on access to attrs=userPassword,sambaNTPassword,sambaLMPassword by dn="cn=admin,dc=example,dc=local" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=example,dc=local" write by * read ------------------------- slave slapd.conf include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/misc.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 0 modulepath /usr/lib/ldap moduleload back_bdb operation sizelimit 500 tool-threads 1 backend bdb checkpoint 512 30 database bdb ### slurpd updatedn "cn=admin,dc=example,dc=local" updateref ldap://dc01-ubuntu.example.local suffix dc=example,dc=local rootdn cn=admin,dc=example,dc=local rootpw 12345 directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass eq lastmod on access to attrs=userPassword,sambaNTPassword,sambaLMPassword by dn="cn=admin,dc=example,dc=local" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=example,dc=local" write by * read ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 7

noob ldap question
by Nizameddin Ordulu 23 Apr '08

23 Apr '08

Hi All, My apologies in advance if this is not the right place to ask this noob question. I am trying to create an ldap database with base dn: dc=tr,dc=tc. Once created it will be used to store the email accounts like username(a)tr.tc. When I execute the command to modify the dn entry, I get the following error root@nizam-desktop:/home/nizam/Desktop# ldapadd -f user2.ldiff -xv -D "cn=admin,dc=tr,dc=tc" -h 127.0.0.1 -w 1234 ldap_initialize( ldap://127.0.0.1 ) add objectClass: top dcObject organization add dc: tr tc add description: top level of the tr.tc hierarchy adding new entry "dc=tr,dc=tc" modify complete ldap_add: Constraint violation (19) additional info: dc: multiple values provided The user2.ldiff file looks like this: dn: dc=tr,dc=tc objectClass: top objectClass: dcObject objectClass: organization dc: tr dc: tc description: top level of the tr.tc hierarchy dn: cn=admin,dc=tr,dc=tc objectClass: organizationalRole cn: admin description: LDAP Directory Administrator dn: cn=user1,dc=tr,dc=tc objectClass: inetOrgPerson objectClass: inetLocalMailRecipient cn: user1 sn: user1lastname mail: user1(a)tr.tc userPassword: 1234 mailHost: 127.0.0.1 The configuration for the database dc=tr,dc=tc is as follows (part of /etc/ldap/slapd.conf) database bdb suffix "dc=tr,dc=tc" rootdn "cn=admin,dc=tr,dc=tc" rootpw 1234 directory /var/lib/ldap/trtc defaultaccess read schemacheck on lastmod on index cn,sn,st,o eq,pres,sub my OS is Ubuntu 7.10 and i am running slapd installed by the synaptic manager. root@nizam-desktop:/home/nizam/Desktop# uname -a Linux nizam-desktop 2.6.22-14-generic #1 SMP Sun Oct 14 23:05:12 GMT 2007 i686 GNU/Linux Can anyone please tell me why I can not add dc=tr,dc=tc? Kind regards, nizam -- Nizameddin Ordulu

3 3

Re: AW: Invalid syntax (21)
by Luke Lee 23 Apr '08

23 Apr '08

I referenced both the section 4.3 and 6.27 of the rfc2252 and tried the following: (,l\5Fluke,mydomain.com) (,l\_luke,mydomain.com) (,l'\_'luke,mydomain.com (,l"_"luke,mydomain.com) (,(l'_'luke,mydomain.com) (,l"\5F"luke,mydomain.com) (,l"\_"luke,mydomain.com) (,"l_luke",mydomain.com) (,'l_luke',mydomain.com) However, none of the above worked. What is the correct way of doing the escape? Your help will be much appreciated! Luke ----- Original Message ---- From: Dieter Kluenter <dieter(a)dkluenter.de> To: openldap-technical(a)openldap.org Sent: Wednesday, April 23, 2008 6:37:33 AM Subject: Re: AW: Invalid syntax (21) Luke Lee <leeluke77(a)yahoo.com> writes: > Hi Claus, > > Thank you for your valuable opinion. > > I tried to "fix" the syntax problem by removing the _ from the username. It > worked! However, I want to use the _ because this is my company's user naming > convention. I have to point out that when I ran the early version of OpenLDAP > (version 2.2-13), there were no syntax problems when I used the ldif with the > nisNetgroupTriple that was defined. I just did a custom build of OpenLDAP > (version 2.3-39). Then, I immediately encountered the invalid syntax problem > when I triled to load the same ldif. RFC-2307 defines the attribute elements of syntax 'keystring, keystring, as defined in rfc2252, does not allow underscores, if you do require underscores you may escape this character. -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6 Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

Re: AW: Invalid syntax (21)
by Luke Lee 23 Apr '08

23 Apr '08

I referenced both the section 4.3 and 6.27 of the rfc2252 and tried the following: (,l\5Fluke,mydomain.com) (,l\_luke,mydomain.com) (,l'\_'luke,mydomain.com (,l"_"luke,mydomain.com) (,(l'_'luke,mydomain.com) (,l"\5F"luke,mydomain.com) (,l"\_"luke,mydomain.com) (,"l_luke",mydomain.com) (,'l_luke',mydomain.com) However, none of the above worked. What is the correct way of doing the escape? Your help will be much appreciated! Luke ----- Original Message ---- From: Dieter Kluenter <dieter(a)dkluenter.de> To: openldap-technical(a)openldap.org Sent: Wednesday, April 23, 2008 6:37:33 AM Subject: Re: AW: Invalid syntax (21) Luke Lee <leeluke77(a)yahoo.com> writes: > Hi Claus, > > Thank you for your valuable opinion. > > I tried to "fix" the syntax problem by removing the _ from the username. It > worked! However, I want to use the _ because this is my company's user naming > convention. I have to point out that when I ran the early version of OpenLDAP > (version 2.2-13), there were no syntax problems when I used the ldif with the > nisNetgroupTriple that was defined. I just did a custom build of OpenLDAP > (version 2.3-39). Then, I immediately encountered the invalid syntax problem > when I triled to load the same ldif. RFC-2307 defines the attribute elements of syntax 'keystring, keystring, as defined in rfc2252, does not allow underscores, if you do require underscores you may escape this character. -Dieter -- Dieter Klünter | Systemberatung http://www..dkluenter.de GPG Key ID:8EF7B6C6 ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

Re: "to" rules
by uri_gr1＠tut.by 23 Apr '08

23 Apr '08

В сообщении от Monday 21 April 2008 17:30:08 вы написали: > Note, you replied just to me - might have gotten a quicker reply from > someone else if you replied to the list. Anyway... > > uri_gr1(a)tut.by writes: > >From: uri_gr1(a)tut.by > > > >>> I have openldap-2.4.8 up and running. I have ou=People subtree with > >>> posixAccounts and I need to grant access to, let's say, > >>> ou=Clients,ou=AddressBook by all rdn's in ou=People, having > >>> gidNumber=10008. > >> > >> I'm not quite sure what you mean with "by all rdn's". (...) > > > > user uid=uri_gr1,ou=People,dc=tut,dc=by should have write access to > > ou=Clients,ou=AddressBook,dc=tut,dc=by subtree if the user entry contains > > attribute gidNumber: 10008 > > Still untested - > > access to dn.subtree=ou=Clients,ou=AddressBook,dc=tut,dc=by > by dn.onelevel=ou=People,dc=tut,dc=by > set.exact="self/gidNumber & 10008" > write > and maybe by * read or whatever for everyone else I tested ACLs below: # ACL for clients addressbook access to dn.subtree=ou=Clients,ou=AddressBook,dc=tut,dc=by by dn.onelevel=ou=People,dc=tut,dc=by set.exact="self/gidNumber & 10003" write access to dn.subtree=ou=Clients,ou=AddressBook,dc=tut,dc=by by dn.onelevel=ou=People,dc=tut,dc=by set.exact="self/gidNumber & 10007" write access to dn.subtree=ou=Clients,ou=AddressBook,dc=tut,dc=by by dn.onelevel=ou=People,dc=tut,dc=by set.exact="self/gidNumber & 10008" write access to dn.subtree=ou=Clients,ou=AddressBook,dc=tut,dc=by by dn.exact=cn=admin,ou=Groups,dc=tut,dc=by write access to dn.subtree=ou=Clients,ou=AddressBook,dc=tut,dc=by by dn.exact=cn=manager,ou=Groups,dc=tut,dc=by write access to dn.subtree=ou=Clients,ou=AddressBook,dc=tut,dc=by by dn.exact=cn=seller,ou=Groups,dc=tut,dc=by write access to dn.subtree=ou=Clients,ou=AddressBook,dc=tut,dc=by by * none # But it's not worked. Access to ou=Clients,ou=AddressBook,dc=tut,dc=by is restricted to all. Is it posible to write some acls like: ... by filter="(&(objectclass=posixAccount)(gidNumber=10008))" ... As I know it accepted for "to ..." rules, but wthat about "by ..."? I tried it earlier, but maybe it failed beacuse of wrong syntax?

2 2

slapd memory footprint
by Stelios Grigoriadis 23 Apr '08

23 Apr '08

After running some test we observed that slapd is consuming a considerable amount of memory, why is that? We ran one client that retrieved the entire tree (it was pretty small anyway) and 10 other clients that searched for a particular item. Comparing version 2.3.39 with 2.3.32 the footprint increases. From top: 2.3.32: PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ SWAP CODE DATA COMMAND 6049 root 18 0 221m 4904 2568 S 11.5 0.2 0:33.27 216m 2844 137m slapd 2.3.39: PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ SWAP CODE DATA COMMAND 13062 ldap 18 0 268m 80m 77m S 14.3 16.2 0:42.27 188m 2892 185m slapd Is this to be expected? By decreasing the cachesize we got: PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ SWAP CODE DATA COMMAND 22492 ldap 18 0 255m 80m 77m S 14.5 16.1 0:39.01 175m 2892 172m slapd which is still pretty big. The whole ldap tree fits into a 14k large ldif file so the amount of data is not large. Is there any way we can influence the memory footprint (eg. by setting som parameter)? /Stelios

2 2

Re: AW: Invalid syntax (21)
by Luke Lee 23 Apr '08

23 Apr '08

Hi Claus, Thank you for your valuable opinion. I tried to "fix" the syntax problem by removing the _ from the username. It worked! However, I want to use the _ because this is my company's user naming convention. I have to point out that when I ran the early version of OpenLDAP (version 2.2-13), there were no syntax problems when I used the ldif with the nisNetgroupTriple that was defined. I just did a custom build of OpenLDAP (version 2.3-39). Then, I immediately encountered the invalid syntax problem when I triled to load the same ldif. Do you have any thought on the wierd problem? Thanks. Luke ----- Original Message ---- From: "Kick, Claus" <claus.kick(a)siemens.com> To: Luke Lee <leeluke77(a)yahoo.com>; Dieter Kluenter <dieter(a)dkluenter.de>; openldap-technical(a)openldap.org Sent: Tuesday, April 22, 2008 3:59:49 AM Subject: AW: Invalid syntax (21) Hello, nisnetgrouptriple = "(" hostname "," username "," domainname ")" You have nisNetgroupTriple: (,luke_l,mydomain.com <http://mydomain.com/ <http://mydomain.com/> > ) which I would translate to: <empty>,username, domainname. Perhaps you just have to add the hostname and not leave it blank? Cheers, Claus ________________________________ Von: openldap-technical-bounces+claus.kick=siemens.com(a)OpenLDAP.org [mailto:openldap-technical-bounces+claus.kick=siemens.com@OpenLDAP..org] Im Auftrag von Luke Lee Gesendet: Dienstag, 22. April 2008 01:21 An: Dieter Kluenter; openldap-technical(a)openldap.org Betreff: Re: Invalid syntax (21) Hi Dieter, I tried several modifications but still couldn't get it working. Can you or anyone else help please? What's wrong with my syntax? Thanks. Luke ----- Original Message ---- From: Dieter Kluenter <dieter(a)dkluenter.de> To: openldap-technical@openldap..org Sent: Saturday, April 19, 2008 4:27:20 AM Subject: Re: Invalid syntax (21) Luke Lee <leeluke77(a)yahoo.com> writes: > Hi, > > I encounter a situation where I couldn't find any syntax errors in my ldif file but failed to use > ldapadd to add entries. I didn't find any trailing spaces at the end of each objectClass. The > following is the error message: > > adding new entry "cn=LocalSales,ou=Netgroup,dc=mydomain,dc=com" > ldapadd: Invalid syntax (21) > additional info: nisNetgroupTriple: value #0 invalid per syntax > > My ldif file is like the following: [...] > dn: cn=LocalSales,ou=Netgroup,dc=mydomain,dc=com > objectClass: nisNetgroup > objectClass: top > cn: LocalSales > nisNetgroupTriple: (,luke_l,mydomain.com <http://mydomain.com/> ) > nisNetgroupTriple: (,sam_c,mydomain.com <http://mydomain.com/> ) > nisNetgroupTriple: (,amy_s,mydomain.com <http://mydomain.com/> ) > nisNetgroupTriple: (,anita_c,mydomain.com <http://mydomain.com/> ) > nisNetgroupTriple: (,jim_f,mydomain.com <http://mydomain.com/> ) > description: Local Sales The nisnetgrouptriple syntax is described in RFC-2307 as follows: Values in this syntax are represented by the following: nisnetgrouptriple = "(" hostname "," username "," domainname ")" hostname = "" / "-" / keystring username = "" / "-" / keystring domainname = "" / "-" / keystring See RFC-2307 for examples. -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de <http://www.dkluenter.de/> GPG Key ID:8EF7B6C6 ________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. <http://us.rd.yahoo..com/evt=51733/*http://mobile.yahoo.com/;_ylt=Ahu06i62sR…> ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 1

ldap_simple_bind() can't return immediately?
by lijx 23 Apr '08

23 Apr '08

dear Pierangelo Masarati: thank you for your response. now i have call ldap_simple_bind() function but it will return for a long time(almost 60 seconds, and i am working in linux redhat as 4, openldap2.2), but the man doc says this is a asyschronized function, any option should i set the pLdapConnection ? if ((msgid = ldap_simple_bind(pLdapConnection, pUserDN, pPassword)) == -1) /*ldap_simple_bind() return for 60 seconds if the server wrong or down.*/ ... ... ret = ldap_result(pLdapConnection, msgid, LDAP_MSG_ALL, & tv_select_timeout, &result); cheers, lijx > -----Original Message----- > From: Pierangelo Masarati [mailto:ando@sys-net.it] > Sent: Saturday, April 19, 2008 5:41 AM > To: lijx > Cc: openldap-technical(a)openldap.org > Subject: Re: ldapbind() timeout can't work . > > lijx wrote: > > LDAP APIS confused me, anyone can tell my what's wrong with my code? > > > > > > > > I have call ldap_set_option() and set the LDAP_OPT_NETWORK_TIMEOUT > > or > the > > LDAP_OPT_TIMEOUT opt, > > > > before call the ldap_bind_s() or the non synchronize APIS, but the > > authentication result still return after almost 70 > > > > seconds later, am I miss something (note: my server is windows > > active directory, simple authentication.)? > > LDAP_OPT_NETWORK_TIMEOUT olny acts at the connection level, which > apparently is established successfully. ldap_bind_s(), which BTW is > deprecated in favor of ldap_sasl_bind_s(), does not allow any timeout > while waiting for response. Until OpenLDAP 2.3, the LDAP_OPT_TIMEOUT > was not honored; only calling ldap_result() with an explicit timeout > would allow to time out requests taking too long. The only way to > make use of a timeout was to use the asynchronous API, as done in the > code you submitted when BIND_TIME_CONTROL is defined. Since OpenLDAP > 2.4, LDAP_OPT_TIMEOUT is honored by the library. Unfortunately you > didn't specify what version of the API you're using. > > p. > > > > Ing. Pierangelo Masarati > OpenLDAP Core Team > > SysNet s.r.l. > via Dossi, 8 - 27100 Pavia - ITALIA > http://www.sys-net.it > --------------------------------------- > Office: +39 02 23998309 > Mobile: +39 333 4963172 > Email: pierangelo.masarati(a)sys-net.it > ---------------------------------------

1 0

Re: Solairs PAM Password Policy
by Buchan Milne 23 Apr '08

23 Apr '08

On Wednesday 23 April 2008 02:51:22 farhan ahmed wrote: > Hi Buchan, Please stay on-list. > Thanks for reply but I am using OpenLdap server rather than Directory > Server. Any other suggestion ? The point is, that even with Sun's on directory server, the Solaris pam_ldap does not support password policies correctly. As far as I understand, the OpenLDAP ppolicy feature (with a draft standard) is compatible with the relatively undocumented Netscape LDAP server feature. In the forum post I gave, you'll note that HP-UX's pam_ldap supports the password policies correctly ... So, this is a limitation on the Solaris side, there isn't much you can do unless you can run PADLs pam_ldap. Regards, Buchan

1 0

why ldap_simple_bind() can't return immediately?
by lijx 23 Apr '08

23 Apr '08

hii: i have call ldap_simple_bind() function but it will return for a long time(almost 60 seconds, and i am working in linux redhat as 4, openldap2.2), but the man doc says this is a asyschronized function, any option should i set the pLdapConnection? if ((msgid = ldap_simple_bind(pLdapConnection, pUserDN, pPassword)) == -1) /*ldap_simple_bind() return for 60 seconds if the server wrong or down.*/ ... ... ret = ldap_result(pLdapConnection, msgid, LDAP_MSG_ALL, & tv_select_timeout, &result); Cheers, Lijx

1 0

why ldap_simple_bind() can't return immediately?
by lijx 23 Apr '08

23 Apr '08

hii: i have call ldap_simple_bind() function but it will return for a long time(almost 60 seconds, and i am working in linux redhat as 4, openldap2.2), but the man doc says this is a asyschronized function, any option should i set the pLdapConnection? if ((msgid = ldap_simple_bind(pLdapConnection, pUserDN, pPassword)) == -1) /*ldap_simple_bind() return for 60 seconds if the server wrong or down.*/ ... ... ret = ldap_result(pLdapConnection, msgid, LDAP_MSG_ALL, & tv_select_timeout, &result);

1 0

Re: AW: Invalid syntax (21)
by Luke Lee 23 Apr '08

23 Apr '08

Hi Claus, Thank you for your valuable opinion. I tried to "fix" the syntax problem by removing the _ from the username. It worked! However, I want to use the _ because this is my company's user naming convention. I have to point out that when I ran the early version of OpenLDAP (version 2.2-13), there were no syntax problems when I used the ldif with the nisNetgroupTriple that was defined. I just did a custom build of OpenLDAP (version 2.3-39). Then, I immediately encountered the invalid syntax problem when I triled to load the same ldif. It won't work if I keep the _ in the username field but don't leave the hostname field blank. Do you have any thought on the wierd problem? Thanks. Luke ----- Original Message ---- From: "Kick, Claus" <claus.kick(a)siemens.com> To: Luke Lee <leeluke77(a)yahoo.com>; Dieter Kluenter <dieter(a)dkluenter.de>; openldap-technical(a)openldap.org Sent: Tuesday, April 22, 2008 3:59:49 AM Subject: AW: Invalid syntax (21) Hello, nisnetgrouptriple = "(" hostname "," username "," domainname ")" You have nisNetgroupTriple: (,luke_l,mydomain.com <http://mydomain.com/ <http://mydomain.com/> > ) which I would translate to: <empty>,username, domainname. Perhaps you just have to add the hostname and not leave it blank? Cheers, Claus ________________________________ Von: openldap-technical-bounces+claus.kick=siemens.com(a)OpenLDAP.org [mailto:openldap-technical-bounces+claus.kick=siemens.com@OpenLDAP.org] Im Auftrag von Luke Lee Gesendet: Dienstag, 22. April 2008 01:21 An: Dieter Kluenter; openldap-technical(a)openldap.org Betreff: Re: Invalid syntax (21) Hi Dieter, I tried several modifications but still couldn't get it working. Can you or anyone else help please? What's wrong with my syntax? Thanks. Luke ----- Original Message ---- From: Dieter Kluenter <dieter(a)dkluenter.de> To: openldap-technical(a)openldap.org Sent: Saturday, April 19, 2008 4:27:20 AM Subject: Re: Invalid syntax (21) Luke Lee <leeluke77(a)yahoo.com> writes: > Hi, > > I encounter a situation where I couldn't find any syntax errors in my ldif file but failed to use > ldapadd to add entries. I didn't find any trailing spaces at the end of each objectClass. The > following is the error message: > > adding new entry "cn=LocalSales,ou=Netgroup,dc=mydomain,dc=com" > ldapadd: Invalid syntax (21) > additional info: nisNetgroupTriple: value #0 invalid per syntax > > My ldif file is like the following: [...] > dn: cn=LocalSales,ou=Netgroup,dc=mydomain,dc=com > objectClass: nisNetgroup > objectClass: top > cn: LocalSales > nisNetgroupTriple: (,luke_l,mydomain.com <http://mydomain.com/> ) > nisNetgroupTriple: (,sam_c,mydomain.com <http://mydomain.com/> ) > nisNetgroupTriple: (,amy_s,mydomain.com <http://mydomain.com/> ) > nisNetgroupTriple: (,anita_c,mydomain.com <http://mydomain.com/> ) > nisNetgroupTriple: (,jim_f,mydomain.com <http://mydomain.com/> ) > description: Local Sales The nisnetgrouptriple syntax is described in RFC-2307 as follows: Values in this syntax are represented by the following: nisnetgrouptriple = "(" hostname "," username "," domainname ")" hostname = "" / "-" / keystring username = "" / "-" / keystring domainname = "" / "-" / keystring See RFC-2307 for examples. -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de <http://www.dkluenter.de/> GPG Key ID:8EF7B6C6 ________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. <http://us.rd.yahoo..com/evt=51733/*http://mobile.yahoo.com/;_ylt=Ahu06i62sR…> Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

OpenLDAP password change issues...
by Chris Hodson 22 Apr '08

22 Apr '08

I'm dealing with an OpenLDAP server running on Solaris 8. When a user attempts to change their LDAP password from a command line, Linux or Solaris it completes with an all tokens updated. If I try logging in with this new password it does not work. If I try logging in with the previous password it also does not work. If I login to Webmin and manually change the LDAP user's password it will begin working again. I noticed in the password field, after I had attempted changing the password, it had a $1 after the (crypt) line. Before I changed the password the "crypt" line did not contain a $1. It would appear that "passwd" is encrypting the users password differently into LDAP then webmin is. Any help would be much appreciated. Thanks. Chris Hodson Unix Admin Orbital Sciences Corporation (480) 722-3856 Hodson.Chris(a)orbital.com ----------------------------------------- Notice: This e-mail is intended solely for use of the individual or entity to which it is addressed and may contain information that is proprietary, privileged and exempt from disclosure under applicable law. If the reader is not the intended recipient or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. This communication may also contain data subject to U.S. export laws. If so, that data subject to the International Traffic in Arms Regulation cannot be disseminated, distributed or copied to foreign nationals, residing in the U.S. or abroad, absent the express prior approval of the U.S. Department of State. If you have received this communication in error, please notify the sender by reply e-mail and destroy the e-mail message and any physical copies made of the communication. Thank you.

1 0

Re: AW: Invalid syntax (21)
by Luke Lee 22 Apr '08

22 Apr '08

Hi Claus, Thank you for your valuable opinion. I tried to "fix" the syntax problem by removing the _ from the username. It worked! However, I want to use the _ because this is my company's user naming convention. I have to point out that when I ran the early version of OpenLDAP (version 2.2-13), there were no syntax problems when I used the ldif with the nisNetgroupTriple that was defined. I just did a custom build of OpenLDAP (version 2.3-39). Then, I immediately encountered the invalid syntax problem when I triled to load the same ldif. Do you have any thought on the wierd problem? Thanks. Luke ----- Original Message ---- From: "Kick, Claus" <claus.kick(a)siemens.com> To: Luke Lee <leeluke77(a)yahoo.com>; Dieter Kluenter <dieter(a)dkluenter.de>; openldap-technical(a)openldap.org Sent: Tuesday, April 22, 2008 3:59:49 AM Subject: AW: Invalid syntax (21) Hello, nisnetgrouptriple = "(" hostname "," username "," domainname ")" You have nisNetgroupTriple: (,luke_l,mydomain.com <http://mydomain.com/ <http://mydomain.com/> > ) which I would translate to: <empty>,username, domainname. Perhaps you just have to add the hostname and not leave it blank? Cheers, Claus ________________________________ Von: openldap-technical-bounces+claus.kick=siemens.com(a)OpenLDAP.org [mailto:openldap-technical-bounces+claus.kick=siemens.com@OpenLDAP.org] Im Auftrag von Luke Lee Gesendet: Dienstag, 22. April 2008 01:21 An: Dieter Kluenter; openldap-technical(a)openldap.org Betreff: Re: Invalid syntax (21) Hi Dieter, I tried several modifications but still couldn't get it working. Can you or anyone else help please? What's wrong with my syntax? Thanks. Luke ----- Original Message ---- From: Dieter Kluenter <dieter(a)dkluenter.de> To: openldap-technical(a)openldap.org Sent: Saturday, April 19, 2008 4:27:20 AM Subject: Re: Invalid syntax (21) Luke Lee <leeluke77(a)yahoo.com> writes: > Hi, > > I encounter a situation where I couldn't find any syntax errors in my ldif file but failed to use > ldapadd to add entries. I didn't find any trailing spaces at the end of each objectClass. The > following is the error message: > > adding new entry "cn=LocalSales,ou=Netgroup,dc=mydomain,dc=com" > ldapadd: Invalid syntax (21) > additional info: nisNetgroupTriple: value #0 invalid per syntax > > My ldif file is like the following: [...] > dn: cn=LocalSales,ou=Netgroup,dc=mydomain,dc=com > objectClass: nisNetgroup > objectClass: top > cn: LocalSales > nisNetgroupTriple: (,luke_l,mydomain.com <http://mydomain.com/> ) > nisNetgroupTriple: (,sam_c,mydomain.com <http://mydomain.com/> ) > nisNetgroupTriple: (,amy_s,mydomain.com <http://mydomain.com/> ) > nisNetgroupTriple: (,anita_c,mydomain.com <http://mydomain.com/> ) > nisNetgroupTriple: (,jim_f,mydomain.com <http://mydomain.com/> ) > description: Local Sales The nisnetgrouptriple syntax is described in RFC-2307 as follows: Values in this syntax are represented by the following: nisnetgrouptriple = "(" hostname "," username "," domainname ")" hostname = "" / "-" / keystring username = "" / "-" / keystring domainname = "" / "-" / keystring See RFC-2307 for examples. -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de <http://www.dkluenter.de/> GPG Key ID:8EF7B6C6 ________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. <http://us.rd.yahoo..com/evt=51733/*http://mobile.yahoo.com/;_ylt=Ahu06i62sR…> Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

Re: AW: Invalid syntax (21)
by Luke Lee 22 Apr '08

22 Apr '08

Hi Claus, Thank you for your valuable opinion. I tried to "fix" the syntax problem by removing the _ from the username. It worked! However, I want to use the _ because this is my company's user naming convention. I have to point out that when I ran the early version of OpenLDAP (version 2.2-13), there were no syntax problems when I used the ldif with the nisNetgroupTriple that was defined. I just did a custom build of OpenLDAP (version 2.3-39). Then, I immediately encountered the invalid syntax problem when I triled to load the same ldif. Do you have any thought on the wierd problem? Thanks. Luke ----- Original Message ---- From: "Kick, Claus" <claus.kick(a)siemens.com> To: Luke Lee <leeluke77(a)yahoo.com>; Dieter Kluenter <dieter(a)dkluenter.de>; openldap-technical(a)openldap.org Sent: Tuesday, April 22, 2008 3:59:49 AM Subject: AW: Invalid syntax (21) Hello, nisnetgrouptriple = "(" hostname "," username "," domainname ")" You have nisNetgroupTriple: (,luke_l,mydomain.com <http://mydomain.com/ <http://mydomain.com/> > ) which I would translate to: <empty>,username, domainname. Perhaps you just have to add the hostname and not leave it blank? Cheers, Claus ________________________________ Von: openldap-technical-bounces+claus.kick=siemens.com(a)OpenLDAP.org [mailto:openldap-technical-bounces+claus.kick=siemens.com@OpenLDAP.org] Im Auftrag von Luke Lee Gesendet: Dienstag, 22. April 2008 01:21 An: Dieter Kluenter; openldap-technical(a)openldap.org Betreff: Re: Invalid syntax (21) Hi Dieter, I tried several modifications but still couldn't get it working. Can you or anyone else help please? What's wrong with my syntax? Thanks. Luke ----- Original Message ---- From: Dieter Kluenter <dieter(a)dkluenter.de> To: openldap-technical(a)openldap.org Sent: Saturday, April 19, 2008 4:27:20 AM Subject: Re: Invalid syntax (21) Luke Lee <leeluke77(a)yahoo.com> writes: > Hi, > > I encounter a situation where I couldn't find any syntax errors in my ldif file but failed to use > ldapadd to add entries. I didn't find any trailing spaces at the end of each objectClass. The > following is the error message: > > adding new entry "cn=LocalSales,ou=Netgroup,dc=mydomain,dc=com" > ldapadd: Invalid syntax (21) > additional info: nisNetgroupTriple: value #0 invalid per syntax > > My ldif file is like the following: [...] > dn: cn=LocalSales,ou=Netgroup,dc=mydomain,dc=com > objectClass: nisNetgroup > objectClass: top > cn: LocalSales > nisNetgroupTriple: (,luke_l,mydomain.com <http://mydomain.com/> ) > nisNetgroupTriple: (,sam_c,mydomain.com <http://mydomain.com/> ) > nisNetgroupTriple: (,amy_s,mydomain.com <http://mydomain.com/> ) > nisNetgroupTriple: (,anita_c,mydomain.com <http://mydomain.com/> ) > nisNetgroupTriple: (,jim_f,mydomain.com <http://mydomain.com/> ) > description: Local Sales The nisnetgrouptriple syntax is described in RFC-2307 as follows: Values in this syntax are represented by the following: nisnetgrouptriple = "(" hostname "," username "," domainname ")" hostname = "" / "-" / keystring username = "" / "-" / keystring domainname = "" / "-" / keystring See RFC-2307 for examples. -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de <http://www.dkluenter.de/> GPG Key ID:8EF7B6C6 ________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. <http://us.rd.yahoo..com/evt=51733/*http://mobile.yahoo.com/;_ylt=Ahu06i62sR…> Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

configuring ldap client
by Melanie Pfefer 22 Apr '08

22 Apr '08

hi I have a Solaris 10 client that I want to configure ldap instead of dns on it. I am using this: ldapclient init -a profileName=default -a domainName=siroe.com -a proxyDN=cn=proxyagent,ou=profile,dc=siroe,dc=com -a proxyPassword=password ZEUS I am getting this: Failed to find defaultSearchBase for domain siroe.com I also noticed that the nisDomain attribute is missing: ldapsearch -h ZEUS -b "dc=siroe,dc=com" "nisdomain=*" returns nothing. This attribute (nisDomain)is necessary for Solaris clients to find a server for a specific domain. The client searches for an entry on the LDAP server that has the nisDomain matching the desired domain. The DN for the entry found will be used as the BaseDN for the naming information. Any idea please? thanks __________________________________________________________ Sent from Yahoo! Mail. A Smarter Email http://uk.docs.yahoo.com/nowyoucan.html

1 0

Solairs PAM Password Policy
by farhan ahmed 22 Apr '08

22 Apr '08

Hi Guys, I have implemented password policy on linux but Solaris clients are not giving any info/error message other than permision denied. For example, I have pwdInHostory 6, if i try to change password on linux and use old password I get straight away error message -bash-3.00$ passwdChanging password for user test.Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information update failed: Can't contact LDAP server Password is in history of old passwords But When I do same on Solaris I get following -bash-3.00$ passwd wbarreraEnter existing login password: New Password: Re-enter new Password: Permission denied But on server side debug I can see following send_ldap_result: err=19 matched="" text="Password is in history of old passwords" Why Solaris is not showing "Password is in history of old passwords" to user. Solaris is using its native client to connect openldap over TLS Any help would be appreciatedThanks, -- Regards, Farhan Ahmed Find out: SEEK Salary Centre Are you paid what you're worth? _________________________________________________________________ Are you paid what you're worth? Find out: SEEK Salary Centre http://a.ninemsn.com.au/b.aspx?URL=http%3A%2F%2Fninemsn%2Eseek%2Ecom%2Eau%2…

2 1

lt-ldapsearch: error while loading shared libraries
by Rodrigo Castro 22 Apr '08

22 Apr '08

Hello to all. I`ve been struggling with the following error: make test cd tests; make test make[1]: Entrando no diret=F3rio `/root/openldap-2.3.39/tests' make[2]: Entrando no diret=F3rio `/root/openldap-2.3.39/tests' Initiating LDAP tests for BDB... Cleaning up test run directory leftover from previous run. Running ./scripts/all... >>>>> Executing all LDAP tests for bdb >>>>> Starting test000-rootdse ... running defines.sh Starting slapd on TCP/IP port 9011... Using ldapsearch to retrieve the root DSE... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... ./scripts/test000-rootdse: line 66: kill: (2801) - Processo inexistente /root/openldap-2.3.39/clients/tools/.libs/lt-ldapsearch: error while loadin= g shared libraries: libssl.so.0.9.8: cannot open shared object file: No such file or directory >>>>> Test failed >>>>> ./scripts/test000-rootdse failed (exit 127) make[2]: ** [bdb-yes] Erro 127 make[2]: Saindo do diret=F3rio `/root/openldap-2.3.39/tests' make[1]: ** [test] Erro 2 make[1]: Saindo do diret=F3rio `/root/openldap-2.3.39/tests' make: ** [test] Erro 2 Even though in my configure result I have: configure:19451: checking openssl/ssl.h usability configure:19463: cc -c -g -O2 -I/usr/local/BerkeleyDB.4.5/include conftest.= c >&5 configure:19469: $? =3D 0 configure:19473: test -z || test ! -s conftest.err configure:19476: $? =3D 0 configure:19479: test -s conftest.o configure:19482: $? =3D 0 configure:19492: result: yes configure:19496: checking openssl/ssl.h presence configure:19506: cc -E -I/usr/local/BerkeleyDB.4.5/include conftest.c configure:19512: $? =3D 0 configure:19532: result: yes configure:19567: checking for openssl/ssl.h configure:19574: result: yes configure:19589: checking for SSL_library_init in -lssl configure:19619: cc -o conftest -g -O2 -I/usr/local/BerkeleyDB.4.5/include -L/usr/local/lib -L/usr/local/ssl/lib -L/root/krb5-1.6.3/src/lib -L/root/tcp_wrappers_7.6 conftest.c -lssl -lcrypto -lresolv -ldl >&5 configure:19625: $? =3D 0 configure:19629: test -z || test ! -s conftest.err configure:19632: $? =3D 0 configure:19635: test -s conftest configure:19638: $? =3D 0 configure:19651: result: yes configure:19757: checking OpenSSL library version (CRL checking capability) configure:19791: result: yes and: find / -name libssl.so.0.9.8 /root/openssl-0.9.8g/libssl.so.0.9.8 /usr/local/ssl/lib/libssl.so.0.9.8 If this isn`t the place for this post I apologize. Thanks for any help. -- __________________________________ Rodrigo de Castro Cosme Ciência da Computação - Universidade Federal do Espírito Santo Suporte mailing list - suporte(a)inf.ufes.br MSN - rdccosmo(a)gmail.com

1 0

Password Policy
by farhan ahmed 22 Apr '08

22 Apr '08

Hi Guys, I have implemented password policy on linux but Solaris clients are not giving any error message other than permision denied. For example, I have pwdInHostory 6, if i try to change password on linux and use old password I get straight away error message -bash-3.00$ passwdChanging password for user test.Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information update failed: Can't contact LDAP server Password is in history of old passwords But When I do same on Solaris I get following -bash-3.00$ passwd wbarreraEnter existing login password: New Password: Re-enter new Password: Permission denied But on server side debug I can see following send_ldap_result: err=19 matched="" text="Password is in history of old passwords" Why Solaris is not showing "Password is in history of old passwords" to user. Solaris is using its native client to connect openldap over TLS Any help would be appreciatedThanks, -- Regards, Farhan Ahmed _________________________________________________________________ Are you paid what you're worth? Find out: SEEK Salary Centre http://a.ninemsn.com.au/b.aspx?URL=http%3A%2F%2Fninemsn%2Eseek%2Ecom%2Eau%2…

1 0

Re: Invalid syntax (21)
by Luke Lee 22 Apr '08

22 Apr '08

Hi Dieter, I tried several modifications but still couldn't get it working. Can you or anyone else help please? What's wrong with my syntax? Thanks. Luke ----- Original Message ---- From: Dieter Kluenter <dieter(a)dkluenter.de> To: openldap-technical(a)openldap.org Sent: Saturday, April 19, 2008 4:27:20 AM Subject: Re: Invalid syntax (21) Luke Lee <leeluke77(a)yahoo.com> writes: > Hi, > > I encounter a situation where I couldn't find any syntax errors in my ldif file but failed to use > ldapadd to add entries. I didn't find any trailing spaces at the end of each objectClass. The > following is the error message: > > adding new entry "cn=LocalSales,ou=Netgroup,dc=mydomain,dc=com" > ldapadd: Invalid syntax (21) > additional info: nisNetgroupTriple: value #0 invalid per syntax > > My ldif file is like the following: [....] > dn: cn=LocalSales,ou=Netgroup,dc=mydomain,dc=com > objectClass: nisNetgroup > objectClass: top > cn: LocalSales > nisNetgroupTriple: (,luke_l,mydomain.com) > nisNetgroupTriple: (,sam_c,mydomain.com) > nisNetgroupTriple: (,amy_s,mydomain.com) > nisNetgroupTriple: (,anita_c,mydomain.com) > nisNetgroupTriple: (,jim_f,mydomain.com) > description: Local Sales The nisnetgrouptriple syntax is described in RFC-2307 as follows: Values in this syntax are represented by the following: nisnetgrouptriple = "(" hostname "," username "," domainname ")" hostname = "" / "-" / keystring username = "" / "-" / keystring domainname = "" / "-" / keystring See RFC-2307 for examples. -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6 ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now.. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 2

"to" rules
by uri_gr1＠tut.by 21 Apr '08

21 Apr '08

Hi, people! I have openldap-2.4.8 up and running. I have ou=People subtree with posixAccounts and I need to grant access to, let's say, ou=Clients,ou=AddressBook by all rdn's in ou=People, having gidNumber=10008. How can I do so?

2 1

ldapbind() timeout can't work .
by lijx 21 Apr '08

21 Apr '08

LDAP APIS confused me, anyone can tell my what's wrong with my code? I have call ldap_set_option() and set the LDAP_OPT_NETWORK_TIMEOUT or the LDAP_OPT_TIMEOUT opt, before call the ldap_bind_s() or the non synchronize APIS, but the authentication result still return after almost 70 seconds later, am I miss something (note: my server is windows active directory, simple authentication.)? struct timeval tv_select_timeout; tv_select_timeout.tv_sec = 10; tv_select_timeout.tv_usec = 0; int t; t=ldap_set_option(pLdapConnection, LDAP_OPT_NETWORK_TIMEOUT, &tv_select_timeout); #ifdef BIND_TIME_CONTROL { int msgid, err; LDAPMessage *result = NULL; char *error_msg; struct timeval tv; if ((msgid = ldap_simple_bind(pLdapConnection, pUserDN, pPassword)) == -1) { error_msg = NULL; ldap_get_option(pLdapConnection, LDAP_OPT_ERROR_STRING, &error_msg); if (error_msg != NULL) { ldap_memfree(error_msg); } ldap_unbind_s(pLdapConnection); return AUTH_AGENT_ERR_LDAPSIMPLEBIND_FAIL; } ret = ldap_result(pLdapConnection, msgid, LDAP_MSG_ALL, & tv_select_timeout, &result); if (ret == -1) { ldap_unbind_s(pLdapConnection); if (result != NULL) ldap_msgfree(result); return AUTH_AGENT_ERR_LDAPRESULT_FAIL; } else if (ret == 0) { /*timeout & result ==NULL */ ldap_unbind_s(pLdapConnection); if (result != NULL) ldap_msgfree(result); return AUTH_AGENT_ERR_LDAPRESULT_TIMEOUT; } ret = ldap_result2error(pLdapConnection, result, 1); } #else { ret = ldap_bind_s(pLdapConnection, pUserDN, pPassword, LDAP_AUTH_SIMPLE); } #endif

2 2

Invalid syntax (21)
by Luke Lee 19 Apr '08

19 Apr '08

Hi, I encounter a situation where I couldn't find any syntax errors in my ldif file but failed to use ldapadd to add entries. I didn't find any trailing spaces at the end of each objectClass. The following is the error message: adding new entry "cn=LocalSales,ou=Netgroup,dc=mydomain,dc=com" ldapadd: Invalid syntax (21) additional info: nisNetgroupTriple: value #0 invalid per syntax My ldif file is like the following: # # LocalSales # dn: cn=LocalSales,ou=Netgroup,dc=mydomain,dc=com objectClass: nisNetgroup objectClass: top cn: LocalSales nisNetgroupTriple: (,luke_l,mydomain.com) nisNetgroupTriple: (,sam_c,mydomain.com) nisNetgroupTriple: (,amy_s,mydomain.com) nisNetgroupTriple: (,anita_c,mydomain.com) nisNetgroupTriple: (,jim_f,mydomain.com) description: Local Sales # # Corporate Accountants # dn: cn=CorpAcct,ou=Netgroup,dc=mydomain,dc=com objectClass: nisNetgroup objectClass: top cn: CorpAcct nisNetgroupTriple: (,hannah_m,mydomain.com) nisNetgroupTriple: (,judy_j,mydomain.com) description: Corporate Accountants I have included the following schema files in my slapd.conf: include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema Could anyone please help resolve the above problem? Thanks. Luke ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 1

pwdExpirationWarned not present
by Paul Lee 18 Apr '08

18 Apr '08

Dear all, I am using openldap 2.4.8 and testing with the pwdExpireWarning and the pwdMaxAge I set the pwdExpireWarning = 100 and the pwdMaxAge = 120 Then, I preform a change in password operation. and wait for 20 seconds (120 - 100). I then preform a Authentificaiton to the LDAP several times, I see from the log indicate that it now falls in the warning period (i.e. about to expire but not yet expired) Apr 17 19:47:47 ldap0 slapd[7519]: ppolicy_bind: Setting warning for password expiry for cn=paul,ou=SCIG,ou=Govt-Dept,o=HKSARG = 96 seconds However, when I retrieve the operational attributes for that user, I can't see the pwdExpirationWarned attribute. How can I detect the user is in the "about to expire" state ? Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

2 3

Loading Ldif files to ldap server
by divya shree 18 Apr '08

18 Apr '08

Hiii.. I would like to knw.. 1...wen the users register themsleves first..wherev will the user details (like username n password will b stored).... 2.... if it is stored in the mysql backend..how will i migrate this data to the ldif file n load this ldif file to the server... Thanks n Regards Divya --------------------------------- Unlimited freedom, unlimited storage. Get it now

2 1

Manipulation of Request data
by derwyn 18 Apr '08

18 Apr '08

Hi All, I'm a novice in LDAP. But wanted to know if it was possible to mangle request coming to ldap. Eg. I have my ldap data with uid=someuser but the request coming in is uid=someuser(a)somedomain.com Is it possible to add some rule in slapd.conf or ldap.conf to do this kind of manipulation. I'm not using sasal. Thank Derwyn =================================================================== sms START NETCORE to 575758 to get updates on Netcore's enterprise products and services sms START MYTODAY to 09845398453 for more information on our mobile consumer services or go to http://www.mytodaysms.com ===================================================================

3 2

Number of Downloads?
by Gavin Henry 18 Apr '08

18 Apr '08

Hi All, Do we have any stats on the amount of downloads per month/year at all? Thanks, Gavin.

1 0

Re: openLDAP & memberof
by Gene Kupfer 17 Apr '08

17 Apr '08

Thank you very much for the info Michael and Quanah. I will check it out. Best regards, Gene

1 0

openLDAP & memberof
by Gene Kupfer 17 Apr '08

17 Apr '08

Hi all, I've been doing some research and I'm finding that there is no support for a "memberof" type attribute for user objects. When I query groups that have "memberuid" attributes, I get the group name but not the members. Is there any way around this? Maybe some other attribute I can add to the user object that will create a link between it and the group object and allow me to enumerate group members? Thank you, Gene

3 2

Server and client setup for connecting Solaris to an openldap server.
by Chavez, James R. 17 Apr '08

17 Apr '08

Hello all, I have set up a Red Hat Linux box with the Openldap server. I am looking to replace our existing NIS infrastructure with Openldap. The majority of the clients are Solaris 8 with a third of them being Solaris 10. I have been able to connect Red Hat clients to authenticate through LDAP but I am having issues with the Solaris client configuration. I see some stuff on the net but nothing concrete on how to get this working. I see some sites mention a solaris schema but I not found been able to locate that anywhere. Is this something that is possible? I am sure it is but i am relatively new to LDAP. Should I be looking at the Solaris native LDAP server? I have openldap-servers-2.3.27-8 installed on RHEL4. The schemas listed in my slapd.conf are.. include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema Thank you James CONFIDENTIALITY This e-mail message and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail message, you are hereby notified that any dissemination, distribution or copying of this e-mail message, and any attachments thereto, is strictly prohibited. If you have received this e-mail message in error, please immediately notify the sender and permanently delete the original and any copies of this email and any prints thereof. ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS E-MAIL IS NOT INTENDED AS A SUBSTITUTE FOR A WRITING. Notwithstanding the Uniform Electronic Transactions Act or the applicability of any other law of similar substance and effect, absent an express statement to the contrary hereinabove, this e-mail message its contents, and any attachments hereto are not intended to represent an offer or acceptance to enter into a contract and are not otherwise intended to bind the sender, Sanmina-SCI Corporation (or any of its subsidiaries), or any other person or entity.

3 3

LDAP Connection
by Manjunath Warad 17 Apr '08

17 Apr '08

Hi All, I have few queries on LDAP connection. I searched in the archieve but failed to get clarified. 1. Why LDAP server should terminate session if it fails to parse message. It can either send failure response or drop that particular message expecting a proper message from the client next time. Quote from RFC 4511 "If the server receives an LDAPMessage from the client in which the LDAPMessage SEQUENCE tag cannot be recognized, the messageID cannot be parsed, the tag of the protocolOp is not recognized as a request, or the encoding structures or lengths of data fields are found to be incorrect, then the server SHOULD return the Notice of Disconnection described in Section 4.4.1, with the resultCode set to protocolError, and MUST immediately terminate the LDAP session as described in Section 5.3." "and MUST immediately terminate the LDAP session as described in" 2. How it should be dealt with requests received by server while processing BIND request? Is it dropped or cached and processed later? RFC Quote "Similarly, servers SHOULD NOT process or respond to requests received while processing a BindRequest." regards, Manjunath **************************************************************************** *********** This e-mail and attachments contain confidential information from HUAWEI, which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction, or dissemination) by persons other than the intended recipient's) is prohibited. If you receive this e-mail in error, please notify the sender by phone or email immediately and delete it!

1 0

Nothing logged in the log file...
by Paul Lee 17 Apr '08

17 Apr '08

Dear sir, I am using openldap 2.4.8 and my compile option is : ./configure --enable-modules=yes --enable-ppolicy=yes --enable-overlays=yes --enable-syncprov=yes --with-cyrus-sasl --enable-wrappers My slapd.conf : loglevel any logfile /var/lib/ldap/ldap.log I start the openldap by following command : /usr/local/libexec/slapd -f /usr/local/etc/openldap/slapd.conf And then, I add some entries using java and check the log ldap.log, but the size is 0 bytes, nothing logged !!! Can anyone tell me what's wrong ? Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

3 5

Replication failed using slapadd
by Paul Lee 17 Apr '08

17 Apr '08

Dear sir, I am using openldap 2.4.8 and config as 3 way masters, the slapd.connf is shown below : syncrepl rid=001 provider=ldap://202.245.193.128:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" interval=00:00:01:00 syncrepl rid=002 provider=ldap://10.166.23.218:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" interval=00:00:01:00 syncrepl rid=003 provider=ldap://10.0.1.34:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" interval=00:00:01:00 Then, I startup 2 servers (rid= 002 and rid=003), I execute the command in sever 1 (i.e. rid=001) : slapadd -l import.ldif to import 3 entries to the ldap servers. Then, I startup server 1 (rid = 001) and use the command ldapsearch to retrieve the entries, find that all 3 entries are added in server 1, however, when I retrieve the records in server 2 and server 3, only the 1st record is added. Any idea of what's wrong ? Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

1 0

Problem searching LDAP
by Nuno Manuel Martins 16 Apr '08

16 Apr '08

While trying to debug my problems with authentication I discovered the problem was with searching the LDAP entries. If I search my database by the CN field I get this output: ldapsearch -D "cn=manager,dc=example,dc=com" -x -W "cn=myuser" # myuser, Users, example.com dn: uid=myuser,o=Users,dc=example,dc=com uid: myuser cn: myUser objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowLastChange: 13789 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 10002 gidNumber: 10001 homeDirectory: /home/ldap/john gecos: myUser (LDAP) userPassword:: <stuff> It seems pretty normal to me and working. However, if I try to search with "uid=myuser" nothing is returned. What is more, if I instead search with "uid=myuser*" the entry is returned successfully, which tells me that somewhere on the LDAP structure I probably have a problem with strange characters. Is there a way to efficiently correct this or do I have to import everything again? Of course, I could be wrong in my assumption... anything else that could be causing this behaviour besides strange "invisible" characters on UID field? Thank you, Nuno

2 1

Help with ACLs
by David Clarke 16 Apr '08

16 Apr '08

Hello and apologies if I'm posting this in the wrong location. I'm trying to apply some security to my openldap repository and I'm struggling with how or even if I can express a particular constraint. I have an ou containing inetOrgPerson's and the person's "o" attribute is the string value of the organisation "o" to which the user belongs, e.g. "Some Company Ltd". e.g. dn=uid=12345679,ou=people,dc=thecompany,dc=co,dc=nz attr o=Some Company Ltd The organisation "Some Company Ltd" can have subsidiary organisations, specified by the "owner" attribute of the subsidiary having the "dn" of owner organisation. e.g. dn: o=Subsidiary Company Ltd,ou=organisations,dc=thecompany,dc=co,dc=nz having attr owner:o=Some Company Ltd,ou=organisations,dc=thecompany,dc=co,dc=nz What I would like to do is restrict the user to having read access only to those subsidiary organisations based on the value of the user's "o" attribute. Is this a reasonable approach or should I be expressing this differently in my schema? I hope I've expressed that reasonably clearly. Any help would be much appreciated.

2 1

DB_CONFIG Problem
by Luke Lee 16 Apr '08

16 Apr '08

Hi, I've been trying to run my newly built OpenLDAP 2.3 server on a RedHat Enterprise server. Since it's installed under the /usr/local directory, I modified the /etc/rc.d/init.d/ldap script. When I tried to start it up the first time by running service ldap start, I received the following error messages: Checking configuration files for slapd: bdb_db_open: Warning - No DB_CONFIG file found in directory /usr/local/var/openldap-data: (2) Expect poor performance for suffix dc=mydomain,dc=com. bdb_db_open: db_open(/usr/local/var/openldap-data/id2entry.bdb) failed: No such file or directory (2) bdb(dc=mydomain,dc=com): Unknown locker ID: 0 backend_startup_one: bi_db_open failed! (2) slap_startup failed (test would succeed using the -u switch) When I copy the following DB_CONFIG file from an example, I received similar error messages as the above. The DB_CONFIG file that I use is the following: # $OpenLDAP: pkg/ldap/servers/slapd/DB_CONFIG,v 1.1.2.3 2006/08/17 17:36:19 kurt Exp $ # Example DB_CONFIG file for use with slapd(8) BDB/HDB databases. # # See Sleepycat Berkeley DB documentation # <http://www.sleepycat.com/docs/ref/env/db_config.html> # for detail description of DB_CONFIG syntax and semantics. # # Hints can also be found in the OpenLDAP Software FAQ # <http://www.openldap.org/faq/index.cgi?file=2> # in particular: # <http://www.openldap.org/faq/index.cgi?file=1075> # Note: most DB_CONFIG settings will take effect only upon rebuilding # the DB environment. # one 0.25 GB cache set_cachesize 0 268435456 1 # Data Directory #set_data_dir db # Transaction Log settings set_lg_regionmax 262144 set_lg_bsize 2097152 #set_lg_dir logs # Note: special DB_CONFIG flags are no longer needed for "quick" # slapadd(8) or slapindex(8) access (see their -q option). The error mesages are the following: Checking configuration files for slapd: bdb_db_open: db_open(/usr/local/var/openldap-data/id2entry.bdb) failed: No such file or directory (2) bdb(dc=mydomain,dc=com): Unknown locker ID: 0 backend_startup_one: bi_db_open failed! (2) slap_startup failed (test would succeed using the -u switch) Can anyone please help resolve the problem? Thanks in advance! Luke ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 1

Fwd: Integrating LDAP with postfix mailserver
by Aravind Arjunan 15 Apr '08

15 Apr '08

---------- Forwarded message ---------- From: Andhu <aravind.arjunan(a)gmail.com> Date: 12 Apr 2008 17:52 Subject: Integrating LDAP with postfix mailserver To: aravind.arjunan(a)gmail.com hi i had mailserver and mailbox server are in two different machines. Both are having the same domain (linux.com) In my mailserver i configured all the mails to relay to my mailbox server. SMTP authentication is also enabled The problem is I configured LDAP in my mailserver to store user information. I created all the users in the ldap database. So when i try to send a mail to a user exists in ldap database, where as only mailbox is present in the mailbox server without user, my mail is not delivering to the recipient it was bouncing back to the sender.When i check the log i found that it was not checking the ldap database itself. My main.cf file: alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases, ldap:/etc/postfix/ldapaliases.cf broken_sasl_auth_clients = yes command_directory = /usr/sbin config_directory = /etc/postfix daemon_directory = /usr/libexec/postfix debug_peer_level = 2 fallback_relay = $mydomain html_directory = no inet_interfaces = all mail_owner = postfix mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man mydestination = 151.2.119.150 mydomain = linux.com myhostname = experts.linux.com mynetworks = 151.2.0.0/16, 127.0.0.0/8 myorigin = $mydomain newaliases_path = /usr/bin/newaliases.postfix queue_directory = /var/spool/postfix readme_directory = /usr/share/doc/postfix-2.2.10/README_FILES relay_domains = $mydestination sample_directory = /usr/share/doc/postfix-2.2.10/samples sendmail_path = /usr/sbin/sendmail.postfix setgid_group = postdrop smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination, check_relay_domains smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = $myhostname smtpd_sasl_security_options = noanonymous unknown_local_recipient_reject_code = 550 ldapaliases_server_host = localhost ldapaliases_server_port = 389 ldapaliases_search_base = dc=linux,dc=com ldapaliases_scope = sub ldapaliases_query_filter = (uid=%s) ldapaliases_result_attribute = maildrop My /etc/postfix/ldapaliases.cf file server_host = 127.0.0.1 search_base = dc=linux,dc=com server_port = 389 scope = sub bind = no query_filter = (maillocaladdress=%s) result_attribute = maildrop dereference = 3 My /etc /openldap/slapd.conf include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema allow bind_v2 pidfile /var/run/slapd.pid argsfile /var/run/slapd.args database bdb suffix "dc=linux,dc=com" rootdn "cn=Manager,dc=linux,dc=com" rootpw {SSHA}BJbifO2zEGwJXoyx63QkeiCwdVE7b1eJ directory /var/lib/ldap/linux.com access to attrs=userPassword by self write by dn="cn=syncuser,dc=linux,dc=com" read by anonymous auth by * none access to * by dn="cn=syncuser,dc=linux,dc=com" read by * read # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index default sub The LDIF file which i added in ldap dn: uid=saurav,ou=solution,dc=linux,dc=com cn: Manaager sn: ganguly uid: saurav mail: saurav(a)linux.com description: Indian Team telephoneNumber: 012101012 userPassword: password uidNumber: 1023 homeDirectory: /home/saurav/ gidNumber: 10023 objectClass: person objectClass: top objectClass: inetOrgperson objectClass: posixAccount dn: uid=anil,ou=solution,dc=linux,dc=com cn: Manager sn: kumble uid: anil mail: anil(a)linux.com description: Indian Team telephoneNumber: 0212101012 userPassword: password uidNumber: 1024 homeDirectory: /home/anil/ gidNumber: 1034 objectClass: person objectClass: top objectClass: inetOrgperson objectClass: posixAccount This is the logs which are taken when i send mail from client to the user who has added in ldap database. Apr 12 17:20:32 experts postfix/smtpd[6010]: connect from unknown[151.2.117.166] Apr 12 17:20:32 experts postfix/smtpd[6010]: match_list_match: unknown: no match Apr 12 17:20:32 experts postfix/smtpd[6010]: match_list_match: 151.2.117.166: no match Apr 12 17:20:32 experts postfix/smtpd[6010]: match_list_match: unknown: no match Apr 12 17:20:32 experts postfix/smtpd[6010]: match_list_match: 151.2.117.166: no match Apr 12 17:20:32 experts postfix/smtpd[6010]: match_hostname: unknown ~? 151.2.0.0/16 Apr 12 17:20:32 experts postfix/smtpd[6010]: match_hostaddr: 151.2.117.166 ~? 151.2.0.0/16 Apr 12 17:20:32 experts postfix/smtpd[6010]: > unknown[151.2.117.166]: 220 experts.linux.com ESMTP Postfix Apr 12 17:20:32 experts postfix/smtpd[6010]: < unknown[151.2.117.166]: EHLO aravind Apr 12 17:20:32 experts postfix/smtpd[6010]: > unknown[151.2.117.166]: 250-experts.linux.com Apr 12 17:20:32 experts postfix/smtpd[6010]: > unknown[151.2.117.166]: 250-PIPELINING Apr 12 17:20:32 experts postfix/smtpd[6010]: > unknown[151.2.117.166]: 250-SIZE 10240000 Apr 12 17:20:32 experts postfix/smtpd[6010]: > unknown[151.2.117.166]: 250-VRFY Apr 12 17:20:32 experts postfix/smtpd[6010]: > unknown[151.2.117.166]: 250-ETRN Apr 12 17:20:32 experts postfix/smtpd[6010]: > unknown[151.2.117.166]: 250-AUTH LOGIN CRAM-MD5 NTLM GSSAPI DIGEST-MD5 PLAIN Apr 12 17:20:32 experts postfix/smtpd[6010]: match_list_match: unknown: no match Apr 12 17:20:32 experts postfix/smtpd[6010]: match_list_match: 151.2.117.166: no match Apr 12 17:20:32 experts postfix/smtpd[6010]: > unknown[151.2.117.166]: 250-AUTH=LOGIN CRAM-MD5 NTLM GSSAPI DIGEST-MD5 PLAIN Apr 12 17:20:32 experts postfix/smtpd[6010]: > unknown[151.2.117.166]: 250 8BITMIME Apr 12 17:20:32 experts postfix/smtpd[6010]: < unknown[151.2.117.166]: AUTH NTLM Apr 12 17:20:32 experts postfix/smtpd[6010]: smtpd_sasl_authenticate: sasl_method NTLM Apr 12 17:20:32 experts postfix/smtpd[6010]: smtpd_sasl_authenticate: uncoded challenge: Apr 12 17:20:32 experts postfix/smtpd[6010]: > unknown[151.2.117.166]: 334 Apr 12 17:20:32 experts postfix/smtpd[6010]: < unknown[151.2.117.166]: TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAFASgKAAAADw== Apr 12 17:20:32 experts postfix/smtpd[6010]: smtpd_sasl_authenticate: decoded response: NTLMSSP Apr 12 17:20:32 experts postfix/smtpd[6010]: smtpd_sasl_authenticate: uncoded challenge: NTLMSSP Apr 12 17:20:32 experts postfix/smtpd[6010]: > unknown[151.2.117.166]: 334 TlRMTVNTUAACAAAAIgAiADAAAAAFggIAPnghBvgGfvEAAAAAAAAAAAAAAAAAAAAARQBYAFAARQBSAFQAUwAuAEwASQBOAFUAWAAuAEMATwBNAA== Apr 12 17:20:32 experts postfix/smtpd[6010]: < unknown[151.2.117.166]: TlRMTVNTUAADAAAAGAAYAF4AAAAYABgAdgAAAAAAAABIAAAACAAIAEgAAAAOAA4AUAAAAAAAAACOAAAABYIAAgUBKAoAAAAPcwBhAGoAdQBBAFIAQQBWAEkATgBEAFJPl9ZLA1BtNohiKVmLgNtBPl0/ zPjlEjMgU4lgCqJ5FET4UeQQCdR/uCK1hQRvew== Apr 12 17:20:32 experts postfix/smtpd[6010]: smtpd_sasl_authenticate: decoded response: NTLMSSP Apr 12 17:20:32 experts postfix/smtpd[6010]: > unknown[151.2.117.166]: 235 Authentication successful Apr 12 17:20:32 experts postfix/smtpd[6010]: < unknown[151.2.117.166]: MAIL FROM: <saju(a)linux.com> Apr 12 17:20:32 experts postfix/smtpd[6010]: extract_addr: input: <saju(a)linux.com> Apr 12 17:20:32 experts postfix/smtpd[6010]: smtpd_check_addr: addr=saju(a)linux.com Apr 12 17:20:32 experts postfix/smtpd[6010]: connect to subsystem private/rewrite Apr 12 17:20:32 experts postfix/smtpd[6010]: send attr request = rewrite Apr 12 17:20:32 experts postfix/smtpd[6010]: send attr rule = local Apr 12 17:20:32 experts postfix/smtpd[6010]: send attr address = saju(a)linux.com Apr 12 17:20:32 experts postfix/smtpd[6010]: private/rewrite socket: wanted attribute: flags Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: flags Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute value: 0 Apr 12 17:20:32 experts postfix/smtpd[6010]: private/rewrite socket: wanted attribute: address Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: address Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute value: saju(a)linux.com Apr 12 17:20:32 experts postfix/smtpd[6010]: private/rewrite socket: wanted attribute: (list terminator) Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: (end) Apr 12 17:20:32 experts postfix/smtpd[6010]: rewrite_clnt: local: saju(a)linux.com -> saju(a)linux.com Apr 12 17:20:32 experts postfix/smtpd[6010]: send attr request = resolve Apr 12 17:20:32 experts postfix/smtpd[6010]: send attr address = saju(a)linux.com Apr 12 17:20:32 experts postfix/smtpd[6010]: private/rewrite socket: wanted attribute: flags Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: flags Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute value: 0 Apr 12 17:20:32 experts postfix/smtpd[6010]: private/rewrite socket: wanted attribute: transport Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: transport Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute value: smtp Apr 12 17:20:32 experts postfix/smtpd[6010]: private/rewrite socket: wanted attribute: nexthop Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: nexthop Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute value: linux.com Apr 12 17:20:32 experts postfix/smtpd[6010]: private/rewrite socket: wanted attribute: recipient Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: recipient Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute value: saju(a)linux.com Apr 12 17:20:32 experts postfix/smtpd[6010]: private/rewrite socket: wanted attribute: flags Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: flags Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute value: 4096 Apr 12 17:20:32 experts postfix/smtpd[6010]: private/rewrite socket: wanted attribute: (list terminator) Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: (end) Apr 12 17:20:32 experts postfix/smtpd[6010]: resolve_clnt: `saju(a)linux.com' -> transp=`smtp' host=`linux.com' rcpt=`saju(a)linux.com' flags= class=default Apr 12 17:20:32 experts postfix/smtpd[6010]: ctable_locate: install entry key saju(a)linux.com Apr 12 17:20:32 experts postfix/smtpd[6010]: extract_addr: result: saju(a)linux.com Apr 12 17:20:32 experts postfix/smtpd[6010]: fsspace: .: block size 4096, blocks free 55825 Apr 12 17:20:32 experts postfix/smtpd[6010]: smtpd_check_size: blocks 4096 avail 55825 min_free 0 msg_size_limit 10240000 Apr 12 17:20:32 experts postfix/smtpd[6010]: > unknown[151.2.117.166]: 250 Ok Apr 12 17:20:32 experts postfix/smtpd[6010]: < unknown[151.2.117.166]: RCPT TO: <saurav(a)linux.com> Apr 12 17:20:32 experts postfix/smtpd[6010]: extract_addr: input: <saurav(a)linux.com> Apr 12 17:20:32 experts postfix/smtpd[6010]: smtpd_check_addr: addr=saurav(a)linux.com Apr 12 17:20:32 experts postfix/smtpd[6010]: send attr request = rewrite Apr 12 17:20:32 experts postfix/smtpd[6010]: send attr rule = local Apr 12 17:20:32 experts postfix/smtpd[6010]: send attr address = saurav(a)linux.com Apr 12 17:20:32 experts postfix/smtpd[6010]: private/rewrite socket: wanted attribute: flags Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: flags Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute value: 0 Apr 12 17:20:32 experts postfix/smtpd[6010]: private/rewrite socket: wanted attribute: address Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: address Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute value: saurav(a)linux.com Apr 12 17:20:32 experts postfix/smtpd[6010]: private/rewrite socket: wanted attribute: (list terminator) Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: (end) Apr 12 17:20:32 experts postfix/smtpd[6010]: rewrite_clnt: local: saurav(a)linux.com -> saurav(a)linux.com Apr 12 17:20:32 experts postfix/smtpd[6010]: send attr request = resolve Apr 12 17:20:32 experts postfix/smtpd[6010]: send attr address = saurav(a)linux.com Apr 12 17:20:32 experts postfix/smtpd[6010]: private/rewrite socket: wanted attribute: flags Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: flags Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute value: 0 Apr 12 17:20:32 experts postfix/smtpd[6010]: private/rewrite socket: wanted attribute: transport Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: transport Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute value: smtp Apr 12 17:20:32 experts postfix/smtpd[6010]: private/rewrite socket: wanted attribute: nexthop Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: nexthop Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute value: linux.com Apr 12 17:20:32 experts postfix/smtpd[6010]: private/rewrite socket: wanted attribute: recipient Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: recipient Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute value: saurav(a)linux.com Apr 12 17:20:32 experts postfix/smtpd[6010]: private/rewrite socket: wanted attribute: flags Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: flags Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute value: 4096 Apr 12 17:20:32 experts postfix/smtpd[6010]: private/rewrite socket: wanted attribute: (list terminator) Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: (end) Apr 12 17:20:32 experts postfix/smtpd[6010]: resolve_clnt: `saurav(a)linux.com' -> transp=`smtp' host=`linux.com' rcpt=`saurav(a)linux.com' flags= class=default Apr 12 17:20:32 experts postfix/smtpd[6010]: ctable_locate: install entry key saurav(a)linux.com Apr 12 17:20:32 experts postfix/smtpd[6010]: extract_addr: result: saurav(a)linux.com Apr 12 17:20:32 experts postfix/smtpd[6010]: send attr request = rewrite Apr 12 17:20:32 experts postfix/smtpd[6010]: send attr rule = local Apr 12 17:20:32 experts postfix/smtpd[6010]: send attr address = postmaster Apr 12 17:20:32 experts postfix/smtpd[6010]: private/rewrite socket: wanted attribute: flags Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: flags Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute value: 0 Apr 12 17:20:32 experts postfix/smtpd[6010]: private/rewrite socket: wanted attribute: address Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: address Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute value: postmaster(a)linux.com Apr 12 17:20:32 experts postfix/smtpd[6010]: private/rewrite socket: wanted attribute: (list terminator) Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: (end) Apr 12 17:20:32 experts postfix/smtpd[6010]: rewrite_clnt: local: postmaster -> postmaster(a)linux.com Apr 12 17:20:32 experts postfix/smtpd[6010]: >>> START Recipient address RESTRICTIONS <<< Apr 12 17:20:32 experts postfix/smtpd[6010]: generic_checks: name=permit_sasl_authenticated Apr 12 17:20:32 experts postfix/smtpd[6010]: generic_checks: name=permit_sasl_authenticated status=1 Apr 12 17:20:32 experts postfix/smtpd[6010]: >>> CHECKING RECIPIENT MAPS <<< Apr 12 17:20:32 experts postfix/smtpd[6010]: ctable_locate: leave existing entry key saurav(a)linux.com Apr 12 17:20:32 experts postfix/smtpd[6010]: maps_find: recipient_canonical_maps: saurav(a)linux.com: not found Apr 12 17:20:32 experts postfix/smtpd[6010]: maps_find: recipient_canonical_maps: saurav: not found Apr 12 17:20:32 experts postfix/smtpd[6010]: maps_find: recipient_canonical_maps: @linux.com: not found Apr 12 17:20:32 experts postfix/smtpd[6010]: mail_addr_find: saurav(a)linux.com -> (not found) Apr 12 17:20:32 experts postfix/smtpd[6010]: maps_find: canonical_maps: saurav(a)linux.com: not found Apr 12 17:20:32 experts postfix/smtpd[6010]: maps_find: canonical_maps: saurav: not found Apr 12 17:20:32 experts postfix/smtpd[6010]: maps_find: canonical_maps: @linux.com: not found Apr 12 17:20:32 experts postfix/smtpd[6010]: mail_addr_find: saurav(a)linux.com -> (not found) Apr 12 17:20:32 experts postfix/smtpd[6010]: maps_find: virtual_alias_maps: saurav(a)linux.com: not found Apr 12 17:20:32 experts postfix/smtpd[6010]: maps_find: virtual_alias_maps: saurav: not found Apr 12 17:20:32 experts postfix/smtpd[6010]: maps_find: virtual_alias_maps: @linux.com: not found Apr 12 17:20:32 experts postfix/smtpd[6010]: mail_addr_find: saurav(a)linux.com -> (not found) Apr 12 17:20:32 experts postfix/smtpd[6010]: smtpd_check_rewrite: trying: permit_inet_interfaces Apr 12 17:20:32 experts postfix/smtpd[6010]: permit_inet_interfaces: unknown 151.2.117.166 Apr 12 17:20:32 experts postfix/smtpd[6010]: before input_transp_cleanup: cleanup flags = enable_header_body_filter enable_automatic_bcc enable_address_mapping Apr 12 17:20:32 experts postfix/smtpd[6010]: after input_transp_cleanup: cleanup flags = enable_header_body_filter enable_automatic_bcc enable_address_mapping Apr 12 17:20:32 experts postfix/smtpd[6010]: connect to subsystem public/cleanup Apr 12 17:20:32 experts postfix/smtpd[6010]: public/cleanup socket: wanted attribute: queue_id Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: queue_id Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute value: 431A52ECEA Apr 12 17:20:32 experts postfix/smtpd[6010]: public/cleanup socket: wanted attribute: (list terminator) Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: (end) Apr 12 17:20:32 experts postfix/smtpd[6010]: send attr flags = 50 Apr 12 17:20:32 experts postfix/smtpd[6010]: 431A52ECEA: client=unknown[151.2.117.166], sasl_method=NTLM, sasl_username=saju(a)experts.linux.com Apr 12 17:20:32 experts postfix/smtpd[6010]: > unknown[151.2.117.166]: 250 Ok Apr 12 17:20:32 experts postfix/smtpd[6010]: < unknown[151.2.117.166]: DATA Apr 12 17:20:32 experts postfix/smtpd[6010]: > unknown[151.2.117.166]: 354 End data with <CR><LF>.<CR><LF> Apr 12 17:20:32 experts postfix/smtpd[6010]: public/cleanup socket: wanted attribute: status Apr 12 17:20:32 experts postfix/cleanup[6013]: 431A52ECEA: message- id=<000001c89c93$800efa90$802cefb0$@com> Apr 12 17:20:32 experts postfix/qmgr[5876]: 431A52ECEA: from=<saju(a)linux.com>, size=2672, nrcpt=1 (queue active) Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: status Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute value: 0 Apr 12 17:20:32 experts postfix/smtpd[6010]: public/cleanup socket: wanted attribute: reason Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: reason Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute value: (end) Apr 12 17:20:32 experts postfix/smtpd[6010]: public/cleanup socket: wanted attribute: (list terminator) Apr 12 17:20:32 experts postfix/smtpd[6010]: input attribute name: (end) Apr 12 17:20:32 experts postfix/smtpd[6010]: > unknown[151.2.117.166]: 250 Ok: queued as 431A52ECEA Apr 12 17:20:32 experts postfix/smtp[6014]: 431A52ECEA: to=<saurav(a)linux.com>, relay=rules.linux.com[151.2.119.150], delay=0, status=bounced (host rules.linux.com[151.2.119.150] said: 550 <saurav(a)linux.com>: Recipient address rejected: User unknown in local recipient table (in reply to RCPT TO command)) Apr 12 17:20:32 experts postfix/cleanup[6013]: 917512ECF0: message- id=<20080412115032.917512ECF0(a)experts.linux.com> Apr 12 17:20:32 experts postfix/qmgr[5876]: 917512ECF0: from=<>, size=4589, nrcpt=1 (queue active) Apr 12 17:20:32 experts postfix/qmgr[5876]: 431A52ECEA: removed Apr 12 17:20:32 experts postfix/smtp[6014]: 917512ECF0: to=<saju(a)linux.com>, relay=rules.linux.com[151.2.119.150], delay=0, status=bounced (host rules.linux.com[151.2.119.150] said: 550 <saju(a)linux.com>: Recipient address rejected: User unknown in local recipient table (in reply to RCPT TO command)) Apr 12 17:20:32 experts postfix/qmgr[5876]: 917512ECF0: removed Apr 12 17:20:34 experts postfix/smtpd[6010]: < unknown[151.2.117.166]: QUIT Apr 12 17:20:34 experts postfix/smtpd[6010]: > unknown[151.2.117.166]: 221 Bye Apr 12 17:20:34 experts postfix/smtpd[6010]: match_hostname: unknown ~? 151.2.0.0/16 Apr 12 17:20:34 experts postfix/smtpd[6010]: match_hostaddr: 151.2.117.166 ~? 151.2.0.0/16 Apr 12 17:20:34 experts postfix/smtpd[6010]: disconnect from unknown[151.2.117.166] Apr 12 17:20:34 experts postfix/smtpd[6010]: master_notify: status 1 Apr 12 17:20:34 experts postfix/smtpd[6010]: connection closed

1 0

Re: OpenLDAP 2.3 Make Test Failed
by Luke Lee 14 Apr '08

14 Apr '08

Thank you for the suggestion. I followed your instructions and was able to successfully complete the make test. Thanks again! Luke ----- Original Message ---- From: Quanah Gibson-Mount <quanah(a)zimbra.com> To: Luke Lee <leeluke77(a)yahoo.com>; openldap-technical(a)openldap.org Sent: Friday, April 11, 2008 5:10:35 PM Subject: Re: OpenLDAP 2.3 Make Test Failed --On Friday, April 11, 2008 5:06 PM -0700 Luke Lee <leeluke77(a)yahoo.com> wrote: > > > Hi Quanah, > > Thank you for the response. > > I have the following set when I ran the configure: I suggest you compare your LD_FLAGS line with mine. You're missing some important options. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

Dynlist and roles/groups
by Ashley Penney 14 Apr '08

14 Apr '08

Hi, I'm not sure if this is exactly the right list, but I'm stuck trying to implement something at work and I'm hoping someone can help me. Background: We have an existing openldap setup that uses roles rather than groups to determine who gets what. We have people under ou=People, and roles under ou=Roles. Here's parts of my person object: dn: uid=apenney,ou=People,dc=law,dc=harvard,dc=edu objectClass: hostObject objectClass: inetOrgPerson objectClass: lawHarvardEduPerson objectClass: organizationalPerson objectClass: person objectClass: posixAccount objectClass: qmailUser objectClass: shadowAccount objectClass: top cn: Ashley Penney isMemberOf: cn=SFTP User:member,ou=Roles,dc=law,dc=harvard,dc=edu isMemberOf: cn=SFTPUser,ou=Roles,dc=law,dc=harvard,dc=edu Here's cn=SFTPUser,ou=Roles dn: cn=SFTPUser,ou=Roles,dc=law,dc=harvard,dc=edu objectClass: lawHarvardEduRole objectClass: organizationalUnit objectClass: posixGroup objectClass: top cn: SFTPUser gidNumber: 24 ou: Roles ou: Xythos description: Indicates that a user has SFTP access. displayName: SFTP User (SFTP User) What I want to be able to do, via nss_ldap, is to interate over the isMemberOf entries, and check the cn=x,ou=roles for a posixGroup. I've managed to get it building a search of the form: SRCHbase="ou=Roles,dc=law,dc=harvard,dc=edu" scope=2deref=3filter="(|distinguishedName=cn=sftpuser:member,ou=roles,dc=law,dc=harvard,dc=edu)(distinguishedName=cn=sftpuser,ou=roles,dc=law,dc=harvard,dc=edu))" It then does a SRCHattr=objectClass lookup, but this fails. My understanding is this requires some support in openldap itself, and I can't figure out if this is provided or not. So, my alternative method is to build a dynamic list up, from my understanding, and have it build me a dynamic sftp-users group. I cannot figure out what values I would map however, and I'd appreciate any assistance anyone can offer.

1 0

creating attributes in new objectclass
by Christophe Dumonet 14 Apr '08

14 Apr '08

Hello, I have created a new objectclass for my company, and added some new attributes. Slapd restarts well, I can create new attributes with values in dns, but When I want to search with the attribute with an ldapsearch or another tools (postfix ), these attributes are not find. for example : I got no answer with : ldapsearch -x -b "ou=people,dc=ifma,dc=fr" -H ldap://172.16.10.92 -D "cn=admin,dc=ifma,dc=fr" -W -LLL "(backupmail1=dumonet(a)backup1.ifma.fr)" uid ( While I see in a ldap browser an attribute backupmail1 with dumonet(a)backup1.ifma.fr in value , and got an uid ! ) My objectclass is in a new schema : , and is included in slapd.conf by include /etc/ldap/schema/ifma.schema vi ifma.schema : #schema local IFMA #Date : 23/01/2008 #Author: Christophe Dumonet - IFMA # # CLASS IFMA # attributetype ( 1.3.6.1.4.1.7135.1.3.7.103 NAME 'pathbackupmail1' DESC 'chemin pour backupmail1' SYNTAX 1.3.6.1.4.1.1466.115.121.1.50 ) attributetype ( 1.3.6.1.4.1.7135.1.3.7.102 NAME 'backupmail1' DESC 'Adresse mail fictive pour backup mail 1 en temps reel' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) objectclass ( 1.3.6.1.4.1.7135.1.3.7.1 NAME 'ifma' SUP top AUXILIARY DESC 'classe d infos ifma' MAY ( backupmail1 $ pathbackupmail1 )) Why ? Is my schema not well created, my syntax ? other , I work with openldap 2.3.30 , thanks for answer ! Christophe Dumonet. -- ---------------------------------------------------- Christophe Dumonet Centre de Ressources Informatiques Institut Francais de Mecanique Avancee (IFMA) Campus des Cezeaux BP 265 63175 AUBIERE Cedex Tel : +33 - 4.73.28.80.64 Fax : +33 - 4.73.28.81.00 Mail : Christophe.Dumonet(a)ifma.fr ----------------------------------------------------

2 2

Getting output from proxied Active Directory connection
by Clemson, Chris (IHG) 14 Apr '08

14 Apr '08

Please excuse the long email, but I wanted to include everything that might be useful for a diagnosis: I am having trouble setting up my OpenLDAP proxy. Eventually, I would like it to authenticate to our domain controller using idassert-bind, but I'm not worried about that at the moment. When I issue an ldapsearch command against the domain controller: ldapsearch -Hldap://LOCALDC -b "" -s base -x -D "cn=Chris Clemson,ou=users,ou=SITE,ou=Corp,ou=Service Delivery,DC=emea,DC=corp,DC=local" -W It works and I get a reply. When I try it via slapd (running on my machine), It seems to authenticate me ok (wrong passwords and "-D" options return errors), but I don't get my details back, other than a success and no results: ldapsearch -b "" -s base -x -D "cn=Chris Clemson,ou=users,ou=SITE,ou=Corp,ou=Service Delivery ,DC=emea,DC=corp,DC=local" -W '(samaccountname=clemsoc)' Enter LDAP Password: # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (samaccountname=clemsoc) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 "ldapsearch -b "" -s base -x '(samaccountname=clemsoc)'" also returns the same result. When I do the following (ie, not search for anything): ldapsearch -b "" -s base -x -D "cn=Chris Clemson,ou=users,ou=SITE,ou=Corp,ou=Service Delivery,DC=emea,DC=corp,DC=local" -W I get the following output: Enter LDAP Password: # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: ALL # # dn: objectClass: top objectClass: OpenLDAProotDSE # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 I am running slapd with -d 9, but can't really see anything that helps me. I guess I am missing something, or am not specific enough with my Base DN. Basically, all my users (that I want to search for) are in various OUs under the "Service Delivery" OU in Active Directory. Ldap.conf --------- BASE ou=Service Delivery, dc=emea, dc=corp, dc=local URI ldap://MYMACHINE Slapd.conf ---------- include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/MSOutlook.schema <- custom one I found on for other attributes pidfile /var/openldap/run/slapd.pid argsfile /var/openldap/run/slapd.args Moduleload back_ldap.la access to * by * read database ldap uri ldap://LOCALDC suffix "dc=emea,dc=corp,dc=local" idassert-bind bindmethod=simple binddn="cn=OpenLDAP Access Account,cn=users,DC=emea,DC=corp,DC=local" credentials="xxxxx" mode=none Below is the "slapd -d 9" output of a request attempt: @(#) $OpenLDAP: slapd 2.3.39 (Nov 24 2007 18:26:23) $ vzell@vzell-de:/usr/src/openldap-2.3.39-1/build/servers/slapd daemon_init: listen on ldap:/// daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap:///) daemon: listener initialized ldap:/// daemon_init: 1 listeners opened slapd init: initiated server. slap_sasl_init: initialized! bdb_back_initialize: initialize BDB backend bdb_back_initialize: Berkeley DB 4.5.20: (December 17, 2007) hdb_back_initialize: initialize HDB backend hdb_back_initialize: Berkeley DB 4.5.20: (December 17, 2007) ldap_url_parse_ext(ldap://LOCALDC) >>> dnPrettyNormal: <dc=emea,dc=corp,dc=local> <<< dnPrettyNormal: <dc=emea,dc=corp,dc=local>, <dc=emea,dc=corp,dc=local> >>> dnNormalize: <cn=OpenLDAP Access Account,cn=users,DC=emea,DC=corp,DC=local> <<< dnNormalize: <cn=openldap access account,cn=users,dc=emea,dc=corp,dc=local> >>> dnNormalize: <cn=Subschema> <<< dnNormalize: <cn=subschema> matching_rule_use_init 1.2.840.113556.1.4.804 (integerBitOrMatch): matchingRuleUse: ( 1.2.840.113556.1.4.804 NAME 'integerBitOrMatch' APPLIES ( supportedLDAPVersion $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcDbCacheFree $ olcDbCacheSize $ olcDbIDLcacheSize $ olcDbMode $ olcDbSearchStack $ olcDbShmKey $ olcChainMaxReferralDepth $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ reqResult $ reqId $ reqVersion $ reqSizeLimit $ reqTimeLimit $ reqEntries $ olcProxyCacheQueries $ errCode $ errSleepTime $ olcSpSessionlog $ mailPreferenceOption ) ) 1.2.840.113556.1.4.803 (integerBitAndMatch): matchingRuleUse: ( 1.2.840.113556.1.4.803 NAME 'integerBitAndMatch' APPLIES ( supportedLDAPVersion $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcDbCacheFree $ olcDbCacheSize $ olcDbIDLcacheSize $ olcDbMode $ olcDbSearchStack $ olcDbShmKey $ olcChainMaxReferralDepth $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ reqResult $ reqId $ reqVersion $ reqSizeLimit $ reqTimeLimit $ reqEntries $ olcProxyCacheQueries $ errCode $ errSleepTime $ olcSpSessionlog $ mailPreferenceOption ) ) 1.3.6.1.4.1.1466.109.114.2 (caseIgnoreIA5Match): matchingRuleUse: ( 1.3.6.1.4.1.1466.109.114.2 NAME 'caseIgnoreIA5Match' APPLIES ( altServer $ mail $ dc $ associatedDomain $ email $ aRecord $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMailbox ) ) 1.3.6.1.4.1.1466.109.114.1 (caseExactIA5Match): matchingRuleUse: ( 1.3.6.1.4.1.1466.109.114.1 NAME 'caseExactIA5Match' APPLIES ( altServer $ mail $ dc $ associatedDomain $ email $ aRecord $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMailbox ) ) 2.5.13.35 (certificateMatch): matchingRuleUse: ( 2.5.13.35 NAME 'certificateMatch' APPLIES ( userCertificate $ cACertificate ) ) 2.5.13.34 (certificateExactMatch): matchingRuleUse: ( 2.5.13.34 NAME 'certificateExactMatch' APPLIES ( userCertificate $ cACertificate ) ) 2.5.13.30 (objectIdentifierFirstComponentMatch): matchingRuleUse: ( 2.5.13.30 NAME 'objectIdentifierFirstComponentMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ ldapSyntaxes $ supportedApplicationContext ) ) 2.5.13.29 (integerFirstComponentMatch): matchingRuleUse: ( 2.5.13.29 NAME 'integerFirstComponentMatch' APPLIES ( supportedLDAPVersion $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcDbCacheFree $ olcDbCacheSize $ olcDbIDLcacheSize $ olcDbMode $ olcDbSearchStack $ olcDbShmKey $ olcChainMaxReferralDepth $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ reqResult $ reqId $ reqVersion $ reqSizeLimit $ reqTimeLimit $ reqEntries $ olcProxyCacheQueries $ errCode $ errSleepTime $ olcSpSessionlog $ mailPreferenceOption ) ) 2.5.13.27 (generalizedTimeMatch): matchingRuleUse: ( 2.5.13.27 NAME 'generalizedTimeMatch' APPLIES ( createTimestamp $ modifyTimestamp $ reqStart $ reqEnd $ pwdChangedTime $ pwdAccountLockedTime $ pwdFailureTime $ pwdGraceUseTime ) ) 2.5.13.24 (protocolInformationMatch): matchingRuleUse: ( 2.5.13.24 NAME 'protocolInformationMatch' APPLIES protocolInformation ) 2.5.13.23 (uniqueMemberMatch): matchingRuleUse: ( 2.5.13.23 NAME 'uniqueMemberMatch' APPLIES uniqueMember ) 2.5.13.22 (presentationAddressMatch): matchingRuleUse: ( 2.5.13.22 NAME 'presentationAddressMatch' APPLIES presentationAddress ) 2.5.13.20 (telephoneNumberMatch): matchingRuleUse: ( 2.5.13.20 NAME 'telephoneNumberMatch' APPLIES ( telephoneNumber $ homePhone $ mobile $ pager $ otherFacsimiletelephoneNumber $ IPPhone ) ) 2.5.13.17 (octetStringMatch): matchingRuleUse: ( 2.5.13.17 NAME 'octetStringMatch' APPLIES ( userPassword $ reqControls $ reqRespControls $ reqMod $ reqOld $ reqData $ pwdHistory $ queryid ) ) 2.5.13.16 (bitStringMatch): matchingRuleUse: ( 2.5.13.16 NAME 'bitStringMatch' APPLIES x500UniqueIdentifier ) 2.5.13.14 (integerMatch): matchingRuleUse: ( 2.5.13.14 NAME 'integerMatch' APPLIES ( supportedLDAPVersion $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcDbCacheFree $ olcDbCacheSize $ olcDbIDLcacheSize $ olcDbMode $ olcDbSearchStack $ olcDbShmKey $ olcChainMaxReferralDepth $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ reqResult $ reqId $ reqVersion $ reqSizeLimit $ reqTimeLimit $ reqEntries $ olcProxyCacheQueries $ errCode $ errSleepTime $ olcSpSessionlog $ mailPreferenceOption ) ) 2.5.13.13 (booleanMatch): matchingRuleUse: ( 2.5.13.13 NAME 'booleanMatch' APPLIES ( hasSubordinates $ olcGentleHUP $ olcLastMod $ olcReadOnly $ olcReverseLookup $ olcDbNoSync $ olcDbDirtyRead $ olcDbLinearIndex $ olcChainCacheURI $ olcChainReturnError $ olcDbRebindAsUser $ olcDbChaseReferrals $ olcDbProxyWhoAmI $ olcDbSingleConn $ olcDbUseTemporaryConn $ olcAccessLogSuccess $ reqDeleteOldRDN $ reqAttrsOnly $ pwdReset $ olcPPolicyHashCleartext $ olcPPolicyUseLockout $ olcSpNoPresent $ olcSpReloadHint ) ) 2.5.13.11 (caseIgnoreListMatch): matchingRuleUse: ( 2.5.13.11 NAME 'caseIgnoreListMatch' APPLIES ( postalAddress $ registeredAddress $ homePostalAddress ) ) 2.5.13.8 (numericStringMatch): matchingRuleUse: ( 2.5.13.8 NAME 'numericStringMatch' APPLIES ( x121Address $ internationaliSDNNumber ) ) 2.5.13.7 (caseExactSubstringsMatch): matchingRuleUse: ( 2.5.13.7 NAME 'caseExactSubstringsMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.6 (caseExactOrderingMatch): matchingRuleUse: ( 2.5.13.6 NAME 'caseExactOrderingMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.5 (caseExactMatch): matchingRuleUse: ( 2.5.13.5 NAME 'caseExactMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcInclude $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcSizeLimit $ olcSrvtab $ olcSubordinate $ olcSyncrepl $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbConfig $ olcDbIndex $ olcDbLockDetect $ olcDbURI $ olcDbStartTLS $ olcDbACLPasswd $ olcDbACLBind $ olcDbIDAssertPasswd $ olcDbIDAssertBind $ olcDbIDAssertMode $ olcDbIDAssertAuthzFrom $ olcDbTFSupport $ olcDbTimeout $ olcDbIdleTimeout $ olcDbConnTtl $ olcDbNetworkTimeout $ olcDbCancel $ olcDbQuarantine $ olcAccessLogOps $ olcAccessLogPurge $ olcAccessLogOld $ reqType $ reqSession $ reqMessage $ reqReferral $ reqMethod $ reqAssertion $ reqScope $ reqDerefAliases $ reqFilter $ reqAttr $ olcAuditlogFile $ olcDLattrSet $ olcProxyCache $ olcProxyAttrset $ olcProxyTemplate $ olcProxyResponseCB $ errOp $ errText $ olcSpCheckpoint $ olcValSortAttr $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName $ destinationIndicator $ givenName $ initials $ generationQualifier $ dnQualifier $ houseIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info $ drink $ roomNumber $ userClass $ host $ documentIdentifier $ documentTitle $ documentVersion $ documentLocation $ personalTitle $ co $ uniqueIdentifier $ organizationalStatus $ buildingName $ documentPublisher $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ preferredLanguage $ rdn $ URL $ comment $ conferenceInformation ) ) 2.5.13.4 (caseIgnoreSubstringsMatch): matchingRuleUse: ( 2.5.13.4 NAME 'caseIgnoreSubstringsMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.3 (caseIgnoreOrderingMatch): matchingRuleUse: ( 2.5.13.3 NAME 'caseIgnoreOrderingMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.2 (caseIgnoreMatch): matchingRuleUse: ( 2.5.13.2 NAME 'caseIgnoreMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcInclude $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcSizeLimit $ olcSrvtab $ olcSubordinate $ olcSyncrepl $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbConfig $ olcDbIndex $ olcDbLockDetect $ olcDbURI $ olcDbStartTLS $ olcDbACLPasswd $ olcDbACLBind $ olcDbIDAssertPasswd $ olcDbIDAssertBind $ olcDbIDAssertMode $ olcDbIDAssertAuthzFrom $ olcDbTFSupport $ olcDbTimeout $ olcDbIdleTimeout $ olcDbConnTtl $ olcDbNetworkTimeout $ olcDbCancel $ olcDbQuarantine $ olcAccessLogOps $ olcAccessLogPurge $ olcAccessLogOld $ reqType $ reqSession $ reqMessage $ reqReferral $ reqMethod $ reqAssertion $ reqScope $ reqDerefAliases $ reqFilter $ reqAttr $ olcAuditlogFile $ olcDLattrSet $ olcProxyCache $ olcProxyAttrset $ olcProxyTemplate $ olcProxyResponseCB $ errOp $ errText $ olcSpCheckpoint $ olcValSortAttr $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName $ destinationIndicator $ givenName $ initials $ generationQualifier $ dnQualifier $ houseIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info $ drink $ roomNumber $ userClass $ host $ documentIdentifier $ documentTitle $ documentVersion $ documentLocation $ personalTitle $ co $ uniqueIdentifier $ organizationalStatus $ buildingName $ documentPublisher $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ preferredLanguage $ rdn $ URL $ comment $ conferenceInformation ) ) 1.2.36.79672281.1.13.3 (rdnMatch): 2.5.13.1 (distinguishedNameMatch): matchingRuleUse: ( 2.5.13.1 NAME 'distinguishedNameMatch' APPLIES ( creatorsName $ modifiersName $ subschemaSubentry $ namingContexts $ aliasedObjectName $ distinguishedName $ seeAlso $ olcDefaultSearchBase $ olcRootDN $ olcSchemaDN $ olcSuffix $ olcUpdateDN $ olcDbACLAuthcDn $ olcDbIDAssertAuthcDn $ olcAccessLogDB $ reqDN $ reqAuthzID $ reqNewRDN $ reqNewSuperior $ pwdPolicySubentry $ olcPPolicyDefault $ errMatchedDN $ member $ owner $ roleOccupant $ manager $ documentAuthor $ secretary $ associatedName $ dITRedirect $ reports ) ) 2.5.13.0 (objectIdentifierMatch): matchingRuleUse: ( 2.5.13.0 NAME 'objectIdentifierMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ supportedApplicationContext ) ) slapd startup: initiated. backend_startup_one: starting "cn=config" config_back_db_open config_build_entry: "cn=config" config_build_entry: "cn=include{0}" config_build_entry: "cn=include{1}" config_build_entry: "cn=include{2}" config_build_entry: "cn=include{3}" config_build_entry: "cn=schema" config_build_entry: "cn={0}core" config_build_entry: "cn={1}cosine" config_build_entry: "cn={2}inetorgperson" config_build_entry: "cn={3}MSOutlook" config_build_entry: "olcDatabase={-1}frontend" config_build_entry: "olcDatabase={0}config" config_build_entry: "olcDatabase={1}ldap" backend_startup_one: starting "dc=emea,dc=corp,dc=local" ldap_back_db_open: URI=ldap://LOCALDC slapd starting daemon: added 3r listener=0x0 daemon: added 5r listener=0x10041fc8 daemon: select: listen=5 active_threads=0 tvp=NULL daemon: activity on 1 descriptor >>> slap_listener(ldap:///) daemon: listen=5, new connection on 6 daemon: added 6r (active) listener=0x0 daemon: select: listen=5 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: 6r daemon: read activity on 6 connection_get(6): got connid=0 connection_read(6): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 121 contents: ber_get_next daemon: select: listen=5 active_threads=0 tvp=NULL do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: >>> dnPrettyNormal: <cn=Chris Clemson,ou=users,ou=SITE,ou=Corp,ou=Service Delivery,DC=emea,DC=corp,DC=local> <<< dnPrettyNormal: <cn=Chris Clemson,ou=users,ou=SITE,ou=Corp,ou=Service Delivery,dc=emea,dc=corp,dc=local>, <cn=chris clemson,ou=users,ou=SITE,ou=corp,ou=service delivery,dc=emea,dc=corp,dc=local> do_bind: version=3 dn="cn=Chris Clemson,ou=users,ou=SITE,ou=Corp,ou=Service Delivery,dc=emea,dc=corp,dc=local" method=128 ldap_create ldap_url_parse_ext(ldap://LOCALDC) =>ldap_back_getconn: conn=0 op=0: lc=0x10076828 inserted refcnt=1 rc=0 ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP LOCALDC:389 ldap_new_socket: 7 ldap_prepare_socket: 7 ldap_connect_to_host: Trying LOCALDCIP:389 ldap_connect_timeout: fd: 7 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({i) ber: ber_flush: 123 bytes to sd 7 ldap_result ld 0x100a60b0 msgid 1 ldap_chkResponseList ld 0x100a60b0 msgid 1 all 1 ldap_chkResponseList returns ld 0x100a60b0 NULL wait4msg ld 0x100a60b0 msgid 1 (timeout 100000 usec) wait4msg continue ld 0x100a60b0 msgid 1 all 1 ** ld 0x100a60b0 Connections: * host: LOCALDC port: 389 (default) refcnt: 2 status: Connected last used: Wed Apr 9 16:36:19 2008 ** ld 0x100a60b0 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 0x100a60b0 Response Queue: Empty ldap_chkResponseList ld 0x100a60b0 msgid 1 all 1 ldap_chkResponseList returns ld 0x100a60b0 NULL ldap_int_select read1msg: ld 0x100a60b0 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 16 contents: read1msg: ld 0x100a60b0 msgid 1 message type bind ber_scanf fmt ({eaa) ber: ber_scanf fmt ({eaa}) ber: new result: res_errno: 0, res_error: <>, res_matched: <> read1msg: ld 0x100a60b0 0 new referrals read1msg: mark request completed, ld 0x100a60b0 msgid 1 request done: ld 0x100a60b0 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_result ber_scanf fmt ({iaa) ber: ber_scanf fmt (}) ber: ldap_msgfree do_bind: v3 bind: "cn=Chris Clemson,ou=users,ou=SITE,ou=Corp,ou=Service Delivery,dc=emea,dc=corp,dc=local" to "cn=Chris Clemson,ou=users,ou=SITE,ou=Corp,ou=Service Delivery,dc=emea,dc=corp,dc=local" send_ldap_result: conn=0 op=0 p=3 send_ldap_response: msgid=1 tag=97 err=0 ber_flush: 14 bytes to sd 6 daemon: activity on 1 descriptor daemon: activity on: 6r daemon: read activity on 6 connection_get(6): got connid=0 connection_read(6): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 51 contents: ber_get_next do_search ber_scanf fmt ({miiiib) ber: >>> dnPrettyNormal: <> daemon: select: listen=5 active_threads=0 tvp=NULL <<< dnPrettyNormal: <>, <> ber_scanf fmt ({mm}) ber: ber_scanf fmt ({M}}) ber: send_ldap_result: conn=0 op=1 p=3 send_ldap_response: msgid=2 tag=101 err=0 ber_flush: 14 bytes to sd 6 daemon: activity on 1 descriptor daemon: activity on: 6r daemon: read activity on 6 connection_get(6): got connid=0 connection_read(6): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 5 contents: ber_get_next ber_get_next on fd 6 failed errno=0 (No error) connection_read(6): input error=-2 id=0, closing. connection_closing: readying conn=0 sd=6 for close connection_close: deferring conn=0 sd=6 daemon: select: listen=5 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: waked daemon: select: listen=5 active_threads=0 tvp=NULL do_unbind connection_resched: attempting closing conn=0 sd=6 connection_close: conn=0 sd=6 =>ldap_back_conn_destroy: fetching conn 0 daemon: removing 6 daemon: shutdown requested and initiated. daemon: closing 5 slapd shutdown: waiting for 0 threads to terminate slapd shutdown: initiated slapd destroy: freeing system resources. ldap_free_connection 1 1 ldap_send_unbind ber_flush: 7 bytes to sd 7 ldap_free_connection: actually freed slapd stopped. Thank you, Chris

1 1

problem with using OpenLDAP with GSSAPI-Kerberos against an MS AD Domain Controller
by Austin Cherian 12 Apr '08

12 Apr '08

Hi, I hope some one can answer this query regarding LDAP and GSSAPI as i really dint find substantial info for this on the net for what i was trying to accomplish. I have some limitations on using OpenLDAP with Cyrus SASL and hence have to manufacture my own GSSAPI client to use with LDAP. However i have run into some technical issues here with my implementation and MS AD. Here's my problem in short: I am using the kerberos mechanism with GSSAPI, i first use kerberos API's to get a TGT for SPN that i have obtained a keytab for previously. I then use GSSAPI gss_init_sec_context to obtain a service ticket for the ldap server. I then call ldap_init and then subsequently call ldap_sasl_bind_s with mech as GSS-SPNEGO and supplying the GSSAPI token ( obtained from gss_init_sec_context ) as credential ( i set the DN in the ldap_sasl_bind_s to NULL ). >From the network traces and the return code i see that the bind was successful. The bind result shows success (0x00) and negTokenTarg shows negResult as accept-completed. This shows that Bind was indeed a success also to note here the krb-blob that comes with the bind result is successfully consumed by subsequent calls to gss_init_sec_context to complete context establishment. The issue that im facing now is that when i pass GSS wraped search request ( i.e. i build a search request and pass it to gss_wrap API to get a token ) token to the ldap_search_ext api. From the network traces i see that the search request has been received by the ldap server properly. However the LDAP server ( MS AD LDAP server ) responds with the following message : LdapErr: DSID-0C09062.27 comment: In order to perform this operation a successful bind must be completed on the connection. Can some one please throw some light on as to why the search query is getting back with an error that there was no bind done in spite of the server responding success for the LDAP bind prior to sending the search request ?? Any help will be greatly appreciated... Thanks, Austin.

1 0

Re: OpenLDAP 2.3 Make Test Failed
by Luke Lee 12 Apr '08

12 Apr '08

Hi Quanah, Thank you for the response. I have the following set when I ran the configure: #!/bin/bash env CPPFLAGS="-I/usr/local/include -I/usr/local/zlib-1.2.3/include -I/usr/local/BerkeleyDB.4.5/include -I/usr/local/krb5-1.6.3/include -I/usr/local/ssl/include -I/usr/local/cyrus-sasl-2.1.21/include" \ LDFLAGS="-L/usr/local/lib -L/usr/local/zlib-1.2.3/lib -L/usr/local/BerkeleyDB.4.5/lib -L/usr/local/krb5-1.6.3/lib -L/usr/local/ssl/lib -L/usr/local/cyrus-sasl-2.1.21/lib" \ ../configure --with-tls --with-cyrus-sasl --enable-crypt --enable-syslog I didn't encounter a problem when I did the make depend and make. Should I set the environment when I run the make test? Please enlighten me. Thanks. Luke ----- Original Message ---- From: Quanah Gibson-Mount <quanah(a)zimbra.com> To: Luke Lee <leeluke77(a)yahoo.com>; openldap-technical(a)openldap.org Sent: Friday, April 11, 2008 4:53:42 PM Subject: Re: OpenLDAP 2.3 Make Test Failed --On Friday, April 11, 2008 4:35 PM -0700 Luke Lee <leeluke77(a)yahoo.com> wrote: > > > Hi, > > I'd like to appreciate all people who previously helped out my OpenLDAP > 2.3 build process. Now, I come to the last stage but got stuck at the > "make test" stage. It failed with the following messages: > I triled to resolve the problem by creating a symbolic link to the shared > lib under the /usr/local/ssl/lib but in vain. Can anyone please help? > I'll highly appreciate it! You need to set the run path correctly when building, so that slapd knows what paths to search to find the libraries. For example, in my OpenLDAP build, I have: LDFLAGS="-L$(OPENSSL_LIB_DIR) -L$(BDB_LIB_DIR) -L$(CYRUS_LIB_DIR) -R$(OPENSSL_LIB_DIR) -R$(BDB_LIB_DIR) -R$(CYRUS_LIB_DIR)" and when I go to make: LD_RUN_PATH=$(OPENSSL_LIB_DIR):$(BDB_LIB_DIR):$(CYRUS_LIB_DIR) $(MAKE) $(MAKEARGS); that should get you going in the right direction. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

OpenLDAP 2.3 Make Test Failed
by Luke Lee 11 Apr '08

11 Apr '08

Hi, I'd like to appreciate all people who previously helped out my OpenLDAP 2.3 build process. Now, I come to the last stage but got stuck at the "make test" stage. It failed with the following messages: cd tests; make test make[1]: Entering directory `/myopenldap/openldap-2.3.39/tests' make[2]: Entering directory `/myopenldap/openldap-2.3.39/tests' Initiating LDAP tests for BDB... Running ./scripts/all... >>>>> Executing all LDAP tests for bdb >>>>> Starting test000-rootdse ... running defines.sh Starting slapd on TCP/IP port 9011... Using ldapsearch to retrieve the root DSE... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... ../scripts/test000-rootdse: line 66: kill: (28736) - No such process .../clients/tools/ldapsearch: error while loading shared libraries: libssl.so.0.9.8: cannot open shared object file: No such file or directory >>>>> Test failed >>>>> ./scripts/test000-rootdse failed (exit 127) make[2]: *** [bdb-yes] Error 127 make[2]: Leaving directory `/myopenldap/openldap-2.3.39/tests' make[1]: *** [test] Error 2 make[1]: Leaving directory `/myopenldap/openldap-2.3.39/tests' make: *** [test] Error 2 I triled to resolve the problem by creating a symbolic link to the shared lib under the /usr/local/ssl/lib but in vain. Can anyone please help? I'll highly appreciate it! Luke __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Re: OpenLDAP 2.3 Configure Error
by Luke Lee 11 Apr '08

11 Apr '08

Hi Tommy, Thank you for the indepth information. I think that I'd better to stick with the stable OpenLDAP release. Luke ----- Original Message ---- From: Tommy Ho <tho(a)stillsecure.com> To: openldap-technical <openldap-technical(a)openldap.org> Sent: Friday, April 11, 2008 12:39:30 PM Subject: Re: OpenLDAP 2.3 Configure Error On Fri, 2008-04-11 at 11:56 -0700, Quanah Gibson-Mount wrote: > --On Friday, April 11, 2008 11:53 AM -0700 Luke Lee <leeluke77(a)yahoo.com> > wrote: > > > > > > > > > Hi Tommy, > > > > Thank you very much for the help. I also want to give thanks to whoever > > spent time reading my previous and this emails. It appears to me that I > > just couldn't find my mistake. > > > > I corrected it per your instrcution. However, I am encountering another > > error message now. The error message says: > > > OpenLDAP 2.3 does not support building with BDB 4.6. > > --Quanah > Yes, as Quanah had pointed out, the corrective action is to either 1) use BDB 4.5.20 (supported by openLDAP 2.3) or 2) use openLDAP 2.4.8 in order to use BDB 4.6.x. In either case, if your bdb libraries are not installed into /libs or /usr/libs, you'll need to set LD_LIBRARY_PATH to where BDB libraries are installed (e.g. export LD_LIBRARY_PATH= $LD_LIBRARY_PATH:/usr/local/lib) before starting configure to avoid getting the version mismatch error. Good luck, \Tommy > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Re: OpenLDAP 2.3 Configure Error
by Luke Lee 11 Apr '08

11 Apr '08

Hi Tommy, Thank you very much for the help. I also want to give thanks to whoever spent time reading my previous and this emails. It appears to me that I just couldn't find my mistake. I corrected it per your instrcution. However, I am encountering another error message now. The error message says: checking for db.h... yes checking for Berkeley DB major version... 4 checking for Berkeley DB minor version... 6 checking for Berkeley DB link (-ldb-4)... yes checking for Berkeley DB version match... no configure: error: Berkeley DB version mismatch A few lines in the log are: configure:31831: checking db.h presence configure:31841: cc -E -I/usr/local/include -I/usr/local/BerkeleyDB.4.6/include -I/usr/local/krb5-1.6.3/include -I/usr/local/ssl/include conftest.c configure:31847: $? = 0 configure:31867: result: yes configure:31902: checking for db.h configure:31909: result: yes configure:31925: checking for Berkeley DB major version configure:32044: result: 4 configure:32047: checking for Berkeley DB minor version configure:32290: result: 6 configure:34481: checking for Berkeley DB link (-ldb-4) configure:34547: cc -o conftest -g -O2 -I/usr/local/include -I/usr/local/BerkeleyDB.4.6/include -I/usr/local/krb5-1.6.3/include -I/usr/local/ssl/include -L/usr/local/lib -L/usr/local/BerkeleyDB.4.6/lib -L/usr/local/krb5-1.6.3/lib -L/usr/local/ssl/lib conftest.c -ldb-4 -pthread -lresolv >&5 configure:34553: $? = 0 configure:34557: test -z || test ! -s conftest.err configure:34560: $? = 0 configure:34563: test -s conftest configure:34566: $? = 0 configure:34581: result: yes configure:35580: checking for Berkeley DB version match configure:35636: cc -o conftest -g -O2 -I/usr/local/include -I/usr/local/BerkeleyDB.4.6/include -I/usr/local/krb5-1.6.3/include -I/usr/local/ssl/include -L/usr/local/lib -L/usr/local/BerkeleyDB.4.6/lib -L/usr/local/krb5-1.6.3/lib -L/usr/local/ssl/lib conftest.c -ldb-4 -pthread -lresolv >&5 configure:35639: $? = 0 configure:35641: ./conftest ../conftest: error while loading shared libraries: libdb-4.6.so: cannot open shared object file: No such file or directory configure:35644: $? = 127 configure: program exited with status 127 configure: failed program was: | /* confdefs.h. */ I know that I have an older version of DB. However, I have added the 4.6 path for the build. How can I resolve the problem? Please help. Thank you! Luke Lee ----- Original Message ---- From: Tommy Ho <tho(a)stillsecure.com> To: Luke Lee <leeluke77(a)yahoo.com> Cc: openldap-technical(a)openldap.org Sent: Friday, April 11, 2008 10:15:51 AM Subject: Re: OpenLDAP 2.3 Configure Error On Thu, 2008-04-10 at 17:50 -0700, Luke Lee wrote: > Hi, > > I'm building a custom OpenLDAP 2.3 but failed at the configure stage > with the following error messages: > checking openssl/ssl.h usability... no > checking openssl/ssl.h presence... no > checking for openssl/ssl.h... no > configure: error: Could not locate TLS/SSL package > > I've installed OpenSSL at the default /usr/local/ssl localtion with > threads, shared, and zlib support. > > In the configure log, the ssl.h was not found. A few lines of the log > are attached below: > > configure:18067: cc -E -I/usr/local/include > -I/usr/local/BerkeleyDB.4.6/include -I/usr/local/krb5-1.6.3/include > -I/usr/local/ssl/include/openssl conftest.c > configure:18073: $? = 0 > configure:18093: result: yes > configure:18128: checking for sys/un.h > configure:18135: result: yes > configure:19451: checking openssl/ssl.h usability > configure:19463: cc -c -g -O2 -I/usr/local/include > -I/usr/local/BerkeleyDB.4.6/include -I/usr/local/krb5-1.6.3/include > -I/usr/local/ssl/include/openssl conftest.c >&5 > conftest.c:127:25: openssl/ssl.h: No such file or directory > configure:19469: $? = 1 > configure: failed program was: > | /* confdefs.h. */ > | > | #define PACKAGE_NAME "" > | #define PACKAGE_TARNAME "" > | #define PACKAGE_VERSION "" > | #define PACKAGE_STRING "" > | #define PACKAGE_BUGREPORT "" > | #define OPENLDAP_PACKAGE "OpenLDAP" > > I have the required include and libs found in the env: > LDFLAGS=-L/usr/local/lib -L/usr/local/BerkeleyDB.4.6/lib > -L/usr/local/krb5-1.6.3/lib -L/usr/local/ssl/lib > CPPFLAGS=-I/usr/local/include -I/usr/local/BerkeleyDB.4.6/include > -I/usr/local/krb5-1.6.3/include -I/usr/local/ssl/include/openssl Your last include is the problem, it should be: -I/usr/local/ssl/include \Tommy > > Can anyone please help resolve this problem? Thanks! > > Luke Lee > > > > __________________________________________________ > Do You Yahoo!? > Tired of spam? Yahoo! Mail has the best spam protection around > http://mail.yahoo.com __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 2

back-sql question: iodbc or unixodbc
by Tommy Ho 11 Apr '08

11 Apr '08

Hi, I'm trying to get openLDAP 2.4.8 to work with postgreSQL 8.1.8. Does it matter which odbc driver manager I use? In http://www.openldap.org/faq/data/cache/978.html, under "How To Use It", it specifies to setup unixODBC while in http://www.samse.fr/GPL/ldap_pg/HOWTO/index.html, it says to use iodbc. I actually installed iodbc 3.52.6 and psqlodbc 8.03.0100 but am getting into a pthread mutex lock when backsql_load_schema_map() is trying to send the query "SELECT id, name, keytbl, keycol, create_proc, delete_proc, expect_return FROM ldap_oc_mappings" to postgres. From attaching gdb, the lock is happening SQLAllocStmt where is it is recursively being called from SQLAllocStmt_internal(). If others have found success getting openLDAP working with postgres, could you please share your expertise? Let me know if I can provide additional data, like the configure options and other setup/version info. Thanks, \Tommy

2 4

Re: OpenLDAP 2.3 Configure Error
by Luke Lee 11 Apr '08

11 Apr '08

Thank you! ----- Original Message ---- From: Quanah Gibson-Mount <quanah(a)zimbra.com> To: Luke Lee <leeluke77(a)yahoo.com> Cc: openldap-technical(a)openldap.org Sent: Friday, April 11, 2008 12:13:16 PM Subject: Re: OpenLDAP 2.3 Configure Error --On Friday, April 11, 2008 12:06 PM -0700 Luke Lee <leeluke77(a)yahoo.com> wrote: > > > Hi Quanah, > > What version of BDB is recommended? Thanks! Personally, I use BDB 4.2.52 + 6 patches when using OpenLDAP 2.3. It's been quite stable for me over the last several years. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Re: OpenLDAP 2.3 Configure Error
by Luke Lee 11 Apr '08

11 Apr '08

Hi Quanah, What version of BDB is recommended? Thanks! Luke ----- Original Message ---- From: Quanah Gibson-Mount <quanah(a)zimbra.com> To: Luke Lee <leeluke77(a)yahoo.com>; tho(a)stillsecure.com Cc: openldap-technical(a)openldap.org Sent: Friday, April 11, 2008 11:56:17 AM Subject: Re: OpenLDAP 2.3 Configure Error --On Friday, April 11, 2008 11:53 AM -0700 Luke Lee <leeluke77(a)yahoo.com> wrote: > > > > Hi Tommy, > > Thank you very much for the help. I also want to give thanks to whoever > spent time reading my previous and this emails. It appears to me that I > just couldn't find my mistake. > > I corrected it per your instrcution. However, I am encountering another > error message now. The error message says: OpenLDAP 2.3 does not support building with BDB 4.6. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

OpenLDAP 2.3 Configure Error
by Luke Lee 11 Apr '08

11 Apr '08

Hi, I'm building a custom OpenLDAP 2.3 but failed at the configure stage with the following error messages: checking openssl/ssl.h usability... no checking openssl/ssl.h presence... no checking for openssl/ssl.h... no configure: error: Could not locate TLS/SSL package I've installed OpenSSL at the default /usr/local/ssl localtion with threads, shared, and zlib support. In the configure log, the ssl.h was not found. A few lines of the log are attached below: configure:18067: cc -E -I/usr/local/include -I/usr/local/BerkeleyDB.4.6/include -I/usr/local/krb5-1.6.3/include -I/usr/local/ssl/include/openssl conftest.c configure:18073: $? = 0 configure:18093: result: yes configure:18128: checking for sys/un.h configure:18135: result: yes configure:19451: checking openssl/ssl.h usability configure:19463: cc -c -g -O2 -I/usr/local/include -I/usr/local/BerkeleyDB.4.6/include -I/usr/local/krb5-1.6.3/include -I/usr/local/ssl/include/openssl conftest.c >&5 conftest.c:127:25: openssl/ssl.h: No such file or directory configure:19469: $? = 1 configure: failed program was: | /* confdefs.h. */ | | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | #define OPENLDAP_PACKAGE "OpenLDAP" I have the required include and libs found in the env: LDFLAGS=-L/usr/local/lib -L/usr/local/BerkeleyDB.4.6/lib -L/usr/local/krb5-1.6.3/lib -L/usr/local/ssl/lib CPPFLAGS=-I/usr/local/include -I/usr/local/BerkeleyDB.4.6/include -I/usr/local/krb5-1.6.3/include -I/usr/local/ssl/include/openssl Can anyone please help resolve this problem? Thanks! Luke Lee __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

group of groups
by Andreas Moroder 11 Apr '08

11 Apr '08

Hello, I would like to have groups as members of other groups and use this with nss_ldap. Example: dn: cn=apotheke, ou=groups, dc=sb-brixen,dc=it gidNumber: 1019 memberUid: jack memberUid: joe sambaGroupType: 2 objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping description: apotheke cn: apotheke dn: cn=magazin, ou=groups, dc=sb-brixen,dc=it gidNumber: 1020 memberUid: paul memberUid: frank sambaGroupType: 2 objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping description: magazin cn: magazin dn: cn=common, ou=groups, dc=sb-brixen,dc=it gidNumber: 1021 member???: apotheke member???: magazin sambaGroupType: 2 objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping description: common cn: common what attribute do I have to use for the group in the group ? ( in the example i used member??? ) Thnaks for your reply Andreas

2 1

RE: error while accessing through Java "javax.naming.AuthenticationNotSupportedException: simple"
by Sai 10 Apr '08

10 Apr '08

Hi I did not figure-out the cause of why I am getting this and I did not fix this. But I figured out a work-around for this. Thought might help the community. I did not provide the SECURITY_AUTHENTICATION attribute. So it took the default of the server configured and it succeeded in authenticating the user Entry. What I will do next is to figure out what the default authentication is, for my server and try and pass it. Hope this helps some one out there. Thanks, -Bangaru. _____ From: Sai [mailto:bangaru.adabala@gmail.com] Sent: Monday, April 07, 2008 11:32 AM To: 'openldap-technical(a)openldap.org' Subject: error while accessing through Java "javax.naming.AuthenticationNotSupportedException: simple" Hi I am new to openLDAP. I am configuring it (version: OpenLDAP: slapd 2.3.27) on a Linux machine to use with our Web Application (java). When I try and make a connection I am getting the following error. =============== javax.naming.AuthenticationNotSupportedException: simple [4/7/08 10:42:01:887 EDT] 00000026 SystemErr R at com.sun.jndi.ldap.sasl.LdapSasl.saslBind(LdapSasl.java:115) =============== These are the code / attributes I used. ================= Hashtable env = new Hashtable(); env.put( Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory" ); env.put( Context.PROVIDER_URL, "ldap://<machine name>:<port>" ); env.put( Context.SECURITY_PRINCIPAL, "cn=uimadmin,ou=UIM,o=nhes,dc=nh,dc=gov" ); env.put( Context.SECURITY_AUTHENTICATION, "simple" ); env.put( Context.SECURITY_CREDENTIALS, "<password in plaintext>" ); try { context = new InitialDirContext(env); System.out.println("CONTEXT OPENED WITH ADMIN ACCOUNT"); } catch (NamingException ne) { ne.printStackTrace(); LogManager.logMessage("LDAPManager.getAdminJndiContext()", ne); } return context; ================= When I try and do an ldapsearch with a -x option (simple authentication) on the command line, it is returning results successfully. I am also able to connect using ldapbrowser v2.8.2 and see the results. Any help regarding this is greatly appreciated. Thanks in advance. -Bangaru.

1 0

ldap mail distribution list
by Aniruddha Karanjkar 10 Apr '08

10 Apr '08

Dear LDAP users, I want to use LDAP as shared abook. but I am not finding any information for creating mail distribution list in this. Why ?

1 0

Xen with OpenLDAP
by Quanah Gibson-Mount 09 Apr '08

09 Apr '08

In the past, using slapd under Xen has been problematic due to the issue here: <https://bugzilla.redhat.com/show_bug.cgi?id=91933> as reported here as well: <http://www.openldap.org/lists/openldap-software/200603/msg00214.html> I know that at least as recently as Xen 3.0.4, this was a problem. This was brought up on the Xen devel list, and their answer is found here: <http://lists.xensource.com/archives/html/xen-devel/2008-04/msg00167.html> Does their explanation seem to make sense? It sounded to me like they weren't 100% sure of their understanding of the issue. But it would be nice to be able to have something we could put in the FAQ to address this if this does address the problem. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

2 2

ProxyAuth via slapd-ldap woes
by Mark deJong 09 Apr '08

09 Apr '08

Hello, I'm having the hardest time getting ProxyAuth working to FDS via the OpenLDAP slapd-ldap module. I'm currently using Kerberos SASL bind to the OpenLDAP proxy server, which performs a search of the associated user DN on the FDS server. This part works fine. But when SLAPD attempted to perform proxyauth for that user, I receive the following error from FDS: # search result search: 4 result: 2 Protocol error text: unable to parse proxied authorization control I have tested proxyauth via other methods and they work fine. I have the following in my slapd.conf file: # SASL sasl-realm CORP.COMPANY.COM <http://corp.company.com/> sasl-host ldap03.corp.company.com sasl-secprops minssf=56 # Regexp for SASL authentication: authz-regexp uid=(.*),cn=corp.company.com,cn=gssapi,cn=auth ldap:///dc=corp,dc=company,dc=com??sub?(uid=$1) authz-policy to authzTo=ldap:///dc=corp,dc=company,dc=com??sub?(objectclass=person) ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database ldap suffix "dc=corp,dc=company,dc=com" #uri "ldaps://ldap01.corp.company.com/dc=corp,dc=company,dc=com" uri "ldap://ldap01.corp.company.com/" acl-bind bindmethod=simple binddn="uid=proxyadmin,cn=users,cn=bindaccounts,dc=corp,dc=company,dc=com" credentials="password" idassert-authzFrom "dn:*" idassert-bind bindmethod=simple binddn="uid=proxyadmin,cn=users,cn=bindaccounts,dc=corp,dc=company,dc=com" credentials="password" mode=self Not sure if it's helpful but here is the output in the logs at the event: Apr 8 16:17:39 ldap03 slapd[3166]: ===>slap_sasl_match: comparing DN uid=dejongm,cn=opssec,cn=users,cn=accounts,dc=corp,dc=company,dc=com to rule dn:* Apr 8 16:17:39 ldap03 slapd[3166]: slap_parseURI: parsing dn:* Apr 8 16:17:39 ldap03 slapd[3166]: <===slap_sasl_match: comparison returned 0 Apr 8 16:17:39 ldap03 slapd[3166]: ===>slap_sasl_match: comparing DN uid=dejongm,cn=opssec,cn=users,cn=accounts,dc=corp,dc=company,dc=com to rule dn:* Apr 8 16:17:39 ldap03 slapd[3166]: slap_parseURI: parsing dn:* Apr 8 16:17:39 ldap03 slapd[3166]: <===slap_sasl_match: comparison returned 0 Apr 8 16:17:39 ldap03 slapd[3166]: send_ldap_result: conn=0 op=3 p=3 Apr 8 16:17:39 ldap03 slapd[3166]: send_ldap_result: err=2 matched="" text="unable to parse proxied authorization control" Apr 8 16:17:39 ldap03 slapd[3166]: send_ldap_response: msgid=4 tag=101 err=2 Apr 8 16:17:39 ldap03 slapd[3166]: conn=0 op=3 SEARCH RESULT tag=101 err=2 nentries=0 text=unable to parse proxied authorization control Any suggestions would be appreciated. -Mark

2 1

Password policy can't replicate in openldap 2.4.8
by Paul Lee 09 Apr '08

09 Apr '08

Dear sir, I found that the account policy can't be replicated in openldap 2.4.8 I setup 2 servers, with Mirror mode. Then, I added the password policy and some user accounts in server 1, I then startup server 2, the user accounts are replicated to server 2. Content of policy.ldif : dn: ou=Policies ou: Policies description: All people in organisation objectClass: organizationalUnit dn: ou=Policies,o=HKSARG ou: Policies description: All people in organisation objectClass: organizationalUnit dn: cn=default,ou=Policies,o=HKSARG objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: userPassword pwdMaxFailure: 3 pwdInHistory: 12 pwdMinLength: 6 pwdExpireWarning: 259200 pwdAllowUserChange: TRUE pwdFailureCountInterval: 300 pwdGraceAuthNLimit: 1 pwdLockoutDuration: 300 pwdMustChange: FALSE pwdCheckQuality: 1 pwdMaxAge: 60000000 slapd.conf in server 1 : #overlay syncprov overlay ppolicy ppolicy_default "cn=default,ou=Policies,o=HKSARG" overlay syncprov #access to * by dn="cn=Manager" write by * read access to * by * write access to * by * read #database monitor syncprov-checkpoint 100 10 syncprov-sessionlog 100 # syncrepl directives syncrepl rid=1 provider=ldap://202.245.193.128:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist retry="60 +" syncrepl rid=2 provider=ldap://10.166.23.218:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist retry="60 +" mirrormode on serverID 1 slapd.conf in server 2 : # Password policy overlay ppolicy ppolicy_default "cn=default,ou=Policies,o=HKSARG" overlay syncprov #access to * by dn="cn=Manager" write by * read access to * by * write access to * by * read #database monitor syncprov-checkpoint 100 10 syncprov-sessionlog 100 # syncrepl directives syncrepl rid=1 provider=ldap://202.245.193.128:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist retry="60 +" syncrepl rid=2 provider=ldap://10.166.23.218:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist retry="60 +" mirrormode on serverID 2 I input the incorrect password 3 times in server 1 for a user, then, I find that the attribute pwdAccountLockedTime is updated in server 1, but I find that in server 2, this attribute is not replicated. As I result, when I input correct password in server 2, I still get authentication successful, but in server 1, authentication is failed. Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

2 4

Slapd Won't Start After TLS Was Configured
by Luke Lee 09 Apr '08

09 Apr '08

Hi, I've been trying to configure TLS with OpenLDAP on a RedHat Enterprise 4u4 server running OpenLDAP 2.2.13 but failed. The ldap service won't start and the following error messages are showing under the debugging log: TLS: could not load verify locations (file:`/etc/openldap/TLS/cacert.pem',dir:`/etc/openldap/TLS'). TLS: error:0200100D:system library:fopen:Permission denied bss_file.c:104 TLS: error:2006D002:BIO routines:BIO_new_file:system lib bss_file.c:109 TLS: error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib by_file.c:279 main: TLS init def ctx failed: -1 slapd shutdown: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. Can anyone help resolve the problem please? Thanks! Luke Lee ____________________________________________________________________________________ You rock. That's why Blockbuster's offering you one month of Blockbuster Total Access, No Cost. http://tc.deals.yahoo.com/tc/blockbuster/text5.com

2 1

some help required LDAP - GSSAPI issue.
by Austin Cherian 08 Apr '08

08 Apr '08

Hi, I hope some one can answer this query regarding LDAP and GSSAPI as i really dint find substantial info for this on the net for what i was trying to accomplish. I have some limitations on using OpenLDAP with Cyrus SASL and hence have to manufacture my own GSSAPI client to use with LDAP. However i have run into some technical issues here with my implementation and MS AD. Here's my problem in short: I am using the kerberos mechanism with GSSAPI, i first use kerberos API's to get a TGT for SPN that i have obtained a keytab for previously. I then use GSSAPI gss_init_sec_context to obtain a service ticket for the ldap server. I then call ldap_init and then subsequently call ldap_sasl_bind_s with mech as GSS-SPNEGO and supplying the GSSAPI token ( obtained from gss_init_sec_context ) as credential ( i set the DN in the ldap_sasl_bind_s to NULL ). >From the network traces and the return code i see that the bind was successful. The bind result shows success (0x00) and negTokenTarg shows negResult as accept-completed. This shows that Bind was indeed a success also to note here the krb-blob that comes with the bind result is successfully consumed by subsequent calls to gss_init_sec_context to complete context establishment. The issue that im facing now is that when i pass GSS wraped search request ( i.e. i build a search request and pass it to gss_wrap API to get a token ) token to the ldap_search_ext api. From the network traces i see that the search request has been received by the ldap server properly. However the LDAP server ( MS AD LDAP server ) responds with the following message : LdapErr: DSID-0C09062.27 comment: In order to perform this operation a successful bind must be completed on the connection. Can some one please throw some light on as to why the search query is getting back with an error that there was no bind done in spite of the server responding success for the LDAP bind prior to sending the search request ?? Any help will be greatly appreciated... Thanks, Austin.

1 0

First question...
by Daniel Padula 08 Apr '08

08 Apr '08

Hi! I am Daniel from argentina, I have an strange problem that, after been looking for it, I am really lost. I have made an objectClass in open ldap 2.4.7-6.1 and it works perfectly, but when I implemented in an open ldap 2.3.27-1. it did't work. It fails with the message, ldap_add: Invalid syntax (21) additional info: objectClass: value #0 invalid per syntax. Are there any main difference in schema 's structure between those ldap versions? Where could be the problem? attributetype ( 1.3.6.1.4.1.4203.666.1.124 NAME 'dynastyName' DESC ' Nombre dynasty.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) attributetype ( 1.3.6.1.4.1.4203.666.1.125 NAME 'vars' DESC ' Valores obtenidos de dynasty.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) objectclass (1.3.6.1.4.1.4203.666.1.54775 NAME 'jxfsDevice' SUP top STRUCTURAL DESC 'Estructura de un dispositivo jxfs' MAY ( cn $ vars $ dynastyName)) Thanks in advance! -- Daniel Padula. MSN, Gtalk, Jabber: daniel.padula(a)gmail.com

2 2

mail distribution list problem
by Aniruddha Karanjkar 08 Apr '08

08 Apr '08

Hi I have configured ldap on fedora 8 for contact list. It is working absolutely fine. Only thing is I am not able to create mail distribution list, which can be browsed in OL OE or TB. Please HELP.

1 0

error while accessing through Java "javax.naming.AuthenticationNotSupportedException: simple"
by Sai 07 Apr '08

07 Apr '08

Hi I am new to openLDAP. I am configuring it (version: OpenLDAP: slapd 2.3.27) on a Linux machine to use with our Web Application (java). When I try and make a connection I am getting the following error. =============== javax.naming.AuthenticationNotSupportedException: simple [4/7/08 10:42:01:887 EDT] 00000026 SystemErr R at com.sun.jndi.ldap.sasl.LdapSasl.saslBind(LdapSasl.java:115) =============== These are the code / attributes I used. ================= Hashtable env = new Hashtable(); env.put( Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory" ); env.put( Context.PROVIDER_URL, "ldap://<machine name>:<port>" ); env.put( Context.SECURITY_PRINCIPAL, "cn=uimadmin,ou=UIM,o=nhes,dc=nh,dc=gov" ); env.put( Context.SECURITY_AUTHENTICATION, "simple" ); env.put( Context.SECURITY_CREDENTIALS, "<password in plaintext>" ); try { context = new InitialDirContext(env); System.out.println("CONTEXT OPENED WITH ADMIN ACCOUNT"); } catch (NamingException ne) { ne.printStackTrace(); LogManager.logMessage("LDAPManager.getAdminJndiContext()", ne); } return context; ================= When I try and do an ldapsearch with a -x option (simple authentication) on the command line, it is returning results successfully. I am also able to connect using ldapbrowser v2.8.2 and see the results. Any help regarding this is greatly appreciated. Thanks in advance. -Bangaru.

1 0

Questions about Active Directory Password Cache overlay
by Wes Modes 07 Apr '08

07 Apr '08

Thanks to Buchan Milne, I'm looking into the Active Directory Password Cache overlay for OpenLDAP, which seems to offer more or less what I'm trying to do. Is anyone here experienced with it? Is this the right place to ask or is there an openLDAP overlays list? I understand this description of ADPC: Active Directory Password Cache =============================== Active Directory does not provide any means to read user credentials on any public API. It is possible, to install additional libraries as password sniffer to catch and forward cleartext passwords on changes. In case you cannot or simply dont want to install such libraries, the Active Directory Password Cache overlay is your option. The Active Directory Password Cache overlay allows to mirror user account credentials without any modification on the AD server. It only takes one occasional simple bind authentication against the OpenLDAP server. If the credential has not been mirrored yet, the overlay uses the krbPrincipalName and the password provided by the user to perform a Kerberos init against the Active Directory. A successful Kerberos init guarantees a correct password for this principal, and therefor the bind finally succeeds. Within this overlay operation, the password gets encrypted with the default OpenLDAP hash alorithm and stored as userPassword attribute. There is an option to update the sambaNTPassword also (using code borrowed from Howard Chu's smbk5pwd overlay). All following simple bind authentications will first try these cached credentials, making the OpenLDAP server independent from AD. In case the user changes its password on the Active Directory server, the old password stays valid in OpenLDAP until the user first presents the new password for an simple bind. Within this bind operation, the overlay performs another Kerberos init and updates the cached credentials in OpenLDAP. It is clear to me that after a password change, that a failure to authenticate initiates a new auth attempt against the KDC, and if it succeeds, ADPC caches the passwd as a hash in OpenLDAP. But if Samba fails to authenticate against the hash stored in sambaNTPassword, is a new authentication attempt made against the KDC? And if it does, where does it get the passwd to hash (since Samba never gets the passwd in NTLM authentication)? Practically speaking, it seems that the password that the overlay hashes has to come from a source other than Samba. A web app? How have people used it in the past? W. -- Wes Modes Server Administrator & Programmer Analyst McHenry Library Computing & Network Services Information and Technology Services 459-5208

2 1

RE: openLDAP controls‏
by Quanah Gibson-Mount 06 Apr '08

06 Apr '08

--On Saturday, April 05, 2008 9:23 PM -0700 Gene Kupfer <kupferg(a)msn.com> wrote: > I'm using Jumpbox beta which uses the latest OpenLDAP release I believe. > My application is a software streaming app on which I can configure > provisioning to users or groups. However, I am not able to list users in > my openLDAP server so I am not able to configure what apps they have > access to. These controls I referenced are required by my app to return a > list of user accounts. Keep your replies to the list if you want responses. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

4 5

openLDAP controls‏
by Gene Kupfer 06 Apr '08

06 Apr '08

Hello, I’m trying to figure out how to enable some controls, but can’t find a single thing online that references this topic. The controls are defined in the ldap.h file (please see below), but when I query my directory for supported controls it does not show them in the list. #define LDAP_CONTROL_SORTREQUEST "1.2.840.113556.1.4.473" #define LDAP_CONTROL_SORTRESPONSE "1.2.840.113556.1.4.474" #define LDAP_CONTROL_VLVREQUEST "2.16.840.1.113730.3.4.9" #define LDAP_CONTROL_VLVRESPONSE "2.16.840.1.113730.3.4.10" I’m trying to connect an application that lists these controls as CRITICAL and fails to show the LDAP users and groups. Thank you very much for your help. Gene

3 2

Samba authentication to Kerberos via OpenLDAP, third and last try
by Wes Modes 04 Apr '08

04 Apr '08

So far answers I've received about this have been inconsistent at best and downright inaccurate at worst. I'm going to try one more time and see if, at the very least, someone can give me a lead. I ask you to consider what I'm asking remotely possible, and then seek a solution. (Particularly before one blasts off an ill-thought out message that says simple, "Can't be done," simple because you've never done it or haven't heard of it being done.) So consider this a challenge or a riddle. 1. I have an OpenLDAP directory server that I am using for user and group information. I would like to use it also to authenticate against. This way, whatever I hook up to it (Samba, webstuff, PHP apps, CMS) can both authenticate and authorize from one source. 2. There is a separate Kerberos server that has users' campus-wide passwords. I have access to it, but do not control it. 3. I have a separate linux file server running Samba. PCs and Macs will connect to it. I know I can do Kerberos authentication directly from Samba, but I'd prefer OpenLDAP do the Kerberos connection. Here's why: a) I can solve the problem once, rather than have to work out BOTH LDAP and Kerberos connections for every new authenticated service I add, and b) LDAP hooks are more common than Kerberos hooks for other services for which I will eventually want authentication and authroization. And yes, I know it breaks the Kerberos model. The question and the challenge: Any leads on how I might convince Samba to pass the input password on to OpenLDAP so that OpenLDAP can authenticate it against Kerberos? Wes -- Wes Modes Server Administrator & Programmer Analyst McHenry Library Computing & Network Services Information and Technology Services 459-5208

4 6

Migration to 2.4.8 version
by uri_gr1＠tut.by 04 Apr '08

04 Apr '08

Hi, people! I'm atemptting to migrate to openldap-2.4.8(I realy need mirrormode replication). But some problems appear, first of all, number of ldap editors(gq, luma, JXplorer) can't add new entries into ldap tree, actually only phpldapadmin can do than; second, can't setup pam_ldap/nss_ldap to authenticate via openldap-2.4.8. Last one really makes new openldap version completely unusable. Is any way to solve this problems?

2 3

Need help to export ldap user home directory "/home/ldapuser" to client LDAP
by ashwani singh 04 Apr '08

04 Apr '08

Sorry correction in previews steps : Hi, I have created LDAP user "ldapuser" and exported its home directory "/home/LDAP/ldapuser" to LDAP client by following steps and its working but when I replace /home/LDAP/ with /home/testdir/ or only /home it is not allowing to modify  database. How can I export the user home directory from same location /home on client with "/home/ldapuser"? Please help me. [root@sc1435-7 home]# ldapmodify -x -D "cn=Manager,dc=ldapserver,dc=com" -W -f /etc/openldap/automount.ldif Enter LDAP Password: modifying entry "ou=auto.master,dc=ldapserver,dc=com" modifying entry "ou=auto.home,dc=ldapserver,dc=com" modifying entry "cn=/home, ou=auto.master,dc=ldapserver,dc=com" modifying entry "cn=testdir,ou=auto.home,dc=ldapserver,dc=com" ldap_modify: No such object (32)        matched DN: ou=auto.home,dc=ldapserver,dc=com Working Steps with "/home/LDAP/" Step 1. #mkdir /home/LDAP cp -dpR  /home/ldapuser /home/LDAP/Step 2. Modify data base for "ldapuser" home directory :(as bellow) Create ldif file for auto mount of home directory:(as bellow) Step 3. Edit /etc/exports for shard directory [root@sc1435-7 home]# cat /etc/exports /home/LDAP                  *(rw,sync) # /usr/sbin/exportfs -a Step 4. Add changes in LDAP data base : ldapmodify -x -D "cn=Manager,dc=ldapserver,dc=com" -W -f /etc/openldap/ldapuser.ldif ldapadd -x -D "cn=Manager,dc=ldapserver,dc=com" -W -f /etc/openldap/automount.ldif Modify data base for "ldapuser" home directory : # cat /etc/openldap/ldapuser.ldif dn: uid=ldapuser,ou=People,dc=ldapserver,dc=com uid: ldapuser cn: ldapuser objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {crypt}$1$lxxxxxxxxxxxxxxxxxxxxxx. shadowLastChange: 13968 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 500 gidNumber: 100 homeDirectory: /home/LDAP/ldapuser Create ldif file for auto mount of home directory: # cat /etc/openldap/automount.ldif dn: ou=auto.master,dc=ldapserver,dc=com objectClass: top objectClass: automountMap ou: auto.master dn: ou=auto.home,dc=ldapserver,dc=com objectClass: top objectClass: automountMap ou: auto.home dn: cn=/home, ou=auto.master,dc=ldapserver,dc=com objectClass: automount automountInformation: ldap:ou=auto.home,dc=ldapserver,dc=com --timeout 60 cn: /home dn: cn=LDAP,ou=auto.home,dc=ldapserver,dc=com objectClass: automount automountInformation: -rw,hard,intr sc1435-7:/home/LDAP cn: LDAP Thanks and regards, Ashwani

2 1

slapd is not binding on AIX 5.3
by mohammed hannini 03 Apr '08

03 Apr '08

Hi, I installed openldap 2.3.37 on AIX 5.3. When I start slapd, I get this error: daemon: bind(7) failed errno=67 (Address already in use) slapd starting This is even though there is nothing running on port 389 but the ldap server itself. # netstat -an |grep 389 tcp4 0 0 *.389 *.* LISTEN Any ideas? Thanks ____________________________________________________________________________________ You rock. That's why Blockbuster's offering you one month of Blockbuster Total Access, No Cost. http://tc.deals.yahoo.com/tc/blockbuster/text5.com

1 0

date/time attributes
by Ildar Mulyukov 03 Apr '08

03 Apr '08

Hello again! Can anyone point me to attributes designating date or/and time? For example, is there a counterpart of VCard BDAY attribute? Thanks! Regards, Ildar -- Ildar Mulyukov, free SW designer/programmer ================================================ email: ildar(a)users.sourceforge.net home: http://tuganger.narod.ru/ ALT Linux Sisyphus ================================================

4 5

Need help to export ldap user home directory "/home/ldapuser" to client LDAP
by ashwani singh 03 Apr '08

03 Apr '08

Hi, I have created LDAP user "ldapuser" and exported its home directory "/home/LDAP/ldapuser" to LDAP client by following steps and its working but when I replace /home/LDAP/ with /home/testdir/ or only /home it is not allowing to modify  database. How can I export the user home directory from same location /home on client with "/home/ldapuser"? Please help me. [root@sc1435-7 home]# ldapmodify -x -D "cn=Manager,dc=ldapserver,dc=com" -W -f /etc/openldap/automount.ldif Enter LDAP Password: modifying entry "ou=auto.master,dc=ldapserver,dc=com" modifying entry "ou=auto.home,dc=ldapserver,dc=com" modifying entry "cn=/home, ou=auto.master,dc=ldapserver,dc=com" modifying entry "cn=testdir,ou=auto.home,dc=ldapserver,dc=com" ldap_modify: No such object (32)         matched DN: ou=auto.home,dc=ldapserver,dc=com Working Steps with "/home/LDAP/" Step 1. #mkdir /home/LDAP cp -dpR  /home/ldapuser /home/LDAP/ Step 2. Modify data base for "ldapuser" home directory :(as bellow) Create ldif file for auto mount of home directory:(as bellow) Step 3. Edit /etc/exports for shard directory [root@sc1435-7 home]# cat /etc/exports /home/LDAP                  *(rw,sync) # /usr/sbin/exportfs -a  Step 4. Add changes in LDAP data base : ldapmodify -x -D "cn=Manager,dc=ldapserver,dc=com" -W -f /etc/openldap/ldapuser.ldif ldapadd -x -D "cn=Manager,dc=ldapserver,dc=com" -W -f /etc/openldap/automount.ldif Modify data base for "ldapuser" home directory : # cat /etc/openldap/ldapuser.ldif dn: uid=ldapuser,ou=People,dc=ldapserver,dc=com uid: ldapuser cn: ldapuser objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {crypt}$1$lxxxxxxxxxxxxxxxxxxxxxx. shadowLastChange: 13968 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 500 gidNumber: 100 homeDirectory: /home/test/ldapuser Create ldif file for auto mount of home directory: # cat /etc/openldap/automount.ldif dn: ou=auto.master,dc=ldapserver,dc=com objectClass: top objectClass: automountMap ou: auto.master dn: ou=auto.home,dc=ldapserver,dc=com objectClass: top objectClass: automountMap ou: auto.home dn: cn=/home, ou=auto.master,dc=ldapserver,dc=com objectClass: automount automountInformation: ldap:ou=auto.home,dc=ldapserver,dc=com --timeout 60 cn: /home dn: ou=auto.home,dc=ldapserver,dc=com objectClass: automount automountInformation: -rw,hard,intr sc1435-7:/home Thanks and regards, Ashwani

1 0

Deadlocks when writing in parallell (two processes)
by Stelios Grigoriadis 02 Apr '08

02 Apr '08

We get a lot of DB_LOCK_DEADLOCK when using to programs that for a period of time continuosly writes to OpenLDAP. Version is 2.3.39. The information added is of the form: ebcmdCustomer=0+ebcmdDir=220xx,ou=AuthCodes,ebcmdVersion=0,ebcmdProduct=ebcmd,dc=example,dc=com where xx varies. Snippet of the output: Mar 27 13:03:21 ldapt1 slapd[7589]: => bdb_dn2id_add: subtree (ebcmdCustomer=0+ebcmdDir=22037,ou=authcodes,ebcmdVersion=0,ebcmdProduct=ebcmd,dc=example,dc=com) put failed: -30995 Mar 27 13:03:26 ldapt1 slapd[7589]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30995) Mar 27 13:03:26 ldapt1 slapd[7589]: => bdb_dn2id_add: parent (ou=authcodes,ebcmdVersion=0,ebcmdProduct=ebcmd,dc=example,dc=com) insert failed: -30995 Mar 27 13:03:28 ldapt1 slapd[7589]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30995) Mar 27 13:03:28 ldapt1 slapd[7589]: => bdb_dn2id_add: parent (ou=authcodes,ebcmdVersion=0,ebcmdProduct=ebcmd,dc=example,dc=com) insert failed: -30995 Mar 27 13:03:36 ldapt1 slapd[7589]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30995) Mar 27 13:03:36 ldapt1 slapd[7589]: => bdb_dn2id_add: parent (ou=authcodes,ebcmdVersion=0,ebcmdProduct=ebcmd,dc=example,dc=com) insert failed: -30995 Mar 27 13:03:38 ldapt1 slapd[7589]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30995) I see in the code that a key (the same it seems to be) is repeatedly written, and a comment is stating that /* Don't worry if it's already there */ (line 862 in servers/slapd/back-bdb/idl.c). Is this to be expected or have we done something wrong? /Stelios Grigoriadis

2 2

Applying ppolicy to a user
by Bryan Payne 02 Apr '08

02 Apr '08

I need to apply an alternate policy to a specific user. I can't for the life of me remember what attribute needs to be set for the user. Any help is appreciated. Thanks.

2 1

Re: OpenLDAP Group ACL
by Pierangelo Masarati 01 Apr '08

01 Apr '08

Please keep replies on the list. Luke Lee wrote: > Sir, > > I have the following in my base ldif: snip > > and I have the following under the group ou: > > dn: cn=pwmanager,ou=Group,dc=mydomain,dc=com > objectClass: groupOfNames > cn: pwmanager > member: cn=l_luke,ou=People,dc=mydomain,dc=com > member: w_smith,ou=People,dc=mydomain,dc=com snip > The access defined in the slapd.conf file: > > access to attrs=userPassword > by self write > by group.exact="cn=pwmanager,ou=Group,dc=mydomain,dc=com" write > by * none > > access to * > by self write > by group.exact="cn=pwmanager,ou=Group,dc=mydomain,dc=com" write > by users read > by * none > > Will I be able to use the following command to change user's password? > > ldappasswd -x -W -D "uid=l_luke,ou=People,dc=mydomain,dc=com" -S > "uid=w_smith,ou=People,dc=mydomain,dc=com" No. > How can I use the Netgroup and netgroup.byhost nisMap to achive the same purpose? Would you please help? Thanks! You can't. You can't use anything but groupOfNames/member for group membership. The only alternative, discussed thousands of times in the archives (the last time three days ago, <http://www.openldap.org/lists/openldap-software/200803/msg00241.html>) consists in using sets, but performance and deadlock issues will probably bite you. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Blank Password for a ldap user
by Rocky S 01 Apr '08

01 Apr '08

I am very new ldap programming, so bear with me if my query is naive. I am trying to write a program using the OpenLDAP SDK. The program should take an LDAP servername/port, a CN & a password. The program should then report if the CN/password combination is correct or incorrect. This is how I am trying to do this. [ error checks removed for making it simple] LDAP *pldap; ldap_initialize(&pldap, "ldap://myhost:389) ; int desired_version = LDAP_VERSION3; ldap_set_option(pldap, LDAP_OPT_PROTOCOL_VERSION, &desired_version); int ret = ldap_bind_s(pldap, "uid=Jack,ou=People,dc=vss,dc=veritas,dc=com", "jack123", LDAP_AUTH_SIMPLE); if(ret == LDAP_SUCCESS) puts("VERIFIED"); else puts("FAILURE"); This works fine for for Jack/jack123. I have another user in the directory - John who has a null/empty password I tried both ldap_bind_s(pldap, "uid=John,ou=People,dc=vss,dc=veritas,dc=com", NULL, LDAP_AUTH_SIMPLE); ldap_bind_s(pldap, "uid=John,ou=People,dc=vss,dc=veritas,dc=com", "", LDAP_AUTH_SIMPLE); Both cases ldap_bind_s returns 53 - which I think means LDAP UNWILLING TO PERFORM I know the server allows null passwords.

2 2

logs and I/O Performances
by Andre Stoffel 31 Mar '08

31 Mar '08

Hi all, We are using 3 LDAP Directories based on Openldap 2.2.23 (number of objects : between 4000 and 11000 in the DBs) . The hardware is based on HP servers correctly dimensioned but not oversized disks resided on an EMC Symmetrix We try to implement the ldap logs but we have to stop after the first test: a common request taking between 1 up to 2 seconds instead of some milliseconds. Has anybody an idea of whats going wrong: setting, architecture Thanks. André.

2 1

OpenLDAP as a Meta directory for eDirectory and Active Directory
by Jon Gerdes 30 Mar '08

30 Mar '08

I have a requirement to link up the contents of an AD and an eDir into a single meta dir. I am testing all this on a small system. The basic idea is that a user will be able to do a search on their uid and then bind to it. Their account could be in either the AD or the eDir. I would want to support both simple and digest-md5 binds. Both eDir and AD support SASL digest md5 binds but AD does not allow simple binds. I do not wish to change the back ends but just work with what is there. In my test system I have dc=blueloop,dc=net at the top with ou=edir and ou=ad to be mapped under the top level. My gerdesj account has all the relavent rights in all cases. I have gone around in circles on this several times! I can do a browse of the edir container fine ie a search of the ou=edir,dc=blueloop,dc=net as anon returns stuff as I would expect. This seems to work OK: ldapsearch -h localhost '(objectclass=*)' -D "cn=gerdesj,ou=edir,dc=blueloop,dc=net" -b "ou=edir,dc=blueloop,dc=net" -x -W Trying to use SASL fails: ldapsearch -h localhost -b 'ou=edir,dc=blueloop,dc=net' '(objectclass=*)' -Y DIGEST-MD5 -U "dn:cn=gerdesj,ou=edir,dc=blueloop,dc=net" SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database This seems to imply to me that the OpenLDAP box is trying to auth me rather than passing this off to the system it is proxying. Why ? I would also like to make the AD side of things such that it will allow a simple anonymous connection to search and then allow through a simple bind I've read everything I can find but have run out of steam. Thanks for any advice or pointers. Cheers Jon Here is a chunk out of my slapd.conf ##### eDir #ldapsearch -h localhost -b 'ou=edir,dc=blueloop,dc=net' -s sub -x -D '' '(objectclass=*)' database ldap suffix "ou=edir,dc=blueloop,dc=net" uri "ldap://port.blueloop.net/" subordinate overlay rwm rwm-suffixmassage "ou=edir,dc=blueloop,dc=net" "ou=users,o=blueloop" ##### AD database ldap suffix "ou=ad,dc=blueloop,dc=net" uri "ldap://baileys.blueloop.net/" subordinate idassert-authzFrom "dn:regex=.*" acl-bind bindmethod=sasl saslmech=DIGEST-MD5 authcId=gerdesj authzId=gerdesj credentials="{SSHA}xxxxxx" idassert-bind bindmethod=sasl saslmech=DIGEST-MD5 binddn="cn=gerdesj,ou=users,ou=blueloop,dc=blueloop,dc=net" credentials="{SSHA}xxxxxxxxxxxxxx" mode=self overerlay rwm rwm-suffixmassage "ou=ad,dc=blueloop,dc=net" "ou=users,ou=blueloop,dc=blueloop,dc=net" Registered Address : 7 Manor Buildings, North Perrott, Crewkerne, Somerset, TA18 7ST Registered England & Wales - 3981322 CONFIDENTIAL INFORMATION This e-mail and any files attached with it are confidential and for the sole use of the intended recipient(s). If you are not the intended recipient(s) you are prohibited from using, copying or distributing this or any information contained in it and should immediately notify the sender and delete the message from your system. Internet communications are not secure and Blueloop Limited is not responsible for unauthorised use by third parties nor for alteration or corruption in transmission. Furthermore, while Blueloop Limited have taken reasonable precautions to minimise the risk of software viruses, it cannot accept liability for any damage which you may suffer as a result of such viruses, and we therefore recommend you carry out your own virus checks on receipt of any e-mail.

2 1

DSMLReader(dsmlFile) gives Invalid beginning tag :attr error
by Hamidreza Hamedtoolloei 29 Mar '08

29 Mar '08

var YAHOO = {'Shortcuts' : {}}; YAHOO.Shortcuts.hasSensitiveText = false; YAHOO.Shortcuts.sensitivityType = []; YAHOO.Shortcuts.doUlt = false; YAHOO.Shortcuts.location = "us"; YAHOO.Shortcuts.document_id = 0; YAHOO.Shortcuts.document_type = ""; YAHOO.Shortcuts.document_title = "DSMLReader(dsmlFile) gives Invalid beginning tag :attr error"; YAHOO.Shortcuts.document_publish_date = ""; YAHOO.Shortcuts.document_author = "hamedtoolloei(a)yahoo.com"; YAHOO.Shortcuts.document_url = ""; YAHOO.Shortcuts.document_tags = ""; YAHOO.Shortcuts.annotationSet = { "lw_1206833257_0": { "text": "prabbit(a)dsml.org", "extended": 0, "startchar": 1507, "endchar": 1522, "start": 1507, "end": 1522, "extendedFrom": "", "predictedCategory": "", "predictionProbability": "0", "weight": 1, "type": ["shortcuts:/us/instance/identifier/email_address"], "category": ["IDENTIFIER"], "context": "" } }; Hey guys, I am using jldap to communicate with ldap, and I get an exception when I am parsing a dsml file. In more details, the following line of code LDAPReader in = new DSMLReader(dsmlFile); gives the following error Thefollowing error occured handling a DSML file:LDAPLocalException: Thefollowing error occured while parsing DSML: org.xml.sax.SAXException:Invalid beginning tag :attr (84) Decoding Error org.xml.sax.SAXException: Invalid beginning tag :attr when dsmlFile is <dsml:directory-entries> <dsml:entry dn="uid=prabbit,ou=development,o=bowstreet,c=us"> <dsml:objectclass> <dsml:oc-value>top</dsml:oc-value> <dsml:oc-value>person</dsml:oc-value> <dsml:oc-value>organizationalPerson</dsml:oc-value> <dsml:oc-value>inetOrgPerson</dsml:oc-value> </dsml:objectclass> <dsml:attr name="sn"><dsml:value>Rabbit</dsml:value></dsml:attr> <dsml:attr name="uid"><dsml:value>prabbit</dsml:value></dsml:attr> <dsml:attr name="mail"><dsml:value>prabbit(a)dsml.org</dsml:value></dsml:attr> <dsml:attr name="givenname"><dsml:value>Peter</dsml:value></dsml:attr> <dsml:attr name="cn"><dsml:value>Peter Rabbit</dsml:value></dsml:attr> </dsml:entry> </dsml:directory-entries> </dsml:dsml> Any suggestions?? thanks Never miss a thing. Make Yahoo your homepage. ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

1 0

Unable to add attribute to cn
by Frank, Hans, 232 28 Mar '08

28 Mar '08

Hi there, I would like to add the attribute "orclnetdescstring" to the following ldap object: cn=TESTDB,cn=OracleContext,dc=test,dc=de When trying this, I get the following error message: 09:44:42 AM: Failed to add 'orclnetdescstring' attribute for ldap://***:389/cn=TESTDB,cn=OracleContext,dc=test,dc=de Root error: [LDAP: error code 65 - attribute 'orclnetdescstring' not allowed] I did include the attributetype into the core.schema, which is included in slapd.conf the following way: attributetype ( 1.3.6.1.4.1.9232.6 NAME 'orclnetdescstring' DESC 'Oracle-OID spezific A-Type' SUP name ) or: attributetype ( 1.3.6.1.4.1.9232.6 NAME 'orclnetdescstring' SUP name ) But that doesn't change anything. I am very new to openldap, so if there are any good tutorials which describe such simple things (I suppose this is something simple), please let me know. I just need this object with some specific attributes, how can I realise this? Best Regards Hans Frank

3 2

Re: NIS to ldap layout
by Eric Ritchie 28 Mar '08

28 Mar '08

Gavin Henry wrote: > Eric Ritchie wrote: >> I have 3 NIS domains I wish to convert to ldap. I would like to keep >> 3 separate areas in ldap since the NIS domains have different >> accounts. I created a base dn and loaded data under 3 higher levels, >> such as base is dc=xyz,dc=com and dc=a,dc=xyz,dc=com >> dc=b,dc=xyz,dc=com dc=c,dc=xyz,dc=com. Then if I want client one to >> be in domain a, I set its base to dc=a,dc=xyz,dc=com. This works for >> host name lookups but when another host tries to login to the box via >> telnet or rsh, the login hangs after the password is entered, ssh >> works though. If I specify a binddn on the client with >> dc=a,dc=xyz,dc=com, I can login via telnet and rsh but name lookups >> fail on the host. Any idea what is causing this? Is this the best way >> to have separate DBs for clients? >> >> Thanks >> > > Sounds like you are using pam_ldap? I would post to their lists with > you configurations etc. > > Gavin. > I emptied my ldap database to start fresh. I created a base of dc=ibg,dc=com and loaded 2 hostname/IPs. I configured my client to use ldap for hosts in /etc/nsswitch.conf. Its using ldap for host lookups only, nothing else. The client works fine, it can find the 2 hosts in ldap. If I try to telnet from a host not in ldap it works but if I try to telnet from one of the hosts in ldap to my client, it hangs. If I set binddn on the client, then the hosts in ldap can telnet to the client but the client can't lookup host names. I'm new to ldap so I'm not sure if this is a pam or ldap issue. I don't understand why enabling the binddn allows the remote host to telnet but breaks local name lookups. Thanks -- Eric Ritchie Interactive Brokers LLC 203-618-5868

2 1

Re: OpenLDAP Group ACL
by Luke Lee 28 Mar '08

28 Mar '08

Sir, I modified my settings and added the following group: dn: cn=pwmanager,ou=Group,dc=mydomain,dc=com objectClass: posixGroup objectClass: top cn: pwmanager userPassword: {crypt}x gidNumber: 550 memberUid: l_luke memberUid: w_smith I also modified my ACL in the slapd.conf: access to attr=userPassword by self write by anonymous auth by group/groupOfNames/member="cn=pwmanager,ou=Group,dc=mydomain,dc=com" write by * none access to * by self write by group/groupOfNames/member="cn=pwmanager,ou=Group,dc=mydomain,dc=com" write by * read I used the same command trying to change the user's password but received the exact same error. Would you please help? You mentioned that the nisNetgroup object doesn't fit in the ACL configuration in your previous reply. I had defined netgroups looked like the following: dn: cn=Sales,ou=Netgroup,dc=mydomain,dc=com objectClass: nisNetgroup objectClass: top cn: Sales nisNetgroupTriple: (,c_parks,mydomain.com) nisNetgroupTriple: (,j_berryhill,mydomain.com) nisNetgroupTriple: (,b_chen,mydomain.com) Would there be a way for me to use the netgroup and its members for any ACL type of access? Your help will be highly appreciated! ----- Original Message ---- From: Pierangelo Masarati <ando(a)sys-net.it> To: Luke Lee <leeluke77(a)yahoo.com> Cc: openldap-technical(a)openldap.org Sent: Thursday, March 27, 2008 12:35:16 PM Subject: Re: OpenLDAP Group ACL > Hello, > > I'll appreciate it if any of you are willing to take time and share with > me your experience with OpenLDAP running on a RedHat server configured > with group ACL. > > I'm trying to grant a group of people (including myself) the permission to > change user LDAP passwords. However, when I try to change a user's LDAP > password, I received the following message: > > Result: Insufficient access (50) > > The command that I used was: > > ldappasswd -x -W -D "uid=l_luke,ou=Netgroup,dc=mydomain,dc=com" -S > "uid=w_smith,ou=People,dc=mydomain,dc=com" > > My ACL settings in the slapd.conf file are: > > access to attr=userPassword > by self write > by anonymous auth > by group.exact="cn=ITgroup,ou=Netgroup,dc=mydomain,dc=com" write > by * none > access to * > by self write > by group.exact="cn=ITgroup,ou=Netgroup,dc=mydomain,dc=com" write > by * read > > My netgroup has been defined as the following: > > dn: cn=ITgroup,ou=Netgroup,dc=mydomain,dc=com > objectClass: nisNetgroup > objectClass: top > cn: ITgroup > nisNetgroupTriple: (,l_luke,mydomain.com) > nisNetgroupTriple: (,w_smith,mydomain.com) > nisNetgroupTriple: (,g_baker,mydomain.com) > description: Password Keepers > > My user entry is: > > # l_luke, People mydomain.com > dn: uid=l_luke,ou=People,dc=mydomain,dc=com > uid: l_luke > cn: l_luke > objectClass: account > objectClass: posixAccount > objectClass: top > objectClass: shadowAccount > shadowLastChange: 13958 > shadowMax: 99999 > shadowWarning: 7 > loginShell: /bin/bash > uidNumber: 10005 > gidNumber: 10005 > homeDirectory: /home/l_luke > gecos: Luke Lee > > Can anyone point me to the right direction or share with me the correct > group ACL settings that you have? Thanks! As indicated in slapd.access(5), the member attribute must have either distinguishedName syntax (or nameAndOptionalUID syntax) or be derivated from memberURL; it defaults to "member". It appears from your message that you expect "nisNetgroupTriple" to be used as member attribute, but you should specify that attribute in the ACL clause. However, "nisNetgroupTriple" wouldn't be allowed since it doesn't comply with the above restrictions. You need to use LDAP groups for access control; nisNetGroup objects don't fit. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it --------------------------------------- ____________________________________________________________________________________ Looking for last minute shopping deals? Find them fast with Yahoo! Search. http://tools.search.yahoo.com/newsearch/category.php?category=shopping

2 1

OpenLDAP Group ACL
by Luke Lee 27 Mar '08

27 Mar '08

Hello, I'll appreciate it if any of you are willing to take time and share with me your experience with OpenLDAP running on a RedHat server configured with group ACL. I'm trying to grant a group of people (including myself) the permission to change user LDAP passwords. However, when I try to change a user's LDAP password, I received the following message: Result: Insufficient access (50) The command that I used was: ldappasswd -x -W -D "uid=l_luke,ou=Netgroup,dc=mydomain,dc=com" -S "uid=w_smith,ou=People,dc=mydomain,dc=com" My ACL settings in the slapd.conf file are: access to attr=userPassword by self write by anonymous auth by group.exact="cn=ITgroup,ou=Netgroup,dc=mydomain,dc=com" write by * none access to * by self write by group.exact="cn=ITgroup,ou=Netgroup,dc=mydomain,dc=com" write by * read My netgroup has been defined as the following: dn: cn=ITgroup,ou=Netgroup,dc=mydomain,dc=com objectClass: nisNetgroup objectClass: top cn: ITgroup nisNetgroupTriple: (,l_luke,mydomain.com) nisNetgroupTriple: (,w_smith,mydomain.com) nisNetgroupTriple: (,g_baker,mydomain.com) description: Password Keepers My user entry is: # l_luke, People mydomain.com dn: uid=l_luke,ou=People,dc=mydomain,dc=com uid: l_luke cn: l_luke objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowLastChange: 13958 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 10005 gidNumber: 10005 homeDirectory: /home/l_luke gecos: Luke Lee Can anyone point me to the right direction or share with me the correct group ACL settings that you have? Thanks! ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

2 1

ways to connect to IBM Lotus Directory
by Ildar Mulyukov 27 Mar '08

27 Mar '08

Hello, I want to replicate an IBM Lotus Directory version 8 to my OpenLDAP server. Does anyone have such an experience? Anyone to give me a good advice? Thank you. I was thinking of several questions: 1. I need IBM attributes, objectClasses etc. to use as an additional OpenLDAP schema. 1a. Is it possible to create a schema file using LDAP schema discovery? 2. Is Syncrepl of any use here? 3. As a last resort I could use ldapsearch+ldapadd as soon as I get Lotus schema. Thanks for any help. Best regards, Ildar -- Ildar Mulyukov, free SW designer/programmer ================================================ email: ildar(a)users.sourceforge.net home: http://tuganger.narod.ru/ ALT Linux Sisyphus ================================================

2 3

DSMLReader(dsmlFile) gives Invalid beginning tag :attr error
by Hamidreza Hamedtoolloei 26 Mar '08

26 Mar '08

Hey guys, I am using jldap to communicate with ldap, adn I get a exception when I am parsing a dsml file. In more details, the following line of code LDAPReader in = new DSMLReader(dsmlFile); gives the following error The following error occured handling a DSML file:LDAPLocalException: The following error occured while parsing DSML: org.xml.sax.SAXException: Invalid beginning tag :attr (84) Decoding Error org.xml.sax.SAXException: Invalid beginning tag :attr when dsmlFile is <dsml:directory-entries> <dsml:entry dn="uid=prabbit,ou=development,o=bowstreet,c=us"> <dsml:objectclass> <dsml:oc-value>top</dsml:oc-value> <dsml:oc-value>person</dsml:oc-value> <dsml:oc-value>organizationalPerson</dsml:oc-value> <dsml:oc-value>inetOrgPerson</dsml:oc-value> </dsml:objectclass> <dsml:attr name="sn"><dsml:value>Rabbit</dsml:value></dsml:attr> <dsml:attr name="uid"><dsml:value>prabbit</dsml:value></dsml:attr> <dsml:attr name="mail"><dsml:value>prabbit(a)dsml.org</dsml:value></dsml:attr> <dsml:attr name="givenname"><dsml:value>Peter</dsml:value></dsml:attr> <dsml:attr name="cn"><dsml:value>Peter Rabbit</dsml:value></dsml:attr> </dsml:entry> </dsml:directory-entries> Any suggestions?? thanks ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

How to write ldap client using openldap
by Brijesh Shukla 25 Mar '08

25 Mar '08

Hi All, I am new to openldap, I have just installed it on my linux machine (CentOS). I would like to write an experimental code for ldap client that can connect with Active directory. ( I know using authconfig on linux I can do it) I would like to know, Is one can write his/her own ldap client using openldap. if yes any sample code or guidelines? Thanks to read this mail, Looking forward for your reply. Regards Brijesh Shukla

2 1

RE: Solaris 10 Native LDAP Client TLS
by farhan ahmed 25 Mar '08

25 Mar '08

Hi Claus and Roy, Thanks for the reply. In fact nothing to do with sendmail, I pasted the wrong lines from /var/adm/messages, sorry for that LDAP Server: OpenLdap Linux LDAP Clients: Linux, Solaris 10, Solaris 9 and Solaris 8 Following command works fine for Solaris 10 but it doesn't work for 8 and 9. Please help me I really need to sort out this. ldapclient -v manual -a defaultServerList=10.10.10.10 -a defaultSearchBase=dc=test,dc=com -a authenticationMethod=tls:simple -a serviceAuthenticationMethod=pam_ldap:tls:simple -a credentialLevel=proxy -a serviceAuthenticationMethod=passwd-cmd:tls:simple -a proxyDN=cn=proxyagent,ou=Profile,dc=test,dc=com -a proxyPassword=test When I ran ldaplist I get following in /var/adm/messages on Solaris 9 Mar 21 23:35:38 web04 ldaplist[1932]: [ID 293258 user.warning] libsldap: Status: 81 Mesg: openConnection: simple bind failed - Can't contact LDAP serverMar 21 23:35:38 web04 ldaplist[1932]: [ID 292100 user.warning] libsldap: could not remove 203.221.221.83 from servers listMar 21 23:35:38 web04 ldaplist[1932]: [ID 293258 user.warning] libsldap: Status: 7 Mesg: Session error no available conn. While on server I get following in debugs Mar 21 23:29:50 rhapp04-t1 slapd[15119]: connection_read(10): checking for input on id=0Mar 21 23:29:50 rhapp04-t1 slapd[15119]: connection_read(10): TLS accept error error=-1 id=0, closingMar 21 23:29:51 rhapp04-t1 slapd[15119]: connection_closing: readying conn=0 sd=10 for close Really appreciate if someone shows me the right way to solve this issue. Cheers, Farhan -- From: farhhanahmed(a)hotmail.comTo: openldap-technical(a)openldap.orgSubject: RE: Solaris 10 Native LDAP Client TLSDate: Mon, 17 Mar 2008 13:01:56 +0000 Hi Guys, I have done it for Solaris 10 but now I am facing problem in Solaris 9. Please help me Still no luck with LDAP native client on Solaris 9. I am getting following messageMar 16 02:02:59 web04 sendmail[3700]: [ID 293258 mail.warning] libsldap: Status: 81 Mesg: openConnection: simple bind failed - Can't contact LDAP serverBut when I run /usr/lib/ldap/ldap_cachemgr -g, I get following which shows there is no problemcachemgr configuration:server debug level 0server log file "/var/ldap/cachemgr.log"number of calls to ldapcachemgr 19cachemgr cache data statistics:Configuration refresh information: Previous refresh time: 2008/03/17 23:55:23Next refresh time: 2008/03/18 00:55:23Server information: Previous refresh time: 2008/03/17 23:55:23Next refresh time: 2008/03/18 00:05:23server: 203.221.221.83, status: UPCache data information: Maximum cache entries: 256Number of cache entries: 0 ldapclient -vvv manual -a defaultServerList=10.10.10.10 -a defaultSearchBase=dc=test,dc=com -a authenticationMethod=tls:simple -a credentialLevel=proxy -a proxyDN=cn=proxyagent,ou=profile,dc=test,dc=com -a proxyPassword=test Note: Same command works for Solaris 10I really want to use LDAP native client rather than openldap client which is hassle to install gcc padle pam_ldap etc on 50 servers.Please help me guys.Thanks,Farhan From: farhhanahmed(a)hotmail.comTo: openldap-technical(a)openldap.orgSubject: Solaris 10 Native LDAP Client TLSDate: Fri, 14 Mar 2008 11:55:59 +0000 Hello Guys, I am having some issues to configure LDAP Native client with TLS. Please help me to sort out this issueLDAP Server: Linux (OpenLdap), LDAP Client: Solaris 10 (Native Client)When I run following command to test, it works fine, ldapsearch -v -h test -p 636 -Z -P /var/ldap/cert8.db -b "dc=test,dc=com" -s base "objectclass=*"ldapsearch: started Fri Mar 14 18:11:57 2008ldap_init( test, 636 )filter pattern: objectclass=*returning: ALLfilter is: (objectclass=*)version: 1dn: dc=test,dc=comobjectClass: dcObjectobjectClass: organizationo: test.com web sitedc: test1 matchesBut When I run ldapclient command to initialize ldapclient, it doesn't work, please guide me where I am doing wrongldapclient -v manual -a defaultServerList=10.10.10.10-a defaultSearchBase=dc=test,dc=com -a authenticationMethod=tls:simple -a serviceAuthenticationMethod=pam_ldap:tls:simple -a serviceAuthenticationMethod=keyserv:tls:simple -a serviceAuthenticationMethod=passwd-cmd:tls:simple-a credentialLevel=proxy -a proxyDN=cn=Manager,ou=People,dc=test,dc=com -a proxyPassword=passwdAfter that when I run ldaplist command, I get following in /var/adm/messagesMar 14 18:15:16 subx05-t1 nfs4cbd[1638]: [ID 293258 daemon.warning] libsldap: Status: 91 Mesg: openConnection: failed to initializeTLS security (security library: bad database.)Please help me guys :) I know I am very near to get it workingThanks,Farhan at CarPoint.com.au It's simple! Sell your car for just $30 at CarPoint.com.au It's simple! Sell your car for just $30 _________________________________________________________________ Fashion, beauty, health, relationship advice and horoscopes. http://ninemsn.com.au/share/redir/adTrack.asp?mode=click&clientID=873&refer…

3 2

NIS to ldap layout
by Eric Ritchie 24 Mar '08

24 Mar '08

I have 3 NIS domains I wish to convert to ldap. I would like to keep 3 separate areas in ldap since the NIS domains have different accounts. I created a base dn and loaded data under 3 higher levels, such as base is dc=xyz,dc=com and dc=a,dc=xyz,dc=com dc=b,dc=xyz,dc=com dc=c,dc=xyz,dc=com. Then if I want client one to be in domain a, I set its base to dc=a,dc=xyz,dc=com. This works for host name lookups but when another host tries to login to the box via telnet or rsh, the login hangs after the password is entered, ssh works though. If I specify a binddn on the client with dc=a,dc=xyz,dc=com, I can login via telnet and rsh but name lookups fail on the host. Any idea what is causing this? Is this the best way to have separate DBs for clients? Thanks -- Eric Ritchie Interactive Brokers LLC 203-618-5868

1 0

Authentication against translucent ldap server
by Javier Barroso 24 Mar '08

24 Mar '08

Hi, I've configured ldap translucent overlay with slapd-ldap as backend. Then I changed userPassword of a user. When I try to auth to the translucent server, the new password is not valid, and I have to introduce the password that be in ldap server which is being proxied. I would like new password would be the password used for auth. Do you know how could I configure such approach ? Thank you in advanced

1 0

workin on Openldap-2.4.7
by divya shree 22 Mar '08

22 Mar '08

Hii I am doin a project where in i hav to use Ldap to provide a single login 4 various services used.. I hav successfully installed the openladp-2.4.7 server...by configuring the slapd.conf file... i wanted more info of LDAP client utilities..n how to query the server...n also wat should b my next step to achieve the objective... Thanks and Regards Divya --------------------------------- Now you can chat without downloading messenger. Click here to know how.

3 2

MySQL as MailBox and LDAP for authentication
by koko fofo 22 Mar '08

22 Mar '08

Hello every body; I'm going to install Postfix mail server with MySQL as mailbox container and LDAP for authentication purpose. I want good documentation to do it. Thanks --------------------------------- Never miss a thing. Make Yahoo your homepage.

4 6

Having troubles compiling openldap
by chris croswhite 21 Mar '08

21 Mar '08

Folks, There is probably an easy answer to this, however, I am stuck trying to compile openldap: getpeereid.c: In function 'lutil_getpeereid': getpeereid.c:64: error: storage size of 'peercred' isn't known make[2]: *** [getpeereid.o] Error 1 make[2]: Leaving directory `/var/tmp/openldap-2.4.8/libraries/liblutil' make[1]: *** [all-common] Error 1 make[1]: Leaving directory `/var/tmp/openldap-2.4.8/libraries' make: *** [all-common] Error 1 The struct type has its prototype in file sys/ucred.h but on linux (or at least all the variants I looked at), this is not a typical system file and google leads me to believe this is a BSD/BSD-variant system header. I am building with gcc4.3 and a linux w/2.4.25 kernel. Any clue what I am doing wrong here? Thanks!

1 0

Re: Numerical result out of range ... not solvable !
by Tamer Al-Khouli 21 Mar '08

21 Mar '08

But the entry exists in the openLDAP database and that's where it should check for it (since i configured pam to do do that). This is the whole point i am trying to get from centralized user authentication after all !! The openLDAP sever should be contacted to authenticate the users from different clients without the need for these clients to use their /etc/passwd files ! On Fri, Mar 21, 2008 at 5:25 PM, Matt Parker <parkerman(a)gmail.com> wrote: > > However, when > > i use the command su to switch to user1 ( which i commented out from > > /etc/passwd/) i get a message telling me that the user does not exist. > > /etc/passwd is the list of users in a *nix operating system. > commenting out user1 makes that account no longer exist. you cannot > 'su' to a user which doesn't exist. >

2 2

Numerical result out of range ... not solvable !
by Tamer Al-Khouli 21 Mar '08

21 Mar '08

Hi guys, I am setting up a centralized authentication server using openLDAP without TLS/SSL. I added the /etc/passwd and /etc/shadow entries, an looked them up using: $ldapsearch -x -D "uid=user1,ou=People,dc=example,dc=com" -w user1 "(objectclass=*)" where user1 is the password of the user user1, and i got all the entries. I also configured pam so that it uses pam_ldap. However, when i use the command su to switch to user1 ( which i commented out from /etc/passwd/) i get a message telling me that the user does not exist. Running slapd in the debugging mode i notice an errno=34 "Numerical result out of range". I googled it and found that this can be solved by adding the directives sockbuf_max_incoming and sockbuf_max_incoming_auth. I added the directives and tried with many values like 1234567, 999999, 9999999 for each of the them, still, i am getting the same error message. What else can i do to get rid of this error ?!

2 1

Re: Problems creating a Samba4 LDAP Backend
by Howard Chu 21 Mar '08

21 Mar '08

simo wrote: > On Wed, 2008-03-19 at 17:33 -0700, Howard Chu wrote: >> Searching on memberOf doesn't make a lot of sense to me, when you could simply >> read the group object directly. When is this actually a useful thing to do? An >> alternative would be to make the memberOf overlay intercept these filters and >> rewrite them in terms of member. > > Premise: here I am thinking beyond what AD is doing as I use the > memberOf concept in another project. > >> From my usage memberOf makes it very simple to find all the groups a > member is part of even if that membership derives from nested grouping. Ah, an interesting point, but probably a separate discussion. Note that the OpenLDAP memberOf overlay doesn't handle nested groups. > It's very clear that most of the time you have an identity and you want > to know what this Identity is part of, not the other way. No, not clear at all. A very common application of "groups" is for things like email lists. In that case, an MTA knows a specific group (the name of the email list), and needs to know all of the members. Other times (e.g. access control) you know an identity (current user) and want to know if the identity belongs to a particular group (for an authorization check). In that case, it is an equal amount of work to look in the user's entry for a memberOf value as to look in the group entry for the particular member value. In practice, because groups may be referenced frequently for multiple users, the group entries will be hot in the server cache and so the member lookup is actually cheaper. The frequency with which the question "what groups do I belong to" is asked is extremely low in most applications. The frequency with which the question "is XX a member of this group" is asked is very high in most applications. E.g., the libc initgroups() call needs to know what groups you belong to; that call typically occurs only once at the beginning of a login session. After that the result is essentially cached by the kernel. The result is cached in the kernel because the subsequent "is XX a member of group YY" questions happen so frequently as a process accesses system resources. > So you really want to do a single search on one entry, rather than a > huge search on the whole directory to find out (including local > calculation for nesting) what groups include that identity as member, by > parsing all groups one by one. > It is as simple as that. No, not simple at all. Yes, ideally you would like to be able to look in a single place and get the answer to "what privileges does user X have" but that doesn't actually mean what you're implying. In particular, the "single place" you're looking isn't necessarily that user's own entry. In most cases, that's the worst place to use because users generally have full write privileges to their own data, and the data comprising their set of privileges really belongs to the sysadmin, not to the individual user. Ideally, you write to the privilege set and read from the privilege set in the same way, in the same place. As an administrator, this simple consistency makes life easier. The memberOf concept is fundamentally broken if you actually rely on it for privilege determination because it is one step removed from how privileges are actually assigned by the sysadmin. (I.e., the sysadmin doesn't assign membership privileges to a user by writing to the memberOf attribute, therefore memberOf is not authoritative.) > Now for what concern the Samba4 problem, I think we should be more > creative and first understand in which cases we might hit a problem with > plugins like memberOf. I am sure some of these cases are just normal > possible inconsistencies that can happen even in a normal AD server if > you do many modifications at the same time. For these cases we just have > to try not to make them more probable or problematic than what they are > now. > In other cases we might think of doing aggressive caching/prediction in > our internal transactions. It might require some more work, but it could > be a viable option, and also drive some more performance as dealing with > an external LDAP is necessarily slower. > Finally, if caching/prediction is not possible, we can think of writing > overlays/slapi plugins directly for the LDAP server of choice be it > OpenLDAP or Fedora Directory Server or anything else. This third option > would require some more work and will be server specific, and perhaps > involve some creative thinking wrt licensing, but it is certainly a > viable option we should not discard. After all, these LDAP servers have > a plugin system with defined APIs exactly to solve those problems that > cannot be solved merely by external interaction. Agreed. And frankly, there's already an existence proof that this approach is viable. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: ldap_add: Server is unwilling to perform (53) error:
by shanmuga priya 21 Mar '08

21 Mar '08

On Tue, Mar 18, 2008 at 12:13 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, March 18, 2008 12:12 AM +0530 vinodh kumar > <vinstce(a)gmail.com> wrote: > > > > so , we need to add a entry objectclass : account in our .ldif file > > right??? > > and do i need to add the above in schema file ???? > > > > sorry if my doubt is silly!! bare with me :) > > If you have loaded the cosine schema, then all you need to do is add the > objectClass: account into your ldif file. > hello sir.. i am also one in that project..well we already loaded cosine schema..and it contains account ..as you said we added object class account in our ldif file..but still we are getting the very same error??where are we missing??? > > --Quanah > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Future is now.. @http://shanmugapriya.wordpress.com/

2 1

a problem with centralized authentication using openLDAP
by Tamer Al-Khouli 20 Mar '08

20 Mar '08

Hi everyone, I am trying to set up and openLDAP server for centralized authentication. I used self-signed certificate and put the generated server.pem file in the slapd.conf, then i checked it using the following command: $openssl s_client -connect localhost:636 -showcerts and i got : Verify return code: 18 (self signed certificate) which, as i read, indicates that things fine with the server. Next, i tired: $ldapsearch -x "uid=user1" and i got : ============ # extended LDIF # # LDAPv3 # base <> with scope subtree # filter: uid=user1 # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 ============= Even though there's an entry with that uid, so i ran slapd in the debug mode 9 using this command: $/usr/sbin/slapd -d9 -h "ldap:/// ldaps:///" 1>/var/log/ldaplog 2>&1 and i did the ldapsearch again and got this from the log: ========================== TLS trace:SSL_accept:error in SSLv3 read client certificate A .... commection_read(14): unable to get TLS client DN, error=49 id=6 .... connection_read(14): input error=-2 id=6, closing. ========================== I thought the error seen in the log could be related to the fact that i didn't do anything on the client side to give it a certificate, so i assigned the same server.pem file to the client in the /etc/openldap/ldap.conf file as follows: .... TLS_CACERT /etc/openldap/server.pem TLS_REQCERT allow .... and issued the ldapsearch command again, and i got this: ldap_bind: Can't contact LDAP server (-1) additional info: TLS: hostname does not match CN in peer certificate. I am stuck here and don't know what to do, can any one help, please ?!

2 1

Solaris 10 Client ; Openldap 2.4 Server; supportedControl supportedsaslmechanisms
by Mark S 20 Mar '08

20 Mar '08

I am running a Solaris 10 x86 environment and have built Openldap 2.4.8 as by LDAP server platform. On the client side I have run the following ldapclient command to configure my clients; ldapclient manual -v -a credentialLevel=anonymous \ -a authenticationMethod=none \ -a defaultsearchbase='dc=nyc,dc=example,dc=com' \ -a defaultServerList=10.0.0.1 \ -a serviceSearchDescriptor=passwd:ou=people,dc=nyc,dc=example,dc=com?one \ -a serviceSearchDescriptor=group:ou=group,dc=nyc,dc=example,dc=com?one \ -a serviceSearchDescriptor=services:ou=services,dc=nyc,dc=example,dc=com?one \ -a serviceSearchDescriptor=protocols:ou=protocols,dc=nyc,dc=example,dc=com?one \ -a serviceSearchDescriptor=rpc:ou=rpc,dc=nyc,dc=example,dc=com?one \ -a serviceSearchDescriptor=hosts:ou=hosts,dc=nyc,dc=example,dc=com?one \ -a serviceSearchDescriptor=networks:ou=networks,dc=nyc,dc=example,dc=com?one \ -a serviceSearchDescriptor=netgroup:ou=netgroup,dc=nyc,dc=example,dc=com?one I have ended up with the following /var/ldap/ldap_client_file NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_SERVERS= 10.0.0.1 NS_LDAP_SEARCH_BASEDN= dc=nyc,dc=example,dc=com NS_LDAP_AUTH= none NS_LDAP_CACHETTL= 0 NS_LDAP_CREDENTIAL_LEVEL= anonymous NS_LDAP_SERVICE_SEARCH_DESC= passwd:ou=people,dc=nyc,dc=example,dc=com?one NS_LDAP_SERVICE_SEARCH_DESC= group:ou=group,dc=nyc,dc=example,dc=com?one NS_LDAP_SERVICE_SEARCH_DESC= services:ou=services,dc=nyc,dc=example,dc=com?one NS_LDAP_SERVICE_SEARCH_DESC= protocols:ou=protocols,dc=nyc,dc=example,dc=com?one NS_LDAP_SERVICE_SEARCH_DESC= rpc:ou=rpc,dc=nyc,dc=example,dc=com?one NS_LDAP_SERVICE_SEARCH_DESC= hosts:ou=hosts,dc=nyc,dc=example,dc=com?one NS_LDAP_SERVICE_SEARCH_DESC= networks:ou=networks,dc=nyc,dc=example,dc=com?one NS_LDAP_SERVICE_SEARCH_DESC= netgroup:ou=netgroup,dc=nyc,dc=example,dc=com?one NS_LDAP_SERVICE_SEARCH_DESC= automount:ou=automount,dc=nyc,dc=example,dc=com?one In general all is working fine. My one concerns is that when I have been monitoring the ldap logs i see the below query over and over again Mar 18 12:10:23 ldap1.nyc.example.com slapd[6642]: [ID 848112 local4.debug] conn=9423 fd=38 ACCEPT from IP=10.0.1.182:42757 (IP=0.0.0.0:389) Mar 18 12:10:23 ldap1.nyc.example.com slapd[6642]: [ID 469902 local4.debug] conn=9423 op=0 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" Mar 18 12:10:23 ldap1.nyc.example.com slapd[6642]: [ID 744844 local4.debug] conn=9423 op=0 SRCH attr=supportedControl supportedsaslmechanisms Mar 18 12:10:23 ldap1.nyc.example.com slapd[6642]: [ID 167594 local4.debug] conn=9423 op=0 SEARCH RESULT tag=101 err=0 nentries=1 text= Mar 18 12:10:23 ldap1.nyc.example.com slapd[6642]: [ID 218904 local4.debug] conn=9423 op=1 UNBIND Mar 18 12:10:23 ldap1.nyc.example.com slapd[6642]: [ID 952275 local4.debug] conn=9423 fd=38 closed Does anyone know why the Solaris ldap_cachemgr process keeps performing this query over and over again and what I might do to stop it. Thanks!

2 4

RE: Solaris 10 Native LDAP Client TLS
by farhan ahmed 20 Mar '08

20 Mar '08

Hi Guys, I have done it for Solaris 10 but now I am facing problem in Solaris 9. Please help me Still no luck with LDAP native client on Solaris 9. I am getting following messageMar 16 02:02:59 web04 sendmail[3700]: [ID 293258 mail.warning] libsldap: Status: 81 Mesg: openConnection: simple bind failed - Can't contact LDAP serverBut when I run /usr/lib/ldap/ldap_cachemgr -g, I get following which shows there is no problemcachemgr configuration:server debug level 0server log file "/var/ldap/cachemgr.log"number of calls to ldapcachemgr 19cachemgr cache data statistics:Configuration refresh information: Previous refresh time: 2008/03/17 23:55:23Next refresh time: 2008/03/18 00:55:23Server information: Previous refresh time: 2008/03/17 23:55:23Next refresh time: 2008/03/18 00:05:23server: 203.221.221.83, status: UPCache data information: Maximum cache entries: 256Number of cache entries: 0 ldapclient -vvv manual -a defaultServerList=10.10.10.10 -a defaultSearchBase=dc=test,dc=com -a authenticationMethod=tls:simple -a credentialLevel=proxy -a proxyDN=cn=proxyagent,ou=profile,dc=test,dc=com -a proxyPassword=test Note: Same command works for Solaris 10I really want to use LDAP native client rather than openldap client which is hassle to install gcc padle pam_ldap etc on 50 servers.Please help me guys.Thanks,Farhan From: farhhanahmed(a)hotmail.comTo: openldap-technical(a)openldap.orgSubject: Solaris 10 Native LDAP Client TLSDate: Fri, 14 Mar 2008 11:55:59 +0000 Hello Guys, I am having some issues to configure LDAP Native client with TLS. Please help me to sort out this issueLDAP Server: Linux (OpenLdap), LDAP Client: Solaris 10 (Native Client)When I run following command to test, it works fine, ldapsearch -v -h test -p 636 -Z -P /var/ldap/cert8.db -b "dc=test,dc=com" -s base "objectclass=*"ldapsearch: started Fri Mar 14 18:11:57 2008ldap_init( test, 636 )filter pattern: objectclass=*returning: ALLfilter is: (objectclass=*)version: 1dn: dc=test,dc=comobjectClass: dcObjectobjectClass: organizationo: test.com web sitedc: test1 matchesBut When I run ldapclient command to initialize ldapclient, it doesn't work, please guide me where I am doing wrongldapclient -v manual -a defaultServerList=10.10.10.10-a defaultSearchBase=dc=test,dc=com -a authenticationMethod=tls:simple -a serviceAuthenticationMethod=pam_ldap:tls:simple -a serviceAuthenticationMethod=keyserv:tls:simple -a serviceAuthenticationMethod=passwd-cmd:tls:simple-a credentialLevel=proxy -a proxyDN=cn=Manager,ou=People,dc=test,dc=com -a proxyPassword=passwdAfter that when I run ldaplist command, I get following in /var/adm/messagesMar 14 18:15:16 subx05-t1 nfs4cbd[1638]: [ID 293258 daemon.warning] libsldap: Status: 91 Mesg: openConnection: failed to initializeTLS security (security library: bad database.)Please help me guys :) I know I am very near to get it workingThanks,Farhan at CarPoint.com.au It's simple! Sell your car for just $30 _________________________________________________________________ New music from the Rogue Traders - listen now! http://ninemsn.com.au/share/redir/adTrack.asp?mode=click&clientID=832&refer…

3 2

Problems creating a Samba4 LDAP Backend
by Andrew Bartlett 20 Mar '08

20 Mar '08

Over the past few weeks, I have been testing OpenLDAP as a backend for Samba4. I've been working with the OpenLDAP team on my requirements, and there has been some really good outcomes - the memberOf module has been improved, as has the refint module. However, I seem to have hit a brick wall, in the form of (internal) transaction support. I need an LDAP backend to support internal transactions - that is, when for example a 'member' modification is made, all the memberOf attributes must be updated before the call returns. Similarly, if a user or group moves, all the member/memberOf attributes that link the user to their groups must also move, before the modrdn returns. The Samba4 test ldap.js tests this behaviour extensively, because I want to be sure it works. As understand the discussion I've had with the OpenLDAP team, OpenLDAP does not support this, and will not support it for perhaps some time. Similarly, from discussions with the Fedora DS team at the CIFS developer days, I understand that it is similarly very unlikely that Fedora DS will support internal transactions. (It also does not support subtree renames, which we also need). The fact that LDAP does not expose a transaction API was always going to be a difficult part of having Samba4 use an LDAP backend, but I always assumed that if we pushed the really hard bit - updating linked attributes - into the LDAP server that we could at least always have a consistent DB. (It turns out this is one of the primary uses of transactions anyway.) But without that consistency, and without knowing as a caller if all the updates succeed, I'm worried about how we can safely move forward. This is especially disappointing because I was hoping that these free, replicating LDAP servers might solve the backed replication problem for me, without needing to use AD replication. Does anybody have any ideas or suggestions on how I could get around this? Should we drop the LDAP backend as a nice idea, but not going to work, and focus on DRS or some other form of replication? Can someone imagine a sane way to reconstruct the DN links, including subtree renames, without the help of the LDAP backend? Could we ban subtree renames (as Fedora DS does), and try to handle this ourselves (with pre/post checks and a good deal of prayer)? Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

2 5

Re: ldap_add: Server is unwilling to perform (53) error:
by vinodh kumar 17 Mar '08

17 Mar '08

On Mon, Mar 17, 2008 at 11:29 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Monday, March 17, 2008 11:26 PM +0530 vinodh kumar <vinstce(a)gmail.com > > > wrote: > > our ldif file is, > > > > > > > > dn: cn:new,dc=example,dc=com > > > > objectClass:posixAccount > > cn:new > > uid:new > > displayname:neww > > homedirectory > > > homedirectory:/home/new > > I suggest you research into objectClasses and valid objectClass chains. > The error you've gotten is quite correct, you've failed to provide a > structural objectClass in your entry. Think of it in terms of object > oriented programming -- Every entry object must be of a specific class, > which can then be added onto with auxiliary information. posixAccount is > auxiliary, you need to add a valid structural OC to your entry. > > "account" may be the one you're looking for: oh thanks:) actually i have a doubt that where to add this??? objectclass ( 0.9.2342.19200300.100.4.5 NAME 'account' > SUP top STRUCTURAL > MUST userid > MAY ( description $ seeAlso $ localityName $ > organizationName $ organizationalUnitName $ host ) > ) > > > --Quanah > > so , we need to add a entry objectclass : account in our .ldif file right??? and do i need to add the above in schema file ???? sorry if my doubt is silly!! bare with me :) -- regards vinodh i blog @ http://vinsvision.wordpress.com

2 1

ldap_add: Server is unwilling to perform (53) error:
by vinodh kumar 17 Mar '08

17 Mar '08

hello all, we are trying to setup a ldap server which uses the mysql as back-end instead of bdb backend.we have installed slapd and ldap-utils in debian-etch .we also have installed mylibodbc, mysql-client-5,mysql-server-5. we have established the mysql-ODBC connectivity and tested the connectivity using isql.we have configured the slapd.conf file to connect mysql and when we tried to add entries using ldapadd , we get the following err ldap_add: Server is unwilling to perform (53) additional info: operation not permitted within namingContext this is the slapd.conf file # This is the main slapd configuration file. See slapd.conf(5) for more # info on the configuration options. ############################# Global Directives: # Features to permit #allow bind_v2 # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values loglevel 0 # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_sql # The maximum number of entries that is returned for a search operation sizelimit 500 # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 1 ############################## > > ######################################### > # Specific Backend Directives for bdb: > # Backend specific directives apply to this backend until another > # 'backend' directive occurs > backend sql > checkpoint 512 30 > > ####################################################################### > # Specific Backend Directives for 'other': > # Backend specific directives apply to this backend until another > # 'backend' directive occurs > #backend <other> > > ####################################################################### > # Specific Directives for database #1, of type bdb: > # Database specific directives apply to this databasse until another > # 'database' directive occurs > database sql > suffix "dc=example,dc=org" > rootdn "cn=admin,dc=example,dc=org" > rootpw ldap > dbname ldap > dbuser new > dbpasswd new > #insentry_query "insert into ldap_entries (id,dn,oc_map_id,parent,keyval) > values ((select max(id)+1 from ldap_entries),?,?,?,?)" > #upper_func "upper" > #strcast_func "text" > #concat_pattern "?||?" > #has_ldapinfo_dn_ru no > #schemacheck on > > lastmod off > > > # The base of your directory in database #1 > suffix "dc=example,dc=org" > > # rootdn directive for specifying a superuser on the database. This is > needed > # for syncrepl. > rootdn "cn=admin,dc=example,dc=org" > rootpw secret > # Where the database file are physically stored for database #1 > directory "/var/lib/ldap" > > # For the Debian package we use 2MB as default but be sure to update this > # value if you have plenty of RAM > dbconfig set_cachesize 0 2097152 0 > > # Sven Hartge reported that he had to set this value incredibly high > # to get slapd running at all. See http://bugs.debian.org/303057 > # for more information. > > # Number of objects that can be locked at the same time. > dbconfig set_lk_max_objects 1500 > # Number of locks (both requested and granted) > dbconfig set_lk_max_locks 1500 > # Number of lockers > dbconfig set_lk_max_lockers 1500 > > # Indexing options for database #1 > index objectClass eq > cn,sn,ou > # Save the time that the entry gets modified, for database #1 > lastmod on > > # Where to store the replica logs for database #1 > # replogfile /var/lib/ldap/replog > > # The userPassword by default can be changed > # by the entry owning it if they are authenticated. > # Others should not be able to see it, except the > # admin entry below > # These access lines apply to database #1 only > access to attrs=userPassword,shadowLastChange > by dn="cn=admin,dc=example,dc=org" write > by anonymous auth > by self write > by * none > > # Ensure read access to the base for things like > # supportedSASLMechanisms. Without this you may > # have problems with SASL not knowing what > # mechanisms are available and the like. > # Note that this is covered by the 'access to *' > # ACL below too but if you change that as people > # are wont to do you'll still need this if you > # want SASL (and possible other things) to work > # happily. > access to dn.base="" by * read > > # The admin dn has full write access, everyone else > # can read everything. > access to * > by dn="cn=admin,dc=example,dc=org" write > by * none > > # For Netscape Roaming support, each user gets a roaming > # profile for which they have write access to > #access to dn=".*,ou=Roaming,o=morsnet" > # by dn="cn=admin,dc=example,dc=org" write > # by dnattr=owner write > > ####################################################################### > # Specific Directives for database #2, of type 'other' (can be bdb too): > # Database specific directives apply to this databasse until another > # 'database' directive occurs > #database <other> > > # The base of your directory for database #2 > #suffix "dc=debian,dc=org" > -- regards vinodh i blog @ http://vinsvision.wordpress.com

3 8

Loading the refint module globally?
by Andrew Bartlett 17 Mar '08

17 Mar '08

I've been wondering why I couldn't get the wonders of refint and memberOf to play together, and even went to the extent of writing a testsuite to prove that they could work (indeed, they do). However, I eventually found my problem - while memberOf works very nicely as a global overlay, the refint module does not (yet :-). With it loaded per-backend (for now), it seems to work. Any chance someone could knock me up a patch for that, much like was done so well for memberOf? Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

3 10

proxycache examples
by Andy Cobaugh 15 Mar '08

15 Mar '08

I'm working in an environment where the server I wish to use for user and group lookups (through nss_ldap on RHEL) limits the number of queries per IP per day to 200. I want to cache as much as I can locally, for as long as I can. This data hardly ever changes, so the longer I can cache, the better. I'm thinking of caching everything for at least a day, if not longer. Does the pcache overlay currently support such long ttl's? Does anyone have any working pcache configs that can be used to cache the kind of searches performed by nss_ldap ? -- Andy Cobaugh

2 1

Changing attribute values on the consumer
by Kyriakos Stefanidis 14 Mar '08

14 Mar '08

Hello all, Is it possible to change the attribute values on the consumer (of the replication scheme) or add new attributes and preserve them during replication? Im using external scripts that refresh the values/attributes regulary but I was wondering if there is another more "elegant" way Best Regards Kyriakos

3 4

ldap + xsd
by Yan Falken 14 Mar '08

14 Mar '08

Hi, I have one (maybe stupid - so sorry for it :) ) question - is it possible to employ somehow xsd schemas with ldap? My problem is that I need here to document all the possible directory configurations and I'm familiar with xsd and newbie in ldap - so I'm just reasoning if it may be possible to use it for documentation and future schema generation in the next phase. Thanks YF

3 2

Solaris 10 Native LDAP Client TLS
by farhan ahmed 14 Mar '08

14 Mar '08

Hello Guys, I am having some issues to configure LDAP Native client with TLS. Please help me to sort out this issueLDAP Server: Linux (OpenLdap), LDAP Client: Solaris 10 (Native Client)When I run following command to test, it works fine, ldapsearch -v -h test -p 636 -Z -P /var/ldap/cert8.db -b "dc=test,dc=com" -s base "objectclass=*"ldapsearch: started Fri Mar 14 18:11:57 2008ldap_init( test, 636 )filter pattern: objectclass=*returning: ALLfilter is: (objectclass=*)version: 1dn: dc=test,dc=comobjectClass: dcObjectobjectClass: organizationo: test.com web sitedc: test1 matches But When I run ldapclient command to initialize ldapclient, it doesn't work, please guide me where I am doing wrongldapclient -v manual -a defaultServerList=10.10.10.10-a defaultSearchBase=dc=test,dc=com -a authenticationMethod=tls:simple -a serviceAuthenticationMethod=pam_ldap:tls:simple -a serviceAuthenticationMethod=keyserv:tls:simple -a serviceAuthenticationMethod=passwd-cmd:tls:simple-a credentialLevel=proxy -a proxyDN=cn=Manager,ou=People,dc=test,dc=com -a proxyPassword=passwdAfter that when I run ldaplist command, I get following in /var/adm/messagesMar 14 18:15:16 subx05-t1 nfs4cbd[1638]: [ID 293258 daemon.warning] libsldap: Status: 91 Mesg: openConnection: failed to initializeTLS security (security library: bad database.)Please help me guys :) I know I am very near to get it workingThanks,Farhan _________________________________________________________________ New music from the Rogue Traders - listen now! http://ninemsn.com.au/share/redir/adTrack.asp?mode=click&clientID=832&refer…

1 0

Exception while modifying for Open LDAP 2.3 via TLS
by Narayana Murthy Pedapudi 14 Mar '08

14 Mar '08

Please note that I have not used TLSVerifyClient property at all.... # moduleload back_shell.la TLSCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM :+LOW:+SSLv2:+SSLv3:+EXP TLSCACertificateFile /usr/local/var/openldap-data/cacert.pem TLSCertificateFile /usr/local/var/openldap-data/servercrt.pem TLSCertificateKeyFile /usr/local/var/openldap-data/serverkey.pem # Client verification not required #TLSVerifyClient never But I get a different error if I use TLSVerifyclient demand # Client verification not required TLSVerifyClient demand Please find below exception for this java.net.SocketException: Software caused connection abort: recv failed at java.net.SocketInputStream.socketRead0(Native Method) at java.net.SocketInputStream.read(SocketInputStream.java:129) at com.sun.net.ssl.internal.ssl.InputRecord.readFully( InputRecord.java:293) at com.sun.net.ssl.internal.ssl.InputRecord.read(InputRecord.java :331) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord( SSLSocketImpl.java:723) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.waitForClose( SSLSocketImpl.java:1366) at com.sun.net.ssl.internal.ssl.HandshakeOutStream.flush( HandshakeOutStream.java:103) at com.sun.net.ssl.internal.ssl.Handshaker.sendChangeCipherSpec( Handshaker.java:590) at com.sun.net.ssl.internal.ssl.ClientHandshaker.sendChangeCipherAndFinish (ClientHandshak java:698) at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverHelloDone( ClientHandshaker.java:62 at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage( ClientHandshaker.java:160 at com.sun.net.ssl.internal.ssl.Handshaker.processLoop( Handshaker.java:495) at com.sun.net.ssl.internal.ssl.Handshaker.process_record( Handshaker.java:433) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord( SSLSocketImpl.java:818) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake( SSLSocketImpl.java: 0) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake( SSLSocketImpl.java:1057) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake( SSLSocketImpl.java:1041) at com.sun.jndi.ldap.ext.StartTlsResponseImpl.startHandshake( StartTlsResponseImpl.java:34 at com.sun.jndi.ldap.ext.StartTlsResponseImpl.negotiate( StartTlsResponseImpl.java:208) at com.sun.jndi.ldap.ext.StartTlsResponseImpl.negotiate( StartTlsResponseImpl.java:161) at ModifyAttr.main(ModifyAttr.java:38) Thanks in advance.. -- Narayana Murthy http://narayana-leo.blogspot.com/ http://blogs.sun.com/narayana

1 1

OpenLDAP custom binding operation.
by Sérgio Afonso 13 Mar '08

13 Mar '08

Hello all, We are developing an authentication system based on OpenLDAP. We have created a specific schema, with some password fields intended to be used in different kinds of applications. This attributes (password1, password2, ... passwordx) inherit the userPassword attribute. One of our applications use the ldap_bind method to authenticate its users, and we want it to bind against the attribute password1. However the ldap_bind seems to be hardcoded to just check the userPassword attribute. We have tried using the rwm overlay, and even though we could see the password1 translated to userPassword with an ldapsearch we are unable to bind against it. Is there any overlay besides rwm that could be used to fulfill this authentication scenario? Thanks for any help someone might give us. Best regards, Sérgio Afonso

1 0

LDAP Writes are not propagated to mirror nodes.
by K C, Sachin (Sachin) 13 Mar '08

13 Mar '08

Hello All, I am trying to setup Mirror Mode of replication. Using the configuration files listed below for 2 node setup. The database comes up and after every 2 or 3 writes, the data is not pushed onto the other mirror node. This is happening on both the mirror nodes. I am getting the following error: slap_client_connect: URI=ldap://135.254.229.102:389 DN="uid=<UID>,o=csosso_arc" ldap_sasl_bind_s failed (-1) slap_client_connect: URI=ldap://135.254.229.102:389 DN="uid=<UID>,o=csosso" ldap_sasl_bind_s failed (-1) This is happening after 2 or 3 write operations to the database. The slapd.conf on node 1 is: ================================= database bdb suffix "o=CSOSSO" directory /opt/cso/ldap/db rootdn "uid=<UID>,o=CSOSSO" rootpw <PWD> # cleartext passwords, especially for the rootdn, should # be avoid. See slapd.conf(5) for details. cachesize 10000 index cn pres,eq,sub index sn pres,eq,sub index givenName pres,eq,sub index uid eq index objectclass,entryCSN,entryUUID eq include /opt/cso/ldap/replica/135.254.229.102-390 database bdb suffix "o=CSOSSO_ARC" directory /opt/cso/ldap/db_arc rootdn "uid=<UID>,o=CSOSSO_ARC" rootpw <PWD> # cleartext passwords, especially for the rootdn, should # be avoid. See slapd.conf(5) for details. cachesize 10000 index cn pres,eq,sub index sn pres,eq,sub index givenName pres,eq,sub index uid eq index objectclass,entryCSN,entryUUID eq include /opt/cso/ldap/replica/135.254.229.102-390-arc ========================================= The syncrepl configuration on node 1 is: ========================================= syncrepl rid=1 provider=ldap://135.254.229.102:389 type=refreshAndPersist interval=00:00:01:00 retry="30 +" searchbase="ou=people,o=csosso" filter="(objectclass=*)" scope=sub attrs="*,+" sizelimit="unlimited" timelimit="unlimited" schemachecking=off bindmethod=simple binddn="uid=<UID>,o=CSOSSO" credentials=<PWD> mirrormode on overlay syncprov syncprov-checkpoint 100 1 syncprov-sessionlog 100 ======================================= Same configuration files are used on node 2 except the port numbers and the serverID. Thanks Sachin

5 28

samba + openldap ->connexion to PDC impossible !
by franck dufau 12 Mar '08

12 Mar '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hye Gurus ! i'am newbie on this maillist - and my english is not very good -> sorry! i'am verry interrested in samba using ldap authentifiaction i have see many howto on internet about this subject. However my win XP sp2 do not want connect to my Samba pdc server perhaps something wrong... OS debian etch i add user like this : # smbldap-useradd -a -P -c "toto DUPONT" toto # smbldap-useradd -a -P toto on windows : i see my domaine and i can use authentification to acces on folder on the pdc ! but when i want add my win xp into the domaine ! impossible ! can someone help me ? ###################### smb.conf ###########################" [global] workgroup = minou netbios name = debian server string = Samba-LDAP PDC Server domain master = Yes local master = Yes domain logons = Yes os level = 40 #passwd program = /usr/sbin/smbldap-passwd ?u %u ldap passwd sync = Yes passdb backend = ldapsam:ldap://127.0.0.1/ ldap admin dn = cn=Manager,dc=mondomaine,dc=net ldap suffix = dc=mondomaine,dc=net ldap group suffix = ou=Group ldap user suffix = ou=users ldap machine suffix = ou=machines add user script = /usr/sbin/smbldap-useradd -m "%u" ldap delete dn = Yes delete user script = /usr/sbin/smbldap-userdel "%u" add machine script = /usr/sbin/smbldap-useradd -w "%u" add group script = /usr/sbin/smbldap-groupadd -p "%g" #delete group script = /usr/sbin/smbldap-groupdel "%g" add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g" delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g" set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%u" logon path = \\%L\profile\%U logon drive = P: logon home = \\%L\%U socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 case sensitive = No default case = lower preserve case = yes short preserve case = Yes #character set = iso8859-1 #domain admin group = @admin dns proxy = No wins support = Yes hosts allow = 192.168.0. 127. winbind use default domain = Yes nt acl support = Yes msdfs root = Yes hide files = /desktop.ini/ntuser.ini/NTUSER.*/ [netlogon] path = /home/netlogon writable = No browseable = No write list = Administrateur # [profile] path = /home/export/profile browseable = No writeable = Yes profile acls = yes create mask = 0700 directory mask = 0700 # [homes] comment = Repertoire Personnel browseable = yes writeable = Yes # [partage] comment = Repertoire commun browseable = Yes writeable = Yes public = No path = /data ############################ slapd.conf ################################ SID="S-1-5-21-862544283-2880828001-3584954034" slaveLDAP="127.0.0.1" slavePort="389" masterLDAP="127.0.0.1" masterPort="389" ldapTLS="0" verify="none" suffix="dc=mondomaine,dc=net" usersdn="ou=People,${suffix}" computersdn="ou=People,${suffix}" groupsdn="ou=Group,${suffix}" idmapdn="ou=People,${suffix}" e sambaUnixIdPooldn="cn=debian,${suffix}" scope="sub" hash_encrypt="SSHA" crypt_salt_format="$1$%.8s" userLoginShell="/bin/bash" userHome="/home/%U" userGecos="System User" defaultUserGid="513" defaultComputerGid="515" skeletonDir="/etc/skel" defaultMaxPasswordAge="90" userSmbHome="\\debian\homes\%U" userProfile="\\debian\profiles\%U" userHomeDrive="U:" userScript="logon.bat" mailDomain="mondomaine.net" with_smbpasswd="0" smbpasswd="/usr/bin/smbpasswd" #################### nssswitch.conf################ passwd: compat ldap group: compat ldap shadow: compat ldap hosts: files dns networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis ################ export ldif ###################### # LDIF Export for: dc=mondomaine,dc=net # Generated by phpLDAPadmin ( http://phpldapadmin.sourceforge.net/ ) on March 12, 2008 4:20 pm # Server: My LDAP Server (localhost) # Search Scope: sub # Search Filter: (objectClass=*) # Total Entries: 30 dn: dc=mondomaine,dc=net objectClass: dcObject objectClass: organization o: Example Company dc: mondomaine dn: cn=debian,dc=mondomaine,dc=net gidNumber: 1000 objectClass: inetOrgPerson objectClass: sambaUnixIdPool cn: debian sn: debian uidNumber: 1007 dn: cn=Manager,dc=mondomaine,dc=net cn: Manager telephoneNumber: 0663057489 description: Manager du domaine postalAddress: 15 rue du mauconduit postalCode: 76540 postalCode: Criquetot le mauconduit objectClass: organizationalRole dn: ou=Group,dc=mondomaine,dc=net objectClass: top objectClass: organizationalUnit ou: Group dn: cn=Account Operators,ou=Group,dc=mondomaine,dc=net objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping gidNumber: 548 cn: Account Operators description: Netbios Domain Users to manipulate users accounts sambaSID: S-1-5-32-548 sambaGroupType: 5 displayName: Account Operators dn: cn=Administrators,ou=Group,dc=mondomaine,dc=net objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping gidNumber: 544 cn: Administrators description: Netbios Domain Members can fully administer the computer/sambaD omainName sambaSID: S-1-5-32-544 sambaGroupType: 5 displayName: Administrators dn: cn=Backup Operators,ou=Group,dc=mondomaine,dc=net objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping gidNumber: 551 cn: Backup Operators description: Netbios Domain Members can bypass file security to back up file s sambaSID: S-1-5-32-551 sambaGroupType: 5 displayName: Backup Operators dn: cn=Domain Admins,ou=Group,dc=mondomaine,dc=net objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping gidNumber: 512 cn: Domain Admins memberUid: root description: Netbios Domain Administrators sambaSID: S-1-5-21-862544283-2880828001-3584954034-512 sambaGroupType: 2 displayName: Domain Admins dn: cn=Domain Computers,ou=Group,dc=mondomaine,dc=net objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping gidNumber: 515 cn: Domain Computers description: Netbios Domain Computers accounts sambaSID: S-1-5-21-862544283-2880828001-3584954034-515 sambaGroupType: 2 displayName: Domain Computers dn: cn=Domain Guests,ou=Group,dc=mondomaine,dc=net objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping gidNumber: 514 cn: Domain Guests description: Netbios Domain Guests Users sambaSID: S-1-5-21-862544283-2880828001-3584954034-514 sambaGroupType: 2 displayName: Domain Guests dn: cn=Domain Users,ou=Group,dc=mondomaine,dc=net objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping gidNumber: 513 cn: Domain Users description: Netbios Domain Users sambaSID: S-1-5-21-862544283-2880828001-3584954034-513 sambaGroupType: 2 displayName: Domain Users dn: cn=Print Operators,ou=Group,dc=mondomaine,dc=net objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping gidNumber: 550 cn: Print Operators description: Netbios Domain Print Operators sambaSID: S-1-5-32-550 sambaGroupType: 5 displayName: Print Operators dn: cn=Replicators,ou=Group,dc=mondomaine,dc=net objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping gidNumber: 552 cn: Replicators description: Netbios Domain Supports file replication in a sambaDomainName sambaSID: S-1-5-32-552 sambaGroupType: 5 displayName: Replicators dn: ou=Idmap,dc=mondomaine,dc=net objectClass: top objectClass: organizationalUnit ou: Idmap dn: ou=machines,dc=mondomaine,dc=net ou: machines objectClass: organizationalUnit objectClass: top dn: uid=serve$,ou=Machines,dc=mondomaine,dc=net uid: serve$ sambaSID: S-1-5-21-1244034782-2093432471-748532972-3010 sambaPwdCanChange: 1205279569 sambaPwdMustChange: 2147483647 sambaLMPassword: 587574A5B695D85AAAD3B435B51404EE sambaNTPassword: 072321F3EEF2DDA2DB88A5C7BB3628FD sambaPwdLastSet: 1205279569 sambaAcctFlags: [W ] objectClass: sambaSamAccount objectClass: account dn: ou=People,dc=mondomaine,dc=net objectClass: top objectClass: organizationalUnit ou: People dn: uid=franck,ou=People,dc=mondomaine,dc=net objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: sambaSamAccount cn: franck sn: franck givenName: franck uid: franck uidNumber: 1005 gidNumber: 513 homeDirectory: /home/franck loginShell: /bin/bash gecos: System User sambaLogonTime: 0 sambaLogoffTime: 2147483647 sambaKickoffTime: 2147483647 displayName: System User sambaSID: S-1-5-21-862544283-2880828001-3584954034-3010 sambaPrimaryGroupSID: S-1-5-21-862544283-2880828001-3584954034-513 sambaLogonScript: logon.bat sambaProfilePath: \\debian\profiles\franck sambaHomePath: \\debian\homes\franck sambaHomeDrive: U: sambaLMPassword: 5ABB8B7D728DAD9FAAD3B435B51404EE sambaNTPassword: 30FE997E5B1952EADD217C9F8D01375F sambaPwdMustChange: 2147483647 sambaPasswordHistory: 000000000000000000000000000000000000000000000000000000 0000000000 sambaAcctFlags: [U ] sambaPwdCanChange: 1205279981 sambaPwdLastSet: 1205279981 userPassword: {SSHA}lMkPUMvpX7SLDjXnUsXX1UHUM7AYQ23v dn: uid=garfield,ou=People,dc=mondomaine,dc=net objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: sambaSamAccount cn: garfield sn: garfield givenName: garfield uid: garfield uidNumber: 1003 gidNumber: 513 homeDirectory: /home/garfield loginShell: /bin/bash gecos: garfield minou sambaLogonTime: 0 sambaLogoffTime: 2147483647 sambaKickoffTime: 2147483647 displayName: garfield minou sambaSID: S-1-5-21-862544283-2880828001-3584954034-3006 sambaPrimaryGroupSID: S-1-5-21-862544283-2880828001-3584954034-513 sambaLogonScript: logon.bat sambaProfilePath: \\debian\profiles\garfield sambaHomePath: \\debian\homes\garfield sambaHomeDrive: U: sambaPwdCanChange: 1205279649 sambaPwdMustChange: 2147483647 sambaLMPassword: 5ABB8B7D728DAD9FAAD3B435B51404EE sambaNTPassword: 30FE997E5B1952EADD217C9F8D01375F sambaPasswordHistory: 000000000000000000000000000000000000000000000000000000 0000000000 sambaPwdLastSet: 1205279649 sambaAcctFlags: [U ] userPassword: {SSHA}FKQbeCHIYn4y+jANJrUKzcXD5ZryJFjE dn: uid=nobody,ou=People,dc=mondomaine,dc=net cn: nobody sn: nobody objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: sambaSamAccount objectClass: posixAccount objectClass: shadowAccount gidNumber: 514 uid: nobody uidNumber: 999 homeDirectory: /dev/null sambaPwdLastSet: 0 sambaLogonTime: 0 sambaLogoffTime: 2147483647 sambaKickoffTime: 2147483647 sambaPwdCanChange: 0 sambaPwdMustChange: 2147483647 sambaHomePath: \\debian\homes\nobody sambaHomeDrive: U: sambaProfilePath: \\debian\profiles\nobody sambaPrimaryGroupSID: S-1-5-21-862544283-2880828001-3584954034-514 sambaLMPassword: NO PASSWORDXXXXXXXXXXXXXXXXXXXXX sambaNTPassword: NO PASSWORDXXXXXXXXXXXXXXXXXXXXX sambaAcctFlags: [NUD ] sambaSID: S-1-5-21-862544283-2880828001-3584954034-2998 loginShell: /bin/false dn: uid=nouille,ou=People,dc=mondomaine,dc=net objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: sambaSamAccount cn: nouille sn: nouille givenName: nouille uid: nouille uidNumber: 1004 gidNumber: 513 homeDirectory: /home/nouille loginShell: /bin/bash gecos: nouille nouille sambaLogonTime: 0 sambaLogoffTime: 2147483647 sambaKickoffTime: 2147483647 sambaPwdCanChange: 0 displayName: nouille nouille sambaSID: S-1-5-21-862544283-2880828001-3584954034-3008 sambaPrimaryGroupSID: S-1-5-21-862544283-2880828001-3584954034-513 sambaLogonScript: logon.bat sambaProfilePath: \\debian\profiles\nouille sambaHomePath: \\debian\homes\nouille sambaHomeDrive: U: sambaLMPassword: 5ABB8B7D728DAD9FAAD3B435B51404EE sambaAcctFlags: [U] sambaNTPassword: 30FE997E5B1952EADD217C9F8D01375F sambaPwdLastSet: 1205278395 sambaPwdMustChange: 1213054395 userPassword: {SSHA}jmgi/WJRb4LWGubiY0ESLi0fhex3ajdM dn: uid=oops,ou=People,dc=mondomaine,dc=net objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: sambaSamAccount cn: oops sn: oops givenName: oops uid: oops uidNumber: 1006 gidNumber: 513 homeDirectory: /home/oops loginShell: /bin/bash gecos: System User userPassword: {crypt}x sambaPwdLastSet: 0 sambaLogonTime: 0 sambaLogoffTime: 2147483647 sambaKickoffTime: 2147483647 sambaPwdCanChange: 0 sambaPwdMustChange: 2147483647 displayName: System User sambaAcctFlags: [UX] sambaSID: S-1-5-21-862544283-2880828001-3584954034-3012 sambaPrimaryGroupSID: S-1-5-21-862544283-2880828001-3584954034-513 sambaLogonScript: logon.bat sambaProfilePath: \\debian\profiles\oops sambaHomePath: \\debian\homes\oops sambaHomeDrive: U: dn: uid=root,ou=People,dc=mondomaine,dc=net cn: root sn: root objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: sambaSamAccount objectClass: posixAccount objectClass: shadowAccount gidNumber: 0 uid: root uidNumber: 0 homeDirectory: /home/root sambaLogonTime: 0 sambaLogoffTime: 2147483647 sambaKickoffTime: 2147483647 sambaPwdCanChange: 0 sambaHomePath: \\debian\homes\root sambaHomeDrive: U: sambaProfilePath: \\debian\profiles\root sambaPrimaryGroupSID: S-1-5-21-862544283-2880828001-3584954034-512 sambaSID: S-1-5-21-862544283-2880828001-3584954034-500 loginShell: /bin/false gecos: Netbios Domain Administrator sambaLMPassword: 5ABB8B7D728DAD9FAAD3B435B51404EE sambaAcctFlags: [U] sambaNTPassword: 30FE997E5B1952EADD217C9F8D01375F sambaPwdLastSet: 1205275706 sambaPwdMustChange: 1213051706 userPassword: {SSHA}fkTC1ohX/oH6mYphnQa6Z+aEJ+lvcHVQ dn: uid=sabrina,ou=People,dc=mondomaine,dc=net objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: sambaSamAccount cn: sabrina sn: sabrina givenName: sabrina uid: sabrina uidNumber: 1001 gidNumber: 513 homeDirectory: /home/sabrina loginShell: /bin/bash gecos: sabrina FONTAINE sambaLogonTime: 0 sambaLogoffTime: 2147483647 sambaKickoffTime: 2147483647 sambaPwdCanChange: 0 displayName: sabrina FONTAINE sambaSID: S-1-5-21-862544283-2880828001-3584954034-3002 sambaPrimaryGroupSID: S-1-5-21-862544283-2880828001-3584954034-513 sambaLogonScript: logon.bat sambaProfilePath: \\debian\profiles\sabrina sambaHomePath: \\debian\homes\sabrina sambaHomeDrive: U: sambaLMPassword: 5ABB8B7D728DAD9FAAD3B435B51404EE sambaAcctFlags: [U] sambaNTPassword: 30FE997E5B1952EADD217C9F8D01375F sambaPwdLastSet: 1205270017 sambaPwdMustChange: 1213046017 userPassword: {SSHA}5CAQIwSoOKfNSYhgu+TLbMA/RAtQNlhE dn: uid=test,ou=People,dc=mondomaine,dc=net objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: sambaSamAccount cn: test sn: test givenName: test uid: test uidNumber: 1002 gidNumber: 513 homeDirectory: /home/test loginShell: /bin/bash gecos: test sa sambaLogonTime: 0 sambaLogoffTime: 2147483647 sambaKickoffTime: 2147483647 sambaPwdCanChange: 0 displayName: test sa sambaSID: S-1-5-21-862544283-2880828001-3584954034-3004 sambaPrimaryGroupSID: S-1-5-21-862544283-2880828001-3584954034-513 sambaLogonScript: logon.bat sambaProfilePath: \\debian\profiles\test sambaHomePath: \\debian\homes\test sambaHomeDrive: U: sambaLMPassword: 5ABB8B7D728DAD9FAAD3B435B51404EE sambaAcctFlags: [U] sambaNTPassword: 30FE997E5B1952EADD217C9F8D01375F sambaPwdLastSet: 1205275224 sambaPwdMustChange: 1213051224 userPassword: {SSHA}RHUCgviMgeeMWQnqzaAummLi//FSdi45 dn: ou=users,dc=mondomaine,dc=net ou: users objectClass: organizationalUnit objectClass: top dn: uid=nobody,ou=Users,dc=mondomaine,dc=net cn: nobody sn: nobody objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: sambaSamAccount objectClass: posixAccount objectClass: shadowAccount gidNumber: 514 uid: nobody uidNumber: 999 homeDirectory: /dev/null sambaPwdLastSet: 0 sambaLogonTime: 0 sambaLogoffTime: 2147483647 sambaKickoffTime: 2147483647 sambaPwdCanChange: 0 sambaPwdMustChange: 2147483647 sambaPrimaryGroupSID: S-1-5-21-862544283-2880828001-3584954034-514 sambaLMPassword: NO PASSWORDXXXXXXXXXXXXXXXXXXXXX sambaNTPassword: NO PASSWORDXXXXXXXXXXXXXXXXXXXXX sambaAcctFlags: [NUD ] sambaSID: S-1-5-21-862544283-2880828001-3584954034-2998 loginShell: /bin/false dn: uid=root,ou=Users,dc=mondomaine,dc=net cn: root sn: root objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: sambaSamAccount objectClass: posixAccount objectClass: shadowAccount gidNumber: 0 uid: root uidNumber: 0 homeDirectory: /home/root sambaLogonTime: 0 sambaLogoffTime: 2147483647 sambaKickoffTime: 2147483647 sambaPwdCanChange: 0 sambaPrimaryGroupSID: S-1-5-21-862544283-2880828001-3584954034-512 sambaSID: S-1-5-21-862544283-2880828001-3584954034-500 loginShell: /bin/false gecos: Netbios Domain Administrator sambaLMPassword: 5ABB8B7D728DAD9FAAD3B435B51404EE sambaAcctFlags: [U] sambaNTPassword: 30FE997E5B1952EADD217C9F8D01375F sambaPwdLastSet: 1205269850 sambaPwdMustChange: 1209157850 userPassword: {SSHA}ERELK5S1k93p0lJuU/SHzuoy2q10RGww dn: sambaDomainName=DEBIAN,dc=mondomaine,dc=net sambaDomainName: DEBIAN sambaSID: S-1-5-21-862544283-2880828001-3584954034 sambaAlgorithmicRidBase: 1000 objectClass: sambaDomain sambaNextUserRid: 1000 sambaMinPwdLength: 5 sambaPwdHistoryLength: 0 sambaLogonToChgPwd: 0 sambaMaxPwdAge: -1 sambaMinPwdAge: 0 sambaLockoutDuration: 30 sambaLockoutObservationWindow: 30 sambaLockoutThreshold: 0 sambaForceLogoff: -1 sambaRefuseMachinePwdChange: 0 dn: sambaDomainName=MINOU,dc=mondomaine,dc=net sambaDomainName: MINOU sambaSID: S-1-5-21-1244034782-2093432471-748532972 sambaAlgorithmicRidBase: 1000 objectClass: sambaDomain sambaNextUserRid: 1000 sambaMinPwdLength: 5 sambaPwdHistoryLength: 0 sambaLogonToChgPwd: 0 sambaMaxPwdAge: -1 sambaMinPwdAge: 0 sambaLockoutDuration: 30 sambaLockoutObservationWindow: 30 sambaLockoutThreshold: 0 sambaForceLogoff: -1 sambaRefuseMachinePwdChange: 0 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iQIVAwUBR9f3XBrEXSEgvy0YAQIHjw/8CaBcOclb7ElvduMaTOPDD2w/yP9Mcbx/ W53GpCIeW9LfHALhdWq7sQ4x4dcNA5lJpjidyeH88rnfzizi923Y529NdiBTGX22 xA5AC4e7Kr75IzBR2Q4jMlniUOZT24ZWoUyGobMdWjcPqnmgiSoPlt48xATl9Wzx tAxR3Yql++A2fHKH7kPZRtw2xU8SMLD6QwYZwhibmVcySs7+dUHuQ3LgLtw8k9my BLoEhhigy/eZTUjvsYg8VptT0ijvoFkxJs3K6hm33dlux7vvAgrz7L7wqontCCzD b+Ceg/YzvKLLa2+vs+9nzL3eykdaxSVQjqh8lDerOnzQ/hKLQ2QW24eZVrhP60YE zT+XN7BeN9stiFZyP0nLl779Fnmll4jM1/0SHfgcanfX611gTqoAPJij3shyo695 fQs7rxr9VV18MHJH1BrnpPeMCdJjKsZI2igbRycYNmZSURvVw7xsdGRBvMNPmSpD rP8F9IzF9otwDqrIxyoeN9CqKZYjz4T6+yjOX9GvvmXEApsCljaffflzYdk0pVJT bSQ5x6SmhT6gjgFs6otuSAEgspMIGiirfgk5Rz7Gss0kxTOT+CNqi8VzvWC+zdks bG5OL0UBkTLrlLp7vrMzXUwLX5fv4jhzsQmPSM80H4f1U3qWXSVQD6sSQxy3a+tV JYAzN15WBMw= =L+aM -----END PGP SIGNATURE-----

2 4

Password encryption for changing passwords
by Kick, Claus 12 Mar '08

12 Mar '08

Hello everyone, I have a quick question about changing passwords and having them encrypted. We are running OpenLDAP VERSION: 2.3.39,REV=2008.01.01 This is in slapd.conf: password-hash {CRYPT} password-crypt-salt-format "$1$%.8s" The passwords are changed via ldapmodify of the Net::LDAP perl module. The changes work, however, the new passwords are unencrypted, at least the infamous ldap browser tells me that. Honestly, I have no idea where else to look. Could someone provide a pointer into the right direction? Regards, Claus

3 5

Re: alias problem - report status code 80 - internal error?]
by Yan Falken 11 Mar '08

11 Mar '08

Hi - thanks for your response. Please see comments. On Mon, Mar 10, 2008 at 10:10:54AM -0700, Quanah Gibson-Mount wrote: > --On Monday, March 10, 2008 3:33 PM +0100 Yan Falken <seahawk(a)volny.cz> > wrote: > > >Hi, > > > >I'm trying to use alias somehow but facing some internal problem and > >don't know how to fix them. Situation: > > > ldap_add: Internal (implementation specific) error (80) > > additional info: no structuralObjectClass operational > > attribute > > This error is clearly reporting the problem. > > >So - any advice where may be the problem? > > All entries must have a structural objectClass. Pick one. Ok - thanks - I used extensibleObject and commented out the organizationalUnit. Then the schema is imported. > > >I'm using bdb backend as a recommended one - have no ldbm modules here - > >in debian there is no ldbm support. > > ldbm being present or not being present has absolutely nothing to do with > your issue. I mentioned that because of this post (and several others I found on the forums): http://www.openldap.org/lists/openldap-software/200211/msg00457.html where's explicitly stated that aliases are supported just under LDBM backend - so sorry for confusion - I'm newbie in this area. So it works in case I use: dn: ou=Staff,o=JNDITutorial objectclass: top objectclass: alias # objectclass: organizationalUnit objectclass: extensibleObject aliasedObjectName: ou=People,o=JNDITutorial ou: Staff > > --Quanah > > Regards YF

2 1

configuring ldap client in Solaris 9
by Gustavo Mendes de Carvalho 11 Mar '08

11 Mar '08

Hi There, Does anybody has some doc or wiki or any other information about how to install and configure solaris 9 ldap client ? Of course that I am already looking for this information on the net, but I didn't find any good paper about it. Thanks in advance --- Gustavo Mendes de Carvalho e-mail: gmcarvalho(a)gmail.com

4 3

Re: Paging C/C++ API
by Ralf Haferkamp 11 Mar '08

11 Mar '08

On Dienstag, 11. März 2008, Yishai Hadas wrote: > Hello, > > Can someone gives a reference to any C/C++ code that can be used on > Linux machine: > > * Connects to Microsoft AD (or to any other LDAP server) > > * Retrieves results based on the paging mechanism described > under RFC2696. The "ldapsearch" command does support this (see the ldapsearch(1) man page for details. Source code can be found in the OpenLDAP sources ( ./client/tools/*.c and ./libraries/libldap/pagectrl.c ). Another example would be the nss_ldap module. > * Which OpenLDAP rpm for Linux is needed here ? As the OpenLDAP project does not ship any prebuild packages (RPMs, whatever) this depends on the distribution you are using. In SUSE Linux e.g. you'll find ldapsearch in the openldap2-client.rpm other distributors use different names. -- Ralf

1 0

importing ldif
by Paolo Leano 11 Mar '08

11 Mar '08

hi, I am getting an "additional info: naming attribute 'uid' is not present in entry" error when importing an ldif file. here is the sample entry: dn: uid=testuid,ou=testou,dc=testdomain,dc=com cn: testcn objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: OfficePerson mail: test(a)testdomain.com URL: http://www.testdomain.com o: test givenName: testname initials: testinitial sn: testsn ou: testou i could add a line: uid: testuid under the dn and it imports just fine but the ldif file has at least 2000 entries. is there an easier way to go about this. any help would be appreciated in pointing me to the right direction thank you

2 1

alias problem - report status code 80 - internal error?
by Yan Falken 10 Mar '08

10 Mar '08

Hi, I'm trying to use alias somehow but facing some internal problem and don't know how to fix them. Situation: data for import: dn: ou=Staff,o=JNDITutorial objectclass: top objectclass: alias objectclass: organizationalUnit aliasedObjectName: ou=People,o=JNDITutorial ou: Staff error: ldap_initialize( ldap://localhost ) add objectclass: top alias organizationalUnit add aliasedObjectName: ou=People,o=JNDITutorial add ou: Staff adding new entry "ou=Staff,o=JNDITutorial" modify complete ldap_add: Internal (implementation specific) error (80) additional info: no structuralObjectClass operational attribute the problem is if I try to play with this: if I remove organizationalUnit I get: ldap_add: Object class violation (65) additional info: attribute 'ou' not allowed so I remove ou and surprise - I'm getting: ldap_add: Naming violation (64) additional info: naming attribute 'ou' is not present in entry So - any advice where may be the problem? I'm using bdb backend as a recommended one - have no ldbm modules here - in debian there is no ldbm support. Thanks. YF

2 1

OpenLDAP and Berkeley DB 4.6
by Dongsheng Song 10 Mar '08

10 Mar '08

Since OpenLDAP 2.3 is incompatible[1] with Berkeley DB 4.6, so I must stick to BDB 4.5 or upgrade to OpenLDAP 2.4 ? [1] http://www.openbsd.org/cgi-bin/cvsweb/ports/databases/openldap/Makefile Thanks for some help. Dongsheng

2 1

ldap and nfs from different servers
by VaraPrasad Yalla 10 Mar '08

10 Mar '08

Hello, Please let me know if there is a way to authenticate users from one box and mount the users' home folders from another box. Even without importing autofs details into the ldap database home directories from the same machine are getting mounted on client machines. How is it possible to mount home directories from another machine in the same way? I am getting errors when I do this on client machines. Thanks.

2 1

dynamic groups
by Andreas Moroder 10 Mar '08

10 Mar '08

Dynamic Lists Hello, I have a question about dynamic grousp ( lists ). For every department in our hospital we have six groups DEP_A_GRP1 ... DEP_A_GRP6 DEP_B_GRP1 ... DEP_B_GRP6 and so on. Is it possible to configure openldap the way that every user of any department group becomes also user in a dynamically generate all containing main department group DEP_A contains all the users of DEP_A_GRP1 to 6 DEP_B contains all the users of DEP_B_GRP1 to 6 .... This should work for primary and secondary groups and the added dynamic group should be a secondary group. Because we use also the slapo-memberof the memberof=DEP_A ... attribute should also be returne for the users of DEP_A_GRP1 to 6. Is this possible and could anyone please tell me how to configure this ? Thanks Andreas Moroder

1 0

Samba to Kerberos via OpenLDAP
by Wes Modes 08 Mar '08

08 Mar '08

Thanks for all your advice so far. First, I'll just say this is a question principally about the arcane mysteries of Samba to OpenLDAP authentication. I've had Samba to OpenLDAP authentication running for a while now using the samba.schema and the ldapsam module. Now I'd like to understand a bit more about how that works in order to take it a step further and get openLDAP to bind against a Kerberos database via SASL. An aside; Yes, I'd heard that Samba can be configured to authenticate against Kerberos directly, but for my own reasons, I'd prefer that Samba talk only to OpenLDAP, and OpenLDAP can do the authentication. I'll fall back on the Samba to Kerberos direct route if I can't find a way to do what I want. I've noted that the Samba schema and smbldap-tools add to the user record two Samba specific password fields, sambaNTPassword and sambaLMPassword. If I have the ldapsam module specified as the passdb backend in smb.conf, is OpenLDAP merely storing the samba passwords while Samba does the password comparisons? Or does OpenLDAP do the authentication and return a yes or no? Is it possible to have Samba defer authentication to OpenLDAP? If so, I can have OpenLDAP use the {SASL} method to do authentication via kerberos. Wes -- Wes Modes Server Administrator & Programmer Analyst McHenry Library Computing & Network Services Information and Technology Services 459-5208

3 2

Problem setting up OpenLDAP for user authentication
by Guennadi Liakhovetski 05 Mar '08

05 Mar '08

Hi all I'm new to LDAP, and I must say it took me a LONG time to set it up under Debian etch on both server and client at all to do anything useful. Now I can do "ldapsearch -x -v -L" type requests from remote a host and locally. I then tried switching the remote host to using LDAP for user authentication. I'd like users not registered locally to be able to login using ldap, and for locally-known users nothing should change. I did manage to get logins to use ldap by configuring all /etc/pam.d/common-* files to first try pam_unix and then, if that fails to use ldap: * sufficient pam_unix * sufficient pam_ldap (should this be "required?) where * is "account", "auth", "password" and "session". In "auth" and "password" I also had to put * required pam_deny after ldap, because otherwise wrong passwords were accepted. In nsswitch.conf I put *: files ldap for "passwd", "group", "shadow". Now I would expect that with sequences ("pam_unix" before "pam_ldap" and "files" before "ldap") indeed locally known users wouldn't be authenticated using ldap. Unfortunately, this doesn't seem to be the case. Now _all_ nss / pam requests go to the LDAP server. Including calls from udevd, avahi-daemon, and others, which causes them to fail in various ways. What am I doing wrong? I know SASL is not configured in my setup, but that shouldn't be a problem? At least not for the cases when LDAP shouldn't be attempted at all. Thanks Guennadi --- Guennadi Liakhovetski

2 4

Could I import the data through the slapadd what I export by the ldapsearch
by 何萍 05 Mar '08

05 Mar '08

There are 6,000,000 records in my openldap directory, I want to backup the data, but I found that the slapcat isn't work when the file id2entry.dbbsize over 2G, so I export the data by ldapsearch, but after I use slapadd to import the data to the backup server, there are some strange error happened, some records can't be add to the ldap correctly, and the record coundn't be searched by ldapsearch. As the same time, others data can be correctly operated. Operation system is the redhat linux 9.0. The verson of openldap is 2.0.27, use ldbm. Because there are too many records so I couldn't upgrade the version of the openldap . when I use ldapsearch the result is : # # filter: (&(uid=abc)(domain=123)) # requesting: ALL # # search result search: 2 result: 0 Success when i use ldapadd to add the record, it says: ldap_add: Already exists ldif_record() = 68 when i use ldapdelete to del it, the result is: Delete Result: Invalid DN syntax (34) Additional info: invalid DN (my dn is right) I thought mybe the record format is not correct that I exported by ldapsearch and imported by slapadd, because the ldif file lost entryUUID、entryCSN... and so on. now how can i do? I have tried to rebuild the entryUUID and run the slapindex to rebuild the index, but failed at least.

2 1

Fwd: GSSAPI contexts used in multiple threads
by Russ Allbery 04 Mar '08

04 Mar '08

As part of the discussion of adding additional thread safety guarantees to MIT Kerberos's GSS-API implementation to support OpenLDAP's use case, Sam Hartman had the following additional questions about how OpenLDAP uses SASL in such a way as to run into this problem. I'm happy to forward answers back to him. I don't understand the usage well enough to explain it myself. | From: Sam Hartman <hartmans(a)mit.edu> | Subject: GSSAPI contexts used in multiple threads | Date: Mon, 03 Mar 2008 16:28:13 -0500 | | Hi. I'm catching up on email. I read a discussion (although I cannot | find it now) of adding support so that an established gss-api context | can be used in multiple threads at the same time. This seems like a | fine feature to add to MIT Kerberos. | | However I'm quite puzzled as to how this works for LDAP or any other | SASL application. SASL is a stream protocol; it presents an ordered | stream across the network connection. In order to guarantee this the | sasl security layer requires that tokens be wrapped and unwrapped in | the same order. If you don't do that you can get into a situation | where the wrap order is different from the unwrap order and you get | spurious gap tokens or out of order tokens. You cannot tell the | difference between this and an attack. Also, since SASL applications | may chunk data into GSS-API tokens in arbitrary order, GSS-API tokens | may not line up with LDAP PDU boundaries. | | So, I'm very confused about how an LDAP implementation could be a | correct application and run into problems with MIT's current thread | safety requirements. | | I'd appreciate it if people who do remember the original discussion | could forward my message to the right place to get an answer. | | Thanks, | | --Sam -- Russ Allbery (rra(a)stanford.edu) <http://www.eyrie.org/~eagle/>

2 3

LDAP replication when NTP server sets the time ahead
by Lucky Y 04 Mar '08

04 Mar '08

Hi, I have a system in GMT timezone and the NTP server in GMT-2hrs time zone. In this case when the system time syncs with NTP time(for example the first when the system comes up after configuration ), the time in the system will be set 2hours behind the current time in the system. In this case, LDAP relication is failing. What is the dependancy between LDAP replication and NTP servers ? Thanks in adavce. Regards, Lucky

5 7

ldap group name resolving problem
by Christian Weihrauch 03 Mar '08

03 Mar '08

Hi, I have problems with debian etch Linux clients resolving group names served by our LDAP server. user and passwd work because I can login properly. "getent group" properly shows the group served by the LDAP server. eg: #getent group mygroup:x:1000:chris However "id username" only shows LDAP served groupIDs but not their names. eg: #id chris uid=1002(chris) gid=1000 groups=1000,20(dialout) This means that I can't do things like chgrp eg: "chgroup mygroup directoryname" gives: "chgrp: invalid group `mygroup'" I am using nscd and nsswitch.conf says: passwd: files ldap group: files ldap shadow: files ldap Any ideas? Thanks! -- Christian Weihrauch, The University of Reading

3 4

Not able to load the LDIF file onto the LDAP server
by divya shree 02 Mar '08

02 Mar '08

Hi I am trying to load my ldif file onto the server using the command ldapadd -x -D "cn=Manager,dc=example,dc=net" -W -f example.ldif For which i am prompted 4 the password enter LDAP password: When i give the password: secret....i.e., the same as in slapd.conf file... i am getting an error tat says LDAP_BIND: invalid credentials(49) Plz help ASAP Thanks n Regards Divya --------------------------------- Why delete messages? Unlimited storage is just a click away.

3 2

Help with SASL/GSSAPI to remote Kerberos server
by Wes Modes 01 Mar '08

01 Mar '08

I am using *SASL/GSSAPI* to authenticate to* Kerberos* from *OpenLDAP*. I haven't gotten that to work yet. To separate and modularize some of these services, we have three servers: A file server running Samba; A directory server running OpenLDAP to provide personal and group identities; and an authentication server running Kerberos (administered by another group). Samba connects to OpenLDAP through smbldap-tools. And OpenLDAP connects to the Kerberos server via SASL/GSSAPI. When someone requests a Samba logon, Samba requests an LDAP bind, which in turn should use SASL to authenticate via Kerberos. The connection between Samba and OpenLDAP is working swell. It is the Kerberos connection that has me flummoxed. *Simply put, OpenLDAP with SASL2 and GSSAPI support will be running on one server, while the Kerberos KDC will be running on another server.* I haven't found any documents that address this not-so-wacky design. Almost all of the docs I found presume that I am setting up the KDC on the same server at OpenLDAP. In my case, the KDC is administered by another group who is willing to grant me access to Kerberos. However, none of the docs I've found offer help in setting up SASL/GSSAPI here and the Kerberos server elsewhere. So when a document says, run /kadmin.local/, to generate a principle, that is not available to me. If I can ask specifically for what I want, I might be able to convince the kerberos administrators to do it for me, but I have to be pretty specific about what I want. The docs I'm referring to are Cyrus SASL for System Administrators http://www.sendmail.org/~ca/email/cyrus/sysadmin.html <http://www.sendmail.org/%7Eca/email/cyrus/sysadmin.html> OpenLDAP 2.2 Administrator's Guide - Using SASL http://www.openldap.org/doc/admin22/guide.html#Using%20SASL In several documents, it was suggested that before you try connecting OpenLDAP to Kerberos that you test to make sure your Kerberos configuration is working. That makes a lot of sense to me. So I want to perform a series of checks, but I don't know what those tests might be. Here's what I would like to test: * Can I connect to the Kerberos server directly? (kinit) * Is direct authentication to the Kerberos server working? * Am I getting returned a proper ticket? (klist) * Is the keytab file on my OpenLDAP server being recognized and accepted by the Kerberos server? * Is my machine being authenticated as a principle? Does it need to be? * How do I test SASL2 before getting OpenLDAP involved? * After making changes to my OpenLDAP config, how do I test the Kerberos connection through OpenLDAP? Do you have any pointers here? This project has been delayed weeks and weeks while I climb and climb up Samba, OpenLDAP, and Kerberos' very steep learning curve. So your prompt response will be hugely helpful. Thanks in advance, Wes Specifics of my configuration: * OS: Red Hat Enterprise 4 v2.6.9 * OpenLDAP v2.2.13 * Local MIT Kerberos5 v1.3.4 * KDC: MIT Kerberos5 v? * Cyrus SASL v2.1.19 -- Wes Modes Server Administrator & Programmer Analyst McHenry Library Computing & Network Services Information and Technology Services 459-5208

5 11

Missing Syntax
by Nik Svoboda 29 Feb '08

29 Feb '08

I have noticed that in the openldap system I am using, the schema has a missing syntax. This syntax is "1.3.6.1.4.1.1466.115.121.1.58" ; "Substring Assertion". This is referenced in matching types using partial matching of strings (exactsubstringsmatch, numericStringSubstringsMatch, ...). I am fairly new to these subjects and do not understand fully how they operate. Is there a way to correct this? Are the syntaxes and matching types specified in a way that can be modified dynamically? -Nikkos

3 5

ldapsearch hangs Intermittently
by Kumar, Manish 28 Feb '08

28 Feb '08

I am encountering an issue on ldapsearch periodically "hangs". One out of 100 times it work fine but sometime it hangs. My ldapsearch version is ldapsearch 2.2.13 (Aug 18 2005 22:24:20). When I run it in debug mode it waits in ldap_int_select() function. end of trace is ldap_chkResponseList for msgid=-1, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid -1, all 1 ber_get_next ber_get_next: tag 0x30 len 305 contents: ldap_read: message type search-entry msgid 2, original id 2 adding response id 2 type 100: wait4msg continue, msgid -1, all 1 ** Connections: * host: 209.236.241.6 port: 20001 (default) refcnt: 2 status: Connected last used: Thu Feb 28 15:11:52 2008 ** Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ** Response Queue: * msgid 2, type 100 chained responses: * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 ldap_chkResponseList for msgid=-1, all=1 ldap_chkResponseList returns NULL ldap_int_select Please help me regarding this issue. Regards Manish

1 0

RWM overlay bind operation
by Rui Ramos 28 Feb '08

28 Feb '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello *, I'm having some troubles with the rwm overlay maybe someone can give some ligths on the subject. We have a non standard schema which in turn has an atribute pass1 that we want to use for the LDAP BIND operation. From what i've seen the BIND operation is hardcoded to use userPAssword attribute (please correct me if i'm wrong). So what we did was the following: we have server A with pass2 filled running on port 7001. and server B with the following config ... database ldap suffix "dc=example,dc=org" uri "ldap://localhost:7001" overlay rwm rwm-map attribute userPassword pass2 ... With this configuration the attribute userPassword gets filled with the content of pass2. But if we try to make Bind search in server B with that user password it fails because it tries to make the bind in ldap://localhost:7001. Is there a way to make the bind operation the the changed data ? Best Regards, Rui Ramos - -- Rui Ramos ============================================== Universidade do Porto - IRICUP Praça Gomes Teixeira, 4099-002 Porto, Portugal email: rramos[at]reit.up.pt phone: +351 22 040 8164 ============================================== -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.7 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iQEVAwUBR8aDvL1uR0bdnTWSAQIuhQgAw5rF8zSs0MapMSUMsb96j0PiUV2TdQ9V GTyB6RTeAJmNqh6/bvEoUO3m8a1UaNffQzYpj03S7y4moVVz4r8+bJQ4Xs0eM8C0 PSU1SXisJbVTcqbEoccma6Yllnd2ZYke8zo/kF/4EPycFxGVj36N+krEB7L/ouO8 jx+Mg6KhteqdxX4Pwz+WyG5g1jhxw4/RKiZC5BaWtP5Cv6pz810DZv9W9C9B0/tJ BYuiWWl3ntzI50Vgm3dmdBt3yUBvngfk/e6RIyRA0rDxpu9uslzCm3Q1acU72tOH Rj32AHuciyf6697rvZE/XQHao09AUhOrZliY/lmpLNc0LHKjDkvDCA== =uBz4 -----END PGP SIGNATURE-----

1 0

ldapsearch returns Could not create LDAP session handle (3): Time limit exceeded
by Brooks Campbell 28 Feb '08

28 Feb '08

We upgraded some client servers from RedHat ES3U4 to Redhat ES4U2 and now the ldapsearch string we used in our monitoring software to check if the customers openldap server is working is returning errors. We were using: ldapsearch -x -H ladps://host.domain.com:636 Which worked find with the open ldap-client on redhat 3 (I do not no the version number) but in redhat 4 openldap-clients 2.2.13-3 we get the error "Could not create LDAP session handle (3): Time limit exceeded" immediately. Ldap is working our application authenticates users it is just the ldapsearch we are using to monitor the service which seems to not be working. Does anyone see anything wrong with the line above or is there something else we can use in a automated script to check if the ldap server is running? Brooks Campbell IT Manager, Waterloo CA and Hersham UK Navtech Systems Support Inc. 295 Hagey Blvd Suite 200 Waterloo, ON, N2L 6R5 W:519-747-1170 xt263 brooks(a)navtechinc.com

3 4

integrating LDAP onto EPrints and Dspace
by divya shree 28 Feb '08

28 Feb '08

Hi I am doin a project..where in i hav to integrate LDAP on to Eprints n DSpace..for providin a single user authentication to the users of Eprints n DSapce... For this i am trying to install OpenLdap-2.4.7..software..i would like to knw if i am on the ryt track and also would like to knw the diff between openldap n ldap..if there is any... Thanks and Regards Divya --------------------------------- Forgot the famous last words? Access your message archive online. Click here.

2 1

OpenLDAP question
by Keith Conger 27 Feb '08

27 Feb '08

Hi, I was wondering if the following is possible with OpenLDAP: I'd like to have an OpenLDAP Server or two(load balanced) with an extended custom schema that will proxy certain attributes back to a non-openldap ldap server. Reading through the list archives it seems like it may be possible but does anyone know for sure from experience? Keith -- Keith Conger Server Systems Administrator Onondaga Community College 4585 West Seneca Turnpike Syracuse, N.Y. 13215-4585 Email/JID: congerk(a)sunyocc.edu http://www.sunyocc.edu/~congerk/

2 1

LDAP add fails with Protocol Error
by Alexander Hartner 27 Feb '08

27 Feb '08

After generating an LDIF file using ldapsearch having a direct fast connect to the LDAP directory, attempt to re-import the file have succeeded while being on the local network. However attempt to import the same LDIF file over a WAN connection fail with the following error: ldapadd -c -D "..." -w ... -x -h ... -p 389 -f test2.ldif adding new entry "..." ldap_add: Already exists (68) adding new entry "..." ldap_add: Already exists (68) adding new entry "..." ldap_add: Protocol error (2) additional info: no attributes provided adding new entry "..." ldap_add: Already exists (68) .. adding new entry "..." adding new entry "..." .. adding new entry "..." ldapadd: update failed: ... ldap_add: Can't contact LDAP server (-1) .. All messages after this file with the same error (-1). It seems that the slower connection is causing a Protocol error which results in LDAP falling over, or at least becoming un-available. Any ideas what could be causing this problem and what I could to address this. Regards Alex

2 1

nss_ldap periodic errors
by Kamil Kisiel 27 Feb '08

27 Feb '08

I'm using nss_ldap on a whole bunch of machines on the network, and while it works great most of the time, I continuously get errors in my syslog. A sampling from today (these are actually from different machines, but I have anonymized the hostnames to be the same.): Feb 25 09:30:25 server.example.com sshd[17495]: nss_ldap: could not search LDAP server - Server is unavailable Feb 25 11:11:08 server.example.com -bash: nss_ldap: could not search LDAP server - Server is unavailable Feb 25 21:50:01 server.example.com automount[5030]: nss_ldap: could not search LDAP server - Server is unavailable Feb 25 21:55:16 server.example.com nscd: nss_ldap: could not search LDAP server - Server is unavailable I get a few of these errors in our syslogs every hour, and occasionally it seems I can't log in via SSH. However typically when I log in to the machine and do a "getent passwd" everything is fine. The LDAP server is from Open Directory in OS X Server 10.5.2. The version of nss_ldap is the one from Gentoo Linux, version nss_ldap-258. My /etc/ldap.conf looks like this: uri ldap://ldap1.example:389 base dc=example,dc=com timelimit 30 bind_timelimit 30 bind_policy soft nss_reconnect_maxconntries 5 idle_timelimit 3600 pam_password_prohibit_message Please use System Preferences on your Mac to change your directory password. nss_base_group cn=Groups,dc=zymeworks,dc=com nss_base_passwd cn=Users,dc=zymeworks,dc=com Does anyone have any suggestions as to what I can try to do to debug and fix this ? It's really becoming irritating. -- Kamil

3 4

log fields
by Gustavo Mendes de Carvalho 27 Feb '08

27 Feb '08

Hi there, I would like to get some documentation that can describe, in details, which fiileds there are present in ldap.log file, and the meaning of each field. I need some information about 7th field (op=33 in first line). Where can I find all codes used in this field ? Jan 10 11:50:21 ldap01 slapd[10819]: conn=1702 op=33 SEARCH RESULT tag=101 err=0 nentries=1 text= Jan 10 11:50:25 ldap01 slapd[10819]: conn=1702 op=34 SRCH base="uid=gustavo,ou=company,c=org" scope=0 deref=0 filter="(objectClass=*)" Jan 10 11:50:25 ldap01 slapd[10819]: conn=1702 op=34 SEARCH RESULT tag=101 err=0 nentries=1 text= Jan 10 11:50:26 ldap01 slapd[10819]: conn=1702 op=35 SRCH base="uid=gustavo,ou=company,c=org" scope=0 deref=0 filter="(objectClass=*)" Jan 10 11:50:26 ldap01 slapd[10819]: conn=1702 op=35 SEARCH RESULT tag=101 err=0 nentries=1 text= Jan 10 12:28:13 ldap01 slapd[10819]: conn=1702 op=36 UNBIND Jan 10 12:28:13 ldap01 slapd[10819]: conn=1702 fd=21 closed Thanks --- Gustavo e-mail: gmcarvalho(a)gmail.com

5 7

Re: using LDAP as central authentication unit
by Hamidreza Hamedtoolloei 26 Feb '08

26 Feb '08

Hey Buchan, Thanks alot for your help... it make sense now....during the configuration process , I modified the NSS service to consult the OpenLDAP server by adding the following lines in the /etc/nsswitch.conf file passwd: files ldap shadow: files ldap group: files ldap So ldap server is called for NSS lookup regardless of what authentication mechanism is used. got it Again, thanks alot ~Hamid ----- Original Message ---- From: Buchan Milne <bgmilne(a)staff.telkomsa.net> To: openldap-technical(a)openldap.org Cc: Hamidreza Hamedtoolloei <hamedtoolloei(a)yahoo.com> Sent: Tuesday, February 26, 2008 1:13:56 AM Subject: Re: using LDAP as central authentication unit On Monday 25 February 2008 20:52:08 Hamidreza Hamedtoolloei wrote: > so if a user is in both /etc/passwd and ldap, linux authentication is used. > However, if a user is ONLY in ldap directory, linux authentication fails > and ldap is called. Analysing the case that a user is only in the > etc/passwd: > In this case, there are some activities in the ldap site which I dont > understand. If a user is only in etc/passwd and pam.d/system.auth file > says call ldap only if linux fails, then why ldap is called when linux > authentication is successful? Because, this is NOT PAM. It is a NSS lookup. For example, when you type 'ls', the filesystem returns the uid that owns the files. To show the username of the owner, the c library invokes a function from nss, to look up the username. This has nothing to do with pam. In a similar way, group memberships have nothing (much) to do with PAM, but with nss. > You say this is expected... but if I understood the pam.d/system.auth file > correctly, ldap should not be called if a user is only in etc/passwd We can't tell, as you haven't provided your /etc/nsswitch.conf file, and none of the queries from your log look like pam_ldap, they look more like nss_ldap ... Regards, Buchan ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

1 0

OpenLDAP Support for cpCPS objectClass??
by Patrick Patterson 26 Feb '08

26 Feb '08

Hi All; I am working on a PKI project, and would like to be able to use OpenLDAP, however, the certificate policy that we have to conform to mandates that CA entries be a member of pkiCA and cpCps auxiliary object classes. Now, the pkiCA requirement is easy, as it looks like OpenLDAP supports that just fine, however, I'm wondering if cpCPS is able to be supported. I guess my question is twofold: Have the syntax checking routines mandated for the cpCps object class (I presume out of ITU-T X.509 chapter 11) been implemented in OpenLDAP, and if so, does anyone happen to have a schema file available so that I don't have to write one myself to add this objectClass to OpenLDAP. If not, is it possible to add these syntax checking routines in the same way as one can extend the schema for object classes and attributes? (I know that I could probably cheat, turn schema checking off and just build have the server support the attributes in a somewhat custom fashion, but since this is for a PKI system that needs a certain level of trust, I am a bit loath to do this). Thanks in advance. -- Personal Mail from Patrick Patterson No company affiliation

3 4

Re: Limit daily query number
by cariparo＠libero.it 26 Feb '08

26 Feb '08

Overlays seems to be the right way to follow. Now I perform some investigation... Grazie! ---------- Initial Header ----------- >From : "Pierangelo Masarati" ando(a)sys-net.it To : "cariparo(a)libero.it" cariparo(a)libero.it Cc : openldap-technical(a)openldap.org Date : Mon, 25 Feb 2008 15:06:57 +0100 Subject : Re: Limit daily query number > Gavin Henry wrote: > > <quote who="cariparo\(a)libero\.it"> > >> Thanks Gavin, > >> We have a LDAP service for out customers, under subscription, and we want > >> to release a light free service for everyone on Internet, by narrowing the > >> daily queries number. > >> I'm thinking to create a PHP bridge, so free customers call a php page > >> instead to connecting directly to LDAP server, and mantain an IP list on > >> MySQL. Any other idea? > > What you need would best be dealt with by a custom overlay. I suggest > you look at overlay development (servers/slapd/overlays/slapover.txt, > <http://www.openldap.org/faq/data/cache/1169.html>), or hire someone > that can develop it for you. > > <advertisement> > One of SysNet's specialties is custom overlay development > <http://open.sys-net.it> > </advertisement> > > p. > > > > Ing. Pierangelo Masarati > OpenLDAP Core Team > > SysNet s.r.l. > via Dossi, 8 - 27100 Pavia - ITALIA > http://www.sys-net.it > --------------------------------------- > Office: +39 02 23998309 > Mobile: +39 333 4963172 > Email: pierangelo.masarati(a)sys-net.it > --------------------------------------- > > >

1 0

Change LDAP User's Password
by Le Trung Kien 26 Feb '08

26 Feb '08

Hi, I'm confused about ldap authentication. I'm attempting to use ldap with kerberos 5, when changing an user's password, I issused: user1]$ passwd Kerberos 5 Password: ****** New UNIX password: ****** Retype new UNIX password: ****** All things go well, however, still have a password don't change, and I don't know what this password is. And how to change it. Still that user, I can't use 'ldappasswd' user1]$ ldappasswd SASL/GSSAPI authentication started SASL username: user1(a)MYREALM.COM SASL SSF: 56 SASL installing layers New password: yPYNAgvO <--- this changes frequently Result: Internal (implementation specific) error (80) Additional info: SASL(-7): invalid parameter supplied: Error putting OTP secret I should emphasize that the user1 has two passwords, the first one can be changed with 'passwd' or 'kpasswd', the other I don't know how to access it, although this second password still works and it's can be used to login. More information: user1]$ passwd Kerberos 5 Password: <--- type a wrong password and got following (only the first password works here) Enter login(LDAP) password: <--- the second password works here New UNIX password: ****** Retype new UNIX password: ****** LDAP password information update failed: Insufficient access passwd: Permission denied Best Regards. -- Le Trung Kien.

2 7

Redirect bind requests to another server
by Andreas Moroder 26 Feb '08

26 Feb '08

Hello, we have a web application that autenticates via openldap. Now a second hospital should use this same application, but they have their own autentication server, active directory in this case. In our network the users authenticate giving their username ( amoroder in my case ) and password. Is it possible to configure openldap to redirect the bind request to the remote server when the username contains an extension like jsmith@remote ? Does this work with AD as second/remote authentication server ? Thank you very much Andreas

4 4

Re: using LDAP as central authentication unit
by Hamidreza Hamedtoolloei 26 Feb '08

26 Feb '08

Hey Buchan, Sorry for not answering your question.. I must have overlooked your response. My ultimate goal is to use LDAP for user authentication and resource authorization in a grid computing environment. As a starting point, I tried to use ldap as a centralized linux user account management mechanism. So I configured my LDAP to act as linux user authentication using this link: http://www.ibm.com/developerworks/library/l-openldap/index.html during analyzing the behavior of ldap I came up with the below observation: /etc/pam.d/system.auth file has the following content which suggests that linux authentication is used first and it it fails ldap is used. auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass so if a user is in both /etc/passwd and ldap, linux authentication is used. However, if a user is ONLY in ldap directory, linux authentication fails and ldap is called. Analysing the case that a user is only in the etc/passwd: In this case, there are some activities in the ldap site which I dont understand. If a user is only in etc/passwd and pam.d/system.auth file says call ldap only if linux fails, then why ldap is called when linux authentication is successful? You say this is expected... but if I understood the pam.d/system.auth file correctly, ldap should not be called if a user is only in etc/passwd Thanks, ~Hamid ----- Original Message ---- From: Buchan Milne <bgmilne(a)staff.telkomsa.net> To: openldap-technical(a)openldap.org Cc: Hamidreza Hamedtoolloei <hamedtoolloei(a)yahoo.com> Sent: Sunday, February 24, 2008 11:02:04 PM Subject: Re: using LDAP as central authentication unit On Saturday 23 February 2008 03:09:33 Hamidreza Hamedtoolloei wrote: > Dear Tony, > Thanks for your comment..I played more with my ldap and here is what I > found out.. If a user in in both /etc/passwd and ldap directory with the > same password, linux authentication is used. However, if user etc/passwd is > different than the ldap passwd, depending on what passwd is used during the > login, appropriate authentication is used(i.e both passwords work just > fine) However, here is what I still dont understand: > if a user is only in etc/passwd, after executing su user, it seems that > there are still some activities in the ldap site. This is to be expected. But, since you did not answer my previous question (asking about what you are trying to achieve, not every single question you have on how user information and authentication technologies work), I am not sure how to answer some of your questions. > fir instance when I do su > karan where karan ONLY exists in the etc/passwd, I get the following in > the logfile(/vat/log/local4) > > > Feb 22 14:54:03 gamaalien slapd[7896]: conn=42 fd=20 ACCEPT from > IP=127.0.0.1:33277 (IP=0.0.0.0:389) Feb 22 14:54:03 gamaalien slapd[7896]: > conn=42 op=0 BIND dn="" method=128 Feb 22 14:54:03 gamaalien slapd[7896]: > conn=42 op=0 RESULT tag=97 err=0 text= Feb 22 14:54:03 gamaalien > slapd[7896]: conn=42 op=1 SRCH base="ou=People,dc=ibm,dc=com" scope=2 > deref=0 filter="(&(objectClass=posixAccount)(uidNumber=502))" Feb 22 > 14:54:03 gamaalien slapd[7896]: conn=42 op=1 SRCH attr=uid userPassword > uidNumber gidNumber cn homeDirectory loginShell gecos description > objectClass This is a typical search from nss_ldap, *not* pam_ldap. As such, it has nothing to do with your PAM configuration, but your nss configuration, which I don't believe you have provided. > Feb 22 14:54:03 gamaalien slapd[7896]: <= > bdb_equality_candidates: (uidNumber) not indexed You should tell slapd to index uidNUmber (in slapd.conf), and run slapindex to ensure that the existing entries are indexed. > Feb 22 14:54:03 gamaalien > slapd[7896]: conn=42 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Feb > 22 14:55:04 gamaalien slapd[7896]: conn=43 fd=21 ACCEPT from > IP=127.0.0.1:33278 (IP=0.0.0.0:389) Feb 22 14:55:04 gamaalien slapd[7896]: > conn=42 fd=20 closed (connection lost) Feb 22 14:55:04 gamaalien > slapd[7896]: conn=43 op=0 BIND dn="" method=128 Feb 22 14:55:04 gamaalien > slapd[7896]: conn=43 op=0 RESULT tag=97 err=0 text= Feb 22 14:55:04 > gamaalien slapd[7896]: conn=43 op=1 SRCH base="ou=People,dc=ibm,dc=com" > scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=karan))" Feb 22 > 14:55:04 gamaalien slapd[7896]: <= bdb_equality_candidates: (uid) not > indexed Samething with uid. > Feb 22 14:55:04 gamaalien slapd[7896]: conn=43 op=1 SEARCH RESULT > tag=101 err=0 nentries=0 text= Feb 22 14:55:04 gamaalien slapd[7896]: > conn=43 op=2 SRCH base="ou=People,dc=ibm,dc=com" scope=2 deref=0 > filter="(&(objectClass=posixGroup)(memberUid=karan))" Feb 22 14:55:04 > gamaalien slapd[7896]: conn=43 op=2 SRCH attr=gidNumber Feb 22 14:55:04 > gamaalien slapd[7896]: conn=43 op=2 SEARCH RESULT tag=101 err=0 nentries=0 > text= Feb 22 14:55:04 gamaalien slapd[7896]: conn=43 fd=21 closed > (connection lost) > > do you know whats going on here? if linux authentication is used and karan > is not in the ldap directory then why ldap is called? thanks for your help Let's see your /etc/nsswitch.conf first ... ____________________________________________________________________________________ Looking for last minute shopping deals? Find them fast with Yahoo! Search. http://tools.search.yahoo.com/newsearch/category.php?category=shopping

2 1

REF: Getting Started - LDAP+PDC
by Teddy L. Nyambe 26 Feb '08

26 Feb '08

Hi All, Am new. I have LDAP running on a server and created accounts using OXAdmin tool form Openxchange, now I want to integrate samba as a PDC and I have noticed there are no home directories for users created using the tool. Should I create users in /etc/passwd, I want to use the already existing users in LDAP and have them log in to the domain. How can I setup this please help!? Kind regards Teddy L. ............................................................................ ........... Teddy Lubasi Nyambe Assistant Principal Clerk ICT - Applications National Assembly of Zambia P.O. Box 31299 Lusaka, ZAMBIA Phone: +260 1 292425 Cell: +260 97 7760473 ~/ Human Knowledge belongs to the world! - AntiTrust Man is a tool-using animal. Without tools he is nothing, with tools he is all - Thomas Carlyle 1795-1881 As we enjoy great advantages from inventions of others, we should be glad of an opportunity to serve others by any invention of ours; and this we should do freely and generously. Benjamin Franklin /~

2 1

LDAP replication
by Rui Ramos 26 Feb '08

26 Feb '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello * I'm having troubles setting the following LDAP arquitecture. And desperatly need some advices. The architecture is formed by a master ldap server (CORE) and several slaves (EDGES). They all have a non standard schema that is required for the project we are working on. So one of my questions is: Is it possible to replicate data from CORE to EDGEs machines using slurpd or syncrepl, and still have the abbility to change some atributes in slaves directly ? if not what could be a possible solution for this ? One of this EDGE machine require atribute translation. We manage to set this working with slurpd replogfile. So we can have this: B -> C Where B replicates LDAP data to C slave using slurpd. But when we try to add the Master server to this: A -> B -> C Where A replicates to B with synrepl. replog isn't created for the B -> C replication. So my other questions are: - Can slurpd and syncrepl be used in the same server ? - Can a ldap server be configured as master/slave ? - What would be your sugestions for solving this issue ? Using openldap 2.3.27-8 Best Regards, Rui - -- Rui Ramos ============================================== Universidade do Porto - IRICUP Praça Gomes Teixeira, 4099-002 Porto, Portugal email: rramos[at]reit.up.pt phone: +351 22 040 8164 ============================================== -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.7 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iQEVAwUBR8KHsb1uR0bdnTWSAQKgGwgAku13Z8pmx4H5R0IxqQ7iQ5ptM2y3WQ13 3nEK9awE84hFRGkFcjiXfrq8O9U/WiAbpTjQw/E+hPczK0JccgzawErIfQgcqZsn FhtD3sBInkDHLd5JZYiva3TdZ0phnng+tBd1Otrr+ZeSrWF77UaA/kfj0/tSwOEo 1p1eGrmwheu7c6Gjd18cwN+/ox+phS7nDjHPWS3cew5e4YY/02FtjrXWtUWC5GLv VSA/QAjd9kmXA/Q7ihXkVkyQbBStvcRDXNWR6F8URK3/Sk9rKBsZ4fteTpBzwC/4 lpPf0Q2ctfteMd8sqR1qVdFVikgpxMBHJ/bj3W9X5yimTQiJmrZNqw== =LuwH -----END PGP SIGNATURE-----

2 1

Re: Limit daily query number
by Gavin Henry 25 Feb '08

25 Feb '08

<quote who="cariparo\(a)libero\.it"> > Thanks Gavin, > We have a LDAP service for out customers, under subscription, and we want > to release a light free service for everyone on Internet, by narrowing the > daily queries number. > I'm thinking to create a PHP bridge, so free customers call a php page > instead to connecting directly to LDAP server, and mantain an IP list on > MySQL. Any other idea? Please keep replies on list ;-) Don't store sensitive data, setup the usual security things, DMZ etc. and check out: conn_max_pending conn_max_pending_auth and sizelimit/timelimit make it readonly too. via "man slapd.conf" Cheers.

2 4

question about object classes
by VaraPrasad Yalla 25 Feb '08

25 Feb '08

Hello Ldapusers, In the slapd.conf file I made sure to include /etc/openldap/schema/inetorgperson.schema But when I use the password migration script to convert password map to ldif format I always see that only 'account' comes up as the default object class in the ldif files . Here is an example of what one of the ldif entries looks like : -------------------------------------------- dn: uid=axe,ou=People,dc=example,dc=com uid: axe cn: axe objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {crypt}$1$8EJTU0c0$O2oc9gwyMJZl0hFg7x6Y7. shadowLastChange: 12371 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 500 gidNumber: 500 homeDirectory: /home/axe -------------------------------------------- How do I make sure that inetorgperson comes up as the default object class without having to add it manually . Also is it possible to modify the object class of a record that has already been added to the database ? Please let me know . Thanks .

1 0

Re: using LDAP as central authentication unit
by Hamidreza Hamedtoolloei 25 Feb '08

25 Feb '08

Dear Tony, Thanks for your comment..I played more with my ldap and here is what I found out.. If a user in in both /etc/passwd and ldap directory with the same password, linux authentication is used. However, if user etc/passwd is different than the ldap passwd, depending on what passwd is used during the login, appropriate authentication is used(i.e both passwords work just fine) However, here is what I still dont understand: if a user is only in etc/passwd, after executing su user, it seems that there are still some activities in the ldap site. fir instance when I do su karan where karan ONLY exists in the etc/passwd, I get the following in the logfile(/vat/log/local4) Feb 22 14:54:03 gamaalien slapd[7896]: conn=42 fd=20 ACCEPT from IP=127.0.0.1:33277 (IP=0.0.0.0:389) Feb 22 14:54:03 gamaalien slapd[7896]: conn=42 op=0 BIND dn="" method=128 Feb 22 14:54:03 gamaalien slapd[7896]: conn=42 op=0 RESULT tag=97 err=0 text= Feb 22 14:54:03 gamaalien slapd[7896]: conn=42 op=1 SRCH base="ou=People,dc=ibm,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=502))" Feb 22 14:54:03 gamaalien slapd[7896]: conn=42 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass Feb 22 14:54:03 gamaalien slapd[7896]: <= bdb_equality_candidates: (uidNumber) not indexed Feb 22 14:54:03 gamaalien slapd[7896]: conn=42 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Feb 22 14:55:04 gamaalien slapd[7896]: conn=43 fd=21 ACCEPT from IP=127.0.0.1:33278 (IP=0.0.0.0:389) Feb 22 14:55:04 gamaalien slapd[7896]: conn=42 fd=20 closed (connection lost) Feb 22 14:55:04 gamaalien slapd[7896]: conn=43 op=0 BIND dn="" method=128 Feb 22 14:55:04 gamaalien slapd[7896]: conn=43 op=0 RESULT tag=97 err=0 text= Feb 22 14:55:04 gamaalien slapd[7896]: conn=43 op=1 SRCH base="ou=People,dc=ibm,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=karan))" Feb 22 14:55:04 gamaalien slapd[7896]: <= bdb_equality_candidates: (uid) not indexed Feb 22 14:55:04 gamaalien slapd[7896]: conn=43 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Feb 22 14:55:04 gamaalien slapd[7896]: conn=43 op=2 SRCH base="ou=People,dc=ibm,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup)(memberUid=karan))" Feb 22 14:55:04 gamaalien slapd[7896]: conn=43 op=2 SRCH attr=gidNumber Feb 22 14:55:04 gamaalien slapd[7896]: conn=43 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text= Feb 22 14:55:04 gamaalien slapd[7896]: conn=43 fd=21 closed (connection lost) do you know whats going on here? if linux authentication is used and karan is not in the ldap directory then why ldap is called? thanks for your help ----- Original Message ---- From: Tony Earnshaw <tonni(a)hetnet.nl> To: openldap-technical(a)openldap.org Sent: Friday, February 22, 2008 2:12:36 AM Subject: Re: using LDAP as central authentication unit Hamidreza Hamedtoolloei skrev, on 22-02-2008 09:49: > http://www.linux.com/articles/113567 describes the "sufficient" modifier > as follows: > If a sufficient module succeeds, it is enough to satisfy the > requirements of sufficient modules in that realm for use of the service, > and modules below it that are also listed as 'sufficient' are not invoked. > > given the following /etc/pam.d/system.auth file: > auth required /lib/security/$ISA/pam_env.so > auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok > auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass > auth required /lib/security/$ISA/pam_deny.so > I think LDAP is used ONLY if the unix authentication fails?? right??? am > I missing something??? I don't suppose that, reading the article you quote, you're missing anything, but I've just played around with my test machine's FC6 /etc/pam.d/system-auth and found the following for the auth service: 1: Where a user is in both LDAP and /etc/{passwd,shadow} only the pam_unix.so password counts, even though the position of the pam_unix.so and pam_ldap.so lines is swapped. Changing the LDAP entry's password doesn't make any difference to pam; 2: Where a user is only in LDAP the pam_unix.so auth entry is ignored, whatever its position; 3: Commenting out the pam_unix.so line results in all login attempts by everyone to be invalid. So not even root can log in any longer. So I'd say that the stuff is far more complicated than the author states. Perhaps people are thinking about the nsswitch.conf entries. However, a recent thread in the pam_ldap mailing list hinted that things might be different for systems on which Padl's CNS pam_ldap library is installed, rather than Red Hat's version - as on my machines. To avoid completely "missing something" I suggest you try it out for yourself ;) Best, --Tonni -- Tony Earnshaw Email: tonni at hetnet dot nl ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

4 3

Limit daily query number
by cariparo＠libero.it 24 Feb '08

24 Feb '08

Hi All, I have a OpenLDAP implementation with anonymous read access enabled, so I want to limit the numbers of the query that each computer (IP) can perform on a specified time windows. For example: allow each IP to perform max 300 queries per day. I have a huge amount of users, and a database of abt 1M objects. Can anyone give me a suggestion, i can't find any specific setting. Thanks Carip

2 2

extend remote server with local (subordinate) entries
by Oren Laadan 24 Feb '08

24 Feb '08

Hi, I use the configuration below to extend a given remote LDAP database with a relatively small number of local records. Specifically, the local database adds new (posix) groups and new autofs maps, adding to the ones already given by the remote server. (see the original thread at: http://www.openldap.org/lists/openldap-software/200802/msg00128.html) > ... > moduleload back_ldap > moduleload back_bdb > ... > backend bdb > backend ldap > ... > # bdb backend, configured as a subordinate of the main server > database bdb > suffix "dc=SUB,dc=EXAMPLE,dc=COM" > readonly on > subordinate > ... > # ldap backend, with the right DN base > database ldap > lastmod off > suffix "dc=EXAMPLE,dc=COM" > uri "ldaps://REMOTE_SERVER/" > ... > The extension of groups works like charm, without any modification to the clients' setup (/etc/ldap/ldap.conf). However, the additional maps aren't observed by the autofs-ldap method and are therefore not working for users. Running on Debian (unstable), autofs-ldap-auto-master gives: /home ldap:ou=auto.home,ou=AutoFS,dc=EXANPLE,dc=COM /proj ldap:ou=auto.proj,ou=AutoFS,dc=EXAMPLE,dc=COM A remote LDAP entry for /proj looks like: dn: cn=blast,ou=auto.proj,ou=AutoFS,dc=EXAMPLE,dc=COM objectClass: automount cn: blast automountInformation: -rw blast:/export/blast A local (added to the subtree SUB) entry for /proj looks like: dn: cn=extra,ou=auto.proj,ou=AutoFS,dc=SUB,dc=EXAMPLE,dc=COM objectClass: automount cn: extra automountInformation: -rw extra:/export/extra Problem is, that autofs only "sees" entries of the first type; if I run automount manually (prepending "dc=SUB," to the default way it is otherwise invoked): /usr/sbin/automount --pid-file=/var/run/autofs/_proj.pid --timeout=300 /proj ldap ou=auto.proj,ou=AutoFS,dc=SUB,dc=EXAMPLE,dc=COM then I can make it see the second type, but then it ignores the first type. Note that the same technique works for adding more groups. So I suspect the problem is that somehow autofs does not consider subtrees as valid results for its query to ldap. Any ideas how to fix this ? (or perhaps suggestion how to arrange the entire setup differently and still have the same end result). Thanks, Oren.

2 3

Re: using LDAP as central authentication unit
by Hamidreza Hamedtoolloei 22 Feb '08

22 Feb '08

Dear Tony, Thanks for your prompt response.. http://www.linux.com/articles/113567 describes the "sufficient" modifier as follows: If a sufficient module succeeds, it is enough to satisfy the requirements of sufficient modules in that realm for use of the service, and modules below it that are also listed as 'sufficient' are not invoked. given the following /etc/pam.d/system.auth file: auth required /lib/security/$ISA/pam_env.so auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass auth required /lib/security/$ISA/pam_deny.so I think LDAP is used ONLY if the unix authentication fails?? right??? am I missing something??? ----- Original Message ---- From: Tony Earnshaw <tonni(a)hetnet.nl> To: openldap-technical(a)openldap.org Sent: Thursday, February 21, 2008 9:58:57 PM Subject: Re: using LDAP as central authentication unit Hamidreza Hamedtoolloei skrev, on 22-02-2008 03:21: > I've followed one of the online instructions on how to configure my > system to use ldap as the user authentication mechanism. below is > partial content of my /etc/pam.d/system.auth file: > #%PAM-1.0 > # This file is auto-generated. > # User changes will be destroyed the next time authconfig is run. > auth required /lib/security/$ISA/pam_env.so > auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok > auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass > auth required /lib/security/$ISA/pam_deny.so > > looking at some online resources about how pam works, it seems that unix > authentication is being applied first, and only if it fails, ldap > authentication is applied. Am I correct here? In other words if all the > users are still in /etc/shadow and /etc/passd files.... ldap is NOT > being used for authentication. If I delete the users from /etc/passwd... > then LDAP is used.... right>? No, all the modules will be used, but the way they are treated depends on the modifiers {sufficient,required,requisite} and {use_first_pass,try_first_pass,null} (unless you're using Solaris >= 10 where they've been obsoleted). Best, --Tonni -- Tony Earnshaw Email: tonni at hetnet dot nl ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

3 2

OpenLdap unstable on RHEL5 & Centos5 with db4
by Rohit B 22 Feb '08

22 Feb '08

Hello List members I am running Openldap and db4 [root@build ~]# slapd -V @(#) $OpenLDAP: slapd 2.3.27 (Mar 14 2007 17:44:50) $ mockbuild@builder4.centos.org:/builddir/build/BUILD/openldap-2.3.27/openldap-2.3.27/build-servers/servers/slapd DB4 vcersion db4-4.3.29-9 We have a address book containing around 500 to 2000 addresses stored in it. Every thing works fine for some days and then it crashes. I see nothing in the logs. We are using a custom schema attached with this email. Before we upgraded from the default openldap in centos4.4 to Centos5.0 it was working perfectly, is there any compatibility issues with the schema & the new package. -- Regards, Rohit Baisakhiya attributetype ( 2.5.4.7.1 NAME ( 'location' 'subdomain' ) SUP name ) attributetype ( 2.5.4.7.2 NAME ( 'proxyflag' ) SUP name ) attributetype ( 2.5.4.7.3 NAME ( 'mailflag' ) SUP name ) attributetype ( 2.5.4.7.4 NAME ( 'incomingflag' ) SUP name ) attributetype ( 2.5.4.7.5 NAME ( 'outgoingflag' ) SUP name ) attributetype ( 2.5.4.7.6 NAME ( 'inmailsize' ) SUP name ) attributetype ( 2.5.4.7.7 NAME ( 'outmailsize' ) SUP name ) attributetype ( 2.5.4.7.8 NAME ( 'mailquota' ) SUP name ) attributetype ( 2.5.4.7.9 NAME ( 'globalquota' ) SUP name ) attributetype ( 2.5.4.7.10 NAME ( 'memOfGroup' ) SUP name ) attributetype ( 2.5.4.7.11 NAME ( 'autoDeleteMail' ) SUP name ) #attributetype ( 2.5.4.7.11 NAME ( 'mailsOlderThan' ) SUP name ) #attributetype ( 2.5.4.7.12 NAME ('lastModifiedTime') SUP name) #attributetype( 0.9.2342.19200300.100.1.23 NAME ('lastModifiedTime') SUP name) #attributetype ( 2.5.4.7.10 NAME 'member' SUP distinguishedName ) #attributetype ( 2.5.4.7.11 NAME 'owner' SUP distinguishedName ) #attributetype ( 2.5.4.7.12 NAME 'seeAlso' SUP distinguishedName ) #attributetype ( 2.5.4.7.13 NAME ( 'ou' 'organizationalUnitName' ) SUP name ) #attributetype ( 2.5.4.7.14 NAME ( 'o' 'organizationName' ) SUP name ) #attributetype ( 2.5.4.7.15 NAME 'description' # EQUALITY caseIgnoreMatch # SUBSTR caseIgnoreSubstringsMatch # SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} ) #attributetype ( 2.5.4.7.16 NAME 'businessCategory' # EQUALITY caseIgnoreMatch # SUBSTR caseIgnoreSubstringsMatch # SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) # # Netcore User objectclass # objectclass ( 1.3.6.1.4.1.4203.1.4.1.1 NAME ( 'Netcore' 'Netserv' ) DESC 'Netcore Netserv Ldap' SUP ( posixAccount $ inetLocalMailRecipient $ inetOrgPerson ) MAY ( location $ proxyflag $ mailflag $ incomingflag $ outgoingflag $ inmailsize $ outmailsize $ mailquota $ globalquota $ acctFlags $ description $ homeDrive $ kickoffTime $ lmPassword $ logoffTime $ logonTime $ ntPassword $ primaryGroupID $ profilePath $ pwdCanChange $ pwdLastSet $ pwdMustChange $ scriptPath $ smbHome $ rid $ ou $ memOfGroup $ autoDeleteMail $ calFBURL ) ) #attributetype (2.16.840.1.113730.3.1.13 #Conflicting hence changed this attributetype (2.16.840.1.113730.3.1.14 NAME 'mailAlternateAddress' DESC 'alternate RFC822 email addresses used to reach this person' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype (2.16.840.1.113730.3.1.23 NAME 'mgrpAllowedDomain' DESC 'allowed domains for sender of mail to group' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype (2.16.840.1.113730.3.1.25 NAME 'mgrpDeliverTo' DESC 'LDAP Search URL to describe group membership' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 EQUALITY caseExactIA5Match ) attributetype (2.16.840.1.113730.3.1.26 NAME 'mgrpErrorsTo' DESC 'person or group to receive error messages for this group' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype (2.16.840.1.113730.3.1.28 NAME 'mgrpRejectAction' DESC 'The action to be taken for a rejected message to the group' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype (2.16.840.1.113730.3.1.29 NAME 'mgrpRejectText' DESC 'Text to be returned with a rejected message' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype (2.16.840.1.113730.3.1.30 NAME 'mgrpRFC822MailMember' DESC 'RFC822 mail address of email only member of group' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) # # Netcore Group objectclass # ###### object class modified Manoj for version 2.1 of openldap ####### objectclass (2.16.840.1.113730.3.2.4 NAME 'mailGroup' SUP top STRUCTURAL MUST ( uid $ mail $ cn ) MAY ( mailAlternateAddress $ mailHost $ mgrpAllowedDomain $ mgrpDeliverTo $ mgrpRejectAction $ mgrpErrorsTo $ mgrpRFC822MailMember $ mgrpRejectText $ businessCategory $ seeAlso $ owner $ ou $ o $ description $ uniqueMember $ mailquota) )

3 6

me
by Aravind Arjunan 22 Feb '08

22 Feb '08

I had configured ldap in server-client I had created the ldif file also and added that file to the ldap database. It was working fine yesterday,but when i started the machine today and when i restarted the ldap service the stopping ldap is always coming failed. When starting ldap is always coming start,when i check by *service ldap status* it is showing slapd is stopped. [root@testnode ~]# service ldap restart Stopping slapd: [*FAILED*] Checking configuration files for slapd: config file testing succeeded Starting slapd: [ *OK * ] [root@testnode ~]# service ldap restart Stopping slapd: [*FAILED*] Checking configuration files for slapd: config file testing succeeded Starting slapd: [ *OK * ] [root@testnode ~]# service ldap restart Stopping slapd: [*FAILED*] Checking configuration files for slapd: config file testing succeeded Starting slapd: [ *OK *] [*root@testnode ~]# service ldap status slapd is stopped [root@testnode ~]# *

1 0

using LDAP as central authentication unit
by Hamidreza Hamedtoolloei 22 Feb '08

22 Feb '08

Hello, I've followed one of the online instructions on how to configure my system to use ldap as the user authentication mechanism. below is partial content of my /etc/pam.d/system.auth file: #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required /lib/security/$ISA/pam_env.so auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass auth required /lib/security/$ISA/pam_deny.so looking at some online resources about how pam works, it seems that unix authentication is being applied first, and only if it fails, ldap authentication is applied. Am I correct here? In other words if all the users are still in /etc/shadow and /etc/passd files.... ldap is NOT being used for authentication. If I delete the users from /etc/passwd... then LDAP is used.... right>? thx, ~Hamid ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 2

query regarding user names and passwords
by anish patil 21 Feb '08

21 Feb '08

Hi All, I want to add usr names which are not in ASCII characters using ldapadd command . I tried it on RHEL 4.4 , it giving me following error <error> adding new entry "uid=ああああ,ou=People,dc=avaya,dc=com" ldap_add: Invalid DN syntax (34) additional info: invalid DN </error> Systems locale set:-*LANG=ja_JP.SJIS* i googled it i found this http://www.openldap.org/lists/openldap-software/200308/msg00570.html But this post is in 2003 So i wanted to know is it LDAP's limitation ? Thanks in advance -- Anish Patil

3 5

Red Hat RPMs?
by Gavin Henry 21 Feb '08

21 Feb '08

BTW, has anyone over the history of the "well-known" broken Red Hat RPMs raised bug reports etc. and had any response? I'm not sure what effort has been put into this and whether it's worth picking it up again? As most users first experience of OpenLDAP is via the RH and Fedora RPMs, I think some effort (if it's not a waste of time again) should be put into trying to raise our concerns, as it harms the project in the long run. Currently we have SuSE, Mandriva and Debian guys on the lists who care (you all know who you are ;-) ). Anyone from Red Hat or Fedora here? Thanks. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

5 6

TLS/SSL Handshake Error
by Mathis, Jim 21 Feb '08

21 Feb '08

Hello, After creating a self-signed certificate as per the, OpenLDAP Admin Guide, TLS/SSL was enabled. The CN used when creating the certificates was the hostname of the LDAP server - "node01". However, when conducting further TLS/SSL tests there appears to be a handshaking error between the client and server. Additionally, when checking the Server certificates using the " openssl s_client -connect :636 -state -CAfile /var/certs/cacert.pem -cert /var/certs/servercrt.pem -key /var/certs/serverkey.pem" command it indicates that the client private certificate key can't be loaded and expecting a start line (see below). Appreciate any additional info. Config data as follows: CLIENT CONFIG DATA /etc/ldap.conf host node01 base dc=S80,dc=com uri ldaps://node01/ ldap_version 3 port 636 timelimit 120 bind_timelimit 120 bind_policy soft idle_timelimit 3600 ssl on tls_checkpeer yes tls_cacertfile /etc/openldap/cacerts/cacert.pem tls_cacertdir /etc/openldap/cacerts tls_reqcert never tls_ciphers TLSv1 pam_password md5 /etc/openldap/ldap.conf URI ldaps://node01:636 HOST node01 BASE dc=S80,dc=com TLS_CACERT /etc/openldap/cacerts/cacert.pem TLS_CACERTDIR /etc/openldap/cacerts TLS_REQCERT never /etc/openldap/cacerts/cacert.pem Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: sha1WithRSAEncryption Issuer: C=US, ST=Virginia, O=XXX, OU=S80, CN=node01/emailAddress=XXX Validity Not Before: Feb 21 15:10:48 2008 GMT Not After : Feb 20 15:10:48 2011 GMT Subject: C=US, ST=Virginia, O=XXX, OU=S80, CN=node01/emailAddress=XXX Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:da:b9:b0:ba:ca:95:f1:fc:48:6e:e9:d5:5d:d5: 22:aa:9e:38:19:7d:0c:14:65:44:fa:12:69:f6:98: 6a:38:43:11:29:20:a8:a2:98:a9:00:ce:40:19:e5: 56:46:1b:85:d6:99:91:5f:7b:a9:19:ac:7b:7c:cc: 42:13:88:99:99:af:98:52:9b:a4:60:77:ca:e7:ae: 41:97:c0:8c:5e:f9:a1:44:c0:6b:29:ec:3f:9b:1e: 59:dc:05:f5:b8:a8:ed:71:7c:db:51:26:1f:59:ee: 04:fc:b0:24:77:64:2e:be:df:a7:1a:91:34:81:f4: a6:d6:b9:26:64:63:2f:19:95 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: C1:AA:5F:32:3D:7F:80:FA:4A:A1:A2:24:BC:66:AB:CE:C3:5A:A8:E0 X509v3 Authority Key Identifier: keyid:C1:AA:5F:32:3D:7F:80:FA:4A:A1:A2:24:BC:66:AB:CE:C3:5A:A8:E0 Signature Algorithm: sha1WithRSAEncryption 37:84:43:62:ed:98:c3:31:85:24:3e:8d:d8:88:9f:4d:8f:00: dc:08:21:ee:9d:19:07:21:c0:70:cf:b1:38:94:49:34:de:42: 93:5e:51:79:95:6b:d6:2d:7f:92:f7:da:49:d0:92:65:81:8f: ed:0e:24:0a:0d:17:cd:73:fe:c2:86:9c:40:22:04:af:7b:d6: 1e:ba:2c:5a:f4:d8:52:ab:8f:94:45:ae:bc:11:07:06:0d:da: 11:6f:f5:1a:63:ae:05:0a:64:32:b1:f0:5c:eb:21:6b:d1:ff: bb:0a:42:a9:a9:23:f3:ab:d4:9f:b4:26:4e:d4:ea:7b:0a:26: df:a4 -----BEGIN CERTIFICATE----- .....XXX -----END CERTIFICATE----- SERVER CONFIG DATA Server IP: 192.168.10.1 Hostname: node01 Suffix: dc=S80,dc=com Certificate Common Name (CN): node01 /etc/openldap/slapd.conf TLSCACertificateFile /var/certs/cacert.pem TLSCertificateFile /var/certs/servercrt.pem TLSCertificateKeyFile /var/certs/serverkey.pem database ldbm suffix "dc=S80,dc=com" SERVER KEY (serverkey.pem) -----BEGIN CERTIFICATE REQUEST----- ...XXX -----END CERTIFICATE REQUEST----- ERRORS OBSERVED (SERVER) [root@node01 certs]# openssl s_client -connect :636 -state -CAfile /var/certs/cacert.pem -cert /var/certs/servercrt.pem -key /var/certs/serverkey.pem unable to load client certificate private key file 8086:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:644:Expecting: ANY PRIVATE KEY [root@node01 certs]# ldapsearch -d127 -x -H ldaps://node01 uid=uid ldap_create ldap_url_parse_ext(ldaps://node01) ldap_bind ldap_simple_bind ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP node01:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 192.168.10.1:636 ldap_connect_timeout: fd: 3 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization tls_write: want=133, written=133 0000: 80 83 01 03 01 00 5a 00 00 00 20 00 00 39 00 00 ......Z... ..9.. 0010: 38 00 00 35 00 00 16 00 00 13 00 00 0a 07 00 c0 8..5............ 0020: 00 00 33 00 00 32 00 00 2f 03 00 80 00 00 66 00 ..3..2../.....f. 0030: 00 05 00 00 04 01 00 80 00 00 63 00 00 62 00 00 ..........c..b.. 0040: 15 00 00 12 00 00 09 06 00 40 00 00 65 00 00 64 .........@..e..d 0050: 00 00 14 00 00 11 00 00 08 00 00 06 04 00 80 00 ................ 0060: 00 03 02 00 80 28 9b 68 41 39 df 12 52 12 ab 41 .....(.hA9..R..A 0070: 20 11 b0 b9 d0 76 3d 5c 2d f6 3a 00 49 28 07 d4 ....v=\-.:.I(.. 0080: 67 8d 26 70 fb g.&p. TLS trace: SSL_connect:SSLv2/v3 write client hello A tls_read: want=7, got=7 0000: 15 03 01 00 02 02 28 ......( TLS trace: SSL3 alert read:fatal:handshake failure TLS trace: SSL_connect:error in SSLv2/v3 read server hello A TLS: can't connect. ldap_perror ldap_bind: Can't contact LDAP server (-1) additional info: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure ERRORS OBSERVED (CLIENT) [root@node03 ~]# openssl s_client -connect node01:636 -showcerts -state -CAfile /etc/openldap/cacerts/cacert.pem CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv2/v3 write client hello A SSL3 alert read:fatal:handshake failure SSL_connect:error in SSLv2/v3 read server hello A 3531:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:s23_clnt.c:562: [root@node03 ~]# ldapsearch -d127 -x -H ldaps://node01 uid=uid ldap_create ldap_url_parse_ext(ldaps://node01) ldap_bind ldap_simple_bind ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP node01:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 192.168.10.1:636 ldap_connect_timeout: fd: 3 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization tls_write: want=133, written=133 0000: 80 83 01 03 01 00 5a 00 00 00 20 00 00 39 00 00 ......Z... ..9.. 0010: 38 00 00 35 00 00 16 00 00 13 00 00 0a 07 00 c0 8..5............ 0020: 00 00 33 00 00 32 00 00 2f 03 00 80 00 00 66 00 ..3..2../.....f. 0030: 00 05 00 00 04 01 00 80 00 00 63 00 00 62 00 00 ..........c..b.. 0040: 15 00 00 12 00 00 09 06 00 40 00 00 65 00 00 64 .........@..e..d 0050: 00 00 14 00 00 11 00 00 08 00 00 06 04 00 80 00 ................ 0060: 00 03 02 00 80 51 97 63 fc ee 43 25 a8 d2 e4 8c .....Q.c..C%.... 0070: ef 63 6e e0 97 b7 cd c2 1e 14 97 c9 50 5d 82 6b .cn.........P].k 0080: 3f f5 d0 6f a4 ?..o. TLS trace: SSL_connect:SSLv2/v3 write client hello A tls_read: want=7, got=7 0000: 15 03 01 00 02 02 28 ......( TLS trace: SSL3 alert read:fatal:handshake failure TLS trace: SSL_connect:error in SSLv2/v3 read server hello A TLS: can't connect. ldap_perror ldap_bind: Can't contact LDAP server (-1) additional info: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

1 0

RE: LDAP Writes are not propagated to mirror nodes.
by Quanah Gibson-Mount 21 Feb '08

21 Feb '08

--On Thursday, February 21, 2008 2:56 PM +0800 "K C, Sachin (Sachin)" <sachinkc(a)alcatel-lucent.com> wrote: > > Quanah, > > I have compiled the source on solaris 10. OpenLDAP release I > used is 2.4.7 Keep all replies on the list. Sending a reply to the list and then sending a further reply to me is only going to help ensure you end up on my blacklist, and it definitely won't get you a quicker response. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: Ppolicy issues
by Bryan Payne 21 Feb '08

21 Feb '08

Thank you for your help. I added the pwdPolicySubentry to a user to no avail. I did find this in the logfile though: Feb 20 09:01:13 ldapserver slapd[6709]: conn=95289 op=4 SEARCH RESULT tag=101 err=50 nentries=0 text=Operations are restricted to bind/unbind/abandon/StartTLS/modify password So it looks like it's trying to do something but cannot. While I'm concerned about password strength, I'm more concerned (at this point) with just having the machine prompt for a password change. I'm running centos 4.6 and openldap 2.3.39. I compiled it with the following: ./configure --enable-crypt --enable-ppolicy --with-tls --prefix=/opt/openldap/ Once again, thanks for any help. Bryan Payne skrev, on 19-02-2008 22:27: I have some issues with ppolicy. It seems it recognizes expiration dates (I know this from looking in the logs, but it does not warn the user their password is expiring soon), properly locks out accounts with too many failed logins but it cannot seem to force a password change when pwdReset is set to TRUE, nor does it prevent logins when the password has expired. Any help would be greatly appreciated. I'll post the things of importance below. Please let me know if anything else would help. [root@ldapserver ~]# ldapsearch -x -LLL cn=default dn: cn=default,ou=policies,dc=example,dc=com objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: 2.5.4.35 pwdInHistory: 6 pwdCheckQuality: 1 pwdMinLength: 8 pwdMaxFailure: 4 pwdLockout: TRUE pwdFailureCountInterval: 0 pwdMustChange: TRUE pwdSafeModify: FALSE pwdLockoutDuration: 900 pwdExpireWarning: 432000 pwdGraceAuthNLimit: 1 pwdAllowUserChange: TRUE pwdMaxAge: 7776000 From slapd.conf overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=example,dc=com" ppolicy_use_lockout Most of the above looks kosher; my main site is running ppolicy on OpenLDAP 2.3.33 up to 2.3.39 Buchan rpms on Red Hat RHEL5 and all the above work. However: 1: I've found that each posixAccount has to have the operational attribute pwdPolicySubentry. Although this is an operational attribute, it is (the only?) such that is user modifiable. In this (as in many other) respects gq is indispensable as GUI. 2: I've found that extensive use has to be made of pam_ldap to get the best out of ppolicy (for example password strength). 3: It would help if you detailed OS and OL versions, so's one could know whether to contribute help or not. Bets, --Tonni -- Tony Earnshaw Email: tonni at hetnet dot nl

4 6

Re: TLS LDAP Configuration w/Linux 5.0
by Buchan Milne 21 Feb '08

21 Feb '08

Please keep replies on-list. On Thursday 21 February 2008 17:00:11 Mathis, Jim wrote: > Buchan, > > Thanks for the info. I want to ensure when I create the certificates > that I'm doing it correctly. As follows: > > LDAP Server IP: 192.168.10.1 > Host name: node01 > suffix: dc=S80,dc=com > > Do I create a Certificate Common Name using "node01.S80.com" or "node01" You use the name that you are going to use to connect to the host with. The real fqdn does not matter .... So, if you are going to use: URI ldaps://www.microsoft.com then create a cert for www.microsoft.com (of course, you should ensure that the name you use resolves to the IP) Regard,s Buchan

1 0

ldapadd of LDIF files with attribute 'apple-generateduid' not allowed
by Alexander Hartner 21 Feb '08

21 Feb '08

I am trying to import a simple LDIF file into OpenDirectory on OS X 10.5.2 Leopard Server. However when I issue the following ldapadd command I get an error : ldapadd -D [rootdn] -x -w [secretPassword] -f Import.ldif Error : 65 Object class violation" attribute 'apple-generateduid' not allowed I would have thought that I had specified apple-generateduid, but I didn't. This is my import file -----------BEGIN----------- # Alexander Hartner dn: cn=Alexander Hartner2,cn=people,dc=macbook-znet,dc=local objectClass: top objectClass: person objectClass: inetOrgPerson displayName: Alexander Hartner2 cn: Alexander Hartner2 givenName: Alexander sn: Hartner mail: alex(a)j2anywhere.com initials: A o: j2anywhere.com -----------END----------- I know this might not be the best forum for OS X support, but I am a bit stuck on this. Thanks in advance. Alex

1 0

TLS LDAP Configuration w/Linux 5.0
by Mathis, Jim 21 Feb '08

21 Feb '08

Hello, Info as follows: OS: RH Enterprise Server 5.1 Server Certificates: Created using a Common Name of "S80.com" Client Certificate: Copied "cacert.pem" from the server and placed into "/etc/openldap/cacerts/" Problem: When configuring TLS to work with LDAP I'm no longer able to login from a client via LDAP. LDAP works normal when TLS is not configured. Suspect possible configuration problem. I'd appreciate any additional information. Thanks. CLIENT /ETC/LDAP.CONF # The distinguished name of the search base. base dc=S80,dc=com timelimit 120 bind_timelimit 120 idle_timelimit 3600 # Just assume that there are no supplemental groups for these named users nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman bind_policy soft uri ldaps://192.168.10.1/ ssl start_tls TLS_CACERT /etc/openldap/cacerts/cacert.pem pam_password md5 CLIENT /ETC/OPENLDAP/LDAP.CONF URI ldaps://192.168.10.1/ BASE dc=S80,dc=com TLS_CACERT /etc/openldap/cacerts/cacert.pem SERVER /ETC/OPENLDAP/SLAPD.CONF TLSCACertificateFile /var/certs/cacert.pem TLSCertificateFile /var/certs/servercrt.pem TLSCertificateKeyFile /var/certs/serverkey.pem database ldbm suffix "dc=S80,dc=com" rootdn "cn=Administrator,dc=S80,dc=com" USED THE FOLLOWING COMMANDS (Did not observe ldaps port 636 being opened. Not sure if it's necessary due to start_tls on port 389) slapd -h "ldap:/// ldaps:///" nmap 192.168.10.1 PORT STATE SERVICE 22/tcp open ssh 111/tcp open rpcbind 389/tcp open ldap 617/tcp open sco-dtmgr 650/tcp open unknown 722/tcp open unknown 2049/tcp open nfs AMPLIFYING DATA No errors occur using "ldapsearch -x 'uid=jmathis' -H ldap://192.168.10.1" Errors observed using: ldapsearch -x 'uid=jmathis' -H ldaps://192.168.10.1 ldap_bind: Can't contact LDAP server (-1) ldapsearch -x -b 'dc=S80,dc=com' -ZZ ldap_start_tls: Can't contact LDAP server (-1)

3 2

Re: ldapsearch for accont object class
by Hamidreza Hamedtoolloei 21 Feb '08

21 Feb '08

Dear Dieter , Thanks for your response. I am using LDAP as a centrtal authentication unit, and migrated all the linux accounts to ldap via some migration tools. currently authentication for linux users work fine i.e. "su sriram then inputing the password" doesnt complain, but when I want to bind to ldap using a user DN (ex ldapsearch "uid=sriram,ou=People,dc=ibm,dc=com" -W -x) I get the Invalid credentials (49) error. I added password-hash {CRYPR} to my slapd.config file, however, it prevented the server from running. the other entry, "cn=fratbrother,ou=People,dc=ibm,dc=com", I added manually. Although the hashing method is SSHA, when I add password-hash {MD5} to my slapd.config, I still can successfully bind. I dont know why this is happening... since the password-hash method has changed, I expect to get the Invalid credentials error... any ideas? ----- Original Message ---- From: Dieter Kluenter <dieter(a)dkluenter.de> To: openldap-technical(a)openldap.org Sent: Tuesday, February 19, 2008 11:33:05 PM Subject: Re: ldapsearch for accont object class Hamidreza Hamedtoolloei <hamedtoolloei(a)yahoo.com> writes: > Dear all, > Below is the "partial" content of my openldap db. > when I do: > ldapsearch -D "cn=fratbrother,ou=People,dc=ibm,dc=com" -w password -x > everything is fine. However, when I do > ldapsearch -D "uid=sriram,ou=People,dc=ibm,dc=com" -w password -x > I get the ldap_bind: Invalid credentials (49) error. > is this related to the "account" object class? > it seems that none of the openLdap tools such as ldapsearch,ldappasswd works > for "account" object class.. is the syntax different for this type of class? > p.s. in my slapd.config for ACL I have > access to * > by * read Your problem seem to be different password hashing methods > # sriram, People, ibm.com > dn: uid=sriram,ou=People,dc=ibm,dc=com > userPassword:: e2NyeXB0fSQxJC82bGVIazhGJEY3bHpuS1d2bi5UWmQuZ2o1TUhqLy4= this is a crypt hashed passwword > dn: cn=fratbrother,ou=People,dc=ibm,dc=com > userPassword:: e1NTSEF9aXVxUkw1MlAvaS9XUkRkNHhuN0lEbUl3VnhhekRzV2s= this is a ssha hashed password. -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6 ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 1

Another question concerning the dynlist overlay
by Gerd Schering 20 Feb '08

20 Feb '08

Hi, I my slapd.conf i added th following line: dynlist-attrset myAccount myAccountOwnerURL myAccount is a propriatary, auxliliary objectclass. SlapD says: AttributeDescription "myAccountOwnerURL" must be a subtype of "labeledURI". I really don't now how to arrange this. Trying attributetype ( labeledURI:1 NAME 'myAccountOwnerURL' ... ) gives: OID could not be expanded: "labeledURI:1" even the dyngroup.schema wsa loaded prior to the schema containing the "myAccountOwnerURL" Attribute. Any hint how to proceed? Gerd -- ------------------------------------------------------ -- Gerd Schering, Email: Schering(a)tubit.TU-Berlin.DE -- -- TU Berlin, Zentraleinrichtung Rechenzentrum -- -- Sekr. E-N 50, Einsteinufer 17, 10587 Berlin -- -- phone: +49 30 314 24383, fax: +49 30 314 21060 -- ------------------------------------------------------

2 2

ldapsearch for accont object class
by Hamidreza Hamedtoolloei 20 Feb '08

20 Feb '08

Dear all, Below is the "partial" content of my openldap db. when I do: ldapsearch -D "cn=fratbrother,ou=People,dc=ibm,dc=com" -w password -x everything is fine. However, when I do ldapsearch -D "uid=sriram,ou=People,dc=ibm,dc=com" -w password -x I get the ldap_bind: Invalid credentials (49) error. is this related to the "account" object class? it seems that none of the openLdap tools such as ldapsearch,ldappasswd works for "account" object class.. is the syntax different for this type of class? p.s. in my slapd.config for ACL I have access to * by * read # sriram, People, ibm.com dn: uid=sriram,ou=People,dc=ibm,dc=com uid: sriram cn: Sriram Krishnan objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword:: e2NyeXB0fSQxJC82bGVIazhGJEY3bHpuS1d2bi5UWmQuZ2o1TUhqLy4= shadowLastChange: 13923 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 503 gidNumber: 503 homeDirectory: /export/home/sriram gecos: Sriram Krishnan,SDSC,8585555555,8586666666 # fratbrother, People, ibm.com dn: cn=fratbrother,ou=People,dc=ibm,dc=com cn: fratbrother sn: fratbrother objectClass: top objectClass: person userPassword:: e1NTSEF9aXVxUkw1MlAvaS9XUkRkNHhuN0lEbUl3VnhhekRzV2s= ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

3 2

Ppolicy issues
by Bryan Payne 20 Feb '08

20 Feb '08

I have some issues with ppolicy. It seems it recognizes expiration dates (I know this from looking in the logs, but it does not warn the user their password is expiring soon), properly locks out accounts with too many failed logins but it cannot seem to force a password change when pwdReset is set to TRUE, nor does it prevent logins when the password has expired. Any help would be greatly appreciated. I'll post the things of importance below. Please let me know if anything else would help. [root@ldapserver ~]# ldapsearch -x -LLL cn=default dn: cn=default,ou=policies,dc=example,dc=com objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: 2.5.4.35 pwdInHistory: 6 pwdCheckQuality: 1 pwdMinLength: 8 pwdMaxFailure: 4 pwdLockout: TRUE pwdFailureCountInterval: 0 pwdMustChange: TRUE pwdSafeModify: FALSE pwdLockoutDuration: 900 pwdExpireWarning: 432000 pwdGraceAuthNLimit: 1 pwdAllowUserChange: TRUE pwdMaxAge: 7776000 From slapd.conf overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=example,dc=com" ppolicy_use_lockout

2 1

Password change synchronization
by punith punith 20 Feb '08

20 Feb '08

Hi everybody.. Warm greetings to you all. I am doing authentication using OpenLDAP and I think it is best place to ask my problem. What I require is, I have to run a shell script when the user changes password. ie Suppose that a user is changed his OpenLDAP pasword, I want to trigger a shell script which updates oracle login password. Is it possible with Openldap? If so, how and where to keep the shell script? All queris and reply are welcome.

3 3

LDAP in Master-Slave
by Aravind Arjunan 20 Feb '08

20 Feb '08

am trying to configuring openldap2.2 in syncrepl method in master-slave. I have two linux machines,i configured for master and slave. I think i had done the configurations correct,bcos after restarting the consumer, my database from provider were copied to consumer automatically. But when i check the consumer by using ldapsearch command,it is returning no such object. in replogfile also there was no content.Tell me how to check that my slave ldap was working and how to check that wheather it has been replicated. After configuring my slave i had added some more in entries in master to check wheather it has been replicated to slave.But i cant able to found through ldapsearch command. The command which i had issued is [root@slave ~]# ldapsearch -x -b 'dc=example,dc=com' \ > '(objectclass=*)' # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope sub # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1

2 1

Fwd: LDAP
by Aravind Arjunan 19 Feb '08

19 Feb '08

---------- Forwarded message ---------- From: Aravind Arjunan <aravind.arjunan(a)gmail.com> Date: 19 Feb 2008 18:31 Subject: Re: LDAP To: Buchan Milne <bgmilne(a)staff.telkomsa.net> When i try to add root.ldif file am getting this error Already exixts(68) If suppose i had edited the root.file or any other ldif file which are already added to the database,at that time also will i get the same error. Just say me how to add the edited ldif file in the database. [root@server openldap]# ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f /etc/openldap/root.ldif Enter LDAP Password: adding new entry "ou=People,cn=Manager,dc=example,dc=com" ldap_add: Already exists (68) [root@server openldap]#

1 0

Re: LDAP
by Aravind Arjunan 19 Feb '08

19 Feb '08

I had already added the domain dc=example,dc=com But when i try to add the ldapuser.ldif am getting no such object error. Here when i try to add example.com.ldif it shows Already exists(68) if suppose if i make some changes in the example.com.ldif is it possible for me to add agian or at that time also it will display Already exists(68) error. tell me how to add the edited ldif file. [root@server ~]# ldapadd -x -D "cn=Manager,dc=example,dc=com" \ > -W -f /etc/openldap/example.com.ldif Enter LDAP Password: adding new entry "dc=example,dc=com" ldap_add: Already exists (68) [root@server ~]# ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f /etc/openldap/ldapusers.ldif Enter LDAP Password: adding new entry "uid=ldapuser,ou=People,cn=Manager,dc=example,dc=com" ldap_add: No such object (32) matched DN: cn=Manager,dc=example,dc=com [root@server ~]# ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f /etc/openldap/root.ldif Enter LDAP Password: adding new entry "uid=root,ou=People,dc=example,dc=com" ldap_add: No such object (32) matched DN: dc=example,dc=com [root@server ~]#

2 1

Ldap group with apache and proftpd
by jonathan.houze＠inetprocess.com 18 Feb '08

18 Feb '08

Hello every body, I am trying to manage rights with phpLdapAdmin and I don't succeed in configuring Apache and Proftpd I have created a branch : Peoples with user, each user is on the group "ldap" (groupid=1000) and some user are in a group "ftp" (groupid=1001) I'd like Proftpd and Apache to check user on the group "ftp" (1001) but I don't succeed, same for Apache ============== My VHOST on httpd.conf ================ LDAPTrustedCA /etc/ssl/cacert.pem LDAPTrustedCAType BASE64_FILE <Location /ldap-status> Order deny,allow Deny from All AuthName "Company.com Intranet" AuthType Basic AuthLDAPUrl ldaps://ldap.enterprise.com/ou=Peoples,dc=ldap,dc=enterprise,dc=com?uid #AuthLDAPGroupAttribute memberUid #AuthLDAPGroupAttributeIsDN off #Require ldap-group cn=ftp,ou=Groups,dc=ldap,dc=enterprise,dc=com #Require ldap-attribute gidNumber=1001 #Satisfy any ======================================================= Thank you, for your support

2 1

LDAP
by Aravind Arjunan 18 Feb '08

18 Feb '08

when am trying to add ldapuser.ldif am getting this error. [root@server ~]# ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f /etc/openldap/ldapusers.ldif Enter LDAP Password: adding new entry "uid=ldapuser,ou=People,cn=Manager,dc=example,dc=com" ldap_add: No such object (32) matched DN: cn=Manager,dc=example,dc=com This is my ldapuser.ldif dn: uid=ldapuser,ou=People,cn=Manager,dc=example,dc=com uid: ldapuser cn: Manager ou: People objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {crypt}c3ZWmT7fM2thY shadowLastChange: 13927 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 507 gidNumber: 100 homeDirectory: /home/ldapuser And is it necessary to extract the information of ldapuser from /etc/passwd file and for linux root account and extracted the /etc/passwd data into an ldif file and imported to that database.

3 2

LDAP inquiry
by Houaichine, Fathi (Fathi) 18 Feb '08

18 Feb '08

Dear team, I have a need to query two different LDAP servers in different domains, all the tools I have today I can query only one server a time, so I am looking if Openldap can do this requirement ? I'll appreciate if any body could advise. Best regards Fathi

2 3

syncrepl, database is not complete...
by Alain Siani 18 Feb '08

18 Feb '08

Hello, _My problem :_ I would like to have a replication server and i don't understand why all data are not copied to the replication server, i use rootdn to do sync...i should be able to copy all data...it start to copy but don't copy all data... _LDAP version :_ Source and copy are the same server : openldap-2.3.27-8 see below for configuration files, thks for your help ! Alain _Source server :_ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/rfc822-MailMember.schema include /etc/openldap/schema/gosa/gofon.schema include /etc/openldap/schema/gosa/samba3.schema include /etc/openldap/schema/gosa/pureftpd.schema include /etc/openldap/schema/gosa/gohard.schema include /etc/openldap/schema/gosa/goto.schema include /etc/openldap/schema/gosa/gosa+samba3.schema include /etc/openldap/schema/gosa/gofax.schema include /etc/openldap/schema/gosa/goserver.schema include /etc/openldap/schema/sfe.schema loglevel 256 password-hash {CRYPT} allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args access to * by * read database bdb suffix dc=domain,dc=com rootdn cn=Manager,dc=domain,dc=com rootpw {SSHA}Lcrkf43J0AU3rXGtMRk5iHAMXHuweL4R directory /var/lib/ldap/domain.com # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub *# Pour la replication avec syncrepl overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 sessionlog 123 500* ==================================================================== _Destination server :_ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema loglevel 256 schemacheck off allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=domain,dc=com" rootdn "cn=Manager,dc=domain,dc=com" rootpw {SSHA}Lcrkf43J0AU3rXGtMRk5iHAMXHuweL4R directory /var/lib/ldap/domain.com index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub access to * by * read * syncrepl rid=123 provider=ldap://10.0.0.242:389 type=refreshOnly interval=00:00:05:00 searchbase="dc=domain,dc=com" filter="(objectclass=*)" attrs="*" scope=sub schemachecking=off updatedn="cn=Manager,dc=domain,dc=com" bindmethod=simple binddn="cn=Manager,dc=domain,dc=com" credentials=xxxx* --- Antivirus avast! : message Sortant sain. Base de donnees virale (VPS) : 080216-0, 16/02/2008 Analyse le : 17/02/2008 13:54:14 avast! - copyright (c) 1988-2008 ALWIL Software. http://www.avast.com

6 13

basic database design
by VaraPrasad Yalla 18 Feb '08

18 Feb '08

I built a basic ldap server which is now working fine . It presently has very few attributes for each of the entries in the database . one of the records now looks like this : --------------------------------------------- dn: uid=test,ou=People,dc=example,dc=com uid: test cn: test objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {crypt}$1$XViJ4WIc$KIn0R0tQnYaKglIOI5Koj. shadowLastChange: 13925 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 506 gidNumber: 506 homeDirectory: /home/test ---------------------------------------------- How do I add further attributes like surname , email , street name etc to it ? Where should I make the modifications for these things to be added to the database ?

2 1

Re: Question concerning the dynlist overlay and single valued attributes
by Pierangelo Masarati 16 Feb '08

16 Feb '08

Gerd Schering wrote: > Pierangelo Masarati wrote: >> Dynlist does not >> allow massaging, so an option would be to stack a rwm before dynlist, so >> that rwm can massage the attribute names from persID to memberID before >> gathering. Looks ugly. > > Even if I will look for another solution (as promised in my previous > posting), I am somewhat curious: where can I find an example dealing > with overlay stacking? Please keep replies on the list. Overlay stacking is trivial: just configure more than one. From slapd.conf(5): overlay <overlay-name> Add the specified overlay to this database. An overlay is a piece of code that intercepts database operations in order to extend or change them. Overlays are pushed onto a stack over the database, and so they will execute in the reverse of the order in which they were configured and the database itself will receive control last of all. See the slapd.overlays(5) manual page for an overview of the available overlays. Note that all of the database’s regular settings should be configured before any overlay settings. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

ldap_initialize failure
by Ron Rogers 15 Feb '08

15 Feb '08

Hi All, I am receiving an LDAP_NO_MEMORY return from ldap_initialize on my Linux box. This error only occurs when the my application is executed from another process. If I start the app from the command line, everything works fine. I've spent some time looking at the source code and manual pages . The error seems to be coming from the call to LDAP_INT_GLOBAL_OPT. After that I'm getting lost in the macros and #defines . Does anyone have any ideas about this problem? Thanks Ron Rogers ____________________________________________________________________________________ Looking for last minute shopping deals? Find them fast with Yahoo! Search. http://tools.search.yahoo.com/newsearch/category.php?category=shopping

1 0

OpenLDAP synchtonization with windows/Active Directory
by Razi Garbie 15 Feb '08

15 Feb '08

Hi everyone, I've spent countless of hours trying to figure out how to sync openLDAP with my currently running windows/active directory, however.. i cant find any information on how this is done. Im currently running windows/AD which authenticates ~20users all windows boxes (obviously), however.. all windows users have accounts on the linux machines i run and that makes administrative tasks a bit messy, hence i have to make account changes on two different domains. The ideal setup is to setup setup a OpenLDAP server that is synced with windows active directory, so that my users can authenticate against the linux domain using their windows passwords. etc, (linux machines/-ldap clients) - > OpenLDAP <--SYNC --> Win/AD <- (windows machines) Thats how i imagine the setup will look like. Has anyone ever done this? Any help is greatly appreciated! // Thanks, boney

5 7

LDAP Auth
by Nuno Manuel Martins 15 Feb '08

15 Feb '08

Hello List, I am very new to OpenLDAP and I am trying to put a Linux box authenticating trough OpenLDAP instead of using the standard password file. For this use I followed the tutorial you can find at http://ldots.org/ldap/ but it seems this howto is out of date. The first problem I ran into was when trying to insert a new user in LDIF format, I corrected the first error I got and now this is the file I have dn: uid=myuser,ou=People,dc=example,dc=com uid: myuser cn: myuser sn: Doe givenname: John objectclass: person objectclass: posixaccount objectclass: account ou: People uidnumber: 10001 gidnumber: 10001 homedirectory=: /home/ldap/john loginshell: /bin/bash When I try to run ldapadd I get the following error: adding new entry "uid=branc0,ou=People,dc=example,dc=com" ldap_add: Invalid syntax (21) additional info: objectclass: value #1 invalid per syntax I am not sure what the problem is, although I'm pretty sure it is between the chair and the keyboard. Maybe someone on the list can direct me to a more up-to-date tutorial on setting up authentication with LDAP ? OpenLDAP version is 2.4.7

4 6

RE: SSL Help
by Vinh.CTR.Hoang＠faa.gov 14 Feb '08

14 Feb '08

It seems like my ldapsearch can't find the get local issuer certificate. what configuration files tells the ldapsearch of which certificate to use? Oh, my certificate and keys and cacert files are good, I've tested them using the openssl s_server and s_client to get a basic connection. can someone help me, I don't know what else could be the problem. here's the log for ldapsearch: /usr/local/bin/ldapsearch -x -LLL -ZZ -d 1 ldap_create ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost:389 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying ::1 389 ldap_connect_timeout: fd: 4 tm: -1 async: 0 ldap_close_socket: 4 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying 127.0.0.1:389 ldap_connect_timeout: fd: 4 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush: 31 bytes to sd 4 ldap_result ld 60888 msgid 1 ldap_chkResponseList ld 60888 msgid 1 all 1 ldap_chkResponseList returns ld 60888 NULL wait4msg ld 60888 msgid 1 (infinite timeout) wait4msg continue ld 60888 msgid 1 all 1 ** ld 60888 Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Wed Feb 13 20:49:25 2008 ** ld 60888 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 60888 Response Queue: Empty ldap_chkResponseList ld 60888 msgid 1 all 1 ldap_chkResponseList returns ld 60888 NULL ldap_int_select read1msg: ld 60888 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 12 contents: read1msg: ld 60888 msgid 1 message type extended-result ber_scanf fmt ({eaa) ber: read1msg: ld 60888 0 new referrals read1msg: mark request completed, ld 60888 msgid 1 request done: ld 60888 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ber_scanf fmt ({eaa) ber: ldap_parse_result ber_scanf fmt ({iaa) ber: ber_scanf fmt (}) ber: ldap_msgfree TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 20, subject: /CN=ldap1.mylan/emailAddress=abc@mylan, issuer: /CN=ldap1.mylan/emailAddress=abc@mylan TLS certificate verification: Error, unable to get local issuer certificate TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. ldap_perror ldap_start_tls: Connect error (-11) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed >>>>>>>>>>>>END>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> and here's the server's log for that search daemon: activity on 1 descriptor >>> slap_listener(ldap:///) daemon: listen=8, new connection on 14 daemon: added 14r (active) listener=0 daemon: select: listen=7 active_threads=0 tvp=NULL daemon: select: listen=8 active_threads=0 tvp=NULL daemon: select: listen=9 active_threads=0 tvp=NULL daemon: select: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: 14r daemon: read activity on 14 connection_get(14) connection_get(14): got connid=6 connection_read(14): checking for input on id=6 ber_get_next ldap_read: want=8, got=8 0000: 30 1d 02 01 01 77 18 80 0....w.. ldap_read: want=23, got=23 0000: 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 31 34 36 .1.3.6.1.4.1.146 0010: 36 2e 32 30 30 33 37 6.20037 ber_get_next: tag 0x30 len 29 contents: ber_dump: buf=0x002094f0 ptr=0x002094f0 end=0x0020950d len=29 0000: 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 ...w...1.3.6.1.4 0010: 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .1.1466.20037 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable daemon: select: listen=7 active_threads=0 tvp=NULL daemon: select: listen=8 active_threads=0 tvp=NULL daemon: select: listen=9 active_threads=0 tvp=NULL daemon: select: listen=10 active_threads=0 tvp=NULL do_extended ber_scanf fmt ({m) ber: ber_dump: buf=0x002094f0 ptr=0x002094f3 end=0x0020950d len=26 0000: 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e w...1.3.6.1.4.1. 0010: 31 34 36 36 2e 32 30 30 33 37 1466.20037 do_extended: oid=1.3.6.1.4.1.1466.20037 send_ldap_extended: err=0 oid= len=0 send_ldap_response: msgid=1 tag=120 err=0 ber_flush: 14 bytes to sd 14 0000: 30 0c 02 01 01 78 07 0a 01 00 04 00 04 00 0....x........ ldap_write: want=14, written=14 0000: 30 0c 02 01 01 78 07 0a 01 00 04 00 04 00 0....x........ daemon: activity on 1 descriptor daemon: activity on: 14r daemon: read activity on 14 connection_get(14) connection_get(14): got connid=6 connection_read(14): checking for input on id=6 TLS trace: SSL_accept:before/accept initialization tls_read: want=11, got=11 0000: 80 7a 01 03 01 00 51 00 00 00 20 .z....Q... tls_read: want=113, got=113 0000: 00 00 39 00 00 38 00 00 35 00 00 16 00 00 13 00 ..9..8..5....... 0010: 00 0a 07 00 c0 00 00 33 00 00 32 00 00 2f 00 00 .......3..2../.. 0020: 07 05 00 80 03 00 80 00 00 05 00 00 04 01 00 80 ................ 0030: 00 00 15 00 00 12 00 00 09 06 00 40 00 00 14 00 ...........@.... 0040: 00 11 00 00 08 00 00 06 04 00 80 00 00 03 02 00 ................ 0050: 80 32 4e ca 88 41 1f 3a 73 cd a1 1c 29 73 a6 81 .2N..A.:s...)s.. 0060: 8c c5 af c3 af 93 bf 13 4a c7 54 90 b7 82 d2 69 ........J.T....i 0070: 2f / TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write server done A tls_write: want=810, written=810 0000: 16 03 01 00 4a 02 00 00 46 03 01 47 b3 58 84 43 ....J...F..G.X.C 0010: c3 a5 64 a9 b5 7c 0b 8b 25 1c d6 e9 ce f2 1f 9b ..d..|..%....... 0020: 82 00 e0 6d 33 e7 e6 44 53 6c 52 20 7d 72 fe 41 ...m3..DSlR }r.A 0030: 17 4c 96 5c 5c 9c 6b df 32 0d c0 32 45 fe 7b bf .L.\\.k.2..2E.{. 0040: a9 5e 16 4b 62 ec 3b 11 76 6e ee ce 00 35 00 16 .^.Kb.;.vn...5.. 0050: 03 01 02 cd 0b 00 02 c9 00 02 c6 00 02 c3 30 82 ..............0. 0060: 02 bf 30 82 02 28 a0 03 02 01 02 02 01 01 30 0d ..0..(........0. 0070: 06 09 2a 86 48 86 f7 0d 01 01 04 05 00 30 30 31 ..*.H........001 0080: 14 30 12 06 03 55 04 03 13 0b 6c 64 61 70 31 2e .0...U....ldap1. 0090: 6d 79 6c 61 6e 31 18 30 16 06 09 2a 86 48 86 f7 mylan1.0...*.H.. 00a0: 0d 01 09 01 16 09 61 62 63 40 6d 79 6c 61 6e 30 ......abc@mylan0 00b0: 1e 17 0d 30 38 30 32 31 33 31 36 31 34 32 32 5a ...080213161422Z 00c0: 17 0d 31 38 30 32 31 32 31 36 31 34 32 32 5a 30 ..180212161422Z0 00d0: 30 31 14 30 12 06 03 55 04 03 13 0b 6c 64 61 70 01.0...U....ldap 00e0: 31 2e 6d 79 6c 61 6e 31 18 30 16 06 09 2a 86 48 1.mylan1.0...*.H 00f0: 86 f7 0d 01 09 01 16 09 61 62 63 40 6d 79 6c 61 ........abc@myla 0100: 6e 30 81 9f 30 0d 06 09 2a 86 48 86 f7 0d 01 01 n0..0...*.H..... 0110: 01 05 00 03 81 8d 00 30 81 89 02 81 81 00 ef 80 .......0........ 0120: 03 36 0f 1e e0 19 e7 1d 03 a9 cb 13 53 81 d6 f7 .6..........S... 0130: bf b6 e4 1c 84 38 77 bd 85 39 e6 f6 9c 50 70 82 .....8w..9...Pp. 0140: 3e 7e e0 17 e9 86 4f a3 48 8f bb 1a f1 04 92 72 >~....O.H......r 0150: bc 02 a7 dd 97 54 c1 cd 09 bd f8 d8 da 23 04 8e .....T.......#.. 0160: e7 77 de 44 f8 54 f9 5e 35 1e 05 50 71 b2 dc 25 .w.D.T.^5..Pq..% 0170: 71 7b e9 48 99 bf 93 a2 07 4e 4e 1f 1f 96 c8 b8 q{.H.....NN..... 0180: 76 21 3b fc c7 60 ab b2 4a 01 2d 8a 15 ee af e7 v!;..`..J.-..... 0190: 76 4e 50 1b 61 8f 5c a1 b3 07 4a cc 82 43 02 03 vNP.a.\...J..C.. 01a0: 01 00 01 a3 81 e8 30 81 e5 30 09 06 03 55 1d 13 ......0..0...U.. 01b0: 04 02 30 00 30 2c 06 09 60 86 48 01 86 f8 42 01 ..0.0,..`.H...B. 01c0: 0d 04 1f 16 1d 4f 70 65 6e 53 53 4c 20 47 65 6e .....OpenSSL Gen 01d0: 65 72 61 74 65 64 20 43 65 72 74 69 66 69 63 61 erated Certifica 01e0: 74 65 30 1d 06 03 55 1d 0e 04 16 04 14 18 e5 ab te0...U......... 01f0: 2a 99 96 50 78 35 71 52 a6 ad 1f 8a 53 c6 72 cd *..Px5qR....S.r. 0200: dc 30 60 06 03 55 1d 23 04 59 30 57 80 14 25 ba .0`..U.#.Y0W..%. 0210: f3 49 07 88 d2 aa 76 2f 59 fc f0 bb 08 6d b5 17 .I....v/Y....m.. 0220: f3 e8 a1 34 a4 32 30 30 31 14 30 12 06 03 55 04 ...4.2001.0...U. 0230: 03 13 0b 6c 64 61 70 31 2e 6d 79 6c 61 6e 31 18 ...ldap1.mylan1. 0240: 30 16 06 09 2a 86 48 86 f7 0d 01 09 01 16 09 61 0...*.H........a 0250: 62 63 40 6d 79 6c 61 6e 82 09 00 8e 0f 59 9d 05 bc@mylan.....Y.. 0260: 90 4f f0 30 29 06 03 55 1d 11 04 22 30 20 82 0a .O.0)..U..."0 .. 0270: 6c 64 61 70 2e 6d 79 6c 61 6e 82 12 6c 6f 61 64 ldap.mylan..load 0280: 62 61 6c 61 6e 63 65 72 2e 6d 79 6c 61 6e 30 0d balancer.mylan0. 0290: 06 09 2a 86 48 86 f7 0d 01 01 04 05 00 03 81 81 ..*.H........... 02a0: 00 89 b9 5b c0 9e 57 39 32 c0 55 79 d6 dd cd 55 ...[..W92.Uy...U 02b0: 2f 6c a4 7e 96 96 f8 f2 51 38 85 35 f1 a9 42 45 /l.~....Q8.5..BE 02c0: b8 f7 e4 a8 68 46 43 c5 5a d8 74 3e e8 a1 f3 25 ....hFC.Z.t>...% 02d0: a7 57 2c bd 0c a2 5d f3 ae 19 57 f6 13 f1 07 2f .W,...]...W..../ 02e0: df da 39 85 bd 0f 60 7b 98 52 8b ae 5d 7a 1a c5 ..9...`{.R..]z.. 02f0: 59 b5 6f 49 74 05 87 5f a4 72 49 7d 59 79 da 97 Y.oIt.._.rI}Yy.. 0300: 5d 01 9c e2 fb b5 42 21 19 f6 9a ef 05 5e cb 8b ].....B!.....^.. 0310: e4 b3 2a 7f f2 5e 87 73 23 ed c0 31 78 53 7e 18 ..*..^.s#..1xS~. 0320: 39 16 03 01 00 04 0e 00 00 00 9......... TLS trace: SSL_accept:SSLv3 flush data tls_read: want=5, got=5 0000: 15 03 01 00 02 ..... tls_read: want=2, got=2 0000: 02 30 .0 TLS trace: SSL3 alert read:fatal:unknown CA TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept. TLS: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca s3_pkt.c:1053 connection_read(14): TLS accept failure error=-1 id=6, closing connection_closing: readying conn=6 sd=14 for close connection_close: conn=6 sd=14 daemon: removing 14 daemon: select: listen=7 active_threads=0 tvp=NULL daemon: select: listen=8 active_threads=0 tvp=NULL daemon: select: listen=9 active_threads=0 tvp=NULL daemon: select: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: waked daemon: select: listen=7 active_threads=0 tvp=NULL daemon: select: listen=8 active_threads=0 tvp=NULL daemon: select: listen=9 active_threads=0 tvp=NULL daemon: select: listen=10 active_threads=0 tvp=NULL >>>>>>>>>>>>>>>>>>>>END>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Thanks, Vinh Vinh CTR Hoang/ACT/CNTR/FAA@FAA Sent by: openldap-technical-bounces+vinh.ctr.hoang=faa.gov(a)OpenLDAP.org 02/12/2008 05:27 PM To openldap-technical(a)openldap.org cc Subject SSL Help Hi, I'm having some troubles with openldap w/ TLS. I can't seem to do a ldapsearch -x -LLL -ZZ, as it is giving be back "SSL3_GET_SERVER_CERTIFICATE:certificate verify failed" On the server side log I'm getting: TLS trace: SSL3 alert read: fatal:unknown CA TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept TLS: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca s3_pkt.c:1053 I've tried and tested my ssl connection using: openssl s_client -connect ldap1.mylan:636 -showcerts -state -CAfile /usr/local/etc/openldap/cacert.pem and that works, althought if I use "TLSVerifyClient demand" in slapd.conf, the server will reject the connection saying that the client didn't send the certificate. I also tried the client authentication ssl test and the works w/ and w/o the TLSVerifyClient demand option: openssl s_client -connect ldap1.mylan:636 -state \ -CAfile /usr/local/etc/openldap/cacert.pem \ -cert /usr/local/etc/openldap/slapd-cert-ldap1.pem \ -key /usr/local/etc/openldap/slapd-key-ldap1.pem Does any know what i'm doing wrong? Here are the tls part of my configs: slapd.conf .... #TLS SSL keys TLSCipherSuite HIGH:MEDIUM:+TLSv1:+SSLv2:SSLv3 TLSCACertificateFile /usr/local/etc/openldap/cacert.pem TLSCertificateFile /usr/local/etc/openldap/slapd-cert-ldap1.pem TLSCertificateKeyFile /usr/local/etc/openldap/slapd-key-ldap1.pem #TLSVerifyClient demand .... ldap.conf BASE dc=mylan HOST ldap1.mylan #URI ldaps://127.0.0.1:636 TLS_CACERT /usr/local/etc/openldap/cacert.pem ..... /etc/ldap.conf # network or connect timeouts (see bind_timelimit). host 127.0.0.1 # The distinguished name of the search base. #base dc=caplan,dc=org base dc=mylan # Another way to specify your LDAP server is to provide an # uri with the server name. This allows to use # Unix Domain Sockets to connect to a local LDAP Server. host ldap1.mylan #uri ldap://127.0.0.1/ #uri ldap://127.0.0.1/ ldaps://127.0.0.1/ #uri ldapi://%2fvar%2frun%2fldapi_sock/ # Note: %2f encodes the '/' used as directory separator # The LDAP version to use (defaults to 3 # if supported by client library) ldap_version 3 # The distinguished name to bind to the server with. # Optional: default is to bind anonymously. #binddn cn=NonAnon,dc=caplan,dc=org # The credentials to bind with. # Optional: default is no credential. #bindpw SeCrEt # The distinguished name to bind to the server with # if the effective user ID is root. Password is # stored in /etc/ldap.secret (mode 600) #rootbinddn cn=root,dc=padl,dc=com # The port. # Optional: default is 389. port 389 .. ... .. # OpenLDAP SSL mechanism # start_tls mechanism uses the normal LDAP port, LDAPS typically 636 ssl start_tls #ssl on # OpenLDAP SSL options # Require and verify server certificate (yes/no) # Default is to use libldap's default behavior, which can be configured in # /etc/openldap/ldap.conf using the TLS_REQCERT setting. The default for # OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes". tls_checkpeer yes # CA certificates for server certificate verification # At least one of these are required if tls_checkpeer is "yes" #tls_cacertfile /etc/ssl/ca.cert #tls_cacertdir /etc/ssl/certs tls_cacertfile /usr/local/etc/openldap/cacert.pem # Seed the PRNG if /dev/urandom is not provided #tls_randfile /var/run/egd-pool # SSL cipher suite # See man ciphers for syntax #tls_ciphers TLSv1 # Client certificate and key # Use these, if your server requires client authentication. #tls_cert #tls_key Thanks, Vinh

2 2

Question concerning the dynlist overlay and single valued attributes
by Gerd Schering 14 Feb '08

14 Feb '08

Hi, I wnt to use the dynlist overlay to collect attribute values from entries in different branches of the DIT, via a dynamic group like this: dn: cn=dynamicTestList,ou=Groups,dc=local,dc=site cn: dynamicTestList objectclass: groupOfURLs memberURL: ldap:///dc=local,dc=site?sn,persID?sub?(objectclass=*) When I query this, I via ldapsearch -x -H ldaps:/// \ -b "cn=dynamicTestList,dc=local,dc=site" -s base "(objectclass=*)" I recieve a reasonable number of "sn" values but just one for "persID", despite the fact, that there should be a lot of them. "persID" is defined SINGLE VALUE. Is this the reason for receiving just one item and if so, what can I do to circumvent this, i.e. retrieve all "persID" from matched entries? BTW, does the dynlist overlay support the "cn=config" staff? Any help will be appreciated, Gerd -- ------------------------------------------------------ -- Gerd Schering, Email: Schering(a)tubit.TU-Berlin.DE -- ------------------------------------------------------

2 2

SSL Help
by Vinh.CTR.Hoang＠faa.gov 14 Feb '08

14 Feb '08

Hi, I'm having some troubles with openldap w/ TLS. I can't seem to do a ldapsearch -x -LLL -ZZ, as it is giving be back "SSL3_GET_SERVER_CERTIFICATE:certificate verify failed" On the server side log I'm getting: TLS trace: SSL3 alert read: fatal:unknown CA TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept TLS: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca s3_pkt.c:1053 I've tried and tested my ssl connection using: openssl s_client -connect ldap1.mylan:636 -showcerts -state -CAfile /usr/local/etc/openldap/cacert.pem and that works, althought if I use "TLSVerifyClient demand" in slapd.conf, the server will reject the connection saying that the client didn't send the certificate. I also tried the client authentication ssl test and the works w/ and w/o the TLSVerifyClient demand option: openssl s_client -connect ldap1.mylan:636 -state \ -CAfile /usr/local/etc/openldap/cacert.pem \ -cert /usr/local/etc/openldap/slapd-cert-ldap1.pem \ -key /usr/local/etc/openldap/slapd-key-ldap1.pem Does any know what i'm doing wrong? Here are the tls part of my configs: slapd.conf .... #TLS SSL keys TLSCipherSuite HIGH:MEDIUM:+TLSv1:+SSLv2:SSLv3 TLSCACertificateFile /usr/local/etc/openldap/cacert.pem TLSCertificateFile /usr/local/etc/openldap/slapd-cert-ldap1.pem TLSCertificateKeyFile /usr/local/etc/openldap/slapd-key-ldap1.pem #TLSVerifyClient demand .... ldap.conf BASE dc=mylan HOST ldap1.mylan #URI ldaps://127.0.0.1:636 TLS_CACERT /usr/local/etc/openldap/cacert.pem ..... /etc/ldap.conf # network or connect timeouts (see bind_timelimit). host 127.0.0.1 # The distinguished name of the search base. #base dc=caplan,dc=org base dc=mylan # Another way to specify your LDAP server is to provide an # uri with the server name. This allows to use # Unix Domain Sockets to connect to a local LDAP Server. host ldap1.mylan #uri ldap://127.0.0.1/ #uri ldap://127.0.0.1/ ldaps://127.0.0.1/ #uri ldapi://%2fvar%2frun%2fldapi_sock/ # Note: %2f encodes the '/' used as directory separator # The LDAP version to use (defaults to 3 # if supported by client library) ldap_version 3 # The distinguished name to bind to the server with. # Optional: default is to bind anonymously. #binddn cn=NonAnon,dc=caplan,dc=org # The credentials to bind with. # Optional: default is no credential. #bindpw SeCrEt # The distinguished name to bind to the server with # if the effective user ID is root. Password is # stored in /etc/ldap.secret (mode 600) #rootbinddn cn=root,dc=padl,dc=com # The port. # Optional: default is 389. port 389 .. ... .. # OpenLDAP SSL mechanism # start_tls mechanism uses the normal LDAP port, LDAPS typically 636 ssl start_tls #ssl on # OpenLDAP SSL options # Require and verify server certificate (yes/no) # Default is to use libldap's default behavior, which can be configured in # /etc/openldap/ldap.conf using the TLS_REQCERT setting. The default for # OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes". tls_checkpeer yes # CA certificates for server certificate verification # At least one of these are required if tls_checkpeer is "yes" #tls_cacertfile /etc/ssl/ca.cert #tls_cacertdir /etc/ssl/certs tls_cacertfile /usr/local/etc/openldap/cacert.pem # Seed the PRNG if /dev/urandom is not provided #tls_randfile /var/run/egd-pool # SSL cipher suite # See man ciphers for syntax #tls_ciphers TLSv1 # Client certificate and key # Use these, if your server requires client authentication. #tls_cert #tls_key Thanks, Vinh

2 1

Re: Ldap ppolicy schema entries
by Aravind Arjunan 12 Feb '08

12 Feb '08

* Am still facing issue while configuring ldap in master slave for replication. am using openldap 2.2 version. OS: RHEL 4.0 And am trying to configure master slave replication thro slurpd method. i had configured my master slapd.conf and slave slave slapd.conf. similarly i configured master and slave ldap.conf. After that i stopped the service in master and slave by [root@server ~]# service ldap stop Stopping slapd: [ OK ] Stopping slurpd: [ OK ] [root@server ~]# similarly in slave also. then i copied the database manually using slapcat [root@server openldap]# slapcat -b "dc=example,dc=com" -v -l example.com.ldif # id=00000001 # id=00000003 [root@server openldap]# scp example.com.ldif root(a)151.2.119.133 :/var/lib/ldap/example.com/ root(a)151.2.119.133's password: example.com.ldif 100% 747 0.7KB/s 00:00 [root@server openldap]# In slave : [root@slave openldap]# slapadd -b "dc=example,dc=com" -v -l example.com.ldif added: "dc=example,dc=com" (00000001) added: "cn=Manager,dc=example,dc=com" (00000002) [root@slave openldap]# but when i create a user in ldapmaster and check that user in slave,i was not able to found. there was no log in replogfile. [root@server ~]# useradd test [root@server ~]# passwd test Changing password for user test. New UNIX password: Retype new UNIX password: passwd: all authentication tokens updated successfully. [root@server ~]# In slave [root@slave openldap]# id test id: test: No such user Here is my configuration files master slapd.conf * *=============* *#######################################################################* # ldbm and/or bdb database definitions ####################################################################### * database bdb * #The base of your directory * suffix "dc=example,dc=com" * #where the database files are physically stored * directory "/var/lib/ldap/example.com" * #Distinguished name,not subject to access control * rootdn "cn=Manager,dc=example,dc=com" rootpw password * # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Replicas of this database * replica uri=ldap://=151.2.119.133:389 suffix="dc=example,dc=com" binddn="cn=syncuser,dc=example,dc=com" bindmethod=simple credentials=hcllch replogfile /var/lib/ldap/replogfile * #ACL's * access to attrs=userpassword by self write by anonymous auth by dn="cn=syncuser,dc=example,dc=com" read by * auth access to * by self write by dn="cn=syncuser,dc=example,dc=com" read by * read * #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM [root@server openldap]# * Slave slapd.conf ============== * ####################################################################### # ldbm and/or bdb database definitions ####################################################################### * database bdb * #The base of your directory * suffix "dc=example,dc=com" * #where the database files are physically stored #directory "/var/lib/ldap/ldap-test" #Distinguished name,not subject to access control * rootdn "cn=Manager,dc=example,dc=com" rootpw password * # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended * updatedn cn=syncuser,dc=example,dc=com updateref ldap://151.2.119.120 directory /var/lib/ldap/example.com access to attrs=userpassword by self write by anonymous auth by dn="cn=syncuser,dc=example,dc=com" write by * auth access to * by self write by dn="cn=syncuser,dc=example,dc=com" write by * read * # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM [root@slave openldap]# * Master ldap.conf ============== * # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example, dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never * host 151.2.119.120 151.2.119.133 base dc=example,dc=com binddn cn=Manager,dc=example,dc=com bindpw password bind_policy soft pam_password expo Slave ldap.conf ============== * # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example, dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never * host 151.2.119.133 151.2.119.120 base dc=example,dc=com binddn cn=Manager,dc=example,dc=com bindpw password bind_policy soft pam_password expo *

2 1

Master Slave ldap
by Aravind Arjunan 12 Feb '08

12 Feb '08

---------- Forwarded message ---------- From: Aravind Arjunan <aravind.arjunan(a)gmail.com> Date: 9 Feb 2008 11:20 Subject: Fwd: Ldap ppolicy schema entries To: openldap-technical(a)openldap.org ---------- Forwarded message ---------- From: Aravind Arjunan <aravind.arjunan(a)gmail.com> Date: 9 Feb 2008 11:19 Subject: Re: Ldap ppolicy schema entries To: Buchan Milne <bgmilne(a)staff.telkomsa.net> Am trying to confiure the ldap in master-slave It was mentioned in the document that after configuring the master and slave slapd.conf file for replication, shutdown the master slapd,so you can copy the database. I cant understand in this part,how to copy the database. where to copy?tell me how to check that my slave slapd is working? wheather by giving ldapsearch command in slave instance or by any other. am attaching the master and slave conf file for reference,please mention me if there is any mistake.

2 1

Fwd: Ldap ppolicy schema entries
by Aravind Arjunan 09 Feb '08

09 Feb '08

---------- Forwarded message ---------- From: Aravind Arjunan <aravind.arjunan(a)gmail.com> Date: 9 Feb 2008 11:19 Subject: Re: Ldap ppolicy schema entries To: Buchan Milne <bgmilne(a)staff.telkomsa.net> Am trying to confiure the ldap in master-slave It was mentioned in the document that after configuring the master and slave slapd.conf file for replication, shutdown the master slapd,so you can copy the database. I cant understand in this part,how to copy the database. where to copy?tell me how to check that my slave slapd is working? wheather by giving ldapsearch command in slave instance or by any other. am attaching the master and slave conf file for reference,please mention me if there is any mistake.

1 0

tips in ldappasswd
by Gustavo Mendes de Carvalho 08 Feb '08

08 Feb '08

Hi there, I have an OpenLDAP Server authenticating with TLSv1, but I ´foound some probelms when I have to change my ldap user´s password. I use the following command to try to change it [ming@ldap-cli ~]$ ldappasswd -AS -ZZ -H ldaps://ldap.server/ -D uid=ming,ou=org-unit,o=org,c=br Old password: Re-enter old password: New password: Re-enter new password: ldap_start_tls: Operations error (1) additional info: TLS already started [ming@ldap-cli ~]$ ldappasswd -AS -H ldaps://ldap.server/ -D uid=ming,ou=org-unit,o=org,c=br Old password: Re-enter old password: New password: Re-enter new password: SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Miscellaneous failure (No credentials cache found) I store only password's hashes in my ldap database, so I need to know how to replace this hash. If I connect to my ldap server using some ldap browser, like ldapadmin, I can change my user´s password, but I need to change it using some command line, like ldappasswd. Do you have some examples about how to use ldappasswd ? I already search it in Google, but all expamples that I found tells me that to use same command that I'm already using. Thanks iin advance --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com

3 5

2.3.39 vs 2.3.40 (as Re: (ITS#5354) slapd repeatedly hangs and stops reponding)
by Buchan Milne 08 Feb '08

08 Feb '08

On Friday 08 February 2008 03:35:54 quanah(a)zimbra.com wrote: > --On Thursday, February 07, 2008 8:13 PM -0500 Oren Laadan > > <orenl(a)cs.columbia.edu> wrote: > > will fix the symbols now. thanks. > > > > as for the patch, it seems unrelated as it fixes a problem during the > > start-up of the daemon; also, it's for 2.4.7, and I just downgraded > > back to 2.4.49 (which I was using originally). the decision to move > > up was because I hoped that the problem would disappear when using a > > more recent version of openldap. as it turns out, it didn't :( > > There's no such thing as 2.4.49. I assume you mean 2.3.40? Or 2.3.39? I > would use 2.3.40 over 2.3.39 Quoting Howard: "While ITS#5342 is still being investigated, I would recommend that everyone use 2.3.39 and not 2.3.40. Sorry for the trouble." ITS#5342 is still open, and while the last two followups seem to indicate that the corruption was not the fault of 2.3.40 ... I'm planning an upgrade for this weekend (from 2.3.34 for one set of servers, and from 2.3.11 for another), and thus far I'm hoping to run with 2.3.39 with most fixes in 2.3.40 (plus #5358's fix), but not the dn2id lock fix ... Maybe I should make provision for an export/import during my upgrade? Regards, Buchan

3 3

Re: Ldap ppolicy schema entries
by Ljunghammar, Darryl K 08 Feb '08

08 Feb '08

Hi Tonni, Could you give me an example of what you meant by putting a + at the end of the ldapsearch command? When I tried putting a plus at the end it didn't give me any found results so I must be doing something wrong with the syntax. I used: [root@alph bin]# ldapsearch -x -H ldaps://alph/ -D "cn=Manager,dc=dst,dc=boeing,dc=com" -W -b "ou=people,dc=dst,dc=boeing,dc=com" "(uid=darryl+)" Enter LDAP Password: xxxxxx # extended LDIF # # LDAPv3 # base <ou=people,dc=dst,dc=boeing,dc=com> with scope sub # filter: (uid=darryl+) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 But if I leave off the + I do get the user fields so I know it has data. Thanks, Darryl ________________________________________________________________________ ___________ Ljunghammar, Darryl K skrev, on 23-01-2008 21:56: I would like to view the ppolicy schema attributes for a user when I do a "ldapsearch" but they don't show up. For example, I would like to see the "pwdHistory" attribute for a user. I know it is being updated because if I enter a previously used password it tells me it can't be reused. I am using openldap 2.3.39-3 on a Redhat 5.1 system. Put a '+' at the end of your ldapsearch string and you'll see only the operational attributes, *if* your ACLs permit this. You will not see empty attributes, only those with values. Best, --Tonni -- Tony Earnshaw Email: tonni at hetnet dot nl

2 1

Openldap and last logon
by Ljunghammar, Darryl K 08 Feb '08

08 Feb '08

Hi, I there a way to record the last logon and hostname into a user's record in openldap? I am using openldap 2.3.27-8 on a Rh5.1 system. Thanks, Darryl

1 0

Trouble Installing LDAP Client On Ubuntu Linux
by Ldap Newbie 08 Feb '08

08 Feb '08

Hi, I have some trouble with the installation of the LDAP client on Ubuntu Linux. I followed the instructions as described the articles below. 1. <http://www.linux.com/feature/114074> 2. <http://mcwhirter.com.au/node/25> Although I followed the steps in the article my Ubuntu keeps running exactly as before, authenticating without using LDAP. Problem is that I don't have a clue what's happening. So any suggestions on what files to check or what commands to run to test things are appreciated. What I do know about this configuration problem is: * The LDAP server is up and running, it's usable from another application * I don't see any incoming traces when I run slapd in full debug mode and try some actions like rebooting or getent passwd from the client * The getent passwd <username> test as described in article .2 fails So likely something went wrong with the configuration of $ apt-get install libpam-ldap libnss-ldap Is there a way I can rerun the installer so that I can verify the configuration data I entered. What other things should I try ? All suggestions apprectiated. Thanks, Carl _________________________________________________________________ Who's friends with who and co-starred in what? http://www.searchgamesbox.com/celebrityseparation.shtml

3 2

openldap - missing modules - how / where to find them
by Charlie Reddington 06 Feb '08

06 Feb '08

Hi Everyone, I'm working on setting up openldap on a few of my linux servers. I was working on setting up the slapd.conf file, and I ran the slaptest against it. I was returned with this. 1t_dlopenext failed: (back_bdb) back_bdb.so: cannont open shared object file: no file or directory found. Okay, simple enough, I'm trying to use the bdb backend, so I need the module that is called in my file back_bdb.so. I did a search on the system and that is not found. I installed the openldap stuff via yum. I installed the following. openldap openldap-servers openldap-cleints openldap-devel I've reinstalled, I've searched for just the backend module itself, all coming up empty handed. Can someone point me to what I'm doing wrong to get these files? Charlie

2 1

Timeouts over LDAPS
by Martin Sandsmark 06 Feb '08

06 Feb '08

Hi! I'm having some trouble with time-outs when using ldaps with pam. If the slapd opens an incoming ssl connection, but do not respond correctly (like if the Berkley database breaks down, which unfortunately seems to happen from time to time), the ldap-pam-module will hang more or less indefinitely. This is rather unfortunate, since it makes logging in and repairing the database much more tedious. If we use just plain ldap (not using openssl), the connection times out rather quickly, and pam tries the next authentication method which works as expected, and the problem can be fixed. But unfortunately that also opens up some security risks, since we can't be sure we connect to the proper ldap server. -- Martin Sandsmark IT-Komiteen, Samfundet "Capital letters were always the best way of dealing with things you didn't have a good answer to." - Douglas Adams

3 2

LDAP Master/Slave replication
by Alain Siani 05 Feb '08

05 Feb '08

Hello, Do you think the version of ldap must be equal ? I use openldap-2.3.27-8 on server and openldap-2.2.23-5 on client. Do you think it is syncrepl compatible ? thanks, Alain I don't found the solution... do you know a french document for installation of "syncrpl" ? I tried english documentation : http://www.openldap.org/doc/admin22/syncrepl.html but no success... thanks, Alain The log : Feb 5 13:11:37 dev5 slapd[2523]: =>do_syncrepl Feb 5 13:11:37 dev5 slapd[2523]: => bdb_entry_get: ndn: "cn=syncrepl123,dc=myDomain,dc=com" Feb 5 13:11:37 dev5 slapd[2523]: => bdb_entry_get: oc: "(null)", at: "syncreplCookie" Feb 5 13:11:37 dev5 slapd[2523]: bdb_dn2entry("cn=syncrepl123,dc=myDomain,dc=com") Feb 5 13:11:37 dev5 slapd[2523]: => bdb_dn2id( "dc=myDomain,dc=com" ) Feb 5 13:11:37 dev5 slapd[2523]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) Feb 5 13:11:37 dev5 slapd[2523]: => bdb_entry_get: cannot find entry: "cn=syncrepl123,dc=myDomain,dc=com" Feb 5 13:11:37 dev5 slapd[2523]: =>do_syncrep2 thanks for you help ! Alain Hello, I use the bottom file "slapd.conf" to mirror master server. It was ok with 2.2.23-5 version of openldap. I just installed a new version of openldap : 2.3.27-8 Now the slave server start ok... but slapcat is empty !!?? Do you have an idea ? Thanks a lot, Alain slapd.conf _________ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema allow bind_v2 pidfile /var/run/slapd.pid argsfile /var/run/slapd.args loglevel 256 database bdb suffix "dc=myDomain,dc=com" rootdn "cn=Manager,dc=myDomain,dc=com" rootpw {SSHA}wuapktMrH50PDG29WoffJcmvpblebsdT directory /var/lib/ldap/myDomain.com index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryUUID eq access to * by * read syncrepl rid=123 provider=ldap://10.0.0.242:389 type=refreshOnly interval=00:00:01:00 searchbase="dc=myDomain,dc=com" filter="(objectclass=*)" attrs="*" scope=sub bindmethod=simple binddn="cn=Manager,dc=myDomain,dc=com" credentials="myPassword" --- Antivirus avast! : message Entrant sain. Base de donnees virale (VPS) : 080204-0, 04/02/2008 Analyse le : 05/02/2008 19:55:34 avast! - copyright (c) 1988-2008 ALWIL Software. http://www.avast.com --- Antivirus avast! : message Sortant sain. Base de donnees virale (VPS) : 080204-0, 04/02/2008 Analyse le : 05/02/2008 20:03:01 avast! - copyright (c) 1988-2008 ALWIL Software. http://www.avast.com

2 1

LDAP Master/Slave replication
by asiani＠free.fr 05 Feb '08

05 Feb '08

I don't found the solution... do you know a french document for installation of "syncrpl" ? I tried english documentation : http://www.openldap.org/doc/admin22/syncrepl.html but no success... thanks, Alain The log : Feb 5 13:11:37 dev5 slapd[2523]: =>do_syncrepl Feb 5 13:11:37 dev5 slapd[2523]: => bdb_entry_get: ndn: "cn=syncrepl123,dc=myDomain,dc=com" Feb 5 13:11:37 dev5 slapd[2523]: => bdb_entry_get: oc: "(null)", at: "syncreplCookie" Feb 5 13:11:37 dev5 slapd[2523]: bdb_dn2entry("cn=syncrepl123,dc=myDomain,dc=com") Feb 5 13:11:37 dev5 slapd[2523]: => bdb_dn2id( "dc=myDomain,dc=com" ) Feb 5 13:11:37 dev5 slapd[2523]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) Feb 5 13:11:37 dev5 slapd[2523]: => bdb_entry_get: cannot find entry: "cn=syncrepl123,dc=myDomain,dc=com" Feb 5 13:11:37 dev5 slapd[2523]: =>do_syncrep2 thanks for you help ! Alain Hello, I use the bottom file "slapd.conf" to mirror master server. It was ok with 2.2.23-5 version of openldap. I just installed a new version of openldap : 2.3.27-8 Now the slave server start ok... but slapcat is empty !!?? Do you have an idea ? Thanks a lot, Alain slapd.conf _________ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema allow bind_v2 pidfile /var/run/slapd.pid argsfile /var/run/slapd.args loglevel 256 database bdb suffix "dc=myDomain,dc=com" rootdn "cn=Manager,dc=myDomain,dc=com" rootpw {SSHA}wuapktMrH50PDG29WoffJcmvpblebsdT directory /var/lib/ldap/myDomain.com index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryUUID eq access to * by * read syncrepl rid=123 provider=ldap://10.0.0.242:389 type=refreshOnly interval=00:00:01:00 searchbase="dc=myDomain,dc=com" filter="(objectclass=*)" attrs="*" scope=sub bindmethod=simple binddn="cn=Manager,dc=myDomain,dc=com" credentials="myPassword"

1 0

LDAP Master/Slave replication
by asiani＠free.fr 05 Feb '08

05 Feb '08

The log : Feb 5 13:11:37 dev5 slapd[2523]: =>do_syncrepl Feb 5 13:11:37 dev5 slapd[2523]: => bdb_entry_get: ndn: "cn=syncrepl123,dc=myDomain,dc=com" Feb 5 13:11:37 dev5 slapd[2523]: => bdb_entry_get: oc: "(null)", at: "syncreplCookie" Feb 5 13:11:37 dev5 slapd[2523]: bdb_dn2entry("cn=syncrepl123,dc=myDomain,dc=com") Feb 5 13:11:37 dev5 slapd[2523]: => bdb_dn2id( "dc=myDomain,dc=com" ) Feb 5 13:11:37 dev5 slapd[2523]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) Feb 5 13:11:37 dev5 slapd[2523]: => bdb_entry_get: cannot find entry: "cn=syncrepl123,dc=myDomain,dc=com" Feb 5 13:11:37 dev5 slapd[2523]: =>do_syncrep2 thanks for you help ! Alain Hello, I use the bottom file "slapd.conf" to mirror master server. It was ok with 2.2.23-5 version of openldap. I just installed a new version of openldap : 2.3.27-8 Now the slave server start ok... but slapcat is empty !!?? Do you have an idea ? Thanks a lot, Alain slapd.conf _________ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema allow bind_v2 pidfile /var/run/slapd.pid argsfile /var/run/slapd.args loglevel 256 database bdb suffix "dc=myDomain,dc=com" rootdn "cn=Manager,dc=myDomain,dc=com" rootpw {SSHA}wuapktMrH50PDG29WoffJcmvpblebsdT directory /var/lib/ldap/myDomain.com index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryUUID eq access to * by * read syncrepl rid=123 provider=ldap://10.0.0.242:389 type=refreshOnly interval=00:00:01:00 searchbase="dc=myDomain,dc=com" filter="(objectclass=*)" attrs="*" scope=sub bindmethod=simple binddn="cn=Manager,dc=myDomain,dc=com" credentials="myPassword"

1 0

LDAP Master/Slave replication
by asiani＠free.fr 05 Feb '08

05 Feb '08

Hello, I use the bottom file "slapd.conf" to mirror master server. It was ok with 2.2.23-5 version of openldap. I just installed a new version of openldap : 2.3.27-8 Now the slave server start ok... but slapcat is empty !!?? Do you have an idea ? Thanks a lot, Alain slapd.conf _________ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema allow bind_v2 pidfile /var/run/slapd.pid argsfile /var/run/slapd.args loglevel 256 database bdb suffix "dc=myDomain,dc=com" rootdn "cn=Manager,dc=myDomain,dc=com" rootpw {SSHA}wuapktMrH50PDG29WoffJcmvpblebsdT directory /var/lib/ldap/myDomain.com index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryUUID eq access to * by * read syncrepl rid=123 provider=ldap://10.0.0.242:389 type=refreshOnly interval=00:00:01:00 searchbase="dc=myDomain,dc=com" filter="(objectclass=*)" attrs="*" scope=sub bindmethod=simple binddn="cn=Manager,dc=myDomain,dc=com" credentials="myPassword"

1 0

Exporting LDAP info from Active Directory / Exchange Global Address List
by Clemson, Chris (IHG) 04 Feb '08

04 Feb '08

Hi everyone, Hopefully I'm now sending this to the right list, apologies if not.... I am trying to find a way of exporting most information from the GAL into an LDAP server. It seems that OpenLDAP might do what I want, however I'm relatively new to using LDAP, so I was wondering if someone could give me a few pointers on how to do this. It sounds like I need to use a slapd as a Proxy Cache Engine, so I can cache an AD query (preferably the equivalent of the Exchange GAL) into OpenLDAP. People can then use the OpenLDAP server as a Directory source in Outlook without needing to log in to anything. I need to do something like this so that people who do not have access to the Exchange Servers can see (and therefore email) accounts in Exchange. I have found some mailing list articles that allude to this, but nothing specific. Thank you, Chris

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical