openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

Allow users to change ldap password with passwd
by Real, Elizabeth (392K) 06 Oct '15

06 Oct '15

This is my setup: Server: Openldap 2.4.39 installed on RHEL7 Ldap clients: RHEL7 and RHEL5 I set up this directive on the ldap clients (/etc/sssd/sssd.conf) to prevent users with expired accounts to login: ldap_pwd_policy = shadow. This works as expected. Now I need to allow users to reset their ldap password after logging in to an ldap client. This is what is logged when a user attempts to reset their password using passwd: rhel7 ldap client: # passwd Changing password for user real Current password: New password: Retype new password: passwd: Authentication token manipulation error rhel7 ldap server: /var/log/secure pam_unix(passwd:chauthtok): user “real” does not exist in the /etc/passwd pam_sss(passwd:chauthtok): Password change failed for user real: 28 (Module is unknown) Gkr-pam: couldn’t update the login keyring password: no old password was Entered In an attempt to allow users to change their ldap password, i edited my ACL on the ldap server and added 'shadowLastChange': dn: olcDatabase={2}hdb,cn=config add: olcAccess olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by dn.base="cn=Alien,dc=cluster,dc=sec312" write by anonymous auth by * none olcAccess: {1}to * by self write by dn.base="cn=Alien,dc=cluster,dc=sec312" write by * read However that did not work, on the ldap clients I get this on the logs: pam_unix(sshd:auth): authentication failure pam_sss(sshd:auth): authentication failure pam_sss(sshd:auth): received for user reaL 4 (System error) This is the /etc/pam.d/system-auth file on the rhel7 ldap client: #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_fprintd.so auth sufficient pam_unix.so try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth sufficient pam_sss.so use_first_pass auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_pwquality.so try_first_pass local_users_only retry=3 minlen=8 lcredit=-1 ucredit=-1 dcredit=-1 ocredit=-1 authtok_type= password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so ~ What other directive do I need to set to allow users to reset their ldap password when they call passwd? Thank you, Liz

4 14

olcAccess with combined "by who" condition
by rss ln 06 Oct '15

06 Oct '15

Hello, Is it possible to combine olcAccess "by who" condition for DN and IP address, that both conditions must by true? Something like: to dn.subtree="ou=test,dc=domain,dc=com" by dn="uid=someuser,ou=users,dc=domain,dc=com" & peername.ip=10.10.10.10 read So, it should be possible to read the subtree for the user only from the specific IP address. I tried also use "set=(...)" but without success. Any chance to do that?

2 1

implementation specific error trying to modify olcSyncProvConfig object
by Angel L. Mateo 05 Oct '15

05 Oct '15

Hello, I am trying to modify an already existing configuration in my openldap servers (I have tried with 2.4.31 an 2.4.41). Its current ldif is: dn: olcOverlay={0}syncprov objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: ef486ea8-bf26-1034-850e-938b6f4c1ac2 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20150715102100Z entryCSN: 20151002093808.730729Z#000000#01e#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20151002093808Z Now, I'm trying to add olcSpSessionlog and olcCheckpoint attributes, so I have this update ldif: dn: olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config changetype: modify replace: olcSpCheckpoint olcSpCheckpoint: 100 10 - replace: olcSpSessionlog olcSpSessionlog: 100 (I know I could use add operations instead of replace, but the ldif is generated from a configuration system). When I try to run this ldif I get: # /usr/bin/ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/update.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config" ldap_modify: Other (e.g., implementation specific) error (80) This is a rare behaviour, because I have tried changing the order of the modifications and it works: # /usr/bin/ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/update.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config" I have also tried separating the modifications in two different operations (first with olcSpCheckpoint) and then I get a "no such attribute" error: # /usr/bin/ldapmodify -Y EXTERNAL -H ldapi:/// SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config changetype: modify replace: olcSpCheckpoint olcSpCheckpoint: 100 10 modifying entry "olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config" dn: olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config changetype: modify replace: olcSpSessionlog olcSpSessionlog: 100 modifying entry "olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config" ldap_modify: Other (e.g., implementation specific) error (80) additional info: modify/delete: olcSpSessionlog: no such attribute The same operation but trying to update first the olcSpSessionlog attribute also errors with "no such attribute": # /usr/bin/ldapmodify -Y EXTERNAL -H ldapi:/// SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config changetype: modify replace: olcSpSessionlog olcSpSessionlog: 100 modifying entry "olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config" ldap_modify: Other (e.g., implementation specific) error (80) additional info: modify/delete: olcSpSessionlog: no such attribute Is this a bug? If not, why I'm having this error? Any idea? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

2 1

RBAC
by Aneela Saleem 05 Oct '15

05 Oct '15

Hi all, Can anyone please provide me with some useful tutorials about "How can we implement RBAC in LDAP" ? I have mostly seen research papers only. I want to see some implementation examples. Thanks

2 3

Complex multi-master topology
by Patrick 04 Oct '15

04 Oct '15

I've been trying to create a complex multi-master replication of cn=config for a week now... I'm using the core debian package: slapd 2.4.40+dfsg-1+deb8u1 I've seen someone claiming it could work but cannot find configs related to this kind of topology. http://www.slideshare.net/ghenry/openldap-replication-strategies (slide #24) When building a simple multimaster (two or three nodes) everything works as planned. But in the case some nodes cannot talk to others, i cannot find a way to make it works. Let's take this example +-------+ +-------+ +-------+ | ldap1 | <---> | ldap2 | <---> | ldap3 | +-------+ +-------+ +-------+ and say: olcSyncRepl: rid=001 searchbase="cn=config" type=refreshAndPersist provider=ldap://ldap1 olcSyncRepl: rid=002 searchbase="cn=config" type=refreshAndPersist provider=ldap://ldap2 olcSyncRepl: rid=003 searchbase="cn=config" type=refreshAndPersist provider=ldap://ldap3 Where initialy: ldap1 have rid=002 ldap2 have rid=001 and rid=003 ldap3 have rid=002 Soon everyone get rid=001 rid=002 rid=003 and ldap3 cannot talk to ldap1 and it does not work... And even if i don't care about the connexion between ldap1 and ldap3 failing, the replication does not work either... if ldap1 change something, it gets replicated to ldap2 but not ldap3. Also, i've been trying to use exattrs=Syncrepl but if someone change his Syncrepl, it get deleted on the other node... Someone seems to have seen this with memberof overlay ? http://www.openldap.org/lists/openldap-technical/201505/msg00124.html Anyone have references to help me get to my goal? -- Patrick Brideau Administrateur Système Kronos Technologies - http://www.kronos-web.com tel: 418 877-5400 p.216

5 10

BP build OpenLDAP and lmdb packages
by Michael Ströder 03 Oct '15

03 Oct '15

HI! I wonder what's considered best practice for building OpenLDAP and lmdb packages e.g. for a Linux distribution. Fortunately lmdb seems to be leveraged by more and more other software. So Linux distributions start to ship lmdb libs and tools as separate packages. 1. Do I have a chance to build OpenLDAP against those packages? Which releases have to be aligned? 2. Or should I link back-mdb statically into slapd when producing OpenLDAP packages? This would probably also require to build separate version of the mdb tools. Of course personally I'd prefer 1. Ciao, Michael.

5 8

[LMDB] What pointer is returned with combination of MDB_WRITEMAP and MDB_RESERVE?
by Victor Baybekov 03 Oct '15

03 Oct '15

Hi, Docs for MDB_RESERVE say that a returned pointer to the reserved space is valid "before the next update operation or the transaction ends." Docs for MDB_WRITEMAP say that it "writes directly to the mmap instead of using malloc for pages." Does combining the two options return a pointer directly to a place in a mmap so that this pointer could be used after a transaction ends or after the next update? I have a use case where I want to somewhat abuse LMDB safety for convenience. If I could get a pointer to a place inside a mmap I could work with LMDB value as opaque blob or as a region inside the single big mmap. This could be more convenient than creating and opening hundreds of temporary memory mapped files and keeping open handles to them. For example, Aeron terms could be stored like this: a stream id per an LMDB db and a term id for a key in the db. Thanks! Victor

2 3

parent DN and deref control
by Michael Ströder 02 Oct '15

02 Oct '15

Hmm... I have a use-case where it would be handy to use the deref control to request attributes from an entry's parent entry. But this would require kind of a pseudo-attribute 'parentDN' (similar to 'entryDN'). Anybody aware whether such a thing is already available? [1] https://tools.ietf.org/html/draft-masarati-ldap-deref-00 Nope, I don't want to use collective attributes. Ciao, Michael.

3 5

cannot delete pwdFailureTime attribute
by David Magda 01 Oct '15

01 Oct '15

Hello, How do I delete the pwdFailureTime attribute on a slave? I have a DN where pwdFailureTime entries are growing and its slowly filling up /var/lib/ldap/. Ive tried the following LDIF: dn: uid=foo,ou=People,dc=example,dc=com changetype: modify delete: pwdFailureTime But since the system is slave, its giving ldapmodify(1) a redirect to the master. I've also tried the script in ITS#8185: http://www.openldap.org/lists/openldap-bugs/201507/msg00012.html that connects to ldapi:///, and that also referral/redirects (since we have olcUpdateRef configured). We are not using the slapo-chain(5) funcionality. Is there any way to manipulate pwdFailureTime on the slaves without going into the raw databases files? Or do we have to enable slapo-chain(5) when using slapo-ppolicy(5) and then do things on the master? Thanks for any info. Regards, David

2 2

How to build contrib pw-radius?
by dev 01 Oct '15

01 Oct '15

Hi, I'm trying to build the pw-radius module in the contrib directory but can't seem to find the right library to add to the incantation. I've tried installing the freeradius-dev package as well as the libradiusclient-ng-dev but still no radlib.h. A google on the error message[1] returns *exactly* two results so I'm kind of at a loss. Can someone point me in the direction of the correct radius package to install to get this built? [1] test# gcc -shared -I../../../include -Wall -g -o pw-radius.so radius.c -lradius radius.c:27:20: fatal error: radlib.h: No such file or directory compilation terminated.

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical