openldap-technical

openldap-technical@openldap.org

5 participants
9899 discussions

Nested groups and sssd filters
by Miltos Tereres 11 Feb '16

11 Feb '16

Hello, I have a groupOfUniqueNames in my ldap (xv64ut09), which has as a uniqueMember the DN of another groupOfUniqueNames. In this last group are my user values. In my sssd configuration I use a filter like this: ldap_user_search_base = ou=people,dc=fu,dc=bar,dc=com??(&(memberOf=cn=xv64ut09,ou=groups,dc=fu,dc=bar,dc=com)(objectClass=*)) The problem is that this doesn't work if the user values are in a nested group, it only works if the users are in my main group (xv64ut09). I would guess that linux / sssd can support this type of nesting. Is there a change that needs to be done from the ldap server side, in the schema, or maybe something else that I have missed? I am using the rfc2307bis... Thanks.

4 3

Replication between 2.4.21 and 2.4.31
by Jason J. W. Williams 11 Feb '16

11 Feb '16

Hello, For various reasons we may need to set up N-way multimaster replication between OpenLDAP 2.4.21 and 2.4.31. Do folks see problems running different patch releases in the same replication group? -J

2 1

Crash on ldap 2.4.41 on RedHat using mdb.
by ping-shin ching 11 Feb '16

11 Feb '16

Hi Folks, I upload data approx (15 million entries) using slapadd. Then start the server and run some searches. Not all searches crash- only some. I get some results before before slapd core dumps. Do I need to furnish any more information? gcc (GCC) 4.4.7 20120313 (Red Hat 4.4.7-3) Configure options... --without-cyrus-sasl \ --disable-bdb \ --disable-hdb \ --enable-ldap \ --enable-mdb \ --enable-constraint \ --enable-accesslog; \ backtrace... Core was generated by `./slapd -h ldap://:1389 -f /data/openldap24/etc/openldap/slapd.conf'. Program terminated with signal 11, Segmentation fault. #0 0x00000000004940fa in mdb_node_read (txn=0x7f9dec102b00, leaf=0x7f9e3914c736, data=0x7f9df15f6020) at ./../../../libraries/liblmdb/mdb.c:5350 5350 data->mv_size = NODEDSZ(leaf); Missing separate debuginfos, use: debuginfo-install glibc-2.12-1.166.el6_7.3.x86_64 (gdb) where #0 0x00000000004940fa in mdb_node_read (txn=0x7f9dec102b00, leaf=0x7f9e3914c736, data=0x7f9df15f6020) at ./../../../libraries/liblmdb/mdb.c:5350 #1 0x00000000004978db in mdb_cursor_set (mc=0x7f9dec104480, key=0x7f9df366c320, data=0x7f9df15f6020, op=MDB_SET, exactp=<value optimized out>) at ./../../../libraries/liblmdb/mdb.c:5787 #2 0x000000000049818a in mdb_cursor_get (mc=0x7f9dec104480, key=0x7f9df366c320, data=0x7f9df15f6020, op=<value optimized out>) at ./../../../libraries/liblmdb/mdb.c:5952 #3 0x00000000004a2c81 in mdb_waitfixup (op=0x7f9dec102570, ww=0x7f9df37fc460, mci=<value optimized out>, mcd=0x7f9dec104480, scopes=0x7f9df12f5010) at search.c:377 #4 0x00000000004a52bc in mdb_search (op=0x7f9dec102570, rs=<value optimized out>) at search.c:1114 #5 0x000000000048179e in overlay_op_walk (op=0x7f9dec102570, rs=0x7f9df37fda30, which=<value optimized out>, oi=0x214ca50, on=0x0) at backover.c:677 #6 0x0000000000482213 in over_op_func (op=0x7f9dec102570, rs=<value optimized out>, which=<value optimized out>) at backover.c:730 #7 0x000000000041f871 in fe_op_search (op=0x7f9dec102570, rs=0x7f9df37fda30) at search.c:402 #8 0x000000000042009c in do_search (op=0x7f9dec102570, rs=0x7f9df37fda30) at search.c:247 #9 0x000000000041d959 in connection_operation (ctx=0x7f9df37fdb70, arg_v=0x7f9dec102570) at connection.c:1155 #10 0x000000000041e0cd in connection_read_thread (ctx=0x7f9df37fdb70, argv=<value optimized out>) at connection.c:1291 #11 0x00000000004ef7a0 in ldap_int_thread_pool_wrapper (xpool=0x20af380) at tpool.c:696 #12 0x00000034a7c079d1 in start_thread () from /lib64/libpthread.so.0 #13 0x00000034a78e8b5d in epoll_pwait () from /lib64/libc.so.6 #14 0x0000000000000000 in ?? ()

2 2

ldap separate OU-administrator account
by Gary Spencer 10 Feb '16

10 Feb '16

Hi, I need some guidance, I have a simple DIT with users in the users OU, and a separate OU for admins. In addition to the Manager, I have created an admin2 account in the admins OU, however default permissions don't allow the admin2.admins.domain.tld to create users in the users.domain.tld OU. I also don't want admin2 to have equal permissions to Manager, I am giving that account away to our users administrator and they only need access to create/modify/delete users under the users OU (on basis of least privilege I don't want them to have full access). I am using dynamic ldap, I have already created the users and admin accounts, I just need guidance on adding the ACL's. I am a complete novice with openldap, what do I need to do to grant the correct olcAccess so that the admin2 account can create users in the users.domain.tld OU ? I'd also like a read-only admin in the admins OU that can view all details for all users under users OU ? And cream on top of the cake, I'd like to prohibit accounts in the users OU from looking at any of the rest of the LDAP objects other than self ? I think I'm right I need to modify the olcAccess access rules, but don't know how, current olcAccess rules follow:- dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb <... CUT ...> olcSuffix: dc=domain,dc=tld olcRootDN: cn=Manager,dc=domain,dc=tld olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=Manager,dc=domain,dc=tld" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=Manager,dc=domain,dc=tld" write by * read (I have tweaked the text output to replace our domain, please ignore any typos I may have inadvertently introduced) I have read the admin guides and man pages, but I can't see clearly see what ldif stanzas I need to construct ? Thanks in advance. Gary Spencer [cid:image001.jpg@01D16412.92EB2D10]<http://www.sis.tv/distribution/> Whitehall Avenue | Kingston | Milton Keynes | MK10 0AX www.sis.tv<http://www.sis.tv> ********************************************************************** Satellite Information Services Limited. Registered Office: Whitehall Avenue, Kingston, Milton Keynes, Buckinghamshire, MK10 0AX. Company No. 4243307 SIS LIVE Limited. Registered Office: Whitehall Avenue, Kingston, Milton Keynes, Buckinghamshire, MK10 0AX. Company No. 5075598 The information in this email (which includes any files transmitted with it) is confidential and is intended for the addressee only. Unauthorized recipients are required to maintain confidentiality. If you have received this email in error please notify the sender immediately, destroy any copies and delete it from your computer system. **********************************************************************

1 0

Using TLS not seeing EXTERNAL as Using TLS not seeing EXTERNAL as supported SASL mechanism
by Bill MacAllister 10 Feb '16

10 Feb '16

I am working on using TLS on an OpenLDAP server and having issues. Basically I can make a TLS connection, but I don't see EXTERNAL as one of the supportedSASLMechanisms. (slapd 2.4.41+dfsg-1ubuntu2~dbp0 built with openssl) Here is my ldapsearch: $ ldapsearch -h ldap-test-master1.corp.dropbox.com -x -ZZ -b '' -s base supportedSASLMechanisms # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: supportedSASLMechanisms # # dn: supportedSASLMechanisms: GS2-IAKERB supportedSASLMechanisms: GS2-KRB5 supportedSASLMechanisms: SCRAM-SHA-1 supportedSASLMechanisms: GSSAPI supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: CRAM-MD5 supportedSASLMechanisms: NTLM supportedSASLMechanisms: LOGIN supportedSASLMechanisms: PLAIN # search result search: 3 result: 0 Success # numResponses: 2 Here is what I see in the server log: 2016-02-09T02:40:00.797598+00:00 ldap-test-master1 slapd[22379]: conn=1008 fd=14 ACCEPT from IP=172.17.8.240:47231 (IP=0.0.0.0:389) 2016-02-09T02:40:00.797640+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=0 EXT oid=1.3.6.1.4.1.1466.20037 2016-02-09T02:40:00.797646+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=0 STARTTLS 2016-02-09T02:40:00.797686+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=0 RESULT oid= err=0 text= 2016-02-09T02:40:00.804071+00:00 ldap-test-master1 slapd[22379]: conn=1008 fd=14 TLS established tls_ssf=256 ssf=256 2016-02-09T02:40:00.804540+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=1 BIND dn="" method=128 2016-02-09T02:40:00.804590+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=1 RESULT tag=97 err=0 text= 2016-02-09T02:40:00.804931+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=2 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" 2016-02-09T02:40:00.804941+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=2 SRCH attr=supportedSASLMechanisms 2016-02-09T02:40:00.805056+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= 2016-02-09T02:40:00.805483+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=3 UNBIND 2016-02-09T02:40:00.805587+00:00 ldap-test-master1 slapd[22379]: conn=1008 fd=14 closed What should I be looking at? What am I missing? Thanks in advance, Bill

2 2

openldap 2.4.44 does not provide an slapd.d
by Mary Kao 10 Feb '16

10 Feb '16

Hello, I compiled openldap 2.4.44 on scientific linux and discovered it didn't create a slapd.d directory. There is however, a slapd.conf file. Is this right? If so, I would need to convert the slapd.conf file to slapd.d? Thanks!

2 1

Re: make posixGroup auxiliary in 2.4.40
by Chris 10 Feb '16

10 Feb '16

Michael StrÃ¶der wrote: > Chris wrote: >> I'm moving from OpenLDAP 2.2.x to 2.4.40 and have wasted hours trying to >> achieve the following: >> mailGroup (Postfix) is used as structural class, posixGroup (NIS) as auxiliary. >> Anyway. I can't add rfc2307bis schema, because NIS is already included. I've tried different methods to get rid of NIS, but they're not working. >> Is there any way to make posixGroup auxiliary? > Are you using static or dynamic configuration? > If you're using static configuration you simply omit nis.schema. I'm using dynamic configuration (Debian Jessie). > Note that rfc2307bis.schema requires a migration from old posixGroup entries > because the membership attribute also changes. They have already used rfc2307bis with static configuration and commented NIS out. They didn't use NIS, my bad. Nevertheless NIS is "included" in dynamic configuration. NIS and rfc2307 are mutually exclusive. The issue eased, since I can do without the rfc2307bis attributes, essentially posixGroup and gidNumber. Nevertheless, is there a way to use rfc2307bis with dynamic configuration? Should one switch to static config. in this case? - Chris

2 1

rebuilding the DIT
by Timothy Keith 09 Feb '16

09 Feb '16

How can I recreate the DIT using the output from slapcat ? I want to change the suffix when I do this. First, I ran slapcat: slapcat -v -l slapcat_backup.ldif Or just point me to the appropriate documentation. Tim

3 2

Authenticating mac users on ldap
by robert k Wild 09 Feb '16

09 Feb '16

Hi all, I want to know or if anyone has done it, i want to be able to login via my ldap user on a mac I know it works on linux as i have been able to login via ldap on my centos machine Also i have mounted my ldap server, (where all the home shares are) via autofs How can i get this to work Many thanks Rob

1 0

BINDDN in ~/.ldaprc ignored(?)
by Frank Thommen 09 Feb '16

09 Feb '16

Hi, BINDDN in ~/.ldaprc seems to be ignored or I'm doing something wrong. /etc/openldap/ldap.conf is empty. ~/.ldaprc is: $ cat ~/.ldaprc BINDDN <myBindDN> BASE <myBaseDN> URI ldaps://<myLDAPServer> TLS_REQCERT never $ ldapsearch returns an error if I don't declare the bindDN on the commandline: $ ldapsearch -W -v cn=xyz ldap_initialize( <DEFAULT> ) Enter LDAP Password: SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (No Kerberos credentials available) $ Using strace I can see, that ~/.ldaprc is accessed by ldapsearch. So either BINDDN is ignored or I am doing something wrong. but works happily with the bindDN on the commandline: $ ldapsearch -D <myBindDN> -W -v cn=xyz ldap_initialize( <DEFAULT> ) Enter LDAP Password: [... ldapsearch results ...] $ Using strace I can see, that ~/.ldaprc is accessed by ldapsearch. So either BINDDN is ignored or I am doing something wrong. This is with openSUSE 13.1 and ldapsearch 2.4.33. Cheers Frank

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical