openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

Re: Openldap vs 389
by Shawn McKinney 20 Apr '16

20 Apr '16

> On Apr 19, 2016, at 16:34:27,Achilleas Mantzios wrote: > > I admit I haven’t done my homework regarding the standards (the literature is just huge), maybe I was hasty in using the term RBAC above, but anyway what does Fortress/RBAC give out of the box that our solution wouldn’t, I mean you wouldn’t mind giving a very rough overview ? Not knowing what your solution provides it's not possible for me to give you a comparison and in any case that’s a question for you to decide. If you want to understand fortress, first understand its apis, there are links to javadoc descs at the bottom of this page: https://directory.apache.org/fortress/overview.html If after that you are still interested, checkout the tutorials: - http://github.com/shawnmckinney/apache-fortress-demo - http://github.com/shawnmckinney/role-engineering-sample - http://github.com/shawnmckinney/wicket-sample - http://github.com/shawnmckinney/fortress-saml-demo or some of the collateral that is here: - http://iamfortress.net/2015/06/11/what-is-delegated-administration/ - http://iamfortress.net/2015/03/13/enabling-java-ee-and-fortress-security-in… - http://iamfortress.net/2015/03/05/the-seven-steps-of-role-engineering/ - http://iamfortress.net/2015/02/16/apache-fortress-end-to-end-security-tutor… - http://iamfortress.net/2014/11/24/using-role-for-access-control-is-not-rbac/ Shawn

2 1

memberuid value should be DN or RDN or both woks
by scn_73＠yahoo.com 20 Apr '16

20 Apr '16

All, Openldap is complaining invalid dn. I doubt, it's for group members those memberuid don't have have DN and added as RDN. Like to know does memberuid should be DN or RDN works too. slapd[4892]: conn=1629448 op=2180 do_search: invalid dn (member1) slapd[4892]: conn=1629448 op=2181 do_search: invalid dn (memver2) slapd[4892]: conn=1629448 op=2182 do_search: invalid dn (member2) objectClass: posixGroup objectClass: top cn: g1 gidNumber: xxxx memberUid: member1 memberUid: member2 memberUid: member3 - Sachin

2 1

Best method to swap TLS cert/key/CA files
by ML mail 19 Apr '16

19 Apr '16

Hello, I would like to swap my self signed certificate including CA, cert and key with a new set of CA, cert and key files on my OpenLDAP 2.4.31 master and replica servers. What would be the best way to achieve that? Can I simply run an ldapmodify with the new values and then restart slapd? Is it as easy as that or are there any pitfalls I should take care of? Thank you in advance for your comments. Regards ML

2 2

passwd, proxying, and idassert-authzFrom
by David Magda 19 Apr '16

19 Apr '16

Hello, I have a master OpenLDAP server, with a bunch of slaves, and then Linux clients talking to the slaves. We've used olcUpdateRef/updateref for a while, but have a situation where we need to proxy connection on behalf of clients via the slaves. So we have configured a slapo-chain(5) overlay, with the following settings: olcDbURI: ldap://10.0.0.555/ olcDbIDAssertBind: bindmethod=simple \ binddn="cn=update,dc=example,dc=ca" \ credentials=s3cr3t mode=self olcDbRebindAsUser: TRUE However, when users try to run passwd(1) (with pam_ldap.conf(5) having the "pam_password exop" setting) they get: > LDAP password information update failed: Strong(er) authentication required only authenticated users may change passwords > passwd: Permission denied > passwd: password unchanged On the master, we have: > Apr 12 13:14:00 ops slapd[26119]: conn=16 fd=32 ACCEPT from IP=111.222.333.444:59985 (IP=0.0.0.0:389) > Apr 12 13:14:00 ops slapd[26119]: conn=16 op=0 BIND dn="" method=128 > Apr 12 13:14:00 ops slapd[26119]: conn=16 op=0 RESULT tag=97 err=0 text= > Apr 12 13:14:00 ops slapd[26119]: conn=16 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.1 > Apr 12 13:14:00 ops slapd[26119]: conn=16 op=1 PASSMOD > Apr 12 13:14:00 ops slapd[26119]: conn=16 op=1 RESULT oid= err=8 text=only authenticated users may change passwords The (cn=update...) DN has an "authzTo" attribute set to "{0}dn.regex:^uid=[^,]+,ou=People,dc=example,dc=ca". I'm guessing I may need to set idassert-authzFrom (olc equiv?) to something. Is this correct? If so, should it be restricted to ou=People? If not, what am I missing? Thanks for any info. Regards, David

1 1

Re: Openldap vs 389
by Achilleas Mantzios 19 Apr '16

19 Apr '16

On 19/04/2016 13:41, Emmanuel Lécharny wrote: > Le 19/04/16 11:39, Achilleas Mantzios a écrit : >> On 19/04/2016 12:20, Emmanuel Lécharny wrote: >>> Le 19/04/16 10:47, Achilleas Mantzios a écrit : >>>> Hello, >>>> >>>> I have been testing sporadically openldap two years now, including >>>> many advanced features, sql, ppolicy, etc we are currently evaluating >>>> openldap along with redhat's 389 for enterprise use as RBAC, on which >>>> we will built upon our existing infrastructure. We want to have full >>>> password policy enabled, in order to meet requirements for passing SOX >>>> (Sarbanes Oxley) compliance. >>>> 389's documentation is lousy, I haven't tried anything exotic (sql, >>>> etc) with it, the reason we are looking at it is because it is favored >>>> by kolab.org and likely to come as standard in future kolab versions. >>>> So I would like your opinion on this. Pros/Cons to choose openldap or >>>> 389 directory server as our long term strategic decision? >>>> >>> If you are interested in RBAC, know that there is a Java API that >>> implements RBAC at http://directory.apache.org/fortress/ (1.0.0 have >>> just been released last week). It works with OpenLDAP as a backend (and >>> some other LDAP server too). >> Hi I had talked with a SYMAS person some years ago regarding fortress, >> this is also hosted by openldap : http://www.openldap.org/fortress/ >> So who manages fortress? > It has moved to the Apache Foundation 2 years ago. Thanx for the insight. > > >> By the test we had done with openldap it seemed that marginally we >> could meet our password policy requirements. > Here, you will have to tell us more about your requirements. Right, we have an inhouse application running on Java EE, which we have been developing for the last 16 years. We use mostly classic form-based j2ee declarative security. We have been using IBM Lotus Notes Domino Server and its bundled LDAP server, by writing our own login module for Jboss. But lotus's LDAP is of limited potential. Now we need to have the following features : - support password strength and also communicate relevant error codes/messages back to the calling client (e.g. jboss login module) - handle correctly while in period of passwd expiration warning (error codes/messages) - handle correctly after period of passwd expiration, but within the grace limit (error codes/messages) - support password history (error codes/messages) - handle correctly after period of passwd expiration, and also after grace limit (error codes/messages) - account explicitly locked (error codes/messages) - handle pwdMustChange & pwdReset (error codes/messages) - account explicitly locked after pwdMaxFailure (error codes/messages) According to some tests we had done back in 2014, we had it all covered, in theory. Our idea was to have some supplementary roles assigned to the user, denoting of any outstanding state of the account, and then add this role to the user, inside the login module, and then use an hybrid approach of declarative security + some filters + some programmatic security to allow the user to have a full RBAC experience -- Achilleas Mantzios IT DEV Lead IT DEPT Dynacom Tankers Mgmt

2 2

Re: Openldap vs 389
by Achilleas Mantzios 19 Apr '16

19 Apr '16

On 19/04/2016 12:20, Emmanuel Lécharny wrote: > Le 19/04/16 10:47, Achilleas Mantzios a écrit : >> Hello, >> >> I have been testing sporadically openldap two years now, including >> many advanced features, sql, ppolicy, etc we are currently evaluating >> openldap along with redhat's 389 for enterprise use as RBAC, on which >> we will built upon our existing infrastructure. We want to have full >> password policy enabled, in order to meet requirements for passing SOX >> (Sarbanes Oxley) compliance. >> 389's documentation is lousy, I haven't tried anything exotic (sql, >> etc) with it, the reason we are looking at it is because it is favored >> by kolab.org and likely to come as standard in future kolab versions. >> So I would like your opinion on this. Pros/Cons to choose openldap or >> 389 directory server as our long term strategic decision? >> > If you are interested in RBAC, know that there is a Java API that > implements RBAC at http://directory.apache.org/fortress/ (1.0.0 have > just been released last week). It works with OpenLDAP as a backend (and > some other LDAP server too). Hi I had talked with a SYMAS person some years ago regarding fortress, this is also hosted by openldap : http://www.openldap.org/fortress/ So who manages fortress? By the test we had done with openldap it seemed that marginally we could meet our password policy requirements. > > Regarding OpenLDAP, obviously, this list is clearly biased. Now, let's > see what you can find on the Internet : > > http://www.slideshare.net/ldapcon/benchmarks-on-ldap-directories > Thanx! > -- Achilleas Mantzios IT DEV Lead IT DEPT Dynacom Tankers Mgmt

1 0

Openldap vs 389
by Achilleas Mantzios 19 Apr '16

19 Apr '16

Hello, I have been testing sporadically openldap two years now, including many advanced features, sql, ppolicy, etc we are currently evaluating openldap along with redhat's 389 for enterprise use as RBAC, on which we will built upon our existing infrastructure. We want to have full password policy enabled, in order to meet requirements for passing SOX (Sarbanes Oxley) compliance. 389's documentation is lousy, I haven't tried anything exotic (sql, etc) with it, the reason we are looking at it is because it is favored by kolab.org and likely to come as standard in future kolab versions. So I would like your opinion on this. Pros/Cons to choose openldap or 389 directory server as our long term strategic decision? -- Achilleas Mantzios IT DEV Lead IT DEPT Dynacom Tankers Mgmt

2 2

LMDB: file size increase (due to new free pages) even though write transaction does not add/update items
by Argyrios Kyrtzidis 18 Apr '16

18 Apr '16

Hi, Thank you for making LMDB available. I’m using LMDB on OSX (without MDB_WRITEMAP, so the database file size is relative to the stored data, not the max mapsize). I’ve noticed that write transactions that have a large number of ‘attempted’ updates, but that do not actually make any updates due to MDB_NOOVERWRITE / MDB_NODUPDATA, cause an increase in the database file size, which mdb_stat attributes to an increased number of free pages. This is with latest master of the github mirror. I’m wondering if you have any hints on what I may be doing wrong ? I’d like if possible to avoid the database size increasing if the write pass did not make any updates.

2 5

IP based and FQDN based certificate on same LDAP node
by Prashanth P.Nair 18 Apr '16

18 Apr '16

Hi Currently my LDAP server is having self signed FQDN based SSL certificate .I would like to have IP based SSL certificate for the same node.IS that feasible ? Below certificate issued to FQDN i.e CN=FQN. TLSCACertificateFile /etc/ssl/ldap.pem TLSCertificateKeyFile /etc/ssl/ldap.pem TLSCertificateFile /etc/ssl/ldap.pem Br/Prashanth.

2 1

ldap_sync(3) function usage
by Frank Crow 18 Apr '16

18 Apr '16

I'm wanting to write a client in C/C++ that does a "refresh and persist" sync search on an entry. I'm looking at the ldap_sync(3) man page and that looks like it would do most things that I need. I can't find any example code that is using that interface, so if somebody could point me to any that does, I'd really appreciate it. I do understand that I need to initialize the API with the ldap_sync_initialize() to get an ldap_sync_t structure. The members of the structure seem straightforward enough but I don't understand how I connect my ldap connection (LDAP*) to this API. How does that work?? Also, I don't understand how the different function typedefs work. I mean that I understand that I need four functions: ldap_sync_search_entry_f my_search_entry(...); ldap_sync_search_reference_function_f my_search_reference(...); ldap_sync_search_intermediate_f my_search_intermediate(...); ldap_sync_search_result_f my_search_result(...); But how does the ldap_sync(3) API become aware of those functions? Or... is there an easier way to do what I want? Looks like the ldapsearch command line tool just adds a control to the search (-E sync=rp) and handles the resulting messages as necessary. Should I be trying to do that instead of using ldap_sync(3)? Thanks, -- Frank

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical