openldap-technical

openldap-technical@openldap.org

9897 discussions

Replication Broke
by Daniel Howard 12 Jan '18

12 Jan '18

Hello, He have OpenLDAP replication set up based on the docs at https://help.ubuntu.com/lts/serverguide/openldap-server.html#openldap-serve… I noticed recently a symptom, whereby a new user exists only on the primary. So, I started to debug: Master: (ldap0) 0-16:23 djh@ldap0 ~$ ldapsearch -z1 -LLLQY EXTERNAL -H ldapi:/// -s base -b dc=qxxxxxxxxd,dc=com contextCSN dn: dc=qxxxxxxxxd,dc=com contextCSN: 20180113002606.399160Z#000000#000#000000 Consumer: (ldap1) 0-16:23 djh@ldap1 ~$ ldapsearch -z1 -LLLQY EXTERNAL -H ldapi:/// -s base -b dc=qxxxxxxxxd,dc=com contextCSN dn: dc=qxxxxxxxxd,dc=com contextCSN: 20171121212631.416502Z#000000#000#000000 Ooohhh, my! I have a lot of messages like this on the consumer: Jan 12 16:28:55 ldap1 slapd[5383]: syncrepl_message_to_entry: rid=317 DN: uid=djh,ou=People,dc=qxxxxxxxxd,dc=com, UUID: 29f7fc06-7c2a-1035-83e5-9d6082b37970 Jan 12 16:28:55 ldap1 slapd[5383]: syncrepl_entry: rid=317 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Jan 12 16:28:55 ldap1 slapd[5383]: syncrepl_entry: rid=317 inserted UUID 29f7fc06-7c2a-1035-83e5-9d6082b37970 Jan 12 16:28:55 ldap1 slapd[5383]: dn_callback : entries have identical CSN uid=djh,ou=People,dc=qxxxxxxxxd,dc=com 20180113002133.183992Z#000000#000#000000 Jan 12 16:28:55 ldap1 slapd[5383]: syncrepl_entry: rid=317 be_search (0) Jan 12 16:28:55 ldap1 slapd[5383]: syncrepl_entry: rid=317 uid=djh,ou=People,dc=qxxxxxxxxd,dc=com Jan 12 16:28:55 ldap1 slapd[5383]: syncrepl_entry: rid=317 entry unchanged, ignored (uid=djh,ou=People,dc=qxxxxxxxxd,dc=com) Jan 12 16:28:55 ldap1 slapd[5383]: syncrepl_message_to_entry: rid=317 DN: uid=john,ou=People,dc=qxxxxxxxxd,dc=com, UUID: ddaae880-7c2f-1035-83ed-9d6082b37970 Jan 12 16:28:55 ldap1 slapd[5383]: syncrepl_message_to_entry: rid=317 mods check (pwdChangedTime: attribute type undefined) Jan 12 16:28:55 ldap1 slapd[5383]: do_syncrepl: rid=317 rc 17 retrying What is funny is I can, for example, change the loginshell on my account, and that replicates. Is the latter message about pwdChangedTime a clue that maybe I had a schema change on Master that hasn't been applied to Consumer? Please advise on where to look next? Thanks! -danny -- http://dannyman.toldme.com

1 1

proxyauth app against consumer with chainoverlay
by Michael Wandel 12 Jan '18

12 Jan '18

Hallo, we are testing some application that use proxyauth against an consumer with chain overlay with proxyauth. The oenldap version is 2.4.44 . I'm not sure, if i made a mistake or is it a general problem to work with proxyauth in a ldapmodify against a consumer with chain overlay with proxyauth configured ? It looks like, the provider doesn't see the proxyauth from the app request. If someone has a hint or using this construct, I would be grateful for a solution. best regards Michael Wandel

1 0

Incosistent config after schema modification
by Ervin Hegedüs 11 Jan '18

11 Jan '18

Hi there, here are a 3 member multimaster config with OpenLDAP 2.4.44 (Debian 9.3). We need a custom schema, so I've made that - everithing has worked as well, but the customer said he needs to modify some attribute type in the new custom schema. I've made an ldif: dn: cn={5}cppm,cn=schema,cn=config changetype: modify replace: olcAttributeTypes olcAttributeTypes: {0}( cppmAttrs:1 NAME 'cppmCreateTime' DESC 'Create time' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{20} SINGLE-VALUE ) olcAttributeTypes: {5}( cppmAttrs:6 NAME 'cppmExpireTime' DESC 'Expire time' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{20} SINGLE-VALUE ) olcAttributeTypes: {7}( cppmAttrs:8 NAME 'cppmActivationTime' DESC 'Activati on time' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{20} SINGLE-VALUE ) # ldapmodify -Y EXTERNAL -H ldapi:/// -f mod1.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "cn={5}cppm,cn=schema,cn=config" Then I'ld liked to add this new objectclass to a member of tree, but I got an error: "cppmDomainName: attribute type undefined" but - of corse - I've added this attribute to the original schema. So, I'ld like to backup the config database, but the slapcat said: # slapcat -b cn=config 5a562aa7 olcObjectClasses: value #0 olcObjectClasses: AttributeType not found: "cppmVisitorCompany" 5a562aa7 config error processing cn={5}cppm,cn=schema,cn=config: olcObjectClasses: AttributeType not found: "cppmVisitorCompany" slapcat: bad configuration file! What's happenned? What em'I wrong? And what should I do now? Thanks, a.

4 12

proxy/backend pointers
by David LaPorte 10 Jan '18

10 Jan '18

Sorry to re-send to the list, but I'm hopeful someone might have some thoughts on whether this might be possible! We have an old unsupported application that authenticates users using an LDAP bind. The credential used for authentication (and what all the internal authorizations are tied to) is employee ID. We are moving to LDAP directory that uses email address instead of employee ID as the DN - the employee ID is still present as an attribute in the new directory and the password remains the same. Since I can't modify the problematic application, it’s not going away anytime soon, and it’s the last thing holding up migration to the new directory system, I'm hoping that I can use OpenLDAP as a shim between the application and the new directory to do something like the following: * Collect credentials (employee_id, password) during bind * using a privileged service account, search/bind against the new directory to map employee ID attribute to email address DN (like mod_authz_ldap does it) * return the success/failure as result of original bind I would appreciate any ideas or pointers if this is possible or if there might be a better way. Thanks in advance! Dave David LaPorte david(a)davidlaporte.org

1 0

[Q] what is the best practice or right way to change schemas order for cn=config case?
by Zeus Panchenko 09 Jan '18

09 Jan '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hi, what is the best practice or right way to change schemas order for cn=config case? 1. to move file? 2. to ldapmodify? for the one used to slapd.conf both of ways look weird ... :( - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAlo6mMsACgkQr3jpPg/3oypRzwCdHNMNgUewiolW91I7DB7cK5dE BqoAn0tXLDIMIBg0W9uG39pwN7LPRPth =jKuI -----END PGP SIGNATURE-----

3 3

Re: uidNumber for Service Accounts?
by Douglas Duckworth 08 Jan '18

08 Jan '18

Thanks everyone. I agree it would be ideal to differenaiate this account from others. So far it's in own OU while standard users are in People. Seeing an error. The ldif: dn: uid=preset,ou=Service Accounts,dc=blah objectClass: top objectClass: account objectClass: applicationProcess Enter LDAP Password: adding new entry "uid=preset,ou=Service Accounts,dc=blah ldap_add: Object class violation (65) additional info: invalid structural object class chain (account/applicationProcess) Sorry, I am LDAP padawan. Though this does work as it's now in the LDAP server: dn: uid=preset,ou=Service Accounts,dc=blah objectClass: top objectClass: account objectClass: applicationProcess objectClass: simpleSecurityObject uid: preset cn: preset sn: preset givenName: preset title: Password Reset Account description: Service Account For Resetting Passwords I will then great this account the ability to write to all users in People OU. Any security concerns? Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-6305 F: 212-746-8690 On Wed, Dec 20, 2017 at 2:07 AM, Michael Ströder <michael(a)stroeder.com> wrote: > MJ J wrote: > > Service accounts typically use the simpleSecurityObject object class. > > But one needs an appropriate structural object class to add the entry. > 'simpleSecurityObject' is an auxiliary object class without any naming > attribute. > > Ciao, Michael. > > > On Tue, Dec 19, 2017 at 9:15 PM, Douglas Duckworth > > <dod2014(a)med.cornell.edu> wrote: > >> It seems I created this service account with posixAccount objectClass. > That > >> requires uidNumber. > >> > >> So I need to do some research on what's the appropriate objectClass for > this > >> service account. It's used by SSSD and Apache, for example, to perform > >> binds with our LDAP cluster since we do not allow anon binds. In > addtion > >> ACLs only permit this account, and the Manager, access to read the > entire > >> directory. > >> > >> From reading here http://www.zytrax.com/books/ldap/ape/#objectclasses I > >> think I would only need objectClass: account which the service account > >> already contains. So I could delete the posixAccount objectClass and > then > >> uidNumber, gidNumber, homeDirectory, and loginShell? > >> > >> Thanks, > >> > >> Douglas Duckworth, MSc, LFCS > >

2 1

OpenLDAP slave failure in case of master indisponibility
by Matthieu Cerda 02 Jan '18

02 Jan '18

Greetings, I am observing a rather strange issue in the following setup: * 1 OpenLDAP master server (2.4.31) * 4 OpenLDAP slave servers (2.4.40) * The OpenLDAP slaves do forward any update attempt to the master using the chain overlay / proxyauthz (mainly to update the pwdFailureTime attribute for ppolicy) If I try to shut the master down (for maintenance let's say), the slaves behave properly, then begin to deadlock one after each other after a few minutes (by deadlock I mean no log output anymore, and any ldapwhoami / ldapsearch request connects and then times out) On the attached image, I monitored at the same time one of the slaves using collectd, to keep an eye on cn=monitor data (the period between 15:24:30 and 15:26:00 has been extrapolated by Grafana, no data is available at this time since cn=monitor access also deadlocks) I can see that backload / pending threads and waiters seem to increase gradually until the server gets unresponsive. I found nothing on the ML (except https://www.openldap.org/lists/openldap-technical/200912/msg00112.html) or searching for clues, Is this predictable behavior or and obvious misconfiguration, or it is an interesting occastion to dig a bit deeper ? Thanks in advance, -- Matthieu Cerda Infrastructure, BU Means @ NBS System

2 2

openLDAP with let's encrypt SSL certificate
by Jonas Kellens 01 Jan '18

01 Jan '18

Hello I am trying to configure openLDAP on Centos 6.8 with SSL. LDAP version : @(#) $OpenLDAP: slapd 2.4.40 (May 10 2016 23:30:49) $ mockbuild@worker1.bsys.centos.org:/builddir/build/BUILD/openldap-2.4.40/openldap-2.4.40/build-servers/servers/slapd LDAP service is running with ldaps:// support : ps -ef | grep slap ldap 22182 1 0 20:07 ? 00:00:00 /usr/sbin/slapd -h ldap:/// ldaps:/// ldapi:/// -u ldap root 22193 22118 0 20:07 pts/0 00:00:00 grep slap netstat -plane | grep 636 tcp 0 0 0.0.0.0:636 0.0.0.0:* LISTEN 0 45649460 22182/slapd tcp 0 0 :::636 :::* LISTEN 0 45649461 22182/slapd When I try to do an LDAP search, it fails to connect and the log shows : Dec 31 13:02:12 slap01 slapd[23776]: conn=1119 fd=13 ACCEPT from IP=xx.xx.xx.xx:45426 (IP=0.0.0.0:636) Dec 31 13:02:12 slap01 slapd[23776]: conn=1119 fd=13 closed (TLS negotiation failure) My /etc/openldap/slapd.conf file has the following lines : TLSCACertificateFile /etc/letsencrypt/live/slap01.domain.tld/fullchain.pem TLSCertificateFile /etc/letsencrypt/live/slap01.domain.tld/cert.pem TLSCertificateKeyFile /etc/letsencrypt/live/slap01.domain.tld/privkey.pem What else do I need to make openLDAP work with my let's encrypt SSL-certificate ? I've tried adding : TLSCACertificatePath /usr/share/pki/ca-trust-source But no success. Kind regards Jonas.

2 1

Error in dnx509Normalize when adding userCertificate value
by Cédric Couralet 28 Dec '17

28 Dec '17

Hello all, I encountered a problem when importing several client certificate in usercertificate attribute. The error was : [15362]: >>> certificateExactNormalize: <0x7f07019a9100, 1745> [15362]: dnX509Normalize: <(null)> (21) [15362]: <<< certificateExactNormalize: <0x7f07019a9100, 1745> => <(err)> [15362]: <= str2entry NULL (ssyn_normalize 21) [15362]: conn=1591 op=17 RESULT tag=103 err=21 text=userCertificate;binary: value #0 normalization failed Looking through the certificateExactNormalize in sourcecode, it seems the problem comes from the normalization of IssuerDn. Sure enough, in my case the issuer dn is : CN = Certigna Services CA 2.5.4.97 = NTRFR-48146308100036 OU = 0002 48146308100036 O = DHIMYOTIS C = FR Openldap has problem with the "2.5.4.97 = NTRFR-48146308100036" part, it is declared as organizationIdentifier but don't appear in openldap core schema (yet ?). I managed to avoid the error by adding an attribute to schema but I'm wondering if there is not a better way to do it, and why is the normalize called here ? My ldap version is the debian one : # slapd -V @(#) $OpenLDAP: slapd (Apr 23 2013 12:16:04) $ root@lupin:/tmp/buildd/openldap-2.4.31/debian/build/servers/slapd Is an update sufficient? Thank you for your answers, Cédric Couralet

2 1

LDAP password policies don't seems to work
by André Rodier 24 Dec '17

24 Dec '17

Hello all, I have an LDAP server, that I use for system authentication, emails, etc, in a domain (homebox.space) I have the password policies defined in the LDAP database, but they don't seem to apply to the users when changing a password. Both "olcPPolicyDefault" and "olcPPolicyHashCleartext" are set up, but only the last is working, i.e. passwords sent in clear text by an LDAP client are automatically encrypted. There is an overlay entry for the domain, example: olcPPolicyDefault: cn=default,ou=pwpolicies,dc=homebox,dc=space and a correct entry "pwdPolicySubentry" for each user. However, when I try change the password with pam_ldap or using the roundcube password plugin, even the minimal length rule is ignored. The module configuration: > dn: cn=module{0},cn=config > objectClass: olcModuleList > cn: module{0} > olcModulePath: /usr/lib/ldap > olcModuleLoad: {0}back_mdb > olcModuleLoad: {1}ppolicy.la > olcModuleLoad: {2}deref.la > structuralObjectClass: olcModuleList > entryUUID: acbfbc52-7c3a-1037-9cc1-d74dec6fc011 > creatorsName: cn=admin,cn=config > createTimestamp: 20171223143824Z > entryCSN: 20171223143828.930245Z#000000#000#000000 > modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth > modifyTimestamp: 20171223143828Z The overlay configuration > dn: olcOverlay={0}ppolicy,olcDatabase={1}mdb,cn=config > objectClass: olcPPolicyConfig > objectClass: olcOverlayConfig > olcOverlay: {0}ppolicy > olcPPolicyDefault: cn=default,ou=pwpolicies,dc=homebox,dc=space > olcPPolicyHashCleartext: TRUE > olcPPolicyUseLockout: FALSE > olcPPolicyForwardUpdates: FALSE > structuralObjectClass: olcPPolicyConfig > entryUUID: affa09e0-7c3a-1037-956b-0f107d4f36ac > creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth > createTimestamp: 20171223143829Z > entryCSN: 20171223143829.643274Z#000000#000#000000 > modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth > modifyTimestamp: 20171223143829Z The policy: > dn: cn=default,ou=pwpolicies,dc=homebox,dc=space > pwdExpireWarning: 259200 > pwdMaxFailure: 5 > cn: default > objectClass: pwdPolicy > objectClass: person > objectClass: top > pwdMinLength: 8 > pwdCheckQuality: 0 > pwdAttribute: userPassword > pwdLockoutDuration: 0 > pwdInHistory: 0 > sn: default > pwdMaxAge: 31536000 > pwdGraceAuthNLimit: 0 > pwdFailureCountInterval: 300 > structuralObjectClass: person > entryUUID: b083c4d2-7c3a-1037-956d-0f107d4f36ac > creatorsName: cn=admin,dc=homebox,dc=space > createTimestamp: 20171223143830Z > entryCSN: 20171223143830.545905Z#000000#000#000000 > modifiersName: cn=admin,dc=homebox,dc=space > modifyTimestamp: 20171223143830Z Example of one user: > dn:: Y249QW5kcsOpIFJvZGllcixvdT11c2VycyxkYz1ob21lYm94LGRjPXNwYWNl > pwdPolicySubentry: cn=default,ou=pwpolicies,dc=homebox,dc=space > shadowMin: 0 > uid: andre > objectClass: top > objectClass: person > objectClass: posixAccount > objectClass: shadowAccount > objectClass: inetOrgPerson > loginShell: /bin/bash > shadowFlag: 0 > uidNumber: 1001 > shadowMax: 999999 > gidNumber: 1001 > homeDirectory: /home/users/andre > sn: Rodier > shadowInactive: -1 > mail: andre(a)homebox.space > givenName:: QW5kcsOp > shadowWarning: 7 > structuralObjectClass: inetOrgPerson > cn:: QW5kcsOpIFJvZGllcg== > entryUUID: b12c4db4-7c3a-1037-9572-0f107d4f36ac > creatorsName: cn=admin,dc=homebox,dc=space > createTimestamp: 20171223143831Z > userPassword:: e1NTSEF9SHllVitOazkyekNHYlIwbVRUdkZJZWFpVUo2WElSVWM= > pwdChangedTime: 20171223150211Z > entryCSN: 20171223150211.599058Z#000000#000#000000 > modifiersName: cn=admin,dc=homebox,dc=space > modifyTimestamp: 20171223150211Z > I have the whole source code here: https://github.com/progmaticltd/homebox/ The Ansible tasks I am using to configure the LDAP server are here: https://github.com/progmaticltd/homebox/blob/master/install/playbooks/roles… Any help welcome. Kind regards, André Rodier. PS: Merry Christmas / Happy new year / for those concerned.

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical