openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

slapd: No database support for /var/heimdal/heimdal
by Francesco Malvezzi 16 Oct '15

16 Oct '15

hi all, while adding the smbk5pwd overlay 1) to a mdb database, on ldapmodify command slapd dies suddently with the following last lines: [...] 5620d62f >>> dnPrettyNormal: <olcOverlay={3}smbk5pwd,olcDatabase={1}mdb,cn=config> 5620d62f <<< dnPrettyNormal: <olcOverlay={3}smbk5pwd,olcDatabase={1}mdb,cn=config>, <olcOverlay={3}smbk5pwd,olcDatabase={1}mdb,cn=config> 5620d62f oc_check_required entry (olcOverlay={3}smbk5pwd,olcDatabase={1}mdb,cn=config), objectClass "olcSmbK5PwdConfig" 5620d62f oc_check_allowed type "objectClass" 5620d62f oc_check_allowed type "olcOverlay" 5620d62f oc_check_allowed type "olcSmbK5PwdEnable" 5620d62f oc_check_allowed type "structuralObjectClass" slapd: No database support for /var/heimdal/heimdal openldap is 2.4.42 compiled on debian jessie, heimdal is compiled too (heimdal-1-5-branch). The module in contrib/slapd-modules/smbk5pwd compiles fine apart a few warnings. I think I am missing a library, but I am not able to figure out which one. thank you, Francesco 1) dn: olcOverlay={3}smbk5pwd,olcDatabase={1}mdb,cn=config changetype: add objectClass: olcSmbK5PwdConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {3}smbk5pwd olcSmbK5PwdEnable: samba olcSmbK5PwdEnable: krb5

1 1

Can a ppolicy be applied to a subtree?
by Campbell, Courtney 15 Oct '15

15 Oct '15

I am curious if a ppolicy can be applied to a subtree so that it is added to a user account when newly created? ________________________________ This message (including any attachments) is confidential and intended for a specific individual and purpose. If you are not the intended recipient, please notify the sender immediately and delete this message.

3 3

Allowing users to update their passwords
by Kartik Vashishta 13 Oct '15

13 Oct '15

Team, I am not anything but new to ldap. I have however successfully installed and configured Openldap on CentOS7. Online material was a BIG help. I am trying to figure out how to allow users to change their own passwords. Googling pointed me out to this: access to attrs=userPassword by self write by anonymous auth by users none access to * by * read But where and how does this get input into the ldap db. There is no more a slapd.conf. Please advise. Regards, Kartik Vashishta

3 2

bind/queries through multiple backends
by Steffen Kaiser 10 Oct '15

10 Oct '15

Hi, I currently have a local OpenLDAP v2.4.40 with a bdb backend and another instance with a ldap backend proxying binds and queries to an AD. The bdb backend serves just one suffix: dc=example,dc=com The AD serves several suffixes: dc=example,dc=com (same as local one) dc=example,dc=net dc=otherexample,dc=com dc=anotherexample,dc=net I would like to merge both configurations. The entries of the suffix dc=example,dc=com, which is served by both servers, are disjunct. There is no DN, which is located on both servers. There will be some name problems, but these can be handled by organisational means. ==== My first problem is that I cannot make bind work for DNs with suffix dc=example,dc=com, which are located on the 2nd backend. In fact, there are very few DNs of that suffix on the 2nd server, but there are. I would like that bind first tries the first (local) server and, if the DN is missing there, the second server (the proxy). Currently, only the local backend is queried. ==== What would be the best solution to forward a bunch of suffixes to the LDAP backend? -- Steffen Kaiser

2 1

empty ldapmodify refused with slapo-unique
by Geert Hendrickx 08 Oct '15

08 Oct '15

When slapo-unique constraints are in effect, it seems empty updates are no longer allowed: > $ ldapmodify -x -h localhost -D cn=Manager,dc=my-domain,dc=com -w secret > dn: cn=test1,dc=my-domain,dc=com > changetype: modify > > modifying entry "cn=test1,dc=my-domain,dc=com" > ldap_modify: Invalid syntax (21) > additional info: unique_modify() got null op.orm_modlist Why is this considered invalid syntax? Without slapo-unique constraint, empty updates like these are accepted. Geert -- geert.hendrickx.be :: geert(a)hendrickx.be :: PGP: 0xC4BB9E9F This e-mail was composed using 100% recycled spam messages!

2 2

SSL based LDAP client verification
by Aneela Saleem 08 Oct '15

08 Oct '15

Hi all, I have followed this link <http://www.openldap.org/faq/data/cache/185.html> to generate self-signed certificates. I have successfully performed server side validation. What if i want to access LDAPS:// from other client. I have copied servercrt.pem and serverkey.pem file on client machine, also added servercrt.pem file to client trust store. I'm using LDAPjs client for authentication. I have provided trust store path and serverkey.pem file in the code, but i still get the following error: crypto.js:104 if (options.cert) c.context.setCert(options.cert); ^ Error: error:0906D06C:PEM routines:PEM_read_bio:no start line at Object.exports.createCredentials (crypto.js:104:31) at Object.exports.connect (tls.js:1334:27) at Client._connect (/home/aneela/node_modules/ldapjs/lib/client/client.js:736:18) at new Client (/home/aneela/node_modules/ldapjs/lib/client/client.js:247:22) at Object.createClient (/home/aneela/node_modules/ldapjs/lib/client/index.js:60:12) at authDN (/home/aneela/client-ldapjs/app.js:15:21) at Object.<anonymous> (/home/aneela/client-ldapjs/app.js:90:1) at Module._compile (module.js:456:26) at Object.Module._extensions..js (module.js:474:10) at Module.load (module.js:356:32) Please guide me if i'm doing something wrong. Which PEM files need to be copied on client machine? Or i need to create client side certificates separately as well?

2 1

slapd-ldap quarantine, manual slapd restart is required
by Nikos Voutsinas 08 Oct '15

08 Oct '15

Hi, I am using the quarantine option of back-ldap, using the following setting: olcDbQuarantine 10,30;60,+ which AFAIK it means that proxy ldap will try to unset the quarantine in 10 seconds for 30 times, and then will try every 60 seconds, forever. In my case when proxy ldap put the backend target into quarantine the following lines were written in slapd.log, and after that proxy ldap never managed to remove the target from quarantine. Oct 7 21:30:58 proxy slapd[330]: conn=632725 op=0 ldap_back_retry: retrying URI="ldap://back01 ldap://back02" DN="" Oct 7 21:30:58 proxy slapd[330]: conn=632725 op=0: ldap_back_quarantine enter. Oct 7 21:31:08 proxy slapd[330]: conn=632759 op=0: ldap_back_getconn quarantine retry block #0 try #0. It seems to me that back ldap tried once to check the target status in 10 seconds, and after that nothing..... 1. Is the config syntax correct? 2. Is there any case this to be a regression of ITS#5592 Thanks, Nikos

2 1

SSL based ldap server
by Aneela Saleem 07 Oct '15

07 Oct '15

Hi all, I have implemented LDAP over ssl. FQDN of LDAP server is "platalytics.com" and same is CN in the SSL certificate. But why is it so that when i run following command it works fine i.e., ldapsearch -x -D "cn=aneela,ou=users,dc=platalytics,dc=com" -W -H ldap:// 127.0.0.1:389 -b "dc=platalytics,dc=com" -s sub 'cn=aneela' but in case of ldaps, i have to provide FQDN as the hostname i.e., ldapsearch -x -D "cn=aneela,ou=users,dc=platalytics,dc=com" -W -H ldaps:// platalytics.com:636 -b "dc=platalytics,dc=com" -s sub 'cn=aneela' because following command does not work i.e., ldapsearch -x -D "cn=aneela,ou=users,dc=platalytics,dc=com" -W -H ldaps:// 127.0.0.1:636 -b "dc=platalytics,dc=com" -s sub 'cn=aneela'

4 9

New User unable to authenticate on new client
by Varadi, Louis - 0442 - MITLL 06 Oct '15

06 Oct '15

I have a new OpenLDAP server. I am also using it as a Ldap Client. I have added a user but cannot authenticate. I have spent a lot of time researching this issue. All the suggestions are very different - ACL issues, slapd pointing the incorrect config files, Ldap.conf file is incorrect, nsswitch is incorrect, incorrect password. Is there a straight forward way to troubleshoot this issue. What are the configs files that are involved with this failure? Your help is greatly appreciated. This user works [root@ldapservrer]# ldapwhoami -x -D cn=ldapadmin,dc=group1,dc=ldap -W Enter LDAP Password: dn:cn=ldapadmin,dc=group1,dc=ldap This user fails [root@ldapserver]# ldapwhoami -x -D cn=lou,dc=group1,dc=ldap -W Enter LDAP Password: ldap_bind: Invalid credentials (49) 5612e45a conn=1051 fd=12 ACCEPT from IP=192.168.0.101:59308 (IP=192.168.0.a0a:389) 5612e45a conn=1051 op=0 BIND dn="cn=lou,dc=group1,dc=ldap" method=128 5612e45a conn=1051 op=0 RESULT tag=97 err=49 text= 5612e45a conn=1051 op=1 UNBIND 5612e45a conn=1051 fd=12 closed Oct 5 16:03:32 ldapserver sshd[1432]: Received disconnect from 9.9.9.9: 11: disconnected by user Oct 5 16:03:36 ldapserver sshd[1528]: Invalid user lou from 9.9.9.9 Oct 5 16:03:36 ldapserver sshd[1529]: input_userauth_request: invalid user lou Oct 5 16:03:53 ldapserver sshd[1528]: Failed password for invalid user lou from 9.9.9.9 port 33968 ssh2 _______________________________ [root@ldapserver man1]# su - lou su: user lou does not exis 5612ebc3 conn=1053 fd=12 ACCEPT from IP=192.168.0.101:59310 (IP=192.168.0.101:389) 5612ebc3 conn=1053 op=0 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" 5612ebc3 conn=1053 op=0 SRCH attr=* altServer namingContexts supportedControl supportedExtension supportedFeatures supportedLDAPVersion supportedSASLMechanisms domainControllerFunctionality defaultNamingContext lastUSN highestCommittedUSN 5612ebc3 conn=1053 op=0 SEARCH RESULT tag=101 err=0 nentries=0 text= 5612ebc3 conn=1053 op=1 SRCH base="dc=group1,dc=ldap" scope=2 deref=0 filter="(&(uid=lou)(objectClass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNum ber=0))))" 5612ebc3 conn=1053 op=1 SRCH attr=objectClass uid userPassword uidNumber gidNumber gecos homeDirectory loginShell krbPrincipalName cn modifyTimestamp modifyTimestamp shadowLastChange shadowMin shadowMax shadowWarning shadowInactive shadowExpire shadowFlag krbLastPwdChange krbPasswordExpiration pwdAttribute authorizedService accountExpires userAccountControl nsAccountLock host loginDisabled loginExpirationTime loginAllowedTimeMap sshPublicKey 5612ebc3 conn=1053 op=1 SEARCH RESULT tag=101 err=50 nentries=0 text= 5612ebc3 conn=1053 op=2 UNBIND 5612ebc3 conn=1053 fd=12 closed __________________________ ssh lou(a)192.168.101 5612ed15 conn=1107 fd=12 ACCEPT from IP=192.168.0.101:59364 (IP=192.168.0.101:389) 5612ed15 conn=1107 op=0 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" 5612ed15 conn=1107 op=0 SRCH attr=* altServer namingContexts supportedControl supportedExtension supportedFeatures supportedLDAPVersion supportedSASLMechanisms domainControllerFunctionality defaultNamingContext lastUSN highestCommittedUSN 5612ed15 conn=1107 op=0 SEARCH RESULT tag=101 err=0 nentries=0 text= 5612ed15 conn=1107 op=1 SRCH base="dc=group1,dc=ldap" scope=2 deref=0 filter="(&(uid=lou)(objectClass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNum ber=0))))" 5612ed15 conn=1107 op=1 SRCH attr=objectClass uid userPassword uidNumber gidNumber gecos homeDirectory loginShell krbPrincipalName cn modifyTimestamp modifyTimestamp shadowLastChange shadowMin shadowMax shadowWarning shadowInactive shadowExpire shadowFlag krbLastPwdChange krbPasswordExpiration pwdAttribute authorizedService accountExpires userAccountControl nsAccountLock host loginDisabled loginExpirationTime loginAllowedTimeMap sshPublicKey 5612ed15 conn=1107 op=1 SEARCH RESULT tag=101 err=50 nentries=0 text= 5612ed15 conn=1107 op=2 UNBIND 5612ed15 conn=1107 fd=12 closed [root@ldapserver ]# ldapsearch -H ldap://ldapserver.group1.ldap -d 256 -D cn=ldapadmin,dc=group1,dc=ldap -W -b ou=Users,dc=group1,dc=ldap Enter LDAP Password: # extended LDIF # # LDAPv3 # base <ou=Users,dc=group1,dc=ldap> with scope subtree # filter: (objectclass=*) # requesting: ALL # # Users, group1.ldap dn: ou=Users,dc=group1,dc=ldap ou: Users objectClass: organizationalUnit # lou, Users, group.ldap dn: uid=lou,ou=Users,dc=group1,dc=ldap uid: lou mail: louxxxxxxxxxxx sn: xxxx pwdAttribute: xxxxxxx telephoneNumber: xxxxxxxxxx roomNumber: xxxx uidNumber: xxxx gidNumber: xxxxx employeeNumber: xxxxx cn: Louis xxxxx loginShell: /bin/bash gecos: Lou xxxx homeDirectory: /home/xxxx objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: pwdPolicy objectClass: shadowAccount userPassword:: xxxxxxx # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2

2 2

Re: OS X Yosemite clients
by oldap＠mountainlake.k12.mn.us 06 Oct '15

06 Oct '15

I have this problem resolved. It isn't related to the OpenLDAP code at all, but has to do with the password formatting. What I found was the passwords in OpenLDAP were in this format: {MD5}<base 64 encoded md5 digest><newline character> The base64 encoder on the Linux server always adds a a newline character (\n) to the end of the encoding. Multiple platforms have always ignored that character until OS X 10.10.5. Simply removing the newline before inserting the encoded password into the OpenLDAP database allows 10.10.5 and later to authenticate against that password. -- Jon

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical