- openldap-technical - openldap.org

integrating LDAP onto EPrints and Dspace
by divya shree 28 Feb '08

28 Feb '08

Hi I am doin a project..where in i hav to integrate LDAP on to Eprints n DSpace..for providin a single user authentication to the users of Eprints n DSapce... For this i am trying to install OpenLdap-2.4.7..software..i would like to knw if i am on the ryt track and also would like to knw the diff between openldap n ldap..if there is any... Thanks and Regards Divya --------------------------------- Forgot the famous last words? Access your message archive online. Click here.

2 1

OpenLDAP question
by Keith Conger 27 Feb '08

27 Feb '08

Hi, I was wondering if the following is possible with OpenLDAP: I'd like to have an OpenLDAP Server or two(load balanced) with an extended custom schema that will proxy certain attributes back to a non-openldap ldap server. Reading through the list archives it seems like it may be possible but does anyone know for sure from experience? Keith -- Keith Conger Server Systems Administrator Onondaga Community College 4585 West Seneca Turnpike Syracuse, N.Y. 13215-4585 Email/JID: congerk(a)sunyocc.edu http://www.sunyocc.edu/~congerk/

2 1

LDAP add fails with Protocol Error
by Alexander Hartner 27 Feb '08

27 Feb '08

After generating an LDIF file using ldapsearch having a direct fast connect to the LDAP directory, attempt to re-import the file have succeeded while being on the local network. However attempt to import the same LDIF file over a WAN connection fail with the following error: ldapadd -c -D "..." -w ... -x -h ... -p 389 -f test2.ldif adding new entry "..." ldap_add: Already exists (68) adding new entry "..." ldap_add: Already exists (68) adding new entry "..." ldap_add: Protocol error (2) additional info: no attributes provided adding new entry "..." ldap_add: Already exists (68) .. adding new entry "..." adding new entry "..." .. adding new entry "..." ldapadd: update failed: ... ldap_add: Can't contact LDAP server (-1) .. All messages after this file with the same error (-1). It seems that the slower connection is causing a Protocol error which results in LDAP falling over, or at least becoming un-available. Any ideas what could be causing this problem and what I could to address this. Regards Alex

2 1

nss_ldap periodic errors
by Kamil Kisiel 27 Feb '08

27 Feb '08

I'm using nss_ldap on a whole bunch of machines on the network, and while it works great most of the time, I continuously get errors in my syslog. A sampling from today (these are actually from different machines, but I have anonymized the hostnames to be the same.): Feb 25 09:30:25 server.example.com sshd[17495]: nss_ldap: could not search LDAP server - Server is unavailable Feb 25 11:11:08 server.example.com -bash: nss_ldap: could not search LDAP server - Server is unavailable Feb 25 21:50:01 server.example.com automount[5030]: nss_ldap: could not search LDAP server - Server is unavailable Feb 25 21:55:16 server.example.com nscd: nss_ldap: could not search LDAP server - Server is unavailable I get a few of these errors in our syslogs every hour, and occasionally it seems I can't log in via SSH. However typically when I log in to the machine and do a "getent passwd" everything is fine. The LDAP server is from Open Directory in OS X Server 10.5.2. The version of nss_ldap is the one from Gentoo Linux, version nss_ldap-258. My /etc/ldap.conf looks like this: uri ldap://ldap1.example:389 base dc=example,dc=com timelimit 30 bind_timelimit 30 bind_policy soft nss_reconnect_maxconntries 5 idle_timelimit 3600 pam_password_prohibit_message Please use System Preferences on your Mac to change your directory password. nss_base_group cn=Groups,dc=zymeworks,dc=com nss_base_passwd cn=Users,dc=zymeworks,dc=com Does anyone have any suggestions as to what I can try to do to debug and fix this ? It's really becoming irritating. -- Kamil

3 4

log fields
by Gustavo Mendes de Carvalho 26 Feb '08

26 Feb '08

Hi there, I would like to get some documentation that can describe, in details, which fiileds there are present in ldap.log file, and the meaning of each field. I need some information about 7th field (op=33 in first line). Where can I find all codes used in this field ? Jan 10 11:50:21 ldap01 slapd[10819]: conn=1702 op=33 SEARCH RESULT tag=101 err=0 nentries=1 text= Jan 10 11:50:25 ldap01 slapd[10819]: conn=1702 op=34 SRCH base="uid=gustavo,ou=company,c=org" scope=0 deref=0 filter="(objectClass=*)" Jan 10 11:50:25 ldap01 slapd[10819]: conn=1702 op=34 SEARCH RESULT tag=101 err=0 nentries=1 text= Jan 10 11:50:26 ldap01 slapd[10819]: conn=1702 op=35 SRCH base="uid=gustavo,ou=company,c=org" scope=0 deref=0 filter="(objectClass=*)" Jan 10 11:50:26 ldap01 slapd[10819]: conn=1702 op=35 SEARCH RESULT tag=101 err=0 nentries=1 text= Jan 10 12:28:13 ldap01 slapd[10819]: conn=1702 op=36 UNBIND Jan 10 12:28:13 ldap01 slapd[10819]: conn=1702 fd=21 closed Thanks --- Gustavo e-mail: gmcarvalho(a)gmail.com

5 7

Re: using LDAP as central authentication unit
by Hamidreza Hamedtoolloei 26 Feb '08

26 Feb '08

Hey Buchan, Thanks alot for your help... it make sense now....during the configuration process , I modified the NSS service to consult the OpenLDAP server by adding the following lines in the /etc/nsswitch.conf file passwd: files ldap shadow: files ldap group: files ldap So ldap server is called for NSS lookup regardless of what authentication mechanism is used. got it Again, thanks alot ~Hamid ----- Original Message ---- From: Buchan Milne <bgmilne(a)staff.telkomsa.net> To: openldap-technical(a)openldap.org Cc: Hamidreza Hamedtoolloei <hamedtoolloei(a)yahoo.com> Sent: Tuesday, February 26, 2008 1:13:56 AM Subject: Re: using LDAP as central authentication unit On Monday 25 February 2008 20:52:08 Hamidreza Hamedtoolloei wrote: > so if a user is in both /etc/passwd and ldap, linux authentication is used. > However, if a user is ONLY in ldap directory, linux authentication fails > and ldap is called. Analysing the case that a user is only in the > etc/passwd: > In this case, there are some activities in the ldap site which I dont > understand. If a user is only in etc/passwd and pam.d/system.auth file > says call ldap only if linux fails, then why ldap is called when linux > authentication is successful? Because, this is NOT PAM. It is a NSS lookup. For example, when you type 'ls', the filesystem returns the uid that owns the files. To show the username of the owner, the c library invokes a function from nss, to look up the username. This has nothing to do with pam. In a similar way, group memberships have nothing (much) to do with PAM, but with nss. > You say this is expected... but if I understood the pam.d/system.auth file > correctly, ldap should not be called if a user is only in etc/passwd We can't tell, as you haven't provided your /etc/nsswitch.conf file, and none of the queries from your log look like pam_ldap, they look more like nss_ldap ... Regards, Buchan ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

1 0

OpenLDAP Support for cpCPS objectClass??
by Patrick Patterson 26 Feb '08

26 Feb '08

Hi All; I am working on a PKI project, and would like to be able to use OpenLDAP, however, the certificate policy that we have to conform to mandates that CA entries be a member of pkiCA and cpCps auxiliary object classes. Now, the pkiCA requirement is easy, as it looks like OpenLDAP supports that just fine, however, I'm wondering if cpCPS is able to be supported. I guess my question is twofold: Have the syntax checking routines mandated for the cpCps object class (I presume out of ITU-T X.509 chapter 11) been implemented in OpenLDAP, and if so, does anyone happen to have a schema file available so that I don't have to write one myself to add this objectClass to OpenLDAP. If not, is it possible to add these syntax checking routines in the same way as one can extend the schema for object classes and attributes? (I know that I could probably cheat, turn schema checking off and just build have the server support the attributes in a somewhat custom fashion, but since this is for a PKI system that needs a certain level of trust, I am a bit loath to do this). Thanks in advance. -- Personal Mail from Patrick Patterson No company affiliation

3 4

Re: Limit daily query number
by cariparo＠libero.it 26 Feb '08

26 Feb '08

Overlays seems to be the right way to follow. Now I perform some investigation... Grazie! ---------- Initial Header ----------- >From : "Pierangelo Masarati" ando(a)sys-net.it To : "cariparo(a)libero.it" cariparo(a)libero.it Cc : openldap-technical(a)openldap.org Date : Mon, 25 Feb 2008 15:06:57 +0100 Subject : Re: Limit daily query number > Gavin Henry wrote: > > <quote who="cariparo\(a)libero\.it"> > >> Thanks Gavin, > >> We have a LDAP service for out customers, under subscription, and we want > >> to release a light free service for everyone on Internet, by narrowing the > >> daily queries number. > >> I'm thinking to create a PHP bridge, so free customers call a php page > >> instead to connecting directly to LDAP server, and mantain an IP list on > >> MySQL. Any other idea? > > What you need would best be dealt with by a custom overlay. I suggest > you look at overlay development (servers/slapd/overlays/slapover.txt, > <http://www.openldap.org/faq/data/cache/1169.html>), or hire someone > that can develop it for you. > > <advertisement> > One of SysNet's specialties is custom overlay development > <http://open.sys-net.it> > </advertisement> > > p. > > > > Ing. Pierangelo Masarati > OpenLDAP Core Team > > SysNet s.r.l. > via Dossi, 8 - 27100 Pavia - ITALIA > http://www.sys-net.it > --------------------------------------- > Office: +39 02 23998309 > Mobile: +39 333 4963172 > Email: pierangelo.masarati(a)sys-net.it > --------------------------------------- > > >

1 0

Change LDAP User's Password
by Le Trung Kien 26 Feb '08

26 Feb '08

Hi, I'm confused about ldap authentication. I'm attempting to use ldap with kerberos 5, when changing an user's password, I issused: user1]$ passwd Kerberos 5 Password: ****** New UNIX password: ****** Retype new UNIX password: ****** All things go well, however, still have a password don't change, and I don't know what this password is. And how to change it. Still that user, I can't use 'ldappasswd' user1]$ ldappasswd SASL/GSSAPI authentication started SASL username: user1(a)MYREALM.COM SASL SSF: 56 SASL installing layers New password: yPYNAgvO <--- this changes frequently Result: Internal (implementation specific) error (80) Additional info: SASL(-7): invalid parameter supplied: Error putting OTP secret I should emphasize that the user1 has two passwords, the first one can be changed with 'passwd' or 'kpasswd', the other I don't know how to access it, although this second password still works and it's can be used to login. More information: user1]$ passwd Kerberos 5 Password: <--- type a wrong password and got following (only the first password works here) Enter login(LDAP) password: <--- the second password works here New UNIX password: ****** Retype new UNIX password: ****** LDAP password information update failed: Insufficient access passwd: Permission denied Best Regards. -- Le Trung Kien.

2 7

Redirect bind requests to another server
by Andreas Moroder 26 Feb '08

26 Feb '08

Hello, we have a web application that autenticates via openldap. Now a second hospital should use this same application, but they have their own autentication server, active directory in this case. In our network the users authenticate giving their username ( amoroder in my case ) and password. Is it possible to configure openldap to redirect the bind request to the remote server when the username contains an extension like jsmith@remote ? Does this work with AD as second/remote authentication server ? Thank you very much Andreas

4 4

Re: using LDAP as central authentication unit
by Hamidreza Hamedtoolloei 26 Feb '08

26 Feb '08

Hey Buchan, Sorry for not answering your question.. I must have overlooked your response. My ultimate goal is to use LDAP for user authentication and resource authorization in a grid computing environment. As a starting point, I tried to use ldap as a centralized linux user account management mechanism. So I configured my LDAP to act as linux user authentication using this link: http://www.ibm.com/developerworks/library/l-openldap/index.html during analyzing the behavior of ldap I came up with the below observation: /etc/pam.d/system.auth file has the following content which suggests that linux authentication is used first and it it fails ldap is used. auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass so if a user is in both /etc/passwd and ldap, linux authentication is used. However, if a user is ONLY in ldap directory, linux authentication fails and ldap is called. Analysing the case that a user is only in the etc/passwd: In this case, there are some activities in the ldap site which I dont understand. If a user is only in etc/passwd and pam.d/system.auth file says call ldap only if linux fails, then why ldap is called when linux authentication is successful? You say this is expected... but if I understood the pam.d/system.auth file correctly, ldap should not be called if a user is only in etc/passwd Thanks, ~Hamid ----- Original Message ---- From: Buchan Milne <bgmilne(a)staff.telkomsa.net> To: openldap-technical(a)openldap.org Cc: Hamidreza Hamedtoolloei <hamedtoolloei(a)yahoo.com> Sent: Sunday, February 24, 2008 11:02:04 PM Subject: Re: using LDAP as central authentication unit On Saturday 23 February 2008 03:09:33 Hamidreza Hamedtoolloei wrote: > Dear Tony, > Thanks for your comment..I played more with my ldap and here is what I > found out.. If a user in in both /etc/passwd and ldap directory with the > same password, linux authentication is used. However, if user etc/passwd is > different than the ldap passwd, depending on what passwd is used during the > login, appropriate authentication is used(i.e both passwords work just > fine) However, here is what I still dont understand: > if a user is only in etc/passwd, after executing su user, it seems that > there are still some activities in the ldap site. This is to be expected. But, since you did not answer my previous question (asking about what you are trying to achieve, not every single question you have on how user information and authentication technologies work), I am not sure how to answer some of your questions. > fir instance when I do su > karan where karan ONLY exists in the etc/passwd, I get the following in > the logfile(/vat/log/local4) > > > Feb 22 14:54:03 gamaalien slapd[7896]: conn=42 fd=20 ACCEPT from > IP=127.0.0.1:33277 (IP=0.0.0.0:389) Feb 22 14:54:03 gamaalien slapd[7896]: > conn=42 op=0 BIND dn="" method=128 Feb 22 14:54:03 gamaalien slapd[7896]: > conn=42 op=0 RESULT tag=97 err=0 text= Feb 22 14:54:03 gamaalien > slapd[7896]: conn=42 op=1 SRCH base="ou=People,dc=ibm,dc=com" scope=2 > deref=0 filter="(&(objectClass=posixAccount)(uidNumber=502))" Feb 22 > 14:54:03 gamaalien slapd[7896]: conn=42 op=1 SRCH attr=uid userPassword > uidNumber gidNumber cn homeDirectory loginShell gecos description > objectClass This is a typical search from nss_ldap, *not* pam_ldap. As such, it has nothing to do with your PAM configuration, but your nss configuration, which I don't believe you have provided. > Feb 22 14:54:03 gamaalien slapd[7896]: <= > bdb_equality_candidates: (uidNumber) not indexed You should tell slapd to index uidNUmber (in slapd.conf), and run slapindex to ensure that the existing entries are indexed. > Feb 22 14:54:03 gamaalien > slapd[7896]: conn=42 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Feb > 22 14:55:04 gamaalien slapd[7896]: conn=43 fd=21 ACCEPT from > IP=127.0.0.1:33278 (IP=0.0.0.0:389) Feb 22 14:55:04 gamaalien slapd[7896]: > conn=42 fd=20 closed (connection lost) Feb 22 14:55:04 gamaalien > slapd[7896]: conn=43 op=0 BIND dn="" method=128 Feb 22 14:55:04 gamaalien > slapd[7896]: conn=43 op=0 RESULT tag=97 err=0 text= Feb 22 14:55:04 > gamaalien slapd[7896]: conn=43 op=1 SRCH base="ou=People,dc=ibm,dc=com" > scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=karan))" Feb 22 > 14:55:04 gamaalien slapd[7896]: <= bdb_equality_candidates: (uid) not > indexed Samething with uid. > Feb 22 14:55:04 gamaalien slapd[7896]: conn=43 op=1 SEARCH RESULT > tag=101 err=0 nentries=0 text= Feb 22 14:55:04 gamaalien slapd[7896]: > conn=43 op=2 SRCH base="ou=People,dc=ibm,dc=com" scope=2 deref=0 > filter="(&(objectClass=posixGroup)(memberUid=karan))" Feb 22 14:55:04 > gamaalien slapd[7896]: conn=43 op=2 SRCH attr=gidNumber Feb 22 14:55:04 > gamaalien slapd[7896]: conn=43 op=2 SEARCH RESULT tag=101 err=0 nentries=0 > text= Feb 22 14:55:04 gamaalien slapd[7896]: conn=43 fd=21 closed > (connection lost) > > do you know whats going on here? if linux authentication is used and karan > is not in the ldap directory then why ldap is called? thanks for your help Let's see your /etc/nsswitch.conf first ... ____________________________________________________________________________________ Looking for last minute shopping deals? Find them fast with Yahoo! Search. http://tools.search.yahoo.com/newsearch/category.php?category=shopping

2 1

REF: Getting Started - LDAP+PDC
by Teddy L. Nyambe 26 Feb '08

26 Feb '08

Hi All, Am new. I have LDAP running on a server and created accounts using OXAdmin tool form Openxchange, now I want to integrate samba as a PDC and I have noticed there are no home directories for users created using the tool. Should I create users in /etc/passwd, I want to use the already existing users in LDAP and have them log in to the domain. How can I setup this please help!? Kind regards Teddy L. ............................................................................ ........... Teddy Lubasi Nyambe Assistant Principal Clerk ICT - Applications National Assembly of Zambia P.O. Box 31299 Lusaka, ZAMBIA Phone: +260 1 292425 Cell: +260 97 7760473 ~/ Human Knowledge belongs to the world! - AntiTrust Man is a tool-using animal. Without tools he is nothing, with tools he is all - Thomas Carlyle 1795-1881 As we enjoy great advantages from inventions of others, we should be glad of an opportunity to serve others by any invention of ours; and this we should do freely and generously. Benjamin Franklin /~

2 1

LDAP replication
by Rui Ramos 25 Feb '08

25 Feb '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello * I'm having troubles setting the following LDAP arquitecture. And desperatly need some advices. The architecture is formed by a master ldap server (CORE) and several slaves (EDGES). They all have a non standard schema that is required for the project we are working on. So one of my questions is: Is it possible to replicate data from CORE to EDGEs machines using slurpd or syncrepl, and still have the abbility to change some atributes in slaves directly ? if not what could be a possible solution for this ? One of this EDGE machine require atribute translation. We manage to set this working with slurpd replogfile. So we can have this: B -> C Where B replicates LDAP data to C slave using slurpd. But when we try to add the Master server to this: A -> B -> C Where A replicates to B with synrepl. replog isn't created for the B -> C replication. So my other questions are: - Can slurpd and syncrepl be used in the same server ? - Can a ldap server be configured as master/slave ? - What would be your sugestions for solving this issue ? Using openldap 2.3.27-8 Best Regards, Rui - -- Rui Ramos ============================================== Universidade do Porto - IRICUP Praça Gomes Teixeira, 4099-002 Porto, Portugal email: rramos[at]reit.up.pt phone: +351 22 040 8164 ============================================== -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.7 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iQEVAwUBR8KHsb1uR0bdnTWSAQKgGwgAku13Z8pmx4H5R0IxqQ7iQ5ptM2y3WQ13 3nEK9awE84hFRGkFcjiXfrq8O9U/WiAbpTjQw/E+hPczK0JccgzawErIfQgcqZsn FhtD3sBInkDHLd5JZYiva3TdZ0phnng+tBd1Otrr+ZeSrWF77UaA/kfj0/tSwOEo 1p1eGrmwheu7c6Gjd18cwN+/ox+phS7nDjHPWS3cew5e4YY/02FtjrXWtUWC5GLv VSA/QAjd9kmXA/Q7ihXkVkyQbBStvcRDXNWR6F8URK3/Sk9rKBsZ4fteTpBzwC/4 lpPf0Q2ctfteMd8sqR1qVdFVikgpxMBHJ/bj3W9X5yimTQiJmrZNqw== =LuwH -----END PGP SIGNATURE-----

2 1

Re: Limit daily query number
by Gavin Henry 25 Feb '08

25 Feb '08

<quote who="cariparo\(a)libero\.it"> > Thanks Gavin, > We have a LDAP service for out customers, under subscription, and we want > to release a light free service for everyone on Internet, by narrowing the > daily queries number. > I'm thinking to create a PHP bridge, so free customers call a php page > instead to connecting directly to LDAP server, and mantain an IP list on > MySQL. Any other idea? Please keep replies on list ;-) Don't store sensitive data, setup the usual security things, DMZ etc. and check out: conn_max_pending conn_max_pending_auth and sizelimit/timelimit make it readonly too. via "man slapd.conf" Cheers.

2 4

question about object classes
by VaraPrasad Yalla 25 Feb '08

25 Feb '08

Hello Ldapusers, In the slapd.conf file I made sure to include /etc/openldap/schema/inetorgperson.schema But when I use the password migration script to convert password map to ldif format I always see that only 'account' comes up as the default object class in the ldif files . Here is an example of what one of the ldif entries looks like : -------------------------------------------- dn: uid=axe,ou=People,dc=example,dc=com uid: axe cn: axe objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {crypt}$1$8EJTU0c0$O2oc9gwyMJZl0hFg7x6Y7. shadowLastChange: 12371 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 500 gidNumber: 500 homeDirectory: /home/axe -------------------------------------------- How do I make sure that inetorgperson comes up as the default object class without having to add it manually . Also is it possible to modify the object class of a record that has already been added to the database ? Please let me know . Thanks .

1 0

Re: using LDAP as central authentication unit
by Hamidreza Hamedtoolloei 24 Feb '08

24 Feb '08

Dear Tony, Thanks for your comment..I played more with my ldap and here is what I found out.. If a user in in both /etc/passwd and ldap directory with the same password, linux authentication is used. However, if user etc/passwd is different than the ldap passwd, depending on what passwd is used during the login, appropriate authentication is used(i.e both passwords work just fine) However, here is what I still dont understand: if a user is only in etc/passwd, after executing su user, it seems that there are still some activities in the ldap site. fir instance when I do su karan where karan ONLY exists in the etc/passwd, I get the following in the logfile(/vat/log/local4) Feb 22 14:54:03 gamaalien slapd[7896]: conn=42 fd=20 ACCEPT from IP=127.0.0.1:33277 (IP=0.0.0.0:389) Feb 22 14:54:03 gamaalien slapd[7896]: conn=42 op=0 BIND dn="" method=128 Feb 22 14:54:03 gamaalien slapd[7896]: conn=42 op=0 RESULT tag=97 err=0 text= Feb 22 14:54:03 gamaalien slapd[7896]: conn=42 op=1 SRCH base="ou=People,dc=ibm,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=502))" Feb 22 14:54:03 gamaalien slapd[7896]: conn=42 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass Feb 22 14:54:03 gamaalien slapd[7896]: <= bdb_equality_candidates: (uidNumber) not indexed Feb 22 14:54:03 gamaalien slapd[7896]: conn=42 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Feb 22 14:55:04 gamaalien slapd[7896]: conn=43 fd=21 ACCEPT from IP=127.0.0.1:33278 (IP=0.0.0.0:389) Feb 22 14:55:04 gamaalien slapd[7896]: conn=42 fd=20 closed (connection lost) Feb 22 14:55:04 gamaalien slapd[7896]: conn=43 op=0 BIND dn="" method=128 Feb 22 14:55:04 gamaalien slapd[7896]: conn=43 op=0 RESULT tag=97 err=0 text= Feb 22 14:55:04 gamaalien slapd[7896]: conn=43 op=1 SRCH base="ou=People,dc=ibm,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=karan))" Feb 22 14:55:04 gamaalien slapd[7896]: <= bdb_equality_candidates: (uid) not indexed Feb 22 14:55:04 gamaalien slapd[7896]: conn=43 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Feb 22 14:55:04 gamaalien slapd[7896]: conn=43 op=2 SRCH base="ou=People,dc=ibm,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup)(memberUid=karan))" Feb 22 14:55:04 gamaalien slapd[7896]: conn=43 op=2 SRCH attr=gidNumber Feb 22 14:55:04 gamaalien slapd[7896]: conn=43 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text= Feb 22 14:55:04 gamaalien slapd[7896]: conn=43 fd=21 closed (connection lost) do you know whats going on here? if linux authentication is used and karan is not in the ldap directory then why ldap is called? thanks for your help ----- Original Message ---- From: Tony Earnshaw <tonni(a)hetnet.nl> To: openldap-technical(a)openldap.org Sent: Friday, February 22, 2008 2:12:36 AM Subject: Re: using LDAP as central authentication unit Hamidreza Hamedtoolloei skrev, on 22-02-2008 09:49: > http://www.linux.com/articles/113567 describes the "sufficient" modifier > as follows: > If a sufficient module succeeds, it is enough to satisfy the > requirements of sufficient modules in that realm for use of the service, > and modules below it that are also listed as 'sufficient' are not invoked. > > given the following /etc/pam.d/system.auth file: > auth required /lib/security/$ISA/pam_env.so > auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok > auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass > auth required /lib/security/$ISA/pam_deny.so > I think LDAP is used ONLY if the unix authentication fails?? right??? am > I missing something??? I don't suppose that, reading the article you quote, you're missing anything, but I've just played around with my test machine's FC6 /etc/pam.d/system-auth and found the following for the auth service: 1: Where a user is in both LDAP and /etc/{passwd,shadow} only the pam_unix.so password counts, even though the position of the pam_unix.so and pam_ldap.so lines is swapped. Changing the LDAP entry's password doesn't make any difference to pam; 2: Where a user is only in LDAP the pam_unix.so auth entry is ignored, whatever its position; 3: Commenting out the pam_unix.so line results in all login attempts by everyone to be invalid. So not even root can log in any longer. So I'd say that the stuff is far more complicated than the author states. Perhaps people are thinking about the nsswitch.conf entries. However, a recent thread in the pam_ldap mailing list hinted that things might be different for systems on which Padl's CNS pam_ldap library is installed, rather than Red Hat's version - as on my machines. To avoid completely "missing something" I suggest you try it out for yourself ;) Best, --Tonni -- Tony Earnshaw Email: tonni at hetnet dot nl ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

4 3

Limit daily query number
by cariparo＠libero.it 24 Feb '08

24 Feb '08

Hi All, I have a OpenLDAP implementation with anonymous read access enabled, so I want to limit the numbers of the query that each computer (IP) can perform on a specified time windows. For example: allow each IP to perform max 300 queries per day. I have a huge amount of users, and a database of abt 1M objects. Can anyone give me a suggestion, i can't find any specific setting. Thanks Carip

2 2

extend remote server with local (subordinate) entries
by Oren Laadan 24 Feb '08

24 Feb '08

Hi, I use the configuration below to extend a given remote LDAP database with a relatively small number of local records. Specifically, the local database adds new (posix) groups and new autofs maps, adding to the ones already given by the remote server. (see the original thread at: http://www.openldap.org/lists/openldap-software/200802/msg00128.html) > ... > moduleload back_ldap > moduleload back_bdb > ... > backend bdb > backend ldap > ... > # bdb backend, configured as a subordinate of the main server > database bdb > suffix "dc=SUB,dc=EXAMPLE,dc=COM" > readonly on > subordinate > ... > # ldap backend, with the right DN base > database ldap > lastmod off > suffix "dc=EXAMPLE,dc=COM" > uri "ldaps://REMOTE_SERVER/" > ... > The extension of groups works like charm, without any modification to the clients' setup (/etc/ldap/ldap.conf). However, the additional maps aren't observed by the autofs-ldap method and are therefore not working for users. Running on Debian (unstable), autofs-ldap-auto-master gives: /home ldap:ou=auto.home,ou=AutoFS,dc=EXANPLE,dc=COM /proj ldap:ou=auto.proj,ou=AutoFS,dc=EXAMPLE,dc=COM A remote LDAP entry for /proj looks like: dn: cn=blast,ou=auto.proj,ou=AutoFS,dc=EXAMPLE,dc=COM objectClass: automount cn: blast automountInformation: -rw blast:/export/blast A local (added to the subtree SUB) entry for /proj looks like: dn: cn=extra,ou=auto.proj,ou=AutoFS,dc=SUB,dc=EXAMPLE,dc=COM objectClass: automount cn: extra automountInformation: -rw extra:/export/extra Problem is, that autofs only "sees" entries of the first type; if I run automount manually (prepending "dc=SUB," to the default way it is otherwise invoked): /usr/sbin/automount --pid-file=/var/run/autofs/_proj.pid --timeout=300 /proj ldap ou=auto.proj,ou=AutoFS,dc=SUB,dc=EXAMPLE,dc=COM then I can make it see the second type, but then it ignores the first type. Note that the same technique works for adding more groups. So I suspect the problem is that somehow autofs does not consider subtrees as valid results for its query to ldap. Any ideas how to fix this ? (or perhaps suggestion how to arrange the entire setup differently and still have the same end result). Thanks, Oren.

2 3

Re: using LDAP as central authentication unit
by Hamidreza Hamedtoolloei 22 Feb '08

22 Feb '08

Dear Tony, Thanks for your prompt response.. http://www.linux.com/articles/113567 describes the "sufficient" modifier as follows: If a sufficient module succeeds, it is enough to satisfy the requirements of sufficient modules in that realm for use of the service, and modules below it that are also listed as 'sufficient' are not invoked. given the following /etc/pam.d/system.auth file: auth required /lib/security/$ISA/pam_env.so auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass auth required /lib/security/$ISA/pam_deny.so I think LDAP is used ONLY if the unix authentication fails?? right??? am I missing something??? ----- Original Message ---- From: Tony Earnshaw <tonni(a)hetnet.nl> To: openldap-technical(a)openldap.org Sent: Thursday, February 21, 2008 9:58:57 PM Subject: Re: using LDAP as central authentication unit Hamidreza Hamedtoolloei skrev, on 22-02-2008 03:21: > I've followed one of the online instructions on how to configure my > system to use ldap as the user authentication mechanism. below is > partial content of my /etc/pam.d/system.auth file: > #%PAM-1.0 > # This file is auto-generated. > # User changes will be destroyed the next time authconfig is run. > auth required /lib/security/$ISA/pam_env.so > auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok > auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass > auth required /lib/security/$ISA/pam_deny.so > > looking at some online resources about how pam works, it seems that unix > authentication is being applied first, and only if it fails, ldap > authentication is applied. Am I correct here? In other words if all the > users are still in /etc/shadow and /etc/passd files.... ldap is NOT > being used for authentication. If I delete the users from /etc/passwd... > then LDAP is used.... right>? No, all the modules will be used, but the way they are treated depends on the modifiers {sufficient,required,requisite} and {use_first_pass,try_first_pass,null} (unless you're using Solaris >= 10 where they've been obsoleted). Best, --Tonni -- Tony Earnshaw Email: tonni at hetnet dot nl ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

3 2

OpenLdap unstable on RHEL5 & Centos5 with db4
by Rohit B 22 Feb '08

22 Feb '08

Hello List members I am running Openldap and db4 [root@build ~]# slapd -V @(#) $OpenLDAP: slapd 2.3.27 (Mar 14 2007 17:44:50) $ mockbuild@builder4.centos.org:/builddir/build/BUILD/openldap-2.3.27/openldap-2.3.27/build-servers/servers/slapd DB4 vcersion db4-4.3.29-9 We have a address book containing around 500 to 2000 addresses stored in it. Every thing works fine for some days and then it crashes. I see nothing in the logs. We are using a custom schema attached with this email. Before we upgraded from the default openldap in centos4.4 to Centos5.0 it was working perfectly, is there any compatibility issues with the schema & the new package. -- Regards, Rohit Baisakhiya attributetype ( 2.5.4.7.1 NAME ( 'location' 'subdomain' ) SUP name ) attributetype ( 2.5.4.7.2 NAME ( 'proxyflag' ) SUP name ) attributetype ( 2.5.4.7.3 NAME ( 'mailflag' ) SUP name ) attributetype ( 2.5.4.7.4 NAME ( 'incomingflag' ) SUP name ) attributetype ( 2.5.4.7.5 NAME ( 'outgoingflag' ) SUP name ) attributetype ( 2.5.4.7.6 NAME ( 'inmailsize' ) SUP name ) attributetype ( 2.5.4.7.7 NAME ( 'outmailsize' ) SUP name ) attributetype ( 2.5.4.7.8 NAME ( 'mailquota' ) SUP name ) attributetype ( 2.5.4.7.9 NAME ( 'globalquota' ) SUP name ) attributetype ( 2.5.4.7.10 NAME ( 'memOfGroup' ) SUP name ) attributetype ( 2.5.4.7.11 NAME ( 'autoDeleteMail' ) SUP name ) #attributetype ( 2.5.4.7.11 NAME ( 'mailsOlderThan' ) SUP name ) #attributetype ( 2.5.4.7.12 NAME ('lastModifiedTime') SUP name) #attributetype( 0.9.2342.19200300.100.1.23 NAME ('lastModifiedTime') SUP name) #attributetype ( 2.5.4.7.10 NAME 'member' SUP distinguishedName ) #attributetype ( 2.5.4.7.11 NAME 'owner' SUP distinguishedName ) #attributetype ( 2.5.4.7.12 NAME 'seeAlso' SUP distinguishedName ) #attributetype ( 2.5.4.7.13 NAME ( 'ou' 'organizationalUnitName' ) SUP name ) #attributetype ( 2.5.4.7.14 NAME ( 'o' 'organizationName' ) SUP name ) #attributetype ( 2.5.4.7.15 NAME 'description' # EQUALITY caseIgnoreMatch # SUBSTR caseIgnoreSubstringsMatch # SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} ) #attributetype ( 2.5.4.7.16 NAME 'businessCategory' # EQUALITY caseIgnoreMatch # SUBSTR caseIgnoreSubstringsMatch # SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) # # Netcore User objectclass # objectclass ( 1.3.6.1.4.1.4203.1.4.1.1 NAME ( 'Netcore' 'Netserv' ) DESC 'Netcore Netserv Ldap' SUP ( posixAccount $ inetLocalMailRecipient $ inetOrgPerson ) MAY ( location $ proxyflag $ mailflag $ incomingflag $ outgoingflag $ inmailsize $ outmailsize $ mailquota $ globalquota $ acctFlags $ description $ homeDrive $ kickoffTime $ lmPassword $ logoffTime $ logonTime $ ntPassword $ primaryGroupID $ profilePath $ pwdCanChange $ pwdLastSet $ pwdMustChange $ scriptPath $ smbHome $ rid $ ou $ memOfGroup $ autoDeleteMail $ calFBURL ) ) #attributetype (2.16.840.1.113730.3.1.13 #Conflicting hence changed this attributetype (2.16.840.1.113730.3.1.14 NAME 'mailAlternateAddress' DESC 'alternate RFC822 email addresses used to reach this person' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype (2.16.840.1.113730.3.1.23 NAME 'mgrpAllowedDomain' DESC 'allowed domains for sender of mail to group' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype (2.16.840.1.113730.3.1.25 NAME 'mgrpDeliverTo' DESC 'LDAP Search URL to describe group membership' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 EQUALITY caseExactIA5Match ) attributetype (2.16.840.1.113730.3.1.26 NAME 'mgrpErrorsTo' DESC 'person or group to receive error messages for this group' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype (2.16.840.1.113730.3.1.28 NAME 'mgrpRejectAction' DESC 'The action to be taken for a rejected message to the group' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype (2.16.840.1.113730.3.1.29 NAME 'mgrpRejectText' DESC 'Text to be returned with a rejected message' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype (2.16.840.1.113730.3.1.30 NAME 'mgrpRFC822MailMember' DESC 'RFC822 mail address of email only member of group' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) # # Netcore Group objectclass # ###### object class modified Manoj for version 2.1 of openldap ####### objectclass (2.16.840.1.113730.3.2.4 NAME 'mailGroup' SUP top STRUCTURAL MUST ( uid $ mail $ cn ) MAY ( mailAlternateAddress $ mailHost $ mgrpAllowedDomain $ mgrpDeliverTo $ mgrpRejectAction $ mgrpErrorsTo $ mgrpRFC822MailMember $ mgrpRejectText $ businessCategory $ seeAlso $ owner $ ou $ o $ description $ uniqueMember $ mailquota) )

3 6

me
by Aravind Arjunan 21 Feb '08

21 Feb '08

I had configured ldap in server-client I had created the ldif file also and added that file to the ldap database. It was working fine yesterday,but when i started the machine today and when i restarted the ldap service the stopping ldap is always coming failed. When starting ldap is always coming start,when i check by *service ldap status* it is showing slapd is stopped. [root@testnode ~]# service ldap restart Stopping slapd: [*FAILED*] Checking configuration files for slapd: config file testing succeeded Starting slapd: [ *OK * ] [root@testnode ~]# service ldap restart Stopping slapd: [*FAILED*] Checking configuration files for slapd: config file testing succeeded Starting slapd: [ *OK * ] [root@testnode ~]# service ldap restart Stopping slapd: [*FAILED*] Checking configuration files for slapd: config file testing succeeded Starting slapd: [ *OK *] [*root@testnode ~]# service ldap status slapd is stopped [root@testnode ~]# *

1 0

using LDAP as central authentication unit
by Hamidreza Hamedtoolloei 21 Feb '08

21 Feb '08

Hello, I've followed one of the online instructions on how to configure my system to use ldap as the user authentication mechanism. below is partial content of my /etc/pam.d/system.auth file: #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required /lib/security/$ISA/pam_env.so auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass auth required /lib/security/$ISA/pam_deny.so looking at some online resources about how pam works, it seems that unix authentication is being applied first, and only if it fails, ldap authentication is applied. Am I correct here? In other words if all the users are still in /etc/shadow and /etc/passd files.... ldap is NOT being used for authentication. If I delete the users from /etc/passwd... then LDAP is used.... right>? thx, ~Hamid ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 2

query regarding user names and passwords
by anish patil 21 Feb '08

21 Feb '08

Hi All, I want to add usr names which are not in ASCII characters using ldapadd command . I tried it on RHEL 4.4 , it giving me following error <error> adding new entry "uid=ああああ,ou=People,dc=avaya,dc=com" ldap_add: Invalid DN syntax (34) additional info: invalid DN </error> Systems locale set:-*LANG=ja_JP.SJIS* i googled it i found this http://www.openldap.org/lists/openldap-software/200308/msg00570.html But this post is in 2003 So i wanted to know is it LDAP's limitation ? Thanks in advance -- Anish Patil

3 5

Red Hat RPMs?
by Gavin Henry 21 Feb '08

21 Feb '08

BTW, has anyone over the history of the "well-known" broken Red Hat RPMs raised bug reports etc. and had any response? I'm not sure what effort has been put into this and whether it's worth picking it up again? As most users first experience of OpenLDAP is via the RH and Fedora RPMs, I think some effort (if it's not a waste of time again) should be put into trying to raise our concerns, as it harms the project in the long run. Currently we have SuSE, Mandriva and Debian guys on the lists who care (you all know who you are ;-) ). Anyone from Red Hat or Fedora here? Thanks. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

5 6

TLS/SSL Handshake Error
by Mathis, Jim 21 Feb '08

21 Feb '08

Hello, After creating a self-signed certificate as per the, OpenLDAP Admin Guide, TLS/SSL was enabled. The CN used when creating the certificates was the hostname of the LDAP server - "node01". However, when conducting further TLS/SSL tests there appears to be a handshaking error between the client and server. Additionally, when checking the Server certificates using the " openssl s_client -connect :636 -state -CAfile /var/certs/cacert.pem -cert /var/certs/servercrt.pem -key /var/certs/serverkey.pem" command it indicates that the client private certificate key can't be loaded and expecting a start line (see below). Appreciate any additional info. Config data as follows: CLIENT CONFIG DATA /etc/ldap.conf host node01 base dc=S80,dc=com uri ldaps://node01/ ldap_version 3 port 636 timelimit 120 bind_timelimit 120 bind_policy soft idle_timelimit 3600 ssl on tls_checkpeer yes tls_cacertfile /etc/openldap/cacerts/cacert.pem tls_cacertdir /etc/openldap/cacerts tls_reqcert never tls_ciphers TLSv1 pam_password md5 /etc/openldap/ldap.conf URI ldaps://node01:636 HOST node01 BASE dc=S80,dc=com TLS_CACERT /etc/openldap/cacerts/cacert.pem TLS_CACERTDIR /etc/openldap/cacerts TLS_REQCERT never /etc/openldap/cacerts/cacert.pem Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: sha1WithRSAEncryption Issuer: C=US, ST=Virginia, O=XXX, OU=S80, CN=node01/emailAddress=XXX Validity Not Before: Feb 21 15:10:48 2008 GMT Not After : Feb 20 15:10:48 2011 GMT Subject: C=US, ST=Virginia, O=XXX, OU=S80, CN=node01/emailAddress=XXX Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:da:b9:b0:ba:ca:95:f1:fc:48:6e:e9:d5:5d:d5: 22:aa:9e:38:19:7d:0c:14:65:44:fa:12:69:f6:98: 6a:38:43:11:29:20:a8:a2:98:a9:00:ce:40:19:e5: 56:46:1b:85:d6:99:91:5f:7b:a9:19:ac:7b:7c:cc: 42:13:88:99:99:af:98:52:9b:a4:60:77:ca:e7:ae: 41:97:c0:8c:5e:f9:a1:44:c0:6b:29:ec:3f:9b:1e: 59:dc:05:f5:b8:a8:ed:71:7c:db:51:26:1f:59:ee: 04:fc:b0:24:77:64:2e:be:df:a7:1a:91:34:81:f4: a6:d6:b9:26:64:63:2f:19:95 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: C1:AA:5F:32:3D:7F:80:FA:4A:A1:A2:24:BC:66:AB:CE:C3:5A:A8:E0 X509v3 Authority Key Identifier: keyid:C1:AA:5F:32:3D:7F:80:FA:4A:A1:A2:24:BC:66:AB:CE:C3:5A:A8:E0 Signature Algorithm: sha1WithRSAEncryption 37:84:43:62:ed:98:c3:31:85:24:3e:8d:d8:88:9f:4d:8f:00: dc:08:21:ee:9d:19:07:21:c0:70:cf:b1:38:94:49:34:de:42: 93:5e:51:79:95:6b:d6:2d:7f:92:f7:da:49:d0:92:65:81:8f: ed:0e:24:0a:0d:17:cd:73:fe:c2:86:9c:40:22:04:af:7b:d6: 1e:ba:2c:5a:f4:d8:52:ab:8f:94:45:ae:bc:11:07:06:0d:da: 11:6f:f5:1a:63:ae:05:0a:64:32:b1:f0:5c:eb:21:6b:d1:ff: bb:0a:42:a9:a9:23:f3:ab:d4:9f:b4:26:4e:d4:ea:7b:0a:26: df:a4 -----BEGIN CERTIFICATE----- .....XXX -----END CERTIFICATE----- SERVER CONFIG DATA Server IP: 192.168.10.1 Hostname: node01 Suffix: dc=S80,dc=com Certificate Common Name (CN): node01 /etc/openldap/slapd.conf TLSCACertificateFile /var/certs/cacert.pem TLSCertificateFile /var/certs/servercrt.pem TLSCertificateKeyFile /var/certs/serverkey.pem database ldbm suffix "dc=S80,dc=com" SERVER KEY (serverkey.pem) -----BEGIN CERTIFICATE REQUEST----- ...XXX -----END CERTIFICATE REQUEST----- ERRORS OBSERVED (SERVER) [root@node01 certs]# openssl s_client -connect :636 -state -CAfile /var/certs/cacert.pem -cert /var/certs/servercrt.pem -key /var/certs/serverkey.pem unable to load client certificate private key file 8086:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:644:Expecting: ANY PRIVATE KEY [root@node01 certs]# ldapsearch -d127 -x -H ldaps://node01 uid=uid ldap_create ldap_url_parse_ext(ldaps://node01) ldap_bind ldap_simple_bind ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP node01:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 192.168.10.1:636 ldap_connect_timeout: fd: 3 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization tls_write: want=133, written=133 0000: 80 83 01 03 01 00 5a 00 00 00 20 00 00 39 00 00 ......Z... ..9.. 0010: 38 00 00 35 00 00 16 00 00 13 00 00 0a 07 00 c0 8..5............ 0020: 00 00 33 00 00 32 00 00 2f 03 00 80 00 00 66 00 ..3..2../.....f. 0030: 00 05 00 00 04 01 00 80 00 00 63 00 00 62 00 00 ..........c..b.. 0040: 15 00 00 12 00 00 09 06 00 40 00 00 65 00 00 64 .........@..e..d 0050: 00 00 14 00 00 11 00 00 08 00 00 06 04 00 80 00 ................ 0060: 00 03 02 00 80 28 9b 68 41 39 df 12 52 12 ab 41 .....(.hA9..R..A 0070: 20 11 b0 b9 d0 76 3d 5c 2d f6 3a 00 49 28 07 d4 ....v=\-.:.I(.. 0080: 67 8d 26 70 fb g.&p. TLS trace: SSL_connect:SSLv2/v3 write client hello A tls_read: want=7, got=7 0000: 15 03 01 00 02 02 28 ......( TLS trace: SSL3 alert read:fatal:handshake failure TLS trace: SSL_connect:error in SSLv2/v3 read server hello A TLS: can't connect. ldap_perror ldap_bind: Can't contact LDAP server (-1) additional info: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure ERRORS OBSERVED (CLIENT) [root@node03 ~]# openssl s_client -connect node01:636 -showcerts -state -CAfile /etc/openldap/cacerts/cacert.pem CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv2/v3 write client hello A SSL3 alert read:fatal:handshake failure SSL_connect:error in SSLv2/v3 read server hello A 3531:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:s23_clnt.c:562: [root@node03 ~]# ldapsearch -d127 -x -H ldaps://node01 uid=uid ldap_create ldap_url_parse_ext(ldaps://node01) ldap_bind ldap_simple_bind ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP node01:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 192.168.10.1:636 ldap_connect_timeout: fd: 3 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization tls_write: want=133, written=133 0000: 80 83 01 03 01 00 5a 00 00 00 20 00 00 39 00 00 ......Z... ..9.. 0010: 38 00 00 35 00 00 16 00 00 13 00 00 0a 07 00 c0 8..5............ 0020: 00 00 33 00 00 32 00 00 2f 03 00 80 00 00 66 00 ..3..2../.....f. 0030: 00 05 00 00 04 01 00 80 00 00 63 00 00 62 00 00 ..........c..b.. 0040: 15 00 00 12 00 00 09 06 00 40 00 00 65 00 00 64 .........@..e..d 0050: 00 00 14 00 00 11 00 00 08 00 00 06 04 00 80 00 ................ 0060: 00 03 02 00 80 51 97 63 fc ee 43 25 a8 d2 e4 8c .....Q.c..C%.... 0070: ef 63 6e e0 97 b7 cd c2 1e 14 97 c9 50 5d 82 6b .cn.........P].k 0080: 3f f5 d0 6f a4 ?..o. TLS trace: SSL_connect:SSLv2/v3 write client hello A tls_read: want=7, got=7 0000: 15 03 01 00 02 02 28 ......( TLS trace: SSL3 alert read:fatal:handshake failure TLS trace: SSL_connect:error in SSLv2/v3 read server hello A TLS: can't connect. ldap_perror ldap_bind: Can't contact LDAP server (-1) additional info: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

1 0

RE: LDAP Writes are not propagated to mirror nodes.
by Quanah Gibson-Mount 21 Feb '08

21 Feb '08

--On Thursday, February 21, 2008 2:56 PM +0800 "K C, Sachin (Sachin)" <sachinkc(a)alcatel-lucent.com> wrote: > > Quanah, > > I have compiled the source on solaris 10. OpenLDAP release I > used is 2.4.7 Keep all replies on the list. Sending a reply to the list and then sending a further reply to me is only going to help ensure you end up on my blacklist, and it definitely won't get you a quicker response. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: Ppolicy issues
by Bryan Payne 21 Feb '08

21 Feb '08

Thank you for your help. I added the pwdPolicySubentry to a user to no avail. I did find this in the logfile though: Feb 20 09:01:13 ldapserver slapd[6709]: conn=95289 op=4 SEARCH RESULT tag=101 err=50 nentries=0 text=Operations are restricted to bind/unbind/abandon/StartTLS/modify password So it looks like it's trying to do something but cannot. While I'm concerned about password strength, I'm more concerned (at this point) with just having the machine prompt for a password change. I'm running centos 4.6 and openldap 2.3.39. I compiled it with the following: ./configure --enable-crypt --enable-ppolicy --with-tls --prefix=/opt/openldap/ Once again, thanks for any help. Bryan Payne skrev, on 19-02-2008 22:27: I have some issues with ppolicy. It seems it recognizes expiration dates (I know this from looking in the logs, but it does not warn the user their password is expiring soon), properly locks out accounts with too many failed logins but it cannot seem to force a password change when pwdReset is set to TRUE, nor does it prevent logins when the password has expired. Any help would be greatly appreciated. I'll post the things of importance below. Please let me know if anything else would help. [root@ldapserver ~]# ldapsearch -x -LLL cn=default dn: cn=default,ou=policies,dc=example,dc=com objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: 2.5.4.35 pwdInHistory: 6 pwdCheckQuality: 1 pwdMinLength: 8 pwdMaxFailure: 4 pwdLockout: TRUE pwdFailureCountInterval: 0 pwdMustChange: TRUE pwdSafeModify: FALSE pwdLockoutDuration: 900 pwdExpireWarning: 432000 pwdGraceAuthNLimit: 1 pwdAllowUserChange: TRUE pwdMaxAge: 7776000 From slapd.conf overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=example,dc=com" ppolicy_use_lockout Most of the above looks kosher; my main site is running ppolicy on OpenLDAP 2.3.33 up to 2.3.39 Buchan rpms on Red Hat RHEL5 and all the above work. However: 1: I've found that each posixAccount has to have the operational attribute pwdPolicySubentry. Although this is an operational attribute, it is (the only?) such that is user modifiable. In this (as in many other) respects gq is indispensable as GUI. 2: I've found that extensive use has to be made of pam_ldap to get the best out of ppolicy (for example password strength). 3: It would help if you detailed OS and OL versions, so's one could know whether to contribute help or not. Bets, --Tonni -- Tony Earnshaw Email: tonni at hetnet dot nl

4 6

Re: TLS LDAP Configuration w/Linux 5.0
by Buchan Milne 21 Feb '08

21 Feb '08

Please keep replies on-list. On Thursday 21 February 2008 17:00:11 Mathis, Jim wrote: > Buchan, > > Thanks for the info. I want to ensure when I create the certificates > that I'm doing it correctly. As follows: > > LDAP Server IP: 192.168.10.1 > Host name: node01 > suffix: dc=S80,dc=com > > Do I create a Certificate Common Name using "node01.S80.com" or "node01" You use the name that you are going to use to connect to the host with. The real fqdn does not matter .... So, if you are going to use: URI ldaps://www.microsoft.com then create a cert for www.microsoft.com (of course, you should ensure that the name you use resolves to the IP) Regard,s Buchan

1 0

ldapadd of LDIF files with attribute 'apple-generateduid' not allowed
by Alexander Hartner 21 Feb '08

21 Feb '08

I am trying to import a simple LDIF file into OpenDirectory on OS X 10.5.2 Leopard Server. However when I issue the following ldapadd command I get an error : ldapadd -D [rootdn] -x -w [secretPassword] -f Import.ldif Error : 65 Object class violation" attribute 'apple-generateduid' not allowed I would have thought that I had specified apple-generateduid, but I didn't. This is my import file -----------BEGIN----------- # Alexander Hartner dn: cn=Alexander Hartner2,cn=people,dc=macbook-znet,dc=local objectClass: top objectClass: person objectClass: inetOrgPerson displayName: Alexander Hartner2 cn: Alexander Hartner2 givenName: Alexander sn: Hartner mail: alex(a)j2anywhere.com initials: A o: j2anywhere.com -----------END----------- I know this might not be the best forum for OS X support, but I am a bit stuck on this. Thanks in advance. Alex

1 0

TLS LDAP Configuration w/Linux 5.0
by Mathis, Jim 20 Feb '08

20 Feb '08

Hello, Info as follows: OS: RH Enterprise Server 5.1 Server Certificates: Created using a Common Name of "S80.com" Client Certificate: Copied "cacert.pem" from the server and placed into "/etc/openldap/cacerts/" Problem: When configuring TLS to work with LDAP I'm no longer able to login from a client via LDAP. LDAP works normal when TLS is not configured. Suspect possible configuration problem. I'd appreciate any additional information. Thanks. CLIENT /ETC/LDAP.CONF # The distinguished name of the search base. base dc=S80,dc=com timelimit 120 bind_timelimit 120 idle_timelimit 3600 # Just assume that there are no supplemental groups for these named users nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman bind_policy soft uri ldaps://192.168.10.1/ ssl start_tls TLS_CACERT /etc/openldap/cacerts/cacert.pem pam_password md5 CLIENT /ETC/OPENLDAP/LDAP.CONF URI ldaps://192.168.10.1/ BASE dc=S80,dc=com TLS_CACERT /etc/openldap/cacerts/cacert.pem SERVER /ETC/OPENLDAP/SLAPD.CONF TLSCACertificateFile /var/certs/cacert.pem TLSCertificateFile /var/certs/servercrt.pem TLSCertificateKeyFile /var/certs/serverkey.pem database ldbm suffix "dc=S80,dc=com" rootdn "cn=Administrator,dc=S80,dc=com" USED THE FOLLOWING COMMANDS (Did not observe ldaps port 636 being opened. Not sure if it's necessary due to start_tls on port 389) slapd -h "ldap:/// ldaps:///" nmap 192.168.10.1 PORT STATE SERVICE 22/tcp open ssh 111/tcp open rpcbind 389/tcp open ldap 617/tcp open sco-dtmgr 650/tcp open unknown 722/tcp open unknown 2049/tcp open nfs AMPLIFYING DATA No errors occur using "ldapsearch -x 'uid=jmathis' -H ldap://192.168.10.1" Errors observed using: ldapsearch -x 'uid=jmathis' -H ldaps://192.168.10.1 ldap_bind: Can't contact LDAP server (-1) ldapsearch -x -b 'dc=S80,dc=com' -ZZ ldap_start_tls: Can't contact LDAP server (-1)

3 2

Re: ldapsearch for accont object class
by Hamidreza Hamedtoolloei 20 Feb '08

20 Feb '08

Dear Dieter , Thanks for your response. I am using LDAP as a centrtal authentication unit, and migrated all the linux accounts to ldap via some migration tools. currently authentication for linux users work fine i.e. "su sriram then inputing the password" doesnt complain, but when I want to bind to ldap using a user DN (ex ldapsearch "uid=sriram,ou=People,dc=ibm,dc=com" -W -x) I get the Invalid credentials (49) error. I added password-hash {CRYPR} to my slapd.config file, however, it prevented the server from running. the other entry, "cn=fratbrother,ou=People,dc=ibm,dc=com", I added manually. Although the hashing method is SSHA, when I add password-hash {MD5} to my slapd.config, I still can successfully bind. I dont know why this is happening... since the password-hash method has changed, I expect to get the Invalid credentials error... any ideas? ----- Original Message ---- From: Dieter Kluenter <dieter(a)dkluenter.de> To: openldap-technical(a)openldap.org Sent: Tuesday, February 19, 2008 11:33:05 PM Subject: Re: ldapsearch for accont object class Hamidreza Hamedtoolloei <hamedtoolloei(a)yahoo.com> writes: > Dear all, > Below is the "partial" content of my openldap db. > when I do: > ldapsearch -D "cn=fratbrother,ou=People,dc=ibm,dc=com" -w password -x > everything is fine. However, when I do > ldapsearch -D "uid=sriram,ou=People,dc=ibm,dc=com" -w password -x > I get the ldap_bind: Invalid credentials (49) error. > is this related to the "account" object class? > it seems that none of the openLdap tools such as ldapsearch,ldappasswd works > for "account" object class.. is the syntax different for this type of class? > p.s. in my slapd.config for ACL I have > access to * > by * read Your problem seem to be different password hashing methods > # sriram, People, ibm.com > dn: uid=sriram,ou=People,dc=ibm,dc=com > userPassword:: e2NyeXB0fSQxJC82bGVIazhGJEY3bHpuS1d2bi5UWmQuZ2o1TUhqLy4= this is a crypt hashed passwword > dn: cn=fratbrother,ou=People,dc=ibm,dc=com > userPassword:: e1NTSEF9aXVxUkw1MlAvaS9XUkRkNHhuN0lEbUl3VnhhekRzV2s= this is a ssha hashed password. -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6 ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 1

Another question concerning the dynlist overlay
by Gerd Schering 20 Feb '08

20 Feb '08

Hi, I my slapd.conf i added th following line: dynlist-attrset myAccount myAccountOwnerURL myAccount is a propriatary, auxliliary objectclass. SlapD says: AttributeDescription "myAccountOwnerURL" must be a subtype of "labeledURI". I really don't now how to arrange this. Trying attributetype ( labeledURI:1 NAME 'myAccountOwnerURL' ... ) gives: OID could not be expanded: "labeledURI:1" even the dyngroup.schema wsa loaded prior to the schema containing the "myAccountOwnerURL" Attribute. Any hint how to proceed? Gerd -- ------------------------------------------------------ -- Gerd Schering, Email: Schering(a)tubit.TU-Berlin.DE -- -- TU Berlin, Zentraleinrichtung Rechenzentrum -- -- Sekr. E-N 50, Einsteinufer 17, 10587 Berlin -- -- phone: +49 30 314 24383, fax: +49 30 314 21060 -- ------------------------------------------------------

2 2

ldapsearch for accont object class
by Hamidreza Hamedtoolloei 20 Feb '08

20 Feb '08

Dear all, Below is the "partial" content of my openldap db. when I do: ldapsearch -D "cn=fratbrother,ou=People,dc=ibm,dc=com" -w password -x everything is fine. However, when I do ldapsearch -D "uid=sriram,ou=People,dc=ibm,dc=com" -w password -x I get the ldap_bind: Invalid credentials (49) error. is this related to the "account" object class? it seems that none of the openLdap tools such as ldapsearch,ldappasswd works for "account" object class.. is the syntax different for this type of class? p.s. in my slapd.config for ACL I have access to * by * read # sriram, People, ibm.com dn: uid=sriram,ou=People,dc=ibm,dc=com uid: sriram cn: Sriram Krishnan objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword:: e2NyeXB0fSQxJC82bGVIazhGJEY3bHpuS1d2bi5UWmQuZ2o1TUhqLy4= shadowLastChange: 13923 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 503 gidNumber: 503 homeDirectory: /export/home/sriram gecos: Sriram Krishnan,SDSC,8585555555,8586666666 # fratbrother, People, ibm.com dn: cn=fratbrother,ou=People,dc=ibm,dc=com cn: fratbrother sn: fratbrother objectClass: top objectClass: person userPassword:: e1NTSEF9aXVxUkw1MlAvaS9XUkRkNHhuN0lEbUl3VnhhekRzV2s= ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

3 2

Ppolicy issues
by Bryan Payne 19 Feb '08

19 Feb '08

I have some issues with ppolicy. It seems it recognizes expiration dates (I know this from looking in the logs, but it does not warn the user their password is expiring soon), properly locks out accounts with too many failed logins but it cannot seem to force a password change when pwdReset is set to TRUE, nor does it prevent logins when the password has expired. Any help would be greatly appreciated. I'll post the things of importance below. Please let me know if anything else would help. [root@ldapserver ~]# ldapsearch -x -LLL cn=default dn: cn=default,ou=policies,dc=example,dc=com objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: 2.5.4.35 pwdInHistory: 6 pwdCheckQuality: 1 pwdMinLength: 8 pwdMaxFailure: 4 pwdLockout: TRUE pwdFailureCountInterval: 0 pwdMustChange: TRUE pwdSafeModify: FALSE pwdLockoutDuration: 900 pwdExpireWarning: 432000 pwdGraceAuthNLimit: 1 pwdAllowUserChange: TRUE pwdMaxAge: 7776000 From slapd.conf overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=example,dc=com" ppolicy_use_lockout

2 1

Password change synchronization
by punith punith 19 Feb '08

19 Feb '08

Hi everybody.. Warm greetings to you all. I am doing authentication using OpenLDAP and I think it is best place to ask my problem. What I require is, I have to run a shell script when the user changes password. ie Suppose that a user is changed his OpenLDAP pasword, I want to trigger a shell script which updates oracle login password. Is it possible with Openldap? If so, how and where to keep the shell script? All queris and reply are welcome.

3 3

LDAP in Master-Slave
by Aravind Arjunan 19 Feb '08

19 Feb '08

am trying to configuring openldap2.2 in syncrepl method in master-slave. I have two linux machines,i configured for master and slave. I think i had done the configurations correct,bcos after restarting the consumer, my database from provider were copied to consumer automatically. But when i check the consumer by using ldapsearch command,it is returning no such object. in replogfile also there was no content.Tell me how to check that my slave ldap was working and how to check that wheather it has been replicated. After configuring my slave i had added some more in entries in master to check wheather it has been replicated to slave.But i cant able to found through ldapsearch command. The command which i had issued is [root@slave ~]# ldapsearch -x -b 'dc=example,dc=com' \ > '(objectclass=*)' # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope sub # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1

2 1

Fwd: LDAP
by Aravind Arjunan 19 Feb '08

19 Feb '08

---------- Forwarded message ---------- From: Aravind Arjunan <aravind.arjunan(a)gmail.com> Date: 19 Feb 2008 18:31 Subject: Re: LDAP To: Buchan Milne <bgmilne(a)staff.telkomsa.net> When i try to add root.ldif file am getting this error Already exixts(68) If suppose i had edited the root.file or any other ldif file which are already added to the database,at that time also will i get the same error. Just say me how to add the edited ldif file in the database. [root@server openldap]# ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f /etc/openldap/root.ldif Enter LDAP Password: adding new entry "ou=People,cn=Manager,dc=example,dc=com" ldap_add: Already exists (68) [root@server openldap]#

1 0

Re: LDAP
by Aravind Arjunan 18 Feb '08

18 Feb '08

I had already added the domain dc=example,dc=com But when i try to add the ldapuser.ldif am getting no such object error. Here when i try to add example.com.ldif it shows Already exists(68) if suppose if i make some changes in the example.com.ldif is it possible for me to add agian or at that time also it will display Already exists(68) error. tell me how to add the edited ldif file. [root@server ~]# ldapadd -x -D "cn=Manager,dc=example,dc=com" \ > -W -f /etc/openldap/example.com.ldif Enter LDAP Password: adding new entry "dc=example,dc=com" ldap_add: Already exists (68) [root@server ~]# ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f /etc/openldap/ldapusers.ldif Enter LDAP Password: adding new entry "uid=ldapuser,ou=People,cn=Manager,dc=example,dc=com" ldap_add: No such object (32) matched DN: cn=Manager,dc=example,dc=com [root@server ~]# ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f /etc/openldap/root.ldif Enter LDAP Password: adding new entry "uid=root,ou=People,dc=example,dc=com" ldap_add: No such object (32) matched DN: dc=example,dc=com [root@server ~]#

2 1

Ldap group with apache and proftpd
by jonathan.houze＠inetprocess.com 18 Feb '08

18 Feb '08

Hello every body, I am trying to manage rights with phpLdapAdmin and I don't succeed in configuring Apache and Proftpd I have created a branch : Peoples with user, each user is on the group "ldap" (groupid=1000) and some user are in a group "ftp" (groupid=1001) I'd like Proftpd and Apache to check user on the group "ftp" (1001) but I don't succeed, same for Apache ============== My VHOST on httpd.conf ================ LDAPTrustedCA /etc/ssl/cacert.pem LDAPTrustedCAType BASE64_FILE <Location /ldap-status> Order deny,allow Deny from All AuthName "Company.com Intranet" AuthType Basic AuthLDAPUrl ldaps://ldap.enterprise.com/ou=Peoples,dc=ldap,dc=enterprise,dc=com?uid #AuthLDAPGroupAttribute memberUid #AuthLDAPGroupAttributeIsDN off #Require ldap-group cn=ftp,ou=Groups,dc=ldap,dc=enterprise,dc=com #Require ldap-attribute gidNumber=1001 #Satisfy any ======================================================= Thank you, for your support

2 1

LDAP
by Aravind Arjunan 18 Feb '08

18 Feb '08

when am trying to add ldapuser.ldif am getting this error. [root@server ~]# ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f /etc/openldap/ldapusers.ldif Enter LDAP Password: adding new entry "uid=ldapuser,ou=People,cn=Manager,dc=example,dc=com" ldap_add: No such object (32) matched DN: cn=Manager,dc=example,dc=com This is my ldapuser.ldif dn: uid=ldapuser,ou=People,cn=Manager,dc=example,dc=com uid: ldapuser cn: Manager ou: People objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {crypt}c3ZWmT7fM2thY shadowLastChange: 13927 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 507 gidNumber: 100 homeDirectory: /home/ldapuser And is it necessary to extract the information of ldapuser from /etc/passwd file and for linux root account and extracted the /etc/passwd data into an ldif file and imported to that database.

3 2

LDAP inquiry
by Houaichine, Fathi (Fathi) 18 Feb '08

18 Feb '08

Dear team, I have a need to query two different LDAP servers in different domains, all the tools I have today I can query only one server a time, so I am looking if Openldap can do this requirement ? I'll appreciate if any body could advise. Best regards Fathi

2 3

syncrepl, database is not complete...
by Alain Siani 18 Feb '08

18 Feb '08

Hello, _My problem :_ I would like to have a replication server and i don't understand why all data are not copied to the replication server, i use rootdn to do sync...i should be able to copy all data...it start to copy but don't copy all data... _LDAP version :_ Source and copy are the same server : openldap-2.3.27-8 see below for configuration files, thks for your help ! Alain _Source server :_ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/rfc822-MailMember.schema include /etc/openldap/schema/gosa/gofon.schema include /etc/openldap/schema/gosa/samba3.schema include /etc/openldap/schema/gosa/pureftpd.schema include /etc/openldap/schema/gosa/gohard.schema include /etc/openldap/schema/gosa/goto.schema include /etc/openldap/schema/gosa/gosa+samba3.schema include /etc/openldap/schema/gosa/gofax.schema include /etc/openldap/schema/gosa/goserver.schema include /etc/openldap/schema/sfe.schema loglevel 256 password-hash {CRYPT} allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args access to * by * read database bdb suffix dc=domain,dc=com rootdn cn=Manager,dc=domain,dc=com rootpw {SSHA}Lcrkf43J0AU3rXGtMRk5iHAMXHuweL4R directory /var/lib/ldap/domain.com # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub *# Pour la replication avec syncrepl overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 sessionlog 123 500* ==================================================================== _Destination server :_ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema loglevel 256 schemacheck off allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=domain,dc=com" rootdn "cn=Manager,dc=domain,dc=com" rootpw {SSHA}Lcrkf43J0AU3rXGtMRk5iHAMXHuweL4R directory /var/lib/ldap/domain.com index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub access to * by * read * syncrepl rid=123 provider=ldap://10.0.0.242:389 type=refreshOnly interval=00:00:05:00 searchbase="dc=domain,dc=com" filter="(objectclass=*)" attrs="*" scope=sub schemachecking=off updatedn="cn=Manager,dc=domain,dc=com" bindmethod=simple binddn="cn=Manager,dc=domain,dc=com" credentials=xxxx* --- Antivirus avast! : message Sortant sain. Base de donnees virale (VPS) : 080216-0, 16/02/2008 Analyse le : 17/02/2008 13:54:14 avast! - copyright (c) 1988-2008 ALWIL Software. http://www.avast.com

6 13

basic database design
by VaraPrasad Yalla 18 Feb '08

18 Feb '08

I built a basic ldap server which is now working fine . It presently has very few attributes for each of the entries in the database . one of the records now looks like this : --------------------------------------------- dn: uid=test,ou=People,dc=example,dc=com uid: test cn: test objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {crypt}$1$XViJ4WIc$KIn0R0tQnYaKglIOI5Koj. shadowLastChange: 13925 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 506 gidNumber: 506 homeDirectory: /home/test ---------------------------------------------- How do I add further attributes like surname , email , street name etc to it ? Where should I make the modifications for these things to be added to the database ?

2 1

Re: Question concerning the dynlist overlay and single valued attributes
by Pierangelo Masarati 16 Feb '08

16 Feb '08

Gerd Schering wrote: > Pierangelo Masarati wrote: >> Dynlist does not >> allow massaging, so an option would be to stack a rwm before dynlist, so >> that rwm can massage the attribute names from persID to memberID before >> gathering. Looks ugly. > > Even if I will look for another solution (as promised in my previous > posting), I am somewhat curious: where can I find an example dealing > with overlay stacking? Please keep replies on the list. Overlay stacking is trivial: just configure more than one. From slapd.conf(5): overlay <overlay-name> Add the specified overlay to this database. An overlay is a piece of code that intercepts database operations in order to extend or change them. Overlays are pushed onto a stack over the database, and so they will execute in the reverse of the order in which they were configured and the database itself will receive control last of all. See the slapd.overlays(5) manual page for an overview of the available overlays. Note that all of the database’s regular settings should be configured before any overlay settings. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

ldap_initialize failure
by Ron Rogers 15 Feb '08

15 Feb '08

Hi All, I am receiving an LDAP_NO_MEMORY return from ldap_initialize on my Linux box. This error only occurs when the my application is executed from another process. If I start the app from the command line, everything works fine. I've spent some time looking at the source code and manual pages . The error seems to be coming from the call to LDAP_INT_GLOBAL_OPT. After that I'm getting lost in the macros and #defines . Does anyone have any ideas about this problem? Thanks Ron Rogers ____________________________________________________________________________________ Looking for last minute shopping deals? Find them fast with Yahoo! Search. http://tools.search.yahoo.com/newsearch/category.php?category=shopping

1 0

OpenLDAP synchtonization with windows/Active Directory
by Razi Garbie 15 Feb '08

15 Feb '08

Hi everyone, I've spent countless of hours trying to figure out how to sync openLDAP with my currently running windows/active directory, however.. i cant find any information on how this is done. Im currently running windows/AD which authenticates ~20users all windows boxes (obviously), however.. all windows users have accounts on the linux machines i run and that makes administrative tasks a bit messy, hence i have to make account changes on two different domains. The ideal setup is to setup setup a OpenLDAP server that is synced with windows active directory, so that my users can authenticate against the linux domain using their windows passwords. etc, (linux machines/-ldap clients) - > OpenLDAP <--SYNC --> Win/AD <- (windows machines) Thats how i imagine the setup will look like. Has anyone ever done this? Any help is greatly appreciated! // Thanks, boney

5 7

LDAP Auth
by Nuno Manuel Martins 14 Feb '08

14 Feb '08

Hello List, I am very new to OpenLDAP and I am trying to put a Linux box authenticating trough OpenLDAP instead of using the standard password file. For this use I followed the tutorial you can find at http://ldots.org/ldap/ but it seems this howto is out of date. The first problem I ran into was when trying to insert a new user in LDIF format, I corrected the first error I got and now this is the file I have dn: uid=myuser,ou=People,dc=example,dc=com uid: myuser cn: myuser sn: Doe givenname: John objectclass: person objectclass: posixaccount objectclass: account ou: People uidnumber: 10001 gidnumber: 10001 homedirectory=: /home/ldap/john loginshell: /bin/bash When I try to run ldapadd I get the following error: adding new entry "uid=branc0,ou=People,dc=example,dc=com" ldap_add: Invalid syntax (21) additional info: objectclass: value #1 invalid per syntax I am not sure what the problem is, although I'm pretty sure it is between the chair and the keyboard. Maybe someone on the list can direct me to a more up-to-date tutorial on setting up authentication with LDAP ? OpenLDAP version is 2.4.7

4 6

RE: SSL Help
by Vinh.CTR.Hoang＠faa.gov 14 Feb '08

14 Feb '08

It seems like my ldapsearch can't find the get local issuer certificate. what configuration files tells the ldapsearch of which certificate to use? Oh, my certificate and keys and cacert files are good, I've tested them using the openssl s_server and s_client to get a basic connection. can someone help me, I don't know what else could be the problem. here's the log for ldapsearch: /usr/local/bin/ldapsearch -x -LLL -ZZ -d 1 ldap_create ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost:389 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying ::1 389 ldap_connect_timeout: fd: 4 tm: -1 async: 0 ldap_close_socket: 4 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying 127.0.0.1:389 ldap_connect_timeout: fd: 4 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush: 31 bytes to sd 4 ldap_result ld 60888 msgid 1 ldap_chkResponseList ld 60888 msgid 1 all 1 ldap_chkResponseList returns ld 60888 NULL wait4msg ld 60888 msgid 1 (infinite timeout) wait4msg continue ld 60888 msgid 1 all 1 ** ld 60888 Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Wed Feb 13 20:49:25 2008 ** ld 60888 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 60888 Response Queue: Empty ldap_chkResponseList ld 60888 msgid 1 all 1 ldap_chkResponseList returns ld 60888 NULL ldap_int_select read1msg: ld 60888 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 12 contents: read1msg: ld 60888 msgid 1 message type extended-result ber_scanf fmt ({eaa) ber: read1msg: ld 60888 0 new referrals read1msg: mark request completed, ld 60888 msgid 1 request done: ld 60888 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ber_scanf fmt ({eaa) ber: ldap_parse_result ber_scanf fmt ({iaa) ber: ber_scanf fmt (}) ber: ldap_msgfree TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 20, subject: /CN=ldap1.mylan/emailAddress=abc@mylan, issuer: /CN=ldap1.mylan/emailAddress=abc@mylan TLS certificate verification: Error, unable to get local issuer certificate TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. ldap_perror ldap_start_tls: Connect error (-11) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed >>>>>>>>>>>>END>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> and here's the server's log for that search daemon: activity on 1 descriptor >>> slap_listener(ldap:///) daemon: listen=8, new connection on 14 daemon: added 14r (active) listener=0 daemon: select: listen=7 active_threads=0 tvp=NULL daemon: select: listen=8 active_threads=0 tvp=NULL daemon: select: listen=9 active_threads=0 tvp=NULL daemon: select: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: 14r daemon: read activity on 14 connection_get(14) connection_get(14): got connid=6 connection_read(14): checking for input on id=6 ber_get_next ldap_read: want=8, got=8 0000: 30 1d 02 01 01 77 18 80 0....w.. ldap_read: want=23, got=23 0000: 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 31 34 36 .1.3.6.1.4.1.146 0010: 36 2e 32 30 30 33 37 6.20037 ber_get_next: tag 0x30 len 29 contents: ber_dump: buf=0x002094f0 ptr=0x002094f0 end=0x0020950d len=29 0000: 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 ...w...1.3.6.1.4 0010: 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .1.1466.20037 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable daemon: select: listen=7 active_threads=0 tvp=NULL daemon: select: listen=8 active_threads=0 tvp=NULL daemon: select: listen=9 active_threads=0 tvp=NULL daemon: select: listen=10 active_threads=0 tvp=NULL do_extended ber_scanf fmt ({m) ber: ber_dump: buf=0x002094f0 ptr=0x002094f3 end=0x0020950d len=26 0000: 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e w...1.3.6.1.4.1. 0010: 31 34 36 36 2e 32 30 30 33 37 1466.20037 do_extended: oid=1.3.6.1.4.1.1466.20037 send_ldap_extended: err=0 oid= len=0 send_ldap_response: msgid=1 tag=120 err=0 ber_flush: 14 bytes to sd 14 0000: 30 0c 02 01 01 78 07 0a 01 00 04 00 04 00 0....x........ ldap_write: want=14, written=14 0000: 30 0c 02 01 01 78 07 0a 01 00 04 00 04 00 0....x........ daemon: activity on 1 descriptor daemon: activity on: 14r daemon: read activity on 14 connection_get(14) connection_get(14): got connid=6 connection_read(14): checking for input on id=6 TLS trace: SSL_accept:before/accept initialization tls_read: want=11, got=11 0000: 80 7a 01 03 01 00 51 00 00 00 20 .z....Q... tls_read: want=113, got=113 0000: 00 00 39 00 00 38 00 00 35 00 00 16 00 00 13 00 ..9..8..5....... 0010: 00 0a 07 00 c0 00 00 33 00 00 32 00 00 2f 00 00 .......3..2../.. 0020: 07 05 00 80 03 00 80 00 00 05 00 00 04 01 00 80 ................ 0030: 00 00 15 00 00 12 00 00 09 06 00 40 00 00 14 00 ...........@.... 0040: 00 11 00 00 08 00 00 06 04 00 80 00 00 03 02 00 ................ 0050: 80 32 4e ca 88 41 1f 3a 73 cd a1 1c 29 73 a6 81 .2N..A.:s...)s.. 0060: 8c c5 af c3 af 93 bf 13 4a c7 54 90 b7 82 d2 69 ........J.T....i 0070: 2f / TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write server done A tls_write: want=810, written=810 0000: 16 03 01 00 4a 02 00 00 46 03 01 47 b3 58 84 43 ....J...F..G.X.C 0010: c3 a5 64 a9 b5 7c 0b 8b 25 1c d6 e9 ce f2 1f 9b ..d..|..%....... 0020: 82 00 e0 6d 33 e7 e6 44 53 6c 52 20 7d 72 fe 41 ...m3..DSlR }r.A 0030: 17 4c 96 5c 5c 9c 6b df 32 0d c0 32 45 fe 7b bf .L.\\.k.2..2E.{. 0040: a9 5e 16 4b 62 ec 3b 11 76 6e ee ce 00 35 00 16 .^.Kb.;.vn...5.. 0050: 03 01 02 cd 0b 00 02 c9 00 02 c6 00 02 c3 30 82 ..............0. 0060: 02 bf 30 82 02 28 a0 03 02 01 02 02 01 01 30 0d ..0..(........0. 0070: 06 09 2a 86 48 86 f7 0d 01 01 04 05 00 30 30 31 ..*.H........001 0080: 14 30 12 06 03 55 04 03 13 0b 6c 64 61 70 31 2e .0...U....ldap1. 0090: 6d 79 6c 61 6e 31 18 30 16 06 09 2a 86 48 86 f7 mylan1.0...*.H.. 00a0: 0d 01 09 01 16 09 61 62 63 40 6d 79 6c 61 6e 30 ......abc@mylan0 00b0: 1e 17 0d 30 38 30 32 31 33 31 36 31 34 32 32 5a ...080213161422Z 00c0: 17 0d 31 38 30 32 31 32 31 36 31 34 32 32 5a 30 ..180212161422Z0 00d0: 30 31 14 30 12 06 03 55 04 03 13 0b 6c 64 61 70 01.0...U....ldap 00e0: 31 2e 6d 79 6c 61 6e 31 18 30 16 06 09 2a 86 48 1.mylan1.0...*.H 00f0: 86 f7 0d 01 09 01 16 09 61 62 63 40 6d 79 6c 61 ........abc@myla 0100: 6e 30 81 9f 30 0d 06 09 2a 86 48 86 f7 0d 01 01 n0..0...*.H..... 0110: 01 05 00 03 81 8d 00 30 81 89 02 81 81 00 ef 80 .......0........ 0120: 03 36 0f 1e e0 19 e7 1d 03 a9 cb 13 53 81 d6 f7 .6..........S... 0130: bf b6 e4 1c 84 38 77 bd 85 39 e6 f6 9c 50 70 82 .....8w..9...Pp. 0140: 3e 7e e0 17 e9 86 4f a3 48 8f bb 1a f1 04 92 72 >~....O.H......r 0150: bc 02 a7 dd 97 54 c1 cd 09 bd f8 d8 da 23 04 8e .....T.......#.. 0160: e7 77 de 44 f8 54 f9 5e 35 1e 05 50 71 b2 dc 25 .w.D.T.^5..Pq..% 0170: 71 7b e9 48 99 bf 93 a2 07 4e 4e 1f 1f 96 c8 b8 q{.H.....NN..... 0180: 76 21 3b fc c7 60 ab b2 4a 01 2d 8a 15 ee af e7 v!;..`..J.-..... 0190: 76 4e 50 1b 61 8f 5c a1 b3 07 4a cc 82 43 02 03 vNP.a.\...J..C.. 01a0: 01 00 01 a3 81 e8 30 81 e5 30 09 06 03 55 1d 13 ......0..0...U.. 01b0: 04 02 30 00 30 2c 06 09 60 86 48 01 86 f8 42 01 ..0.0,..`.H...B. 01c0: 0d 04 1f 16 1d 4f 70 65 6e 53 53 4c 20 47 65 6e .....OpenSSL Gen 01d0: 65 72 61 74 65 64 20 43 65 72 74 69 66 69 63 61 erated Certifica 01e0: 74 65 30 1d 06 03 55 1d 0e 04 16 04 14 18 e5 ab te0...U......... 01f0: 2a 99 96 50 78 35 71 52 a6 ad 1f 8a 53 c6 72 cd *..Px5qR....S.r. 0200: dc 30 60 06 03 55 1d 23 04 59 30 57 80 14 25 ba .0`..U.#.Y0W..%. 0210: f3 49 07 88 d2 aa 76 2f 59 fc f0 bb 08 6d b5 17 .I....v/Y....m.. 0220: f3 e8 a1 34 a4 32 30 30 31 14 30 12 06 03 55 04 ...4.2001.0...U. 0230: 03 13 0b 6c 64 61 70 31 2e 6d 79 6c 61 6e 31 18 ...ldap1.mylan1. 0240: 30 16 06 09 2a 86 48 86 f7 0d 01 09 01 16 09 61 0...*.H........a 0250: 62 63 40 6d 79 6c 61 6e 82 09 00 8e 0f 59 9d 05 bc@mylan.....Y.. 0260: 90 4f f0 30 29 06 03 55 1d 11 04 22 30 20 82 0a .O.0)..U..."0 .. 0270: 6c 64 61 70 2e 6d 79 6c 61 6e 82 12 6c 6f 61 64 ldap.mylan..load 0280: 62 61 6c 61 6e 63 65 72 2e 6d 79 6c 61 6e 30 0d balancer.mylan0. 0290: 06 09 2a 86 48 86 f7 0d 01 01 04 05 00 03 81 81 ..*.H........... 02a0: 00 89 b9 5b c0 9e 57 39 32 c0 55 79 d6 dd cd 55 ...[..W92.Uy...U 02b0: 2f 6c a4 7e 96 96 f8 f2 51 38 85 35 f1 a9 42 45 /l.~....Q8.5..BE 02c0: b8 f7 e4 a8 68 46 43 c5 5a d8 74 3e e8 a1 f3 25 ....hFC.Z.t>...% 02d0: a7 57 2c bd 0c a2 5d f3 ae 19 57 f6 13 f1 07 2f .W,...]...W..../ 02e0: df da 39 85 bd 0f 60 7b 98 52 8b ae 5d 7a 1a c5 ..9...`{.R..]z.. 02f0: 59 b5 6f 49 74 05 87 5f a4 72 49 7d 59 79 da 97 Y.oIt.._.rI}Yy.. 0300: 5d 01 9c e2 fb b5 42 21 19 f6 9a ef 05 5e cb 8b ].....B!.....^.. 0310: e4 b3 2a 7f f2 5e 87 73 23 ed c0 31 78 53 7e 18 ..*..^.s#..1xS~. 0320: 39 16 03 01 00 04 0e 00 00 00 9......... TLS trace: SSL_accept:SSLv3 flush data tls_read: want=5, got=5 0000: 15 03 01 00 02 ..... tls_read: want=2, got=2 0000: 02 30 .0 TLS trace: SSL3 alert read:fatal:unknown CA TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept. TLS: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca s3_pkt.c:1053 connection_read(14): TLS accept failure error=-1 id=6, closing connection_closing: readying conn=6 sd=14 for close connection_close: conn=6 sd=14 daemon: removing 14 daemon: select: listen=7 active_threads=0 tvp=NULL daemon: select: listen=8 active_threads=0 tvp=NULL daemon: select: listen=9 active_threads=0 tvp=NULL daemon: select: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: waked daemon: select: listen=7 active_threads=0 tvp=NULL daemon: select: listen=8 active_threads=0 tvp=NULL daemon: select: listen=9 active_threads=0 tvp=NULL daemon: select: listen=10 active_threads=0 tvp=NULL >>>>>>>>>>>>>>>>>>>>END>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Thanks, Vinh Vinh CTR Hoang/ACT/CNTR/FAA@FAA Sent by: openldap-technical-bounces+vinh.ctr.hoang=faa.gov(a)OpenLDAP.org 02/12/2008 05:27 PM To openldap-technical(a)openldap.org cc Subject SSL Help Hi, I'm having some troubles with openldap w/ TLS. I can't seem to do a ldapsearch -x -LLL -ZZ, as it is giving be back "SSL3_GET_SERVER_CERTIFICATE:certificate verify failed" On the server side log I'm getting: TLS trace: SSL3 alert read: fatal:unknown CA TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept TLS: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca s3_pkt.c:1053 I've tried and tested my ssl connection using: openssl s_client -connect ldap1.mylan:636 -showcerts -state -CAfile /usr/local/etc/openldap/cacert.pem and that works, althought if I use "TLSVerifyClient demand" in slapd.conf, the server will reject the connection saying that the client didn't send the certificate. I also tried the client authentication ssl test and the works w/ and w/o the TLSVerifyClient demand option: openssl s_client -connect ldap1.mylan:636 -state \ -CAfile /usr/local/etc/openldap/cacert.pem \ -cert /usr/local/etc/openldap/slapd-cert-ldap1.pem \ -key /usr/local/etc/openldap/slapd-key-ldap1.pem Does any know what i'm doing wrong? Here are the tls part of my configs: slapd.conf .... #TLS SSL keys TLSCipherSuite HIGH:MEDIUM:+TLSv1:+SSLv2:SSLv3 TLSCACertificateFile /usr/local/etc/openldap/cacert.pem TLSCertificateFile /usr/local/etc/openldap/slapd-cert-ldap1.pem TLSCertificateKeyFile /usr/local/etc/openldap/slapd-key-ldap1.pem #TLSVerifyClient demand .... ldap.conf BASE dc=mylan HOST ldap1.mylan #URI ldaps://127.0.0.1:636 TLS_CACERT /usr/local/etc/openldap/cacert.pem ..... /etc/ldap.conf # network or connect timeouts (see bind_timelimit). host 127.0.0.1 # The distinguished name of the search base. #base dc=caplan,dc=org base dc=mylan # Another way to specify your LDAP server is to provide an # uri with the server name. This allows to use # Unix Domain Sockets to connect to a local LDAP Server. host ldap1.mylan #uri ldap://127.0.0.1/ #uri ldap://127.0.0.1/ ldaps://127.0.0.1/ #uri ldapi://%2fvar%2frun%2fldapi_sock/ # Note: %2f encodes the '/' used as directory separator # The LDAP version to use (defaults to 3 # if supported by client library) ldap_version 3 # The distinguished name to bind to the server with. # Optional: default is to bind anonymously. #binddn cn=NonAnon,dc=caplan,dc=org # The credentials to bind with. # Optional: default is no credential. #bindpw SeCrEt # The distinguished name to bind to the server with # if the effective user ID is root. Password is # stored in /etc/ldap.secret (mode 600) #rootbinddn cn=root,dc=padl,dc=com # The port. # Optional: default is 389. port 389 .. ... .. # OpenLDAP SSL mechanism # start_tls mechanism uses the normal LDAP port, LDAPS typically 636 ssl start_tls #ssl on # OpenLDAP SSL options # Require and verify server certificate (yes/no) # Default is to use libldap's default behavior, which can be configured in # /etc/openldap/ldap.conf using the TLS_REQCERT setting. The default for # OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes". tls_checkpeer yes # CA certificates for server certificate verification # At least one of these are required if tls_checkpeer is "yes" #tls_cacertfile /etc/ssl/ca.cert #tls_cacertdir /etc/ssl/certs tls_cacertfile /usr/local/etc/openldap/cacert.pem # Seed the PRNG if /dev/urandom is not provided #tls_randfile /var/run/egd-pool # SSL cipher suite # See man ciphers for syntax #tls_ciphers TLSv1 # Client certificate and key # Use these, if your server requires client authentication. #tls_cert #tls_key Thanks, Vinh

2 2

Question concerning the dynlist overlay and single valued attributes
by Gerd Schering 14 Feb '08

14 Feb '08

Hi, I wnt to use the dynlist overlay to collect attribute values from entries in different branches of the DIT, via a dynamic group like this: dn: cn=dynamicTestList,ou=Groups,dc=local,dc=site cn: dynamicTestList objectclass: groupOfURLs memberURL: ldap:///dc=local,dc=site?sn,persID?sub?(objectclass=*) When I query this, I via ldapsearch -x -H ldaps:/// \ -b "cn=dynamicTestList,dc=local,dc=site" -s base "(objectclass=*)" I recieve a reasonable number of "sn" values but just one for "persID", despite the fact, that there should be a lot of them. "persID" is defined SINGLE VALUE. Is this the reason for receiving just one item and if so, what can I do to circumvent this, i.e. retrieve all "persID" from matched entries? BTW, does the dynlist overlay support the "cn=config" staff? Any help will be appreciated, Gerd -- ------------------------------------------------------ -- Gerd Schering, Email: Schering(a)tubit.TU-Berlin.DE -- ------------------------------------------------------

2 2

SSL Help
by Vinh.CTR.Hoang＠faa.gov 13 Feb '08

13 Feb '08

Hi, I'm having some troubles with openldap w/ TLS. I can't seem to do a ldapsearch -x -LLL -ZZ, as it is giving be back "SSL3_GET_SERVER_CERTIFICATE:certificate verify failed" On the server side log I'm getting: TLS trace: SSL3 alert read: fatal:unknown CA TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept TLS: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca s3_pkt.c:1053 I've tried and tested my ssl connection using: openssl s_client -connect ldap1.mylan:636 -showcerts -state -CAfile /usr/local/etc/openldap/cacert.pem and that works, althought if I use "TLSVerifyClient demand" in slapd.conf, the server will reject the connection saying that the client didn't send the certificate. I also tried the client authentication ssl test and the works w/ and w/o the TLSVerifyClient demand option: openssl s_client -connect ldap1.mylan:636 -state \ -CAfile /usr/local/etc/openldap/cacert.pem \ -cert /usr/local/etc/openldap/slapd-cert-ldap1.pem \ -key /usr/local/etc/openldap/slapd-key-ldap1.pem Does any know what i'm doing wrong? Here are the tls part of my configs: slapd.conf .... #TLS SSL keys TLSCipherSuite HIGH:MEDIUM:+TLSv1:+SSLv2:SSLv3 TLSCACertificateFile /usr/local/etc/openldap/cacert.pem TLSCertificateFile /usr/local/etc/openldap/slapd-cert-ldap1.pem TLSCertificateKeyFile /usr/local/etc/openldap/slapd-key-ldap1.pem #TLSVerifyClient demand .... ldap.conf BASE dc=mylan HOST ldap1.mylan #URI ldaps://127.0.0.1:636 TLS_CACERT /usr/local/etc/openldap/cacert.pem ..... /etc/ldap.conf # network or connect timeouts (see bind_timelimit). host 127.0.0.1 # The distinguished name of the search base. #base dc=caplan,dc=org base dc=mylan # Another way to specify your LDAP server is to provide an # uri with the server name. This allows to use # Unix Domain Sockets to connect to a local LDAP Server. host ldap1.mylan #uri ldap://127.0.0.1/ #uri ldap://127.0.0.1/ ldaps://127.0.0.1/ #uri ldapi://%2fvar%2frun%2fldapi_sock/ # Note: %2f encodes the '/' used as directory separator # The LDAP version to use (defaults to 3 # if supported by client library) ldap_version 3 # The distinguished name to bind to the server with. # Optional: default is to bind anonymously. #binddn cn=NonAnon,dc=caplan,dc=org # The credentials to bind with. # Optional: default is no credential. #bindpw SeCrEt # The distinguished name to bind to the server with # if the effective user ID is root. Password is # stored in /etc/ldap.secret (mode 600) #rootbinddn cn=root,dc=padl,dc=com # The port. # Optional: default is 389. port 389 .. ... .. # OpenLDAP SSL mechanism # start_tls mechanism uses the normal LDAP port, LDAPS typically 636 ssl start_tls #ssl on # OpenLDAP SSL options # Require and verify server certificate (yes/no) # Default is to use libldap's default behavior, which can be configured in # /etc/openldap/ldap.conf using the TLS_REQCERT setting. The default for # OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes". tls_checkpeer yes # CA certificates for server certificate verification # At least one of these are required if tls_checkpeer is "yes" #tls_cacertfile /etc/ssl/ca.cert #tls_cacertdir /etc/ssl/certs tls_cacertfile /usr/local/etc/openldap/cacert.pem # Seed the PRNG if /dev/urandom is not provided #tls_randfile /var/run/egd-pool # SSL cipher suite # See man ciphers for syntax #tls_ciphers TLSv1 # Client certificate and key # Use these, if your server requires client authentication. #tls_cert #tls_key Thanks, Vinh

2 1

Re: Ldap ppolicy schema entries
by Aravind Arjunan 12 Feb '08

12 Feb '08

* Am still facing issue while configuring ldap in master slave for replication. am using openldap 2.2 version. OS: RHEL 4.0 And am trying to configure master slave replication thro slurpd method. i had configured my master slapd.conf and slave slave slapd.conf. similarly i configured master and slave ldap.conf. After that i stopped the service in master and slave by [root@server ~]# service ldap stop Stopping slapd: [ OK ] Stopping slurpd: [ OK ] [root@server ~]# similarly in slave also. then i copied the database manually using slapcat [root@server openldap]# slapcat -b "dc=example,dc=com" -v -l example.com.ldif # id=00000001 # id=00000003 [root@server openldap]# scp example.com.ldif root(a)151.2.119.133 :/var/lib/ldap/example.com/ root(a)151.2.119.133's password: example.com.ldif 100% 747 0.7KB/s 00:00 [root@server openldap]# In slave : [root@slave openldap]# slapadd -b "dc=example,dc=com" -v -l example.com.ldif added: "dc=example,dc=com" (00000001) added: "cn=Manager,dc=example,dc=com" (00000002) [root@slave openldap]# but when i create a user in ldapmaster and check that user in slave,i was not able to found. there was no log in replogfile. [root@server ~]# useradd test [root@server ~]# passwd test Changing password for user test. New UNIX password: Retype new UNIX password: passwd: all authentication tokens updated successfully. [root@server ~]# In slave [root@slave openldap]# id test id: test: No such user Here is my configuration files master slapd.conf * *=============* *#######################################################################* # ldbm and/or bdb database definitions ####################################################################### * database bdb * #The base of your directory * suffix "dc=example,dc=com" * #where the database files are physically stored * directory "/var/lib/ldap/example.com" * #Distinguished name,not subject to access control * rootdn "cn=Manager,dc=example,dc=com" rootpw password * # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Replicas of this database * replica uri=ldap://=151.2.119.133:389 suffix="dc=example,dc=com" binddn="cn=syncuser,dc=example,dc=com" bindmethod=simple credentials=hcllch replogfile /var/lib/ldap/replogfile * #ACL's * access to attrs=userpassword by self write by anonymous auth by dn="cn=syncuser,dc=example,dc=com" read by * auth access to * by self write by dn="cn=syncuser,dc=example,dc=com" read by * read * #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM [root@server openldap]# * Slave slapd.conf ============== * ####################################################################### # ldbm and/or bdb database definitions ####################################################################### * database bdb * #The base of your directory * suffix "dc=example,dc=com" * #where the database files are physically stored #directory "/var/lib/ldap/ldap-test" #Distinguished name,not subject to access control * rootdn "cn=Manager,dc=example,dc=com" rootpw password * # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended * updatedn cn=syncuser,dc=example,dc=com updateref ldap://151.2.119.120 directory /var/lib/ldap/example.com access to attrs=userpassword by self write by anonymous auth by dn="cn=syncuser,dc=example,dc=com" write by * auth access to * by self write by dn="cn=syncuser,dc=example,dc=com" write by * read * # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM [root@slave openldap]# * Master ldap.conf ============== * # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example, dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never * host 151.2.119.120 151.2.119.133 base dc=example,dc=com binddn cn=Manager,dc=example,dc=com bindpw password bind_policy soft pam_password expo Slave ldap.conf ============== * # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example, dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never * host 151.2.119.133 151.2.119.120 base dc=example,dc=com binddn cn=Manager,dc=example,dc=com bindpw password bind_policy soft pam_password expo *

2 1

Master Slave ldap
by Aravind Arjunan 11 Feb '08

11 Feb '08

---------- Forwarded message ---------- From: Aravind Arjunan <aravind.arjunan(a)gmail.com> Date: 9 Feb 2008 11:20 Subject: Fwd: Ldap ppolicy schema entries To: openldap-technical(a)openldap.org ---------- Forwarded message ---------- From: Aravind Arjunan <aravind.arjunan(a)gmail.com> Date: 9 Feb 2008 11:19 Subject: Re: Ldap ppolicy schema entries To: Buchan Milne <bgmilne(a)staff.telkomsa.net> Am trying to confiure the ldap in master-slave It was mentioned in the document that after configuring the master and slave slapd.conf file for replication, shutdown the master slapd,so you can copy the database. I cant understand in this part,how to copy the database. where to copy?tell me how to check that my slave slapd is working? wheather by giving ldapsearch command in slave instance or by any other. am attaching the master and slave conf file for reference,please mention me if there is any mistake.

2 1

Fwd: Ldap ppolicy schema entries
by Aravind Arjunan 08 Feb '08

08 Feb '08

---------- Forwarded message ---------- From: Aravind Arjunan <aravind.arjunan(a)gmail.com> Date: 9 Feb 2008 11:19 Subject: Re: Ldap ppolicy schema entries To: Buchan Milne <bgmilne(a)staff.telkomsa.net> Am trying to confiure the ldap in master-slave It was mentioned in the document that after configuring the master and slave slapd.conf file for replication, shutdown the master slapd,so you can copy the database. I cant understand in this part,how to copy the database. where to copy?tell me how to check that my slave slapd is working? wheather by giving ldapsearch command in slave instance or by any other. am attaching the master and slave conf file for reference,please mention me if there is any mistake.

1 0

tips in ldappasswd
by Gustavo Mendes de Carvalho 08 Feb '08

08 Feb '08

Hi there, I have an OpenLDAP Server authenticating with TLSv1, but I ´foound some probelms when I have to change my ldap user´s password. I use the following command to try to change it [ming@ldap-cli ~]$ ldappasswd -AS -ZZ -H ldaps://ldap.server/ -D uid=ming,ou=org-unit,o=org,c=br Old password: Re-enter old password: New password: Re-enter new password: ldap_start_tls: Operations error (1) additional info: TLS already started [ming@ldap-cli ~]$ ldappasswd -AS -H ldaps://ldap.server/ -D uid=ming,ou=org-unit,o=org,c=br Old password: Re-enter old password: New password: Re-enter new password: SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Miscellaneous failure (No credentials cache found) I store only password's hashes in my ldap database, so I need to know how to replace this hash. If I connect to my ldap server using some ldap browser, like ldapadmin, I can change my user´s password, but I need to change it using some command line, like ldappasswd. Do you have some examples about how to use ldappasswd ? I already search it in Google, but all expamples that I found tells me that to use same command that I'm already using. Thanks iin advance --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com

3 5

2.3.39 vs 2.3.40 (as Re: (ITS#5354) slapd repeatedly hangs and stops reponding)
by Buchan Milne 08 Feb '08

08 Feb '08

On Friday 08 February 2008 03:35:54 quanah(a)zimbra.com wrote: > --On Thursday, February 07, 2008 8:13 PM -0500 Oren Laadan > > <orenl(a)cs.columbia.edu> wrote: > > will fix the symbols now. thanks. > > > > as for the patch, it seems unrelated as it fixes a problem during the > > start-up of the daemon; also, it's for 2.4.7, and I just downgraded > > back to 2.4.49 (which I was using originally). the decision to move > > up was because I hoped that the problem would disappear when using a > > more recent version of openldap. as it turns out, it didn't :( > > There's no such thing as 2.4.49. I assume you mean 2.3.40? Or 2.3.39? I > would use 2.3.40 over 2.3.39 Quoting Howard: "While ITS#5342 is still being investigated, I would recommend that everyone use 2.3.39 and not 2.3.40. Sorry for the trouble." ITS#5342 is still open, and while the last two followups seem to indicate that the corruption was not the fault of 2.3.40 ... I'm planning an upgrade for this weekend (from 2.3.34 for one set of servers, and from 2.3.11 for another), and thus far I'm hoping to run with 2.3.39 with most fixes in 2.3.40 (plus #5358's fix), but not the dn2id lock fix ... Maybe I should make provision for an export/import during my upgrade? Regards, Buchan

3 3

Re: Ldap ppolicy schema entries
by Ljunghammar, Darryl K 08 Feb '08

08 Feb '08

Hi Tonni, Could you give me an example of what you meant by putting a + at the end of the ldapsearch command? When I tried putting a plus at the end it didn't give me any found results so I must be doing something wrong with the syntax. I used: [root@alph bin]# ldapsearch -x -H ldaps://alph/ -D "cn=Manager,dc=dst,dc=boeing,dc=com" -W -b "ou=people,dc=dst,dc=boeing,dc=com" "(uid=darryl+)" Enter LDAP Password: xxxxxx # extended LDIF # # LDAPv3 # base <ou=people,dc=dst,dc=boeing,dc=com> with scope sub # filter: (uid=darryl+) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 But if I leave off the + I do get the user fields so I know it has data. Thanks, Darryl ________________________________________________________________________ ___________ Ljunghammar, Darryl K skrev, on 23-01-2008 21:56: I would like to view the ppolicy schema attributes for a user when I do a "ldapsearch" but they don't show up. For example, I would like to see the "pwdHistory" attribute for a user. I know it is being updated because if I enter a previously used password it tells me it can't be reused. I am using openldap 2.3.39-3 on a Redhat 5.1 system. Put a '+' at the end of your ldapsearch string and you'll see only the operational attributes, *if* your ACLs permit this. You will not see empty attributes, only those with values. Best, --Tonni -- Tony Earnshaw Email: tonni at hetnet dot nl

2 1

Openldap and last logon
by Ljunghammar, Darryl K 08 Feb '08

08 Feb '08

Hi, I there a way to record the last logon and hostname into a user's record in openldap? I am using openldap 2.3.27-8 on a Rh5.1 system. Thanks, Darryl

1 0

Trouble Installing LDAP Client On Ubuntu Linux
by Ldap Newbie 08 Feb '08

08 Feb '08

Hi, I have some trouble with the installation of the LDAP client on Ubuntu Linux. I followed the instructions as described the articles below. 1. <http://www.linux.com/feature/114074> 2. <http://mcwhirter.com.au/node/25> Although I followed the steps in the article my Ubuntu keeps running exactly as before, authenticating without using LDAP. Problem is that I don't have a clue what's happening. So any suggestions on what files to check or what commands to run to test things are appreciated. What I do know about this configuration problem is: * The LDAP server is up and running, it's usable from another application * I don't see any incoming traces when I run slapd in full debug mode and try some actions like rebooting or getent passwd from the client * The getent passwd <username> test as described in article .2 fails So likely something went wrong with the configuration of $ apt-get install libpam-ldap libnss-ldap Is there a way I can rerun the installer so that I can verify the configuration data I entered. What other things should I try ? All suggestions apprectiated. Thanks, Carl _________________________________________________________________ Who's friends with who and co-starred in what? http://www.searchgamesbox.com/celebrityseparation.shtml

3 2

openldap - missing modules - how / where to find them
by Charlie Reddington 06 Feb '08

06 Feb '08

Hi Everyone, I'm working on setting up openldap on a few of my linux servers. I was working on setting up the slapd.conf file, and I ran the slaptest against it. I was returned with this. 1t_dlopenext failed: (back_bdb) back_bdb.so: cannont open shared object file: no file or directory found. Okay, simple enough, I'm trying to use the bdb backend, so I need the module that is called in my file back_bdb.so. I did a search on the system and that is not found. I installed the openldap stuff via yum. I installed the following. openldap openldap-servers openldap-cleints openldap-devel I've reinstalled, I've searched for just the backend module itself, all coming up empty handed. Can someone point me to what I'm doing wrong to get these files? Charlie

2 1

Timeouts over LDAPS
by Martin Sandsmark 05 Feb '08

05 Feb '08

Hi! I'm having some trouble with time-outs when using ldaps with pam. If the slapd opens an incoming ssl connection, but do not respond correctly (like if the Berkley database breaks down, which unfortunately seems to happen from time to time), the ldap-pam-module will hang more or less indefinitely. This is rather unfortunate, since it makes logging in and repairing the database much more tedious. If we use just plain ldap (not using openssl), the connection times out rather quickly, and pam tries the next authentication method which works as expected, and the problem can be fixed. But unfortunately that also opens up some security risks, since we can't be sure we connect to the proper ldap server. -- Martin Sandsmark IT-Komiteen, Samfundet "Capital letters were always the best way of dealing with things you didn't have a good answer to." - Douglas Adams

3 2

LDAP Master/Slave replication
by Alain Siani 05 Feb '08

05 Feb '08

Hello, Do you think the version of ldap must be equal ? I use openldap-2.3.27-8 on server and openldap-2.2.23-5 on client. Do you think it is syncrepl compatible ? thanks, Alain I don't found the solution... do you know a french document for installation of "syncrpl" ? I tried english documentation : http://www.openldap.org/doc/admin22/syncrepl.html but no success... thanks, Alain The log : Feb 5 13:11:37 dev5 slapd[2523]: =>do_syncrepl Feb 5 13:11:37 dev5 slapd[2523]: => bdb_entry_get: ndn: "cn=syncrepl123,dc=myDomain,dc=com" Feb 5 13:11:37 dev5 slapd[2523]: => bdb_entry_get: oc: "(null)", at: "syncreplCookie" Feb 5 13:11:37 dev5 slapd[2523]: bdb_dn2entry("cn=syncrepl123,dc=myDomain,dc=com") Feb 5 13:11:37 dev5 slapd[2523]: => bdb_dn2id( "dc=myDomain,dc=com" ) Feb 5 13:11:37 dev5 slapd[2523]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) Feb 5 13:11:37 dev5 slapd[2523]: => bdb_entry_get: cannot find entry: "cn=syncrepl123,dc=myDomain,dc=com" Feb 5 13:11:37 dev5 slapd[2523]: =>do_syncrep2 thanks for you help ! Alain Hello, I use the bottom file "slapd.conf" to mirror master server. It was ok with 2.2.23-5 version of openldap. I just installed a new version of openldap : 2.3.27-8 Now the slave server start ok... but slapcat is empty !!?? Do you have an idea ? Thanks a lot, Alain slapd.conf _________ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema allow bind_v2 pidfile /var/run/slapd.pid argsfile /var/run/slapd.args loglevel 256 database bdb suffix "dc=myDomain,dc=com" rootdn "cn=Manager,dc=myDomain,dc=com" rootpw {SSHA}wuapktMrH50PDG29WoffJcmvpblebsdT directory /var/lib/ldap/myDomain.com index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryUUID eq access to * by * read syncrepl rid=123 provider=ldap://10.0.0.242:389 type=refreshOnly interval=00:00:01:00 searchbase="dc=myDomain,dc=com" filter="(objectclass=*)" attrs="*" scope=sub bindmethod=simple binddn="cn=Manager,dc=myDomain,dc=com" credentials="myPassword" --- Antivirus avast! : message Entrant sain. Base de donnees virale (VPS) : 080204-0, 04/02/2008 Analyse le : 05/02/2008 19:55:34 avast! - copyright (c) 1988-2008 ALWIL Software. http://www.avast.com --- Antivirus avast! : message Sortant sain. Base de donnees virale (VPS) : 080204-0, 04/02/2008 Analyse le : 05/02/2008 20:03:01 avast! - copyright (c) 1988-2008 ALWIL Software. http://www.avast.com

2 1

LDAP Master/Slave replication
by asiani＠free.fr 05 Feb '08

05 Feb '08

I don't found the solution... do you know a french document for installation of "syncrpl" ? I tried english documentation : http://www.openldap.org/doc/admin22/syncrepl.html but no success... thanks, Alain The log : Feb 5 13:11:37 dev5 slapd[2523]: =>do_syncrepl Feb 5 13:11:37 dev5 slapd[2523]: => bdb_entry_get: ndn: "cn=syncrepl123,dc=myDomain,dc=com" Feb 5 13:11:37 dev5 slapd[2523]: => bdb_entry_get: oc: "(null)", at: "syncreplCookie" Feb 5 13:11:37 dev5 slapd[2523]: bdb_dn2entry("cn=syncrepl123,dc=myDomain,dc=com") Feb 5 13:11:37 dev5 slapd[2523]: => bdb_dn2id( "dc=myDomain,dc=com" ) Feb 5 13:11:37 dev5 slapd[2523]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) Feb 5 13:11:37 dev5 slapd[2523]: => bdb_entry_get: cannot find entry: "cn=syncrepl123,dc=myDomain,dc=com" Feb 5 13:11:37 dev5 slapd[2523]: =>do_syncrep2 thanks for you help ! Alain Hello, I use the bottom file "slapd.conf" to mirror master server. It was ok with 2.2.23-5 version of openldap. I just installed a new version of openldap : 2.3.27-8 Now the slave server start ok... but slapcat is empty !!?? Do you have an idea ? Thanks a lot, Alain slapd.conf _________ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema allow bind_v2 pidfile /var/run/slapd.pid argsfile /var/run/slapd.args loglevel 256 database bdb suffix "dc=myDomain,dc=com" rootdn "cn=Manager,dc=myDomain,dc=com" rootpw {SSHA}wuapktMrH50PDG29WoffJcmvpblebsdT directory /var/lib/ldap/myDomain.com index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryUUID eq access to * by * read syncrepl rid=123 provider=ldap://10.0.0.242:389 type=refreshOnly interval=00:00:01:00 searchbase="dc=myDomain,dc=com" filter="(objectclass=*)" attrs="*" scope=sub bindmethod=simple binddn="cn=Manager,dc=myDomain,dc=com" credentials="myPassword"

1 0

LDAP Master/Slave replication
by asiani＠free.fr 05 Feb '08

05 Feb '08

The log : Feb 5 13:11:37 dev5 slapd[2523]: =>do_syncrepl Feb 5 13:11:37 dev5 slapd[2523]: => bdb_entry_get: ndn: "cn=syncrepl123,dc=myDomain,dc=com" Feb 5 13:11:37 dev5 slapd[2523]: => bdb_entry_get: oc: "(null)", at: "syncreplCookie" Feb 5 13:11:37 dev5 slapd[2523]: bdb_dn2entry("cn=syncrepl123,dc=myDomain,dc=com") Feb 5 13:11:37 dev5 slapd[2523]: => bdb_dn2id( "dc=myDomain,dc=com" ) Feb 5 13:11:37 dev5 slapd[2523]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) Feb 5 13:11:37 dev5 slapd[2523]: => bdb_entry_get: cannot find entry: "cn=syncrepl123,dc=myDomain,dc=com" Feb 5 13:11:37 dev5 slapd[2523]: =>do_syncrep2 thanks for you help ! Alain Hello, I use the bottom file "slapd.conf" to mirror master server. It was ok with 2.2.23-5 version of openldap. I just installed a new version of openldap : 2.3.27-8 Now the slave server start ok... but slapcat is empty !!?? Do you have an idea ? Thanks a lot, Alain slapd.conf _________ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema allow bind_v2 pidfile /var/run/slapd.pid argsfile /var/run/slapd.args loglevel 256 database bdb suffix "dc=myDomain,dc=com" rootdn "cn=Manager,dc=myDomain,dc=com" rootpw {SSHA}wuapktMrH50PDG29WoffJcmvpblebsdT directory /var/lib/ldap/myDomain.com index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryUUID eq access to * by * read syncrepl rid=123 provider=ldap://10.0.0.242:389 type=refreshOnly interval=00:00:01:00 searchbase="dc=myDomain,dc=com" filter="(objectclass=*)" attrs="*" scope=sub bindmethod=simple binddn="cn=Manager,dc=myDomain,dc=com" credentials="myPassword"

1 0

LDAP Master/Slave replication
by asiani＠free.fr 05 Feb '08

05 Feb '08

Hello, I use the bottom file "slapd.conf" to mirror master server. It was ok with 2.2.23-5 version of openldap. I just installed a new version of openldap : 2.3.27-8 Now the slave server start ok... but slapcat is empty !!?? Do you have an idea ? Thanks a lot, Alain slapd.conf _________ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema allow bind_v2 pidfile /var/run/slapd.pid argsfile /var/run/slapd.args loglevel 256 database bdb suffix "dc=myDomain,dc=com" rootdn "cn=Manager,dc=myDomain,dc=com" rootpw {SSHA}wuapktMrH50PDG29WoffJcmvpblebsdT directory /var/lib/ldap/myDomain.com index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryUUID eq access to * by * read syncrepl rid=123 provider=ldap://10.0.0.242:389 type=refreshOnly interval=00:00:01:00 searchbase="dc=myDomain,dc=com" filter="(objectclass=*)" attrs="*" scope=sub bindmethod=simple binddn="cn=Manager,dc=myDomain,dc=com" credentials="myPassword"

1 0

Exporting LDAP info from Active Directory / Exchange Global Address List
by Clemson, Chris (IHG) 04 Feb '08

04 Feb '08

Hi everyone, Hopefully I'm now sending this to the right list, apologies if not.... I am trying to find a way of exporting most information from the GAL into an LDAP server. It seems that OpenLDAP might do what I want, however I'm relatively new to using LDAP, so I was wondering if someone could give me a few pointers on how to do this. It sounds like I need to use a slapd as a Proxy Cache Engine, so I can cache an AD query (preferably the equivalent of the Exchange GAL) into OpenLDAP. People can then use the OpenLDAP server as a Directory source in Outlook without needing to log in to anything. I need to do something like this so that people who do not have access to the Exchange Servers can see (and therefore email) accounts in Exchange. I have found some mailing list articles that allude to this, but nothing specific. Thank you, Chris

2 2

Getent fonction with ldap
by asiani＠free.fr 04 Feb '08

04 Feb '08

Hello, I'm looking for a documentation of "howto configure getent with ldap", can you help me, i have problem with this fonction on centos 4.4 i can't get entries from ldap but i try to configure : /etc/pam.d/system-auth /etc/ldap.conf slapcat is ok i do : smbpasswd -w mypassword i put my conf at the bottom of this email, thanks for your help ! Alain /etc/pam.d/system-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. # Modif by AS auth required /lib/security/$ISA/pam_env.so auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass auth required /lib/security/$ISA/pam_deny.so account required /lib/security/$ISA/pam_unix.so account sufficient /lib/security/$ISA/pam_succeed_if.so uid < 100 quiet account required /lib/security/$ISA/pam_permit.so account sufficient /lib/security/$ISA/pam_ldap.so password requisite /lib/security/$ISA/pam_cracklib.so retry=3 password sufficient /lib/security/$ISA/pam_unix.so nullok use_authtok md5 shadow password required /lib/security/$ISA/pam_deny.so password sufficient /lib/security/$ISA/pam_ldap.so use_authtok session required /lib/security/$ISA/pam_limits.so session required /lib/security/$ISA/pam_unix.so session optional /lib/security/$ISA/pam_ldap.so /etc/ldap.conf host 127.0.0.1 #host 10.0.0.245 base dc=myDomain,dc=com rootbinddn cn=Manager,dc=myDomain,dc=com timelimit 120 bind_timelimit 120 idle_timelimit 3600 ssl no tls_cacertdir /etc/openldap/cacerts pam_password md5

2 3

password-hashing scheme
by Vinh.CTR.Hoang＠faa.gov 01 Feb '08

01 Feb '08

Hi, I'm have trouble trying to get a ldap client be authenicated by the the ldap server. I think the problem is that I might have the hash scheme configured wrongly or something like that. I'm on solaris 9 with Openldap 2.3.35. I have the password set as "clear" in the ldap.conf and password-hash as {MD5} in slapd.conf. Am I safe to assume that with these settings, it means that the client will be sent the passwords over the server as clear text and the server will hash it to MD5 before checking against its stored password list? If it is not the case, then how should I configure the client and server to be the case? Thanks, Vinh

4 5

Best method to set access permissions to third parties application with LDAP
by Benjamin Watine 01 Feb '08

01 Feb '08

Hello the list, I have to use LDAP to define access permissions for many third parties applications. So, I wonder what is the best way to organize my LDAP tree. I see two possibilities : - Set a LDAP group for each access level of each application, and create users that belongs to those groups. ex : GlobalServiceGroup | |__Application1Group | |__guestGroup | | |__user1 | | |__user2 | |__userGroup | | |__user3 | | |__user4 | |__adminGroup | |__Application2Group |__devTeamGroup | |__user1 | |__user2 | |__user3 | |__user4 |__testTeamGroup |__adminTeamGroup The problem of this solution is that I have to set a lot of groups, so my LDAP tree would became very complex to administrate. - Another way would be to define my own LDAP classes, with an attribute for each application that define the access level (guest, user, admin, etc). The problem of this solution is that I'm not anymore in the standard LDAP schema, and loose interoperability with standards LDAP clients. What is the best way to set that. Is there is another possibility than the two I mentioned before ? Thank you ! Ben

3 2

Re: Export / import ldap database between 2.2.29 & 2.3.27
by asiani＠free.fr 01 Feb '08

01 Feb '08

Ok thanks a lot !!!!! It is working now ! thks, Alain Buchan Milne wrote: > On Friday 01 February 2008 13:59:11 asiani(a)free.fr wrote: > >> # tail -n106 fichier_slapcat.ldif|head -n30 >> > > Now run this on both the old and the new server: > > # grep ^include /etc/openldap/slapd.conf > > It looks like your new server is missing inetorgperson.schema, and probably > many more. You should add the missing include lines to slapd.conf on your new > server, and try import again. > > Regards, > Buchan > >

1 0

Export / import ldap database between 2.2.29 & 2.3.27
by asiani＠free.fr 01 Feb '08

01 Feb '08

Hello, My source server : openldap-clients-2.2.29-1.FC3 perl-Net-LDAP-0.3202-1.1.fc3.rf nss_ldap-220-3 openldap-devel-2.2.29-1.FC3 php-ldap-4.3.11-2.8.4.legacy smbldap-tools-0.9.1-1.1.fc3.rf openldap-2.2.29-1.FC3 openldap-servers-2.2.29-1.FC3 My destination server : openldap-2.3.27-8 openldap-devel-2.3.27-8 perl-LDAP-0.33-3.fc6 php-ldap-5.1.6-15.el5 python-ldap-2.2.0-2.1 nss_ldap-253-5.el5 openldap-servers-2.3.27-8 I export my database from source : ldapsearch -LLL -x -h localhost -D "cn=Manager,dc=myDomain,dc=com" -w password -b "dc=myDomain,dc=com" > /backups/ldap/ldap-fs4-$TODAY.ldif dn: dc=myDomain,dc=com objectClass: dcObject objectClass: organization o: myDomain dc: myDomain dn: ou=Users,dc=myDomain,dc=com objectClass: organizationalUnit ou: Users dn: ou=Groups,dc=myDomain,dc=com objectClass: organizationalUnit ou: Groups dn: ou=Computers,dc=myDomain,dc=com objectClass: organizationalUnit ou: Computers dn: cn=NextFreeUnixId,dc=myDomain,dc=com objectClass: inetOrgPerson objectClass: sambaUnixIdPool cn: NextFreeUnixId sn: NextFreeUnixId gidNumber: 1001 uidNumber: 1154 dn: uid=smbguest3,ou=Users,dc=myDomain,dc=com objectClass: inetOrgPerson objectClass: sambaSamAccount objectClass: posixAccount objectClass: shadowAccount (...) and try to add in my destination server : slapadd -l fichier.ldif The system failed with this error : str2entry: invalid value for attributeType objectClass #1 (syntax 1.3.6.1.4.1.1466.115.121.1.38) slapadd: could not parse entry (line=69) The database is working well on source server...do y have an idea ? Thank you very much ! Alain

3 3

Pagination behavior using ldap_ctrl_paged
by Faraz R. Khan 01 Feb '08

01 Feb '08

Hi, Is there anyway I can navigate back and forth using the paged results control? The only thing I can currently use is going forward a certain pageSize. I realize this is exactly as per the RFC (2696) but is there anyway I can achieve back and forth pagination (pageSize = -3 for example)? Thank you. -- Faraz R Khan Chief Architect Emergen Consulting Pvt Ltd www.emergen.biz

2 1

ldap_search_ext_s: maximum no of entries
by Rakesh Yadav 31 Jan '08

31 Jan '08

Hi, In case of ldap_search_ext_s: We can pass,how many entries we want. In my case i can retrieve only 100 entries at a time due to the size limit of my buffer. But the ldap search which i am using will return 1000 entries. Is there any way through which i can retrieve 1000 entries in chunks of 100. first time i will fetch 100 entries then again next 100 entries then again next 100 entries..... ... ... In this way i will retrieve all the entries. Please tell me the way of fetching entries from LDAP. -- Thanks Rakesh Yadav

6 8

Please Help
by Umar Draz 31 Jan '08

31 Jan '08

Dear Members! I recently installed openldap and running successfully but there is some lines i saw in ldap log file. bdb_equality_candidates: (memberUid) not indexed bdb_equality_candidates: (sambaDomainName) not indexed Please help what is this and how i can fix that Kind Rgards, Umar Draz --------------------------------- Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now.

1 0

OpenLDAP Log format
by Gustavo Mendes de Carvalho 31 Jan '08

31 Jan '08

Hi there, I would like to know where can I find some document describing all fields and other informations about openldap log file and replication log file (slurp and syncrepl). Thanks in advance --- Gustavo Mendes de Carvalho e-mail: gmcarvalho(a)gmail.com

1 0

loglevel - ip client in logfile
by Christophe Dumonet 31 Jan '08

31 Jan '08

Hello from france, My question is about logs and so loglevel parameter for openldap 2.0 ( yes, this is and older version...! migration is in progress...) Basically, I want my logs contains IPs clients to do some tuning because of some CPU overloads occures while we are installing a new RADIUS client for this LDAP server. So I try to change my loglevel ( as describe here http://www.zytrax.com/books/ldap/ch6/#loglevel ) and no IP appears in logfile while loglevel is set to -1 (or whatever number). Is it possible ? Is my openldap version too old ? Is there other things to do ? Thanks, any help would be appreciate ! Christophe Dumonet. -- ---------------------------------------------------- Christophe Dumonet Centre de Ressources Informatiques Institut Francais de Mecanique Avancee (IFMA) Campus des Cezeaux BP 265 63175 AUBIERE Cedex Tel : +33 - 4.73.28.80.64 Fax : +33 - 4.73.28.81.00 Mail : Christophe.Dumonet(a)ifma.fr ----------------------------------------------------

1 0

Can't contact LDAP Server
by shanmuga priya 30 Jan '08

30 Jan '08

hello all, I was following the documentation to setup openLDAP stuff - http://www.jukie.net/~bart/ldap/ldap-authentication-on-debian/<http://www.jukie.net/%7Ebart/ldap/ldap-authentication-on-debian/> I've modified the ldap.conf and slapd.conf accordingly. But when I tried for testing by doing: ldapsearch -x -W -D 'cn=admin,dc=example' 'objectClass=*' I got the following message: Can't contact LDAP Server How to overcome this problem?? -- Future is now..

4 4

Querying for olcDatabase parameters
by Josh Miller 30 Jan '08

30 Jan '08

Good morning, What is the trick to querying cn=config for olcDatabase entries? I am running OpenLDAP 2.4.7 with a full directory, converted from slapd.conf to slapd.d and everything seems to be running just fine. I can query the directory and I get back all of the entries that I would expect to find. I have renamed my slapd.conf file to ensure that I am not relying upon it, yet I don't see any olcDatabase entries when I query cn=config: [:user@host:] ldapsearch -x -H ldap://localhost/ -D "cn=config" -b 'cn=config' -W cn=config -LLL Enter LDAP Password: dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /etc/openldap/slapd.conf olcConfigDir: /etc/openldap/slapd.d olcArgsFile: /var/run/openldap/run/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcLocalSSF: 71 olcLogLevel: 256 olcPidFile: /var/run/openldap/run/slapd.pid olcReadOnly: FALSE olcSaslSecProps: noplain,noanonymous olcSecurity: ssf=128 olcSecurity: tls=128 olcSecurity: update_ssf=128 olcSecurity: update_tls=128 olcSecurity: simple_bind=128 olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCACertificateFile: /usr/share/ssl/certs/posca3.crt olcTLSCertificateFile: /etc/pki/tls/certs/host.crt olcTLSCertificateKeyFile: /etc/pki/tls/certs/host.key olcTLSCipherSuite: HIGH:MEDIUM:+SSLv2:RSA olcTLSCRLCheck: none olcTLSVerifyClient: never olcToolThreads: 1 [:user@host:] ll /etc/openldap/slapd.d/cn\=config total 64 -rw------- 1 ldap ldap 398 Jan 10 13:22 cn=module{0}.ldif drwxr-x--- 2 ldap ldap 4096 Jan 10 13:22 cn=schema -rw------- 1 ldap ldap 38702 Jan 10 13:22 cn=schema.ldif -rw------- 1 ldap ldap 1163 Jan 10 13:22 olcDatabase={0}config.ldif drwxr-x--- 2 ldap ldap 4096 Jan 10 13:22 olcDatabase={1}bdb -rw------- 1 ldap ldap 2827 Jan 10 13:22 olcDatabase={1}bdb.ldif -rw------- 1 ldap ldap 1236 Jan 10 13:22 olcDatabase={-1}frontend.ldif TIA, -- Joshua M. Miller - RHCE,VCP

1 1

SSL/TLS connection on port 389
by Chris Carr 30 Jan '08

30 Jan '08

Hi All, I've been running slapd with "-h ldaps:///" so that it takes SSL/TLS connections on port 636. This has worked with most clients (Outlook, Seamonkey, Thunderbird) but does not work for Evolution. I don't know why not, but Evolution seems to insist on using port 389 for secure connections. When I type openssl s_client -connect my.server.com:389 It says connection refused. When I type the same command with :636 at the end it connects fine. Could somebody explain to me how to tell slapd to accept secure connections on port 389? I am using the new version of slapd in Debian Testing (2.4.7-1). Sorry if this is a really stupid question, but according to the docs the "startTLS" process should be automatic if a secure connection comes in on port 389. Something is obviously not quite right. Thanks in advance, Chris This e-mail may contain information which is confidential, legally privileged and/or copyright protected. This e-mail is intended for the addressee only. If you receive this in error, please contact the sender and delete the material from your computer

7 15

only ET_DYN and ET_EXEC can be loaded
by Pat Riehecky 29 Jan '08

29 Jan '08

When I started up my test slapd today I got the following message (along with a bunch of normal stuff): line 41 (moduleload smbk5pwd) lt_dlopenext failed: (smbk5pwd) /usr/lib/ldap/smbk5pwd.so.0: only ET_DYN and ET_EXEC can be loaded /etc/ldap/slapd.conf: line 41: <moduleload> handler exited with 1! What on earth does this mean? I spent some time on google to no avail. I know it doesn't like my .so.0 but (a) what doesn't it like and (b) how do I fix it? Pat

3 3

OpenLDAP and Solaris 10 - group problem
by Kick, Claus 29 Jan '08

29 Jan '08

Hello everyone, we are trying to use OpenLDAP to provide user management for a CMS. The CMS relies on OS groups to manage directory branch- and file-access. We are using the following group structure: dn: cn=ts_de_de_gg_ax, ou=Group, o=********** gidNumber: 1400 memberUid: uid=tsmaster, ou=People, o=********** memberUid: uid=teamsite, ou=People, o=********** memberUid: uid=ostehov9, ou=People, o=********** memberUid: uid=zenksid3, ou=People, o=********** memberUid: uid=lellirdg, ou=People, o=********** memberUid: uid=osteholdap, ou=People, o=********** objectClass: posixGroup objectClass: top cn: ts_de_de_gg_ax a user looks like this: dn: uid=osteholdap, ou=People, o=********* sn: osteholdap userPassword:: ********* loginShell: /bin/bash uidNumber: 3618 gidNumber: 504 mail: ****** objectClass: top objectClass: person objectClass: posixAccount objectClass: shadowAccount objectClass: teamsiteinfo objectClass: inetOrgPerson uid: osteholdap tcgid: Z000E58C gecos: *********** teamsiteuserrole: tsuser shadowLastChange: 11111 cn: ******* homeDirectory: /tmp However, it is not possible for a user to access directories belonging to a secondary group he belongs to. What could be the issue here? I would be very grateful for a pointer into the right direction. Regards, Claus Kick

3 4

Uniqueness of entryUUID across multiple LDAP servers
by Rakesh Yadav 29 Jan '08

29 Jan '08

Hi, Actually i am using multiple LDAP servers due to distributed environment. So our tree hierarchy can span over multiple LDAP servers. And i want to use entryUUID as a unique key for my entries of the tree. Can u tell me,entryUUID would be unique over multiple LDAP servers? Or in case of multiple LDAP servers, Two entries which are residing on different LDAP servers but belongs to the same Tree Hierarchy, can have same entryUUID? Regards Rakesh Yadav On Jan 25, 2008 10:36 PM, Michael Ströder <michael(a)stroeder.com> wrote: > Rakesh Yadav wrote: > > > > I got your idea about entryUUID, but can u give me some idea about how > > can i retrieve the value of entryUUID for each entry if it is supported > > by LDAP system. > > Since it's an operational attribute it is not returned by default from > OpenLDAP. You have to explicitly request it or request all operational > attributes with +. > > Example (lines might be wrapped): > ldapsearch -b "dc=stroeder,dc=de" -s base "(objectClass=*)" "*" entryUUID > > or > > ldapsearch -b "dc=stroeder,dc=de" -s base "(objectClass=*)" "*" + > > Ciao, Michael. > --

2 1

OpenLDAP+Active Directory
by Aiko Barz 28 Jan '08

28 Jan '08

Hello, is it possible to create an Active Directory forest with multible subdomains and make those informations available for one Linux machine? Right now, we have one domain and it is possible to do authentication against the Active Directory, while using OpenLDAP, PAM and Kerberos. But now, another department would like to have its own directory/sub-domain. This means: uid=xyz will be located on different directory servers within the Active Directory forest. That means, there are UIDs with different BASEDNs. CN=userA,OU=Users,DC=example,DC=local from AD1 and CN=userB,OU=Users,DC=sub,DC=example,DC=local from AD2 shall both be able to access a Linux box via SSH. No problem? Regards, Aiko -- :wq

4 7

RE: [SPAM] - Re: Syncrepl multimaster replication issue - Sending mail server found on zen.spamhaus.org
by Penza Kenneth at MITTS 28 Jan '08

28 Jan '08

Tonni, Thanks very much for your help. I have removed the compiled version of openldap (it was failing in 4 test in make test) and installed the packages from http://staff.telkomsa.net/packages. The tests worked without any issues and managed to configure openldap using syncrepl. Thanks for the help provided Kenneth Penza -----Original Message----- From: openldap-technical-bounces+kenneth.penza=gov.mt(a)openldap.org [mailto:openldap-technical-bounces+kenneth.penza=gov.mt@openldap.org] On Behalf Of Tony Earnshaw Sent: 24 January 2008 07:34 Cc: openldap-technical(a)openldap.org Subject: [SPAM] - Re: Syncrepl multimaster replication issue - Sending mail server found on zen.spamhaus.org Penza Kenneth at MITTS skrev, on 23-01-2008 11:06: > I am currently trying to setup a multi-master ldap setup. > The setup is running on CentOS 5.1 with kernel 2.6.18-53.el5. In this > setup I have migrated the UNIX authentication files using MigrationTools > and everything worked fine. When I am trying to setup the replication I > am encountering a strange behavior. The initial synchronization was > performed by copying /var/lib/ldap directory when openldap was shutdown. > On starting both nodes query each other and everything seems operating > correctly. When I perform a change on either node, the node performs the > local change however it is not propagated on the other node and in the > /var/log/ldap.log I get the following message: > > > > When ever the change is made on ldap1 it reports: > > Jan 23 10:10:43 ldap1 slapd[5787]: null_callback : error code 0x10 > > Jan 23 10:10:43 ldap1 slapd[5787]: syncrepl_updateCookie: rid=002 > be_modify failed (16) Apart from what Gavin writes, since you're using CentOS5.1, consider using Buchan Milne's Red Hat RHEL5 rpms or src rpm at http://staff.telkomsa.net/packages/. He's done an awful lot of work (has done for years) and patched things that need patching (apart from anything else db4.6) which should ensure things working out of the box on your system. Best, --Tonni -- Tony Earnshaw Email: tonni at hetnet dot nl

1 0

Read/Write locks for LDAP entry
by Rakesh Yadav 28 Jan '08

28 Jan '08

Hi, Actually i want to know whether we can acquire any kind of lock in openLDAP for entries. Suppose we read some entry and use this for doing some calculation and at the same time someone else modify this entry, so i want to know that LDAP provides any kind of lock just like RDBMS. In case of RDBMS we can acquire lock over any record so nobody can modify this until we release this lock. Please tell me about the locking mechanism in OpenLDAP. Thanks -- Rakesh Yadav Pune.

2 3

RFC 2307 and me
by Sean Myers 28 Jan '08

28 Jan '08

I'm currently using an LDAP directory to do a few jobs, including acting as a Network Information Server in a POSIX environment (Debian Linux) via libnss-ldap. It's working great, with authentication handled by Kerberos...simple and elegant SSO. The question I have about RFC 2307, though, stems from a few applications that I've encountered along the way that don't really do things in a POSIX way, and while they can sift through my "people" ou just fine with filters I provide, they generally want my groups to act like a groupOfNames entry, with full DN member attributeTypes, insead of the POSIX uid alone. Are the applications that I'm using simply being unreasonably inflexible? If so, they're all open-source and adding in support to do things the RFC 2307 POSIX way as well as the RFC 2256 groupOfNames way is not an unthinkably difficult task. My initial feeling on this is that not everything is POSIX compatible, not everything should be POSIX compatible, and it might be useful for me and others to be able to abandon RFC 2307 for defining groups in favor of RFC 2256, which appears to be the more "LDAP/X.500" way of doing things. I'm using this directory for a few services, and Linux NSS is really the only POSIX user in the bunch, so would it be "right" to instead fork and libnss-ldap to support RFC 2256 for my implementation? If so, has this been done already? Looking for input before I violate established best practice, and apologies if I've failed at searching. Thanks. -- Sean Myers System Administrator American Research Institute (919) 228-4961

2 1

openldap tls with a ca
by Dave 27 Jan '08

27 Jan '08

Hello, I'm trying to set up openldap for network authentication of both FreeBSD and Linux machines as well as integrating a samba pdc. I've created a ca with instructions found at: http://sial.org/howto/openssl/ca/ I've added the appropriate options to slapd.conf, for TLS as i don't want passwords going around in the clear. Slapd starts fine with tls options added, but if i do an ldapsearch -Z i get a can not contact ldap server. ldapsearch: # extended LDIF # # LDAPv3 # base <dc=davemehler,dc=com> (default) with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 13 Confidentiality required text: confidentiality required # numResponses: 1 I assume this is normal, but the below is what i'm getting with ldapsearch -Z ldapsearch -Z: ldap_start_tls: Connect error (-11) ldap_result: Can't contact LDAP server (-1) Here are the tls options i'm using: slapd.conf: security ssf=128 TLSCipherSuite HIGH TLSCertificateFile /usr/local/etc/openldap/tls/ldap.davemehler.com.crt TLSCertificateKeyFile /usr/local/etc/openldap/tls/ldap.davemehler.com.key TLSCACertificateFile /usr/local/etc/openldap/tls/ca-cert.pem #TLSDHParamFile I'm not sure what that last file is or how to make it, is it critical? /usr/local/etc/ldap.conf: ssl start_tls tls_cacert /usr/local/etc/openldap/tls/ca-cert.pem Checking /var/log/debug.log i'm seeing an error confidentiality required, as if ldap can't read the key, but as i said it's mode 644. Here's the complete transaction: Jan 27 15:20:04 ldap slapd[73647]: conn=6 fd=10 ACCEPT from IP=192.168.0.203:51704 (IP=0.0.0.0:389) Jan 27 15:20:04 ldap slapd[73647]: conn=6 op=0 BIND dn="" method=128 Jan 27 15:20:04 ldap slapd[73647]: conn=6 op=0 RESULT tag=97 err=0 text= Jan 27 15:20:04 ldap slapd[73647]: conn=6 op=1 SRCH base="dc=davemehler,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup))" Jan 27 15:20:04 ldap slapd[73647]: conn=6 op=1 SRCH attr=cn userPassword memberUid uniqueMember gidNumber Jan 27 15:20:04 ldap slapd[73647]: conn=6 op=1 SEARCH RESULT tag=101 err=13 nentries=0 text=confidentiality required Jan 27 15:20:04 ldap slapd[73647]: conn=6 fd=10 closed (connection lost) Any help appreciated. Thanks. Dave.

2 1

Unique id for each ldap entry
by Rakesh Yadav 25 Jan '08

25 Jan '08

Hi, I want to get unique ids for each ldap entry, but i don't know whether ldap provides unique id for each entry or not. In case of RDBMS each entry(tuple) has a OID(Object id) through which we can access uniquely this Entry. In case of LDAP, i need such (OID) kind of object identifier. Please tell me whether ldap provides some kind of unique id(Other than DN) for it's entries or not. If yes then please tell me how we can get these unique ids? -- Rakesh Yadav Pune.

3 4

migrating to another server - restore problem - slapcat slapadd
by Christophe Dumonet 24 Jan '08

24 Jan '08

Hello, I'm migrating from an old openldap server to a new one. So, I have done a dump of the ldap database with a " slapcat -l mydump.ldap -f /etc/openldap/slapd.conf -b "dc=mycompany,dc=com" --> So I had a dump ldif file where organisational units and dn are not in hierarchical order. In my new server ( which works fine , I can ldapadd some ou,dn , no problem) --> The slapadd command doesn't work because my ldap data in the ldif file is not in hierarchical order. I can't re-order manually this because it's a important database ( the ldif --> 50Mo). My slapadd command to restore is : slapadd -l mydump.ldif -f /etc/openldap/slapd.conf -b "dc=mycompany,dc=com" and the errors are relative to the ldif OU order, I had trying to cut/paste in the ldif file some OUs to reorder and errors are reporting to another OUs...which are not in hierachical order ! How can I do to restore quickly my data to my new server ? Any help would be appreciated, Christophe Dumonet, From france -- ---------------------------------------------------- Christophe Dumonet Centre de Ressources Informatiques Institut Francais de Mecanique Avancee (IFMA) Campus des Cezeaux BP 265 63175 AUBIERE Cedex Tel : +33 - 4.73.28.80.64 Fax : +33 - 4.73.28.81.00 Mail : Christophe.Dumonet(a)ifma.fr ----------------------------------------------------

4 6

Syncrepl multimaster replication issue
by Penza Kenneth at MITTS 23 Jan '08

23 Jan '08

People, I am currently trying to setup a multi-master ldap setup. The setup is running on CentOS 5.1 with kernel 2.6.18-53.el5. In this setup I have migrated the UNIX authentication files using MigrationTools and everything worked fine. When I am trying to setup the replication I am encountering a strange behavior. The initial synchronization was performed by copying /var/lib/ldap directory when openldap was shutdown. On starting both nodes query each other and everything seems operating correctly. When I perform a change on either node, the node performs the local change however it is not propagated on the other node and in the /var/log/ldap.log I get the following message: When ever the change is made on ldap1 it reports: Jan 23 10:10:43 ldap1 slapd[5787]: null_callback : error code 0x10 Jan 23 10:10:43 ldap1 slapd[5787]: syncrepl_updateCookie: rid=002 be_modify failed (16) When ever the change is made on ldap2 it reports: Jan 23 10:40:31 ldap2 slapd[5677]: null_callback : error code 0x10 Jan 23 10:40:31 ldap2 slapd[5677]: syncrepl_updateCookie: rid=002 be_modify failed (16) Setup details: cd /root/ldap_inst tar xvzf db-4.6.21.tar.gz tar xvzf openldap-2.4.7.tgz cd db-4.6.21 cd build_unix/ ../dist/configure --prefix=/usr make clean (as root) make (as root) cd /usr/share/libtool/libltdl configure --prefix=/usr make make install (as root) cd /root/ldap_install/openldap-2.4.7 ./configure --prefix=/usrd /usr/share/libtool/libltdl./configure --prefix=/usr --sysconfdir=/etc --libexecdir=/usr/sbin --mandir=/usr/share/man --with-tls --without-cyrus-sasl -enable-modules -enable-bdb=mod -enable-hdb=mod -enable-ldap=mod --enable-crypt make depend make make install (as root) This procedure was completed on two nodes, namely ldap1 and ldap2. This slapd.conf of each nodes is as follows: Ldap1: cat /etc/openldap/slapd.conf | grep -v ^# | grep -v ^$ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/misc.schema allow bind_v2 pidfile /var/run/slapd.pid argsfile /var/run/slapd.args modulepath /usr/sbin/openldap moduleload back_bdb.la TLSCipherSuite HIGH:MEDIUM:+TLSv1:+SSLv2:+SSLv3 TLSCACertificateFile /etc/openldap/cacert.pem TLSCertificateFile /etc/openldap/slapd-cert-ldap1.pem TLSCertificateKeyFile /etc/openldap/slapd-key-ldap1.pem serverID 1 ldap://ldap1:389/ serverID 2 ldap://ldap2:389/ database bdb suffix "dc=linuxldap,dc=org" rootdn "cn=Manager,dc=linuxldap,dc=org" rootpw secret directory /var/lib/ldap checkpoint 128 15 cachesize 10000 dncachesize 5000 idlcachesize 30000 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 index objectClass,entryUUID,entryCSN eq #syncRepl rid=001 # provider=ldap://ldap1:389 # binddn="cn=Manager,dc=linuxldap,dc=org" # bindmethod=simple # credentials=secret # searchbase="dc=linuxldap,dc=org" # type=refreshOnly # interval=00:00:00:05 # retry="5 5 300 5" # timeout=1 syncRepl rid=002 provider=ldap://ldap2:389 binddn="cn=Manager,dc=linuxldap,dc=org" bindmethod=simple credentials=secret searchbase="dc=linuxldap,dc=org" type=refreshOnly interval=00:00:00:05 retry="5 5 300 5" timeout=1 mirrormode true sockbuf_max_incoming 5000 sockbuf_max_incoming_auth 5000 database monitor Ldap2: cat /etc/openldap/slapd.conf | grep -v ^# | grep -v ^$ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/misc.schema allow bind_v2 pidfile /var/run/slapd.pid argsfile /var/run/slapd.args modulepath /usr/sbin/openldap moduleload back_bdb.la TLSCipherSuite HIGH:MEDIUM:+TLSv1:+SSLv2:+SSLv3 TLSCACertificateFile /etc/openldap/cacert.pem TLSCertificateFile /etc/openldap/slapd-cert-ldap1.pem TLSCertificateKeyFile /etc/openldap/slapd-key-ldap1.pem serverID 1 ldap://ldap1:389/ serverID 2 ldap://ldap2:389/ database bdb suffix "dc=linuxldap,dc=org" rootdn "cn=Manager,dc=linuxldap,dc=org" rootpw secret directory /var/lib/ldap checkpoint 128 15 cachesize 10000 dncachesize 5000 idlcachesize 30000 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 index objectClass,entryUUID,entryCSN eq syncRepl rid=001 provider=ldap://ldap1:389 binddn="cn=Manager,dc=linuxldap,dc=org" bindmethod=simple credentials=secret searchbase="dc=linuxldap,dc=org" type=refreshOnly interval=00:00:00:05 retry="5 5 300 5" timeout=1 #syncRepl rid=002 # provider=ldap://ldap2:389 # binddn="cn=Manager,dc=linuxldap,dc=org" # bindmethod=simple # credentials=secret # searchbase="dc=linuxldap,dc=org" # type=refreshOnly # interval=00:00:00:05 # retry="5 5 300 5" # timeout=1 mirrormode true sockbuf_max_incoming 5000 sockbuf_max_incoming_auth 5000 database monitor Regards, Kenneth Penza

3 2

Ldap ppolicy schema entries
by Ljunghammar, Darryl K 23 Jan '08

23 Jan '08

I would like to view the ppolicy schema attributes for a user when I do a "ldapsearch" but they don't show up. For example, I would like to see the "pwdHistory" attribute for a user. I know it is being updated because if I enter a previously used password it tells me it can't be reused. I am using openldap 2.3.39-3 on a Redhat 5.1 system. TIA, Darryl

2 1

Adding new LDIF entries
by David Moderski 23 Jan '08

23 Jan '08

I am having trouble finding the correct information about adding new entries. For example, if I am loading the initial directory, do the entries need to have changetype: add or is changetype: add only used for adding attributes to existing entries? -- Dave Moderski Programmer/Analyst Atlantic Cape Community College 609-625-1111 ext. 5298

2 1

Need a multi-client schema
by Carr, Chris 23 Jan '08

23 Jan '08

[deep breath, disclaimer: I am a knowledgeable end user, having administered a LAN of Linux and Windows PCs at home for several years, but I don't code and I knew nothing of LDAP until recently. I originally submitted this to openldap-software, but the moderator said it was more appopriate for this list. I have lurked for a week with increasing agitation at my lack of technical knowledge - apologies if this question is too stupid for most of you.] I run an IMAP server on my Linux box at home (Debian Etch), so that I can read my mail from anywhere, using any IMAP client (Outlook at work, Evolution at home, Thunderbird at my in-laws, etc.). I got frustrated with having to export and import my contacts all the time, never remembering which client had the most up-to-date set. So I looked into setting up my own LDAP server so they could live in one place, available to any client, just like the email. Sadly it doesn't seem to be that simple. Apt-get install slapd went fine - Debian was even so kind as to set up a bdb database for me with suffix "dc=mydomain", so all I had to do was create a rootdn and rootpw in slapd.conf. I painstakingly exported my contacts from Outlook as CSV, via Evolution as vCard then via http://labs.brotherli.ch/vcfconvert/ into LDIF. But trying to import the result into slapd gave lots of errors, and this is when I discovered the joys of schemata. The vCard-to-LDIF converter uses a variant Mozilla-address-book schema which slapd doesn't understand. I tried tweaking the LDIF file with this python script (http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/476224) but that fell over because some of my contacts don't have email addresses. So slapd is up and running but I have no way of importing my contact info without doing some Python hacking or re-keying the info (about 400 records). Basic question: is there an existing schema that I can include in slapd.conf which will allow my contacts to be intelligible to all the clients I use (let alone might use)? They are just basic person data: names, postal addresses, phone/fax numbers, email addresses, etc. Assuming no, can I combine a schema for each client, if I can find one? For example, the Mozilla one is here (https://bugzilla.mozilla.org/attachment.cgi?id=166746), which will work for Thunderbird, SeaMonkey etc. If I can find one for Evolution and one for Outlook, could I just include them all, or would there be incompatibilities? (Even if there aren't, a quick look at the Mozilla one leads me to suspect that I would need to duplicate numerous fields.) Does anyone successfully use LDAP with multiple clients? Is there an easy way to do it? Judging from the 'AD-style AUX classes' thread there are some issues with Outlook - in the first instance I would be happy if both Evolution and Thunderbird/SeaMonkey could see and edit the same contact data. Thanks in advance for any help, and apologies for the lengthy footer over which I have no control, CC This e-mail may contain information which is confidential, legally privileged and/or copyright protected. This e-mail is intended for the addressee only. If you receive this in error, please contact the sender and delete the material from your computer

3 7

Openldap / windows active directory sync
by अनुज Anuj Singh 23 Jan '08

23 Jan '08

Hi, I have one microsoft windows active directory server, 1. How to implement Openldap and Windows dircetory sync so that any user can get authorized from Openldap or M$ active directory. 2. User information/password sync How to sync windows Active directory with Openldap vice-versa. any tutorial/ how to? Thanks and regards Anuj

1 0

openldap 2.4.7 Segfault when deleting olcAccess parameter from cn=config
by Faraz Khan 22 Jan '08

22 Jan '08

When trying to delete a single olcAccess attribute from cn=config the openldap server crashes. The client library (php) returns error code -1 (cant contact LDAP Server) and the openldap server crashes. The delete operation is: dn: olcDatabase={2}bdb,cn=config changetype: modify delete: olcAccess olcAccess: 2 This behavior is not consistent. Sometimes the server crashes while sometimes it will report back : modifying entry "olcDatabase={2}bdb,cn=config" ldap_modify: No such attribute (16) It might continue to say Error 19 for a while (3-4 times) and on the 5th time the operation completes successfully. However, the dn at this time seems to contain NO entries. After this slapd crashes. Restarting will show that the operation was never ACTUALLY completed. The segfault trace is: ber_dump: buf=0x82c1ef0 ptr=0x82c1ef3 end=0x82c1f2c len=57 0000: 66 37 04 1c 6f 6c 63 64 61 74 61 62 61 73 65 3d f7..olcdatabase= 0010: 7b 32 7d 62 64 62 2c 63 6e 3d 63 6f 6e 66 69 67 {2}bdb,cn=config 0020: 30 17 30 15 0a 01 01 30 10 04 09 6f 6c 63 61 63 0.0....0...olcac 0030: 63 65 73 73 31 03 04 01 32 cess1...2 conn=0 op=3 do_modify: dn (olcdatabase={2}bdb,cn=config) ber_scanf fmt ({e{m[W]}}) ber: ber_dump: buf=0x82c1ef0 ptr=0x82c1f15 end=0x82c1f2c len=23 0000: 30 15 0a 01 01 30 10 04 09 6f 6c 63 61 63 63 65 0....0...olcacce 0010: 73 73 31 03 04 01 32 ss1...2 >>> dnPrettyNormal: <olcdatabase={2}bdb,cn=config> => ldap_bv2dn(olcdatabase={2}bdb,cn=config,0) <= ldap_bv2dn(olcdatabase={2}bdb,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={2}bdb,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={2}bdb,cn=config)=0 <<< dnPrettyNormal: <olcDatabase={2}bdb,cn=config>, <olcDatabase={2}bdb,cn=config> conn=0 op=3 modifications: delete: olcaccess one value, length 1 conn=0 op=3 MOD dn="olcDatabase={2}bdb,cn=config" conn=0 op=3 MOD attr=olcaccess <= acl_access_allowed: granted to database root Segmentation fault -- Faraz R Khan Chief Architect Emergen Consulting Pvt Ltd www.emergen.biz

2 1

> posixGroup & memberOf
by vip43＠mail.ru 22 Jan '08

22 Jan '08

Hi colleagues, HOW to make posixGroup a memberOf another posixGroup?? ... : nis.schema > posixGroup objectclass : ---------- objectclass ( 1.3.6.1.1.1.2.2 NAME 'posixGroup' DESC 'Abstraction of a group of accounts' SUP top STRUCTURAL MUST ( cn $ gidNumber ) MAY ( userPassword $ memberUid $ member $ description ) ) ----------- and where is "memberOf" ?? it seems it must present in MUST.., IMHO openldapAdminGuide promised to add "memberOf attr to posixGroup..,. can i do it myself ?? And what GUI-tool can rule this moment ??,- i'm using http://ldapadmin.sourceforge.net/ , but it can't.

2 3

AD-style AUX classes
by Andrew Bartlett 21 Jan '08

21 Jan '08

I'm not quite sure what I'm looking for here, sorry: In Samba4, we don't yet have full schema validation. In some ways it just has not been a priority - we validate that the attribute and objectClasses exist, but not that they match up. In using OpenLDAP, I'm hoping to avoid having to write that logic, so I stopped adding extensibleObject to all our objectClass values, and replaced it with samba4Top, contaning all the things that AD's top contains, but OpenLDAPs does not. So far so good, but AD has: dn: CN=Domain-DNS,${SCHEMADN} objectClass: top objectClass: classSchema subClassOf: domain systemAuxiliaryClass: samDomain Looking at http://www.grotan.com/ldap/microsoft.ext.schema I created entries in my schema file like: dITContentRule ( 1.2.840.113556.1.5.67 NAME 'domainDNS' AUX ( samDomain ) ) dITContentRule ( 1.2.840.113556.1.5.3 NAME 'samDomain' AUX ( samDomainBase ) ) This created two problems: It appears that you cannot create a ditContentRule for a non-structural objectClass (samDomain is AUXILIARY), and even if I do, I can't tack on the samba4Top on the end, because of: Adding DomainDN: DC=samba,DC=example,DC=com (permitted to fail) ldb load failed: LDAP error 65 LDAP_OBJECT_CLASS_VIOLATION - <class 'samba4Top' not allowed by content rule 'domainDNS'> <> Is there a different approach I should be taking? I need to extend 'top' without extending OpenLDAP's hardcoded top, and I need something that looks like dITcontentRule without the restrictions. Any hints? Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

5 16

MinGW, OpenLDAP and OpenSSL
by Jonathan Bowman 20 Jan '08

20 Jan '08

Greetings all, I recently set out to compile OpenLDAP with SSL/TLS on Windows using MinGW, so that I could compile Ruby/LDAP and python-ldap. It took me a while to find my way, and I frequently wished there were easy instructions online, all in one place. Once I successfully finished, I posted my instructions here: http://bowmansolutions.com/mingw-openldap/ I would love feedback on these instructions, affirmation or criticism. My apologies if they duplicate what is already out there. Regards, Jonathan Bowman

2 2

sql to ldap MD5 conversion
by Antoine Jacoutot 18 Jan '08

18 Jan '08

Hi. After several failed attempts, I need some help regarding the following issue. I need to import some users from a MySQL database to OpenLDAP. I cannot find a working way of converting the md5 password stored in the database (using md5() ) to the {MD5} password format for Ldap. e.g: SQL: the md5 value of 'password' is 5f4dcc3b5aa765d61d8327deb882cf99 OpenLDAP: the result of `slappasswd -h {MD5} -s password` is {MD5}X03MO1qnZdYdgyfeuILPmQ== So obviously I won't be able to use {MD5}5f4dcc3b5aa765d61d8327deb882cf99 >From what I could gather it has to do with Base64 encoding but all my attemps at scripting something failed miserably :( Any hint would be appreciated. Thanks! -- Antoine

2 2

automatic charset conversion?
by Stefan Palme 18 Jan '08

18 Jan '08

Hi, using an OpenLDAP server installation for several things. One thing is a shared addressbook which is used by different persons with different client applications. Some of them have a locale of "de_DE.utf8", some of them work with "de_DE.latin1", some of them use windows and so have a win-1250-or-whatever encoding. When creating new addressbook entries these are transfered from the client to the server in the clients charset encoding. When clients with other encodings read these entries they seem somehow broken - of course. How to solve this problem? When the server known the "client encoding" the server could automatically convert clients data into e.g. utf8 before storing it. Before sending data back to a client it could convert all the stored utf8-data into client's encoding. But I did not found a way to tell the server the client's encoding, so this seems to be no way. Are there any working solutions for this? Regards -stefan- -- ------------------------------------------------------------------- Dipl. Inf. (FH) Stefan Palme email: kleiner(a)hora-obscura.de www: http://hbci4java.kapott.org http://converter-db.de icq: 36376278 key fingerprint: 1BA7 D217 36A1 534C A5AD F18A E2D1 488A E904 F9EC -------------------------------------------------------------------

2 2

Coverity Report for Openldap library
by meow＠computer.org 17 Jan '08

17 Jan '08

Hi : Our development project is using Openldap library, currently using version 2.2.26, planning to migrate to a newer version. And, recently, I saw in scan.coverity is generating Error report for Openldap library . So, I downloaded the latest stable release 2.3.39, check the CHANGES doc to see if coverity fixes were included; but this doc didn;t mention anything regarding fixes for Coverity Error . Just want to know if latest stable release 2.3.39 contain the fixes to the Error reported in the Coverity ? And, how can I get access to the Coverity Report for Openldap library ? Thanks in advance for your time and information! Regards, Yen

2 1

Re: sles 10 synchronize 2 ldapservers
by bakkerru 16 Jan '08

16 Jan '08

Hi, The two directories must contain the same users and groups, and when i add a user on ldapserver off.company.nl it also has to be automativcally create the user on the second ldapserver mail.company.nl. i use openldap 2.3.32 on off.company.nl and 2.2.24 on mail.company.nl regards ruurd -----Oorspronkelijk bericht----- Van: openldap-technical-bounces+ruurd.bakker=ppc.nl(a)OpenLDAP.org [ <mailto:openldap-technical-bounces+ruurd.bakker=ppc.nl@OpenLDAP.org> mailto:openldap-technical-bounces+ruurd.bakker=ppc.nl@OpenLDAP.org] Namens Buchan Milne Verzonden: woensdag 16 januari 2008 7:48 Aan: openldap-technical(a)openldap.org CC: bakkerru Onderwerp: Re: sles 10 synchronize 2 ldapservers On Tuesday 15 January 2008 17:42:08 bakkerru wrote: > Question: > > How can i sychronize the users and groups of 2 ldap servers. 1 is > setup as pdc with samba and openldap (SLES10) domain "off.company.nl" > and the other is our mailserver installed with ldap and openexchange > (SLES9.3) domain mail.company.nl. how can i sync the users between > both. The mailserver is in a DMZ. You seem to have two issues here, and you're not clear which one you are trying to address. 1)Are you trying to merge the contents of two different directories? or 2)Are you trying to ensure that the contents of the directory on one server is available on another server? or 3)both? I am not aware of tools to merge the contents of two directories, but you could either do it manually, or write some scripts (which would depend on the contents of the directories). Once you have one directory containing all the information, use the replication tools which are provided to keep the directory in sync across your two servers. To be able to recommend which replication tool to use, you need to supply the versions of OpenLDAP you are using (which may generate a recommendation to upgrade at least one of them ...). Regards, Buchan

4 3

Script to check connections made
by Gustavo Mendes de Carvalho 16 Jan '08

16 Jan '08

Hi All, I would like to know if somebody has some script or knows where I can find one, that reads ldap.log file and creates a report where it's possible to check who logged in which machine, and when this connections was made. Regards --- Gustavo e-mail: gmcarvalho(a)gmail.com

5 5

Expired password notification
by Andris Eiduks 16 Jan '08

16 Jan '08

Hi! We use OpenLDAP for user's authentication. And now also implemented password policy. Authentication from Tomcat works without problem but customers find out about expired passwords only after unsuccessful binding when all limits are exceeded. ldapsearch with option "-e ppolicy" shows info about necessary password change. Is possible to get the same info by BIND operation performing from other systems side again OpenLDAP? Or we must create special functions in application for user attributes checking (pwdChangedTime, pwdGraceUseTime) and notification generation ? Thanks in advance,

4 6

how to change attribute display order
by Winanjaya - CBN 16 Jan '08

16 Jan '08

Dear All, How do I change attribute display order? ..(ie. sn, cn to cn, sn) .. pls advise thanks & regards Winanjaya *********************** Our outgoing mail has been scanned by MSS. ***********-***********

3 2

Subtree renames and memberOf handling
by Andrew Bartlett 16 Jan '08

16 Jan '08

I perhaps should have flagged this earlier, but I wanted to actually have the test to prove it. It appears that subtree renames and the memberOf plugin are not handled correctly. That is: I create cn=ldaptestuser4,cn=ldaptestcontainer,DC=samba,DC=example,DC=com I add it to a group: dn: cn=ldaptestgroup2,cn=users,DC=samba,DC=example,DC=com changetype: modify add: member member: cn=ldaptestuser4,cn=ldaptestcontainer,DC=samba,DC=example,DC=com Then I rename the container CN=ldaptestcontainer,DC=samba,DC=example,DC=com into CN=ldaptestcontainer2,DC=samba,DC=example,DC=com However, when I search: [abartlet@naomi source]$ bin/ldbsearch -H st/dc/private/sam.ldb "cn=ldaptestgroup2" # record 1 dn: CN=ldaptestgroup2,CN=Users,DC=samba,DC=example,DC=com member: cn=ldaptestuser,cn=useRs,dc=samba,dc=example,dc=com member: cn=ldaptestcomputer,cn=computers,dc=samba,dc=example,dc=com member: cn=ldaptestuser2,cn=users,dc=samba,dc=example,dc=com member: cn=ldaptestuser4,cn=ldaptestcontainer,dc=samba,dc=example,dc=com [abartlet@naomi source]$ bin/ldbsearch -H st/dc/private/sam.ldb "cn=ldaptestuser4" # record 1 dn: CN=ldaptestuser4,CN=ldaptestcontainer2,DC=samba,DC=example,DC=com cn: ldaptestuser4 memberOf: cn=ldaptestgroup2,cn=users,dc=samba,dc=example,dc=com The 'member' attribute on the group is wrong, most likely because such a subtree rename would never cause the memberOf module to fire and notice that this needs updating. Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

3 14

memberOf hidden?
by Andrew Bartlett 16 Jan '08

16 Jan '08

One of the odd things I've noticed since moving to OpenLDAP managing memberOf is that memberOf is a hidden attribute by default. Is that because it is treated as operational (due to being managed by the module)? I can un-hide it for Samba (I have code that adds a list of attributes to any query for *), but I just wanted to check there wasn't a more elegant way to do it. Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

4 19

LDAP and oracle
by florian.engelmann＠bt.com 16 Jan '08

16 Jan '08

Hi, We just migrated our unix/linux accounts to LDAP. We decided to migrate every user account that can login (except root) to LDAP. Now we have heavy load on our LDAP systems and I think this is because we also migrated the oracle users that are running our oracle databases. This is because the oracle admins log on the systems using the user the database is running with. I do not know that much about oracle but is it mandatory to administrate an oracle database with the same user? Does it make sense to migrate systemusers to ldap? Florian Engelmann

2 3

sles 10 synchronize 2 ldapservers
by bakkerru 15 Jan '08

15 Jan '08

Question: How can i sychronize the users and groups of 2 ldap servers. 1 is setup as pdc with samba and openldap (SLES10) domain "off.company.nl" and the other is our mailserver installed with ldap and openexchange (SLES9.3) domain mail.company.nl. how can i sync the users between both. The mailserver is in a DMZ. thanks in advantage Ruurd

4 3

objectIdentifier Macros?
by Gavin Henry 15 Jan '08

15 Jan '08

Evening all, Are OID Macros specific to slapd? Thanks. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

2 4

update with perl
by alois blasbichler 15 Jan '08

15 Jan '08

Hello list We use openldap 2.3.39. I want to add with a perl-script to all my users this attributes : objectClass: orcluser orclpassword: xxxxxxxxx I dont now how do that with a script. Actually my users haves this objectClasses : objectClass: top objectClass: hordePerson objectClass: shadowAccount objectClass: posixAccount objectClass: person objectClass: inetOrgPerson objectClass: SuSEeMailObject objectClass: sambaSamAccount I defined an : objectclass ( 1.1.2.881.881.555.666 NAME 'inetorcluser' DESC 'inetorcluser' SUP ( inetOrgPerson $ orcluser ) STRUCTURAL ) And so when i with an ldap-browser export an user, then after deleting this user i add in the ldif-datei the followings attributes: objectClass: inetorcluser objectClass: orcluser orclpassword: xxxxxxxxx then i can import this user fine. That for one user is ok but for a lot of users how can i do that - i tried with perl - but without success. Thanks in advanced for any help. luis

3 3

Silly details like CN= v cn=
by Andrew Bartlett 13 Jan '08

13 Jan '08

I've been working on making Samba4 pass it's testsuite with OpenLDAP as a backend. One of my tests does what no LDAP client should do - it applies a case sensitive comparison of the returned DN, compared with what we expect and get from AD. For example, we search for cn=ldaptestmachine and then ensure we get: CN=ldaptestmachine,CN=Users,DC=samba,DC=example,DC=com OpenLDAP returns cn=ldaptestmachine,cn=users,dc=samba,dc=example,dc=com which I'm sure is perfectly valid, but if I can write a bodgy script with case sensitive comparisons, so can an admin or sloppy app. Working in the windows space makes me like to eliminate differences where I can. Can the case of the attribute names (CN and DC) in that DN be made to be UPPER case easily? (Alternately I'll write a filter module on the Samba4 side to do that). Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

4 11

Chain authentication bind configuration
by Dave Stoll 13 Jan '08

13 Jan '08

Hello - I seem to have run into a bit of a roadblock with my configuration. I am trying to build an OpenLDAP server which uses ref: entries to chain to two other LDAP servers for user authorization. I have been able to get everything working fine so long as I allow anonymous binding on the servers referenced from OpenLDAP. Unfortunately, the security folks are requesting the OpenLDAP server to force bind credentials for the particular ldap uri. >From man slapd-ldap(5) I see the following: acl-bind ... This identity is by no means implicitly used by the proxy when the client connects anonymously. The idassert-bind feature, instead, in some cases can be crafted to implement that behavior, which is intrinsically unsafe and should be used with extreme care. This directive obsoletes acl-authcDN, and acl- passwd. ... Unfortunately, I¹m having a bit of difficulty finding any documentation supporting the ability to implicitly use a particular bindDN and simple authentication password, regardless of whether the query is anonymous or authenticated. Any help would be welcome. Cheers, Dave -- Dave Stoll echo mac | sed 's/^/dave.stoll(a)/;s/$/.com/'

2 6

NOOP and case change renames
by Andrew Bartlett 10 Jan '08

10 Jan '08

I'm up against my next challenge in the great challenge of Samba4 and OpenLDAP. As metioned on openldap-devel, I've hit up against renaming DNs onto themselves. For example, I previously mentioned cn=ldaptestuser2,cn=users,DC=samba,DC=example,DC=com into cn=ldaptestuser3,cn=users,DC=samba,DC=example,DC=com This should become: dn: cn=ldaptestuser2,cn=users,DC=samba,DC=example,DC=com changetype: modrdn newrdn: cn=ldaptestuser2 deleteoldrdn: 1 > RFC 4511 states that a modify DN operation must fail with the > entryAlreadyExists result code if there was already an entry with that > name. However, a broad interpretation would recognize that such a > modify DN operation is going to be a no-op and simply ignore it. The > specific case doesn't seem to be explicitly dealt with in RFC 4511. I've written a module to cause this to never reach the DB, but my next test (which AD also permits) is: cn=ldaptestuser3,cn=users,DC=samba,DC=example,DC=com into cn=ldaptestUSER3,cn=users,DC=samba,DC=example,DC=com So it seems I need some backend help. Is there another way I should be handling case changes in a DN, or could/should the DB be modified to allow these operations? (These tests arose because a user tried to do exactly this from the windows management tools, and we also failed to allow it in ldb). Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

2 5

Newbie - how to change display name settings
by Winanjaya - CBN 09 Jan '08

09 Jan '08

Hello All, I am very new with this, I have configured openldap on my FC1 .. Currently, the Display name settings is Last Name, First Name .. how to change it to FirstName, Last Name? Please help Thanks & Regards Winanjaya *********************** Our outgoing mail has been scanned by MSS. ***********-***********

4 7

simple-auth to SASL mapping?
by Stefan Palme 08 Jan '08

08 Jan '08

Hi all, I have setup an OpenLDAP server for users authenticating using SASL. The authz-regexp "converts" the SASL identity into a DN which is used only for authorization purposes - there are no real LDAP entries with these DNs. This setup works fine. Now I have some LDAP client applications that only support simple authentication, but no SASL authentication. So I am looking for a way to "map" simple authentication to SASL authentication, e.g. when a user uses simple auth with DN "cn=user1,ou=users,dc=domain,dc=com" this mechanism should authenticate this user via SASL using username "user1" and the provided password. I absolutely DO NOT WANT to create real LDAP entries for these users, because the user database is an external one accessed via SASL->PAM->COMPLICATED_PAM_MODULES, and I dont want to manage user accounts in two places :-) Is this possible? I already thought about using an "ldap"-backend to proxy simple-auth-connections, but I did not found a way to just "rewrite" the authentication information and make the proxy server using SASL with a username extracted from the simple auth DN... Thanks and best regards -stefan-

2 2

Regarding ldap client library with php ldap exop patch
by Faraz Khan 08 Jan '08

08 Jan '08

This is regarding the php ldap exop patch published by Pierangelo Masarati at : http://www.sys-net.it/~ando/Download/#PHP%3E I BADLY require paged results for my ldap based application. The patch applies fine to PHP 5_2 HEAD. However, two things need to be changed. 1. the zstr struct does not exist, which needs to be defined. This is not a problem. Solved with some help from PHP developers on what zstr is. 2. In the function php_ldap_do_search(INTERNAL_FUNCTION_PARAMETERS, int scope) in ldap.c, timelimit is set to -1 as follows: int ldap_attrsonly = 0; int ldap_sizelimit = -1; int ldap_timelimit = -1; The ldap_search operation keeps on returning a LDAP ERROR : Timeout in this case. Modifying timelimit to : int ldap_timelimit = 300; for example fixes the issue and pagination works. I'm guessing the following is what causes problems: #ifdef HAVE_LDAP_SEARCH_EXT_S /* Run the actual search */ { int rc; struct timeval tv; tv.tv_sec = ldap_timelimit; tv.tv_usec = 0; rc = ldap_search_ext(ld->link, ldap_base_dn, scope, ldap_filter, ldap_attrs, ldap_attrsonly, NULL, NULL, &tv, ldap_sizelimit, &rcs[i] ); /* TODO: check rc == LDAP_SUCCESS */ } the tv.tv_usec=0 when tv.tv_sec = -1 Just a hunch. How does ldap_search_ext handle timelimit? Thank you. I currently have it set to 300, which is bad, and it seems to be working fine. Please remember the problem (with the patch applied) happens not only to paged requests but any ldap_search request (keeps timing out instantaneously) -- Faraz R Khan Chief Architect Emergen Consulting Pvt Ltd www.emergen.biz

1 0

Password expiration question (ppolicy and smbk5wpd interaction)
by Pat Riehecky 07 Jan '08

07 Jan '08

Like many before me I would love to get the smbk5pwd module up and running, but I have a question. In OpenLDAP 2.4.7: If I set a password expiration time up (with ppolicy), and the user's password expires, does it lock the Heimdal, Samba, and ldap passwords? On the flip side, if I set a password expiration time up (with smbk5pwd), and the user's password expires, does it lock the Heimdal, Samba, and ldap passwords? Or perhaps more to the point, what can I do to keep all three of these passwords either all valid or all expired at the same time? The documentation is a bit vague on this one point, and the archives left me still in confusion..... Pat

3 2

Decoding error when splitting a DN with ldap_str2dn()
by Michael Ströder 07 Jan '08

07 Jan '08

HI! I have a problem splitting a DN with ldap_str2dn(). Actually I'm using it from python-ldap but judging from the debug output there does not seem to be an issue with passing the DN to the OpenLDAP API (see Python console output below). Any clue what's wrong with this DN? OID.0.2.262.1.10.7.20=1 + CN=DIR DATEV D12 1:PN, O=DATEV eG, C=DE BTW: Removing the spaces around , and + does not help either. Ciao, Michael. -------------------------------- snip -------------------------------- Python console: >>> ldap.set_option(ldap.OPT_DEBUG_LEVEL,65535) >>> dn 'OID.0.2.262.1.10.7.20=1 + CN=DIR DATEV D12 1:PN, O=DATEV eG, C=DE' >>> ldap.dn.str2dn(dn) => ldap_bv2dn(OID.0.2.262.1.10.7.20=1 + CN=DIR DATEV D12 1:PN, O=DATEV eG, C=DE,0) ldap_err2string <= ldap_bv2dn(OID.0.2.262.1.10.7.20=1 + CN=DIR DATEV D12 1:PN, O=DATEV eG, C=DE)=-4 Decoding error Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/lib/python2.5/site-packages/ldap/dn.py", line 50, in str2dn return ldap.functions._ldap_function_call(_ldap.str2dn,dn,flags) File "/usr/lib/python2.5/site-packages/ldap/functions.py", line 59, in _ldap_function_call result = func(*args,**kwargs) ldap.DECODING_ERROR >>>

3 4

Relative Distinguished Name searches
by Andrew Bartlett 06 Jan '08

06 Jan '08

In Samba4, I currently have a module that creates and maintains the 'name' attribute for our AD look-alike. Unlike in other systems, where this is related to 'cn', in AD this is always the relative distinguished name. I wondered if it might be possible (by some extended matching of some kind) to transform a search of 'name=foo' into something that does not require the manual maintenance of a samba4RDN attribute? (such a matching might then avoid problems if, in future, we allow clients direct access to the backend). Any thoughts? Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

2 1

CN must be indexed?
by Andrew Bartlett 06 Jan '08

06 Jan '08

Working on the OpenLDAP backend for Samba4, I'm wondering if this is expected: Is 'cn' a special attribute in the OpenLDAP code? It seems that the builtin schema definition (or something else) requires that the 'cn' attribute be indexed with index cn eq Otherwise, searches for cn=foo fail, where cn=foo* succeeds... I'm using current CVS, and trying to have Samba4 automatically generate configuration files for OpenLDAP, possibly based on the (AD) schema-data we will load into the directory. As such, knowing any (particularly other, similar) OpenLDAP-imposed constraints will be very useful, so that I can ensure these are met by the provision-backend script in Samba4. Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. http://redhat.com

2 5

Packaging libldap and libldap_r
by Russ Allbery 05 Jan '08

05 Jan '08

I'm one of the people who works on packaging OpenLDAP for Debian, and I'm trying to figure out what the right way to deal with libldap and libldap_r would be. Here's the problem that Debian has (which I expect is shared by other distributors): As I understand it, libldap_r is the thread-safe library and libldap is not thread-safe, so threaded applications have to link with libldap_r. However, libldap and libldap_r both contain the same symbols and don't use symbol versioning. So if both are loaded into the same process space at the same time, it's undefined which library is called, which can cause all sorts of problems. Therefore, for modules like nss-ldap that are loaded into the process space of almost every system process, there is no good option for which library to link against in the presence of both libraries: Linking with libldap because nss-ldap isn't threaded means that threaded applications that link with libldap_r may resolve symbols to the wrong library. Threaded applications may also get undefined results if they call NSS functions. But linking nss-ldap with with libldap_r to be safe for threaded applications will cause problems for any application linked with libldap. Note that nss-ldap is just an example, useful because it's fairly obvious. The same problem applies to any situation where multiple libraries may be mingled in a process space: PAM-using servers with pam-ldap, Apache with mod_ldap and mod_python or mod_perl loading LDAP modules, etc. What's the recommended way of dealing with this problem? I'd like whatever solution we use to be something that you're comfortable with. It's worth noting, btw, that glibc provides stubs for pthread functions, allowing libraries that need to be thread-safe in threaded programs but not in unthreaded programs to gain back the speed lost to locking when running without threads. In order to use this, the library should *not* be linked directly with the pthread library. glibc will provide stubs that do nothing if libpthread isn't loaded, and if it is, they will be transparently replaced by the correct threading code. This would eliminate the need to have two separate libraries. However, glibc only provides these stubs for a limited number of functions, and libldap_r currently references pthread functions outside of that set. I believe the other symbols may only be used in the code that supports slapd, although I could be wrong. Attached is the list of functions for which stubs are provided. pthread_attr_destroy pthread_attr_getdetachstate pthread_attr_getinheritsched pthread_attr_getschedparam pthread_attr_getschedpolicy pthread_attr_getscope pthread_attr_init pthread_attr_setdetachstate pthread_attr_setinheritsched pthread_attr_setschedparam pthread_attr_setschedpolicy pthread_attr_setscope pthread_cond_broadcast pthread_cond_destroy pthread_cond_init pthread_cond_signal pthread_cond_timedwait pthread_cond_wait pthread_condattr_destroy pthread_condattr_init pthread_equal pthread_exit pthread_getschedparam pthread_mutex_destroy pthread_mutex_init pthread_mutex_lock pthread_mutex_unlock pthread_self pthread_setcancelstate pthread_setcanceltype pthread_setschedparam -- Russ Allbery (rra(a)stanford.edu) <http://www.eyrie.org/~eagle/>

1 0

openldap adressbook
by digitom 04 Jan '08

04 Jan '08

Hello, I've want to set up an email server with dovecot, postfix openldap etc. Now my problem is to set up an openldap adressbook for Evolution. I've could add a new contact to the database via Evolution, and can see the contact via phpldapadmin and with Evolution. But if I restart Evolution, all contacts are lost (in Evolution, in phpldapadmin I still could see the conatcts.) Where is the problem? I've activated all possible log statements, but there's no needful information. (for me:) I've using debian etch with slapd 2.3.30-5 and Evolution 2.12.1. Now my slapd.conf: include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/evolutionperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel conns filter config trace args BER ACL stats stats2 shell parse index modulepath /usr/lib/ldap moduleload back_bdb sizelimit 500 tool-threads 1 backend bdb checkpoint 512 30 database bdb suffix "dc=testdomain" rootdn "cn=admin,dc=testdomain" rootpw {SSHA} ... and my ldif: dn:dc=testdomain objectClass: dcObject objectClass: organization o: my-example dc:testdomain dn:cn=admin,dc=testdomain objectClass: organizationalRole cn:admin dn:ou=contacts,dc=testdomain ou: contacts objectClass: organizationalUnit Do you need any further information to help me??? Thanks in advance. Thomas

3 2

[Unofficial] OpenLDAP Weekly News Issue 7
by Gavin Henry 04 Jan '08

04 Jan '08

Dear All, The seventh issue is out: http://blog.suretecsystems.com/categories/1-OpenLDAP Summary: - OpenLDAP 2.4.7 Released - OpenLDAP 2.3.40 Released - New Mailing List - Update on Build Farm - Contributions - OpenLDAP Documentation updates - OpenLDAP Development - Community Binaries - Blog LDAP Schema Update - "If there was an OpenLDAP Cookbook, what recipes would you like to see?" - Selected user issues and solutions discussed - LDAP Roundup Thanks, Gavin. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

1 0

Cannot replicate userPassword?
by Thomas Kirchtag 02 Jan '08

02 Jan '08

My setup is rather basic. ldaps://ldap.ipodion.at is master/sync provider. "consumer" is slave/consumer. Everything seems to be working fine, all attributes are replicated with the notable exception of the userPassword attribute. ldapsearch on the consumer shows the missing attributes, so it can't be a permissions problem: consumer # ldapsearch -x -LL -D "cn=admin,dc=ipodion,dc=at" -W -H ldaps://ldap.ipodion.at -b "dc=int,dc=ipodion,dc=at" "(objectClass=person)" uidNumber userpassword Enter LDAP Password: version: 1 dn: cn=NextFreeUnixId,dc=int,dc=ipodion,dc=at uidNumber: 10007 dn: uid=tkircht,ou=people,dc=int,dc=ipodion,dc=at uidNumber: 500 userPassword:: e1NNRDV9dXZ1UkxMY1VDaThMSktablRSazJWMElCU2l dn: uid=Administrator,ou=People,dc=int,dc=ipodion,dc=at uidNumber: 0 userPassword:: e1NNRDV9c2swZEtCMzUyb2JQTkRucTcxcDczc0VScXpB [...] I added the acl for uidNumber just to make sure I didn't mistype any credential information, but the uidNumber attribute is replicated the user Password isn't.. I cannot find anything on this in the archives or the documentation - what am I doing wrong here?! Any help would be appreciated thanks, Thomas Config files: --------------------------------------------------------- provider: --------------------------------------------------------- ldap:~# grep -v '^#' /etc/ldap/slapd.conf | grep -v '^$' allow bind_v2 include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/extension.schema schemacheck on pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args TLSCertificateFile /etc/ssl/certs/ldap.ipodion.cert.pem TLSCertificateKeyFile /etc/ssl/private/ldap.ipodion.key.pem TLSCACertificateFile /usr/share/ca-certificates/cacert.org/root.crt loglevel -1 modulepath /usr/lib/ldap moduleload back_bdb moduleload back_meta moduleload syncprov backend bdb database bdb suffix "dc=ipodion,dc=at" directory "/var/lib/ldap" overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 index objectClass eq index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub lastmod on rootdn "cn=admin,dc=ipodion,dc=at" rootpw <secret> access to attrs=userPassword by dn="cn=admin,dc=ipodion,dc=at" write by anonymous auth by self write by * none access to attrs=uidNumber by dn="cn=admin,dc=ipodion,dc=at" write by anonymous auth by self write by * none access to dn.subtree="ou=addressbook,dc=ipodion,dc=at" by self write by dn="cn=admin,ou=addressbook,dc=ipodion,dc=at" write by * read access to dn.base="" by * read access to * by dn="cn=admin,dc=ipodion,dc=at" write by * read --------------------------------------------------------- consumer: --------------------------------------------------------- consumer:~# grep -v '^#' /etc/ldap/slapd.conf | grep -v '^$' allow bind_v2 include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema schemacheck on pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args TLSCACertificateFile /etc/ssl/CA/cacert.pem loglevel 256 modulepath /usr/lib/ldap moduleload back_bdb backend bdb database bdb suffix "dc=int,dc=ipodion,dc=at" directory "/var/lib/ldap" index objectClass eq index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub lastmod on rootdn "cn=admin,dc=int,dc=ipodion,dc=at" rootpw {SSHA}<secret2> syncrepl rid=667 provider=ldaps://ldap.ipodion.at type=refreshOnly interval=01:00:00:00 searchbase="dc=int,dc=ipodion,dc=at" scope=sub schemachecking=on bindmethod=simple binddn="cn=admin,dc=ipodion,dc=at" credentials=<secret> access to attrs=userPassword by dn="cn=admin,dc=int,dc=ipodion,dc=at" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=int,dc=ipodion,dc=at" write by * read -- ========================================================= iPodion GmbH Rotensterngasse 20/3 A-1020 Wien, Austria Mobil: +43-660-216 32 98 Tel.:+43-1-216 32 98-0 mailto:office@iPodion.at Fax: +43-1-216 32 98-28 http://www.iPodion.at ========================================================= Achtung: Bitte beachten Sie meine neue Telefonnummer: 0660/2163298

4 7

ldap_set_option/ldap_bind_s segfaults
by Johan Ström 31 Dec '07

31 Dec '07

Hi list Im trying to run pure-ftpd 1.0.21 on a FreeBSD 7.0-amd64 (still beta yes) host, with LDAP (openldap-2.3.39) as auth backend. However the authing doesnt seem to work at all, as soon as password is sent the client gets disconnected. I've posted this similar message (altough more debugging info now) to their list without a single response. Tracing the problem got me to the following code (pureftpd's log_ldap.c, with a lot of logfile statements inserted by me): 110 static LDAP *pw_ldap_connect(void) 111 { 112 LDAP *ld; 113 # ifdef LDAP_OPT_PROTOCOL_VERSION 114 int version = ldap_version; 115 # endif 116 117 if (ldap_host == NULL || port < 0) { 118 logfile(LOG_DEBUG, "bad host"); 119 return NULL; 120 } 121 logfile(LOG_DEBUG, "initing to host %s port %d", ldap_host, port); 122 if ((ld = ldap_init(ldap_host, port)) == NULL) { 123 logfile(LOG_DEBUG, "init failed"); 124 return NULL; 125 } 126 logfile(LOG_DEBUG, "init ok ld is %p", ld); 127 # ifdef LDAP_OPT_PROTOCOL_VERSION 128 logfile(LOG_DEBUG, "setting version %d", version); 129 if (ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version) != 130 LDAP_SUCCESS) { 131 logfile(LOG_DEBUG, "failed versionset"); 132 return NULL; 133 } 134 logfile(LOG_DEBUG, "versionset ok"); 135 # endif 136 logfile(LOG_DEBUG, "binding"); 137 if (ldap_bind_s(ld, root, pwd, LDAP_AUTH_SIMPLE) != LDAP_SUCCESS) { 138 logfile(LOG_DEBUG, "bind failed"); 139 return NULL; 140 } 141 logfile(LOG_DEBUG, "bound ok"); 142 143 return ld; 144 } When running, I get this debug output Dec 29 09:31:10 back-1 pure-ftpd: (?(a)172.28.1.11) [DEBUG] ldap entered Dec 29 09:31:10 back-1 pure-ftpd: (?(a)172.28.1.11) [DEBUG] connecting Dec 29 09:31:10 back-1 pure-ftpd: (?(a)172.28.1.11) [DEBUG] initing to host localhost port 389 Dec 29 09:31:10 back-1 pure-ftpd: (?(a)172.28.1.11) [DEBUG] init ok ld is 0x1297180 Dec 29 09:31:10 back-1 pure-ftpd: (?(a)172.28.1.11) [DEBUG] setting version 3 Dec 29 09:31:10 back-1 kernel: pid 97603 (pure-ftpd), uid 0: exited on signal 11 After that, nothing.. And the forked process dies. As its a forked one, I havent been able to run gdb on it, so I've done the above log entrys instead.. But it seems pretty clear that it crashes when doign ldap_set_option. If i skip the set option and do bind directly, that crashes too. slapd doesnt even see the connection so I guess its something in the client part pure-ftpd: libssl.so.5 => /usr/lib/libssl.so.5 (0x800650000) libcrypto.so.5 => /lib/libcrypto.so.5 (0x80079a000) libldap-2.3.so.2 => /usr/local/lib/libldap-2.3.so.2 (0x800a2a000) liblber-2.3.so.2 => /usr/local/lib/liblber-2.3.so.2 (0x800b64000) libcrypt.so.4 => /lib/libcrypt.so.4 (0x800c72000) libpam.so.4 => /usr/lib/libpam.so.4 (0x800d8b000) libc.so.7 => /lib/libc.so.7 (0x800e93000) libsasl2.so.2 => /usr/local/lib/libsasl2.so.2 (0x8010b0000) Only have one version of the client lib installed so shouldnt be any problems there.. openldap-sasl-client-2.3.39 Open source LDAP client implementation with SASL2 support openldap-server-2.3.39 Open source LDAP server implementation I do have the same setup but with openldap-2.3.38 running fine on a FreeBSD 6.2-i386 box. Haven't seen any problems with the regular ldap* tools on this box, but havent tested any other software yet. Soo.. Anyone got any ideas? Hope this is the correct list, if not, sorry. Thanks! -- Johan Ström Stromnet johan(a)stromnet.se http://www.stromnet.se/

2 5

OpenLDAP and optional kerberos ?
by Nicolas GRENECHE 29 Dec '07

29 Dec '07

Hi all, I need tu replace an old NIS with a topnotch OpenLDAP server. I would like to add SSO support on my brand new architecture. 2 scenarii may occur : 1) Using pam_kerberos to authentaicate against KDC and retreiving information from LDAP server with SASL. The backward is that anyone (or anything) that need to authenticate MUST be kerberos aware. 2) Having LDAP and Kerberos passwords synced. Asset : You can authenticate through LDAP or kerberos (pam_ldap required an pam_kerberos optional) ie you must authenticate against LDAP and if Kerberos autentication success you get a TGT ! Backward : Two password databases to protect / lot of work on client side / passwords must be synced (Do you now materials to do it ?). I add that security is not a major concern for us and we got many OS on client side that's why the 1st solution may not fit our needs. Has someone ever experienced the second solution ? Have you some hints and feedbacks ? Thx, Nico

2 1

slapcat Segmentation fault
by John Sherling 29 Dec '07

29 Dec '07

Running OpenLDAP 2.2.19 on Darwin kernel v. 8.11.1, and when I issue: /usr/sbin/slapcat -d 5 -v -l /Users/localadmin/Desktop/bkup.ldif I get the following output: <snip>... # id=00000070 entry_decode: "cn=raidgroup,cn=groups,dc=fileserver,dc=mydomain,dc=private" <= entry_decode(cn=raidgroup,cn=groups,dc=fileserver,dc=mydomain,dc=private) # id=00000071 slapcat shutdown: initiated Segmentation fault ...</snip> Anyone know how I can track down what's causing this segmentation fault?

2 1

archive test
by Kurt Zeilenga 28 Dec '07

28 Dec '07

Test the archives....

1 0

test message
by Kurt Zeilenga 28 Dec '07

28 Dec '07

test

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical