openldap-technical

openldap-technical@openldap.org

9 participants
9902 discussions

proxy to AD does not work during login client machine
by Leo Xiao 17 Jun '15

17 Jun '15

Hi technical, I hit a problem during configure proxy to AD. I can run command: $ldapsearch -x -h localhost -LLL -b dc=mydomain,dc=local -D cn=open,cn=users,dc=mydomain,dc=local -W "(cn=open1)" cn sAMAccountName which return the SAMACCOUNTNAME:open successfully. --- This may mean the proxy works well. But if I run command with out -D -D cn=open,cn=users,dc=mydomain,dc=local. The search will failed. when I try to login my client machine with AD user. It always failed. --- I can login with openldapuser successfully. I think I need some configuration to force the -D in slapd.con. Is there any problems with my slapd.conf? Or any trouble shooting comments? Appreciate it very much. Below is my slapd.conf: ####################################################################### # database definitions ####################################################################### database ldap suffix "DC=mydomain,DC=local" uri ldap://dc-ad.mydomain.local/ chase-referrals no rebind-as-user yes idassert-bind bindmethod=simple binddn="CN=open,OU=users,DC=mydomain,DC=local" credentials=open mode=none flags=non-prescriptive idassert-authzFrom "*" Thanks, Leo

2 4

authentication with SSL
by Bharath K 16 Jun '15

16 Jun '15

i am trying to accesses on specific web pages and use LDAP users for authentication with SSL connection.but i am getting error like my username which is stored in ldap database user name:cdac password:cdac123 but when i authenticate i am getting below error user cdac: authentication failure for "/": Password Mismatch [2446] auth_ldap authenticate: user test1 authentication failed; URI / [LDAP: ldap_simple_bind_s() failed][Invalid credentials] please help me..............

1 0

problem using redundant ldap servers with keystone
by Chris Card 15 Jun '15

15 Jun '15

Hi, I have an HA OpenStack installation with a keystone domain backed by an LDAP server. I want to make the installation resilient in the case of an LDAP server failure, so I have configured keystone with a space-separated list of LDAP server urls in the [ldap] url option. This configuration appears to work well if I e.g. stop slapd on one of the LDAP servers - I can login to horizon as a user from the LDAP directory as long as one of the LDAP servers is running slapd. But if I shutdown one of the LDAP servers, login to horizon fails and the browser (chrome in this case) says "No data received". I've turned on debug logging in keystone, and as far as I can see the LDAP requests are still working; indeed cli commands like "openstack user list --domain <domain>" which get data from LDAP still work. Any ideas? [openstack juno, centos 7, keystone and horizon running as wsgi apps under Apache] Chris

1 1

AW: problem with olcAccess - can not change own userPassword field
by Stefan Bauer 14 Jun '15

14 Jun '15

Hi Ryan, thank you. Stefan -----Ursprüngliche Nachricht----- Von: Ryan Tandy <ryan(a)nardis.ca> Gesendet: Son 14 Juni 2015 00:59 An: Stefan Bauer <sb(a)plzk.de> CC: openldap-technical(a)openldap.org Betreff: Re: problem with olcAccess - can not change own userPassword field On Thu, Jun 11, 2015 at 02:12:19PM +0200, Stefan Bauer wrote: >olcAccess: {0}to * by * read by * break "by * read" matches everyone, and stops. "by * break" is never reached. >olcAccess: {1}to dn.subtree="ou=Benutzer,dc=example,dc=com" attrs=userPassword by self write by * break This rule is never reached, because everyone is matched by "by * read" (with "stop" implicit) above.

1 0

Re: Syncrepl issue with one node
by Quanah Gibson-Mount 14 Jun '15

14 Jun '15

--On Tuesday, June 09, 2015 8:50 AM -0500 espeake(a)oreillyauto.com wrote: > > We are running openLDAP 2.4.39 in an MMR replication on Ubuntu 14.04. I > have one node that is not wanting to sync with other nodes giving the > following error: > > Jun 9 06:51:35 tn-ldap-a-1 slapd[3138]: do_syncrep2: rid=005 CSN too old, > ignoring 20150609115135.153480Z#000000#003#000000 > > As you can see the CSN shows the exact same time the time that is being > logged. We are in the U.S. Central timezone. I have checked our ntp > service on my three nodes. All three are pointed to the same ntp and are > in sync. Would be possible that one node might still be just a few > miliseconds too fast and the csn timestamp would appear wrong? Is there a > logging level I can set for that specific issue? I am currently logging > the sync records. I can go to debug in needed. a) Please don't resend your emails to the list. The first one got through fine, which you could easily verify by looking at the list archives. b) Not enough information provided here to go on. Are all server IDs unique? Are all syncrepl clauses unique per DB? Personally I've never found ntpd particularly good at keeping clocks in sync. I've generally resorted to running ntpdate frequently out of cron, particularly for VMs. --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

3 3

why is userPassword transferred binary?
by Jephte Clain 14 Jun '15

14 Jun '15

hello, just wondering: when I ldapsearch the userPassword attribute, it is returned as binary: $ ldapsearch -LLL -H "ldap://xxx:389/" -x -D xxx -W "(uid=xxx)" userPassword dn: uid=xxx,dc=domain,dc=tld userPassword:: Z290Y2hhCg== however, I created a new attribute with the same schema as userPassword: attributetype ( runUniv:1.1.2 NAME 'runUnivPassword' DESC 'RFC2256/2307 password for special needs' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128} ) when I search this attribute, it is returned as text: $ ldapsearch -LLL -H "ldap://xxx:389/" -x -D xxx -W "(uid=xxx)" runUnivPassword dn: uid=xxx,dc=domain,dc=tld runUnivPassword: gotcha so my question is: does ldapsearch process userPassword as a special case and ask for binary transfer type? or does slapd return userPassword as binary by default? if so, how do I configure runUnivPassword to be handled the same? thanks in advance. best regards, -- *Jephté CLAIN | Développeur, Intégrateur d'applications* Service Systèmes d'Information Direction des Systèmes d'Information <http://numerique.univ-reunion.fr> Tél: +262 262 93 86 31 <tel:+262262938631> || Gsm: +262 692 29 58 24 <tel:+262692295824> www.univ-reunion.fr <http://www.univ-reunion.fr> || Facebook <http://www.facebook.com/pages/Universit%C3%A9-de-La-R%C3%A9union-OFFICIEL/1…> || Twitter <http://twitter.com/univ_reunion>

3 4

problem with olcAccess - can not change own userPassword field
by Stefan Bauer 13 Jun '15

13 Jun '15

Dear Users, I'm trying to change my own password in field userPassword with some gui and receive access denied - permission denied message. The access rules are .. and I'm binding with "cn=benutzer1,ou=Benutzer,dc=example,dc=com" olcAccess: {0}to * by * read by * break olcAccess: {1}to dn.subtree="ou=Benutzer,dc=example,dc=com" attrs=userPassword by self write by * break What do i miss? # benutzer1, Benutzer, example.com dn: cn=benutzer1,ou=Benutzer,dc=example,dc=com cn: benutzer1 objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top objectClass: posixAccount sn: Mustermann gidNumber: 777 homeDirectory: /home/benutzer1 uid: benutzer1 uidNumber: 777 loginShell: /bin/bash userPassword:: known # {2}bdb, config dn: olcDatabase={2}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=example,dc=com olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=Manager,dc=example,dc=com olcRootPW:: known olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbCacheSize: 1000 olcDbCheckpoint: 1024 15 olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass pres,eq olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: uidNumber pres,eq olcDbIndex: gidNumber pres,eq olcDbIndex: mail pres,eq,sub olcDbIndex: ou pres,eq,sub olcDbIndex: loginShell pres,eq olcDbIndex: sn pres,eq,sub olcDbIndex: givenName pres,eq,sub olcDbIndex: memberUid pres,eq,sub olcDbIndex: nisMapName pres,eq,sub olcDbIndex: nisMapEntry pres,eq,sub olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 olcAccess: {0}to * by * read by * break olcAccess: {1}to dn.subtree="ou=Benutzer,dc=example,dc=com" attrs=userPassword by self write by * break

2 1

process slapd 99 % CPU
by Fabián M Sales 11 Jun '15

11 Jun '15

Hello, I have problem with My LDAP-server. The process /usr/sbin/slapd the process consumes 99% cpu, As you can see it? I enable the logs but can not find the problem, because this sometimes 99% and sometimes remains low. It is at times. Sorry for My poor English, -- Firma Institucional *Fabián* *M. Sales *Soporte Técnico & I.T.I Linux *DonWeb * La Actitud Es Todo www.DonWeb.com ------------------------------------------------------------------------ Nota de confidencialidad: Este mensaje y archivos adjuntos al mismo son confidenciales, de uso exclusivo para el destinatario del mismo. La divulgación y/o uso del mismo sin autorización por parte de DonWeb.com queda prohibida. DonWeb.com no se hace responsable del mensaje por la falsificación y/o alteración del mismo. De no ser Ud el destinatario del mismo y lo ha recibido por error, por favor, notifique al remitente y elim?elo de su sistema. Confidentiality Note: This message and any attachments (the message) are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited by DonWeb.com. DonWeb.com shall not be liable for the message if altered or falsified. If you are not the intended addressee of this message, please cancel it immediately and inform the sender Nota de Confidencialidade: Esta mensagem e seus eventuais anexos podem conter dados confidenciais ou privilegiados. Se você os recebeu por engano ou não é um dos destinatários aos quais ela foi endereçada, por favor destrua-a e a todos os seus eventuais anexos ou copias realizadas, imediatamente. É proibida a retenção, distribuição, divulgação ou utilização de quaisquer informações aqui contidas. Por favor, informenos sobre o recebimento indevido desta mensagem, retornando-a para o autor.

2 1

bdb_equality_candidates: (uniqueMember) not indexed
by Fabián M Sales 11 Jun '15

11 Jun '15

Hello list. :) I have got this error y My logs: bdb_equality_candidates: (uniqueMember) not indexed How create this index uniqueMember? I create a ldif file, as it should be? Steps anyone know? Thanks- -- Firma Institucional *Fabián* *M. Sales *Soporte Técnico & I.T.I Linux *DonWeb * La Actitud Es Todo www.DonWeb.com ------------------------------------------------------------------------ Nota de confidencialidad: Este mensaje y archivos adjuntos al mismo son confidenciales, de uso exclusivo para el destinatario del mismo. La divulgación y/o uso del mismo sin autorización por parte de DonWeb.com queda prohibida. DonWeb.com no se hace responsable del mensaje por la falsificación y/o alteración del mismo. De no ser Ud el destinatario del mismo y lo ha recibido por error, por favor, notifique al remitente y elim?elo de su sistema. Confidentiality Note: This message and any attachments (the message) are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited by DonWeb.com. DonWeb.com shall not be liable for the message if altered or falsified. If you are not the intended addressee of this message, please cancel it immediately and inform the sender Nota de Confidencialidade: Esta mensagem e seus eventuais anexos podem conter dados confidenciais ou privilegiados. Se você os recebeu por engano ou não é um dos destinatários aos quais ela foi endereçada, por favor destrua-a e a todos os seus eventuais anexos ou copias realizadas, imediatamente. É proibida a retenção, distribuição, divulgação ou utilização de quaisquer informações aqui contidas. Por favor, informenos sobre o recebimento indevido desta mensagem, retornando-a para o autor.

3 3

olcMirrorMode FALSE - yet - error code 53 - shadow context; no update referral
by lejeczek 11 Jun '15

11 Jun '15

hi everybody one of databases in my slapd has nor referrals and olcMirrorMode=FALSE in config yet I get infamous: - [LDAP: error code 53 - shadow context; no update referral] why would it be, something I am missing in the config of that database? other databases configs affect this one somehow? many thanks

4 5

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical