openldap-technical

openldap-technical@openldap.org

14 participants
9795 discussions

OpenLDAP and Google Cloud Directory Sync
by Brian Hill 19 Oct '18

19 Oct '18

I would like to get OpenLDAP to trigger a GCDS sync whenever either certain attributes are modified or even anything the DB, if it isn't possible to limit it to certain attributes. I am thinking along the lines of OpenLDAP calling some external program after a modification, but if there is another way to do this that I am missing, I am all ears. I have looked at the various overlays but none seem relevant. Has anyone done this or have general suggestions? Brian

5 4

Re: Check synchro : access only to contextcsn
by Lirien Maxime 18 Oct '18

18 Oct '18

Damn ! my ACL don't work despites your help :-/ In the log it seems that "supervision" can't access dc=fr, it starts from dc=gouv,dc=fr. Without rule#3, it's ok because of rule #5. But with rule#3 it's supposed to match contextCSN Thanks guys. Here are my ACL : # 1) Admin's branch access to dn.subtree="ou=Comptes Admin,dc=fr" by dn.exact="cn=Synchro,ou=Comptes Admin,dc=fr" read by self auth by users auth by anonymous auth # 2) userPassword accessible by all access to * attrs=userPassword by dn.exact="cn=Synchro,ou=Comptes Admin,dc=fr" read by users auth by anonymous auth by * none *# 3) ********* CONTEXTCSN ********** *access to dn.base="dc=fr" attrs=entry,children,contextcsn* * by dn.exact="cn=Synchro,ou=Comptes Admin,dc=fr" read by dn.exact="cn=supervision,ou=Comptes Clients,dc=fr" read by * none* # 4) Certificate access to * attrs=userCertificateAuthentication,userCertificateConfidentiality,userCertificateSigning by dn.exact="cn=clienttest,ou=Comptes Clients,dc=fr" read by dn.exact="cn=Synchro,ou=Comptes Admin,dc=fr" read by * none # 5) Branch dc=gouv,dc=fr access to dn.subtree="dc=gouv,dc=fr" by dn.subtree="ou=Comptes Clients,dc=fr" read by dn.subtree="ou=Comptes Admin,dc=fr" write by * none # 6) All the tree access to * by dn.exact="cn=root,dc=fr" write by dn.subtree="ou=Comptes Admin,dc=fr" read by dn.exact="cn=Synchro,ou=Comptes Admin,dc=fr" read by self none by users none by anonymous none by * none On Tue, Oct 16, 2018 at 6:31 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Tuesday, October 16, 2018 6:54 PM +0200 Dieter Klünter > <dieter(a)dkluenter.de> wrote: > > > Am Tue, 16 Oct 2018 15:51:50 +0200 > > schrieb Lirien Maxime <maxime.lirien(a)gmail.com>: > > > >> Hi all, > >> thanks for reading. > >> I have a "supervision" account on all my ldap servers. With the plugin > >> nagios , it check the synchro. I would like this account read only > >> contextcsn to check synchro. And only contextcsn not the other > >> entries. (plugin check nagios). > >> Can someone help me to write the right ACL ? > >> > >> Here what I tried but not really right :-/ > >> # ContextCSN > >> access to dn.subtree="dc=fr" attrs=contextCSN > >> by dn.subtree="cn=supervision,ou=Comptes Clients,dc=fr" read > >> by * none > > > > access to dn.base=dc=fr > > attrs=entry,children,contextCSN read > > I'd also be careful of doing "by * none" to the contextCSN, etc, as that > can break replication depending on the DN that binds to the master(s), > since the replication DN must be able to read the contextCSN. > > --Quanah > > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > >

2 1

Re: Adding read-only consumers to a Mirror Mode Replication setup?
by Quanah Gibson-Mount 18 Oct '18

18 Oct '18

--On Thursday, October 18, 2018 1:44 PM +0200 Ondřej Kuzník <ondra(a)mistotebe.net> wrote: > I can see cn=config is being replicated in that ticket. It makes more > sense that the 'unwilling to perform' issue would be limited to > replicating the config (which can be more picky about its modifications) > rather than regular databases. cn=config is not being replicated in that ticket. I simply said in one follow up that things broke after I made a change to cn=config. Later, I clearly stated that was entirely unrelated. ;) > That kind of setup is being used in a significant number of deployments > and by Linus' law we'd have more reports like this one. I've never seen that setup in any deployment. I've seen lots of deployments that say, have 2-way MMR, and 3 replicas that feed of Master #1 and 3 replicas that feed off of Master #2. But not where any replica feeds from *both* masters, as is discussed in the ticket. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

ODD #5 Proceedings
by Howard Chu 17 Oct '18

17 Oct '18

Proceedings are partially online now. http://www.openldap.org/conf/odd-tuebingen-2018/ (The last 2 talks are still missing, will be uploaded when available.) -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Check synchro : access only to contextcsn
by Lirien Maxime 16 Oct '18

16 Oct '18

Hi all, thanks for reading. I have a "supervision" account on all my ldap servers. With the plugin nagios , it check the synchro. I would like this account read only contextcsn to check synchro. And only contextcsn not the other entries. (plugin check nagios). Can someone help me to write the right ACL ? Here what I tried but not really right :-/ # ContextCSN access to dn.subtree="dc=fr" attrs=contextCSN by dn.subtree="cn=supervision,ou=Comptes Clients,dc=fr" read by * none Thanks.

3 2

Password policy messages - how can I pass back
by Ervin Hegedüs 13 Oct '18

13 Oct '18

Hi there, there is a password policy external module with this config: dn: cn=default,ou=pwpolicies,dc=hu cn: default objectClass: pwdPolicy objectClass: pwdPolicyChecker objectClass: device pwdAllowUserChange: TRUE pwdInHistory: 5 pwdMinLength: 10 pwdAttribute: userPassword pwdCheckQuality: 1 pwdCheckModule: pwdCheckModule-poc.so I've grabbed this source: https://github.com/bindle/bofh-pwdCheckModules Everything works as well: I can change the password with ldappasswd tool, or ldap_exop() in PHP - the policy check works in both cases. I just have one question: is there any way to send back to the client the error message? I mean: # /usr/bin/ldappasswd -H ldaps://dev-ldap-01 -w "secret" -D "UID="dminuser,dc=hu" -s "abcdefghijkl" "uid=airween,ou=Users,dc=hu" Result: Constraint violation (19) There isn't any detailed information, what's the reason why the policy module drops the request, but I can see that in the logfile: Oct 10 20:05:21 dev-ldap-01 slapd[16312]: check_password_quality: module error: (pwdCheckModule-poc.so) Passwords less than 16 characters require at least 3 traits (upper case, lower case, digits, or special characters).[1] Oct 10 20:05:21 dev-ldap-01 slapd[16312]: send_ldap_result: conn=1742 op=1 p=3 Oct 10 20:05:21 dev-ldap-01 slapd[16312]: send_ldap_result: err=19 matched="" text="Passwords less than 16 characters require at least 3 traits (upper case, lower case, digits, or special characters)" It would be very good to catch this message at client side. Is it possible? Note, that in PHP side I'm using: ldap_get_option($ldapconn, LDAP_OPT_DIAGNOSTIC_MESSAGE, $_err); and $_err variable is empty. When I send the old password, which exists in history, I got: ldappasswd -H ldaps://... ... ... -s "oldpasswd" "uid=airween,..." Result: Constraint violation (19) Additional info: Password is not being changed from existing value in PHP: "Password is not being changed from existing value" In syslog I can see: Oct 10 20:09:36 dev-ldap-01 slapd[16312]: send_ldap_result: err=19 matched="" text="Password is not being changed from existing value" Oct 10 20:09:36 dev-ldap-01 slapd[16312]: send_ldap_extended: err=19 oid= len=0 Oct 10 20:09:36 dev-ldap-01 slapd[16312]: send_ldap_response: msgid=2 tag=120 err=19 Oct 10 20:09:36 dev-ldap-01 slapd[16312]: conn=1743 op=1 RESULT oid= err=19 text=Password is not being changed from existing value Should I fill some member of Entry struct in 3rd argument in policy module? int check_password (char *pPasswd, char **ppErrStr, Entry *pEntry) ....................................................^^^^^^^^^^^^^^ Thanks, a.

3 6

How to add a new schema on N-way multi-master with legacy config
by Martin Božič 12 Oct '18

12 Oct '18

Hello, We've inherited an N-way multi-master setup (based on CentOS OpenLDAP v. 2.4.39) which was setup with text conf in slapd.conf instead of online configuration in cn=config. Due to various dependencies from other internal systems we can't migrate to online configuration quickly, but we to urgently have to add an additional schema to our cluster. My Google-fu and wading through the openldap list archives was unsuccessful. I suppose that adding a new schema to such a setup would require the following steps: 1. stop all instances in the cluster 2. add schema to all instances to /etc/openldap/schema 3. start all instances in the cluster Would this be the correct approach or is there something else I should be aware of? Regards, Martin Božič

4 3

role based authorization -> dynacl module?
by Daniel Tröder 11 Oct '18

11 Oct '18

Hello everyone, I am in the process of implementing a role concept via ACLs and hope for a hint so that I don't invent the wheel a second time. Specifically, it is about identity management for schools. A user (object) can have several roles in multiple schools. Permissions on other LDAP objects can thus differ depending on the role(s) the user and the object have in the same school(s). For example, a user could have been assigned the following roles that are scattered over several schools: → "Teacher" in school 1 → "School admin" in school 2 → "Parent" in school 3 → both "Teacher" and "Staff" in school 4 ACLs should now be defined accordingly, e.g. → the role "teacher" at school X can reset the password for the role "student" at school X → the role "teacher" at school X *cannot* reset the password for the role "student" of school Y → the role "school administrator" at school X can reset the password for the roles "student" and "teacher" at school X → ... So far I have not seen any way to map such a construct via groups or sets without including a separate ACL for each group, which is a performance issue. Is there another way to map the role concept besides implementing an own dynacl module? Greetings, Daniel

4 13

Fwd: ppolicy and logging
by Maurice Barlow 10 Oct '18

10 Oct '18

Greetings, using 2.4.45 on Solaris 11 ( shipped with the distro ) with ppolicy. Working on the locking out of the accounts and want to configure detailed messages pumped into syslog to track lockout activity. At the moment what i see is only "errorno=49". Any ideas or a secure log_level ? cheers MB

1 0

Using ppolicy and autogroup to apply policy to a group a users
by Clément OUDOT 08 Oct '18

08 Oct '18

Hello, we often have the question on this list: how apply a policy to a branch or a group of users? I was thinking we could use autogroup we this kind of configuration: dn: olcOverlay={9}autogroup,olcDatabase={1}mdb,cn=config objectClass: top objectClass: olcConfig objectClass: olcAutomaticGroups objectClass: olcOverlayConfig olcOverlay: {9}autogroup olcAGattrSet: pwdPolicy memberUrl seeAlso olcAGmemberOfAd: pwdPolicySubentry The goal is to have a memberUrl inside a pwdPolicy object, that can target accounts that need to have this policy. For example: dn: cn=default,ou=ppolicies,dc=example,dc=com changetype: modify replace: memberURL memberURL: ldap:///ou=users,dc=example,dc=com??one?(uid=user*) The autogroup "olcAGattrSet" is working well, I can see the seeAlso values. But the "olcAGmemberOfAd" does not seem to be applied. I don't know if this is a conflict with ppolicy overlay, or other overlays (dynlist, memberof). I join a full debug log, maybe you can find what is going wrong. We see that "autogroup_member_search_modify_cb" function is called, but user entry is not modified. Do you think this configuration could work? -- Clément Oudot | Identity Solutions Manager clement.oudot(a)worteks.com Worteks | https://www.worteks.com

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical