openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

users don't get prompt to change password (pwdMustChange attribute)
by Rajagopal Rc 24 Dec '15

24 Dec '15

Hello, I am trying to force user to change their password at first logon and on password reset. OS RHEL7 Openldap version 2.4.39-7.el7_1.x86_64 I have tried the following 1) I have set the pwdMustChange attribute to TRUE in ppolicy, but when user logon to client at first time or after resetting password, it just allow suer to logon without prompting to change the password, 2) I have set the pwdReset attribute to TRUE in user attribute for particular user, this doesn't allow user to login at all and keep prompting for password without allowing to login. Also i red in blogs this is not correct way, but couldn't find more information on this. is there any way to force users to change their password at first logon and after resetting password by admin. ? Current ppolicy Thanks & Regards Raj =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

1 0

Issue while changing user password by self
by Rajagopal Rc 24 Dec '15

24 Dec '15

Hello, I am trying to allow users to change their own passwords OS RHEL7 Openldap version 2.4.39-7.el7_1.x86_64 ACL in slapd.conf disallow bind_anon access to attrs=userPassword by self write by dn.base="cn=mirrormode,dc=rnd,dc=com" read by dn.base="cn=binduser,dc=rnd,dc=com" read by * auth access to * by dn.base="cn=mirrormode,dc=rnd,dc=com" read by dn.base="cn=binduser,dc=rnd,dc=com" read by * break access to * by dn="cn=Manager,dc=rnd,dc=com" by users read by self write by * auth from client machine 'user5' is trying to change own password and getting following error $ ldappasswd -H ldaps://ldapdev.rnd.com:636 -x -D "cn=user 5,ou=people,dc=rnd,dc=com" -W -A -S Old password: Re-enter old password: New password: Re-enter new password: Enter LDAP Password: Result: Insufficient access (50) Additional info: User alteration of password is not allowed This error looks like issue with permissions, yet i have already allowed access to attrs=userPassword by self write in slapd.conf, please let me know if there is any thing wrong in above ACL and why i am getting this error Thanks & Regards Raj =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

4 6

Segmentation fault (core dumped) on ldapmodify
by Tim Dunphy 24 Dec '15

24 Dec '15

Hey guys, I have these options set for SSL in my cn=config setup: [root@ldap1:~] #ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config|grep ssl SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 olcTLSCACertificateFile: /etc/ssl/certs/ldap-ca-cert.pem olcTLSCertificateFile: /etc/ssl/certs/ldap-server.crt olcTLSCertificateKeyFile: /etc/ssl/certs/ldap-server.key And I want to change the settings to the contents of this ldif file: [root@ldap1:~] #cat addcerts.ldif dn: cn=config changetype: modify add: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/pki/CA/certs/ca.crt - add: olcTLSCertificateFile olcTLSCertificateFile: /etc/ldap/ssl/ldap1.example.com.crt - add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ldap/ssl/ldap1.example.com.key But when I try to do that I get an error: [root@ldap1:~] #ldapmodify -H ldapi:// -Y EXTERNAL -f addcerts.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 Segmentation fault (core dumped) I wonder if I could be running low on memory: [root@ldap1:~] #free -m total used free shared buffers cached Mem: 992 815 177 10 140 445 -/+ buffers/cache: 229 762 Swap: 0 0 0 Could this be causing the error? How can I make this change without encountering the segmentation fault? Thanks, Tim -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

3 4

pwdChangedTime Undefined Attribute
by Borresen, John - 0444 - MITLL 24 Dec '15

24 Dec '15

All, The "ppolicy" overlay has been loaded to my bdb. The cn=default,ou=pwpolicies,dc=group,dc=ldap has been defined. The pwdPolicySubentry operational attribute was added to uid=jdoe,ou=Users,dc=group,dc=ldap, as well. Now, trying to add the pwdChangedTime attribute to the jdoe UID. Ran "ldapadd" from the command-line: # ldapmodify -d 4 -x -W -H ldap://ldapsrvr.group.ldap -D cn=ldapadmin,dc=group,dc=ldap Enter LDAP Password: ############ dn: uid=jdoe,ou=Users,dc=group,dc=ldap changetype: add add: pwdChangedTime pwdChangedTime: 201512231458Z adding new entry "uid=jdoe,ou=Users,dc=group,dc=ldap" ldap_add: Undefined attribute type (17) additional info: add: attribute type undefined >From my reading, this should be an Operational Attribute that isn't constrained or defined by an ObjectClass. Thanks for the help in advance. Btw, I am running OpenLDAP 2.4.40. John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Humanitarian Assistance and Disaster Relief (HADR) Systems 244 Wood St Lexington, MA 02420 Email: <mailto:john.borresen@ll.mit.edu> john.borresen(a)ll.mit.edu

2 4

LMDB many dup fixed size elements
by Simon Majou 23 Dec '15

23 Dec '15

Hello, I want to allow users to create tables with dup fixed size. A solution would be to create named databases, but that would make potentially a lot of tables (for instance millions), and doesn't seem ok cf the comment on function mdb_env_set_maxdbs. Another solution would be to create one DB for each fixed size and insert the users and their tables inside. Would it be better ? -- Best regards, Simon

1 0

openldap newbie - olcAccess ACL configuration
by Gary Spencer 23 Dec '15

23 Dec '15

Hi, I have deployed a new OpenLDAP server (RHEL 7.1 / openldap-2.4) and have read Matt Butcher's 'Mastering ...' book and the OpenLDAP-Admin-Guide but I'm continuing to struggle to find the information I need to satisfactorily configure using the dynamic way of working instead of using the legacy slapd.conf method. (Any reference to administering ldap using dynamic method would be appreciated) I have OpenLDAP basically configured to answer queries using the Manager object, but I want to remove current privileges and have just two accounts in the system ou - one with read only to the users ou and all objects therein, and one with the equivalent of Manager rights to the users OU that I can give to my devs to create their own users. I would retain the Manager account for full access, but would just like to give out the readonly and readwrite accounts in system OU permissions to users OU, and remove users permissions to anything but themselves. My intention is to delete the existing olcAccess rules and implement a new set, but I can't get rid of the old rules as it's not letting me. When I try 'ldapmodify -x -W -H "ldap://HOSTNAME" -D "cn=Manager,dc=SUBDOMAIN,dc=DOMAIN,dc=TLD" -f acl_delete_file.ldif' I receive :- 'modifying entry "olcDatabase={2}hdb,cn=config" ldap_modify: Insufficient access (50)' The delete ldif looks like this :- # {2}hdb, config dn: olcDatabase={2}hdb,cn=config delete: olcAccess I am using the default hdb database. I understood 'Manager' had full access to everything regardless, can anyone shed any light on why this request would be refused ? Gary Spencer Infrastructure Project Engineer [http://www.sis.tv/contentAsset/raw-data/369d823c-5153-4089-a9b6-4d868930a68…]<http://www.sis.tv/contact/streaming-from-sis.html> ********************************************************************** Satellite Information Services Limited. Registered Office: Whitehall Avenue, Kingston, Milton Keynes, Buckinghamshire, MK10 0AX. Company No. 4243307 The information in this email (which includes any files transmitted with it) is confidential and is intended for the addressee only. Unauthorized recipients are required to maintain confidentiality. If you have received this email in error please notify the sender immediately, destroy any copies and delete it from your computer system. **********************************************************************

2 1

Server Side Searching Overlay
by Michael 23 Dec '15

23 Dec '15

So I have a request from developers to enable the sssvlv overlay. They would like the server to return sorted searches on I enabled the overlay and then to test the functionality I added the following "ordering" rule to the core.schema. attributetype ( 2.5.4.4 NAME ( 'sn' 'surname' ) DESC 'RFC2256: last (family) name(s) for which the entity is known by' ORDERING caseIgnoreOrderingMatch SUP name ) The following ldapsearch works as expected and returns the "sn" attribute in alphabetical order. ldapsearch -x -ZZ -D cn=root,dc=testlott,dc=lott -w password objectclass=person -E sss=sn sn Based on this information I have several questions. 1. Will I be violating any RFC by modifying the core.schema?2. The developers want the same functionality with the "cn" attribute. Is this supported or even possible?3. They also request this functionality on a couple of attributes in a custom schema. Is adding an "ordering" rule as I did with the "sn" attribute the proper way to do this? Thanks.

3 8

access log or last bind overlay working with bind_anon?
by Tan, Eric 22 Dec '15

22 Dec '15

Hello, I have been doing a lot of research into OpenLDAP and it’s functionalities.. While I have set up a few OpenLDAP servers before, there are many facets of the software I am unfamiliar with. Recently, I was asked to find a way to obtain a list of users and their last login for auditing reasons (We need to disable the users after a certain amount of time of inactivity) I have looked into a few different solutions but have been unable to reach anyone with enough knowledge for some reason so here is an email with some hope as to get some information to point me in the right direction. I think there are two things that may work for my purposes.. The last bind overlay or the access log overlay. For the Lastbind overlay, since we are using anonymous bind, do you know if this will still work for us? For the access log, how would I pull this specific information out of the database? According to the man pages: logops <operations> Specify which types of operations to log. The valid operation types are abandon, add, bind, compare, delete, extended, modify, modrdn, search, and unbind. Aliases for common sets of operations are also available: writes add, delete, modify, modrdn reads compare, search Session Would this work if are using anonymous binding as well? Any help would be greatly appreciated! -Eric

1 0

Bug in last LMDB GitHub commit (Windows + VL32)
by Jeremiah Morrill 22 Dec '15

22 Dec '15

Pretty excited about the 32bit support! I was just kicking the tires on it today and I realize this is still a work in progress, but I wanted to report a possible bug with VL32/Windows. When I open a database with MDB_RDONLY and seek a cursor to MDB_LAST, I get a system error code of 0xc000004e (STATUS_SECTION_PROTECTION) from NtMapViewOfSection. This is presumably because of the MEM_RESERVE_FLAG is present on the open of the db when MDB_RDONLY is used. After patching up the NtMapViewOfSection, I get a 0xc000001f(STATUS_INVALID_VIEW_SIZE) from NtMapViewOfSection. I believe this happens because it is requesting a view that goes beyond the size of the db. A quick adjustment on the “len” being requested seems to have “fixed” it. I have included a diff patch below. I realize this is a naïve hack, but hoped it could be useful in reproducing and fixing. -Jer diff --git a/src/lmdb/mdb.c b/src/lmdb/mdb.c index 297d3e3..d594a6f 100644 --- a/src/lmdb/mdb.c +++ b/src/lmdb/mdb.c @@ -5655,7 +5655,7 @@ mdb_rpage_get(MDB_txn *txn, pgno_t pg0, MDB_page **ret) #define MAP(rc,env,addr,len,off) \ addr = NULL; \ rc = NtMapViewOfSection(env->me_fmh, GetCurrentProcess(), &addr, 0, \ - len, &off, &len, ViewUnmap, MEM_RESERVE, PAGE_READONLY) + len, &off, &len, ViewUnmap, ((env->me_flags & MDB_RDONLY) == 0) ? MEM_RESERVE : 0, PAGE_READONLY) #else off_t off; size_t len; @@ -5835,6 +5835,14 @@ retry: } } SET_OFF(off, pgno * env->me_psize); + +#ifdef MDB_VL32 + if(off.QuadPart + len > env->me_mapsize) + { + len = env->me_mapsize - off.QuadPart; + } +#endif + MAP(rc, env, id3.mptr, len, off); if (rc) { fail:

2 1

Re: pass-through authentication
by Chuck Theobald 22 Dec '15

22 Dec '15

Sounds like a SASL2 pass-through solution could work, esp. if you can get an account there with query capabilities. I will look for some references that could get you started. Chuck Sent from my Verizon Wireless 4G LTE DROID Timothy Keith <timothy.g.keith(a)gmail.com> wrote: >We have limited access to the servers. Same company, different IT organization. Our LDAP requirement must be transparent to those servers. We want to inherit the LDAP directory information from the Unix servers - mostly the user Id and passwords, and add information that is needed by applications that our servers will manage. > > >Tim > > >On Fri, Dec 18, 2015 at 4:01 PM, Chuck Theobald <chuckt(a)uoregon.edu> wrote: > >Details of your authn server would be helpful. Do you have access to the admins of that server? Are they cooperative? > >I tried to set this up using SASL to communicate with the campus Active Directory. Reliability is a bit suspect, it will typically take 3-4 attempts to get a successful authentication. Also, the setup requires an account on AD that is capable of making queries. The particulars of our installation force me to use my own - not ideal. > >Anyway, your situation may vary, so send us some details on what you are trying to talk to for autn. > >Chuck > > > > >On 12/17/2015 04:32 PM, Timothy Keith wrote: > >We are attempting to set up an LDAP server which will answer queries >from an application. The database will contain metadata on a set of >users in the application. The application will also query the server >to authenticate the user’s password, however, this server will not >house the password. That resides on another server, which our server >will query. We do not have administrative rights to the other >server. > > The difficulty we are having now is setting up the pass-through >authentication for the passwords. Any pointers in how to proceed with >this would be greatly appreciated. > >Regards, > >Tim > > > >-- >Chuck Theobald >System Administrator >The Robert and Beverly Lewis Center for Neuroimaging >University of Oregon >P: 541-346-0343 >F: 541-346-0345 > > >

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical