openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

mirror entries with rewrite?
by Christian Bösch 01 Apr '15

01 Apr '15

Hi, I want to mirror entries from a subtree to another virtual tree. I tried with rwm-rewrite which works for rewriting but I want to keep the real entries. Is therefor rwm-rewrite the wrong approach or is that possible? Thanks in advance, Chris

1 0

Sorting the NAME Attribute
by Tim Gustafson 01 Apr '15

01 Apr '15

In the following post: http://www.openldap.org/cgi-bin/wilma_hiliter/openldap-technical/201001/msg… Quanah said: > However, I will note, the definitions of these attributes are RFC > defined. They have no ORDERING rule on purpose. I was not able to find what that purpose was. Does anyone have any idea why it was decided that something as critical as "name" attributes shouldn't have an ORDERING rule? In my case, I have users who have a lower-case first-letter in their last name, which makes them appear at the bottom of all lists of people when sorted on the LDAP server. Needless to say, this makes them unhappy. For most of my purposes, I simply sort the data in my code once it is retrieved from the LDAP server, but in some cases I don't have control over the software being used and therefore can't change it, and in other cases this is terribly inefficient or impractical. Other than "because the RFC says so", what's the reasoning behind not defining an ORDERING rule for "name" attributes", preferably one that is case-insensitive? Could it at least be made a build option to enable or disable an ORDERING rule on at least that attribute (or perhaps in a more general configurable way for other attributes as well), even if it's not truly RFC-compliant? -- Tim Gustafson tjg(a)ucsc.edu 831-459-5354 Baskin Engineering, Room 313A

1 1

disable logins with ACLs
by Igor Shmukler 31 Mar '15

31 Mar '15

Hello, I am trying to disable user logins for expired trial users. After searching online, finally found a useful thread from this very list archived http://www.openldap.org/lists/openldap-technical/201111/msg00165.html I accidentally tried to mess with userPassword hash, but it did not work me. Since in that thread Michael showed/shared a better way to achieve the same goal of disabling users with ACLs, I am trying to copy his method. I attempted to follow Michael's example. It has not worked yet. Below is my script: dn: olcDatabase={3}hdb,cn=config changetype: modify replace: olcAccess olcAccess: {0}to attrs=userPassword,shadowLastChange filter=(&(objectClass=inetOrgPerson)(serviceLevel=suspended)) by dn="cn=config" write by * none olcAccess: {1}to attrs=userPassword,shadowLastChange filter=(&(objectClass=inetOrgPerson)(!(serviceLevel=suspended))) by self write by anonymous auth by dn="cn=admin,dc=directory,dc=apple,dc=com" write by dn="cn=config" write by * none olcAccess: {2}to dn.base="" by * read olcAccess: {3}to * filter=(&(objectClass=inetOrgPerson)(serviceLevel=suspended)) by dn="cn=config" write by * none olcAccess: {4}to * filter=(&(objectClass=inetOrgPerson)(!(serviceLevel=suspended))) by self write by dn="cn=admin,dc=directory,dc=apple,dc=com" write by dn="cn=config" write by * read Currently, ldapmodify(1) is failing with an implementation specific error, likely due to messed-up syntax or something. The additional info: <olcAccess> handler exited with 1 Michael's example is not written for OLC, so I managed to do something wrong. Any ideas? Thank you, Igor Shmukler

1 0

sane ppolicy choices
by Igor Shmukler 31 Mar '15

31 Mar '15

Hello, I am trying to implement a trial [period] for new customers, using the OpenLDAP password policy overlay. I was thinking about setting a combination of pwdMaxAge, pwdMustChange and pwdAllowUserChange. Basically, the best idea I have had is to set MaxAge to the length of trial [in seconds] then in a user changes the password while in trial mode, calculate MaxAge as (trial_length - time_passed), then at the end setting MustChange to true and AllowUserChange to false [until the trial has been converted]. Is that a sane policy? Should I be doing something totally different? Please advise. Sincerely, Igor Shmukler

3 5

Re: Q: different SSF settings for ldapi:// than for ldap:
by Michael Ströder 30 Mar '15

30 Mar '15

Ulrich Windl wrote: > Isn't the SSF strength for ldapi:// zero? The SSF strength of ldapi:// is whatever you set with configuration directive localSSF. It's your local security policy decision. Personally on my systems I don't see any problem with setting it to an equal strength like a strongly encrypted TLS connection. YMMV. Ciao, Michael.

1 0

Re: Antw: Re: Q: different SSF settings for ldapi:// than for ldap:
by Michael Ströder 30 Mar '15

30 Mar '15

Ulrich Windl wrote: >>>> Michael Ströder<michael(a)stroeder.com> schrieb am 30.03.2015 um 11:24 in > Nachricht <55191633.90204(a)stroeder.com>: >> Ulrich Windl wrote: >>>>>> Michael Ströder<michael(a)stroeder.com> schrieb am 29.03.2015 um 12:12 in >>>> I have this in my config: >>>> >>>> # SSF value for ldapi:// >>>> localSSF 256 >>> >>> What I don't understand here is: Doesn't "256" _require_ encryption for >>> ldapi:// then? >> >> There is a reason for everything I write, especially this sentence: >> >> >> See slapd.conf(5) for details. >> >> Learn to read the fine docs. > > What really annoys me in this list are answers like "I know, you dont't. Try > to find out yourself!". Is it really too demanding to look up the text yourself when I point out a particular configuration directive *and* point to the relevant man page? My impression was that you did not read the text before asking back. > Here's what the manual page says: > -- > localSSF <SSF> > Specifies the Security Strength Factor (SSF) to be given > local > LDAP sessions, such as those to the ldapi:// listener. For > a > description of SSF values, see sasl-secprops's minssf > option > description. The default is 71. > -- > So where is the answer what 255 means? And what is the meaning of 71? (I guess > 71 bit encryption; so I guess 255 means 255-bit encryption, but you say I'm > wrong) Yes, the default is 71 which is lower than what you specified as minssf. Ciao, Michael.

1 0

Re: Antw: Re: external authentication source
by Hallvard Breien Furuseth 30 Mar '15

30 Mar '15

On 23. mars 2015 12:45, Ulrich Windl wrote: > Related question: If the command above fails with "stronger confidentiality required", and adding "-ZZ" fails with " TLS: hostname does not match CN in peer certificate", how should a proper certificate look like? Read the OpenLDAP Admin Guide, section 16 (TLS). In particular 16.1.1. Server Certificates. -- Hallvard

3 3

installing slapd no_configuration true
by Igor Shmukler 30 Mar '15

30 Mar '15

Hello, I have been trying to install slapd without configuration, so I could do the configuration manually [specifically to customize my "organization" objectClass]. I have been using debconf-set-selections and noninteractive install. It worked fine when I would do non interactive config database configuration and also DIT database configuration. When I set "slapd slapd/no_configuration boolean true" setup fails. The error is below: Omitting slapd configuration as requested. * No configuration file was found for slapd at /etc/ldap/slapd.conf. invoke-rc.d: initscript slapd, action "start" failed. dpkg: error processing package slapd (--configure): subprocess installed post-installation script returned error exit status 1 Processing triggers for ureadahead (0.100.0-16) ... Processing triggers for ufw (0.34~rc-0ubuntu2) ... Errors were encountered while processing: slapd E: Sub-process /usr/bin/dpkg returned an error code (1) I understand that the issue might be debian-related and have little to do with OpenLDAP, per say. Still, to be sure that I did not do something completely wrong, and to tap into collective wisdom; I would love for someone experienced to comment. What would be the easiest way to install slapd, ideally with config database setup, without a DIT database? I want to manually add DIT database[s] later. I got that part down. Sincerely, Igor Shmukler

5 6

Re: Q: different SSF settings for ldapi:// than for ldap:
by Michael Ströder 30 Mar '15

30 Mar '15

Ulrich Windl wrote: >>>> Michael Ströder<michael(a)stroeder.com> schrieb am 29.03.2015 um 12:12 in >> I have this in my config: >> >> # SSF value for ldapi:// >> localSSF 256 > > What I don't understand here is: Doesn't "256" _require_ encryption for > ldapi:// then? There is a reason for everything I write, especially this sentence: >> See slapd.conf(5) for details. Learn to read the fine docs. Ciao, Michael.

1 0

Re: Antw: Re: external authentication source
by Dirk Kastens 30 Mar '15

30 Mar '15

Hi Ulrich, > Thanks for the hint, but I fail to use it: > > First it seems I cannot use it in olcSecurity (as I can use update_ssf), and then I fail to set it at the database level: It's a global option. Just set it as an attribute of cn=config. dn: cn=config olcLocalSSF: 256 Then use ldapsearch without TLS. This should work. Regards, Dirk

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical