openldap-technical

openldap-technical@openldap.org

14 participants
9795 discussions

SASL EXTERNAL olcRootDN and ACLs
by linux nuse 28 Sep '18

28 Sep '18

https://www.openldap.org/doc/admin24/access-control.html says: Regardless of what access control policy is defined, the rootdn is always allowed full rights (i.e. auth, search, compare, read and write) on everything and anything. As a consequence, it's useless (and results in a performance penalty) to explicitly list the rootdn among the <by> clauses. "Well", said I and set olcRootDN to gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth. Then I've tried to add an entry with $ sudo ldapadd -Y EXTERNAL -H ldapi:/// .... and OpenLDAP told that I don't have permission to modify the DB. I had to grant gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth access to everything in the backend's ACL to make it working. Is it expected that gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth rootdn does not have full rights without explicit permission or I need to recheck because I could get something wrong (didn't restart slapd or something like that)?

2 3

RE: Restarting syncrepl based provider / consumer setup trawls through whole DIT - why?
by Ole Nomann Thomsen 26 Sep '18

26 Sep '18

> --On Monday, September 24, 2018 2:51 PM +0000 Ole Nomann Thomsen > <ole.nomann(a)stil.dk> wrote: > > > 2018-09-12T16:25:41.526574+02:00 nonpresent_callback: rid=001 present > > UUID 9b99ec5a-4cfe-1029-9a2e-80309636f032, dn > > ou=Authentication,o=UNI-C,c=DK > > This is the presence phase. > > > > I'm guessing that that the Consumer is looking up every entry to decide > > if it has changed. > > It is confirming each entry is still present (not deleted). > > > > But why is it not persistent? Am a missing some obvious explanation as to > > why this is not possible, or have I just misconfigured something? Any > > hints where I should look? > > > > Is there a better way to set up replication to avoid this? > > a) Use delta-syncrepl > b) Ensure you have a large sessionlog setting (See ITS#8125, ITS#8486) > > Warm regards, > Quanah Thanks - You too. In my case, the present-phase is not really useful, since this particulat ldap-instance only ever adds and modifies entries, never deletes. Would it then be possible to skip it ? - Ole.

2 1

Slapd generate SQL by PostgreSQL based syntax
by 横山善行 25 Sep '18

25 Sep '18

Hi I use openldap slapd 2.4.40 + MySQL5.5 as back-sql on CentoS 6.9 It seems slapd generate PostgreSQL based syntax SQL Here is the error message for ldapsearch -x -b "dc=example,dc=com" '(objectClass=*)' 5b70e25c <==backsql_srch_query() returns SELECT DISTINCT ldap_entries.id,eduperson.id,text('inetOrgPerson') AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,eduperson WHERE eduperson.id=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND 9=9 AND 3=3 5b70e25c Constructed query: SELECT DISTINCT ldap_entries.id,eduperson.id,text('inetOrgPerson') AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,eduperson WHERE eduperson.id=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND 9=9 AND 3=3 5b70e25c id: '3' 5b70e25c backsql_oc_get_candidates(): error executing query 5b70e25c Return code: -1 5b70e25c nativeErrCode=1064 SQLengineState=37000 msg="[unixODBC][MySQL][ODBC 5.1 Driver][mysqld-5.5.57]You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '('inetOrgPerson') AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,edupers' at line 1" 5b70e25c send_ldap_result: conn=1000 op=1 p=3 5b70e25c send_ldap_result: err=80 matched="" text="" 5b70e25c send_ldap_response: msgid=2 tag=101 err=80 I take same message as I execute below from MySQL console. I can see text('inetOrgPerson') in the SQL which was generated by slapd however,MySQL doesn’t support text() function in its SQL. When I use Postgeresql as back-sql it works properly Is it a bug or setting error for some directives? ######################################### 一般財団法人日本建設情報総合センター（JACIC:ジャシック）建設副産物・発生土情報交換システム担当　国際土木委員会　事務局担当　　システムエンジニアリング部　横山　善行　電話　03-3505-2661　 FAX 03-3589-6258 mail yokoyamy(a)jacic.or.jp ########################################

1 0

How to make ldap evaluate clear text password vs DES stored password
by yokoyamy＠jacic.or.jp 25 Sep '18

25 Sep '18

Hi. I have user information in RDB which include user-id and password set. I’ve been trying to use this RDB as backend database for openldap server. Now,I can find user information in RDB through openldap. However, I recognized I can’t use this user information for ldap login certification process. LDAP’s userPassowrd stored in the RDB has been already DES hashed by original app. On the other hand, input password from ldapseach command line is CREARTEXT. Now I’d like my openldap to change CREATEXT input password into DES hassed text so that they'll match for certification. I've asked this topic on stackoverflow web site how to do that by server settings.But I couldn’t find proper directives to set. How to make ldap evaluate clear text password vs DES stored password Since then,I’ve been searching LDAP source files which is matching input password from ldapsearch command line against userPassword stored in backend RDB for slapd. I’d like to change certification process of LDAP source file to make input password into DES hashed by using 2 characters of userPassword as its SALT. I've already known that 2 characters at the beginning of userPasswordwas used as its SALT when it was hashed. So the fact is ,my slapd can read userPassword from the RDB. I think I'll be able to find out what will be SALT to make input password into DES hashed text. If I can make opeldap to act this way,I can use user's infomation in the RDB to ldap login inforomation wiht seamless.

5 15

Restarting syncrepl based provider / consumer setup trawls through whole DIT - why?
by Ole Nomann Thomsen 24 Sep '18

24 Sep '18

Hi, my problem is this: Whenever I restart a Consumer in our single-provider, multi-consumer syncrepl setup, type=refreshAndPersist (OpenLdap 2.4.45), It spends about half an hour running through the whole DIT (about 5.5 million entries), doing this for each: 2018-09-12T16:25:41.526574+02:00 nonpresent_callback: rid=001 present UUID 9b99ec5a-4cfe-1029-9a2e-80309636f032, dn ou=Authentication,o=UNI-C,c=DK I'm guessing that that the Consumer is looking up every entry to decide if it has changed. This has the unfortunate effect that the Consumer is deemed out-of-sync in the timespan (referring to the contextCSN in the root entry), even if only one entry has actually changed in the master. And it cannot be let back into the serverfarm before it is synchronized, thus making every restart of a Consumer require at least 30 mins downtime for that Consumer. If I read the docs correctly (https://www.openldap.org/doc/admin24/replication.html), there should be a synchronization cookie set after the refresh stage (and during the persist-stage). It looks to me like at least in my case, that cookie is not persistent - it seems that when the Consumer is restarted, this cookie is either lost or reset, causing the whole DIT to be read, and not just those entries, younger than the cookie. But why is it not persistent? Am a missing some obvious explanation as to why this is not possible, or have I just misconfigured something? Any hints where I should look? Is there a better way to set up replication to avoid this? Thanks - Ole N Thomsen

2 1

Trigger-like function
by Ervin Hegedüs 24 Sep '18

24 Sep '18

Hi, as I described in my previous thread[1], I have a web frontend tool, where user can modify its own password - here the password is a set of passwd attributes: userPassword, sambaNTPassword, sambaLMPassword. Is there any way that when I give access to users to modify its own password, and the user wants to modify it through LDAP(S), instead of out web frontend, the samba passwords also updated (with correct hash algorithm)? I've found that the password policy and history should handle inside of OpenLDAP, only this feature missing. I've also found slapo-shell and slapo-sock overlays, but as I interpret those mechanism, they sends the client request to an external software, so when I want to change the userPassword, the slapd send this request to the external tool, which sends a modify request to slapd, which sends the request to external tool, whcih.... Em I right? Or should I use some filter to exclude, which requests sending to external program and which not? Is there any solution for this request? Thanks, a. [1]: https://www.openldap.org/lists/openldap-technical/201809/msg00021.html

3 6

A couple of questions regarding replication and user mapping
by Karsten Heymann 21 Sep '18

21 Sep '18

Hi, I'm having a rough week as a long planned ldap migration this week went semi-bad, in that we noticed a good day after the new cluster went productive that both masters and both clients started to diverge data-wise. I'm still sorting out the details, but while troubleshooting some questions arose already. (I'm running 2.4.46+dfsg-5~bpo9+1 on debian 9 with two masters (syncrepl, mirror mode) behind a load balancer and two slaves, also behind a load balancer. I was authenticating the replication with client certificates, but had to switch back to simple bind usind rootdn/rootpw als sync credentials to rule out any acl problems causing our problems.) 1. I've read in an older debian bug report, that changing olcAuthRegexp requires a slapd restart in order to be effective. Is that still the case? If yes, could this *please* be added to the manpage and the documentation? Pretty please? 2. Is ldapwhoami supposed to also print out the result of a authz-regexp mapping? 3. The slapd.conf manpage mentions: "The replaced name can be either a DN, i.e. a string prefixed by "dn:", or an LDAP URI." Is prepending dn: really required? The examples on https://www.openldap.org/doc/admin24/sasl.html don't have it. 4. What happens when a lot of concurrent writes happen to two masters configured in mirror mode? We had a loadbalancer misconfiguration and the loadbalancers were using simple round robin to write to the masters. Can this result in diverging content on the two masters? 5. At one time we had diverging content on both masters for the same entries, probably due to a broken acl config that did not allow the sync user to see all alltributes on the other master. Is there any way to cause a "re-sync" of an entry without actually changing data on the entry? The only way I found was to use slapd -c, but And finally not a question, but a recommendation for anyone in a similiar situation: The ldifdiff-tool (https://github.com/nxadm/ldifdiff) proved extremely valuable in sorting out the mess and understanding what actually was the situation data-wise between the systems. Best regards Karsten

6 6

Password policy questions
by Ervin Hegedüs 20 Sep '18

20 Sep '18

Hi, looks like I've successfully configured the ppolicy overlay, but I have some questions. The relevant config: olcModuleLoad: {0}ppolicy structuralObjectClass: olcModuleList dn: olcOverlay={2}ppolicy,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: {2}ppolicy olcPPolicyDefault: cn=default,ou=pwpolicies,dc=hu olcPPolicyHashCleartext: FALSE olcPPolicyUseLockout: FALSE dn: cn=default,ou=pwpolicies,dc=hu cn: default objectClass: pwdPolicy objectClass: pwdPolicyChecker objectClass: device pwdAllowUserChange: TRUE pwdInHistory: 5 pwdMinLength: 10 pwdAttribute: userPassword pwdCheckQuality: 0 When I change my passwd with ldappasswd, the history check works: ldappasswd -H ldaps://dev-ldap-01:636 -W -D uid=airween,ou=Users,ou=company,dc=comp,DC=hu -S New password: Re-enter new password: Enter LDAP Password: Result: Constraint violation (19) Additional info: Password is in history of old passwords but I can set up new password with less than 10 characters, eg "abc". What em I missed? I've never read it, but looks like the policy has effect only when I'm changing passwd with 'ldappasswd', but when I'm using ldapmodify, then I can bypass the rules ldapmodify -H ldaps://dev-ldap-01:636 -D 'uid=airween,ou=Users,ou=company,dc=comp,dc=hu' -x -W -f file.ldif modifying entry "uid=airween,ou=Users,ou=company,dc=comp,DC=hu" [DONE WITH PREV PASSWD] Is it right? How can I validate the policy for all methods? Thanks, a.

3 4

Worse search performance on a branch than at the tree base
by Glover, Matthew 19 Sep '18

19 Sep '18

I'm having a performance problem with searches on a branch and I'm hoping someone can explain it. A search for "(uid=12345)" on basedn "dc=example,dc=com" with a subtree scope returns much more quickly than the same filter and scope on basedn "ou=People,dc=example,dc=com". To confirm this wasn't just a problem with my schema or configuration, I loaded Ubuntu 18 (slapd 2.4.45+dfsg-1ubuntu1), used ldctl to generate 100,000 inetOrgPerson records with uids from 00000 to 99999, loaded them in with ldapadd, then used ldctl to test performance of searches: Both tests were scope subtree, 20 seconds, hitting the test server as fast as possible with randomly generated filters of "(uid=<random uid from 00000 to 99999>)". basedn: dc=example,dc=com - 5455.30/sec - total: 109106 successful searches basedn: ou=People,dc=example,dc=com - 198.80/sec - total: 3976 successful searches Also, while testing against ou=People, the CPU load from slaps went through the roof. It feels rather like the index isn’t being used when the base isn’t the root. I can provide the ldif of my test users and the parameters I used for ldctl tests if desired. Thanks for any help you can offer, Matthew

2 2

groupOfMembers doesn't work with memberOf overlay
by tran dung 19 Sep '18

19 Sep '18

Hi I am using groupOfNames and memberOf overlay works fine. However, groupOfNames requires "member" attribute so in case a group doesn't have a member, I have to use a dummy user. Since groupOfMembers doesn't require "member" attribute, I replaced groupOfNames by groupOfMembers in ldif file and re-built ldap server. However, when I delete member attribute, corresponding menberOf isn't deleted. When I add member attribute, memberOf isn't added. Is this expected behavior of groupOfMembers or is something missing in memberOf overlay setting? Here is my memberOf overlay setting ------------------------------------- # Memberof overlay overlay memberof memberof-dangling drop memberof-refint true ------------------------------------- Best Regards ----------------------- Tran Dung

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical