openldap-technical

openldap-technical@openldap.org

14 participants
9795 discussions

openldap stopped authenticating
by Lang, Adam 27 Nov '18

27 Nov '18

Hello, I woke up to an issue today where SSH access to our servers no longer works due to issues with LDAP authentication. Oddly, ldapsearch with admin credentials interacts with the LDAP server fine. If I check for ldapusers using getent passwd, none are returned. The slapd auditlog records the failed attempts. When trying to su as an ldap user, it returns "no passwd entry". Nothing "should" have changed over night, so any ideas of where to look will be appreciated. Adam The information contained in or attached to this e-mail is intended only for the use of the addressee. If you are not the intended recipient of this e-mail, or a person responsible for delivering it to the intended recipient, you are strictly prohibited from disclosing, copying, distributing, or retaining this e-mail or any part of it. It may contain information which is confidential and/or covered by legal, professional or other privilege under applicable law. If you have received this e-mail in error, please notify the author by replying to this e-mail immediately and delete this e-mail from your system. The views expressed in this email may not necessary be the views held by the organization. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission.

2 2

Empty search result
by Fabiano Sidler 27 Nov '18

27 Nov '18

Hello! What can be the cause for ldapsearch without filter returning everything as expected, but adding a filter (which works well against a 389 and an AD installation) just returns nothing? I can provide configs and logs if this is normal but unexpected (by me) behaviour. Greetings, Fabiano

3 2

SSL_library_init in -lssl... no, configure: error: Could not locate TLS/SSL package
by Synthea 27 Nov '18

27 Nov '18

While I try to configure openldap 2.4.44 I get this error: checking openssl/ssl.h usability... yes checking openssl/ssl.h presence... yes checking for openssl/ssl.h... yes checking for SSL_library_init in -lssl... no checking for ssl3_accept in -lssl... no configure: error: Could not locate TLS/SSL package ssl.h is in /usr/include/openssl/ssl.h and the version of openssl library is 1.1.0f-3

2 1

Q: meaning of ACL "disclose" access
by Ulrich Windl 26 Nov '18

26 Nov '18

Hi! The manual page slapd.access explains: "The disclose access level allows disclosure of information on error." I don't quite understand what this is saying: Can the requester find out a specific object or attribute exists without actually reading its value? Regards, Ulrich

2 1

N-Way MMR between local LDAP and Cloud LDAP
by Alan Lukens 26 Nov '18

26 Nov '18

I have been asked to look into adding an LDAP instance in AWS Cloud environment. This LDAP instance would participate in our current N-Way MMR that we have locally. Does anyone have any recommendations, experience, or insight into attempting something like this? Any help would be appreciated. Alan Lukens Identity Management Specialist University of Massachusetts Amherst, IT NSS

1 0

ldapmodify add olcSyncrepl (okey but not okey)
by lejeczek 19 Nov '18

19 Nov '18

hi everyone I'm must be doing something trivially wrong and am hoping someone could help. I'm trying to add second replica: $ ldapmodify -vv -h rider.my.dom:1389 -D "cn=admin,cn=config" -w my.Biotec13 -x ldap_initialize( ldap://rider.my.dom:1389 ) dn: olcDatabase={1}bdb,cn=config changetype: modify add: olcSyncrepl: rid=002 provider=ldap://swir.my.dom:1389 bindmethod=simple timeout=0 network-timeout=0 binddn="uid=replicator,ou=people,dc=my,dc=dom" credentials="lejek9090" keepalive=0:0:0 starttls=no filter="(objectclass=*)" searchbase="dc=my,dc=dom" scope=sub attrs="*,+" schemachecking=off type=refreshOnly interval=00:00:10:00 retry="5 5 300 +" exit code of the above to shell is 0 yet next ldapsearch finds no such new entry exists. At the time of ldapmodify in logs I see: Nov 19 14:40:48 rider slapd[90048]: slap_queue_csn: queueing 0x7f22cc111e00 20181119144048.167126Z#000000#005#000000 Nov 19 14:40:48 rider slapd[90048]: slap_graduate_commit_csn: removing 0x7f22cc111e00 20181119144048.167126Z#000000#005#000000 How to get it work? Many thanks, L.

4 3

Re: syncrepl schema error
by aRaviNd 19 Nov '18

19 Nov '18

HI Quanah, Yes, there was duplicate values in DIT which was causing slaves to not sync the data. Thanks for your guidance Regards, Aravind M D On Sun, Nov 18, 2018 at 3:35 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Saturday, November 17, 2018 9:38 PM +0530 aRaviNd > <ambadiaravind(a)gmail.com> wrote: > > > If remove the schema changes replication works fine. Could you please let > > us know whats going wrong with the configuration? > > Most likely, you have two values in the attribute that are different when > case sensitive, but the same when case insensitive, i.e.: > > memberUID: AbcD > memberUID: aBCd > > Before your schema change, these are considered different. AAfter your > schema change, they are the same. So when a modification occurs to the > attribute they are now seen as duplicate values and it breaks replication. > > --Quanah > > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > >

1 0

delete a user schema from cn=config
by Derek Zhou 19 Nov '18

19 Nov '18

Hi list, I was experimenting locally written schema with a recent build of slapd. I added the schema ldif with no problem using ldapadd -QY EXTERNAL -H ldapi:/// ... But then I realized I made a mistake, so I try to delete it with ldapdelete -QY EXTERNAL -H ldapi:/// it says: ldap_delete: Server is unwilling to perform (53) what does it mean? The schema is not used by any data on the server. I can use slapmodify to remove it after server shutdown, but that kind of suck and not much different, or even worse than editing conf file? Derek

4 8

syncrepl schema error
by aRaviNd 17 Nov '18

17 Nov '18

Hi Team, We have configured master slave openldap replication in our environment. Default NIS schema was modified for the attribute memberUid to be case insensitive. During replication after some of the records are transferred we are seeing below error. Nov 17 08:06:57 abc.com slapd[2356]: syncrepl_message_to_entry: rid=003 mods check (memberUid: value #30 provided more than once) Nov 17 08:06:57 abc.com slapd[2356]: do_syncrepl: rid=003 rc 20 retrying If remove the schema changes replication works fine. Could you please let us know whats going wrong with the configuration? Thanks in advace Regards, Aravind M D

2 1

cn=config default access control
by Derek Zhou 17 Nov '18

17 Nov '18

Hi list, I've been using openldap for a few years but yesterday I compiled slapd from git head for the first time. To my supprise that: root@my-machine:/root#: ldapsearch -LLLQY EXTERNAL -H ldapi:/// -b cn=config does not work. It took me a while to find out that by default the cn=config database has 'olcAccess: {0}to * by * none' and 'olcRootDN: cn=config' with no olcRootPW, so all access from ldap is denied. Once I know I used slapmodify to change olcRootDN to 'gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth' and everything works as expected afterward. My argument is why isn't it the default? I think debian packages already did that. cn=config is stored as plain text on the local file system so local root can read and change anyway. Changing cn=config is the first thing to do for any admin, and I am not exactly a newbie yet I still stumbled on it. By the way, if we really want people to use cn=config exclusively, I suggest to remove all mentioning of slapd.conf from the latest documentation. Old admins appreciate cn=config more and there will be less distraction for newbies. Derek

2 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical