openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

make test failure due to libsasl2.so.3 not found
by Guruprasad Kulkarni 19 Nov '14

19 Nov '14

I am using ubuntu 12.04.5 LTS I installed cyrus-sasl-2.1.26 (created symlink from /usr/lib/sasl2 to /usr/local/lib/sasl2) I used the following options for configuration: --enable-debug --enable-hdb --enable-ppolicy --enable-syncprov --with-cyrus-sasl Configuration, make depend and make were successful. I then proceeded to "make test" and I got the error: ../clients/tools/ldapsearch: error while loading shared libraries: libsasl2.so.3: cannot open shared object file: No such file or directory The file libsasl2.so.3 is present in /usr/local/lib I set LDFLAGS="-L/usr/local/lib -L/usr/local/lib/sasl2" Do I need to set some other flags to make the tests work? -Guruprasad

3 3

Re: any help on "ldap_sasl_bind_s failed (53)"
by wailok tam 19 Nov '14

19 Nov '14

thx for your reply. do i put in the slave conf file the same thing as the following command? > ldapsearch -x -H ldap://mail.ier.hit-u.ac.jp -W -D > 'cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp' '(uid=someone)' ------------------------------ On Wed, Nov 19, 2014 9:25 AM GMT Jephte Clain wrote: >hello, > >I would say, try to understand the meaning of what you do. The >openldap admin guide is a good place to start. > >- for instance, on the slave, you bind to the master with dn >uid=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp and password >secretofreplicator >does this objet exist *on the master*? with the right password? does >this account have the right acl to read everything on the master >(i.e., on the master, the acl is defined for cn=replicator,... which >is not the same as uid=replicator,...) >- also, why would you use the replicator dn as the rootdn for the slave? > >one last thing: I advise you change the password of both the master >and slave. posting the file with the hash password of the root dn on >the internet is not a good idea :-) > >good luck > > >2014-11-19 11:38 GMT+04:00 wailok tam <wailoktam(a)yahoo.com>: >> Hi, I am new to ldap. I am following the book "Mastering Openldap" to set up >> replication >> but I am getting the error given in the title when I start the slave with >> "splad -d sync" . Replication does >> not work. >> >> ****************************************************************************************************** >> >> slapd.conf of the Master: >> >> include /etc/openldap/schema/core.schema >> include /etc/openldap/schema/cosine.schema >> include /etc/openldap/schema/inetorgperson.schema >> include /etc/openldap/schema/nis.schema >> include /etc/openldap/schema/samba.schema >> >> >> #modulepath /usr/lib/openldap >> #moduleload syncprov.la >> >> # Allow LDAPv2 client connections. This is NOT the default. >> allow bind_v2 >> >> # Do not enable referrals until AFTER you have a working directory >> # service AND an understanding of referrals. >> #referral ldap://root.openldap.org >> >> pidfile /var/run/openldap/slapd.pid >> argsfile /var/run/openldap/slapd.args >> >> #sasl-realm ier.hit-u.ac.jp >> #sasl-host localhost >> #authz-regexp uid=([^,]*),cn=ier.hit-u.ac.jp,cn=DIGEST-MD5,cn=auth >> cn=$1,dc=ier,dc=hit-u,dc=ac,dc=jp >> >> ####################################################################### >> # ldbm and/or bdb database definitions >> ####################################################################### >> >> database bdb >> suffix "dc=ier,dc=hit-u,dc=ac,dc=jp" >> rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" >> #rootpw {MD5}x1Ktlhm0p7RPnl/G01rhTQ== >> rootpw secret >> #password-hash {MD5} >> directory /var/lib/ldap >> >> TLSCACertificateFile /usr/share/ssl/certs/nii-odca2.crt >> TLSCertificateFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt >> TLSCertificateKeyFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.key >> >> overlay syncprov >> syncprov-checkpoint 50 10 >> syncprov-sessionlog 100 >> >> # Indices to maintain for this database >> index objectClass eq,pres >> index ou,cn,mail,surname,givenname eq,pres,sub >> index uidNumber,gidNumber,loginShell eq,pres >> index uid,memberUid eq,pres,sub >> index nisMapName,nisMapEntry eq,pres,sub >> index entryCSN,entryUUID eq >> idlcachesize 1000 >> >> >> access to attrs=userPassword >> by self write >> by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write >> by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read >> by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read >> by anonymous auth >> by * none >> >> >> >> access to attrs=SambaLMPassword,SambaNTPassword >> by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write >> by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read >> by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read >> by self read >> by anonymous auth >> by * none >> >> access to * >> by self write >> by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write >> by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read >> by * read >> >> ***************************************************************************************************** >> >> sladp.conf of the slave: >> >> include /etc/openldap/schema/core.schema >> include /etc/openldap/schema/cosine.schema >> include /etc/openldap/schema/inetorgperson.schema >> include /etc/openldap/schema/nis.schema >> include /etc/openldap/schema/samba.schema >> >> # Allow LDAPv2 client connections. This is NOT the default. >> allow bind_v2 >> >> # Do not enable referrals until AFTER you have a working directory >> # service AND an understanding of referrals. >> #referral ldap://root.openldap.org >> >> pidfile /var/run/openldap/slapd.pid >> argsfile /var/run/openldap/slapd.args >> >> ####################################################################### >> # ldbm and/or bdb database definitions >> ####################################################################### >> >> database bdb >> suffix "dc=ier,dc=hit-u,dc=ac,dc=jp" >> #rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" >> rootdn "cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp" >> #rootpw {MD5}x1Ktlhm0p7RPnl/G01rhTQ== >> rootpw secretofreplicator >> #password-hash {MD5} >> directory /var/lib/ldap >> #TLSCACertificateFile /usr/share/ssl/certs/nii-odca2.crt >> #TLSCertificateFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt >> #TLSCertificateKeyFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.key >> >> >> # Replicas of this database >> #updatedn cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp >> #updateref uri=ldap://192.168.84.22 >> >> # Indices to maintain for this database >> index objectClass eq,pres >> index ou,cn,mail,surname,givenname eq,pres,sub >> index uidNumber,gidNumber,loginShell eq,pres >> index uid,memberUid eq,pres,sub >> index nisMapName,nisMapEntry eq,pres,sub >> index entryCSN,entryUUID eq >> idlcachesize 1000 >> >> >> #access to attrs=userPassword >> # by dn="cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp" write >> # by self write >> # by anonymous auth >> # by * none >> >> >> #access to * >> # by dn="cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp" write >> # by self write >> # by * read >> >> >> >> >> #loglevel stats sync >> >> syncrepl rid=001 >> provider=ldap://mail.ier.hit-u.ac.jp >> type=refreshAndPersist >> interval=00:00:05:00 >> searchbase="dc=ier,dc=hit-u,dc=ac,dc=jp" >> binddn="uid=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" >> bindmethod=simple >> # bindmethod=sasl saslmech=DIGEST-MD5 >> # authcid=replicator >> credentials=secretofreplicator >> >> updateref ldap://mail.ier.hit-u.ac.jp/ >> >> >> ***************************************************************************************** >> what puzzles me is that: >> >> I try on the slave to access the master with >> ldapsearch -x -H ldap://mail.ier.hit-u.ac.jp -W -D >> 'cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp' '(uid=someone)' >> >> and it works. >> >> What is wrong? I really need your help. >> >> > > > >-- >cordialement, >Jephté Clain >Direction des Systèmes d'Information >et des Usages Numériques - 2IG >Tél. 0262 93 86 31 >Fax. 0262 93 81 06 >

2 1

openldap 2.4.40 with cyrus sasl 2.1.26 on ubuntu 12.04lts
by Guruprasad Kulkarni 15 Nov '14

15 Nov '14

Hi, I am using ubuntu 12.04lts I installed cyrus sasl version 2.1.26 using the following steps: ./configure --disable-digest --without-saslauthd make make install I had to use the option without-saslauthd, otherwise it would fail. Now I tried to install openldap 2.4.40 with the following options ./configure --enable-hdb --enable-ppolicy --enable-syncprov --with-cyrus-sasl During make test, I get the error: ../clients/tools/ldapsearch: error while loading shared libraries: libsasl2.so.3: cannot open shared object file: No such file or directory Do I need to use the option --with-saslauthd while installing cyrus sasl to be able to use --with-cyrus-sasl option while installing openldap? -Guruprasad

4 5

ldapsearch and ldappasswd, one can't find user account.
by Grant Schoep 14 Nov '14

14 Nov '14

So I am trying to setup a command line script to simply changing users passwords. I know there are Perl modules and the like, but right now I just want to try to use ldapsearch and ldappasswd. >From my workstation(just a client of the LDAP server). ldapsearch is working fine. When I run ldapsearch -x -H ldaps://blah.blah:#### -W -D uid=mradmin,ou=service-accounts,ou=taco,dc=bell,dc=com -b ou=taco,dc=bell,dc=com "(&(cn=*)(uid=testuser))" This returns info. Looking at those results, it returned what I think I was looking for ... dc: uid=testuser,ou=people,ou=taco,dc=bell,dc=com ... So I then ran. ldappasswd -x -H ldaps://blah.blah:#### -D "uid=mradmin,ou=service-accounts,ou=taco,dc=bell,dc=com" -W "uid=testuser,ou=people,ou=taco,dc=bell,dc=com" And I get the following error Result: No such object (32) Additional info: Error in search for entry "oid=1.3.6.1.4.1.4203.1.11.1,cn=features,cn=config". I very new to dealing with LDAP, so I could be missing something simple from the command line. Thanks for any pointers.

2 1

pwdCheckModule not allowed on openldap 2.4.40 (ubuntu server 12.04)
by Guruprasad Kulkarni 14 Nov '14

14 Nov '14

Hi, I installed openldap 2.4.40 on ubuntu 12.04LTS I enabled ppolicy while configuring the installation. ./configure --enable-hdb --enable-ppolicy --enable-syncprov --with-tls I want to specify a password check module (to check for minimum upper cases, lower cases, digits, etc). I got the module from http://ltb-project.org/wiki/documentation/openldap-ppolicy-check-password I created a password policy very similar to the one given in the documentation: dn: cn=default,ou=policies,dc=example,dc=com cn: default objectClass: pwdPolicy objectClass: person objectClass: top pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 1 pwdCheckModule: check_password.so pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 0 pwdInHistory: 5 3 pwdLockout: TRUE pwdLockoutDuration: 60 0 pwdMaxAge: 1200 pwdMaxFailure: 3 pwdMinAge: 0 pwdMinLength: 8 pwdMustChange: FALSE pwdSafeModify: FALSE sn: dummy value slapd.conf: modulepath /usr/local/lib moduleload check_password.so While adding this password policy to ldap, I get the error: ldap_add: Object class violation (65) attribute info: attribute 'pwdCheckModule' not allowed The log level is 256 and doesn't say much besides giving the same error. Let me know where I have gone wrong. -Guruprasad

2 1

Re: adding VLV support to OpenLDAP 2.4.31
by Igor Shmukler 13 Nov '14

13 Nov '14

Hello, I want to thank everyone who reads this mailing list and especially those who provided advice, which helped me to finally configure my server. You are amazing. Thank you

1 0

Re: adding VLV support to OpenLDAP 2.4.31
by Igor Shmukler 13 Nov '14

13 Nov '14

Hi Chris, vq@vq-HVM-domU:~$ ldapsearch -x -w Vq0106%% -D "cn=admin,dc=nodomain" -b cn=config # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 vq@vq-HVM-domU:~$ cat /usr/share/slapd/sssvlv.ldif dn: olcOverlay=sssvlv,olcDatabase={1}bdb,cn=config objectClass: olcSssVlvConfig olcOverlay: sssvlv olcSssVlvMax: 10 olcSssVlvMaxKeys: 5 In order to actually get the search working, I use base dc=nodomain It is not my choice. I inherited the server and the configuration. Nor do I know much about OpenLDAP configuration. I am a programmer and my job is [among other things] hacking the client piece. Unfortunately, there is nobody else [better] qualified to configure the server. Hence, I am filling in for an administrator. The "ldapsearch -x -w SECRET -D "cn=admin,dc=nodomain" -b dc=nodomain" version works fine and I do in fact get results. Sincerely, Igor Shmukler On Wed, Nov 12, 2014 at 11:47 AM, Chris Card <ctcard(a)hotmail.com> wrote: > > > >> Hi Chris, >> >> Sorry to bother you again. >> >>>>>>> ldapadd -x -w <password> -D cn=config -f <ldif file> >> >> -D cn=config was giving me an authentication error. I used >> credentials, which work for ldapsearch and got a syntax error. >> >> vq@vq-HVM-domU:~$ ldapadd -x -w SECRET -D "cn=admin, dc=nodomain" -f >> /usr/share/slapd/sssvlv.ldif >> ldap_add: Invalid syntax (21) >> additional info: objectClass: value #0 invalid per syntax >> > Is cn=admin,dc=nodomain the rootdn for the cn=config directory? > > Does > > ldapsearch -x -w SECRET -D "cn=admin,dc=nodomain" -b cn=config > > work? > > What are the contents of sssvlv.ldif? (it's possible I made a typo, it was untested) > > Chris > >

7 17

OpenLDAP Proxy for Active Directory Authentication (slapd.d)
by Šmucr Jan 13 Nov '14

13 Nov '14

Hello. I need to integrate local OpenLDAP and remote Active directory DS wereas the result is expected to work like this: User wants to authenticate --> Client (Gerrit 2.9.1) connects to the local OpenLDAP server --> The OpenLDAP server searches its local database for a relevant entry * Entry found --> Inform the client * Entry not found --> Delegate the request to the remote Active directory server o Entry found --> Inform the OpenLDAP server --> Inform the client o Entry not found --> Inform the OpenLDAP server --> Inform the client I came across this article [1], but my server uses the slapd.d configuration schema and I can't make it work as there's too little helpful documentation to it. I'll be thankful for every help. Jan [1] http://ltb-project.org/wiki/documentation/general/sasl_delegation

3 3

questions on overlay sssvlv
by Nicolas RENAULT 13 Nov '14

13 Nov '14

Hello, I already post some question about this but without succes, perhaps because i made a mistake and replys in another question thread. So I restart here. testing env so i can make all that i want. openldap 2.4.40 build on opensuse 13.1. try to make a proxy ldap, with use of meta to relay informations from one AD , one EDir and one openLDAP. (just use openLDAP for now) I create a database to get locally the root "dc=example,dc=fr" and firstlevel OU : "ou=TOUT,dc=example,dc=fr" , "ou=TEST,dc=example,dc=fr" I bind the openLDAP on "ou=LDAP,ou=TOUT,dc=example,dc=fr" I add users on the local ou "TEST" simple requests are working without problem. (on "TEST" and on "TOUT" ) activate sssvlv on slapd.conf (because of meta) globally (ie before the statement for the meta database) overlay sssvlv just this line. when a try this search ldapsearch -E 'sss=displayName' -H ldap://localhost -x -D "cn=Manager,dc=example,dc=fr" -b "ou=TEST,dc=example,dc=fr" -w xxxx -s sub "(&(objectClass=user)(displayName=ag*))" displayName I got the user list sort by display name ( they are local user) when i try this : ldapsearch -E 'sss=displayName' -H ldap://localhost -x -D "cn=Manager,dc=example,dc=fr" -b "ou=LDAP,ou=TOUT,dc=example,dc=fr" -w xxxx -s sub "(&(objectClass=user)(displayName=ag*))" displayName I got this : # extended LDIF # # LDAPv3 # base <ou=LDAP,ou=TOUT,dc=example,dc=fr> with scope subtree # filter: (&(objectClass=user)(displayName=ag*)) # requesting: displayName # with server side sorting control # # search result search: 2 result: 0 Success control: 1.2.840.113556.1.4.474 false MAMKAQA= sortResult: (0) Success # numResponses: 1 I understand that the request as been successfull but whitout any results ? any idea ? I'm thinking of a problem with : * bad place for "overlay ssvlv" in slapd.conf (actually it take place juste after moduleload section and just before the ACL statements * problem with remap attribute when asking the distant LDAP * overlay sssvlv not working with meta ? but need some clues to find where is the problem. Regards -- Nicolas

2 2

allow to pass on "undefined" filters in meta
by Markus.Storm＠t-systems.com 13 Nov '14

13 Nov '14

Hi I've run into a problem trying to deploy back-meta in front of an Active Directory target. I believe that to resolve it, I need to get a new option implemented. I need to issue a request through a back-meta proxy . That query happens to contain a matching rule which is not implemented in OpenLDAP so slapd does not know to evaluate the query. The target that the query will ultimately be passed on to (an Active Directory) does know to process the query, though. OpenLDAP, however, considers the filter to be "undefined" and thus on relaying the request to the AD target, back-meta replaces a portion of the original query with a "(?=undefined)" filter as documented in e.g. slapd-meta manpage "noundeffilter" option. But I need the original query to be passed on. It's in fact a _valid_ LDAP request, just OpenLDAP happens to be unable to parse it. But at least in my setup, slapd does not have to do _anything_ about the query other than to pass it on, so I find it inacceptable that it replaces the query just because it doesn't understand it. Please, can you add an option switch to the code to allow for passing on original queries *without* replacing undefined portions ? I have not found any other solution to my problem. I tried to make OpenLDAP aware of the undefined portion by adding the matching rule to the schema but I failed. Seems that would need to be planted into the code, and not being a programmer, that's not as easy as it is with expanding the schema by some new attributes. Also, while of course any parser/feature enhancement will always be appreciated, I would think that to implement the matching rule is not the best way of fixing things: I believe there will always be situations where OpenLDAP cannot parse the input while another LDAP server can. For a proof of concept, I hacked servers/slapd/back-meta/map.c (around line 581 as of 2.4.39) and but - again, I'm not a programmer - I feel incapable of turning this into a full-blown patch free of side effects, also I want the modification to become available to anyone. So I'm hoping for you to implement the switch mentioned above, maybe as a third possible setting for the "noundeffilter" option. Thanks a lot in advance, best regards Markus Storm

3 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical