openldap-technical

openldap-technical@openldap.org

7 participants
9901 discussions

Re: integrate Openldap and Windows Active Directory server 2003
by Clément OUDOT 15 Apr '15

15 Apr '15

2015-04-15 17:48 GMT+02:00 Kaushal Shriyan <kaushalshriyan(a)gmail.com>: > Hi Clement, > > LSC, We proposed a synchronisation mechanism but was rejected since gives a > lot of privileges to the OpenLDAP to change customer data in AD. the > customer don't want it. Is there a way to get over with this specific use > case? > You just need a read-only AD account if you need to sync from AD to OpenLDAP. Clément.

1 0

integrate Openldap and Windows Active Directory server 2003
by Kaushal Shriyan 15 Apr '15

15 Apr '15

Hi, Is there a way to integrate Openldap and Windows Active Directory server 2003 and sync all the Windows AD users in Openldap? Regards, Kaushal

2 1

multiples syncrepl from same host and DB
by julien soula 15 Apr '15

15 Apr '15

hello, I wanted to synchronize 2 branches of a master DB (slapd-2.4.38). So I created 2 olcSyncrepl on the slave : olcSyncrepl: {0}rid=201 provider=ldap://master searchbase="cn=branch1,suffixDB" scope=sub olcSyncrepl: {1}rid=202 provider=ldap://master searchbase="cn=branch2,suffixDB" scope=sub Unfortunatly, it doesn't work. A change on branch2 on the master produces often a "CSN too old" on the slave. After investigating, it seems that the pb comes from the fact there is one contextCSN by DB. So if the sync task on branch1 is the first to process, it updates the contextCSN and therefore the sync task on branch2 thinks that change is not newer. Am I right ? So is there a proper way to achieve what I want ? Thank for any hints, -- Julien << Vous n'avez rien a dire... Parlons-en! >>

3 3

Re: Antw: multiples syncrepl from same host and DB
by julien soula 15 Apr '15

15 Apr '15

On Wed, Apr 15, 2015 at 02:40:37PM +0200, Ulrich Windl wrote: > >>> julien soula <jsoula(a)univ-lille2.fr> schrieb am 15.04.2015 um 13:29 in > Nachricht <20150415112905.GB3225(a)nickel.univ-lille2.fr>: > > hello, > > > > I wanted to synchronize 2 branches of a master DB (slapd-2.4.38). So I > > created 2 olcSyncrepl on the slave : > > > > olcSyncrepl: {0}rid=201 provider=ldap://master > > searchbase="cn=branch1,suffixDB" scope=sub > > olcSyncrepl: {1}rid=202 provider=ldap://master > > searchbase="cn=branch2,suffixDB" scope=sub > > > > Unfortunatly, it doesn't work. A change on branch2 on the master > > produces often a "CSN too old" on the slave. > > > > After investigating, it seems that the pb comes from the fact there is > > one contextCSN by DB. So if the sync task on branch1 is the first to > > process, it updates the contextCSN and therefore the sync task on > > branch2 thinks that change is not newer. Am I right ? > > If the message you are talking about is like this: > slapd[3965]: do_syncrep2: rid=001 CSN too old, ignoring 20150409131449.846699Z#000000#001#000000 (olcDatabase={1}hdb,cn=config) yes > _and_ the CSN received is the CSN sent,... yes > ... then just ignore the message. That is the same server said before: > slapd[3965]: slap_queue_csn: queing 0x7f5f30afcf20 20150409131449.846699Z#000000#001#000000 > > > > > So is there a proper way to achieve what I want ? > > Did you check the databases before and after sync? Are there differences, or are you just worried about the messages? In fact, I first noticed the no-change of the slave then I took a look to the log and saw this message (the only suspect I saw). Is this config supposed to work ? sincerly, -- Julien << Vous n'avez rien a dire... Parlons-en! >>

1 1

Re: multiples syncrepl from same host and DB
by Abdelhamid MEDDEB 15 Apr '15

15 Apr '15

Hi, I don't think so. Try instead: olcSyncrepl: {0}rid=201 provider=ldap://master searchbase="suffixDB" filter="(<a filter who return data in both branch1 and 2>)" ... Reset the data in slave before trying again Maybe it would be better Cheers Le 15/04/2015 14:00, openldap-technical-request(a)openldap.org a écrit : hello, I wanted to synchronize 2 branches of a master DB (slapd-2.4.38). So I created 2 olcSyncrepl on the slave : olcSyncrepl: {0}rid=201 provider=ldap://master searchbase="cn=branch1,suffixDB" scope=sub olcSyncrepl: {1}rid=202 provider=ldap://master searchbase="cn=branch2,suffixDB" scope=sub Unfortunatly, it doesn't work. A change on branch2 on the master produces often a "CSN too old" on the slave. After investigating, it seems that the pb comes from the fact there is one contextCSN by DB. So if the sync task on branch1 is the first to process, it updates the contextCSN and therefore the sync task on branch2 thinks that change is not newer. Am I right ? So is there a proper way to achieve what I want ? -- *Abdelhamid MEDDEB* http://www.meddeb.net

1 0

Re: Help: LDAP using alias to reference value of another attribute
by Quanah Gibson-Mount 14 Apr '15

14 Apr '15

--On Tuesday, April 14, 2015 5:52 PM +0400 Poul Etto <zepouletto(a)gmail.com> wrote: > There are "u" user accounts on the ldap server > We have a number of "s" services that use LDAP to manage user account. > Each service has particular attributes > Each service must be able to access only it's information > Basic services use only the information contained in the standard LDAP > useraccount > Advanced services have dedicated OUs with special attributes > > It is important that each service can accees in RO (no modification) to > only it's information. > That's why we made our LDAP as it is in the attached picture. This is what custom objectClasses and ACLs are for. Here's an example of a directory set up correctly: <https://itservices.stanford.edu/service/directory/datadefs/accounts> Where services are tied to the user object, with their own specific attributes. ACLs can be used to restrict what data a given service can retrieve. --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

can't chang ldap user passwd by self
by rockwang 13 Apr '15

13 Apr '15

hi,guys I just setup a openldap server via compile command as following. ./configure --prefix=/opt/openldap --enable-overlays=mod --enalbe-dynamic=yes --enable-modules=yes --enable-ppolicy=yes slapd.conf as below include /opt/openldap/etc/openldap/schema/core.schema include /opt/openldap/etc/openldap/schema/cosine.schema include /opt/openldap/etc/openldap/schema/inetorgperson.schema include /opt/openldap/etc/openldap/schema/nis.schema include /opt/openldap/etc/openldap/schema/openldap.schema include /opt/openldap/etc/openldap/schema/ppolicy.schema pidfile /opt/openldap/var/run/slapd.pid argsfile /opt/openldap/var/run/slapd.args access to attrs=userPassword by self write by anonymous auth by dn.base="cn=Manager,dc=abc,dc=com" by * none access to * by self write by dn.base="cn=Manager,dc=abc,dc=com" by * read by * none database bdb suffix "dc=abc,dc=com" rootdn "cn=Manager,dc=abc,dc=com" rootpw 12345678 directory /opt/openldap/var/openldap-data index cn,sn,uid pres,eq,approx,sub index objectClass eq loglevel -1 my question is user can't change his own password. I use following command so I have different result. when not add -x is there error in my config file about acl. I have set pwdRest is true. I need help. thks

4 6

Where are 'attribute names' in the RFC?
by dE 12 Apr '15

12 Apr '15

I was reading https://tools.ietf.org/html/rfc4512; there is a mention of attribute description, but there is no mention of 'attribute name'; or the name using which attributes are referred to. Does such a thing exist or is one of the attribute options used as the name to refer to it or is it in the attribute description?

1 1

ldap_sasl_interactive_bind_s works while ldap_sasl_bind_s does not (GSSAPI bind)
by Osipov, Michael 10 Apr '15

10 Apr '15

Hi folks, I am trying to perform a SASL bind against Active Directory with GSSAPI mech. I wrote a very simple C client which should serve as a proof of concept. I read the man page about both methods [1] and decided to try ldap_sasl_bind_s first. I saw that ldap_sasl_bind_s never sends a Kerberos token to the server (Wireshark capture). Then I tried ldap_sasl_interactive_bind_s as in ldapsearch after fiddler with interact and defaults, which is by the way not very helpful described in the man page, though [2] helped a lot. This one works flawlessly. The difference between both is not really clear to me because we aren't going to use any interactive code. Our goal is to write attribute retrieval for headless libs. A day after, I have downloaded the source tarball and saw that ldap_sasl_bind_s never calls sasl_client_start where ldap_sasl_interactive_bind_s actually does. Additionally, I have found gssapi.c with ldap_int_gss_spnego_bind_s and ldap_gssapi_bind_s where both init the GSS context and loop over the tokens with ldap_sasl_bind_s. Does that ultimately mean that one should avoid ldap_sasl_bind_s altogether and work with ldap_sasl_interactive_bind_s regardless of the mech(s) used? [1] http://www.openldap.org/software/man.cgi?query=ldap_sasl_bind_s&sektion=3&a… [2] http://adam.younglogic.com/2012/02/exteranl-sasl/ Regards, Michael

1 0

can't chang password via simple authentication
by rockwang 09 Apr '15

09 Apr '15

hi,guys I can't chang user password via simple authentication at ldap client. I have set acl rule in slapd.conf. access to attr=userPassword by self write by anonymous auth by dn.base="cn=Manager,dc=abc,dc=com" write by * none access to * by self write by dn.base"cn=Manager,dc=abc,dc=com" write by * read ldappasswd -x -D "uid=bobliu,ou=it,dc=abc,dc=com" -W -S New password: Re-enter new password: Enter LDAP Password: ldap_bind: Invalid credentials (49) but can use ldapsearch via simple authentication. what about problem. thks

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical