openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

Re: [OpenLDAP][Authentication] SASL
by Timothy Keith 01 Feb '16

01 Feb '16

My scenario is relatively simple. The user authentication and LDAP directory for our local application is managed on corporate servers for which we lack administrative rights. We wish to maintain a local view of the LDAP directory for the information that our local application requires, but not alter the user authentication on the corporate servers. Tim On Thu, Jan 21, 2016 at 6:21 PM, Sergio NNX <sfhacker(a)hotmail.com> wrote: >> I am new at LDAP , that is obvious I guess. But, I've been around Unix >> for 30 years. > > Are we still having issues? We might be able to assist you if you describe > your set up and your goal in more detail. > > Cheers, > > Ser. > >> Date: Thu, 21 Jan 2016 14:31:28 -0600 >> From: dwhite(a)cafedemocracy.org >> To: timothy.g.keith(a)gmail.com >> Subject: Re: pass-through authentication >> CC: dwhite(a)cafedemocracy.org; openldap-technical(a)openldap.org >> >> You can view your config with: >> >> slapcat -n0 >> >> And verify that object exists. >> >> If you're receiving this error due to an ACL problem, verify you >> have the proper configuration in place to authenticate as the rootdn using >> sasl/external. See the slapd-config manpage, and see section 15.2 (and in >> particular 15.2.5) of the Administrator's guide, and reference your >> OS/distro documentation. >> >> On 01/21/16 12:35 -0600, Timothy Keith wrote: >> >I commented the mech_list in slapd.conf >> > >> >The ldapsearch result is now No such object >> > >> >ldapsearch -LLLQY EXTERNAL -H ldapi:/// -b cn=config >> >"(|(cn=config)(olcDatabase={1}hdb))" >> >No such object (32) >> > >> >On Fri, Jan 8, 2016 at 2:34 PM, Dan White <dwhite(a)cafedemocracy.org> >> > wrote: >> >> On 01/07/16 17:24 -0600, Timothy Keith wrote: >> >>> >> >>> ldapsearch -LLLQY EXTERNAL -H ldapi:/// -b cn=config >> >>> "(|(cn=config)(olcDatabase={1}hdb))" >> >>> ldap_sasl_interactive_bind_s: Authentication method not supported (7) >> >>> additional info: SASL(-4): no mechanism available: >> >> >> >> >> >> I'm missing some context here. Most likely you have a mech_list hard >> >> coded >> >> in your slapd.conf sasl, which does not include the external mech. >>

2 1

openldap and slapd.conf file
by Mary Kao 29 Jan '16

29 Jan '16

Hello, I've seen information indicating that slapd.conf is no longer in use in OpenLDAP, however the release 2.4.xx comes with a slapd.conf. Can someone please clarify what this file is used for in release 2.4.xx? Would be greatly appreciated. Thank you!

2 1

Lastbind
by Lindolfo Meira 29 Jan '16

29 Jan '16

I noticed the lastbind module won't log public key authentications. Is this the expected behavior? I'm using OpenLDAP 2.4.33. Cheers, L. Meira.

2 1

ldap client login
by Lane 29 Jan '16

29 Jan '16

I'm trying to log into an LDAP client. Below I show a login from the ldap server to the ldap client, and another from a normal workstation on the same subnet to the ldap client. The workstation is able to login, but am not able to login from the ldap server. server: OpenLDAP 2.4.43 clients: nss-pam-ldapd 0.9.6 Any help much appreciated. --- from ldap server to ldap client (fails) $ ssh -l james 10.0.1.2 Enter passphrase for key '/home/james/.ssh/id_rsa': You are required to change your password immediately (root enforced) WARNING: Your password has expired. You must change your password now and login again! New password: Retype new password: password change failed: Server is unwilling to perform passwd: password updated successfully Connection to 10.0.1.2 closed. --- from worstation to ldap client (succeeds) $ ssh node-2 Password: You are required to change your password immediately (root enforced) need a new password New password: Retype new password: password change failed: Insufficient access node-2(james):~$ $ ldapsearch -x -b 'dc=my,dc=example,dc=com' '(objectclass=*)' # extended LDIF # # LDAPv3 # base <dc=my,dc=example,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # my.example.com dn: dc=my,dc=example,dc=com dc: cem objectClass: dcObject objectClass: organization o: CEM # manager, my.example.com dn: cn=manager,dc=my,dc=example,dc=com objectClass: organizationalRole cn: Manager description: LDAP Admin # groups, my.example.com dn: ou=groups,dc=my,dc=example,dc=com ou: groups description: Groups objectClass: organizationalUnit # users, my.example.com dn: ou=users,dc=my,dc=example,dc=com ou: users description: Users objectClass: organizationalUnit # james, groups, my.example.com dn: cn=james,ou=groups,dc=my,dc=example,dc=com cn: james objectClass: top objectClass: posixGroup gidNumber: 1000 # james, users, my.example.com dn: uid=james,ou=users,dc=my,dc=example,dc=com cn: James uid: james uidNumber: 1000 gidNumber: 1000 sn: James homeDirectory: /home/james mail: james(a)example.com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount loginShell: /bin/bash gecos: james shadowLastChange: 0 userPassword:: e1NTSEF9ZjhRMGwwaDk1ek9mMUViaDhreDNlUEsvdFhFb29wV3I= shadowMax: 9999 shadowWarning: 14 # search result search: 2 result: 0 Success # numResponses: 7 # numEntries: 6 /etc/pam.d/system-auth --- auth required pam_env.so auth sufficient pam_unix.so try_first_pass likeauth nullok auth sufficient pam_ldap.so use_first_pass auth required pam_deny.so account required pam_unix.so account [default=bad success=ok user_unknown=ignore] pam_ldap.so account optional pam_permit.so password required pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3 password sufficient pam_unix.so try_first_pass use_authtok nullok sha512 shadow password sufficient pam_ldap.so use_authtok use_first_pass password optional pam_permit.so session required pam_limits.so session required pam_env.so session optional pam_ldap.so session required pam_unix.so session optional pam_permit.so

1 0

OCSP for LDAP Client
by Jason Talley 29 Jan '16

29 Jan '16

I've been asked to enable OCSP checking in our client (connecting to any LDAP server) . The client uses OpenLdap api's for managing the connection to the server. From my recent birth-by-fire education on certs and security, OCSP checking appears more or less to be a manual process rather than having OpenSSL do all the work auto-magically as part of the handshake (ignoring ocsp stapling which I'm avoiding). I don't see any options in openssl s_client (for testing) to enable OCSP -- only a separate utility to manually check based on captured client certs. Storing the CRL in the LDAP DB isn't an option. For whatever reason, OCSP is required. Is there any way to enable OCSP checking via the current LDAP API? Assuming the answer is no, then would a reasonable approach be to manually query the server URL from time to time, and verify the certificate in the background? Traffic from our client should be relatively minimal, so even at a rate of one verification an hour should have a minimal risk window of the cert being expired. Using this method I can more or less follow the same logic as the openssl utilities (s_client and ocsp). TIA.

3 2

simple question
by Aleksandar Karalejić 28 Jan '16

28 Jan '16

Hi OpenLDAP team, I have a question, simple I hope, for you - I need to send client certificate to the server openldap server (by using openldap api and openSSL). For completing this job, first I initalized ldap with url containing ldaps in the url scheme (ldaps://fqdn_of_ldap_server:636). I have set LDAP_OPT_PROTOCOL_VERSION -> LDAP_VERSION3 LDAP_OPT_X_TLS_PROTOCOL_MIN -> LDAP_OPT_X_TLS_PROTOCOL_TLS1_2 LDAP_OPT_X_TLS_REQUIRE_CERT -> LDAP_OPT_X_TLS_DEMAND LDAP_OPT_X_TLS_CONNECT_ARG -> fqdn_of_ldap_server LDAP_OPT_X_TLS_CONNECT_CB -> my_tsl_verify_callback and then I called ldap_sasl_bind: ldap_sasl_bind(mLdapObj, NULL, "EXTERNAL", NULL, NULL, NULL, &msgid); What I saw is that certficate from the server was received, but how to send client certifikate. I played arround with LDAP_OPT_X_TLS_CERTFILE (sending the abs path to the .pem file) but nothing. Also, I saw that this parameter was not taken into account - it looks like ssl_ctx object used for ssl_connect does not include path to the file (like two global structures used for setting up ctx know nothing about each other.) Can you, help me with this? Regards, Aleksandar

2 4

OpenLdap + Cyrus SASL + MIT Kerberos credentials cache
by Petar Kovačević 28 Jan '16

28 Jan '16

Hi All, I'm working on Windows application that uses libldap built with cyrus sasl and MIT Kerberos and I'm having issues with Kerberos authentication on AD. I have tested with various applications and Kerberos is working properly on server. In my app I'm using ldap_sasl_interactive_bind_s(mLdapObj, NULL, "GSSAPI", NULL, NULL, LDAP_SASL_INTERACTIVE, my_ldap_sasl_interact, defaults) in order to bind with server, but I get error -2 (Local error). I have debugged the app and I have found that there is an issue with Keberos Credentials Cache. Because I haven't set credentials cache location, Kerberos reads this location from KRB5CCNAME environment variable. So my first question is : Is there any API in libldap, so we can set our own contact cache location? But even when I set this variable, I get same error when I try to bind. After some more debugging I found that Kerberos expects that I already have credentials cache file created, and that there is a ticket in it(as a I have called kinit before bind). Is there an API in libldap, that will call Kerberos API for credentials cache and ticket obtaining operations, which we can call before bind, or we need to call Kerberos API directly ? Thank you for your help. Best Regards, Petar Kovacevic

2 3

Re: [OpenLDAP][Authentication] SASL
by Timothy Keith 28 Jan '16

28 Jan '16

I don't yet have access to the corporate LDAP service on the production Unix servers. To serve that purpose for testing I am using Apache Directory server on Windows. The test example I'm using is for Active Directory, but I think the pass-through tutorial ought to work basically the same for evaluation purposes. Tim

1 0

Re: acl bug?
by BÖSCH Christian 27 Jan '16

27 Jan '16

> On 26 Jan 2016, at 14:34 , julien soula <julien.soula(a)univ-lille2.fr> wrote: > > On Tue, Jan 26, 2016 at 11:43:59AM +0000, BÖSCH Christian wrote: >> >> Jan 26 12:35:46 openldap1 slapd[84283]: => mdb_entry_get: found entry: "uid=user1,ou=people,o=abc.net" >> Jan 26 12:35:46 openldap1 slapd[84283]: => mdb_entry_get: found entry: "cn=group,ou=groups,o=abc.net" > > are you sure that "uid=user1,ou=people,o=abc.net" is a member of > "cn=group,ou=groups,o=abc.net” ? yes i am. to me it seems that filter= following with attrs= (tested with several filters and attributes) does not work. if i omit attrs= it works to hide the whole entry. if i use a dn instead of filter i can use the attrs= to hide a single attribute. christian > > cdt, > -- > Julien > << Vous n'avez rien a dire... Parlons-en! >>

2 3

Problems with log entries order
by Dario Zanzico 27 Jan '16

27 Jan '16

Writing a script for parsing openldap logs I found that, for some of my connections, the BIND log entry precedes the corresponding ACCEPT entry (which as far as i understand must logically precede the BIND) example: 2016-01-25T12:54:02.131094+01:00 HOSTNAME slapd[15258]: conn=91596 op=0 BIND dn="" method=128 2016-01-25T12:54:02.131099+01:00 HOSTNAME slapd[15258]: conn=91596 op=0 RESULT tag=97 err=0 text= 2016-01-25T12:54:02.131103+01:00 HOSTNAME slapd[15258]: conn=91596 fd=93 ACCEPT from [CUT] slapd is started with the '-l local4' parameter, and rsyslogd is configured to send local4.* to the openldap.log file suspecting some rsyslogd problems i tried running slapd using the "-d 256" parameter, but in the output i found 56a6202b conn=1004 op=0 BIND dn="" method=128 56a6202b conn=1004 op=0 RESULT tag=97 err=0 text= 56a6202b conn=1004 fd=13 ACCEPT from [CUT] Is there any way to guarantee openldap to generate ordered logs? thanks, dario

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical