openldap-technical

openldap-technical@openldap.org

9 participants
9902 discussions

disable unique overlay from member attributes
by Fischer, Johannes 27 Aug '15

27 Aug '15

Hi @all, I try to allow double entries for the attribute member. I’ve tried it with the ldif: dn: olcOverlay=unique,olcDatabase={1}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcUniqueConfig olcOverlay: unique olcUniqueUri: ignore ldap:///?members?sub but when I load it to the config with: ldapmodify the Error: ldap_add: invalid syntax (21) additional info: objectClass: value #1 invalid per syntax What is going wrong here? Greetings John -- Johannes Fischer Wissenschaftlicher Angestellter Fraunhofer-Institut für Produktionstechnik und Automatisierung IPA Kompetenzzentrum Digitale Werkzeuge in der Produktion Nobelstraße 12 │ 70569 Stuttgart Telefon +49 711 970-1217 johannes.fischer(a)ipa.fraunhofer.de<mailto:johannes.fischer@ipa.fraunhofer.de> www.ipa.fraunhofer.de<http://www.ipa.fraunhofer.de/> [cid:image001.png@01D0DE8D.A482B990]

3 3

Mail attribute: how to make it mandatory.
by Simone Taliercio 27 Aug '15

27 Aug '15

Hi again :p Since there's a lot of posting about attributes and unique overlay then I decided to make it even worse ;) I'm using OpenLDAP for storing entries which have *inetOrgPerson* as objectclass. What would be required to switch the "mail" attribute from optional to mandatory ? Thanks a lot for the support! Simone

2 4

authz-regexp behavior with GSSAPI
by Peter Heinemann 26 Aug '15

26 Aug '15

Good day, I am trying to figure out different behaviors with authz-regexp in slapd.conf. openldap 2.4-39 RHEL 6.5 cyrus-sasl and cyrus-sasl-gssapi 2.1.23-15 krb5-libs 1.10.3-42 We're mapping based on a search for the presence of the userPassword attribute. In production is: sasl-host pennid.upenn.edu sasl-realm UPENN.EDU authz-regexp uid=(.*),cn=UPENN.EDU,cn=gssapi,cn=auth ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}$1@UPENN.EDU) and the authentication mapping works as desired; the user@realm gets mapped to the just the username and the search succeeds: ldapwhoami -Y GSSAPI -U netmon -H ldaps://pennid.upenn.edu SASL/GSSAPI authentication started SASL username: netmon(a)UPENN.EDU SASL SSF: 56 SASL data security layer installed. dn:uid=netmon,ou=entities,dc=upenn,dc=edu However, on development in a different kerberos realm, that statement will not map properly. The mapping doesn't take place, so user@realm is used for the (unsuccessful) search: sasl-host pennid-dev.net.isc.upenn.edu sasl-realm TEST.NET.ISC.UPENN.EDU authz-regexp uid=(.*),cn=TEST.NET.ISC.UPENN.EDU,cn=gssapi,cn=auth ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}$1@TEST.NET.ISC.UPENN.EDU) no mapping takes place: ldapwhoami -Y GSSAPI -U netmon -H ldaps://pennid-dev.net.isc.upenn.edu SASL/GSSAPI authentication started SASL username: netmon(a)TEST.NET.ISC.UPENN.EDU SASL SSF: 56 SASL data security layer installed. dn:uid=netmon@test.net.isc.upenn.edu,cn=test.net.isc.upenn.edu,cn=gssapi,cn=auth However, a change to the regexp on the development system will cause mapping to work there: authz-regexp uid=(.*)(a)TEST.NET.ISC.UPENN.EDU,cn=TEST.NET.ISC.UPENN.EDU,cn=gssapi,cn=auth ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}$1@TEST.NET.ISC.UPENN.EDU) $ ldapwhoami -Y GSSAPI -U netmon -H ldaps://pennid-dev.net.isc.upenn.edu SASL/GSSAPI authentication started SASL username: netmon(a)TEST.NET.ISC.UPENN.EDU SASL SSF: 56 SASL data security layer installed. dn:uid=netmon,ou=entities,dc=upenn,dc=edu But a similar regexp in production will not map properly: authz-regexp uid=(.*)(a)UPENN.EDU,cn=UPENN.EDU,cn=gssapi,cn=auth ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}$1@UPENN.EDU) ldapwhoami -Y GSSAPI -U netmon -H ldaps://pennid.upenn.edu SASL/GSSAPI authentication started SASL username: netmon(a)UPENN.EDU SASL SSF: 56 SASL data security layer installed. dn:uid=netmon,cn=upenn.edu,cn=gssapi,cn=auth Can anyone shed light on the different behavior? - only the authz-regexp has been modified - slapd was restarted after the changes. Thanks, Peter

1 0

Re: Slapd is coming down
by Édnei Rodrigues 25 Aug '15

25 Aug '15

I have two process because I am replicating the production three to this environment ( dev, port 1389) and I have a translucent service to overlap a few attributes (port 389 ). Thanks. Em 20/08/2015 15:43, "Quanah Gibson-Mount" <quanah(a)zimbra.com> escreveu: > --On Thursday, August 20, 2015 4:00 PM -0300 Édnei Rodrigues < > ednei.felipe.rodrigues(a)gmail.com> wrote: > > >> Hello quanah! >> Yes, I know, my SO killed the slapd because it was configured. >> But I don't have any other service in the server, only the openldap. >> > > Why do you have two slapd processes on the server? Your setup seems > somewhat odd. > > --Quanah > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 1

How to create multiple schema at the same level in openldap
by PRATIK SINGAL 25 Aug '15

25 Aug '15

Hello all, Can any one help me on how the schema files will be created where multiple schema can be present at the same level.Below is the diagram where Schema C And Schema D are two Schema which needs to be present at the same third level under Schema B. Schema A | Schema B | | Schema C Schema D Regards, Pratik

2 1

Centos 7/openldap/samba
by Alex Moen 25 Aug '15

25 Aug '15

Setting up a new openldap server on Centos 7. I am trying to add the samba.schema that comes with samba. I got the schema file from the newest distribution of Samba, copied it to /etc/openldap/schema, and ran "ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/samba.schema". This command worked perfectly with the cosine and inetorgperson schema files, but I got an 'invalid format (line 1) entry: ""' response. I grepped the internet for this response, and found that some people have needed to change all "attryibutetype" entries to "attributetype:". So, I did that. It got me to line 2, where the leading descriptor is "DESC". I changed all the "DESC" to "DESC:", which was also helpful and moved me on to line 3, and so on. So, now I have gotten to line 236, which is an objectclass statement, so I am lost. None of the other files that worked with this exact same command syntax has any of the colons on the descriptors (IDK what they are really called), so I wonder if I'm not barking up the wrong tree. I also can't find anything on the net that speaks to this issue, so I am guessing that I probably have some other problem with the server. Any suggestions??? TIA! Alex -- Alex Moen NSTII North Dakota Telephone Company 701-662-6481

3 2

Group of groups wiith posfix
by Jose Legido 25 Aug '15

25 Aug '15

Hello I have debian machine configured sudo with ldap group. The ldap group is objectclass posixGroup and the users memberUid. I want to put groups instead of users. It's possible? Thank you

1 0

LDAP proxy issue
by jason cafarelli 24 Aug '15

24 Aug '15

note: Apologize if this dupes; think i sent original out before i was approved on mailing list. A bit stuck; bear with me; somewhat of a LDAP nubbie; sure i am missing something simple, Trying to get a local server to AUTH locally to its own openldap-server and then proxy to corporate LDAP if user is not found locally. 1. Local users work 2. AUTH to local LDAP server works 3. AUTH to corporate LDAP does NOT work 4. LDAP search to corporate works when using local server (ack!?!) user = corporate LDAP account internal ldap = users - internal.com corporate ldap = people - datacenter.corporate.com note: anonymous bind is enabled on corporate. oot@ sssd]# ldapsearch -h 127.0.0.1 -x -b "uid=user,ou=people,dc=datacenter,dc=corporate,dc=com" # extended LDIF # # LDAPv3 # base <uid=user,ou=people,dc=datacenter,dc=corporate,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # user, People, datacenter.corporate.com dn: uid=user,ou=People,dc=datacenter,dc=corporate,dc=com uid: user cn: objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowMax: shadowWarning: loginShell: /bin/bash uidNumber: gidNumber: homeDirectory: /home/users/user gecos: user shadowLastChange: 16461 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Setup slap.d; ####################################################################### # database definitions ####################################################################### database bdb suffix "dc=internal,dc=com" checkpoint 1024 15 rootdn "cn=adm,dc=internal,dc=com" rootpw {SSHA}aaaaa directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM #proxy ldap database ldap suffix "ou=People,dc=datacenter,dc=corp,dc=com" uri "ldap://1.1.1.1:389/" idassert-bind bindmethod=none ldap.conf URI ldap://127.0.0.1 BASE dc=internal,dc=com

1 0

OpenLDAP 2.4.42 RPMs for Red Hat / CentOS
by Clément OUDOT 24 Aug '15

24 Aug '15

Hi, OpenLDAP 2.4.42 RPMs for Red Hat / CentOS are available on LDAP Tool Box project : http://ltb-project.org/wiki/download#packages_for_red_hatcentos You can see packages description here: http://ltb-project.org/wiki/documentation/openldap-rpm -- Clément OUDOT Consultant en logiciels libres, Expert infrastructure et sécurité Savoir-faire Linux 87, rue de Turbigo - 75003 PARIS

1 0

Re: How to let users change passwords
by robert k Wild 24 Aug '15

24 Aug '15

i feel such a donut! it was because i had a space inbetween the lines of "modify time stamp" and the first "olcaccess", i deleted the space restarted slapd and on the client when i run the command passwd i can successfully change the user password

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical