openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

LDAP loadbalancer with URL redirect
by Olivier - 20 Oct '19

20 Oct '19

Hi, I have two different LDAP ldap://ldap1 and ldap://ldap2 behind a same public IP 10.0.0.1 Is there a solution to make a reverse proxy with redirection ? I mean if a LDAP request arrive to 10.0.0.1 with URI target "ldap://ldap1" , the request is redirected to server ldap1. Thanks.

3 2

Retrieve deleted user accounts
by Michael Starling 15 Oct '19

15 Oct '19

Is there any OpenLDAP control equivalent to the Microsoft's >> LDAP_SERVER_SHOW_DELETED_OID = "1.2.840.113556.1.4.417" ? I would like to pull a list of user accounts that have been deleted along with the corresponding date/time. Mike

5 4

TLS Connectivity
by Howard.Gillison＠gvltec.edu 12 Oct '19

12 Oct '19

Good morning to you, I have a question regarding the user of LDAP_* calls while programming in C. I am on an Oracle/Sun Solaris machine running Solaris 11.3. I am writing my code via Oracle Solaris Studio version 12.4. I do have OpenLdap v2.4.30 installed on my machine. ( /user/lib/slapd -VV returns: @(#) $OpenLDAP: slapd 2.4.30 (Feb 9 2017 12:37:50) $ @ul11sru-build:/builds/ul11u3sru-gate/components/openldap/build/sparcv7/servers/slapd) NOTE: the services are NOT up and running. I have no ldap server running on this machine. I am simply writing code using the LDAP_* service calls. In previous releases, there were some calls available to the effect of LDAP_START_TLS or LDAP_START_SSL and some others. All of those calls are now gone and as far as I can tell, not available in any form. With that said, my current code runs correctly and executes if I use port 389 to talk to an Active Directory Server. There is no problem, and I get back a valid response from my code, and I have gone through a pretty substantial set of testing to verify that the code is indeed accurate and valid. I even raided a site that had a sample code set for a bind and copied/modified that and tested it as well. My code and my raided code work correctly. If, however, I change the default port to be port 636, the code fails when I attempt to bind via LDAP_SIMPLE_BIND_S. The specific error code returned to me is an Error Code 91 and the LDAP_ERR2STRING result is: "Can't connect to the LDAP server". The Error Code implies that the system is down - OR - it is not available. If I change the default port back to 389, the code works. My conclusion is that I am having difficulty with the remote Active Directory Server "trusting" my server. I have OpenSSL on my machine, and I have the Private Certificate from the remote Active Directory Server installed along with the appropriate CA certificates and L1R chain. If I issue an "openssl s_client -showcerts -connect tbdca.gvl.gtech.pri:636" I do get a valid connection and get the following output result: CONNECTED(00000004) depth=2 C = US, O = "Entrust, Inc.", OU = See www.entrust.net/legal-terms<http://www.entrust.net/legal-terms>, OU = "(c) 2012 Entrust, Inc. - for authorized use only", CN = Entrust Root Certification Authority - G3 verify return:1 depth=1 C = US, O = "Entrust, Inc.", OU = See www.entrust.net/legal-terms<http://www.entrust.net/legal-terms>, OU = "(c) 2014 Entrust, Inc. - for authorized use only", CN = Entrust Certification Authority - L1R verify return:1 depth=0 C = US, ST = South Carolina, L = Greenville, O = Greenville Technical College, CN = gtech.pri verify return:1 The certificate named gtech.pri is the Certificate loaded on the Active Directory Domain Controllers. It is a Private SSL certificate with Subject Alternative Names. I forget precisely where I read this and I've tried to locate the document again - but perhaps one of you may know. It seems that the document was indicating that in order to connect to the Active Directory server, the CN and DN of the certificates had to exactly match. (I can't find the document now, so I can't recall the wording. If that is the case, it makes a private certificate rather worthless and makes a SAN certificate worthless from the outset - but OpenSSL does in fact verify the connection) Since there are no longer any LDAP_START_* for security, I have a dilemma of sorts. I have noticed in the ldap.conf man pages that it is possible to create a .ldaprc file in a user's local directory. Given that I could do that, will it work? Will that give me the access capability that I'm seeking? (again, I am NOT running an LDAP server on this machine. I'm simply coding a program in C that will make a connection to an Active Directory Server and it must be a secure connection) There are several parameters inside of the ldap.conf file that can point back to the certificate base and the certificate directory. There has to be some sort of mechanism to do this since the LDAP_START_TLS commands and so forth have been removed. Many thanks for your input and thanks for your patience in reading this! All the best, Howard This electronic mail message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. To the best of our ability and knowledge, this mail message has been scanned and is free of viruses and malware.

3 2

No version information available
by Leo Führinger 08 Oct '19

08 Oct '19

Hello, I've installed the newest version 2.4.48 of openldap on Ubuntu 18.04: vergrößern ./configure --with-cyrus-sasl --with-tls=openssl --enable-overlays=mod --enable-backends=mod --disable-perl --disable-ndb --enable-crypt --enable-modules --enable-dynamic --enable-syslog --enable-debug --enable-local --enable-spasswd --disable-sql --enable-mdb make depend make #test make test > test_results.txt grep '>>>>>.*failed' test_results.txt #install make install If I run the scritp 'sudo sh updateOpenldap.sh' which includes the command ldapdelete -x -r -D cn=admin,dc=aesettlingen,dc=ddnss,dc=de -w geheim ou=benutzer,dc=schule,dc=ddnss,dc=de >> updateOpenldap.log 2>> updateOpenldap.errorlog everything works fine. If I use a cronjob via crontab */1 * * * * /bin/bash /home/ldap/convertADtoOpenldap/updateOpenldap.sh I get the errors: ldapdelete: /usr/local/lib/liblber-2.4.so.2: no version information available (required by ldapdelete) ldapdelete: /usr/local/lib/libldap-2.4.so.2: no version information available (required by ldapdelete) LDAP vendor version mismatch: library 20448, header 20445 Here the content of /usr/lib/ vergrößern 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 root@ldapserver:/# ls -lah /usr/lib/lib* lrwxrwxrwx 1 root root 21 Mai 14 09:07 /usr/lib/libDeployPkg.so.0 -> libDeployPkg.so.0.0.0 -rw-r--r-- 1 root root 31K Mai 14 09:07 /usr/lib/libDeployPkg.so.0.0.0 lrwxrwxrwx 1 root root 15 Dez 19 2018 /usr/lib/libgjs.so.0 -> libgjs.so.0.0.0 -rw-r--r-- 1 root root 820K Dez 19 2018 /usr/lib/libgjs.so.0.0.0 lrwxrwxrwx 1 root root 20 Mai 14 09:07 /usr/lib/libguestlib.so.0 -> libguestlib.so.0.0.0 -rw-r--r-- 1 root root 23K Mai 14 09:07 /usr/lib/libguestlib.so.0.0.0 lrwxrwxrwx 1 root root 16 Mai 14 09:07 /usr/lib/libhgfs.so.0 -> libhgfs.so.0.0.0 -rw-r--r-- 1 root root 160K Mai 14 09:07 /usr/lib/libhgfs.so.0.0.0 lrwxrwxrwx 1 root root 31 Sep 16 17:37 /usr/lib/libldap-2.4.so.2 -> /usr/local/lib/libldap-2.4.so.2 lrwxrwxrwx 1 root root 17 Sep 4 2018 /usr/lib/libnetpbm.so.10 -> libnetpbm.so.10.0 -rw-r--r-- 1 root root 143K Apr 23 2016 /usr/lib/libnetpbm.so.10.0 lrwxrwxrwx 1 root root 18 Mai 14 09:07 /usr/lib/libvgauth.so.0 -> libvgauth.so.0.0.0 -rw-r--r-- 1 root root 84K Mai 14 09:07 /usr/lib/libvgauth.so.0.0.0 lrwxrwxrwx 1 root root 19 Mai 14 09:07 /usr/lib/libvmtools.so.0 -> libvmtools.so.0.0.0 -rw-r--r-- 1 root root 609K Mai 14 09:07 /usr/lib/libvmtools.so.0.0.0 and /usr/local/lib/ vergrößern 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 root@ldapserver:/# ls -lah /usr/local/lib/lib* lrwxrwxrwx 1 root root 22 Okt 3 18:11 /usr/local/lib/liblber-2.4.so.2 -> liblber-2.4.so.2.10.11 -rw-r--r-- 1 root root 222K Okt 3 18:11 /usr/local/lib/liblber-2.4.so.2.10.11 -rw-r--r-- 1 root root 223K Sep 12 2018 /usr/local/lib/liblber-2.4.so.2.10.8 -rw-r--r-- 1 root root 223K Sep 11 2018 /usr/local/lib/liblber-2.4.so.2.10.9 -rw-r--r-- 1 root root 375K Okt 3 18:11 /usr/local/lib/liblber.a -rw-r--r-- 1 root root 827 Okt 3 18:11 /usr/local/lib/liblber.la lrwxrwxrwx 1 root root 22 Okt 3 18:11 /usr/local/lib/liblber.so -> liblber-2.4.so.2.10.11 lrwxrwxrwx 1 root root 22 Okt 3 18:11 /usr/local/lib/libldap-2.4.so.2 -> libldap-2.4.so.2.10.11 -rw-r--r-- 1 root root 1,4M Okt 3 18:11 /usr/local/lib/libldap-2.4.so.2.10.11 -rw-r--r-- 1 root root 1,4M Sep 12 2018 /usr/local/lib/libldap-2.4.so.2.10.8 -rw-r--r-- 1 root root 1,4M Sep 11 2018 /usr/local/lib/libldap-2.4.so.2.10.9 -rw-r--r-- 1 root root 2,8M Okt 3 18:11 /usr/local/lib/libldap.a -rw-r--r-- 1 root root 876 Okt 3 18:11 /usr/local/lib/libldap.la lrwxrwxrwx 1 root root 24 Okt 3 18:11 /usr/local/lib/libldap_r-2.4.so.2 -> libldap_r-2.4.so.2.10.11 -rw-r--r-- 1 root root 1,6M Okt 3 18:11 /usr/local/lib/libldap_r-2.4.so.2.10.11 -rw-r--r-- 1 root root 1,6M Sep 12 2018 /usr/local/lib/libldap_r-2.4.so.2.10.8 -rw-r--r-- 1 root root 1,6M Sep 11 2018 /usr/local/lib/libldap_r-2.4.so.2.10.9 -rw-r--r-- 1 root root 3,1M Okt 3 18:11 /usr/local/lib/libldap_r.a -rw-r--r-- 1 root root 899 Okt 3 18:11 /usr/local/lib/libldap_r.la lrwxrwxrwx 1 root root 24 Okt 3 18:11 /usr/local/lib/libldap_r.so -> libldap_r-2.4.so.2.10.11 lrwxrwxrwx 1 root root 22 Okt 3 18:11 /usr/local/lib/libldap.so -> libldap-2.4.so.2.10.11 Does somebody has any idea? Thanks a lot! Leo

2 2

not getting ldap proxy to AD working... please help
by Drikus Brits 08 Oct '19

08 Oct '19

Heya experts. I need some guidance. I am having difficulty deploying my requirements. I need to deploy a couple of U18 servers/containers. These servers all needs to authenticate with LDAP accounts that is active and in a certain group on AD, but the IT team doesn't want to allow IPs and ports from servers across the network and so I have to set up a ldap proxy that will speak to AD on behalf of all the other machines eg jumphost. The windows AD cannot be modified to add extra groups eg posixAccount, uidNumber, gidNumber, loginShell, homeDirectory etc. I can successfully run a ldapsearch from the proxy machine to the AD and query a user based on the sAMAccountName and am getting successful results back from AD. However, when the jumphost (proxy set as ldap authhost) tries to authenticate with the proxy, then I see the request coming in from the jumphost to ldap proxy, and see the ldap proxy sending the request to the windows AD, but it forwards the same details as it sent to the local to the remote; eg objectClass=posixAccount, uid=testuser. This doesn't exist on the AD and so returns no result. I've tried to do rewrites and according to the packet captures, saw that the rewrite was working somewhat. I was able to rewrite uid to sAMAccountName, but not sure what to rewrite the posixAccount to.... So ideally what I'd like to see happening is that : 1) user logs onto jumphost with username "testuser" 2) user lookup & authentication goes to ldap_proxy 3) ldap_proxy send request to AD to check if user exists and is active and match against the password 4) upon username=exists, is=active, password=ok return the result to ldap_proxy 5) ldap_proxy returns the necessary to jumphost eg; a) posixAccount b) homeDirectory c) loginShell I've tried following a couple of different options to make it work, but right now I'm not sure which option is the correct one eg; (mdb config + ldap backend) or (meta + ldap backend ) or ( ldap + pcache ) and whether to rewrite or not to rewrite. From my understanding, I am looking for something that sounds like a meta setup that combines the local and remote data...is my understanding correct? I've seen this working at a previous employer but not sure whether their AD was modified and that is why it was working there, or whether the solution is workable without having to force the IT guys' hand and add extra vars.. I've scouted the openldap mailing list as well for answers but there is a plethora of no replies and some replies that somewhat matches what I'm trying to do... Any guidance would be super appreciated

2 2

Lazy quantifiers in regex ACLs??
by Jon C Kidder 02 Oct '19

02 Oct '19

Does the regex engine in OpenLDAP not support lazy quantifiers? Why does the ACL processing in this log show only one capture group as if the lazy quantifier in the first capture group isn't recognized? Every tester I plug this regex into produces 2 capture groups which is what I need. I need to carve off the leading OU as one capture group and capture the remaining chain of OUs as the second group then re-use both in my ACLs. Any suggestions for creating a regex that would produce the desired capture groups for use in my ACLs? 5d94aa15 => dnpat: [18] (ou=.+?,)?(ou=.+,)?ou=Delegated,ou=ApplicationData,dc=global,dc=aep,dc=com$ nsub: 2 5d94aa15 => acl_get: [18] matched 5d94aa15 => acl_get: [18] attr entry 5d94aa15 => match[dn0]: 0 95 ou=testapplication,ou=bolt,ou=concourse,ou=delegated,ou=applicationdata,dc=global,dc=aep,dc=com 5d94aa15 => match[dn1]: 0 40 ou=testapplication,ou=bolt,ou=concourse,

2 2

Change OID of existing custom Attribute
by Tobias Hachmer 30 Sep '19

30 Sep '19

Hello, running here OpenLDAP 2.4.42 on Ubuntu 16.04 with a hdb Database. Some old admin have added 2 custom attributes to the standard nis.schema, years ago. For this OIDs from nis schema has been chosen (1.3.6.1.1.1.1.2.x). I would like to fix that: Is it possible to move these custom Attributes to our custom Schema, while changing OIDs, also? Or do we have to clear the data DB, move the attrs and reimport a data backup? Thanks in advance, Tobias

3 9

N-Way Multimaster with syncrepl and delta-repl - LDAP Server not able to start after configuring
by Oliver Dörr 26 Sep '19

26 Sep '19

Hi, I already found two mail threads regarding my post but they do not help. I'm trying to setup a N-Way Multi-Master configuration following https://openldap.org/doc/admin24/replication.html section 18.3.3 with two masters.(su40v314 / su40v315) Using my process list I have started my server su40v314 with root 35523 1 0 Sep25 ? 00:00:02 /opt/symas/lib64/slapd -u root -g ldapadmi -h ldap://0.0.0.0:8653/ ldaps://0.0.0.0:8652/ -F /solshg/test2/etc So I believe that olcServerID should be olcServerID: 1 ldaps://su40v314:8652/ olcServerID: 2 ldaps://su40v315:8652/ but when I restart the server I get Sep 26 11:05:40 su40v314 slapd[129788]: read_config: no serverID / URL match found. Check slapd -h arguments. Same behaviour, if I change the HOST_LIST to "ldap://su40v314:8653/ ldaps://su40v314:8652/" Any ideas what I missed? Regards Oliver

2 1

How do I add the 'dialupAccess' attribute ....
by Paul Pathiakis 24 Sep '19

24 Sep '19

Quanah, Thank you for everything. It all works. :) (Something very strange had occurred with the 389 port being in a strange state that forced me to, finally, reboot as there was nothing running and even netstat, netcat and everything else said somethign was running but ps -elf said slapd wasn't there. *shrug*) My latest problem: I have the freeradius schema in my schemas. I verified this: ls -sal /etc/openldap/slapd.d/cn=config/cn=schema/cn={12}freeradius.ldif I also verified that the attribute that I want to access, dialupAccess is in there with a grep for it on that file. I'm trying to figure out how to make this attribute part of my user profiles so that I can check to see if this is set to 'yes' or 'no' for VPN access. dn: cn={12}freeradius objectClass: olcSchemaConfig cn: {12}freeradius...olcAttributeTypes: {56}( 1.3.6.1.4.1.11344.4.3.1.57 NAME 'dialupAccess' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) .. I can see this is an object class of olcSchemaConfig but how do I add that to my user profiles? THank you! Paul

2 2

MDB indices operations (MIT Kerberos with OpenLDAP backend)
by Дилян Палаузов 22 Sep '19

22 Sep '19

Hello, https://www.openldap.org/software/man.cgi?query=slapd-mdb&apropos=0&sektion… (man slapd-mdb) is not clear about indices. Is olcDbIndex A eq olcDbIndex B eq the same as olcDbIndex A,B eq and is the latter the same as oldDbIndex B,A eq ? In the SQL word these are different things and while Postgresql is supposed to handle "index A,B" and "index B,A" as equivalent, it does not, so a query has to be tuned to make use of existing indices. The particular use-case is the OpenLDAP backend of MIT Kerberos and the indices it needs for this query, as discussed at https://github.com/krb5/krb5/pull/974#issuecomment-531167854. The debug output of OpenLDAP, when there is no objectClass eq index, but a krbPrincipal eq index, is: Sep 13 09:09:03 mail slapd[14296]: 5d7b5caf conn=1117 op=7 SRCH base="cn=X.NET,cn=krbContainer" scope=2 deref=0 filter="(&(|(objectClass=krbPrincipalAux)(objectClass=krbPrincipal))(krbPrincipalName=krbtgt/X.NET(a)X.NET))" Sep 13 09:09:03 mail slapd[14296]: 5d7b5caf conn=1117 op=7 SRCH attr=krbprincipalname krbcanonicalname objectclass krbprincipalkey krbmaxrenewable age krbmaxticketlife krbticketflags krbprincipalexpiration krbticketpolicyreference krbUpEnabled krbpwdpolicyreference krbpasswordexpiration krbLastFailedAuth krbLoginFailedCount krbLastSuccessfulAuth krbLastPwdChange krbLastAdminUnlock krbPrincipalAuthInd krbExtraData krbObjectReferences krbAllowedToDelegateTo krbPwdHistory Sep 13 09:09:03 mail slapd[14296]: 5d7b5caf <= mdb_equality_candidates: (objectClass) not indexed Sep 13 09:09:03 mail slapd[14296]: 5d7b5caf conn=1117 op=7 SEARCH RESULT tag=101 err=0 nentries=1 text= Does it need one index on objectClass, one index on krbPrincipal, or one index on "first objectClass, then krbPrincipal"? If no mdb_candidate output can be triggered, does it mean, that creating an index is pointless? Moreover, it is not clear when changing the oldDbIndex on a database regenerates the index, and when running slapindex is necessary. My reading of https://www.openldap.org/doc/admin24/tuning.html , Section 21.3.2. “What to watch out for”, is that the output “mdb_equality_candidates” means inefficient searches. But a different interpretation is possible: This equality_candidates may be targeted at the simple case, where the search filter is just one equality test, and where an index could significantly reduce the number of candidates to be loaded and checked. For a krb5 LDAP KDB get_principal operation, the filter expression is (&(|(objectclass=krbprincipalaux)(objectclass=krbprincipal))(krbprincipalname=...)), so the objectClass equality test is intersected with a krbPrincipalName equality test. If the Kerberos LDAP DB is large and isn't shared with a lot of other LDAP data, almost every object in the database will match one of the objectClass equality tests, but only one will match the krbPrincipalName test. In that scenario, an objectClass index is useless, as it doesn't reduce the number of candidates significantly, while the krbPrincipalName index is useful. In fact, it is possible for the objectClass index to slow down the search, relative to having only a krbPrincipalName index--slapd might have to read in a large list of krbprincipal objects, then intersect that with a one-element list of objects matching the krbPrincipalName. While that would be much faster than loading and checking every principal object, it would still be O(n) in space and time rather than O(1). Regards Дилян

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical