openldap-technical

openldap-technical@openldap.org

18 participants
9785 discussions

solaris client ldap-backend to AD and DSE
by Craig H Silva (Cenitex) 30 Nov '23

30 Nov '23

I need to configure openldap as a proxy to AD so that AD can be upgraded to version 2019. Currently using Unix services for Windows, which works to provide nis information to solaris (11) and zfsappliance but it was deprecated after windows 2012. There's still nis info info in various attributes in AD schema, but the nis service is about to go. So an alternative is needed. I have the proxy configured with ldap-backend and its very happy to provide all the attribute information, but the solaris ldap client wants the DSE through the proxy and for the life of me I can't work out what is impeding it. I can "ldapsearch -Y EXTERNAL -H ldapi:/// -b "" -s base -LLL "+"" on the openldap system and the DSE is returned and I can get the DSE with an ldapsearch from the solaris client if I point directly at the AD ldap server, but if i point solaris at the openldap proxy - nada. This really upsets the ldapclient on solaris - it feels degraded. It feels like its an access issue as I can get a DSE when root on the openldap system. from config: # {1}ldap, config dn: olcDatabase={1}ldap,cn=config objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {1}ldap olcSuffix: dc=myorg,dc=lcl olcAccess: {0}to dn.base="" by * read olcAccess: {1}to dn.base="cn=Schema" by * read olcAccess: {2}to dn.base="cn=Subschema" by * read olcAccess: {3}to * by self read by users read by anonymous auth olcAddContentAcl: FALSE olcLastMod: FALSE olcMaxDerefDepth: 15 olcReadOnly: TRUE olcRootDN: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth olcSyncUseSubentry: FALSE olcMonitoring: FALSE olcDbURI: "ldaps://myorgdevad.myorgdev.lcl:636" Any guidance appreciated - logs available on request. Craig Silva | Specialist Engineer – Unix & Storage Services Level 18, 80 Collins Street, Melbourne 3000 (03) 9063 5126 cenitex.vic.gov.au Cenitex acknowledges the Traditional Owners and custodians of the land and we pay our respects to their Elders, past, present and emerging. We are an inclusive workplace that embraces diversity in all its forms. ---------------------------------------------------------------------- Notice: This email and any attachments may contain information that is personal, confidential, legally privileged and/or copyright. No part of it should be reproduced, adapted or communicated without the prior written consent of the copyright owner. It is the responsibility of the recipient to check for and remove viruses. If you have received this email in error, please notify the sender by return email, delete it from your system and destroy any copies. You are not authorised to use, communicate or rely on the information contained in this email. Please consider the environment before printing this email.

2 2

Re: Need assistant to Implement and Configure OpenLDAP for users authentication from Multi-Domain
by Quanah Gibson-Mount 28 Nov '23

28 Nov '23

--On Thursday, November 23, 2023 12:21 PM +0000 Sunil Sharma <sunil.sharma(a)mdsglobalit.com> wrote: > • What would be the Best OS for OpenLDAP currently, is it Linux, > CentOS or any other? Generally any current linux distribution with a current openldap release. > • We have users from Multi-Domain where these domains do not have any > trust relationship between each other and we need to authenticate the > users from multi-Domain for UC applications (CUCM, CUC, CER, UCCE, > Expressways and Jabber). > > > > We are looking if we can sync the user database from > these multidomain to a single OpenLDAP server and then from this OpenLDAP > to UC applications using single search base for authentication, is this > possible? Probably? --Quanah

1 0

Access to cn=monitor from read-only ldap
by Kevin Cousin 21 Nov '23

21 Nov '23

Hi List, I've got an LDAP architecture with one read-write OpenLDAP (primary) and some read-only OpenLDAP (replica). I load the cn=monitor backend on the primary? is it sufficient to have the cn=monitor backend on the slave too or should I activate it on the replicas ? Regards, Kevin C

3 2

syncrepl between 2.4.57.0.1 and 2.6.2-3
by Frank, Michael 16 Nov '23

16 Nov '23

Airbus Amber Dear all, basically I trying to establish a syncrepl/refreshAndpersist Setup between: OpenLDAP: 2.4.57.0.1 @ Solaris < - > OpenLDAP: 2.6.2-3 @ Rhel 9.latest (don`t ask) An intial syncrepl activation does works properly (replication of ou`s content in both directions), but when I afterwards restart one of the replication Partners, the sync failes and in consequence on one of replication Partner the ou`s are deleted. From logging point of view there are somekind of issues to identify the remote object via the UUID which leads then to the deletion: ##schnipp 6538d3db.38892890 0x7f9fe65fe640 nonpresent_callback: rid=044 nonpresent UUID 25a0c72c-0364-103e-83af-fb52f2a7ef64, dn ou=permissions,dc=xxx,dc=xxxx,dc=xxxxxx 6538d3db.388983a6 0x7f9fe65fe640 nonpresent_callback: rid=044 adding entry ou=permissions,dc=xxxx,dc=xxxxx,dc=xxxx to non-present list ###schnapp Unfortunately I cannot find any Information which says something useful about the basic backward compatibility of the synrepl/refreshAndPersist implementation from 2.6 to 2.4. Can someone state why this mission is hopeless in detail or should the setup work basically ? (I know the best practice : everywhere same versions...) Best regards and thanks in advance, michael This Item has been reviewed and was determined as not listed under German regulation, nor EU export controls, nor U.S. export controls. However, in the case of the item has to be resold, transferred, or otherwise disposed of to an embargoed country, to an end user of concern or in support of a prohibited end use, you may be required to obtain an export license. The information in this e-mail is confidential. The contents may not be disclosed or used by anyone other than the addressee. Access to this e-mail by anyone else is unauthorised. If you are not the intended recipient, please notify Airbus immediately and delete this e-mail. Airbus cannot accept any responsibility for the accuracy or completeness of this e-mail as it has been sent over public networks. If you have any concerns over the content of this message or its Accuracy or Integrity, please contact Airbus immediately. All outgoing e-mails from Airbus are checked using regularly updated virus scanning software but you should take whatever measures you deem to be appropriate to ensure that this message and any attachments are virus free.

3 8

"user"/"users" keyword in documentation
by Uwe Sauter 12 Nov '23

12 Nov '23

Hi all, in the ACL chapter of the online documentation to OpenLDAP 2.6 (and likely the versions before) there might be a mismatch of singular/plural usage of the "users" keyword. In chapter 8.3.2 "who to grant access to" table 5.3 lists specifier "users" as "authenticated users" entities. This is further shown in chapter 8.4.2 "matching anonymous and authenticated users". In chapter 8.4.9 "tips for using regular expressions in access control" the singular is used: "Use shorthands. The user directive matches authenticated users and the anonymous directive matches anonymous users." As well as in the subchapters 8.5.x where the singular is used in set definitions. My question now is: does it matter whether singular or plural of user is used in ACLs? If so, where to use one and where to use the other? Does it follow natural language useage? Thanks, Uwe

2 2

Thread Safety in LMDB with MDB_NOTLS and Readonly Cursors
by xiaoya2wei＠gmail.com 08 Nov '23

08 Nov '23

Greetings LMDB Community, I am delving into the thread-safety aspects of LMDB, specifically regarding the use of readonly cursors across multiple threads. With the MDB_NOTLS flag enabled, which disables thread-local storage, my understanding is that readonly transactions may be shared between threads, provided there is proper synchronization to prevent concurrent access. Building upon this, I seek clarity on the following: Can multiple threads safely access a single readonly cursor derived from such a synchronized readonly transaction when MDB_NOTLS is enabled? Upon reviewing the LMDB source code, I noticed that cursors are tied to transactions (see mdb.c#L1335). This suggests that if threads can synchronously share a transaction, they might also share a cursor associated with it for data retrieval. Meanwhile, while looking at the LMDB document (http://www.lmdb.tech/doc/group__mdb.html#gad7ea55da06b77513609efebd44b26920), it says “Cursors may not span transactions”, which is a little confusing for me. To be crystal transparent, does it mean that, even if MDB_NOTLS is set, a cursor opened by a readonly transaction still has to stay with one single thread for its entire lifetime, and cannot be used by another thread even at a different time? Thank you in advance for your assistance! Best, Xiaoya

2 4

Issue with refint and rwm overlay
by Maksim Saroka 07 Nov '23

07 Nov '23

Hello, We have a strange situation with refint and rwm overlays on ldap replica. Looks like those overlays depend on each other and on position in the slapd.conf file regarding database section. However refint overlay is working in any position if rwm overlay is not specified. Here are the examples with positions in the file: Refint overlay work if: 1. rwm overlay section database section refint overlay section Refint overlay does not work if: 1. database section refint overlay section rwm overlay section 2. rwm overlay section refint overlay section database section Could you please explain to us the root cause of that as I can't find any explanation in the docs. -------- Maksim Saroka DevOps/System Administrator Exadel.com <https://exadel.com/> Follow Us on LinkedIn <https://www.linkedin.com/company/exadel/> -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

2 5

email aliases - extended version
by Chris Vogel 01 Nov '23

01 Nov '23

Hi, I moved from a mailserver using exim/mysql to one based on postfix/ldap and found a question I couldn't answer by searching: Is there a way to put "email aliases like I'm used to" into the directory? By "email aliases like I'm used to" I mean 1-m aliases with the following properties: - An email received for an alias address is send to multiple maildrops and/or email addresses Additinally I'd like to add information about ownership/permissions: - An alias has got one or more owner(s) who - are able to edit the list of receivers - are allowed to delete the alias - change permission on it like described below - An alias has properties that describe the permission local receivers have (for all of the local receivers or every single local): - its open to subscription by every uid (user on the system) or only the owners are allowed to add new receivers - delete oneself from the list of receivers - allowed to use the alias address as email sender for emails delivered by the account I know this sounds like mailinglist, but most of that has been possible in exim using files and file permissions or values in a mysql database. A listmanager would add some interface for managing this, but that is not what I'm looking for. I'm looking for an existing standard or quasi-official way on how to represent this in the directory before inventing the wheel a second time. Along my way I stumbled over this two messages on the list which seem to point in a similar direction: https://lists.openldap.org/hyperkitty/list/openldap-technical@openldap.org/… https://lists.openldap.org/hyperkitty/list/openldap-technical@openldap.org/… Thanks for any references or help Chris

2 1

OpenLDAP 2.4 (released October 2007) - Question
by Steffano Festa 01 Nov '23

01 Nov '23

Hi team, Is the OpenLDAP 2.4 (released October 2007) still actively maintained? Or can we consider it as EOL? [cid:image001.png@01DA0CCC.4B603970]

2 1

lastbind not working on consumer since version 2.6.3
by alexjl1＠thenode.info 01 Nov '23

01 Nov '23

Hi, I have a single provider / multiple consumers setup with olcLastBind enabled on all servers but excluding the pwdLastSuccess attribute from syncing, so that the provider and each consumer have their own values. After updating one of the consumers from 2.6.2 to 2.6.3, I noticed that pwdLastSuccess stopped refreshing on new binds. So, on a test machine I installed 2.6.3 and then 2.6.6 and verified that when the server is set to read only or as a simple consumer (no multiprovider), pwdLastSuccess is not modified. Is this a result of the fixes for ITS#9863 in 2.6.3? If this is not a bug, but intended behavior, is there a way to have lastbind work in a simple consumer (without making it writable)?

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical