openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

Re: rebuilding the DIT
by Timothy Keith 12 Feb '16

12 Feb '16

On Thu, Feb 11, 2016 at 4:46 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, February 11, 2016 4:38 PM -0600 Timothy Keith > <timothy.g.keith(a)gmail.com> wrote: > >> I don't know how to fix this. If I could reinitialize the dc=pubsys, >> dc=com that would be okay too as there are relatively few users to >> add. > > > It's saying that you're missing a schema file for inetOrgPerson. Schema is > stored in the config database. I.e., if your slapd is passed an option of > -F /path/to/configdb then slapadd (and slapcat) should both also be passed > an option to the same location. > > It would generally be impossible for you to be able to create entries in > openldap that used inetorgPerson without the schema actually being present. > So this would indicate that you're not providing the correct options to > slapadd. You provide virtually no useful information at what you're doing, > so it becomes rather difficult to do anything but guess at what the causes > of your issues are. > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc This is the slapadd request : slapadd -F /etc/openldap/slapd.d -l slapcat_backup.ldif 56bd1acf The first database does not allow slapadd; using the first available one (2) 56bd1acf bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap: (2). Expect poor performance for suffix "dc=example,dc=com". slapadd: line 1: database #2 (dc=example,dc=com) not configured to hold "dc=pubsys,dc=com"; no database configured for that naming context _# 5.10% eta none elapsed none spd 2.7 M/s Closing DB... Tim

2 1

Re: rebuilding the DIT
by Timothy Keith 11 Feb '16

11 Feb '16

On Thu, Feb 11, 2016 at 2:30 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, February 11, 2016 12:29 PM -0800 Quanah Gibson-Mount > <quanah(a)zimbra.com> wrote: > >> --On Thursday, February 11, 2016 2:18 PM -0600 Timothy Keith >> <timothy.g.keith(a)gmail.com> wrote: >> >>> When the slapadd loaded the backup ldif it prints : >>> >>> slapadd: dn="uid=tkeith,ou=Group,dc=pubsys,dc=com" (line=55): (65) >>> unrecognized objectClass 'inetOrgPerson' >> >> >> Sounds like you failed to restore your config database properly. > > > Or, you failed to point slapadd at the actual config database it should be > using for the import. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc I don't know how to fix this. If I could reinitialize the dc=pubsys, dc=com that would be okay too as there are relatively few users to add. Tim

2 1

Re: rebuilding the DIT
by Timothy Keith 11 Feb '16

11 Feb '16

On Thu, Feb 11, 2016 at 12:55 PM, Albert Braden <abraden(a)about.com> wrote: > Do you use IRC? I've had good luck getting help on FreeNode, in #ldap and #openldap > > Even there, people will likely ask you to read the documentation so that you can ask intelligent questions. They're helpful, but they don't want to do your work for you. If you haven't already done so, I would read a lot of this site: > > http://www.openldap.org/doc/admin24/ > > For diagnostic purposes, I recommend using ldapsearch and other command-line tools instead of a GUI client. A question likely to receive a helpful response would look something like this: > > I'm running OpenLDAP version X on <OS>, and when I run this command: > > XXX > > I see this error: > > YYY > > And this appears in slapd.log: > > ZZZ > > Here's the relevant section of my config: > > AAA > > -----Original Message----- > From: openldap-technical [mailto:openldap-technical-bounces@openldap.org] On Behalf Of Timothy Keith > Sent: Thursday, February 11, 2016 1:35 PM > To: openldap-technical(a)openldap.org > Subject: Re: rebuilding the DIT > > On Tue, Feb 9, 2016 at 7:02 PM, Timothy Keith <timothy.g.keith(a)gmail.com> wrote: >> I used slapcat followed by slapadd. The Perl Net::LDAP sounds useful. >> >> Tim > > > Is there a good forum for newbie openlap questions? > > I saved another DIT using slapcat, then loaded using slapadd. But, > that is now returning error code 49 : invalid credentials ( in > JXplorer ). I'm using the rootpw password that > is defined in /etc/openldap/ldap.conf > > Tim > I stopped the service, and then restarted slapd with the -d 1 ( debug ) and also used the -f /etc/openldap/ldap.conf. Now, it is accepting the password for rootdn ( which I have never explicitly changed ) Tim

2 3

Re: rebuilding the DIT
by Timothy Keith 11 Feb '16

11 Feb '16

I used slapcat followed by slapadd. The Perl Net::LDAP sounds useful. Tim

1 1

Re: make posixGroup auxiliary in 2.4.40
by Chris 11 Feb '16

11 Feb '16

Quanah Gibson-Mount wrote: > --On Tuesday, February 09, 2016 10:42 PM +0100 Chris > <chris2014(a)postbox.xyz> wrote: >> Nevertheless, is there a way to use rfc2307bis with dynamic >> configuration? > > Sure. Use slapcat to export your config DB, remove the problem schema, and > reload with slapadd. Ok. I thought this wasn't possible, because some attribute types are marked as builtin in nis.schema: # builtin #attributetype ( 1.3.6.1.1.1.1.1 NAME 'gidNumber' # DESC 'An integer uniquely identifying a group in an administrative domain' # EQUALITY integerMatch # SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - Chris

2 2

ldap client library
by Friedrich Locke 11 Feb '16

11 Feb '16

Hi folks! i am in need to write a small subset of ldap client library. Currently i need Write a function to encode a bind request Write a function to decode a bind response Write a function to encode a entry request (for instance: retrieve all attributes for entry posixuser uid=sioux,ou=people,dn=x,dn=y) Write a function to decode a entry search response May you point me what are the messages in the ldap library RFC i shoud implement as also the tag values for the ASN objects ? Thanks in advance.

1 0

LMDB and Referential transparency
by Pierre-Étienne Meunier 11 Feb '16

11 Feb '16

Hi, I love LMDB, thanks for writing it! I wonder whether it would be possibly to add the following feature: When I change one of the databases (called for instance A) in my environment, I'd like to be able to still keep a copy of A as it was before, and make a new copy B, that would share all its memory with A, except the changes. In other words, I'd like to have a function like: int mdb_fork_db(MDB_txn* txn, MDB_dbi dbi_a, char* B, int open_dbi_flags, MDB_dbi* dbi_b), which would open a new database dbi_b with name B, and copy the B-Tree root of database "dbi_a" as the root of "dbi_b". After this, any put/delete on A would update A only, and any put/delete on new_name would update new_name only. Cheers, Pierre Here is an example of the semantics I would find really great: #include<lmdb.h> void main(){ MDB_env *env; mdb_env_create(&env); mdb_env_open(env,"/tmp/test.lmdb",0,0755); MDB_txn *txn; mdb_env_set_maxdbs(env,2); mdb_txn_begin(env,NULL,0,&txn); MDB_dbi db_a; mdb_dbi_open(txn,"A",MDB_CREATE,&db_a); { char*k_="shared1"; char*v_="value 1"; MDB_val k = { mv_data:k_,mv_size:sizeof(k_) }; MDB_val v = { mv_data:v_,mv_size:sizeof(v_) }; mdb_put(txn,db_a,&k,&v,0); } { char*k_="shared2"; char*v_="value 2"; MDB_val k = { mv_data:k_,mv_size:sizeof(k_) }; MDB_val v = { mv_data:v_,mv_size:sizeof(v_) }; mdb_put(txn,db_a,&k,&v,0); } MDB_dbi db_b; mdb_fork_db(txn,db,"B",MDB_CREATE,&db_b); { char*k_="BKey"; char*v_="Value B"; MDB_val k = { mv_data:k_,mv_size:sizeof(k_) }; MDB_val v = { mv_data:v_,mv_size:sizeof(v_) }; mdb_put(txn,db_b,&k,&v,0); } { char*k_="AKey"; char*v_="Value A"; MDB_val k = { mv_data:k_,mv_size:sizeof(k_) }; MDB_val v = { mv_data:v_,mv_size:sizeof(v_) }; mdb_put(txn,db_a,&k,&v,0); } // Now, A has {shared1, shared2, AKey}, and B has {shared1,shared2,BKey}. { char*k_="shared1"; MDB_val k = { mv_data:k_,mv_size:sizeof(k_) }; mdb_del(txn,db_b,&k,NULL); } // Now, A has {shared1, shared2, AKey}, and B has {shared2,BKey}. mdb_drop(db_a); // Now, the environment has just a single database B, with keys {shared2, BKey}. mdb_txn_commit(txn); mdb_env_close(env); }

3 2

chaining for a single backend?
by Marc Patermann 11 Feb '16

11 Feb '16

Hi, I want to activate chaining for a single backend. The server is a replication consumer and has a few glued database backends. Only one is containing linux accounts with ppolicy overlay. This should use chaining to replicate the ppolicy changes which otherwise stay local. Can this be achieved? Marc

4 6

Unable to do ldapsearch, but testsaslauthd works in OpenLDAP 2.4
by Ravi K Althuru 11 Feb '16

11 Feb '16

We have OpenLDAP 2.3 running on Linux. It is set up in SASL mode authenticating against multiple ADs. Everything works fine there, which is our Production env. We recently installed a new instance of OpenLDAP 2.4.23 running on RedHat Linux 6 in our Dev and QA env. Then, we moved the slapd.conf and slapd-meta.conf file to the new instance, and created the required users. When we run testsaslauthd, we are successfully able to authenticate against the appropriate AD that the user is under. testsaslauthd -u ravi@SONEPAR -p secret - WORKS ldapsearch -x -D uid=ravi,ou=People,ou=company,dc=inside,dc=devserver,dc=com -w secret results in: ldap_bind: Invalid credentials (49) But when we do a ldap search or connect using LDAP Browser, the user is not able to get autheticated. We are not able to bind to the OpenLDAP by using the same credentials. I get a Invalid credentials err 49, which indcates either credentials are incorrect, which in this case its not, or the bind info is incorrect. I seems as though the user is not able to bind to OpenLDAP 2.4 or it does not know how to. When I change the password form {SASL}ralthuru@SONEPAR to a text say "secret", it works fine. Here is the log output from the same user authetication in OpenLDAP 2.3 and OpenLDAP 2.4: SUCCESS - QA 2.4 - testsaslauthd -u ralthuru@SONEPAR -p secret Feb 2 16:42:44 pabeldapd01-new slapd[65327]: conn=1000 fd=8 ACCEPT from IP=127.0.0.1:44500 (IP=127.0.0.1:391) Feb 2 16:42:44 pabeldapd01-new slapd[65327]: conn=1000 op=0 BIND dn="cn=Manager,dc=local" method=128 Feb 2 16:42:44 pabeldapd01-new slapd[65327]: conn=1000 op=0 BIND dn="cn=Manager,dc=local" mech=SIMPLE ssf=0 Feb 2 16:42:44 pabeldapd01-new slapd[65327]: conn=1000 op=0 RESULT tag=97 err=0 text= Feb 2 16:42:44 pabeldapd01-new slapd[65327]: conn=1000 op=1 SRCH base="ou=SONEPAR,dc=local" scope=2 deref=0 filter="(|(uid=ralthuru)(?SMACCOUNTNAME=ralthuru))" Feb 2 16:42:44 pabeldapd01-new slapd[65327]: conn=1000 op=1 SRCH attr=dn Feb 2 16:42:44 pabeldapd01-new slapd[65327]: conn=1000 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Feb 2 16:42:44 pabeldapd01-new slapd[65327]: conn=1000 op=2 BIND anonymous mech=implicit ssf=0 Feb 2 16:42:44 pabeldapd01-new slapd[65327]: conn=1000 op=2 BIND dn="cn=Ravi Althuru,cn=Users,ou=SONEPAR,dc=local" method=128 Feb 2 16:42:44 pabeldapd01-new slapd[65327]: conn=1000 op=2 BIND dn="cn=Ravi Althuru,cn=Users,ou=SONEPAR,dc=local" mech=SIMPLE ssf=0 Feb 2 16:42:44 pabeldapd01-new slapd[65327]: conn=1000 op=2 RESULT tag=97 err=0 text= SUCCESS - QA 2.4 - login as cn=Manager/Password1 from LDAP Browser Feb 2 16:43:09 pabeldapd01-new slapd[65323]: conn=1004 fd=12 ACCEPT from IP=10.108.138.66:64931 (IP=0.0.0.0:389) Feb 2 16:43:09 pabeldapd01-new slapd[65323]: conn=1004 op=0 BIND dn="cn=Manager,dc=inside,dc=sdusadevl,dc=com" method=128 Feb 2 16:43:09 pabeldapd01-new slapd[65323]: conn=1004 op=0 BIND dn="cn=Manager,dc=inside,dc=sdusadevl,dc=com" mech=SIMPLE ssf=0 Feb 2 16:43:09 pabeldapd01-new slapd[65323]: conn=1004 op=0 RESULT tag=97 err=0 text= Feb 2 16:43:12 pabeldapd01-new slapd[65323]: conn=1004 op=1 UNBIND Feb 2 16:43:12 pabeldapd01-new slapd[65323]: conn=1004 fd=12 closed FAIL - QA 2.4 - login as uid=ralthuru/Sonepar123 from LDAP Browser Feb 2 16:43:35 pabeldapd01-new slapd[65323]: conn=1005 fd=12 ACCEPT from IP=10.108.138.66:64939 (IP=0.0.0.0:389) Feb 2 16:43:35 pabeldapd01-new slapd[65323]: conn=1005 op=0 BIND dn="uid=ralthuru,ou=Sonepar,ou=People,dc=inside,dc=sdusadevl,dc=com" mthod=128 Feb 2 16:43:35 pabeldapd01-new slapd[65323]: conn=1005 op=0 RESULT tag=97 err=49 text= Feb 2 16:43:35 pabeldapd01-new slapd[65323]: conn=1005 op=1 UNBIND Feb 2 16:43:35 pabeldapd01-new slapd[65323]: conn=1005 fd=12 closed SUCCESS - PRODUCTION 2.3 - testsaslauthd -u ralthuru@SONEPAR -p secret Feb 3 10:07:35 pavfldapp01 slapd[6375]: conn=94 op=22 BIND anonymous mech=implicit ssf=0 Feb 3 10:07:35 pavfldapp01 slapd[6375]: conn=94 op=22 BIND dn="cn=Manager,dc=local" method=128 Feb 3 10:07:35 pavfldapp01 slapd[6375]: conn=94 op=22 BIND dn="cn=Manager,dc=local" mech=SIMPLE ssf=0 Feb 3 10:07:35 pavfldapp01 slapd[6375]: conn=94 op=22 RESULT tag=97 err=0 text= Feb 3 10:07:35 pavfldapp01 slapd[6375]: conn=94 op=23 SRCH base="ou=SONEPAR,dc=local" scope=2 deref=0 filter="(|(uid=ralthuru)(SAMACCOUNTNAME=ralthuru))" Feb 3 10:07:35 pavfldapp01 slapd[6375]: conn=94 op=23 SRCH attr=dn Feb 3 10:07:35 pavfldapp01 slapd[6375]: conn=94 op=23 SEARCH RESULT tag=101 err=0 nentries=1 text= Feb 3 10:07:35 pavfldapp01 slapd[6375]: conn=94 op=24 BIND anonymous mech=implicit ssf=0 Feb 3 10:07:35 pavfldapp01 slapd[6375]: conn=94 op=24 BIND dn="cn=Althuru\2C Ravi,ou=Accenture,ou=Consultants,ou=SONEPAR,dc=local" method=128 Feb 3 10:07:35 pavfldapp01 slapd[6375]: conn=94 op=24 BIND dn="cn=Althuru\2C Ravi,ou=Accenture,ou=Consultants,ou=SONEPAR,dc=local" mech=SIMPLE ssf=0 Feb 3 10:07:35 pavfldapp01 slapd[6375]: conn=94 op=24 RESULT tag=97 err=0 text= SUCCESS - PRODUCTION 2.3 - login as uid=ralthuru/secret from LDAP Browser eb 3 10:44:45 pavfldapp01 slapd[4806]: conn=50825 fd=15 ACCEPT from IP=10.108.138.66:54298 (IP=0.0.0.0:389) Feb 3 10:44:45 pavfldapp01 slapd[4806]: conn=50825 op=0 BIND dn="uid=ralthuru,ou=Sonepar,ou=People,dc=inside,dc=sonepar-us,dc=com" method=128 Feb 3 10:44:45 pavfldapp01 slapd[6375]: conn=94 op=25 BIND anonymous mech=implicit ssf=0 Feb 3 10:44:45 pavfldapp01 slapd[6375]: conn=94 op=25 BIND dn="cn=Manager,dc=local" method=128 Feb 3 10:44:45 pavfldapp01 slapd[6375]: conn=94 op=25 BIND dn="cn=Manager,dc=local" mech=SIMPLE ssf=0 Feb 3 10:44:45 pavfldapp01 slapd[6375]: conn=94 op=25 RESULT tag=97 err=0 text= Feb 3 10:44:45 pavfldapp01 slapd[6375]: conn=94 op=26 SRCH base="ou=SONEPAR,dc=local" scope=2 deref=0 filter="(|(uid=ralthuru)(SAMACCOUNTNAME=ralthuru))" Feb 3 10:44:45 pavfldapp01 slapd[6375]: conn=94 op=26 SRCH attr=dn Feb 3 10:44:45 pavfldapp01 slapd[6375]: conn=94 op=26 SEARCH RESULT tag=101 err=0 nentries=1 text= Feb 3 10:44:45 pavfldapp01 slapd[6375]: conn=94 op=27 BIND anonymous mech=implicit ssf=0 Feb 3 10:44:45 pavfldapp01 slapd[6375]: conn=94 op=27 BIND dn="cn=Althuru\2C Ravi,ou=Accenture,ou=Consultants,ou=SONEPAR,dc=local" method=128 Feb 3 10:44:45 pavfldapp01 slapd[6375]: conn=94 op=27 BIND dn="cn=Althuru\2C Ravi,ou=Accenture,ou=Consultants,ou=SONEPAR,dc=local" mech=SIMPLE ssf=0 Feb 3 10:44:45 pavfldapp01 slapd[6375]: conn=94 op=27 RESULT tag=97 err=0 text= Feb 3 10:44:45 pavfldapp01 slapd[4806]: conn=50825 op=0 BIND dn="uid=ralthuru,ou=Sonepar,ou=People,dc=inside,dc=sonepar-us,dc=com" mech=SIMPLE ssf=0 Feb 3 10:44:45 pavfldapp01 slapd[4806]: conn=50825 op=0 RESULT tag=97 err=0 text= Feb 3 10:44:47 pavfldapp01 slapd[4806]: conn=50825 op=1 UNBIND SUCCESS - PRODUCTION 2.3 - LDAP Search command as uid=ralthuru/secret Feb 3 10:48:54 pavfldapp01 slapd[4806]: conn=50831 fd=15 ACCEPT from IP=10.199.204.205:44578 (IP=0.0.0.0:389) Feb 3 10:48:54 pavfldapp01 slapd[4806]: conn=50831 op=0 BIND dn="uid=ralthuru,ou=Sonepar,ou=People,dc=inside,dc=sonepar-us,dc=com" method=128 Feb 3 10:48:54 pavfldapp01 slapd[6375]: conn=94 op=28 BIND anonymous mech=implicit ssf=0 Feb 3 10:48:54 pavfldapp01 slapd[6375]: conn=94 op=28 BIND dn="cn=Manager,dc=local" method=128 Feb 3 10:48:54 pavfldapp01 slapd[6375]: conn=94 op=28 BIND dn="cn=Manager,dc=local" mech=SIMPLE ssf=0 Feb 3 10:48:54 pavfldapp01 slapd[6375]: conn=94 op=28 RESULT tag=97 err=0 text= Feb 3 10:48:54 pavfldapp01 slapd[6375]: conn=94 op=29 SRCH base="ou=SONEPAR,dc=local" scope=2 deref=0 filter="(|(uid=ralthuru)(SAMACCOUNTNAME=ralthuru))" Feb 3 10:48:54 pavfldapp01 slapd[6375]: conn=94 op=29 SRCH attr=dn Feb 3 10:48:54 pavfldapp01 slapd[6375]: conn=94 op=29 SEARCH RESULT tag=101 err=0 nentries=1 text= Feb 3 10:48:54 pavfldapp01 slapd[6375]: conn=94 op=30 BIND anonymous mech=implicit ssf=0 Feb 3 10:48:54 pavfldapp01 slapd[6375]: conn=94 op=30 BIND dn="cn=Althuru\2C Ravi,ou=Accenture,ou=Consultants,ou=SONEPAR,dc=local" method=128 Feb 3 10:48:54 pavfldapp01 slapd[6375]: conn=94 op=30 BIND dn="cn=Althuru\2C Ravi,ou=Accenture,ou=Consultants,ou=SONEPAR,dc=local" mech=SIMPLE ssf=0 Feb 3 10:48:54 pavfldapp01 slapd[6375]: conn=94 op=30 RESULT tag=97 err=0 text= Feb 3 10:48:54 pavfldapp01 slapd[4806]: conn=50831 op=0 BIND dn="uid=ralthuru,ou=Sonepar,ou=People,dc=inside,dc=sonepar-us,dc=com" mech=SIMPLE ssf=0 Feb 3 10:48:54 pavfldapp01 slapd[4806]: conn=50831 op=0 RESULT tag=97 err=0 text= Feb 3 10:48:54 pavfldapp01 slapd[4806]: conn=50831 op=1 SRCH base="dc=inside,dc=sonepar-us,dc=com" scope=2 deref=0 filter="(objectClass=*)" Feb 3 10:48:54 pavfldapp01 slapd[4806]: conn=50831 op=1 SEARCH RESULT tag=101 err=4 nentries=500 text= Feb 3 10:48:54 pavfldapp01 slapd[4806]: conn=50831 op=2 UNBIND Feb 3 10:48:54 pavfldapp01 slapd[4806]: conn=50831 fd=15 closed Here is the ldap.conf URI ldap://10.99.19.179 BASE dc=inside,dc=sdusadevl,dc=com TLS_REQCERT never Here is the slapd.conf, only the relevant info: include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/schema_extension.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/lib64/openldap loglevel 256 ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=inside,dc=sdusadevl,dc=com" rootdn "cn=Manager,dc=inside,dc=sdusadevl,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw xyz123 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index uniqueMember eq,pres # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM # adding to ignore error for slaptest cachesize 2000 sasl-host localhost sasl-secprops none ---------------------- Here is the slapd-meta.conf containing the AD where the user ralthuru is autheticating to: uri ldap://sdusa-dc-01.sdusadevl.com:3268/ou=SONEPAR,dc=local lastmod off suffixmassage "ou=SONEPAR,dc=local" "dc=sdusadevl,dc=com" idassert-bind bindmethod=simple binddn="CN=Vignette\\, Service Account,OU=Vignette Service,OU=Vignette,OU=Enterpise Systems,DC=sdusadevl,DC=com" credentials="hiddenpassword" mode=none flags=non-prescriptive idassert-authzFrom "dn.exact:cn=Manager,dc=local" I have searched across many forums, compared the set up on the OpenLDAP 2.3 and OpenLDAP 2.4 instances and cannot find any differences. Any suggestions on how to resolve this is appreciated!

4 7

Nested groups and sssd filters
by Miltos Tereres 11 Feb '16

11 Feb '16

Hello, I have a groupOfUniqueNames in my ldap (xv64ut09), which has as a uniqueMember the DN of another groupOfUniqueNames. In this last group are my user values. In my sssd configuration I use a filter like this: ldap_user_search_base = ou=people,dc=fu,dc=bar,dc=com??(&(memberOf=cn=xv64ut09,ou=groups,dc=fu,dc=bar,dc=com)(objectClass=*)) The problem is that this doesn't work if the user values are in a nested group, it only works if the users are in my main group (xv64ut09). I would guess that linux / sssd can support this type of nesting. Is there a change that needs to be done from the ldap server side, in the schema, or maybe something else that I have missed? I am using the rfc2307bis... Thanks.

4 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical