openldap-technical

openldap-technical@openldap.org

5 participants
9899 discussions

Re: [OpenLDAP][Authentication] SASL
by Timothy Keith 28 Jan '16

28 Jan '16

I don't yet have access to the corporate LDAP service on the production Unix servers. To serve that purpose for testing I am using Apache Directory server on Windows. The test example I'm using is for Active Directory, but I think the pass-through tutorial ought to work basically the same for evaluation purposes. Tim

1 0

Re: acl bug?
by BÖSCH Christian 27 Jan '16

27 Jan '16

> On 26 Jan 2016, at 14:34 , julien soula <julien.soula(a)univ-lille2.fr> wrote: > > On Tue, Jan 26, 2016 at 11:43:59AM +0000, BÖSCH Christian wrote: >> >> Jan 26 12:35:46 openldap1 slapd[84283]: => mdb_entry_get: found entry: "uid=user1,ou=people,o=abc.net" >> Jan 26 12:35:46 openldap1 slapd[84283]: => mdb_entry_get: found entry: "cn=group,ou=groups,o=abc.net" > > are you sure that "uid=user1,ou=people,o=abc.net" is a member of > "cn=group,ou=groups,o=abc.net” ? yes i am. to me it seems that filter= following with attrs= (tested with several filters and attributes) does not work. if i omit attrs= it works to hide the whole entry. if i use a dn instead of filter i can use the attrs= to hide a single attribute. christian > > cdt, > -- > Julien > << Vous n'avez rien a dire... Parlons-en! >>

2 3

Problems with log entries order
by Dario Zanzico 27 Jan '16

27 Jan '16

Writing a script for parsing openldap logs I found that, for some of my connections, the BIND log entry precedes the corresponding ACCEPT entry (which as far as i understand must logically precede the BIND) example: 2016-01-25T12:54:02.131094+01:00 HOSTNAME slapd[15258]: conn=91596 op=0 BIND dn="" method=128 2016-01-25T12:54:02.131099+01:00 HOSTNAME slapd[15258]: conn=91596 op=0 RESULT tag=97 err=0 text= 2016-01-25T12:54:02.131103+01:00 HOSTNAME slapd[15258]: conn=91596 fd=93 ACCEPT from [CUT] slapd is started with the '-l local4' parameter, and rsyslogd is configured to send local4.* to the openldap.log file suspecting some rsyslogd problems i tried running slapd using the "-d 256" parameter, but in the output i found 56a6202b conn=1004 op=0 BIND dn="" method=128 56a6202b conn=1004 op=0 RESULT tag=97 err=0 text= 56a6202b conn=1004 fd=13 ACCEPT from [CUT] Is there any way to guarantee openldap to generate ordered logs? thanks, dario

2 2

Updating Symas LMDB page to add Nim Binding?
by Paul Jackson 26 Jan '16

26 Jan '16

Hi, How would I go about, or to whom would I suggest, adding Nim to the list of languages with LMDB wrappers to the page http://symas.com/mdb/. There is a Nim wrapper for LMDB at https://github.com/fowlmouth/lmdb.nim (Caveat: I cannot vouch for the quality of this wrapper, being new to both Nim and LMDB.) Thanks. -- Paul Jackson pj(a)usa.net

2 1

acl bug?
by BÖSCH Christian 26 Jan '16

26 Jan '16

hi, i’m using this acl: {0}to filter=(objectclass=person) attrs=Hidden by group.exact=“cn=group,ou=groups,o=abc.net” none but members of the group can still access the attribute Hidden. with any filter it does not work. if i use a single dn it works. seems to me filters do not work? chris

2 3

missing init script
by Chuck Theobald 26 Jan '16

26 Jan '16

I'm building OpenLDAP version 2.4.40 from source but am unable to locate the init script. It does not install with 'make install'. Should this script be part of the source distribution? Thanks, -- Chuck Theobald System Administrator The Robert and Beverly Lewis Center for Neuroimaging University of Oregon P: 541-346-0343 F: 541-346-0345

5 5

Re: Problems with log entries order
by Dario Zanzico 25 Jan '16

25 Jan '16

On Mon, Jan 25, 2016, at 03:16 PM, Леонид Юрьев wrote: > In general it is impossible, but only if build slapd without > multithreading. You mean an instance built with --without-threads? > On the other hand, you can try ReOpenLDAP fork - it adds thread-id > prefix for each log-record. > Therefore is possible to filter/split syslog per thread-id, e.g. get > an ordered log for the each slapd-thread. I'll keep this in mind, thanks again > Leonid. dario

1 0

problems with acl
by BÖSCH Christian 25 Jan '16

25 Jan '16

Hi, I want to hide an attribute to members of a group by each other but allowing these members to see this attribute of all other users. So I use this ACLs: olcAccess: {0}to filter=(memberof=cn=group,ou=special,o=abc.net) attrs=PrivateAttr by group.exact="cn=group,ou=special,o=abc.net" none by * break olcAccess: {1}to attrs=PrivateAttr by group.exact="cn=group,ou=special,o=abc.net" ssf=128 read olcAccess: {2}to attrs=userPassword by self write by anonymous auth by * none olcAccess: {3}to * by * read uid=user1,ou=people,o=abc.net <http://abc.net/> and uid=user2,ou=people,o=abc.net <http://abc.net/> are both members of cn=group,ou=special,o=abc.net <http://abc.net/> and the memberOf overlay seems to work also the filter in acl#0: dn: uid=user1,ou=people,o=abc.net memberOf: cn=group,ou=special,o=abc.net dn: uid=user2,ou=people,o=abc.net memberOf: cn=group,ou=special,o=abc.net but if user2 searches for PrivateAttr of user1 it gets the attribute. can anyone give me a hint what’s wrong? many thanks, christian here the log: Jan 25 09:16:56 openldap1 slapd[58851]: => mdb_entry_get: found entry: "uid=user2,ou=people,o=abc.net" Jan 25 09:16:56 openldap1 slapd[58851]: => access_allowed: search access to "o=abc.net" "entry" requested Jan 25 09:16:56 openldap1 slapd[58851]: => acl_get: [4] attr entry Jan 25 09:16:56 openldap1 slapd[58851]: => acl_mask: access to entry "o=abc.net", attr "entry" requested Jan 25 09:16:56 openldap1 slapd[58851]: => acl_mask: to all values by "uid=user2,ou=people,o=abc.net", (=0) Jan 25 09:16:56 openldap1 slapd[58851]: <= check a_dn_pat: * Jan 25 09:16:56 openldap1 slapd[58851]: <= acl_mask: [1] applying read(=rscxd) (stop) Jan 25 09:16:56 openldap1 slapd[58851]: <= acl_mask: [1] mask: read(=rscxd) Jan 25 09:16:56 openldap1 slapd[58851]: => slap_access_allowed: search access granted by read(=rscxd) Jan 25 09:16:56 openldap1 slapd[58851]: => access_allowed: search access granted by read(=rscxd) Jan 25 09:16:56 openldap1 slapd[58851]: => access_allowed: search access to "uid=user1,ou=people,o=abc.net" "uid" requested Jan 25 09:16:56 openldap1 slapd[58851]: => acl_get: [4] attr uid Jan 25 09:16:56 openldap1 slapd[58851]: => acl_mask: access to entry "uid=user1,ou=people,o=abc.net", attr "uid" requested Jan 25 09:16:56 openldap1 slapd[58851]: => acl_mask: to value by "uid=user2,ou=people,o=abc.net", (=0) Jan 25 09:16:56 openldap1 slapd[58851]: <= check a_dn_pat: * Jan 25 09:16:56 openldap1 slapd[58851]: <= acl_mask: [1] applying read(=rscxd) (stop) Jan 25 09:16:56 openldap1 slapd[58851]: <= acl_mask: [1] mask: read(=rscxd) Jan 25 09:16:56 openldap1 slapd[58851]: => slap_access_allowed: search access granted by read(=rscxd) Jan 25 09:16:56 openldap1 slapd[58851]: => access_allowed: search access granted by read(=rscxd) Jan 25 09:16:56 openldap1 slapd[58851]: => access_allowed: read access to "uid=user1,ou=people,o=abc.net" "entry" requested Jan 25 09:16:56 openldap1 slapd[58851]: => acl_get: [4] attr entry Jan 25 09:16:56 openldap1 slapd[58851]: => acl_mask: access to entry "uid=user1,ou=people,o=abc.net", attr "entry" requested Jan 25 09:16:56 openldap1 slapd[58851]: => acl_mask: to all values by "uid=user2,ou=people,o=abc.net", (=0) Jan 25 09:16:56 openldap1 slapd[58851]: <= check a_dn_pat: * Jan 25 09:16:56 openldap1 slapd[58851]: <= acl_mask: [1] applying read(=rscxd) (stop) Jan 25 09:16:56 openldap1 slapd[58851]: <= acl_mask: [1] mask: read(=rscxd) Jan 25 09:16:56 openldap1 slapd[58851]: => slap_access_allowed: read access granted by read(=rscxd) Jan 25 09:16:56 openldap1 slapd[58851]: => access_allowed: read access granted by read(=rscxd) Jan 25 09:16:56 openldap1 slapd[58851]: => access_allowed: result not in cache (PrivateAttr) Jan 25 09:16:56 openldap1 slapd[58851]: => access_allowed: read access to "uid=user1,ou=people,o=abc.net" "PrivateAttr" requested Jan 25 09:16:56 openldap1 slapd[58851]: => access_allowed: search access to "uid=user1,ou=people,o=abc.net" "memberOf" requested Jan 25 09:16:56 openldap1 slapd[58851]: => acl_get: [2] attr PrivateAttr Jan 25 09:16:56 openldap1 slapd[58851]: => acl_mask: access to entry "uid=user1,ou=people,o=abc.net", attr "PrivateAttr" requested Jan 25 09:16:56 openldap1 slapd[58851]: => acl_mask: to value by "uid=user2,ou=people,o=abc.net", (=0) Jan 25 09:16:56 openldap1 slapd[58851]: <= check a_group_pat: cn=group,ou=special,o=abc.net Jan 25 09:16:56 openldap1 slapd[58851]: => mdb_entry_get: found entry: "cn=group,ou=special,o=abc.net" Jan 25 09:16:56 openldap1 slapd[58851]: <= check a_authz.sai_ssf: ACL 128 > OP 256 Jan 25 09:16:56 openldap1 slapd[58851]: <= acl_mask: [1] applying read(=rscxd) (stop) Jan 25 09:16:56 openldap1 slapd[58851]: <= acl_mask: [1] mask: read(=rscxd) Jan 25 09:16:56 openldap1 slapd[58851]: => slap_access_allowed: read access granted by read(=rscxd) Jan 25 09:16:56 openldap1 slapd[58851]: => access_allowed: read access granted by read(=rscxd) Jan 25 09:16:56 openldap1 slapd[58851]: connection_read(35): no connection!

1 0

Re: [OpenLDAP][Authentication] SASL
by Timothy Keith 22 Jan '16

22 Jan '16

The supported SASL mechanisms are CRAM-MD5 and DIGEST-MD5 [tkeith@kif ~]$ ldapsearch -x -H ldap://localhost -b "" -s base supportedSASLMechanisms # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: supportedSASLMechanisms # # dn: supportedSASLMechanisms: CRAM-MD5 supportedSASLMechanisms: DIGEST-MD5 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 But this returns : no mechanism available: ldapwhoami -v -ZZZ -Y EXTERNAL -h localhost ldap_initialize( ldap://localhost ) SASL/EXTERNAL authentication started ldap_sasl_interactive_bind_s: Unknown authentication method (-6) additional info: SASL(-4): no mechanism available: Tim On Fri, Jan 22, 2016 at 11:36 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > Please keep replies to the list. > > --Quanah > > > --On Friday, January 22, 2016 11:26 AM -0600 Timothy Keith > <timothy.g.keith(a)gmail.com> wrote: > >> ldapwhoami -v -ZZ -Y EXTERNAL -h localhost >> ldap_initialize( ldap://localhost ) >> SASL/EXTERNAL authentication started >> ldap_sasl_interactive_bind_s: Unknown authentication method (-6) >> additional info: SASL(-4): no mechanism available: >> >> >> ldapsearch -h localhost -LLL -Y EXTERNAL -b "" -s base + >> SASL/EXTERNAL authentication started >> ldap_sasl_interactive_bind_s: Unknown authentication method (-6) >> additional info: SASL(-4): no mechanism available: >> >> >> Tim >> >> On Fri, Jan 22, 2016 at 10:10 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> >> wrote: >>> >>> --On Friday, January 22, 2016 9:38 AM -0600 Timothy Keith >>> <timothy.g.keith(a)gmail.com> wrote: >>> >>>> The first attempt fails : >>>> >>>> ldapwhoami -v -ZZ -Y EXTERNAL >>>> ldap_initialize( <DEFAULT> ) >>>> ldap_start_tls: Connect error (-11) >>>> additional info: TLS: hostname does not match CN in peer >>>> certificate >>> >>> >>> >>> Why do you expect this to work? You failed to supply -H with a valid >>> ldap:// URI. >>> >>>> This also fails : >>>> >>>> ldapsearch -LLL -Y EXTERNAL -H ldaps:/// -b "" -s base + >>>> ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) >>> >>> >>> >>> Why do you expect this to work? You passed -H without providing a host. >>> >>> --Quanah >>> >>> >>>> >>>> Tim >>>> >>>> >>>> On Thu, Jan 21, 2016 at 7:43 PM, Sergio NNX <sfhacker(a)hotmail.com> >>>> wrote: >>>>>> >>>>>> >>>>>> My scenario is relatively simple. >>>>> >>>>> >>>>> Simple, but it doesn't work, right? >>>>> >>>>> Are you after something similar to the output below? >>>>> >>>>> ldapwhoami -v -ZZ -Y EXTERNAL >>>>> >>>>> SASL/EXTERNAL authentication started >>>>> SASL username: 2.5.4.13=End User Certificate (OpenLDAP >>>>> 2.4.43),2.5.4.5=1234-2015 >>>>> -UK,title=Mr,ou=Finance Department,o=MateAR.eu IT >>>>> Solutions,l=Westminster,st=Lon >>>>> don,c=GB,email=info(a)matear.eu,0.9.2342.19200300.100.1.1=Administrator, >>>>> dc =EU,cn=A dministrator >>>>> SASL SSF: 0 >>>>> dn:description=end user certificate (openldap >>>>> 2.4.43),serialNumber=1234-2015-uk, >>>>> title=mr,ou=finance department,o=matear.eu it >>>>> solutions,l=westminster,st=london, >>>>> c=gb,email=info(a)matear.eu,uid=administrator,dc=eu,cn=administrator >>>>> Result: Success (0) >>>>> >>>>> >>>>> ldapsearch -LLL -Y EXTERNAL -H ldaps:/// -b "" -s base + >>>>> >>>>> SASL/EXTERNAL authentication started >>>>> SASL username: 2.5.4.13=End User Certificate (OpenLDAP >>>>> 2.4.43),2.5.4.5=1234-2015 >>>>> -UK,title=Mr,ou=Finance Department,o=MateAR.eu IT >>>>> Solutions,l=Westminster,st=Lon >>>>> don,c=GB,email=info(a)matear.eu,0.9.2342.19200300.100.1.1=Administrator, >>>>> dc =EU,cn=A dministrator >>>>> >>>>> >>>>> SASL SSF: 0 >>>>> dn: >>>>> structuralObjectClass: OpenLDAProotDSE >>>>> configContext: cn=config >>>>> monitorContext: cn=Monitor >>>>> namingContexts: dc=my-domain,dc=com >>>>> supportedControl: 1.3.6.1.4.1.4203.1.9.1.1 >>>>> supportedControl: 2.16.840.1.113730.3.4.18 >>>>> supportedControl: 2.16.840.1.113730.3.4.2 >>>>> supportedControl: 1.3.6.1.4.1.4203.1.10.1 >>>>> supportedControl: 1.3.6.1.1.22 >>>>> supportedControl: 1.2.840.113556.1.4.319 >>>>> supportedControl: 1.2.826.0.1.3344810.2.3 >>>>> supportedControl: 1.3.6.1.1.13.2 >>>>> supportedControl: 1.3.6.1.1.13.1 >>>>> supportedControl: 1.3.6.1.1.12 >>>>> supportedExtension: 1.3.6.1.4.1.1466.20037 >>>>> supportedExtension: 1.3.6.1.4.1.4203.1.11.1 >>>>> supportedExtension: 1.3.6.1.4.1.4203.1.11.3 >>>>> supportedExtension: 1.3.6.1.1.8 >>>>> supportedFeatures: 1.3.6.1.1.14 >>>>> supportedFeatures: 1.3.6.1.4.1.4203.1.5.1 >>>>> supportedFeatures: 1.3.6.1.4.1.4203.1.5.2 >>>>> supportedFeatures: 1.3.6.1.4.1.4203.1.5.3 >>>>> supportedFeatures: 1.3.6.1.4.1.4203.1.5.4 >>>>> supportedFeatures: 1.3.6.1.4.1.4203.1.5.5 >>>>> supportedLDAPVersion: 3 >>>>> supportedSASLMechanisms: SRP >>>>> supportedSASLMechanisms: SCRAM-SHA-1 >>>>> supportedSASLMechanisms: GSSAPI >>>>> supportedSASLMechanisms: GSS-SPNEGO >>>>> supportedSASLMechanisms: DIGEST-MD5 >>>>> supportedSASLMechanisms: EXTERNAL >>>>> supportedSASLMechanisms: OTP >>>>> supportedSASLMechanisms: CRAM-MD5 >>>>> supportedSASLMechanisms: NTLM >>>>> supportedSASLMechanisms: LOGIN >>>>> supportedSASLMechanisms: PLAIN >>>>> entryDN: >>>>> subschemaSubentry: cn=Subschema >>>>> >>>> >>> >>> >>> >>> -- >>> >>> Quanah Gibson-Mount >>> Platform Architect >>> Zimbra, Inc. >>> -------------------- >>> Zimbra :: the leader in open source messaging and collaboration > > > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

1 0

Re: pass-through authentication
by Timothy Keith 21 Jan '16

21 Jan '16

saslauthd -v saslauthd 2.1.23 authentication mechanisms: getpwent kerberos5 pam rimap shadow ldap Tim

2 5

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical