openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

ldap separate OU-administrator account
by Gary Spencer 10 Feb '16

10 Feb '16

Hi, I need some guidance, I have a simple DIT with users in the users OU, and a separate OU for admins. In addition to the Manager, I have created an admin2 account in the admins OU, however default permissions don't allow the admin2.admins.domain.tld to create users in the users.domain.tld OU. I also don't want admin2 to have equal permissions to Manager, I am giving that account away to our users administrator and they only need access to create/modify/delete users under the users OU (on basis of least privilege I don't want them to have full access). I am using dynamic ldap, I have already created the users and admin accounts, I just need guidance on adding the ACL's. I am a complete novice with openldap, what do I need to do to grant the correct olcAccess so that the admin2 account can create users in the users.domain.tld OU ? I'd also like a read-only admin in the admins OU that can view all details for all users under users OU ? And cream on top of the cake, I'd like to prohibit accounts in the users OU from looking at any of the rest of the LDAP objects other than self ? I think I'm right I need to modify the olcAccess access rules, but don't know how, current olcAccess rules follow:- dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb <... CUT ...> olcSuffix: dc=domain,dc=tld olcRootDN: cn=Manager,dc=domain,dc=tld olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=Manager,dc=domain,dc=tld" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=Manager,dc=domain,dc=tld" write by * read (I have tweaked the text output to replace our domain, please ignore any typos I may have inadvertently introduced) I have read the admin guides and man pages, but I can't see clearly see what ldif stanzas I need to construct ? Thanks in advance. Gary Spencer [cid:image001.jpg@01D16412.92EB2D10]<http://www.sis.tv/distribution/> Whitehall Avenue | Kingston | Milton Keynes | MK10 0AX www.sis.tv<http://www.sis.tv> ********************************************************************** Satellite Information Services Limited. Registered Office: Whitehall Avenue, Kingston, Milton Keynes, Buckinghamshire, MK10 0AX. Company No. 4243307 SIS LIVE Limited. Registered Office: Whitehall Avenue, Kingston, Milton Keynes, Buckinghamshire, MK10 0AX. Company No. 5075598 The information in this email (which includes any files transmitted with it) is confidential and is intended for the addressee only. Unauthorized recipients are required to maintain confidentiality. If you have received this email in error please notify the sender immediately, destroy any copies and delete it from your computer system. **********************************************************************

1 0

Using TLS not seeing EXTERNAL as Using TLS not seeing EXTERNAL as supported SASL mechanism
by Bill MacAllister 10 Feb '16

10 Feb '16

I am working on using TLS on an OpenLDAP server and having issues. Basically I can make a TLS connection, but I don't see EXTERNAL as one of the supportedSASLMechanisms. (slapd 2.4.41+dfsg-1ubuntu2~dbp0 built with openssl) Here is my ldapsearch: $ ldapsearch -h ldap-test-master1.corp.dropbox.com -x -ZZ -b '' -s base supportedSASLMechanisms # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: supportedSASLMechanisms # # dn: supportedSASLMechanisms: GS2-IAKERB supportedSASLMechanisms: GS2-KRB5 supportedSASLMechanisms: SCRAM-SHA-1 supportedSASLMechanisms: GSSAPI supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: CRAM-MD5 supportedSASLMechanisms: NTLM supportedSASLMechanisms: LOGIN supportedSASLMechanisms: PLAIN # search result search: 3 result: 0 Success # numResponses: 2 Here is what I see in the server log: 2016-02-09T02:40:00.797598+00:00 ldap-test-master1 slapd[22379]: conn=1008 fd=14 ACCEPT from IP=172.17.8.240:47231 (IP=0.0.0.0:389) 2016-02-09T02:40:00.797640+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=0 EXT oid=1.3.6.1.4.1.1466.20037 2016-02-09T02:40:00.797646+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=0 STARTTLS 2016-02-09T02:40:00.797686+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=0 RESULT oid= err=0 text= 2016-02-09T02:40:00.804071+00:00 ldap-test-master1 slapd[22379]: conn=1008 fd=14 TLS established tls_ssf=256 ssf=256 2016-02-09T02:40:00.804540+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=1 BIND dn="" method=128 2016-02-09T02:40:00.804590+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=1 RESULT tag=97 err=0 text= 2016-02-09T02:40:00.804931+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=2 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" 2016-02-09T02:40:00.804941+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=2 SRCH attr=supportedSASLMechanisms 2016-02-09T02:40:00.805056+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= 2016-02-09T02:40:00.805483+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=3 UNBIND 2016-02-09T02:40:00.805587+00:00 ldap-test-master1 slapd[22379]: conn=1008 fd=14 closed What should I be looking at? What am I missing? Thanks in advance, Bill

2 2

openldap 2.4.44 does not provide an slapd.d
by Mary Kao 10 Feb '16

10 Feb '16

Hello, I compiled openldap 2.4.44 on scientific linux and discovered it didn't create a slapd.d directory. There is however, a slapd.conf file. Is this right? If so, I would need to convert the slapd.conf file to slapd.d? Thanks!

2 1

Re: make posixGroup auxiliary in 2.4.40
by Chris 10 Feb '16

10 Feb '16

Michael StrÃ¶der wrote: > Chris wrote: >> I'm moving from OpenLDAP 2.2.x to 2.4.40 and have wasted hours trying to >> achieve the following: >> mailGroup (Postfix) is used as structural class, posixGroup (NIS) as auxiliary. >> Anyway. I can't add rfc2307bis schema, because NIS is already included. I've tried different methods to get rid of NIS, but they're not working. >> Is there any way to make posixGroup auxiliary? > Are you using static or dynamic configuration? > If you're using static configuration you simply omit nis.schema. I'm using dynamic configuration (Debian Jessie). > Note that rfc2307bis.schema requires a migration from old posixGroup entries > because the membership attribute also changes. They have already used rfc2307bis with static configuration and commented NIS out. They didn't use NIS, my bad. Nevertheless NIS is "included" in dynamic configuration. NIS and rfc2307 are mutually exclusive. The issue eased, since I can do without the rfc2307bis attributes, essentially posixGroup and gidNumber. Nevertheless, is there a way to use rfc2307bis with dynamic configuration? Should one switch to static config. in this case? - Chris

2 1

rebuilding the DIT
by Timothy Keith 09 Feb '16

09 Feb '16

How can I recreate the DIT using the output from slapcat ? I want to change the suffix when I do this. First, I ran slapcat: slapcat -v -l slapcat_backup.ldif Or just point me to the appropriate documentation. Tim

3 2

Authenticating mac users on ldap
by robert k Wild 09 Feb '16

09 Feb '16

Hi all, I want to know or if anyone has done it, i want to be able to login via my ldap user on a mac I know it works on linux as i have been able to login via ldap on my centos machine Also i have mounted my ldap server, (where all the home shares are) via autofs How can i get this to work Many thanks Rob

1 0

BINDDN in ~/.ldaprc ignored(?)
by Frank Thommen 09 Feb '16

09 Feb '16

Hi, BINDDN in ~/.ldaprc seems to be ignored or I'm doing something wrong. /etc/openldap/ldap.conf is empty. ~/.ldaprc is: $ cat ~/.ldaprc BINDDN <myBindDN> BASE <myBaseDN> URI ldaps://<myLDAPServer> TLS_REQCERT never $ ldapsearch returns an error if I don't declare the bindDN on the commandline: $ ldapsearch -W -v cn=xyz ldap_initialize( <DEFAULT> ) Enter LDAP Password: SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (No Kerberos credentials available) $ Using strace I can see, that ~/.ldaprc is accessed by ldapsearch. So either BINDDN is ignored or I am doing something wrong. but works happily with the bindDN on the commandline: $ ldapsearch -D <myBindDN> -W -v cn=xyz ldap_initialize( <DEFAULT> ) Enter LDAP Password: [... ldapsearch results ...] $ Using strace I can see, that ~/.ldaprc is accessed by ldapsearch. So either BINDDN is ignored or I am doing something wrong. This is with openSUSE 13.1 and ldapsearch 2.4.33. Cheers Frank

3 3

Re: BINDDN in ~/.ldaprc ignored(?)
by Frank Thommen 09 Feb '16

09 Feb '16

On 02/09/2016 02:22 PM, Michael Wandel wrote: > On 09.02.2016 10:28, Frank Thommen wrote: >> Hi, >> >> BINDDN in ~/.ldaprc seems to be ignored or I'm doing something wrong. >> >> /etc/openldap/ldap.conf is empty. >> >> ~/.ldaprc is: >> >> $ cat ~/.ldaprc >> BINDDN <myBindDN> >> BASE <myBaseDN> >> URI ldaps://<myLDAPServer> >> TLS_REQCERT never >> $ >> >> >> ldapsearch returns an error if I don't declare the bindDN on the >> commandline: >> >> $ ldapsearch -W -v cn=xyz >> ldap_initialize( <DEFAULT> ) >> Enter LDAP Password: >> SASL/GSSAPI authentication started >> ldap_sasl_interactive_bind_s: Local error (-2) >> additional info: SASL(-1): generic failure: GSSAPI Error: >> Unspecified GSS failure. Minor code may provide more information (No >> Kerberos credentials available) >> $ >> > > can you please check if > > ldapsearch -x -W -v cn=xyz > > is working ? That works fine f. > > best regards > michael > >> Using strace I can see, that ~/.ldaprc is accessed by ldapsearch. So >> either BINDDN is ignored or I am doing something wrong. >> >> but works happily with the bindDN on the commandline: >> >> $ ldapsearch -D <myBindDN> -W -v cn=xyz >> ldap_initialize( <DEFAULT> ) >> Enter LDAP Password: >> [... ldapsearch results ...] >> $ >> >> Using strace I can see, that ~/.ldaprc is accessed by ldapsearch. So >> either BINDDN is ignored or I am doing something wrong. >> >> This is with openSUSE 13.1 and ldapsearch 2.4.33. >> >> >> Cheers >> Frank >> > > -- Frank Thommen | HD-HuB / DKFZ Heidelberg | f.thommen(a)dkfz-heidelberg.de | TP3: +49-6221-42-3562 (Mo+Di) | IPMB: +49-6221-54-5823 (Mi-Do)

1 0

make posixGroup auxiliary in 2.4.40
by Chris 09 Feb '16

09 Feb '16

Dear All, I'm moving from OpenLDAP 2.2.x to 2.4.40 and have wasted hours trying to achieve the following: mailGroup (Postfix) is used as structural class, posixGroup (NIS) as auxiliary. Anyway. I can't add rfc2307bis schema, because NIS is already included. I've tried different methods to get rid of NIS, but they're not working. Is there any way to make posixGroup auxiliary? Thank you in advance. - Chris

2 1

Re: [OpenLDAP][Authentication] SASL
by Timothy Keith 09 Feb '16

09 Feb '16

On Mon, Feb 8, 2016 at 6:07 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Monday, February 08, 2016 6:04 PM -0600 Timothy Keith > <timothy.g.keith(a)gmail.com> wrote: > >> On Sun, Feb 7, 2016 at 6:55 AM, Michael Ströder <michael(a)stroeder.com> >> wrote: >>> >>> Timothy Keith wrote: >>>> >>>> How can I know that slapd was built with -enable-spasswd ? >>> >>> >>> By looking at the configure command in the build script, spec file in >>> source RPM or whatever produced the binary builds you're using. >>> >>> Ciao, Michael. >>> >> >> I extracted the files from the yum binary packages. It is 2.4.40-7. >> I don't think there is a way to determine what the configure options >> were at build time. > > > You need to download the *source* RPM not the *binary* RPM, as the source > RPM includes the SPEC file used to build OpenLDAP. > > --Quanah > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc This was found in a spec file from the src RPM : ./openldap-2/openldap.spec %configure \ --enable-rlookups \ \ --with-tls=moznss \ --with-cyrus-sasl \ \ --enable-wrappers \ \ --enable-passwd \ \ --enable-cleartext \ --enable-crypt \ --enable-spasswd \ --disable-lmpasswd \ --enable-modules \ --disable-sql \ \ --libexecdir=%{_libdir} \ $@ Looks okay for pass-through. Thanks, Tim

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical