openldap-technical

openldap-technical@openldap.org

12 participants
9980 discussions

slapo-otp: manual page could be improved
by Windl, Ulrich 21 Feb '25

21 Feb '25

Hi! Reading the slapo-otp manual page, It's not quite clear to me how it works: * The tokens are stored in a separate entry, but does the manual page say what object type that entry has to be? I wonder why the token isn't stored directly within the user entry as tokens most likely are not shared. * Likewise "parameters" are stored in a separate entry; again what object type would those be? * Confusingly the manual talks about "attributes" next: Are those "parameters"? I mean: length and HMAC algorithm might be shared among entries, but counter and time-step cannot. A sample configuration would be really helpful, given that the only reference is "See also slapd-config(5)". Kind regards, Ulrich Windl

2 1

Migration from 2.4 to 2.5: problem with using "olcPPolicyDefault" in ACL duriung slapadd
by Windl, Ulrich 21 Feb '25

21 Feb '25

Hi! I'm about to migrate openLDAP 2.4 from SLES12 SP5 to openLDAP 2.5 from SLES15 SP6, following the rather terse https://www.openldap.org/doc/admin25/appendix-upgrading.html. I've removed the policy schema as advised from the LDIF export of cn=config, but now it seems that slapadd cannot use "olcPPolicyDefault" in an ACL: # slapadd -v -n0 -F /etc/openldap/slapd.d -S 1 -w -l 0.ldif added: "cn=config" (00000001) added: "cn=module{0},cn=config" (00000001) added: "cn=schema,cn=config" (00000001) added: "cn={0}core,cn=schema,cn=config" (00000001) added: "cn={1}cosine,cn=schema,cn=config" (00000001) added: "cn={2}inetorgperson,cn=schema,cn=config" (00000001) added: "cn={3}rfc2307bis,cn=schema,cn=config" (00000001) added: "cn={4}yast,cn=schema,cn=config" (00000001) added: "cn={5}sudo,cn=schema,cn=config" (00000001) added: "olcDatabase={-1}frontend,cn=config" (00000001) olcAccess: value #1: unknown attr "olcPPolicyDefault" in to clause. <access clause> ::= access to <what> [ by <who> [ <access> ] [ <control> ] ]+ <what> ::= * | dn[.<dnstyle>=<DN>] [filter=<filter>] [attrs=<attrspec>] <attrspec> ::= <attrname> [val[/<matchingRule>][.<attrstyle>]=<value>] | <attrlist> <attrlist> ::= <attr> [ , <attrlist> ] <attr> ::= <attrname> | @<objectClass> | !<objectClass> | entry | children <who> ::= [ * | anonymous | users | self | dn[.<dnstyle>]=<DN> ] [ realanonymous | realusers | realself | realdn[.<dnstyle>]=<DN> ] [dnattr=<attrname>] [realdnattr=<attrname>] [group[/<objectclass>[/<attrname>]][.<style>]=<group>] [peername[.<peernamestyle>]=<peer>] [sockname[.<style>]=<name>] [domain[.<domainstyle>]=<domain>] [sockurl[.<style>]=<url>] [ssf=<n>] [transport_ssf=<n>] [tls_ssf=<n>] [sasl_ssf=<n>] <style> ::= exact | regex | base(Object) <dnstyle> ::= base(Object) | one(level) | sub(tree) | children | exact | regex <attrstyle> ::= exact | regex | base(Object) | one(level) | sub(tree) | children <peernamestyle> ::= exact | regex | ip | ipv6 | path <domainstyle> ::= exact | regex | base(Object) | sub(tree) <access> ::= [[real]self]{<level>|<priv>} <level> ::= none|disclose|auth|compare|search|read|{write|add|delete}|manage <priv> ::= {=|+|-}{0|d|x|c|s|r|{w|a|z}|m}+ <control> ::= [ stop | continue | break ] slapadd: could not add entry dn="olcDatabase={0}config,cn=config" (line=908): ▒5=▒ Closing DB... (Also note the garbage in the error message that seems to appear for any slapadd error) As noted Openldap is SUSE's version (openldap2_5-2.5.18+31-150500.11.12.1.x86_64) they re-introduced in SLES15 SP5 (maybe due to failing to provide a working migration tool to 389-DS and a proper administration manual) So is it a bug that the attribute cannot be used in ACL, or is it a configuration error on my side? (line 908 is "dn: olcDatabase={0}config,cn=config") The actual line in question is like this: olcAccess: {1}to attrs=olcPPolicyDefault by dn.exact="uid=PP-Checker,ou=system,dc=domain,dc=org" read by * break Kind regards, Ulrich Windl

2 2

Change from mono to multivalued
by Frédéric Goudal 19 Feb '25

19 Feb '25

Hello, I may have to change some attributes from mono valued to multivalued on my production openldap I would like to know if I can do the change dynamically on the running ldap ? Most of my openldap are in 2.6.x version, but… I have one old in 2.4 (yes I know, it’s a very bad idea but too many problems to change it for me now) Thanks in advance Frederic — Frédéric Goudal Ingénieur Système, DSI Bordeaux-INP +33 556 84 23 11

2 1

EAP-TLS extend logged lines
by Alexey D. Filimonov 19 Feb '25

19 Feb '25

Hello. Currently I have EAP-TLS auth. On successfull auth, it logs Wed Feb 19 15:23:13 2025 : Auth: (9) Login OK: [anonymous-xxx] (from client name_of_client1 port 8 cli ee:ee:ee:ed:ae:ee) I'd like to extend or replace this line with UPN from certiificate and other attributes. Where should I start from ?

2 2

Attribute value as glue
by mbalakri＠opentext.com 18 Feb '25

18 Feb '25

We have multimaster replication in place, and sync replication is working. However, we have noticed some glue values for certain entries. What could be the reason for these glue entries, and how can we avoid them? This is a sample entry wit glue values for objectClass and structuralObjectClass attribtues. Please suggest how to avoid these glue values. dn: cn=organizational users,o=test,cn=test,cn=acd,o=in.bbn.ac entryUUID: 2acd5574-47fb-4414-b930-65d3fefc40cb creatorsName: cn=Directory Manager,o=in.bbn.ac createTimestamp: 20240730130003Z entryCSN: 20240730130003.412795Z#000000#001#000000 modifiersName: cn=Directory Manager,o=in.bbn.ac modifyTimestamp: 20240730130003Z objectClass: top objectClass: glue structuralObjectClass: glue

4 11

External LDAP authentication depending on user attributes?
by alexey＠filimonic.net 17 Feb '25

17 Feb '25

I have two LDAP servers (ActiveDirectory) with users: On AD horns-and-hooves.org: cn=Jane Smith,ou=users,dc=horns-and-hooves,dc=org cn: jane.smith(a)contoso.com On AD bells-and-whistles.com: cn=John Snow,ou=users,ou=europe,dc=bells-and-whistles,dc=com mail: john.snow(a)contoso.com And for mail system, I need to grab some of those users to single OpenLDAP database (dc=internal), add some mail system-specific attributes (that dont exist in source ADs) and add passthrough authentication for them to the AD server where they belong. Like this: cn=jane.smith,ou=horns-and-hooves,dc=internal mailQuota: 10 imapHost: imap1 mail: jane.smith(a)contoso.com sourceOrg: horns-and-hooves cn=john.snow,ou=bells-and-whistles,dc=internal mailQuota: 20 imapHost: imap2 mail:: john.snow(a)contoso.com sourceOrg: bells-and-whistles I expect algorithm like this: First, I manually create users in OpenLDAP directory without passwords with correct attributes. When Jane makes simple_bind to OpenLDAP server, the server determines if user is related to horns-and-hooves organization or to bells-and-whistles. If "horns-and-hooves" then server makes a search against ldap://horns-and-hooves.org:389/dc=horns-and-hooves,dc=org for '(mail=$1)' where $1 is value of mail from `mail` attribute. it finds one item, OpenLDAP tries to make bind to ldap://horns-and-hooves.org:389 with DN of item found and password provided by Jane to OpenLDAP. If "bells-and-whistles" then backend server is ldap://bells-and-whistles.com:389/dc=bells-and-whistles,dc=com , other is same. How server determines if user is a hosn-an-hooves user or bells-and-whistles user - based on some attriburte value (sourceOrg) or based on DN value (ou=horns-and-hooves,dc=internal vs ou=bells-and-whistles,dc=internal) - IDK if any of this is possible. Does this algorithm implementation requires SALSd, or it can be done with OpenLDAP-only? Could you please help me getting this configuration done?

3 2

Few questions about replica (mirror mode?)
by alexey＠filimonic.net 17 Feb '25

17 Feb '25

I plan few OpenLDAP servers: N readonly secondaries and single writable main. In my case OpenLDAP is critical as readonly database, and changes are allowed to fail. But I need all readonly replicas contain the same data same time, and I have possibilities to temporarily disconnect readonly secondaries from master. Is there a some kind of operational\replication mode when: - Transactional changes over all servers: Writable main fails writing to database and propagating them to secondaries in case any of secondaries can not receive same changes - Secondary server may start "empty" and self-register as secondary server on writeable main, then get in sync. Until sync complete, secondary server will not satisfy any requests from clients.

3 2

lload backend-server connection issues
by Ben Poliakoff 17 Feb '25

17 Feb '25

I've successfully set up haproxy with current openldap slapd backend instances, the ldap client IP is passed on to my slapd instances, and things like IP based ACLs work. But now I'm exploring and comparing the features of the OpenLDAP lloadd backend. I've been using the embedded version, loading lloadd.a into slapd and I've been using the example configs from https://www.openldap.org/doc/admin26/loadbalancer.html as a starting point. I'm consistently seeing these errors on the backend slapd: Feb 4 10:45:33 test local4.debug slapd[508415]: proxyp(19): invalid header signature Feb 4 10:45:33 test local4.debug slapd[508415]: slapd(19): proxyp failed And on the frontend slapd (running lload) I'm seeing these sorts of errors: Feb 4 10:48:12 slapd-lb-a local4.debug slapd[271207]: operation_init: received a new operation, bind request with msgid=1 for client connid=6 Feb 4 10:48:12 slapd-lb-a local4.debug slapd[271207]: request_bind: connid=6, msgid=1 no available connection found When I compare the traffic between slapd w/lload and the backend slapd with traffic between haproxy and the same backend slapd, the main thing that I notice is that the slapd w/lload is doing a TLSv1 client hello whereas haproxy is doing a TLSv1.3 client hello. Is it possible that the lloadd code doesn't support TLSv1.3? I'd be surprised if that were the case, since the same slapd happily supports client connections with TLSv1.3, but I can't figure out why it's only trying TLSv1. I'm running openldap 2.6.9 packages from Symas on Debian 12, for what it's worth. While I've been working on this I've been using the slapd.conf style config, but would transition to cn=config if it were to go to production. I've tried configuring the backend server URI with ldap://, ldaps://, pldap://, and pldaps://, all with the same results. My current config follows. Thanks for any suggestions! Ben ------- current config ----------------------------------------------- TLSCertificateFile /etc/haproxy/haproxy.pem TLSCertificateKeyFile /etc/haproxy/haproxy.pem TLSCACertificatePath /etc/ssl/certs loglevel stats #loglevel -1 pidfile /var/symas/run/openldap-lload.pid allow bind_v2 include /opt/symas/etc/openldap/schema/core.schema modulepath /opt/symas/lib/openldap # require at least SSL/TLS for simple binds security simple_bind=1 moduleload lloadd.la backend lload # The Load Balancer manages its own sockets, so they have to be separate # from the ones slapd manages (as specified with the -h "URLS" option at # startup). listen ldaps://:10636 # Enable authorization tracking feature proxyauthz # Specify the number of threads to use for the connection manager. The default is 1 and this is typically adequate for up to 16 CPU cores. # The value should be set to a power of 2: io-threads 2 TLSShareSlapdCTX true # Authentication and other options (timeouts) shared between backends. bindconf bindmethod=simple tls_cacertdir="/etc/ssl/certs" binddn=uid=ldap-lb,ou=Services,dc=example,dc=com credentials=xxxxxxxxxxxxxxxxxxxxxxxxxxx network-timeout=5 tier bestof backend-server uri=pldaps://backend-slapd-hostname:8636 retry=5000 max-pending-ops=50 conn-max-pending=10 numconns=10 bindconns=5 ####################################################################### database monitor

2 1

Make OpenLDAP proxy only simple_bind requests to other LDAPs
by Alexey D. Filimonov 11 Feb '25

11 Feb '25

My goal is to [manually] maintain a database of users using OpenLDAP directory, with some set of attributes and values. All of those users have their second accounts in different external LDAP directories (2 directories). For those users, I want OpenLDAP server to passthrough simple_bind authentication to one of those directories. When I manually create a user in OpenLDAP directory, I want specify a `backend keys` in some attributes, that will tell OpenLDAP server how to process user's simple_bind authentication. For example, I can specify some sort of attributes like `backendRealm = ActiveDirectory1` and `mail = jack(a)contoso.com` to tell OpenLDAP to lookup object DN on servers from group `ActiveDirectory1` with `mail=jack(a)contoso.com` filter and try to simple_bind against one server from group `ActiveDirectory1` using DN it fount and password user provided originally. DNs of all users are not even partially equal between directories. Suffixes are different too. All OpenLDAP users and attributes are maintained manually, without proxying (except authentication). Please help me if I can do this somehow using OpenLDAP? Can I do this without using SASLD? Alex.

2 4

container image building and syncing
by Marc 11 Feb '25

11 Feb '25

I use echo "127.0.0.2 ldap.example.com" >> /etc/hosts to prevent the running ldap server from syncing during image building. However when using DOCKER_BUILDKIT=1 this is not possible any more (read only fs). I was wondering if it is possible to start slapd so it does not start syncing?

3 5

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical