openldap-technical

openldap-technical@openldap.org

9 participants
9902 discussions

SASL/EXTERNAL not available
by Frank Crow 02 Sep '15

02 Sep '15

Hi, I'm trying to configure OpenLDAP 2.4.23 (running on RHEL6.5) to use client-side certificates via the SASL/EXTERNAL mechanism. I have successfully configured server-side certs with TLS and was wanting to expand my configuration on the client-side. If set the TLSClientVerify to "allow" or "try" and attempt to use "-Y EXTERNAL", I get the following message: SASL/EXTERNAL authentication started ldap_sasl_interactive_bind_s: Unknown authentication method (-6) additional info: SASL (-4): no mechaism available: If I do a search on the DSE, I get the following available methods: dn: supportedSASLMechanisms: GSSAPI supportedSASLMechanisms: LOGIN supportedSASLMechanisms: CRAM-MD5 supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: PLAIN I know that other people are using this but nobody (here at work) knows why my particular configuration is getting this error. Can anyone help me figure this out? Thanks, -- Frank Crow

4 5

disable simple paged results control support?!
by Igor Shmukler 02 Sep '15

02 Sep '15

Hello, I am trying to make my client, developed for OpenLDAP also compatible with Oracle DSEE. Oracle DSEE is missing support for simple paged results, which I use. Yet, ODSEE supports virtual list view with server-side sorting. I adjusted my code, to use that - VLV+SSS as a fallback whenever the server does not support paged results and supports VLV+SSS, like ODSEE. Is it possible to disable OpenLDAP server-side support of simple paged results control, so the OpenLDAP server would respond that this control is unavailable? I don't have an LDAP proxy, nor ODSEE configured. OpenLDAP saved me many times, in past. Can OpenLDAP be configured to do what I need, so I could test my fallback code in the client using an OpenLDAP server? Thank you, Igor Shmukler

3 7

LMDB: Robust mutexes
by Kristian Amlie 02 Sep '15

02 Sep '15

Hey, there was some discussion about robust mutexes in LMDB about a year ago, and I was told there was a patchset being worked on. I'm just wondering what's the state of this project now. Is it likely to be included in upcoming releases? I don't see it in the latest release 0.9.16, and the "robust" branch hasn't moved for a while. -- Kristian

2 2

Unable to build LMDB on SUSE Linux: undefined reference to pthread_mutexattr_setrobust / pthread_mutex_consistent
by Pallav Gupta 01 Sep '15

01 Sep '15

Hello, I am trying to build LMDB libraries from source on SUSE Linux using gcc 4.7.2 to try for an experimental project at work. I am getting some build errors. I see pthread.h and libpthread.{a/so} installed in /usr/include and /usr/lib64, respectively. But I do not see these functions in the header file or in the library. Maybe the pthread library version is old. I am not sure. I tried searching on the web, but I was not able to understand how to install a different version of the pthread library (it seems to come packaged with the OS?). I do not have admin rights so I would try installing in my local area. Can someone please advise on things I can try to resolve this issue? Thank you for your time and help. (P.S. I had built LMDB successfully on a Mac OS X machine (home computer) without any issues) $ makegcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -Wuninitialized -c mdb.cmdb.c: In function ‘mdb_mutex_failed’:mdb.c:9827:4: warning: implicit declaration of function ‘pthread_mutex_consistent’ [-Wimplicit-function-declaration]gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -Wuninitialized -c midl.car rs liblmdb.a mdb.o midl.oar: creating liblmdb.agcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -Wuninitialized -fPIC -c mdb.c -o mdb.lomdb.c: In function ‘mdb_mutex_failed’:mdb.c:9827:4: warning: implicit declaration of function ‘pthread_mutex_consistent’ [-Wimplicit-function-declaration]gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -Wuninitialized -fPIC -c midl.c -o midl.logcc -pthread -shared -o liblmdb.so mdb.lo midl.lo gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -Wuninitialized -c mdb_stat.cgcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -Wuninitialized mdb_stat.o liblmdb.a -o mdb_statliblmdb.a(mdb.o): In function `mdb_env_setup_locks':/nfs/pdx/proj/dt/tctg03/pgupta6/lmdb-mdb.master/libraries/liblmdb/mdb.c:4642: undefined reference to `pthread_mutexattr_setrobust'liblmdb.a(mdb.o): In function `mdb_mutex_failed':/nfs/pdx/proj/dt/tctg03/pgupta6/lmdb-mdb.master/libraries/liblmdb/mdb.c:9827: undefined reference to `pthread_mutex_consistent'collect2: error: ld returned 1 exit statusmake: *** [mdb_stat] Error 1 My environment is as follows: $ more /etc/SuSE-release SUSE Linux Enterprise Server 11 (x86_64)VERSION = 11PATCHLEVEL = 2 $ uname -aLinux 3.0.101-0.7.29.1.8482.4.PTF-default #1 SMP Tue May 5 16:00:34 UTC 2015 () x86_64 x86_64 x86_64 GNU/Linux

1 0

ppolicy and pwdGraceUseTime
by Craig White 01 Sep '15

01 Sep '15

Openldap 2.4.39 Adding in policy in already running OpenLDAP installation. Mostly functional - I was locked out after failed password attempts as expected. Existing user with password beyond expiration is an issue. It is extended grace logins as expected but when I try to change the password, I get an error which appears to be "error 16 - modify/delete: pwdGraceUseTime: no such attribute" But there is that attribute. # ldapsearch -x -h localhost '(uid=craig.white)' + Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=obscured> (default) with scope subtree # filter: (uid=craig.white) # requesting: + # # craig.white, People, obscured dn: uid=craig.white,ou=People,dc=obscured entryUUID: c4ae47b4-c3e9-1033-8b0f-497efc42df64 creatorsName: cn=root,dc=obscured createTimestamp: 20140829170048Z pwdChangedTime: 20150730153646Z structuralObjectClass: inetOrgPerson pwdPolicySubentry: cn=personnelpp,ou=Policies,dc=obscured pwdGraceUseTime: 20150827230337Z pwdGraceUseTime: 20150827230344Z pwdGraceUseTime: 20150827230351Z pwdGraceUseTime: 20150827230430Z pwdGraceUseTime: 20150827230441Z pwdGraceUseTime: 20150827230847Z pwdGraceUseTime: 20150827230855Z pwdGraceUseTime: 20150827231032Z pwdGraceUseTime: 20150827231039Z pwdGraceUseTime: 20150828152032Z pwdGraceUseTime: 20150828152038Z pwdGraceUseTime: 20150828152404Z pwdGraceUseTime: 20150828152410Z pwdGraceUseTime: 20150828152527Z pwdGraceUseTime: 20150828152533Z pwdGraceUseTime: 20150828152643Z pwdGraceUseTime: 20150828152648Z pwdGraceUseTime: 20150828153349Z pwdGraceUseTime: 20150828153354Z pwdGraceUseTime: 20150828153619Z pwdGraceUseTime: 20150828153623Z entryCSN: 20150828154229.701657Z#000000#000#000000 modifiersName: cn=admin,dc=obscured modifyTimestamp: 20150828154229Z entryDN: uid=craig.white,ou=People,dc=obscured subschemaSubentry: cn=Subschema hasSubordinates: FALSE # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Why won't it let me change my password? Craig White System Administrator O 623-201-8179 M 602-377-9752 [cid:image001.png@01CF86FE.42D51630] SkyTouch Technology 4225 E. Windrose Dr. Phoenix, AZ 85032

2 2

RE: authz-regexp behavior with GSSAPI
by Peter Heinemann 31 Aug '15

31 Aug '15

Dan, Here are version details: openldap 2.4-39 RHEL 6.5 cyrus-sasl and cyrus-sasl-gssapi 2.1.23-15 krb5-libs 1.10.3-42 The tests I'm running (ldapclient) are on the same system as is slapd. It appears that cross-realm authentication is problematic. In the following results, "success" means that the search specified by the regex occurred and the identity was remapped. Both commands used GSSAPI (-Y for ldapwhoami, -M for slapauth): krb5.conf default TEST.NET.ISC.UPENN.EDU ldapwhoami -R TEST.NET... success ldapwhomai no -R success slapauth -R TEST.NET... success slapauth no realm fail krb5.conf default UPENN.EDU ldapwhoami -R TEST.NET... fail ldapwhoami no realm fail slapauth -R TEST.NET... success slapauth no realm specified fail so: slapauth appears to work if a realm is explicitly specified with -R (either cross-realm or within realm), but won't remap if the realm isn't specified. ldapwhoami (and ldapsearch) works within a realm whether or not the realm is specified with -R; but won't remap if -R specifies a different realm. Here's output from slapauth that shows the different behavior when the realm is specified or not. Note that in this case, the ]$ sudo slapauth -d 4 -M GSSAPI -R TEST.NET.ISC.UPENN.EDU netmon 55e45abb mdb_db_open: "dc=upenn,dc=edu" 55e45abb slap_sasl_getdn: conn 18446744073709551615 id=netmon [len=6] 55e45abb [rw] authid: "uid=netmon,cn=test.net.isc.upenn.edu,cn=gssapi,cn=auth" -> "ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}netmon@TEST.NET.ISC.UPENN.EDU)" 55e45abb mdb_idl_fetch_key: [b49d1940] 55e45abb mdb_idl_fetch_key: [4f7f6931] 55e45abb send_ldap_result: err=0 matched="" text="" ID: <netmon> check succeeded authcID: <uid=netmon,ou=entities,dc=upenn,dc=edu> $ sudo slapauth -d 4 -M GSSAPI netmon 55e45ac6 mdb_db_open: "dc=upenn,dc=edu" 55e45ac6 slap_sasl_getdn: conn 18446744073709551615 id=netmon [len=6] 55e45ac6 [rw] authid: "uid=netmon,cn=gssapi,cn=auth" -> "uid=netmon,cn=gssapi,cn=auth" ID: <netmon> check succeeded authcID: <uid=netmon,cn=gssapi,cn=auth> Peter ________________________________________ From: Dan White [dwhite(a)olp.net] Sent: Sunday, August 30, 2015 10:09 AM To: Peter Heinemann Cc: openldap-technical(a)openldap.org Subject: Re: authz-regexp behavior with GSSAPI On 08/26/15 12:51 +0000, Peter Heinemann wrote: >I am trying to figure out different behaviors with authz-regexp in slapd.conf. >In production is: > >sasl-host pennid.upenn.edu >sasl-realm UPENN.EDU >authz-regexp uid=(.*),cn=UPENN.EDU,cn=gssapi,cn=auth > ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}$1@UPENN.EDU) > >and the authentication mapping works as desired; the user@realm gets mapped to the just the username and the search succeeds: > > ldapwhoami -Y GSSAPI -U netmon -H ldaps://pennid.upenn.edu >SASL/GSSAPI authentication started >SASL username: netmon(a)UPENN.EDU >SASL SSF: 56 >SASL data security layer installed. >dn:uid=netmon,ou=entities,dc=upenn,dc=edu > >However, on development in a different kerberos realm, that statement will not map properly. The mapping doesn't take place, so user@realm is used for the (unsuccessful) search: > >sasl-host pennid-dev.net.isc.upenn.edu >sasl-realm TEST.NET.ISC.UPENN.EDU >authz-regexp uid=(.*),cn=TEST.NET.ISC.UPENN.EDU,cn=gssapi,cn=auth > ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}$1@TEST.NET.ISC.UPENN.EDU) > >no mapping takes place: > >ldapwhoami -Y GSSAPI -U netmon -H ldaps://pennid-dev.net.isc.upenn.edu >SASL/GSSAPI authentication started >SASL username: netmon(a)TEST.NET.ISC.UPENN.EDU >SASL SSF: 56 >SASL data security layer installed. >dn:uid=netmon@test.net.isc.upenn.edu,cn=test.net.isc.upenn.edu,cn=gssapi,cn=auth > >However, a change to the regexp on the development system will cause mapping to work there: > >authz-regexp uid=(.*)(a)TEST.NET.ISC.UPENN.EDU,cn=TEST.NET.ISC.UPENN.EDU,cn=gssapi,cn=auth > ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}$1@TEST.NET.ISC.UPENN.EDU) > >$ ldapwhoami -Y GSSAPI -U netmon -H ldaps://pennid-dev.net.isc.upenn.edu >SASL/GSSAPI authentication started >SASL username: netmon(a)TEST.NET.ISC.UPENN.EDU >SASL SSF: 56 >SASL data security layer installed. >dn:uid=netmon,ou=entities,dc=upenn,dc=edu > >But a similar regexp in production will not map properly: > >Can anyone shed light on the different behavior? >- only the authz-regexp has been modified >- slapd was restarted after the changes. Any differences in your /etc/krb5.conf? What is your default realm? Any differences in the libraries you're using (cyrus-sasl and kerberos)? -- Dan White <dwhite(a)olp.net>

2 1

How can I solve "OpenLdap additional info:objectClass value#0 invalid per syntax" Error?
by Jason Long 29 Aug '15

29 Aug '15

Hello. I used below URL for configure my OpenLdap on CentOS 7 but when I want to add a user I got an error " OpenLdap additional info:objectClass value#0 invalid per syntax" How can I solve it? http://docs.adaptivecomputing.com/viewpoint/hpc/Content/topics/1-setup/inst… Thank you.

3 13

RHEL7 OpenLDAP server is not enforcing password expirations
by Real, Elizabeth (392K) 28 Aug '15

28 Aug '15

Hello, I’ve done a lot or research and re-read the OpenLDAP configuration guides but I cannot get my OpenLDAP 2.39 server to not allow users with expired passwords to login to ldap enabled clients. What directive in the /etc/pam.d/ files controls the users password expiration attribute? pam_unix or pam_ldap? Setup: Server: RHEL7 OS Software: OpenLdap 2.4.39 server using slapd service Client: RHEL7 OS Software: enabled Ldap via authconfig, using sssd service Thank you, Liz

2 1

2.4.17 -> 2.4.39 replication: null callback : error code 0x10
by Andrei Valoshyn 28 Aug '15

28 Aug '15

Hello! > > Aug 21 01:42:45 slapd[4658]: null_callback : error code 0x10 > Aug 21 01:42:45 slapd[4658]: syncrepl_entry: rid=107 be_modify failed > (16) > Aug 21 01:42:45 slapd[4658]: do_syncrepl: rid=107 rc 16 retrying (9 > retries left) > > Master (OpenLDAP: slapd 2.4.17, 64bit openSUSE 11.2) and slave > (OpenLDAP: slapd 2.4.31, 64bit openSUSE 12.2) > > master slapd.conf syncprov configuration : > ....... > overlay syncprov > syncprov-checkpoint 100 10 > syncprov-sessionlog 100 > .......... > > slave master slapd.conf syncprov configuration: > ................................... > syncrepl rid=107 provider=ldaps://master.domen.com \ > type=refreshOnly \ > interval=00:00:02:00 \ > scope=sub \ > schemachecking=off \ > searchbase="dc=domen,dc=com" \ > bindmethod=simple \ > binddn="dc=domen,dc=com" \ > credentials=**** \ > retry="60 10 300 10" > ...................... > > I have these errors on all my slaves. What may be the cause of those > errors? I have no idea about that. Please HELP! > >

2 1

openLDAP upgrate
by mdii 28 Aug '15

28 Aug '15

Hi all, I'm starting as an openLDAP administrator, and here in my company they are running the openLDAP 2.4.35. - I found this avec la commande ldapsearch -VV I want to upgrade to the letest version available (2.4.42), how should I procede ? I read that I just need to download the new package, stop the server, install the new version and then restart the server, is that all? Thanks in advance for your help, Marc

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical