openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

LDAP authentication with just sAMAccountName
by Florea, Cosmin Petre 12 Mar '19

12 Mar '19

Hello, I have a LDAP Linux client written with OpenLDAP and i need it to be able to authenticate a user only by username and password (no domain). By username i mean the sAMAccountName from the LDAP record. The bind succeeds if i use "username@domain" or if i use the userPrincipalName (which is not equal to sAMAccountName), but i am unable to make it work just with username. Anonymous ldap_bind followed by a ldap_search does not work (it works if the bind is not anonymous). I have also a windows client (not using openldap library) implemented with DirectoryEntry from C#. The login with just the username works fine in that implementation (connected to the same LDAP server). In the LDAP log file on Windows i see (i put [...] to hide the server address): <Data Name="Message">ldap_bind called for connection 0xd059b718: DN is (null). Method is 0x486. Synchronous is 0x1. <Data Name="Message">ldapBind found server is Windows 2003 or better AD on connection 0xd059b718 <Data Name="Message">Connection->hostname is '[.........]' <Data Name="Message">Connection->DnsSuppliedNAme is '[.........]' <Data Name="Message">Connection->DomainName is '(null)' <Data Name="Message">LDAP: make spn returned 'ldap/[.........]' with error 0 <Data Name="Message">ldapBind found GSSAPI auth type on connection 0xd059b718 <Data Name="Message">ldapBind found GSS-SPNEGO auth type on connection 0xd059b718 <Data Name="Message">ldapBind found DIGEST auth type on connection 0xd059b718 <Data Name="Message">ldap bind: Server is v3 <Data Name="Message">ldap bind: Server supports both GSS-SPNEGO and GSSAPI <Data Name="Message">New servicename for bind is 'ldap/[.........]' <Data Name="Message">wldap32:Server is capable of 'NTLM' <Data Name="Message">ldap_bind returned 0x0 for connection 0xd059b718. So on windows it does ldap_bind 2 times , but i think it is using a different mechanism, probably Windows specific (i mean not ldap_search) to retrieve the userPrincipalName associated with the sAMAccountName from input. I do not have an account that i can use to make the initial bind (my client should work with several distinct servers). My question is: how to do it on linux with OpenLDAP? Is it possible? Thank you.

2 2

Re: Antw: Expected operation of pwdFailureCountInterval
by Tom Jay 12 Mar '19

12 Mar '19

I think the documentation could do with being updated slightly. This is taken from the slapo-ppolicy manual: pwdFailureCountInterval This attribute contains the number of seconds after which old consecutive failed bind attempts are purged from the failure counter, even though no successful authentication has occurred. If pwdFailureCountInterval is not present, or its value is zero (0), the failure counter will only be reset by a successful authentication. What I think that means is that unless the account is locked, and there are no successful authentication attempts, failed bind attempts are cleared from the LDAP entry after the pwdFailureCountInterval time. If the account is locked, the pwdFailureTime entries remain until the account is unlocked manually (or the pwdLockoutDuration time) and a successful authentication attempt (if the account is not locked) will also clear the pwdFailureTime entries. Tom On 2019-02-28 15:00, Ulrich Windl wrote: >>>> Tom Jay <web(a)tomjay.co.uk> schrieb am 27.02.2019 um 04:05 in >>>> Nachricht > <19f2a950eb051ccafe5a4420752d8b84(a)tomjay.co.uk>: >> Hello, >> >> Can someone explain the expected operation of the >> pwdFailureCountInterval attribute please? The documentation seems to >> be >> fairly clear, but if I add it to the password policy, along with some >> other attributes, the account remains locked, even after the >> pwdFailureCountInterval time. Despite authenticating with a valid >> password, the pwdFailureTime entries remain and the account remains >> locked. > > I think the mechanism is the other way round: As long as the account > is not locked, failed counts are reset every (after?) 1200 seconds. > Once an account is locked, it stays locked. > > Did you look at pwdLockoutDuration? > > Regards, > Ulrich > >> >> These are the attributes in use: >> pwdLockout: TRUE >> pwdMaxFailure: 5 >> pwdFailureCountInterval: 1200 >> >> Thanks. >> >> Tom

1 0

Re: Rsyslog stdout and stderr
by albert de montreuil 12 Mar '19

12 Mar '19

Abdelkader Chelouah wrote: > > Hi, > > > > slapd 2.4.44 > > > > OpenLDAP instance configure as a proxy (back-ldap) > > > > > > From time to time, bind operations can take more than 5 sec. These latencies do not seem to come from a CPU or memory problem. I'm trying to see if the network > > can be the root cause of the issue. To debug the fonction ldap_sasl_bind (libraries/libldap/sasl.c), I activated trace loglevel (logs are manage by rsyslog). In > > the definition of ldap_sasl_bind, there is > > > > Debug( LDAP_DEBUG_TRACE, "ldap_sasl_bind\n", 0, 0, 0 ); > > > > A least the message "ldap_sasl_bind" should appear in logs, which is not the case. Actually, Debug (which is first defined in include/ldap_log.h) is redefined > > in libraries/libldap/ldap-int.h > > > > ... > > > > #include "ldap_log.h" > > > > #undef Debug > > > > #ifdef LDAP_DEBUG > > > > #define DebugTest( level ) \ > > ( ldap_debug & level ) > > > > #define Debug( level, fmt, arg1, arg2, arg3 ) \ > > do { if ( ldap_debug & level ) \ > > ldap_log_printf( NULL, (level), (fmt), (arg1), (arg2), (arg3) ); \ > > } while ( 0 ) > > > > #define LDAP_Debug( subsystem, level, fmt, arg1, arg2, arg3 )\ > > ldap_log_printf( NULL, (level), (fmt), (arg1), (arg2), (arg3) ) > > configure > > #else > > > > #define DebugTest( level ) (0 == 1) > > #define Debug( level, fmt, arg1, arg2, arg3 ) ((void)0) > > #define LDAP_Debug( subsystem, level, fmt, arg1, arg2, arg3 ) ((void)0) > > > > #endif /* LDAP_DEBUG */ > > > > ... > > > > A a result, the message is send to standard output. By using rsyslog, it is not possible to catch any message inside ldap_sasl_bind. > > > > > > How to get stdout and stderr messages and still use rsyslog to manage openldap logs ? > syslog is not fast enough to handle the debug traffic. > You could use ber_set_option() to override the log output functions, and have them write > messages both to rsyslog and stderr. But using syslog on every debug message will slow > things down more than 10x. Hi, I'am also interressed to enable stderr and stdout to rsyslog. I try to figure out how to use ber_set_option(), but i'am pretty sur i miss something in my analysis. Starting from the function ldap_sasl_bind in file libraries/libldap/sasl.c + Debug( LDAP_DEBUG_TRACE, "ldap_sasl_bind\n", 0, 0, 0 ); Debug is macro define in first place in include/ldap_log.h and override by libraries/libldap/ldap-int.h So Debug is replace by ldap_log_printf() which is defined in libraries/libldap/print.c, ldap_log_printf() make some check and get varargs and send to pointer function 'ber_pvt_log_print' ber_pvt_log_print is pointer to ber_error_print() in file libraries/liblber/bprint.c. So the target is to change ber_pvt_log_print In function ber_set_option() we can redefine the print function ber_pvt_log_print to write messages both to rsyslog and stderr. (in /servers/slapd/main.c) ber_set_option(NULL, LBER_OPT_LOG_PRINT_FN, &print_syslog); The function is pretty basic : void print_syslog( LDAP_CONST char *data ) { Log0(LDAP_DEBUG_ANY, ldap_syslog_level, data); return ; } Of course i declare prototype in header file. Is it what you have in mind or should i use a function in OpenLDAP ?

1 0

help needed for further investigation
by Thomas.Meller＠t-systems.com 07 Mar '19

07 Mar '19

Hello together. I am the heir of a setup based on RHEL 6.10 and Openldap 2.4.45 (ltb) A master syncrepls to a slave in type=refreshOnly using bindmethod=sasl, saslmech=external. The mapped techuser resides in ou=ServiceUser. All Clients also use user objects in the same ou to bind to the servers. I need to set new acls and decided to include a dedicated acl- and limits-configfile. The ACLs checked via slapacl look fine and run without problems on the test environment. (Which is based on the same 2.4.45 rpms, but the replica runs on RHEL 7.5) All slapd configuration make use of database mdb and an explicitly set maxsize. (which is sized sufficiently: 12 GB, 49 MB used) When implementing the configuration on a running system, the replica deletes the ou (that one with all the service user objects). Which is not what I want 8-/ How can I find out more about the reason for this peculiar result? I set the loglevel to 'stats sync' on the replica and 'sync' on the master. (fs size is limited for logs) The access limits are in place for this replication account and read access is granted as well. (might be I need to set something extra for operational attributes?) limits dn.subtree="ou=ServiceUser,..." size=unlimited (this is the replica) sizelimit unlimited timelimit 10 and limits dn.subtree="ou=ServiceUser,..." size=unlimited time=120 (in this order, this is the master) What do I need to look at to find what's missing? I am no openldap crack, but no newbie as well. Yet my openldap knowledge ist not very extended. Which further infos do I need to supply to maybe get help? The include statements for limits and acls are defined before the database configuration. I avoid using dynamic configuration to keep it all simple. Overlays in use: chain dynlist valsort memberof ppolicy (replica) syncprov ppolicy unique dynlist memberof refint valsort (master) Thank you, Thomas

3 4

setting up openldap to proxy to AD on SUSE ENT 12
by N6Ghost 06 Mar '19

06 Mar '19

hi all, I am trying to setup an openldap proxy to AD and i need to use SUSE Enterprise Linux 12. Hostname:/etc/openldap # rpm -qa|grep -i openldap openldap2-2.4.41-18.43.1.x86_64 openldap2-client-2.4.41-18.43.1.x86_64 what I am trying to do, is proxy an application (with 1000s of users) from talking directory to AD, to talking to openldap. and then have openldap talk to AD. look across the net is a bunch of stuff, but most of it does not seem to apply, or work. look at the offical doc, says use sasl but you must have an local entry with a {sasl] tag on the user thats not really ideal and work make a huge problem. a few of the posts online just said point to AD via ldap is possible? and this application also has a group lookup as part of its auth process... eg, only member of groupX can access.... any help in this would be huge. seems, i am mixing up a few different ways of doing this whats the bets way to do this? Thanks -N6ghost

5 7

Integer keys - order
by Sam Dave 01 Mar '19

01 Mar '19

When using integer keys (MDB_INTEGERKEY), is it guaranteed that when using mdb_cursor_get() to "loop through" my entire database, I will get the keys in the expected integer order? I thought I'd ask to be sure because I'm not sure if this expected behavior is documented.

1 0

Integer keys - drawbacks
by Sam Dave 01 Mar '19

01 Mar '19

Are there any known drawbacks to using integer keys (MDB_INTEGERKEY), performance or otherwise?

1 0

back-ldap timeout per operation
by Abdelkader Chelouah 01 Mar '19

01 Mar '19

Hello, I'm trying to figure out what is the behavior of back-ldap when the timeout (olcDbTimeout) is exceeded for a given operation ? Is the operation retried or aborted ?

1 0

Expected operation of pwdFailureCountInterval
by Tom Jay 27 Feb '19

27 Feb '19

Hello, Can someone explain the expected operation of the pwdFailureCountInterval attribute please? The documentation seems to be fairly clear, but if I add it to the password policy, along with some other attributes, the account remains locked, even after the pwdFailureCountInterval time. Despite authenticating with a valid password, the pwdFailureTime entries remain and the account remains locked. These are the attributes in use: pwdLockout: TRUE pwdMaxFailure: 5 pwdFailureCountInterval: 1200 Thanks. Tom

2 1

slapd-sock Overlay gives no RESULT on Successful BIND
by Kamal Advani 27 Feb '19

27 Feb '19

Hello, We are attempting to sync over some data from OpenLDAP into Win AD. The approach thus far has been to use slapd-sock in overlay mode and attach a listener. Our configuration snippet is as follows: --- moduleload back_sock overlay sock extensions connid socketpath /var/run/openldap/winad-sync-overlay.sock sockops add bind delete modify modrdn sockresps result --- What I have noticed is that on a successful BIND, no corresponding RESULT is received. However, on a BIND failure, we do, with a non-zero code (as expected). Another interesting situation is as follows: * On an unsuccessful BIND, we get 2 messages, a BIND and a MODIFY -- we also use the `ppolicy` module, so it sets the pwdFailureTime, an 'add' change, on a BIND failure. This is fine. * However, both the BIND and MODIFY have the same msgid. * Finally, we get one RESULT back with the same msgid. Continuing on, if I then BIND successfully, as above, I get: * BIND and MODIFY -- this time the MODIFY clears pwdFailureTime, a delete change. Same msgid on both BIND and MODIFY. * Again, only one RESULT, with the corresponding msgid. Have I misconfigured something, or is this expected behaviour? In all cases, have made sure I'm sending through CONTINUE after each message. I guess, I'd expect a RESULT for each request message, it would certainly make message processing much simpler and deterministic: * Receive request, store, keyed by conn id and msg id. * Receive RESULT, find corresponding request, and process accordingly. I only have this issue on BIND, as far as I can tell, at least for the `sockops` I'm interested in. Any suggestions are much appreciated. Thanks very much. Regards, Kamal PS. Happy to provide transcripts of output, just keeping the initial email size manageable. Please let me know. PPS. Another quirk is, it appears that I get a RESULT for a SEARCH, even though I am not subscribed to it in `sockops`, but happy to ignore this for now! -- There is more to life than increasing its speed. -- Mahatma Gandhi

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical