openldap-technical

openldap-technical@openldap.org

18 participants
9785 discussions

argon2 as builtin module?
by Geert Hendrickx 02 Jun '23

02 Jun '23

Hi I was wondering why the argon2 password module can only be built as a dynamic module, and not statically into the slapd binary, like other backends and overlays can be. That would for example make it easier to use slappasswd -h {ARGON2} without having to specify -o module-load=argon2 and module-path etc. Is it because you want to avoid link dependencies on 3rd party libsodium or libargon2 directly in slapd (and slappasswd) itself? Or just because it was previously a contrib module, and just copied over like that? By the way, while looking at the code, I noticed a typo in configure.ac: > if test "$ol_enable_argon2" = "yes" ; then > SLAPD_DYNAMIC_PWMODS="$SLAPD_DYNAMIC_PWDMODS argon2.la" > fi ^^ ^^^ It's referencing two different variables there, which is harmless today, but will be a build bug once multiple password modules become available. SLAPD_DYNAMIC_PWMODS is the correct one. Geert

2 1

Only view exact match on ACL
by Lukas Adrian Kron 24 May '23

24 May '23

Hello, I would like to restrict bind users in the search. I've already managed that they only see groups for which you have been activated. Now I have the problem that bind users should only see users in the people branch if they know the exact user name in the search. So far I have solved the whole thing using the following two ACL sets. You can now also search for people. Since I had to include objectClass for the search to work, you can search for all people or for other values. However, I want all the data I specify to be displayed, but only if the username returns an exact result. I am at the end of my knowledge with the ACL sets. All the Info on ACL cannot help me further here. {5} to dn.exact="ou=Personen,dc=SERVER" by group.exact="GROUP" search by * break {6} to dn.one="ou=Personen,dc=SERVER" attrs=entry,cn,objectClass,givenname,uid,mail,sn,userPassword by group.exact="GROUP" read by * break Thanks a lot. Kindly Lukas Adrian

1 0

SSL timeout
by Robert T Dunn 23 May '23

23 May '23

We are experiencing a problem with SSL timeout as reported with issue 8047: https://bugs.openldap.org/show_bug.cgi?id=8047 Our issue is when the LDAP client does an SSL connect to establish the TLS session with the remote server. If the SERVER_HELLO returned from the remote server takes a significant amount of time or does not come back from the server at all (for example, someone unplugged the server), the LDAP client connection DOES NOT timeout, and there are no LDAP configuration options to force the session to timeout. So, the LDAP client connection is effectively hung forever. Issue 8047 reported the SSL timeout issue, but the issue's status is still UNCONFIRMED. Are there any plans to correct this problem in future versions of LDAP Client? Thanks, Rob Dunn IBM z/TPFDF development email: strmbrgr(a)us.ibm.com<mailto:strmbrgr@us.ibm.com> phone: (845) 433-1312

3 3

DIT changes approval
by sysadm+ldap-technical＠rolep.work 23 May '23

23 May '23

Hello, Is there any way to approve (past or future) DIT changes by more than one people? OpeLDAP has ACL sets, I know. But I don't understand, how (or even can I) to use it forr approve changes in (part of) DIT by two or more people (must not singly, but whole set of people).

3 2

SASL EXTERNAL
by thomaswilliampritchard＠gmail.com 22 May '23

22 May '23

I understand SASL is a framework defined outside of OpenLDAP and the EXTERNAL mechanism of SASL implies authentication is established outside of the SASL mechanism using context around the client connection. It sounds like that could be something like the Client IP, the DN in the client certificate if using mutual TLS, or the gid / uid of the client when connecting over unix sockets. I am looking for a way to audit that my SASL EXTERNAL configuration does not allow any sort of authentication through anything other than the unix socket option. I have not come across a way that I can configure the external mechanism with only uid / gid methodology. Is it sufficient to simply audit the ACLs and see that there is only an ACL for the unix socket mechanism to be confident the server is not entertaining IP / TLS / or some other EXTERNAL methodology?

1 0

OpenLDAP: slapd 2.4.59 | Too Many Open files
by chauhan.ramraj＠gmail.com 19 May '23

19 May '23

Hi All Requesting some sort of help with "Too Many open files". .I have seen several post and even in these archives about too many open files..Details about openldap installation. Version - 2.4.59 OS- RockyLinux 8 Ldap is used by the coldfusion application for authentication. During normal operation things are ok..but after some time or when a load of like 30 concurrent users for a period of 5 mins are added, I get "Too Many Open files" after the file descriptors reach 1024. What I have observed that post the search result log. , the UNBIND and CLOSE on the connection at times takes over 3 mins..and have see that there are over 1000 connections in ESTABLISHED mode based on the lsof -i :ldap ...I have tried to set below limits but to no avail..it still thows error post 1023 open FDs.. * hard nofile 65535 * soft nofile 65535 * hard memlock 3000000 * soft memlock 3000000 * hard nproc 16000 * soft nproc 16000 * hard stack 512000 * soft stack 512000 Have been able to increase the FDs as well by modifiying the slapd startup script(changed the settings to 4096..it did reflect in monitor)..but after some time the connection unbind and close calls are invoke more than 3 mins...as compared to when the load is low..when it happens within few secs.. Any help to make changes to ldap configuration or pointers how to go ahead troubleshooting this would be really appreciated.

3 5

Two mdb_env_open() on same file/dir? Etc.
by Sam Dave 18 May '23

18 May '23

Can two or more mdb_env_open() be called on the same file/directory (in same program or multiple programs)? Can two or more mdb_dbi_open() be called to open ultimately the same database? What are some ramifications of doing so (and of course working with various readonly/readwrite transactions, etc.) I don't see much written about this in documentation. - Samuel

2 1

OpenLDAP - CLDAP and SASL
by Simon Pichugin 16 May '23

16 May '23

Hi folks, I am currently experiencing an issue with IPA Server set up on Fedora 36, using ipa-adtrust-install, and I'm unsure if this is due to a bug or misconfiguration on my part. Here's what I've done: I ran the following ldapsearch command: ldapsearch -LL -H cldap://server.example.com -b '' -s base 'dc=example,dc=com' "(&(DnsDomain='dc=example,dc=com')(NtVer=\x06\x00\x00\x00)(AAC=\x00\x00\x00\x00))" On OpenLDAP 2.4.46, it was working fine, and it gave an output. But OpenLDAP 2.6.2 and 2.6.4 fails with No such object (32) error. I used gdb to investigate and found that the error occurred here: https://git.openldap.org/openldap/openldap/-/blob/master/clients/tools/comm… It executes ldap_sasl_interactive_bind, but it exits right in the beginning: https://git.openldap.org/openldap/openldap/-/blob/master/libraries/libldap/… So back at: https://git.openldap.org/openldap/openldap/-/blob/master/clients/tools/comm… It exists the do-while loop right away and leaves with no result. I'm wondering if I missed something or if there was an oversight in the implementation of this RFC, specifically regarding the CLDAP case: https://git.openldap.org/openldap/openldap/-/commit/2ae62e86bc8ffab713fc489… Looking forward to your thoughts! Best Regards, Simon

2 2

iNetOrgPerson doesn't exist?
by Luca Stancapiano 16 May '23

16 May '23

Hi all, I'm triing to create a user with openldap 2.4 dn: uid=rrrrrr,ou=users,dc=my-domain,dc=com objectClass: iNetOrgPerson uid: iiiiii but it doesn't seem recognize the objectClass producing this error: adding new entry "uid=rrrrrr,ou=users,dc=my-domain,dc=com" ldap_add: Invalid syntax (21) additional info: objectClass: value #0 invalid per syntax Using other object classes is ok. What's the problem?

5 11

Debugging TLS negotiation failure
by terry.lemons＠dell.com 16 May '23

16 May '23

Hi I've followed the instructions in https://www.openldap.org/doc/admin26/quickstart.html to deploy openldap 2.6.4 on a SLES 15 SP4 system. Once I confirmed that this was working correctly, I moved on to configure TLS, following the instructions in https://www.openldap.org/doc/admin26/tls.html. When I try a connection to the LDAPS port (636), I see the following: ldpdd040:~ # openssl s_client -connect ldpdd042.hop.lab.emc.com:636 CONNECTED(00000003) 139702302594704:error:140790E5:SSL routines:ssl23_write:ssl handshake failure:s23_lib.c:177: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 293 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1683823897 Timeout : 300 (sec) Verify return code: 0 (ok) --- ldpdd040:~ # I'm using this command to start slapd: /usr/local/libexec/slapd -F /usr/local/etc/slapd.d -s 3 -h "ldap:/// ldaps:///" When I execute the openssl command above, I look in /var/log/messages and see: 2023-05-11T12:51:55.213884-04:00 ldpdd042 slapd[20101]: conn=1000 fd=12 ACCEPT from IP=10.247.229.40:56844 (IP=0.0.0.0:636) 2023-05-11T12:51:55.213944-04:00 ldpdd042 slapd[20101]: connection_get(12): got connid=1000 2023-05-11T12:51:55.214004-04:00 ldpdd042 slapd[20101]: connection_read(12): checking for input on id=1000 2023-05-11T12:51:55.214065-04:00 ldpdd042 slapd[20101]: connection_read(12): TLS accept failure error=-1 id=1000, closing 2023-05-11T12:51:55.214138-04:00 ldpdd042 slapd[20101]: connection_close: conn=1000 sd=12 2023-05-11T12:51:55.214207-04:00 ldpdd042 slapd[20101]: conn=1000 fd=12 closed (TLS negotiation failure) ldpdd0 I've appended these lines to /usr/local/etc/openldap/slapd.conf: # Added TLS directives # TLSCACertificateFile /var/lib/ca-certificates/ca-bundle.pem TLSCertificateFile /etc/ssl/private/server.cert TLSCertificateKeyFile /etc/ssl/private/server.key #TLSCipherSuite ALL I can't find any log information that helps me understand what the problem is. I'm using a self-signed server certificate that has the cn using the FQDN of the server. How can I debug this? Thanks! tl

12 31

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical