openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

No "known good" password found for the user. Not setting Auth-Type
by MichaelLeung 08 Mar '16

08 Mar '16

hi list i was trying to deploy freeradius + openldap ,and got warning like this (0) ldap : Processing user attributes (0) WARNING: ldap : No "known good" password added. Ensure the admin user has permission to read the password attribute (0) WARNING: ldap : PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Released connection (4) (0) [ldap] = ok (0) [expiration] = noop (0) [logintime] = noop (0) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type (0) WARNING: pap : Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject the ldap account i added to radius configuration file was not the LDAP Manager account , but when i change the account to LDAP Manager user , the warning would not be shown again , and the pass authentication challenge. how can i authorize a normal ldap account can read userPassword attribute , then i can add the account to those system which need LDAP .

1 0

DB_LOG_AUTOREMOVE fails to suppress the log files
by jupiter 07 Mar '16

07 Mar '16

Hi, I am running openldap servers 2.4.40 with bdb on CentOS 6, it creates 10 MB log file in every 2 - 3 minutes, no surprisingly, it fills up the disk quickly. To fix the issue, I added following statement to DB_CONFIG, restarted splapd, but it does not seem work, the log files are still glowing and creating. Could anyone help please why the DB_LOG_AUTOREMOVE is unable to stop log files? Sorry for posting it to different lists as we are not be able to run the ldap server when it fills up the disk so quickly. set_flags DB_LOG_AUTOREMOVE Thanks for your helps. Kind regards,

3 7

storing HA1 password hash for HTTP DIGEST, SIP, TURN
by Daniel Pocock 07 Mar '16

07 Mar '16

Hi all, There are a few protocols that use a HA1[1] password hash, such as HTTP DIGEST[1], SIP DIGEST[2] and TURN[3] (which uses HMAC rather than DIGEST) Is there a standard LDAP attribute name for storing a HA1 value or should it be stored in a regular userPassword attribute as described in the manual[4]? I came across smbk5pwd for keeping SMB password attributes in sync. Is there a similar facility for keeping HA1 passwords in sync when a user changes the password or how could a developer go about adding that, would the smbk5pwd source be a useful model? Regards, Daniel 1. http://tools.ietf.org/html/rfc2617#section-3 2. https://tools.ietf.org/html/rfc3261#section-22.4 3. https://tools.ietf.org/html/rfc5389#section-15.4 4. http://www.openldap.org/doc/admin24/security.html#Password%20Storage

3 5

rewrite overlay to combine multiple OUs
by Nick Couchman 06 Mar '16

06 Mar '16

Well, I have a situation (a particular application, actually), that is so arcane in its configuration that it requires that all of the users for the application be in the same OU. So, the config for the app is something like: CN=%USERNAME%,ou=Users,dc=example,dc=com So, the application substitutes in the %USERNAME% value with the actual username, and then does a bind with the supplied password. My tree is a little more complicated than that - another dc level or two and several different ou=People places - something like this: ou=People,dc=engineering,dc=example,dc=com ou=People,dc=administration,dc=example,dc=com ou=People,dc=operations,dc=example,dc=com etc. with all of the users located under the ou=People branches of the tree. What I'm hoping is that there's some way that I can virtually combine the ou=People locations in my LDAP tree such that, when the application requests cn=Nick,ou=users,dc=example,dc=com, it goes out and searches through either the entire dc=example,dc=com tree or goes through and looks at each of the ou=People locations until it finds it and transparently redirects, allowing this application to function correctly in its stupid configuration, but without me having to create a bunch of aliases in a single location in my tree, or, worse, actually reorganize my tree. I'm thinking there's probably a way to do this with the rewriteRule and some regular expressions, but I can't find quite the combination of rules/expressions to accomplish this. Any ideas? Or am I stuck making aliases? Thanks, Nick == This e-mail may contain SEAKR Engineering (SEAKR) Confidential and Proprietary Information. If this message is not intended for you, you are strictly prohibited from using this message, its contents or attachments in any way. If you have received this message in error, please delete the message from your mailbox. This e-mail may contain export-controlled material and should be handled accordingly.

2 4

Replication of local entries with translucent overlay
by Igor 04 Mar '16

04 Mar '16

Hello, I have an openLDAP proxy server which uses the translucent overlay to supplement Active Directory records with additional attributes. I wanted to set up replication for my translucent entries (specifically, push-based provider/consumer scheme, refreshAndPersist mode). Since slapo-translucent turns off maintenance of the entryCSN and entryUUID attributes (turns off the lastmod option in the translucent_db_init function), it cannot be used with slapo-syncprov (which requires entryCSN and entryUUID attributes). I understand that to make these two overlays work together in all scenarios may not be trivial. However, for my specific scenario, it seems to be enough to just comment out that line which turns off lastmod: ============== --- servers/slapd/overlays/translucent.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/servers/slapd/overlays/translucent.c b/servers/slapd/overlays/translucent.c index 48cca49..45b45a0 100644 --- a/servers/slapd/overlays/translucent.c +++ b/servers/slapd/overlays/translucent.c @@ -1282,7 +1282,7 @@ static int translucent_db_init(BackendDB *be, ConfigReply *cr) { return 1; } SLAP_DBFLAGS(be) |= SLAP_DBFLAG_NO_SCHEMA_CHECK; - SLAP_DBFLAGS(be) |= SLAP_DBFLAG_NOLASTMOD; +// SLAP_DBFLAGS(be) |= SLAP_DBFLAG_NOLASTMOD; return 0; } -- 1.7.1 ============== Everything replicates correctly after that. I don't expect anyone to scour the openLDAP code to come up with an exhaustive list of potential bugs that may arise because of this. I assume the risks that come with such a solution. Having said that, can anyone think of any issues with commenting that line in translucent_db_init, and setting entryCSN, entryUUID, contextCSN attributes to be searched in local glue records only (via olcTranslucentLocal)? Thanks, -Igor

2 1

Users with multiple passwords?
by dev 03 Mar '16

03 Mar '16

Hello All, I have OpenLDAP (2.4.31-1+nmu2ubuntu8.2) setup to authenticate users on our LAN with ActiveDirectory using SASL passthrough. I want to give some of these users access to VPN (OpenVPN) services (auth with the same OpenLDAP server above) however I want to give them an {SHA1} password to access the VPN. I've created another OU (OU=vpnuser) and simply duplicated the entire user entry into it. I have the VPN server using a searchbase of "OU=vpnuser.." and things are working as I want... sort of.. Some software on the LAN finds two users in ldap now so I explicitly exclude OU=vpnuser from searchbases (!OU=vpnuser). ugh.. Is there a better way to accomplish what I am trying to do? Give the same user two different passwords in the ldap tree? Thanks

2 1

Re: ldapmodify hangs, slapd appears to be looping
by Quanah Gibson-Mount 03 Mar '16

03 Mar '16

If you're artificially stuck using RH's builds, then you'll need to contact them for support. --Quanah --On Thursday, March 03, 2016 3:42 PM +0000 "Heinemann, Peter" <phei(a)isc.upenn.edu> wrote: > True, but unfortunately recommended practice collides with (artificial) > standards.... > > ________________________________________ > From: Quanah Gibson-Mount <quanah(a)zimbra.com> > Sent: Thursday, March 3, 2016 10:37 AM > To: Heinemann, Peter; openldap-technical(a)openldap.org > Subject: Re: ldapmodify hangs, slapd appears to be looping > > --On Thursday, March 03, 2016 3:23 PM +0000 "Heinemann, Peter" > <phei(a)isc.upenn.edu> wrote: > >> >> >> >> >> Openldap 2.4.40-6.el6_7 > > As has been repeatedly mentioned on the list, please don't use RH's > OpenLDAP builds. Please do use a current release. You may wish to look > into using a build from the LTB project or Symas. > > <http://ltb-project.org/wiki/download#openldap> > <https://symas.com/products/openldap-directory/> > > There were some known issues with mdb in 2.4.40 and 2.4.41 you may be > triggering here. > > --Quanah > > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration A division of Synacor, Inc

1 0

ldapmodify hangs, slapd appears to be looping
by Heinemann, Peter 03 Mar '16

03 Mar '16

Openldap 2.4.40-6.el6_7 RHEL 6.7 mdb backend ldapmodify is hanging; the hang first evidenced itself in a bulk update. The hang occurs even for a simple update -- with debug set to 1 on the ldapmodify statement (using interactive mode) the block of output listed at below repeats endlessly with no change to the values displayed. The slapd audit log shows no update for the intended record. The problem started after I added a significant amount of data; not new structural objects (OUs) but many entries under them. Have I reached some sort of threshold? I have: - stopped/started slapd; - run a full slapcat and slapadd to a new database I am running the monitor database; would there be data of value there about this condition? mdb_stats output: sudo mdb_stat -ef /etc/openldap/openldap-data Environment Info Map address: (nil) Map size: 8589934592 Page size: 4096 Max pages: 2097152 Number of pages used: 618975 Last transaction ID: 3647 Max readers: 126 Number of readers used: 0 Freelist Status Tree depth: 1 Branch pages: 0 Leaf pages: 1 Overflow pages: 11 Entries: 7 Free pages: 5233 Status of Main DB Tree depth: 1 Branch pages: 0 Leaf pages: 1 Overflow pages: 0 Entries: 16 debug output from ldapmodify: ** ld 0x1ed4e30 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x1ed4e30 request count 1 (abandoned 0) ** ld 0x1ed4e30 Response Queue: Empty ld 0x1ed4e30 response count 0 ldap_chkResponseList ld 0x1ed4e30 msgid 2 all 1 ldap_chkResponseList returns ld 0x1ed4e30 NULL ldap_int_select ldap_result ld 0x1ed4e30 msgid 2 wait4msg ld 0x1ed4e30 msgid 2 (timeout 100000 usec) wait4msg continue ld 0x1ed4e30 msgid 2 all 1 ** ld 0x1ed4e30 Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Thu Mar 3 10:04:05 2016 ** ld 0x1ed4e30 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x1ed4e30 request count 1 (abandoned 0) ** ld 0x1ed4e30 Response Queue: Empty ld 0x1ed4e30 response count 0 ldap_chkResponseList ld 0x1ed4e30 msgid 2 all 1 ldap_chkResponseList returns ld 0x1ed4e30 NULL ldap_int_select ldap_result ld 0x1ed4e30 msgid 2 wait4msg ld 0x1ed4e30 msgid 2 (timeout 100000 usec) wait4msg continue ld 0x1ed4e30 msgid 2 all 1 ** ld 0x1ed4e30 Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Thu Mar 3 10:04:05 2016 ...etc

2 1

OpenLDAP 2.4x Syncrepl setup
by Ted Hyde (RSI) 03 Mar '16

03 Mar '16

Greets - I'm trying to set up a new slave (consumer) server that would test against an existing (read: legacy) Samba4 AD controller for LDAP auth. The intent is to have the consumers as distributed HA-like setups in the event that VPNs or full off-site network connectivity was lost, users could still authenticate against the local LDAP services. (The application auth is really quite simple in this case, just some php grabbing a bunch of groups, not full AD work). In "ye olde days", I could do this with slapd.conf, but I'm trying to upgrade my own brain-software to understand OLC better, and am hitting a brick wall. I'd really like to just have the following on each consumer server: syncrepl rid=1 provider=ldap://ldap.example.com type=refreshOnly interval=00:00:00:30 searchbase="dc=example,dc=com" filter="(objectClass=*)" attrs="*" scope=sub schemachecking=off bindmethod=simple binddn="cn=root,dc=example,dc=com" credentials=secret updateref ldap://ldap.example.com tailed to the end of what would have been a few more lines describing the db for the consumer, but I've not found anywhere how to describe the above snippet into an ldif file. I ran this snippet (names corrected of course) through slaptest just to see if it could handle a partial, and of course it failed (missing db schema) - but if I add the db schema as a header, it fails because of the existing slapd.d directory. If I delete the slapd.d directory and place this old format into slapd.conf, restarting the service fails with a db import error. Yet, some of my old 2.2 configs run fine on 2.2 but fail on 2.4 The service does run, in that I can plow out an old config, start clean, add sample users by hand etc, so at least it's a working server, it just won't join to an existing one or pull a directory from another place. The 2.4 Admin docs say to add the old schema to the slapd.conf file (as I attempted above), but doesn't explore how to do it with OLC. The goal would be to have consumer slapd's running at my off-sites that act in the refreshOnly mode; push up technology is NOT required. Or wanted, actually. Suggestions welcome! Thanks, Ted.

4 3

O: Oracle/SAP and LDAP connections
by Ulrich Windl 25 Feb '16

25 Feb '16

Hi! I noticed that one of our servers running SAP Solution Manager with Oracle has more than 70 established connections to one of our LDAP servers. According to lsof most connections belong to Oracle processes; each process seems to have its own connection: oracle 8447 oracsm 10u IPv4 16950 0t0 TCP 172.20.16.33:42599->172.20.17.200:ldap oracle 8449 oracsm 10u IPv4 16964 0t0 TCP 172.20.16.33:42699->172.20.17.200:ldap oracle 8451 oracsm 10u IPv4 16979 0t0 TCP 172.20.16.33:42799->172.20.17.200:ldap oracle 8453 oracsm 10u IPv4 16994 0t0 TCP 172.20.16.33:42843->172.20.17.200:ldap oracle 8455 oracsm 10u IPv4 17009 0t0 TCP 172.20.16.33:42899->172.20.17.200:ldap oracle 8457 oracsm 10u IPv4 17024 0t0 TCP 172.20.16.33:42999->172.20.17.200:ldap oracle 8465 oracsm 10u IPv4 17106 0t0 TCP 172.20.16.33:43499->172.20.17.200:ldap oracle 8467 oracsm 10u IPv4 17120 0t0 TCP 172.20.16.33:43532->172.20.17.200:ldap oracle 8469 oracsm 10u IPv4 17122 0t0 TCP 172.20.16.33:43599->172.20.17.200:ldap oracle 8471 oracsm 10u IPv4 17123 0t0 TCP 172.20.16.33:43699->172.20.17.200:ldap oracle 8478 oracsm 10u IPv4 17127 0t0 TCP 172.20.16.33:43899->172.20.17.200:ldap oracle 10172 oracsm 10u IPv4 18911 0t0 TCP 172.20.16.33:45598->172.20.17.200:ldap oracle 10197 oracsm 10u IPv4 18920 0t0 TCP 172.20.16.33:45599->172.20.17.200:ldap CSM_70_BT 10412 csmadm 5u IPv4 1348471 0t0 TCP 172.20.16.33:60332->172.20.17.200:ldap sapstarts 11352 csmadm 8u IPv4 20890 0t0 TCP 172.20.16.33:45799->172.20.17.200:ldap ms.sapCSM 11698 csmadm 6u IPv4 21277 0t0 TCP 172.20.16.33:48199->172.20.17.200:ldap CSM_70_DP 11699 csmadm 5u IPv4 21424 0t0 TCP 172.20.16.33:48299->172.20.17.200:ldap gwrd 11737 csmadm 9u IPv4 21480 0t0 TCP 172.20.16.33:48354->172.20.17.200:ldap icman 11738 csmadm 10u IPv4 23751 0t0 TCP 172.20.16.33:48399->172.20.17.200:ldap CSM_70_DI 11740 csmadm 5u IPv4 23815 0t0 TCP 172.20.16.33:48699->172.20.17.200:ldap CSM_70_DI 11741 csmadm 5u IPv4 23801 0t0 TCP 172.20.16.33:48499->172.20.17.200:ldap CSM_70_DI 11742 csmadm 5u IPv4 23806 0t0 TCP 172.20.16.33:48599->172.20.17.200:ldap CSM_70_DI 11743 csmadm 5u IPv4 23817 0t0 TCP 172.20.16.33:48899->172.20.17.200:ldap CSM_70_DI 11744 csmadm 5u IPv4 23816 0t0 TCP 172.20.16.33:48799->172.20.17.200:ldap CSM_70_DI 11745 csmadm 5u IPv4 19863 0t0 TCP 172.20.16.33:55488->172.20.17.200:ldap CSM_70_DI 11746 csmadm 5u IPv4 19856 0t0 TCP 172.20.16.33:55484->172.20.17.200:ldap CSM_70_DI 11747 csmadm 5u IPv4 19900 0t0 TCP 172.20.16.33:55498->172.20.17.200:ldap CSM_70_DI 11748 csmadm 5u IPv4 19880 0t0 TCP 172.20.16.33:55493->172.20.17.200:ldap CSM_70_DI 11749 csmadm 5u IPv4 19878 0t0 TCP 172.20.16.33:55489->172.20.17.200:ldap CSM_70_UP 11750 csmadm 5u IPv4 19862 0t0 TCP 172.20.16.33:55487->172.20.17.200:ldap CSM_70_EN 11751 csmadm 5u IPv4 19889 0t0 TCP 172.20.16.33:55494->172.20.17.200:ldap CSM_70_SP 11755 csmadm 5u IPv4 23865 0t0 TCP 172.20.16.33:51634->172.20.17.200:ldap CSM_70_UP 11756 csmadm 5u IPv4 19941 0t0 TCP 172.20.16.33:55522->172.20.17.200:ldap oracle 11778 oracsm 7u IPv4 23927 0t0 TCP 172.20.16.33:55477->172.20.17.200:ldap oracle 11780 oracsm 7u IPv4 23943 0t0 TCP 172.20.16.33:55478->172.20.17.200:ldap oracle 11782 oracsm 7u IPv4 23983 0t0 TCP 172.20.16.33:55482->172.20.17.200:ldap oracle 11784 oracsm 7u IPv4 23981 0t0 TCP 172.20.16.33:55479->172.20.17.200:ldap oracle 11786 oracsm 7u IPv4 23984 0t0 TCP 172.20.16.33:55483->172.20.17.200:ldap oracle 11792 oracsm 7u IPv4 19879 0t0 TCP 172.20.16.33:55492->172.20.17.200:ldap oracle 11794 oracsm 7u IPv4 19959 0t0 TCP 172.20.16.33:55524->172.20.17.200:ldap oracle 11797 oracsm 7u IPv4 24100 0t0 TCP 172.20.16.33:55538->172.20.17.200:ldap oracle 11800 oracsm 7u IPv4 19990 0t0 TCP 172.20.16.33:55528->172.20.17.200:ldap oracle 11807 oracsm 7u IPv4 20023 0t0 TCP 172.20.16.33:55532->172.20.17.200:ldap oracle 11810 oracsm 7u IPv4 20059 0t0 TCP 172.20.16.33:55533->172.20.17.200:ldap oracle 11813 oracsm 7u IPv4 20062 0t0 TCP 172.20.16.33:55534->172.20.17.200:ldap oracle 11815 oracsm 7u IPv4 20064 0t0 TCP 172.20.16.33:55537->172.20.17.200:ldap oracle 11820 oracsm 7u IPv4 20081 0t0 TCP 172.20.16.33:55539->172.20.17.200:ldap CSM_70_BT 11963 csmadm 5u IPv4 1355947 0t0 TCP 172.20.16.33:61710->172.20.17.200:ldap sapstarts 14502 csmadm 8u IPv4 26768 0t0 TCP 172.20.16.33:57594->172.20.17.200:ldap ms.sapCSM 14870 csmadm 6u IPv4 27174 0t0 TCP 172.20.16.33:57659->172.20.17.200:ldap en.sapCSM 14871 csmadm 9u IPv4 27215 0t0 TCP 172.20.16.33:58272->172.20.17.200:ldap oracle 14882 oracsm 10u IPv4 27217 0t0 TCP 172.20.16.33:58273->172.20.17.200:ldap jlaunch 14890 csmadm 14u IPv4 27282 0t0 TCP 172.20.16.33:58283->172.20.17.200:ldap jlaunch 14891 csmadm 14u IPv4 27688 0t0 TCP 172.20.16.33:58284->172.20.17.200:ldap jlaunch 14892 csmadm 14u IPv4 27678 0t0 TCP 172.20.16.33:58282->172.20.17.200:ldap nscd 15591 root 13u IPv4 28333 0t0 TCP 172.20.16.33:60503->172.20.17.200:ldap CSM_70_BT 31006 csmadm 5u IPv4 1293312 0t0 TCP 172.20.16.33:63365->172.20.17.200:ldap Other machines (running the same OS and SAP also) just have one connection established to an LDAP server. Does anybody know why Oracle uses that many connections, and possibly whether there is a configurable parameter to avoid that many connections. Regards, Ulrich

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical