openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

Re: external authentication source
by Hallvard Breien Furuseth 12 Mar '15

12 Mar '15

On 12. mars 2015 14:13, Mattes wrote: > Wouldn't "lapwhoami -Y EXTERNAL -H ldapi://" be more usefull? Duh, right. (ldapwhoami) -- Hallvard

1 0

question about binding to our new openldap server
by Wang, Hui 11 Mar '15

11 Mar '15

Hi We just upgrade our OS system and installed the most recent openldap version: 2.4.4. I moved the config file and related openldap data files from older version 2.3.4 onto this new server. I can't make successful binding at this moment. The following is from the log file. Should I install the same version of openldap on this new box since I am trying to binding with old data file? Thank you all. Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 fd=10 ACCEPT from IP=130.*.*.*:61404 (IP=0.0.0.0:389) Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=0 BIND dn="" method=128 Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=0 RESULT tag=97 err=0 text= Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=1 SRCH base="ou=Auth,o=csun" scope=0 deref=0 filter="(objectClass=*)" Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=1 SRCH attr=1.1 Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text= Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=2 SRCH base="ou=Auth,o=csun" scope=0 deref=0 filter="(objectClass=*)" Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=2 SEARCH RESULT tag=101 err=32 nentries=0 text= Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=3 SRCH base="ou=Auth,o=csun" scope=1 deref=0 filter="(objectClass=*)" Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=3 SRCH attr=objectclass subschemaSubentry Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=3 SEARCH RESULT tag=101 err=32 nentries=0 text= Mar 11 13:22:05 oldaptest01 slapd[28623]: conn=1040 fd=13 ACCEPT from IP=130.*.*.*:62211 (IP=0.0.0.0:389) Mar 11 13:22:05 oldaptest01 slapd[28623]: conn=1040 op=0 BIND dn="cn=directory manager,o=csun" method=128 Mar 11 13:22:05 oldaptest01 slapd[28623]: conn=1040 op=0 RESULT tag=97 err=49 text= Mar 11 13:22:07 oldaptest01 slapd[28623]: conn=1040 op=1 UNBIND Mar 11 13:22:07 oldaptest01 slapd[28623]: conn=1040 fd=13 closed Mar 11 13:22:08 oldaptest01 slapd[28623]: conn=1041 fd=13 ACCEPT from IP=130.*.*.*:62213 (IP=0.0.0.0:389) Mar 11 13:22:08 oldaptest01 slapd[28623]: conn=1041 op=0 BIND dn="cn=directory manager,o=csun" method=128 Mar 11 13:22:08 oldaptest01 slapd[28623]: conn=1041 op=0 RESULT tag=97 err=49 text= Mar 11 13:22:09 oldaptest01 slapd[28623]: conn=1041 op=1 UNBIND Mar 11 13:22:09 oldaptest01 slapd[28623]: conn=1041 fd=13 closed Hui Wang CSUN IT department

3 2

could not bind to openldap
by Wang, Hui 11 Mar '15

11 Mar '15

Hi We just installed openldap on a new server. I could not bind to it. I tried with anonymous user and also the user from the default conf file. But doesn't work. Can anyone help? Here is my conf file and my logs database bdb suffix "dc=my-domain,dc=com" rootdn "cn=Manager,dc=my-domain,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. # directory /usr/local/var/openldap-data directory /usr/local/var/openldap-data/defaultFromServerInstall # Indices to maintain index objectClass eq from log file: Mar 11 13:45:36 oldaptest01 slapd[27984]: slapd starting Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 fd=10 ACCEPT from IP=130.*.*.*:54015 (IP=0.0.0.0:389) Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=0 BIND dn="" method=128 Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=0 RESULT tag=97 err=0 text= Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=1 SRCH base="dc=my-domain,dc=com" scope=0 deref=0 filter="(objectClass=*)" Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=1 SRCH attr=1.1 Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text= Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=2 SRCH base="dc=my-domain,dc=com" scope=0 deref=0 filter="(objectClass=*)" Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=2 SEARCH RESULT tag=101 err=32 nentries=0 text= Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=3 SRCH base="dc=my-domain,dc=com" scope=1 deref=0 filter="(objectClass=*)" Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=3 SRCH attr=objectclass subschemaSubentry Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=3 SEARCH RESULT tag=101 err=32 nentries=0 text= Mar 11 13:50:52 oldaptest01 slapd[27984]: conn=1001 fd=13 ACCEPT from IP=130.*.*.*:62744 (IP=0.0.0.0:389) Mar 11 13:50:52 oldaptest01 slapd[27984]: conn=1001 op=0 BIND dn="cn=Manager,dc=my-domain,dc=com" method=128 Mar 11 13:50:52 oldaptest01 slapd[27984]: conn=1001 op=0 RESULT tag=97 err=49 text= Mar 11 13:50:53 oldaptest01 slapd[27984]: conn=1001 op=1 UNBIND Mar 11 13:50:53 oldaptest01 slapd[27984]: conn=1001 fd=13 closed Hui Wang (Holly) CSUN IT Department Identity and Directory Service 818-677-2031 holly.wang(a)csun.edu

1 0

ppolicy configuration
by Igor Shmukler 10 Mar '15

10 Mar '15

Hello, I am trying to apply per domain password policy. [At some point, it seems, these scripts worked for me, but I must have messed something up either in the setup or the scripts.] I managed to load ppolicy.la and from lsof(8), I can see it. Now, I want to be able to turn password policy on each domain. I have a simple script invoked as: $sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f ppolicy.ldif The ppolicy.ldif is: dn: olcOverlay=ppolicy,olcDatabase={2}hdb,cn=config changetype: add objectClass: olcPPolicyConfig olcOverlay: ppolicy olcPPolicyDefault: cn=ppolicy,ou=policies,dc=example,dc=com olcPPolicyUseLockout: TRUE olcPPolicyHashCleartext: TRUE When I try to add the online configuration, I get: SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "olcOverlay=ppolicy,olcDatabase={2}hdb,cn=config" ldap_add: Other (e.g., implementation specific) error (80) additional info: User Schema load failed for attribute "pwdAttribute". Error code 17: attribute type undefined I also have an LDIF for default policy, added as: $ldapadd -x -D cn=admin,dc=example,dc=com -W -f default_ppolicy.ldif It contains: dn: ou=policies,dc=example,dc=com objectClass: top objectClass: organizationalUnit ou: policies dn: cn=ppolicy,ou=policies,dc=example,dc=com objectClass: top objectClass: device objectClass: pwdPolicyChecker objectClass: pwdPolicy cn: ppolicy pwdAttribute: userPassword pwdInHistory: 8 pwdMinLength: 8 pwdMaxFailure: 3 pwdFailureCountInterval: 1800 pwdCheckQuality: 0 pwdMustChange: TRUE pwdGraceAuthNLimit: 0 pwdMaxAge: 7776000 pwdExpireWarning: 1209600 pwdLockoutDuration: 900 pwdLockout: TRUE When I try to add default_ppolicy.ldif, I get: adding new entry "ou=policies,dc=example,dc=com" adding new entry "cn=ppolicy,ou=policies,dc=example,dc=com" ldap_add: Invalid syntax (21) additional info: objectClass: value #2 invalid per syntax It seems that OU=policies is created, but CN=ppolicy is not created. Is that right? I have four (4) values for objectClass. How can I find out which one is triggering the error? Any suggestions where I should start looking?! Thank you, Igor Shmukler

3 7

ldap_sasl_bind_s question
by Markus Moeller 05 Mar '15

05 Mar '15

Hi, I try to replace deprecated ldap_bind_s with ldap_sasl_bind_s but I am missing some details about how to do that. With ldap_bind_s I have method as a int and ldap.h has the following defined /* authentication methods available */ #define LDAP_AUTH_NONE ((ber_tag_t) 0x00U) /* no authentication */ #define LDAP_AUTH_SIMPLE ((ber_tag_t) 0x80U) /* context specific + primitive */ #define LDAP_AUTH_SASL ((ber_tag_t) 0xa3U) /* context specific + constructed */ #define LDAP_AUTH_KRBV4 ((ber_tag_t) 0xffU) /* means do both of the following */ #define LDAP_AUTH_KRBV41 ((ber_tag_t) 0x81U) /* context specific + primitive */ #define LDAP_AUTH_KRBV42 ((ber_tag_t) 0x82U) /* context specific + primitive */ but in ldap_sasl_bind_s it is a char variable and I do not know what the value would be for the above auth methods. Where can I find them documented ? int ldap_sasl_bind_s(LDAP *ld, const char *dn, const char *mechanism, struct berval *cred, LDAPControl *sctrls[], LDAPControl *cctrls[], struct berval **servercredp); Thank you Markus

3 5

ldap specifying host attribute
by Rakesh Rajasekharan 04 Mar '15

04 Mar '15

Hi, I am trying to set up a host based authentication. For that ,am modifying the host attribute of existing users through an ldif file as below dn: uid=sam,ou=People,dc=example,dc=com changetype: modify add: objectClass objectClass: hostObject - add: host host: abc host: xyz Is there a way I can put the lidt of hosts in a single line something like this host: xyz abc Thanks, Rakesh

2 3

Re: ACLs using dynlist overlay
by Michael Ströder 04 Mar '15

04 Mar '15

Mattes wrote: > Setting olcLogLevel should do it without restarting. But that will trace _all_ requests, not really > an option on a production system. Looks like I have to clone the database to debug the ACLs. You're testing new ACLs on a production system without having tested them on an isolated test system? This is asking for trouble! Ciao, Michael.

1 0

Error while instaling slapd
by Verónica Ovando 04 Mar '15

04 Mar '15

I need some help for solving this problem when I try to install slapd package on Debian from testing repositories. |Leyendo lista de paquetes... Hecho Creando árbol de dependencias Leyendo la información de estado... Hecho Se instalarán los siguientes paquetes NUEVOS: slapd 0 actualizados, 1 se instalarán, 0 para eliminar y 2 no actualizados. Necesito descargar 1.344 kB de archivos. Se utilizarán 4.091 kB de espacio de disco adicional después de esta operación. Des:1 http://debian.linuxmint.com/latest/ testing/main slapd amd64 2.4.31-1+nmu2+b1 [1.344 kB] Descargados 1.344 kB en 50seg. (26,4 kB/s) Preconfigurando paquetes ... Seleccionando el paquete slapd previamente no seleccionado. (Leyendo la base de datos ... 260763 ficheros o directorios instalados actualmente.) Desempaquetando slapd (de .../slapd_2.4.31-1+nmu2+b1_amd64.deb) ... Procesando disparadores para man-db ... Configurando slapd (2.4.31-1+nmu2+b1) ... Omitting slapd configuration as requested. insserv: warning: script 'K01subversion' missing LSB tags and overrides insserv: warning: script 'subversion' missing LSB tags and overrides [warn] No configuration file was found for slapd at /etc/ldap/slapd.conf. ... (warning). invoke-rc.d: initscript slapd, action "start" failed. dpkg: error al procesar slapd (--configure): el subproceso instalado el script post-installation devolvió el código de salida de error 1 Se encontraron errores al procesar: slapd E: Sub-process /usr/bin/dpkg returned an error code (1) | I do not understand why is trying to find the slapd.conf file, because this versión of slapd(2.4.31) uses cn=config. Thanks in advance.

3 3

problems adding indexs
by Greg Jetter 04 Mar '15

04 Mar '15

Hello: I'm new to openldap and just finished installing it from the ubuntu repository , I added a set of records and now would like to add indexing on some of the record attributes . I read extensively on how to do this , however every attempt ends in failure , I'm not grasping the procedures correctly. I'm using Openldap 2.4 that uses the cn=config method of configuration instead of the slapd.conf file. I created an ldif file containing : dn: olcDatabase={1}hdb,cn=config add: olcDbIndex olcDbIndex: cdmadauserstatus eq using : sudo ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f AddIndexs.ldif it respons with : ldapmodify: wrong attributeType at line 3, entry "olcDatabase={1}hdb,cn=config" Can someone please show me a example of the correct syntax and proper commands to add indexs ? The documentation is pretty clear how to do it using the older method of the config file , but I can't seem to find any working examples of using the new dynamic way . My time is running out I'll have to dump every thing and start with a re build from source if I can't find an answer. thank you for your assistance. Greg contents of olcDatabase={1},cn=config : # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 29ec482d dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=acsalaska,dc=net olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=acsalaska,dc=net" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by self write by dn="cn=admin,dc=acsalaska,dc=net" write by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=acsalaska,dc=net olcRootPW:: e1NTSEF9cHFUS2t1RWorRjYvZk5wYWZveEZVSCtCQk8xclQzc20= olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: uid eq,pres,sub structuralObjectClass: olcHdbConfig entryUUID: 61596770-3b76-1034-8c70-dd19f7d221e0 creatorsName: cn=config createTimestamp: 20150128201708Z entryCSN: 20150128214111.474826Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20150128214111Z

4 4

ACLs using dynlist overlay
by Mattes 04 Mar '15

04 Mar '15

Dear collected list wisdom, I'm trying to set up access control using membership in a dynamic list.I've activated the dynlist overlay and configured it like this: olcDlAttrSet: groupOfURLs memberURL member and installed an ACL: olcAccess: to dn.regex=".+,<some base>" by self read by group/groupOfURLs/member="<group DN>" search Browsing the directory I can see the member attributes being added to the group, but testing access with slapacl I encounter the following error:54ef3976 => bdb_entry_get: found entry: "<group DN>" 54ef3976 <= bdb_entry_get: failed to find attribute member What am I doing wrong? N.B.: I _did_ add member to the list of allowed attributes for a groupOfURLs ... TIA Ralf Mattes

4 9

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical