openldap-technical

openldap-technical@openldap.org

5 participants
9899 discussions

Fwd: openldap.org mailing list memberships reminder
by Phill Edwards 02 Feb '16

02 Feb '16

I received this today and was shocked to see my password in the email. In this day and age a technology group like this should know far better than to do that. It's bad enough you keep unencrypted passwords, but then to send them our in an email is reckless and irresponsible. Regards, Phill Edwards ---------- Forwarded message ---------- From: <mailman-owner(a)openldap.org> Date: 1 Feb 2016 4:24 PM Subject: openldap.org mailing list memberships reminder To: <philledwards(a)gmail.com> Cc: > This is a reminder, sent out once a month, about your openldap.org > mailing list memberships. It includes your subscription info and how > to use it to change it or unsubscribe from a list. > > You can visit the URLs to change your membership status or > configuration, including unsubscribing, setting digest-style delivery > or disabling delivery altogether (e.g., for a vacation), and so on. > > In addition to the URL interfaces, you can also use email to make such > changes. For more info, send a message to the '-request' address of > the list (for example, mailman-request(a)openldap.org) containing just > the word 'help' in the message body, and an email message will be sent > to you with instructions. > > If you have questions, problems, comments, etc, send them to > mailman-owner(a)openldap.org. Thanks! > > Passwords for philledwards(a)gmail.com: > > List Password // URL > ---- -------- > openldap-technical(a)openldap.org <removed> > http://www.openldap.org/lists/mm/options/openldap-technical/philledwards%40…

4 3

openldap on scientific linux
by Mary Kao 01 Feb '16

01 Feb '16

Hello, I am setting up Openldap on scientific linux version 6.7. Is it better to use the install packages e.g. yum install openldap-servers openldap-clients or to download the openldap source, and compile on my system? Thank you.

2 1

Re: Removing olcAccess entry
by Katherine Faella 01 Feb '16

01 Feb '16

On Tue, Jan 12, 2016 at 2:47 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, January 12, 2016 2:38 PM -0500 Katherine Faella <kmf(a)uri.edu> > wrote: > > Which is where I am having trouble. I believe that deleting the {0} >> element should keep the {1} and move it up to the correct position. >> > > I do this extensively, and it works fine. What OpenLDAP release are you > on? > > --Quanah > > > I was afraid you were going to ask that. We are running the Redhat 6 supported 2.4.40-7.el6_7. We have a policy here of sticking with the redhat supported releases of packages since our staff is so small. I really need to resolve this for an important project here. Of course the project is behind schedule and I am left with little time to get my stuff working. I was hoping my syntax was just incorrect. The only other way I can image fixing this is to revert to slapd.conf .... I guess the good news is that my steps and syntax look okay to you. If you have any other thoughts I would happily accept them. Thanks, Kathy -- Katherine Faella tel: (401) 874-4469 Senior Technical Programmer kmf(a)uri.edu University of Rhode Island University Computing Systems(UCS) 210 Flagg Road Kingston, Rhode Island

2 2

Re: [OpenLDAP][Authentication] SASL
by Timothy Keith 01 Feb '16

01 Feb '16

My scenario is relatively simple. The user authentication and LDAP directory for our local application is managed on corporate servers for which we lack administrative rights. We wish to maintain a local view of the LDAP directory for the information that our local application requires, but not alter the user authentication on the corporate servers. Tim On Thu, Jan 21, 2016 at 6:21 PM, Sergio NNX <sfhacker(a)hotmail.com> wrote: >> I am new at LDAP , that is obvious I guess. But, I've been around Unix >> for 30 years. > > Are we still having issues? We might be able to assist you if you describe > your set up and your goal in more detail. > > Cheers, > > Ser. > >> Date: Thu, 21 Jan 2016 14:31:28 -0600 >> From: dwhite(a)cafedemocracy.org >> To: timothy.g.keith(a)gmail.com >> Subject: Re: pass-through authentication >> CC: dwhite(a)cafedemocracy.org; openldap-technical(a)openldap.org >> >> You can view your config with: >> >> slapcat -n0 >> >> And verify that object exists. >> >> If you're receiving this error due to an ACL problem, verify you >> have the proper configuration in place to authenticate as the rootdn using >> sasl/external. See the slapd-config manpage, and see section 15.2 (and in >> particular 15.2.5) of the Administrator's guide, and reference your >> OS/distro documentation. >> >> On 01/21/16 12:35 -0600, Timothy Keith wrote: >> >I commented the mech_list in slapd.conf >> > >> >The ldapsearch result is now No such object >> > >> >ldapsearch -LLLQY EXTERNAL -H ldapi:/// -b cn=config >> >"(|(cn=config)(olcDatabase={1}hdb))" >> >No such object (32) >> > >> >On Fri, Jan 8, 2016 at 2:34 PM, Dan White <dwhite(a)cafedemocracy.org> >> > wrote: >> >> On 01/07/16 17:24 -0600, Timothy Keith wrote: >> >>> >> >>> ldapsearch -LLLQY EXTERNAL -H ldapi:/// -b cn=config >> >>> "(|(cn=config)(olcDatabase={1}hdb))" >> >>> ldap_sasl_interactive_bind_s: Authentication method not supported (7) >> >>> additional info: SASL(-4): no mechanism available: >> >> >> >> >> >> I'm missing some context here. Most likely you have a mech_list hard >> >> coded >> >> in your slapd.conf sasl, which does not include the external mech. >>

2 1

openldap and slapd.conf file
by Mary Kao 29 Jan '16

29 Jan '16

Hello, I've seen information indicating that slapd.conf is no longer in use in OpenLDAP, however the release 2.4.xx comes with a slapd.conf. Can someone please clarify what this file is used for in release 2.4.xx? Would be greatly appreciated. Thank you!

2 1

Lastbind
by Lindolfo Meira 29 Jan '16

29 Jan '16

I noticed the lastbind module won't log public key authentications. Is this the expected behavior? I'm using OpenLDAP 2.4.33. Cheers, L. Meira.

2 1

ldap client login
by Lane 29 Jan '16

29 Jan '16

I'm trying to log into an LDAP client. Below I show a login from the ldap server to the ldap client, and another from a normal workstation on the same subnet to the ldap client. The workstation is able to login, but am not able to login from the ldap server. server: OpenLDAP 2.4.43 clients: nss-pam-ldapd 0.9.6 Any help much appreciated. --- from ldap server to ldap client (fails) $ ssh -l james 10.0.1.2 Enter passphrase for key '/home/james/.ssh/id_rsa': You are required to change your password immediately (root enforced) WARNING: Your password has expired. You must change your password now and login again! New password: Retype new password: password change failed: Server is unwilling to perform passwd: password updated successfully Connection to 10.0.1.2 closed. --- from worstation to ldap client (succeeds) $ ssh node-2 Password: You are required to change your password immediately (root enforced) need a new password New password: Retype new password: password change failed: Insufficient access node-2(james):~$ $ ldapsearch -x -b 'dc=my,dc=example,dc=com' '(objectclass=*)' # extended LDIF # # LDAPv3 # base <dc=my,dc=example,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # my.example.com dn: dc=my,dc=example,dc=com dc: cem objectClass: dcObject objectClass: organization o: CEM # manager, my.example.com dn: cn=manager,dc=my,dc=example,dc=com objectClass: organizationalRole cn: Manager description: LDAP Admin # groups, my.example.com dn: ou=groups,dc=my,dc=example,dc=com ou: groups description: Groups objectClass: organizationalUnit # users, my.example.com dn: ou=users,dc=my,dc=example,dc=com ou: users description: Users objectClass: organizationalUnit # james, groups, my.example.com dn: cn=james,ou=groups,dc=my,dc=example,dc=com cn: james objectClass: top objectClass: posixGroup gidNumber: 1000 # james, users, my.example.com dn: uid=james,ou=users,dc=my,dc=example,dc=com cn: James uid: james uidNumber: 1000 gidNumber: 1000 sn: James homeDirectory: /home/james mail: james(a)example.com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount loginShell: /bin/bash gecos: james shadowLastChange: 0 userPassword:: e1NTSEF9ZjhRMGwwaDk1ek9mMUViaDhreDNlUEsvdFhFb29wV3I= shadowMax: 9999 shadowWarning: 14 # search result search: 2 result: 0 Success # numResponses: 7 # numEntries: 6 /etc/pam.d/system-auth --- auth required pam_env.so auth sufficient pam_unix.so try_first_pass likeauth nullok auth sufficient pam_ldap.so use_first_pass auth required pam_deny.so account required pam_unix.so account [default=bad success=ok user_unknown=ignore] pam_ldap.so account optional pam_permit.so password required pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3 password sufficient pam_unix.so try_first_pass use_authtok nullok sha512 shadow password sufficient pam_ldap.so use_authtok use_first_pass password optional pam_permit.so session required pam_limits.so session required pam_env.so session optional pam_ldap.so session required pam_unix.so session optional pam_permit.so

1 0

OCSP for LDAP Client
by Jason Talley 29 Jan '16

29 Jan '16

I've been asked to enable OCSP checking in our client (connecting to any LDAP server) . The client uses OpenLdap api's for managing the connection to the server. From my recent birth-by-fire education on certs and security, OCSP checking appears more or less to be a manual process rather than having OpenSSL do all the work auto-magically as part of the handshake (ignoring ocsp stapling which I'm avoiding). I don't see any options in openssl s_client (for testing) to enable OCSP -- only a separate utility to manually check based on captured client certs. Storing the CRL in the LDAP DB isn't an option. For whatever reason, OCSP is required. Is there any way to enable OCSP checking via the current LDAP API? Assuming the answer is no, then would a reasonable approach be to manually query the server URL from time to time, and verify the certificate in the background? Traffic from our client should be relatively minimal, so even at a rate of one verification an hour should have a minimal risk window of the cert being expired. Using this method I can more or less follow the same logic as the openssl utilities (s_client and ocsp). TIA.

3 2

simple question
by Aleksandar Karalejić 28 Jan '16

28 Jan '16

Hi OpenLDAP team, I have a question, simple I hope, for you - I need to send client certificate to the server openldap server (by using openldap api and openSSL). For completing this job, first I initalized ldap with url containing ldaps in the url scheme (ldaps://fqdn_of_ldap_server:636). I have set LDAP_OPT_PROTOCOL_VERSION -> LDAP_VERSION3 LDAP_OPT_X_TLS_PROTOCOL_MIN -> LDAP_OPT_X_TLS_PROTOCOL_TLS1_2 LDAP_OPT_X_TLS_REQUIRE_CERT -> LDAP_OPT_X_TLS_DEMAND LDAP_OPT_X_TLS_CONNECT_ARG -> fqdn_of_ldap_server LDAP_OPT_X_TLS_CONNECT_CB -> my_tsl_verify_callback and then I called ldap_sasl_bind: ldap_sasl_bind(mLdapObj, NULL, "EXTERNAL", NULL, NULL, NULL, &msgid); What I saw is that certficate from the server was received, but how to send client certifikate. I played arround with LDAP_OPT_X_TLS_CERTFILE (sending the abs path to the .pem file) but nothing. Also, I saw that this parameter was not taken into account - it looks like ssl_ctx object used for ssl_connect does not include path to the file (like two global structures used for setting up ctx know nothing about each other.) Can you, help me with this? Regards, Aleksandar

2 4

OpenLdap + Cyrus SASL + MIT Kerberos credentials cache
by Petar Kovačević 28 Jan '16

28 Jan '16

Hi All, I'm working on Windows application that uses libldap built with cyrus sasl and MIT Kerberos and I'm having issues with Kerberos authentication on AD. I have tested with various applications and Kerberos is working properly on server. In my app I'm using ldap_sasl_interactive_bind_s(mLdapObj, NULL, "GSSAPI", NULL, NULL, LDAP_SASL_INTERACTIVE, my_ldap_sasl_interact, defaults) in order to bind with server, but I get error -2 (Local error). I have debugged the app and I have found that there is an issue with Keberos Credentials Cache. Because I haven't set credentials cache location, Kerberos reads this location from KRB5CCNAME environment variable. So my first question is : Is there any API in libldap, so we can set our own contact cache location? But even when I set this variable, I get same error when I try to bind. After some more debugging I found that Kerberos expects that I already have credentials cache file created, and that there is a ticket in it(as a I have called kinit before bind). Is there an API in libldap, that will call Kerberos API for credentials cache and ticket obtaining operations, which we can call before bind, or we need to call Kerberos API directly ? Thank you for your help. Best Regards, Petar Kovacevic

2 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical