openldap-technical

openldap-technical@openldap.org

3 participants
9990 discussions

ITS#8046 - remote unauth DoS on 2.4.40
by Paul B. Henson 06 Feb '15

06 Feb '15

I haven't seen any announcement of this other than on security lists, but there's an unauthenticated remote DoS bug in 2.4.40: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776991 The actual ITS is a bit confusing, the reporter at one point says he had the issue with a beta version of 2.4.40 and it didn't work against release, but debian confirmed it kills their official 2.4.40 package and it caused a segfault against my gentoo 2.4.40 release, so if you're running 2.4.40 (older versions not vulnerable), it's probably worth applying the patch from head: http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=patch;h=2f1a2dd32… I rebuilt my 2.4.40 with this and it no longer dies when the PoC query is issued.

2 2

set-based constraints on multi-valued attrs
by Michael Ströder 06 Feb '15

06 Feb '15

HI! I have a hybrid groupOfEntries/posixGroup object class, let's call it 'aeGroup'. It's supposed to serve the same group membership information to RFC2307 and RFC2307bis NSS clients. I want to keep attributes group membership attriutes consistent by using the following constraint: # restrict memberUID to be consistent with group membership defined in member constraint_attribute memberUID,member set "this/memberUID & this/member/uid" restrict="ldap:///dc=example,dc=com??sub?(objectClass=aeGroup)" This does not work as expected. I suspect that the constraint is not applied to each value separately. Rather the constraint is true when any of the values fulfill the constraint rules. Similar constraints cross-referencing values work pretty well for attributes only containing a single value. Any clue? (Yes, I'm already taking care of this in the admin UI web2ldap, but still I want to prevent inconsistent values for any writing LDAP client.) Ciao, Michael.

1 0

Re: plz provide me any simple authentication code in ldap
by Andrew Findlay 06 Feb '15

06 Feb '15

On Fri, Feb 06, 2015 at 10:42:45AM +0530, Bharath K wrote: > To: Andrew Findlay <andrew.findlay(a)skills-1st.co.uk> Please keep your replies on-list so that others with similar problems can learn from the archive. > Subject: Re: plz provide me any simple authentication code in ldap > > i configured openldap and i added user in ldif file,,without authentication its > working.. when i use simple authenticaion its not working its showing as > invalid credentials so what might be the problem??.. I expect the credentials that you are presenting to the LDAP server are invalid (the DN or the password is wrong or is missing). If you want help you need to supply more information. Your code does not include the DN and password that you are trying to use, and you have not supplied any information about the entry that you are trying to bind as. You need to tell us or we cannot help you. When you run this program, what do you put on the command line? Did you turn up the logging as I suggested? What is in the log? Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

Compaction after a lot of appending dublicate keys
by Tom Kirchner 06 Feb '15

06 Feb '15

1 0

Chinese display garbled
by Tian Zhiying 05 Feb '15

05 Feb '15

Hello My ldif file type is UTF-8 as below. # file test.ldif test.ldif: UTF-8 Unicode text The test.ldif content includes Chinese, as below: # cat test.ldif dn: cn=行政部,ou=domain,dc=domain,dc=com cn: 行政部 gidnumber: 500 objectclass: posixGroup I can add it to the LDAP server. Then excuting this command “# ldapsearch -x -H ldap://localhost -b dc=domain,dc=com” , it display as below: # \E7\94\B0\E5\BF\97\E8\8B\B1, domain, domain.com dn:: Y24955Sw5b+X6IuxLG91PXRodW5kZXJzb2Z0LGRjPXRodW5kZXJzb2Z0LGRjPWNvbQ== cn:: 55Sw5b+X6Iux gidNumber: 500 objectClass: posixGroup objectClass: top How can I deal with it? Can you help me? Thanks!!!

5 5

FW: API to check if LDAP connection is valid?
by Bin Lu 05 Feb '15

05 Feb '15

Hi, Is there a public API that does the same work as LDAP_VALID()? I maintain a group of long live ldap connections but sometimes I get assertions from the library. Wondering if there is a way to check if the connection is still valid before I use it. Thanks, -binlu

1 0

regarding openldap
by Bharath K 05 Feb '15

05 Feb '15

i configured openldap and i added user in ldif file,,without authentication its working.. when i use simple authenticaion its not working its showing as invalid credentials so what might be the problem??..or else for whom shall i concern plz give any suggestions

1 0

Openldap migration from 2.4.11 to 2.4.40 for 4-way multimaster servers
by Gary Ho 05 Feb '15

05 Feb '15

Dear all, I have a 4-way multi-master openldap servers running in version 2.4.11. Let's say the servers name are A, B, C, D. I have another 4-way multi-master openldap servers running in version 2.4.40. Let's say the servers name are W,X,Y,Z. What's the proper procedure of migrating the data from servers A,B,C,D to W,X,Y,Z ? My procedure is as follows :- Export data from server A using slapcat command.- Delete the first 6 lines of the ldif files (the lines contains the contextCSN).- Shutdown the process slapd in servers W,X,Y,Z and remove all the openldap data files under /usr/local/var/openldap-data.- Import the ldif files to server W, then start the slapd process in server W.- Export the ldif files from server W.- Import the ldif files to server X,Y,Z respectively.- Start the slapd process in X,Y,Z. What I observe is that all four servers then has 100% CPU and never drop back to idle ? So, is there anything I do wrong ? Thanks

2 1

plz provide me any simple authentication code in ldap
by Bharath K 05 Feb '15

05 Feb '15

below is my code....by executing this i am getting as error as invalid credentials ############################################################################ import java.util.Hashtable; import javax.naming.Context; import javax.naming.InitialContext; import javax.naming. NamingEnumeration; import javax.naming.NamingException; public class SimpleBindDemo { public static void main(String[] args) throws NamingException { if (args.length < 2) { System.err.println("Usage: java SimpleBindDemo <userDN> <password>"); System.exit(1); } Hashtable env = new Hashtable(); env.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory"); env.put(Context.PROVIDER_URL, "ldap://localhost:389/"); env.put(Context.SECURITY_AUTHENTICATION, "simple"); //env.put(Context.SECURITY_PRINCIPAL,"cn=Manager,ou=People,dc=example,dc=com"); //env.put(Context.SECURITY_CREDENTIALS,"ldap123"); env.put(Context.SECURITY_PRINCIPAL,args[0]); env.put(Context.SECURITY_CREDENTIALS,args[1]); try { Context ctx = new InitialContext(env); NamingEnumeration enm = ctx.list(""); while (enm.hasMore()) { System.out.println(enm.next()); } enm.close(); ctx.close(); } catch (NamingException e) { System.out.println(e.getMessage()); } } }

2 1

ppolicy: pwdMinAge being enforced for managers
by Phil 04 Feb '15

04 Feb '15

Hi all, We're implementing a basic user directory with OpenLDAP and the ppolicy attributes pwdMaxAge and pwdMinAge give use some desired functionality, but we need the ability for managers to reset a user's password. If we use the “rootdn” then this works, but we need to have other user accounts designated as managers. Even if we define ACLs to give our management group “manage” access we can still get the following from ldappasswd: Result: Constraint violation (19) Additional info: Password is too young to change Is there any way to designate a group of users as "managers" such that pwdMinAge is not applied? These are the ACLs we've tried without success to give the “UserAdmin” group the rights: cat <<__EOF | ldapmodify -Y EXTERNAL -H ldapi:/// dn: olcDatabase={2}bdb,cn=config changetype: modify add: olcAccess olcAccess: to attrs=userPassword by self =xw by group.exact="cn=UserAdmin,${LDAP_SERVER_BASE}" manage by anonymous auth by * none olcAccess: to dn.base="ou=Users,${LDAP_SERVER_BASE}" by group.exact="cn=UserAdmin,${LDAP_SERVER_BASE}" manage by * read olcAccess: to dn.children="ou=Users,${LDAP_SERVER_BASE}" filter=(objectClass=posixAccount) by group.exact="cn=UserAdmin,${LDAP_SERVER_BASE}" write by * read olcAccess: to dn.base="cn=UserAdmin,${LDAP_SERVER_BASE}" attrs=member by group.exact="cn=UserAdmin,${LDAP_SERVER_BASE}" write by * read olcAccess: to * by * read - __EOF Thanks Phil

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical