openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

OATH TOTP LDAP schema?
by Côme Chilliet 04 Dec '19

04 Dec '19

Hello, We are working on implementing TOTP support in our application based on LDAP, and are looking for an LDAP schema for this. I found https://oath-ldap.stroeder.com but I can’t seem to find out the LDAP schema for this, allowing to store user tokens. Does anyone knows if there is a publicly accessible schema for this? -- Côme Chilliet FusionDirectory - https://www.fusiondirectory.org

3 2

Adding ACL to an Attribute
by Drukpa Kunley 03 Dec '19

03 Dec '19

Hi all, SYSTEM: NethServer-7.6.1810, a distro using Centos7.6.1810 OpenLDAP: openldap-2.4.44-21.el7_6.x86_64 Extra package: Self Service Password I am using Self Service Password with question/answer method to change the password. I store the answer in an attibute named: info. $answer_objectClass = "extensibleObject"; $answer_attribute = "info"; The original Account provider is LDAP which I want to replace with Active Directory. All the user have to choose a question/answer before I replace LDAP with AD as the Account provider. While LDAP is still the Account provider, anybody with console access to the server can see the question/answer using the command: # ldapsearch -D cn=libuser,dc=directory,dc=nh -w `cat /var/lib/nethserver/secrets/libuser` -h 127.0.0.1 # toto, People, directory.nh dn: uid=toto,ou=People,dc=directory,dc=nh ... objectClass: posixAccount objectClass: shadowAccount objectClass: inetOrgPerson objectClass: extensibleObject shadowLastChange: 18220 userPassword:: cm9ibTEyMDQ0OQ== info: {car}Honda I created a Virtual Machine to test the scenario with 3 users. In NethServer, the original Account provider is LDAP. I did a script to extract the users and their answers to file.ldif I remove LDAP. I install Active Directory module. I import the users/groups to AD. In the importation, AD creates new passwords for the imported users. I add a section to Self Service Password for AD. I modify AD with info.ldip to include the answer. # /usr/bin/systemd-run -M nsdc -q -t /usr/bin/ldbmodify -H /var/lib/samba/private/sam.ldb /var/lib/samba/private/file.ldif Modified 3 records successfully # The users can then modify their password responding to the same question/answer they had with LDAP. All is working perfectly. PROBLEM: I cannot encrypt the answer in LDAP because when I import the users to Active Directory, it cannot reads the encrypted answer. I think that AD is using another way to encrypt/decypt? If I don't encrypt the answer, the importation to AD is working correctly. While still using LDAP as Account provider and before I change it to Active Directory, I would like to add an additional ACL so nobody can read the answer stored in "info". After googling a lot I found a way to describe the ACL. I hope it is the right way. access to attrs=info by self write by anonymous auth by group="cn=domain admins,ou=Groups,dc=directory,dc=nh" write by * none How can I create the content of newacl.ldif file to be able to add that ACL to OpenLDAP (ldapmodify -Y EXTERNAL -H ldapi:/// -f /temp/newacl.ldif) Thank you, Drukpa

2 1

Is there a way to set a preference on entries with multiple userPassword attributes?
by Jeremy Diaz 03 Dec '19

03 Dec '19

Hello, Currently I have ldap entries with 2 userPassword attributes. One is a regular SHA password which the other one delegates to sasl. However this results in all entries binding through sasl rather than locally. I need some entries to default to sasl and other entries to default to SHA but still failover to the other password entry. Is this possible through openldap? Thanks, Jeremy -- Jeremy Diaz Rex Consulting, Inc 5652 Florence Terrace, Oakland, CA 94611 email: jeremy.diaz(a)rexconsulting.net web: [ http://www.rexconsulting.net/ | http://www.rexconsulting.net ] phone, toll-free: +1 (888) 403-8996 EXT: 5 The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. Rex Consulting, Inc. has been a California Corporation since 2001.

2 2

acl help access to 'own' attributes
by Marc Roos 30 Nov '19

30 Nov '19

Can anyone help how I should make the acls that allows users[2] access attributes of ldap entries[1] that have themselves listed in the attribute value sendmailMTAMapValue Something like: Access to children? ou=xxxx,ou=dddd,ou=cccc,dc=bbbb,dc=aaaa,dc=local filter=(sendmailMTAMapValue=VAR1) attrs=sendmailMTAKey by uid=VAR1,ou=yyyy,ou=dddd,ou=cccc,dc=bbbb,dc=aaaa,dc=local read [1] dn: sendmailMTAKey=test(a)example.com,ou=xxxx,ou=dddd,ou=cccc,dc=bbbb,dc=aaaa, dc=local objectClass: sendmailMTA objectClass: sendmailMTAMap objectClass: sendmailMTAMapObject objectClass: ritAdditionalInfo sendmailMTAMapName: virtuser sendmailMTACluster: mail sendmailMTAKey: test(a)example.com sendmailMTAMapValue: testuser [2] uid=testuser,ou=yyyy,ou=dddd,ou=cccc,dc=bbbb,dc=aaaa,dc=local

3 6

Does copying lock.mdb and data.mdb give syncrep errors?
by Marc Roos 29 Nov '19

29 Nov '19

Can I just copy the mdb databases to a different server, or are there 'unique' values inside?

2 1

own dynamic posix-group
by Stefan Kania 26 Nov '19

26 Nov '19

Hello, I try to set up my own posix-group to get a dynamic posix-group to use it to give filesystempermission. So I did the following: 1. Create to new objectclasses: ------------ objectclass (1.3.6.1.4.1.23456.1.2.1 NAME 'stkaPosixGroup' DESC 'advanced PosixGroup for dynamic use' SUP top AUXILIARY MUST ( cn $ gidNumber ) MAY ( userPassword $ memberUid $ description ) ) objectclass (1.3.6.1.4.1.23456.1.2.2 NAME 'stkaPosixAccount' DESC 'advanced PosixAccount for dynamic use' SUP posixAccount AUXILIARY MAY ( memberUID )) ------------ YES I know 23456 is not my ODI. It's still a test! 2. Then I configured the dynlist-overlay in slad.conf ------------ overlay dynlist dynlist-attrset groupOfURLs MemberURL ------------ 3. I created a new dynamic group: ------------ dn: cn=dynposix,ou=groups,dc=example,dc=net objectClass: groupOfURLs objectClass: stkaPosixGroup gidNumber: 5000 cn: dynposix memberURL: ldap:///dc=example,dc=net?memberuid?sub?(title=admin) ------------ 4. I added the new objectclass stkaPosixAccout to my users: ------------ dn: cn=Stefan Kania,ou=users,dc=example,dc=net objectClass: posixAccount objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: stkaPosixAccount loginShell: /bin/bash homeDirectory: /home/skania uid: skania cn: Stefan Kania userPassword:: e1NTSEF9cVk4eDVEaVhmYTZxbEw4MDBnRTlkazdtVDd2TzVocUI= uidNumber: 10000 gidNumber: 10000 sn: Kania givenName: Stefan memberUid: skania title: admin ------------ 5. I set the attribute "title" for two users to "admin" and got ------------ root@ldapserver:/# ldapsearch -x -D cn=admin,dc=example,dc=net -W -LLL 'cn=dynposix' dn: cn=dynposix,ou=groups,dc=example,dc=net objectClass: groupOfURLs objectClass: stkaPosixGroup gidNumber: 5000 cn: dynposix memberURL: ldap:///dc=example,dc=net?memberuid?sub?(title=admin) memberUid: skania memberUid: ktom ------------ So my users are member of the group. 5. I use the sssd as ldap-client so I changed the configuration to: ------------ [sssd] config_file_version = 2 services = nss, pam domains = EXAMPLE [nss] filter_groups = root filter_users = root reconnection_retries = 3 [pam] reconnection_retries = 3 offline_credentials_expiration = 2 offline_failed_login_attempts = 3 offline_failed_login_delay = 5 [domain/EXAMPLE] ldap_schema=rfc2307 ldap_uri = ldap://ldapserver.example.net:389 ldap_search_base=dc=example,dc=net ldap_default_bind_dn=uid=sssd-user,ou=users,dc=example,dc=net ldap_default_authtok=geheim id_provider=ldap auth_provider=ldap chpass_provider = ldap ldap_chpass_uri = ldap://ldapserver.example.net:389 cache_credentials = True ldap_tls_cacertdir = /etc/ssl/zertifikate/demoCA ldap_tls_cacert = /etc/ssl/zertifikate/demoCA/cacert.pem ldap_id_use_start_tls = True ldap_group_object_class = stkaPosixGroup enumerate = true ------------ I added the line "ldap_group_object_class = stkaPosixGroup" I Know "enumerate = true" is not a good idea but it's still a test ;-) Now the tests: --------- getent group . . dynposix:*:5000: . . -------- The group will be listed but non of the members. So I did the following: -------- root@ldapserver:~# ldapsearch -x -D cn=admin,dc=example,dc=net -W -LLL 'cn=dynposix' dn: cn=dynposix,ou=groups,dc=example,dc=net objectClass: groupOfURLs objectClass: stkaPosixGroup gidNumber: 5000 cn: dynposix memberURL: ldap:///dc=example,dc=net?memberuid?sub?(title=admin) memberUid: skania memberUid: ktom -------- There are two memberUid entries. Now I did another test searching for "memberuid" -------- root@ldapserver:~# ldapsearch -x -D cn=admin,dc=example,dc=net -W -LLL 'memberuid=*' attrs dn dn: cn=Stefan Kania,ou=users,dc=example,dc=net dn: cn=Kater Tom,ou=users,dc=example,dc=net -------- As you can see, I only get the two users but not my group "dynposix" listed. When i do a "id ktom" I got: -------- root@ldapserver:~# id ktom uid=10001(ktom) gid=10000 groups=10000 -------- Also no group "dynposix" It looks like it is not possible to search for the attribute "memberUid" if it's assigned to a groupOfUrls. Does anyone has an idea where did something wrong? -- Stefan Kania

2 2

switching to containers, slapd tuning?
by Marc Roos 23 Nov '19

23 Nov '19

I have now setups with vm's with a local slapd and nscd for caching authentication requests. If I separate these processes eg. different container for slapd, different container for the application that does system authentication. I will not be able to share cache memory etc. I was wondering if I would ever be able to come near this performance with direct communication between slapd and the application (thus without something like nscd) and how to tune slapd.

1 0

SSL / TLS 1.0 - exposed in SSF?
by Aaron Bennett 22 Nov '19

22 Nov '19

Hi, I'm looking to determine if clients connecting to my OpenLDAP directory are using obsolete protocols (such as SSL, TLS 1.0, etc). Are the connection details exposed in the SSF value of the connection, or exposed elsewhere the log? Best, Aaron --- Aaron Bennett Manager of Systems Administration Clark University ITS

2 3

Re:Re: It seems that the Tls cipher settings in ldap client and server not work.
by Quanah Gibson-Mount 22 Nov '19

22 Nov '19

--On Thursday, November 14, 2019 11:17 AM +0800 莫亚男 <nanmor(a)126.com> wrote: > > > Hi Quanah, > > > Sorry for reply so late. We download the package and self-built. > we used below commands: > env CPPFLAGS=-I/usr/local/src/openssl-1.1.1/include > LDFLAGS=-L/usr/local/ssl/lib ./configure > make depend > make > make install Hi Nancy, Please keep replies on the technical list. Which OpenSSL 1.1.1 release are you linking to? Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 2

Page Leak?
by Andrew Spott 20 Nov '19

20 Nov '19

I apologize if this is the wrong place to ask this, let me know if there is someplace better. So, when doing a `mdb_copy -c`, I've run into the error message: mdb_copy: copying failed, error -30784 (MDB_INCOMPATIBLE: Operation and DB incompatible, or DB flags changed) When looking at the mdb_copy man page, it says that mdb_copy with compaction might fail if the database has a 'page leak'. Since that appears to be what has happened... can anyone tell me what that means? Does this mean that the data could be corrupted? How do I fix this? Thanks! -Andew

2 6

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical