openldap-technical

openldap-technical@openldap.org

7 participants
9901 discussions

SASL pass-through fails
by Joshua Schaeffer 18 Sep '16

18 Sep '16

Hey all, I've been using OpenLDAP and Kerberos for central authentication for a while now, but I have a couple programs that can't use GSSAPI directly and I want to setup SASL pass-through authentication to allow those services to use my Kerberos passwords, but I'm having trouble getting saslauthd to work correctly. I can authentication as myself using GSSAPI without any issue: jschaeffer@zipmaster07 ~/Downloads $ ldapwhoami SASL/GSSAPI authentication started SASL username: jschaeffer(a)HARMONYWAVE.COM SASL SSF: 56 SASL data security layer installed. dn:uid=jschaeffer,ou=end users,ou=people,dc=harmonywave,dc=com But whenever I run the testsaslauthd command I can't get a successful authentication: root@baneling:~# testsaslauthd -u jschaeffer(a)HARMONYWAVE.COM -p <password> 0: NO "authentication failed" Here are my SASL settings: root@baneling:~# cat /etc/default/saslauthd | grep -v '^$\|^\s*\#' START=yes DESC="SASL Authentication Daemon" NAME="saslauthd" MECHANISMS="kerberos5" MECH_OPTIONS="" THREADS=5 OPTIONS="-c -m /var/run/saslauthd" root@baneling:~# cat /etc/ldap/sasl2/slapd.conf pwcheck_method: saslauthd saslauthd_path: /var/run/saslauthd/mux I can see my saslauthd socket listening and what I find really odd is that I can see a successful authentication attempt from Kerberos's logs: root@baneling:~# netstat -a I | grep sasl unix 2 [ ACC ] STREAM LISTENING 25552431 /var/run/saslauthd/mux I get this immediately after issuing the testsaslauthd command: Sep 17 13:09:13 immortal krb5kdc[1210](info): AS_REQ (6 etypes {18 17 16 23 25 26}) 10.1.30.18: NEEDED_PREAUTH: jschaeffer(a)HARMONYWAVE.COM for krbtgt/HARMONYWAVE.COM(a)HARMONYWAVE.COM, Additional pre-authentication required Sep 17 13:09:13 immortal krb5kdc[1210](info): AS_REQ (6 etypes {18 17 16 23 25 26}) 10.1.30.18: ISSUE: authtime 1474139353, etypes {rep=18 tkt=18 ses=18}, jschaeffer(a)HARMONYWAVE.COM for krbtgt/HARMONYWAVE.COM(a)HARMONYWAVE.COM You can also see it in the slapd logs: Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=197 SRCH base="dc=harmonywave,dc=com" scope=2 deref=0 filter="(&(|(objectClass=krbPrincipalAux)(objectClass=krbPrincipal))(krbPrincipalName=jschaeffer(a)HARMONYWAVE.COM))" Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=197 SRCH attr=krbprincipalname krbcanonicalname objectclass krbprincipalkey krbmaxrenewableage krbmaxticketlife krbticketflags krbprincipalexpiration krbticketpolicyreference krbUpEnabled krbpwdpolicyreference krbpasswordexpiration krbLastFailedAuth krbLoginFailedCount krbLastSuccessfulAuth krbLastPwdChange krbLastAdminUnlock krbExtraData krbObjectReferences krbAllowedToDelegateTo Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=197 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=198 SRCH base="dc=harmonywave,dc=com" scope=2 deref=0 filter="(&(|(objectClass=krbPrincipalAux)(objectClass=krbPrincipal))(krbPrincipalName=krbtgt/HARMONYWAVE.COM(a)HARMONYWAVE.COM))" Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=198 SRCH attr=krbprincipalname krbcanonicalname objectclass krbprincipalkey krbmaxrenewableage krbmaxticketlife krbticketflags krbprincipalexpiration krbticketpolicyreference krbUpEnabled krbpwdpolicyreference krbpasswordexpiration krbLastFailedAuth krbLoginFailedCount krbLastSuccessfulAuth krbLastPwdChange krbLastAdminUnlock krbExtraData krbObjectReferences krbAllowedToDelegateTo Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=198 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=199 SRCH base="cn=default,cn=HARMONYWAVE.COM,cn=krbContainer,dc=harmonywave,dc=com" scope=0 deref=0 filter="(objectClass=krbPwdPolicy)" Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=199 SRCH attr=cn krbmaxpwdlife krbminpwdlife krbpwdmindiffchars krbpwdminlength krbpwdhistorylength krbpwdmaxfailure krbpwdfailurecountinterval krbpwdlockoutduration krbpwdattributes krbpwdmaxlife krbpwdmaxrenewablelife krbpwdallowedkeysalts Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=199 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=200 SRCH base="dc=harmonywave,dc=com" scope=2 deref=0 filter="(&(|(objectClass=krbPrincipalAux)(objectClass=krbPrincipal))(krbPrincipalName=jschaeffer(a)HARMONYWAVE.COM))" Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=200 SRCH attr=krbprincipalname krbcanonicalname objectclass krbprincipalkey krbmaxrenewableage krbmaxticketlife krbticketflags krbprincipalexpiration krbticketpolicyreference krbUpEnabled krbpwdpolicyreference krbpasswordexpiration krbLastFailedAuth krbLoginFailedCount krbLastSuccessfulAuth krbLastPwdChange krbLastAdminUnlock krbExtraData krbObjectReferences krbAllowedToDelegateTo Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=200 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=201 SRCH base="dc=harmonywave,dc=com" scope=2 deref=0 filter="(&(|(objectClass=krbPrincipalAux)(objectClass=krbPrincipal))(krbPrincipalName=krbtgt/HARMONYWAVE.COM(a)HARMONYWAVE.COM))" Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=201 SRCH attr=krbprincipalname krbcanonicalname objectclass krbprincipalkey krbmaxrenewableage krbmaxticketlife krbticketflags krbprincipalexpiration krbticketpolicyreference krbUpEnabled krbpwdpolicyreference krbpasswordexpiration krbLastFailedAuth krbLoginFailedCount krbLastSuccessfulAuth krbLastPwdChange krbLastAdminUnlock krbExtraData krbObjectReferences krbAllowedToDelegateTo Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=201 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=202 SRCH base="cn=default,cn=HARMONYWAVE.COM,cn=krbContainer,dc=harmonywave,dc=com" scope=0 deref=0 filter="(objectClass=krbPwdPolicy)" Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=202 SRCH attr=cn krbmaxpwdlife krbminpwdlife krbpwdmindiffchars krbpwdminlength krbpwdhistorylength krbpwdmaxfailure krbpwdfailurecountinterval krbpwdlockoutduration krbpwdattributes krbpwdmaxlife krbpwdmaxrenewablelife krbpwdallowedkeysalts Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=202 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=203 SRCH base="cn=default,cn=HARMONYWAVE.COM,cn=krbContainer,dc=harmonywave,dc=com" scope=0 deref=0 filter="(objectClass=krbPwdPolicy)" Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=203 SRCH attr=cn krbmaxpwdlife krbminpwdlife krbpwdmindiffchars krbpwdminlength krbpwdhistorylength krbpwdmaxfailure krbpwdfailurecountinterval krbpwdlockoutduration krbpwdattributes krbpwdmaxlife krbpwdmaxrenewablelife krbpwdallowedkeysalts Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=203 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=204 SRCH base="krbPrincipalName=jschaeffer(a)HARMONYWAVE.COM,cn=HARMONYWAVE.COM,cn=krbContainer,dc=harmonywave,dc=com" scope=0 deref=0 filter="(objectClass=*)" Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=204 SRCH attr=objectclass Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=204 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=205 MOD dn="krbPrincipalName=jschaeffer(a)HARMONYWAVE.COM,cn=HARMONYWAVE.COM,cn=krbContainer,dc=harmonywave,dc=com" Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=205 MOD attr=krbLastSuccessfulAuth krbExtraData krbLastAdminUnlock Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=205 RESULT tag=103 err=0 text= When I debug the saslauthd daemon all i get is this: root@baneling:~# saslauthd -a kerberos5 -m /var/run/saslauthd -n 5 -d saslauthd[1121] :main : num_procs : 5 saslauthd[1121] :main : mech_option: NULL saslauthd[1121] :main : run_path : /var/run/saslauthd saslauthd[1121] :main : auth_mech : kerberos5 saslauthd[1121] :ipc_init : using accept lock file: /var/run/saslauthd/mux.accept saslauthd[1121] :detach_tty : master pid is: 0 saslauthd[1121] :ipc_init : listening on socket: /var/run/saslauthd/mux saslauthd[1121] :main : using process model saslauthd[1121] :have_baby : forked child: 1122 saslauthd[1122] :get_accept_lock : acquired accept lock saslauthd[1121] :have_baby : forked child: 1123 saslauthd[1121] :have_baby : forked child: 1124 saslauthd[1121] :have_baby : forked child: 1125 saslauthd[1122] :rel_accept_lock : released accept lock saslauthd[1124] :get_accept_lock : acquired accept lock saslauthd[1122] :do_auth : auth failure: [user=jschaeffer(a)HARMONYWAVE.COM] [service=imap] [realm=] [mech=kerberos5] [reason=saslauthd internal error] Kinda at a loss at what else I should look at. Any tips would be appreciated. Thanks, Joshua Schaeffer

3 3

Creating suffix aliases with OpenLDAP
by Ralf Mattes 18 Sep '16

18 Sep '16

Dear collectes list wisdom, I'm running a ldap server whose main database holds a X500 style suffix (i.e. o=...,l=...,c=...). The organisations name does contain a non-ascii character 'ü'. So far this never has been a problem but now one of our partner institutions needs to access the server with tomcat/ndi/proprietary code and that fails misserably - no wonder: the send the bind DN with the wrong encoding. While I'm sure there is a solution on the Java/Tomcat side I'd like to provide the possibility to access the data under a different DN (with 'ü' replaced by 'ue'). My first attempt: I created a second database with the alternative suffix and placed an alias object as the topmost entry. That object points to the toplevel organisation object of the real database. But while I can see that object none of the child entries are found. s there any to configure such an "alias suffix"? TIA Ralf Mattes

7 19

Re: SASL pass-through fails
by Howard Chu 17 Sep '16

17 Sep '16

Joshua Schaeffer wrote: > Hey all, > > I've been using OpenLDAP and Kerberos for central authentication for a while > now, but I have a couple programs that can't use GSSAPI directly and I want to > setup SASL pass-through authentication to allow those services to use my > Kerberos passwords, but I'm having trouble getting saslauthd to work correctly. > > I can authentication as myself using GSSAPI without any issue: > > jschaeffer@zipmaster07 ~/Downloads $ ldapwhoami > SASL/GSSAPI authentication started > SASL username: jschaeffer(a)HARMONYWAVE.COM > SASL SSF: 56 > SASL data security layer installed. > dn:uid=jschaeffer,ou=end users,ou=people,dc=harmonywave,dc=com > > But whenever I run the testsaslauthd command I can't get a successful > authentication: > > root@baneling:~# testsaslauthd -u jschaeffer(a)HARMONYWAVE.COM -p <password> > 0: NO "authentication failed" > When I debug the saslauthd daemon all i get is this: > > root@baneling:~# saslauthd -a kerberos5 -m /var/run/saslauthd -n 5 -d > saslauthd[1121] :main : num_procs : 5 > saslauthd[1121] :main : mech_option: NULL > saslauthd[1121] :main : run_path : /var/run/saslauthd > saslauthd[1121] :main : auth_mech : kerberos5 > saslauthd[1121] :ipc_init : using accept lock file: > /var/run/saslauthd/mux.accept > saslauthd[1121] :detach_tty : master pid is: 0 > saslauthd[1121] :ipc_init : listening on socket: /var/run/saslauthd/mux > saslauthd[1121] :main : using process model > saslauthd[1121] :have_baby : forked child: 1122 > saslauthd[1122] :get_accept_lock : acquired accept lock > saslauthd[1121] :have_baby : forked child: 1123 > saslauthd[1121] :have_baby : forked child: 1124 > saslauthd[1121] :have_baby : forked child: 1125 > saslauthd[1122] :rel_accept_lock : released accept lock > saslauthd[1124] :get_accept_lock : acquired accept lock > saslauthd[1122] :do_auth : auth failure: > [user=jschaeffer(a)HARMONYWAVE.COM] [service=imap] [realm=] [mech=kerberos5] > [reason=saslauthd internal error] > > Kinda at a loss at what else I should look at. Any tips would be appreciated. Your testsaslauthd is trying to use the imap service. If you don't have an imap service in your KDC, then of course it will fail. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 2

Using LMDB safely with fork() and exec()
by Lorenz Bauer 17 Sep '16

17 Sep '16

Hello List, The LMDB documentation says the following in its section on caveats: > * Use an MDB_env* in the process which opened it, without fork()ing. > * Do not have open an LMDB database twice in the same process at the same time. Not even from a plain open() call - close()ing it breaks flock() advisory locking. This seems contrary to an earlier thread on this list (1), which suggests that fork/execing a process using LMDB is OK so long as the MDB_env is not used in the forked process. Looking at the flock man pages on FreeBSD and Linux tells me that this indeed should be ok: an flock is released only when all fds pointing to the open file table entry are closed (ignoring explicit unlock). Exec with FD_CLOEXEC set should therefore be OK. Is my interpretation correct? I want to use this to implement graceful restarts in a daemon which uses LMDB: * mdb_env_open() in old process * fork() -> exec() the daemon itself * mdb_env_open() in new process * mdb_env_close() in old process If this works, I'd like to contribute the changes necessary to not leak fds on exec, which are mentioned in the other thread. * Are there contribution guidelines somewhere? How do I submit a patch? * Seems like there is currently no call to SetHandleInformation with HANDLE_FLAG_INHERIT=0 for Winows, should that be added? Best, Lorenz 1: http://www.openldap.org/lists/openldap-technical/201403/msg00149.html

2 9

Documentation Feedback
by Tom Jay 16 Sep '16

16 Sep '16

Hello, I would like to voice my frustration with the quality of the openLDAP documentation. I am compiling openLDAP from source on Debian 7, and have spent about 2-3 continuous days getting to the point where I can add an LDAP user with a UID. I have been close to giving up with the software, but need it for the LDAP functionality, and as very few viable alternatives exist, have been forced to continue with the installation. I have however almost lost confidence in the product, and am concerned that if there are any problems with it in the future, or I want to enable another feature, I will be almost helpless in getting it to work. The main problem is the Quick-Start Guide. This is anything but quick, and forces the user to consult the less-than-succinct Admin guide. The two together are inconsistent, difficult to follow and do a poor job of explaining what each feature does. The accessibility of information is less than optimal, which means that the user has to look elsewhere, consuming even more time. Unfortunately, there is not much relevant information on the Internet, forcing the user to get stuck in an almost endless loop of checking documentation, testing, reading manuals, and searching on the Internet, in order to get some kind of idea how the software works and what needs to be done to get it working. I would offer to contribute to the documentation, but due to its lack of usefulness, do not have an understanding of the basic concepts myself. The best I would be able to do is describe my experience and provide the steps that I followed to get a basic installation working. Hopefully someone can volunteer the time to test the documentation, in the same way a new user would! Tom

8 9

Service slapd fails to start: str2entry: slap_str2undef_ad(-): empty AttributeDescription
by c.monty＠web.de 15 Sep '16

15 Sep '16

Hi, I have installed OpenLdap server. However, starting slapd fails with this error message: Sep 11 11:00:38 vm108-ldap slapd[13641]: UNKNOWN attributeDescription "CHANGETYPE" inserted. Sep 11 11:00:38 vm108-ldap slapd[13641]: UNKNOWN attributeDescription "ADD" inserted. Sep 11 11:00:38 vm108-ldap slapd[13641]: <= str2entry: slap_str2undef_ad(-): empty AttributeDescription Sep 11 11:00:38 vm108-ldap slapd[13641]: slapd stopped. Sep 11 11:00:38 vm108-ldap slapd[13641]: connections_destroy: nothing to destroy. I have started slapd creating a debug file with following command: slapd -d -1 1>/tmp/slapd-debug.log 2>&1 The debug file is attached to this email. How can I fix this issue? THX

2 1

Re: Creating suffix aliases with OpenLDAP
by Howard Chu 15 Sep '16

15 Sep '16

Ralf Mattes wrote: > First, juat to be clear: thank you for your valuable help and please don't take my comments personally. > > Am Donnerstag, 15. September 2016 09:46 CEST, Dieter Klünter <dieter(a)dkluenter.de> schrieb: > >>> >>> I _knew_ I read about that at some time. This (slapd-relay) looks >>> exactly like what I need. Unfortunately this means I need to to dive >>> down into the labyrinth of (not existing) dosumentation. >> >> Just read manual pages slapd-relay(5) and slapo-rwm(5) that is all the >> documentation you should need. > > That's how it should be, but in reality: > > - non of the documentation even mentions the "new" live configuration. > Ironically, every time someone postsher/his old-style slapd configuration > on this very list she/he's told "use the online configuration". > > Oh, and changing from the old style configuration to the new one is _not_ > just an "add 'olc' in front of the parameters". For example I can't find > the rwm-suffixmassage parameter in the olc-Attributes. Online configuration is self-documenting. You are expected to read the objectclass definition from the config schema. > > - The documentation fails to mention some rather important prerequisits: > the need to load 'back_relay', the need to load 'rwm'. Module loading is not specific to back-relay, rwm, or any other backend or overlay, so there is no reason to mention it in their specific documentation. Whether or not your build supports modules is a compile-time decision, made by whoever built your binaries. Module loading is documented in the general slapd config documentation, since it applies to anything, not just specific backends or overlays. > > - The documentation really should mention that a (miss-)configured database > can't be removed from the server. Better get it right the first time ... :-) Never test new configs on a production server. Always use a throwaway test server. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

How to configure Oracle database user authentication using openldap?
by Reddy, Sudheer (CORP) 15 Sep '16

15 Sep '16

Hi: Currently we use oracle OID/LDAP to setup Oracle Database Enterprise User Security. Our management decided to retire oracle OID/LDAP, and enable database authentication using openldap on SUSE linux 11. I am new to LDAP and open LDAP. I greatly appreciate if you can help me understand the process to get this configured. Thanks, Sudheer Reddy ---------------------------------------------------------------------- This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, notify the sender immediately by return email and delete the message and any attachments from your system.

1 0

Re: Ldap Replication getting delayed for 20 seconds.
by Prashanth P.Nair 14 Sep '16

14 Sep '16

Thank you. 3.Any other parameter needs to be added to fasten this replication? This settings are in place already .But still delay happening. backend hdb database hdb Any other parameter needs to be modified for fastening the replication ? On Tue, Sep 13, 2016 at 3:19 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Monday, September 12, 2016 3:50 PM +0200 "Prashanth P.Nair" < > prashanthppp(a)gmail.com> wrote: > > When i create new record ,its taking 18-20 second to replicate on other >> node. So the application which is reading the records from the second >> node is unable to find those records. >> >> >> 1.Is this normal behavior? >> > > Yes. > > 2.Is there any way to findout how much time took a record to be >> replicated? >> > > Read the information on "loglevel" in the slapd.conf(5) man page. > > 3.Any other paramter needs to be added to fasten this replication? >> >> > backend hdb >> database hdb >> > > Replication is particularly slowed if using back-hdb vs back-mdb. See < > https://mishikal.wordpress.com/2013/05/16/openldap-a-compar > ison-of-back-mdb-and-back-hdb-performance/> and < > https://wiki.zimbra.com/wiki/OpenLDAP_MDB_vs_HDB_performance>. > > --Quanah > > > -- > > Quanah Gibson-Mount >

2 1

How to block bind requests on openLDAP proxy, after number of failed authentication requests?
by Pocoto 14 Sep '16

14 Sep '16

Hi everyone, i am looking for a way an openLDAP proxy can temporarily block bind attempts (by bind-dn), after a number of consecutive failed authentication requests. The solution should work independent from the remote server configuration and with the client request and remote server response information on the proxy only. Is there a working solution or what could be a possible way to accomplish the needs - maybe develop an custom overlay? Thanx in advance, Rüdiger

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical