openldap-technical

openldap-technical@openldap.org

18 participants
9786 discussions

Re: slapd.conf or OLC (cn=config)
by Eric Fetzer 16 Mar '23

16 Mar '23

Options: Environment="SLAPD_URLS=ldap:/// ldapi:/// ldaps:///" Environment="SLAPD_OPTIONS=-F /etc/openldap/slapd.d" ExecStart=/usr/libexec/slapd -u ldap -g ldap -h ${SLAPD_URLS} $SLAPD_OPTIONS Yes, there is a slapd.d directory. Thanks, Eric On Thu, Mar 16, 2023 at 8:08 AM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Wednesday, March 15, 2023 10:11 AM -0600 Eric Fetzer > <eric.fetzer(a)gmail.com> wrote: > > > > > Looking at my slapd.conf file, I have a bunch of olc settings in it. > > Does that mean I'm OLC? I installed it using this > > site: https://computingforgeeks.com/install-configure-openldap-server- > > centos/ > > What options is slapd running with? Is there a "slapd.d" directory where > its configuration is deployed? > > --Quanah >

2 1

Re: Antw: [EXT] invalid opcode
by Jeffrey Walton 16 Mar '23

16 Mar '23

On Thu, Mar 16, 2023 at 10:08 AM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > --On Saturday, March 11, 2023 7:51 PM +0100 Stefan Kania > <stefan(a)kania-online.de> wrote: > > > For a rootdn > > ------------------- > > dn: olcDatabase={2}mdb,cn=config > > changetype: modify > > replace: olcRootPW > > olcRootPW: > > {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$ZGJmZ2lrbmpiZHZzZ3NhdmRzZw$J6eXYSxY4 > > tDs4l8SdBkIwcAU0OqEEdR0gpFNJ5MSqQs > > ------------------- > > This makes sense, since you can't use the ldapv3 password modify operation > to update this password value. > > > and a posix or simpleSecurityObject: > > ------------------- > > dn: uid=repl-user,ou=users,dc=example,dc=net > > changetype: modify > > replace: userPassword > > userPassword: > > {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$c2FsdHNsYXQ5ODc2NTQzMg$Td51W49s0X74o > > m++/EnMRsP4La3x46KufcGGY01T8+M > > ------------------- > > This doesn't make sense. You should be using an ldapv3 password modify > operation on the user account in question and letting the server do the > hashing (and also allows password policies, if deployed, to be used). If I understand things correctly... The server does not hash the password. The server never gets to see the plaintext password. See https://www.postgresql.org/message-id/379034.1673389287%40sss.pgh.pa.us . Jeff

2 1

slapd.conf or OLC (cn=config)
by Eric Fetzer 16 Mar '23

16 Mar '23

How can I tell which methodology my implementation is using?

2 2

invalid opcode
by Stefan Kania 16 Mar '23

16 Mar '23

Hi to all, I just installed a fresh 2.5 server with the symas-packages and debian 11. I can start the service, but as soon as I try to authenticate for example with: ldapsearch -x -D cn=admin,dc=example,dc=net -W the server crashes, I put the loglevel to "any" and I saw kernel: traps: slapd[18020] trap invalid opcode ip:7febaf26a415 sp:7fc3ad4b69e0 error:0 in libargon2.so.1[7febaf266000+5000] Everytime I try to authenitcate. All packages are up to date. any idea

5 19

Re: Adding to the schema
by Eric Fetzer 09 Mar '23

09 Mar '23

If the other moduleload in there is back_mdb.la, should I also go with ppolicy.la or should I stick with .so? Thanks, Eric On Tue, Mar 7, 2023 at 12:21 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Tuesday, March 7, 2023 12:16 PM -0700 Eric Fetzer > <eric.fetzer(a)gmail.com> wrote: > > > > > I'm using 2.6.4. Sorry, brand new at this, how do I enable it? I > > don't see any references to it in the slapd.conf... I'm in the process > > of converting an ISDS db to OpenLDAP. Kind of daunting so far... > > > Generally speaking: > > In the portion of your configuration loading module: > > modulepath .... > moduleload ppolicy.so > > > In the database section of your configuration where you want to apply > password policies > > > database mdb > ... > > overlay ppolicy > > > Regards, > Quanah > > >

2 1

RoleOccupant filter
by forumforeign 09 Mar '23

09 Mar '23

Hello. I have LDAP groups which keep users inside. Here an example of group: # developer, roles, domain.com dn: cn=developer,ou=roles,dc=domain,dc=com objectClass: organizationalRole cn: developer roleOccupant: uid=user1,ou=people,dc=domain,dc=com roleOccupant: uid=user2,ou=people,dc=domain,dc=com I need to make a search filter, which can say, if certain user belong to group? Or does certain group have a user? Next filter give all uids of group developer: openldapsearch -v -H ldaps://<ldap_host> -x -b 'dc=domain,dc=com' -W -D "cn=vmail,ou=services,dc=domain,dc=com" '(&(objectClass=organizationalRole)(cn=developer))' RoleOccupant When I try to add 'uid' to filter it doesn't return any records: '(&(objectClass=organizationalRole)(cn=developer)(uid=user1,ou=people,dc=domain,dc=com))' RoleOccupant '(&(objectClass=organizationalRole)(cn=developer)(uid=user1,ou=people,dc=domain,dc=com))' '(&(objectClass=organizationalRole)(cn=developer)(uid=user1*))' RoleOccupant How I can change filter, that check if user1 belong to group developer?

3 5

Re: Adding to the schema
by Eric Fetzer 08 Mar '23

08 Mar '23

Is the ... where I set the policy? _______________________________________________________ In the database section of your configuration where you want to apply password policies database mdb ...HERE... overlay policy ________________________________________________________ Thanks, Eric On Tue, Mar 7, 2023 at 12:21 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Tuesday, March 7, 2023 12:16 PM -0700 Eric Fetzer > <eric.fetzer(a)gmail.com> wrote: > > > > > I'm using 2.6.4. Sorry, brand new at this, how do I enable it? I > > don't see any references to it in the slapd.conf... I'm in the process > > of converting an ISDS db to OpenLDAP. Kind of daunting so far... > > > Generally speaking: > > In the portion of your configuration loading module: > > modulepath .... > moduleload ppolicy.so > > > In the database section of your configuration where you want to apply > password policies > > > database mdb > ... > > overlay ppolicy > > > Regards, > Quanah > > >

2 1

Re: Backup Mirrormode setup
by Meike Stone 08 Mar '23

08 Mar '23

Am Mi., 16. März 2022 um 21:39 Uhr schrieb Quanah Gibson-Mount <quanah(a)fast-mail.org>: > > > > --On Wednesday, March 16, 2022 10:23 PM +0100 Meike Stone > <meike.stone(a)googlemail.com> wrote: > > > > > We are still using the bdb backend and the latest 2.4.59 (don't ask, > > it will be replaced soon) and I remember, a "few" years ago, I had > > problems with slapcat and online databases, because the server was > > stucking for a while and answers were delayed .. > > (The Admin Guide tells, that "Backups are managed slightly differently" > > ...) Secondly, while offline, I can copy the whole database directory > > including the transaction logs .. > > Ah, ok. Yes, you could set up a read-only consumer node to take backups > from. I'd highly prioritize moving to a supported release of OpenLDAP with > the back-mdb backend as well (I see you say it should be replaced soon). :) > Oh my god, almost a year has passed - now finally our department wants to migrate to the latest version 2.5.14. I'm responsible for the Master LDAP-Server, but there are a few ro-replicas in other departments where I'm not responsible - and I have no access. Is it possible to migrate the master server to the new version and update the replicas (running 2.4.59) later, independent from the master (migration)? Are there any problems to be expected? Regards and many thanks Meike

2 1

dynlist's +memberOf attribute not searchable/fetchable with anonymous binds
by Michal Soltys 08 Mar '23

08 Mar '23

Hi, Consider following simple dynlist config (v2.5.13): groupOfURLs labeledURI uniqueMember+memberOf@groupOfUniqueNames So for static groups we get a dynamic memberOf for each user that is a member of some static group, for example: DN: cn=TouK,ou=TouK,ou=Group,dc=touk,dc=pl ... uniqueMember: cn=Michał Sołtys,ou=Touki,ou=People,dc=touk,dc=pl DN: cn=Michał Sołtys,ou=Touki,ou=People,dc=touk,dc=pl ... memberOf: cn=touk,ou=touk,ou=group,dc=touk,dc=pl Now this works fine if we bind with a user and do a search. But if we do an anonymous search no memberOf is returned or searchable by. For example: assume following ACLs at the top: {0}to * by dn=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break {1}to dn.subtree=ou=People,dc=touk,dc=pl attrs=entry,entryUUID,memberOf,@toukAnonAccess by anonymous =scr by * break {2}to dn.subtree=ou=Group,dc=touk,dc=pl attrs=entry,@groupOfUniqueNames,@groupOfNames by anonymous =scr by * break ... and the following search: ldapsearch -x -H ldaps://ldap.touk.pl -s sub -b 'ou=Touki,ou=People,dc=touk,dc=pl' -o ldif-wrap=no -LLL -v memberOf entryUUID we get the following results: ldap_initialize( ldaps://ldap.touk.pl:636/??base ) filter: (objectclass=*) requesting: memberOf entryUUID dn: ou=Touki,ou=People,dc=touk,dc=pl entryUUID: 6be7e4f8-a800-103a-9fd7-3100241d53c2 dn: cn=Jan Gajl,ou=Touki,ou=People,dc=touk,dc=pl entryUUID: 6c39df1a-a800-103a-8089-3100241d53c2 Why is memberOf omitted with anonymous binds when search explicitly (or implicitly via +) requests it and acls grant required rights ? With explicit binds or EXTERNAL - memberOf is returned (and searchable) correctly. Is there something else that is required for memberOf to work with anonymous binds ?

1 1

Re: Adding to the schema
by Eric Fetzer 07 Mar '23

07 Mar '23

So by configuration loading module, do you mean the slapd.ldif file? If so, since I already loaded it, can I modify and reload it or would that not work? If that's the case, can I load just a subset of it? Thanks, Eric On Tue, Mar 7, 2023 at 12:21 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Tuesday, March 7, 2023 12:16 PM -0700 Eric Fetzer > <eric.fetzer(a)gmail.com> wrote: > > > > > I'm using 2.6.4. Sorry, brand new at this, how do I enable it? I > > don't see any references to it in the slapd.conf... I'm in the process > > of converting an ISDS db to OpenLDAP. Kind of daunting so far... > > > Generally speaking: > > In the portion of your configuration loading module: > > modulepath .... > moduleload ppolicy.so > > > In the database section of your configuration where you want to apply > password policies > > > database mdb > ... > > overlay ppolicy > > > Regards, > Quanah > > >

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical