openldap-technical

openldap-technical@openldap.org

15 participants
9797 discussions

WG: (ITS#7964) overlay rwm escape issue with more the 9 rules / rewrite statements
by Uwe Werler 16 Oct '14

16 Oct '14

FYI - last week I filed an ITS regarding overlay rwm: -----Ursprüngliche Nachricht----- Von: Uwe Werler <uwe.werler(a)retiolum.eu> Gesendet: Mo 13.10.2014 08:46 Betreff: (ITS#7964) overlay rwm escape issue with more the 9 rules / rewrite statements An: openldap-its(a)OpenLDAP.org; Full_Name: Uwe Werler Version: 2.4.40 OS: Linux / SLES 11 SP3 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (155.56.68.214) If I have rewrite rules like this: 23 olcOverlay={1}rwm,olcDatabase={3}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: {1}rwm olcRwmRewrite: {0}rwm-rewriteEngine on olcRwmRewrite: {1}rwm-rewriteContext searchFilter olcRwmRewrite: {2}rwm-rewriteRule "(.*\$)uid=sapr3(\$.*)" "$1uid=dlmsapr3$2" olcRwmRewrite: {3}rwm-rewriteRule "(.*\$)uid=sdb(\$.*)" "$1uid=sdb$2" olcRwmRewrite: {4}rwm-rewriteRule "(.*\$)uid=sapadm(\$.*) "$1uid=dlmsapadm$2" olcRwmRewrite: {5}rwm-rewriteRule "(.*\$)uid=sapmnt(\$.*)" "$1uid=sapmnt$2" olcRwmRewrite: {6}rwm-rewriteRule "(.*\$)uid=[a-z0-9]{3}adm(\$.*)" "$1uid=dlmsidadm$2" olcRwmRewrite: {7}rwm-rewriteRule "(.*\$)uid=sqd[a-z0-9]%3%3}(\$.*)" "$1uid=dlmsqdsid$2" olcRwmRewrite: {8}rwm-rewriteRule "(.*\$)uid=ora[a-z0-9]{3}(\$.*)" "$1uid=dlmorasid$2" olcRwmRewrite: {9}rwm-rewriteRule "(.*\$)uid=sap[a-z0-9]{3}(\$.*)" "$1uid=dlmsapr3$2" olcRwmRewrite: {10}rwm-rewriteRule "(.*\$)uid=sap[a-z0-9]{3}db(\$.*)" "$1uid=dlmsapr3db$2" olcRwmRewrite: {11}rwm-rewriteRule "(.*\$)uid=db2[a-z0-9]{3}(\$.*)" "$1uid=dlmdb2sid$2" olcRwmRewrite: {12}rwm-rewriteRule "(.*\$)uid=db2[a-z0-9]{3}ap(\$.*)" "$1uid=dlmdb2sid$2" then the 7. rule / 9. statement failes to escape. In this example ora*** get's not correctly rewritten to dlmora***: See loglevel trace: 543b711d ==> rewrite_rule_apply rule='(.*$)uid=sapr3($.*)' string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' [1 pass(es)] 543b711d ==> rewrite_rule_apply rule='(.*$)uid=sdb($.*)' string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' [1 pass(es)] 543b711d ==> rewrite_rule_apply rule='(.*$)uid=sapadm($.*)' string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' [1 pass(es)] 543b711d ==> rewrite_rule_apply rule='(.*$)uid=sapmnt($.*)' string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' [1 pass(es)] 543b711d ==> rewrite_rule_apply rule='(.*$)uid=[a-z0-9]{3}adm($.*)' string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' [1 pass(es)] 543b711d ==> rewrite_rule_apply rule='(.*$)uid=sqd[a-z0-9]{3}($.*)' string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' [1 pass(es)] 543b711d ==> rewrite_rule_apply rule='(.*\$)uid=ora[a-z0-9]{3}(\$.*)' string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' [1 pass(es)] 543b711d ==> rewrite_rule_apply rule='(.*$)uid=sap[a-z0-9]{3}($.*)' string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' [1 pass(es)] 543b711d ==> rewrite_rule_apply rule='(.*$)uid=sap[a-z0-9]{3}db($.*)' string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' [1 pass(es)] 543b711d ==> rewrite_rule_apply rule='(.*$)uid=db2[a-z0-9]{3}($.*)' string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' [1 pass(es)] 543b711d ==> rewrite_rule_apply rule='(.*$)uid=db2[a-z0-9]{3}ap($.*)' string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' [1 pass(es)] If I insert a dummy statement like this: olcRwmRewrite: {0}rwm-rewriteEngine on olcRwmRewrite: {1}rwm-rewriteContext searchFilter olcRwmRewrite: {2}rwm-rewriteRule "(.*\$)uid=sapr3(\$.*)" "$1uid=dlmsapr3$2" olcRwmRewrite: {3}rwm-rewriteRule "(.*\$)uid=sdb(\$.*)" "$1uid=sdb$2" olcRwmRewrite: {4}rwm-rewriteRule "(.*\$)uid=sapadm(\$.*)" "$1uid=dlmsapadm$2" olcRwmRewrite: {5}rwm-rewriteRule "(.*\$)uid=sapmnt(\$.*)" "$1uid=sapmnt$2" olcRwmRewrite: {6}rwm-rewriteRule "(.*\$)uid=[a-z0-9]{3}adm(\$.*)" "$1uid=dlmsidadm$2" olcRwmRewrite: {7}rwm-rewriteRule "(.*\$)uid=sqd[a-z0-9]{3}(\$.*)" "$1uid=dlmsqdsid$2" olcRwmRewrite: {8}rwm-rewriteRule "(.*\$)uid=ora[a-z0-9]{3}(\$.*)" "$1uid=dlmorasid$2" olcRwmRewrite: {9}rwm-rewriteContext placeHolder alias searchFilter olcRwmRewrite: {10}rwm-rewriteRule "(.*\$)uid=sap[a-z0-9]{3}(\$.*)" "$1uid=dlmsapr3$2" olcRwmRewrite: {11}rwm-rewriteRule "(.*\$)uid=sap[a-z0-9]{3}db(\$.*)" "$1uid=dlmsapr3db$2" olcRwmRewrite: {12}rwm-rewriteRule "(.*\$)uid=db2[a-z0-9]{3}(\$.*)" "$1uid=dlmdb2sid$2" olcRwmRewrite: {13}rwm-rewriteRule "(.*\$)uid=db2[a-z0-9]{3}ap(\$.*)" "$1uid=dlmdb2sid$2" then the escapes are working properly. Sometimes this occurs with the last rule too. I first tried with 2.4.26 (standard version in SLES11 SP3) and now with 2.4.40. Regards Uwe

1 0

AW: Q: accesslog and sessions
by Uwe Werler 16 Oct '14

16 Oct '14

> >> Now at least I have a problem with "reqSession": If you examine accesslog at > >> some later time, those volatile session IDs don't tell you anything anymore > >> (e.g. the host that opened the connection). Could acesslog be modified to add > >> some details from the session (like monitorConnectionPeerAddress, > >> monitorConnectionStartTime)? > > RTFM and turn on session logging. > > > This woule be a very nice feature, indeed. You mean that I'm then able to get the session ID and search them in log if I turn on loglevel conns?

1 0

Q: accesslog and sessions
by Ulrich Windl 16 Oct '14

16 Oct '14

Hi! I have configured accesslog for modification (attempts) in a multi-master configuration. Comparing accesslogs after some changes, I find some issues (openLDAP 2.4.26 of SLES11 SP3): On the originating server the "reqSession" varies with the connection made, while on a replication consumer the "reqSession" seems fixed (always 2 in one case). Also on the originating server I see the authenticated DN in "reqAuthzID", while on the replication consumer it seems to be always "cn=Admin,dc=example,dc=org". "reqStart" and "reqEnd" are also local for the LDAP server. Now at least I have a problem with "reqSession": If you examine accesslog at some later time, those volatile session IDs don't tell you anything anymore (e.g. the host that opened the connection). Could acesslog be modified to add some details from the session (like monitorConnectionPeerAddress, monitorConnectionStartTime)? Regards, Ulrich Windl

1 0

referrals
by Balazs Kovacs 15 Oct '14

15 Oct '14

Hi, I'm reading about referrals in RFC4511, which says: "Referrals can be returned in response to any operation request (except Unbind and Abandon, which do not have responses)." Can OpenLDAP slapd return referrals for bind operations? I got them for searches but not for binds. I'm using "Subordinate Knowledge Information" as described here" http://www.openldap.org/doc/admin24/referrals.html If no, can you please tell me the reasoning behind it? Best Regards, Balazs

1 0

<attrlist> syntax in ACLs
by Nikos Voutsinas 15 Oct '14

15 Oct '14

Hi all, Although I suspect what the answer would be, I thought It might be a good idea to confirm with the list. Is the following <attrlist> clause in OpenLdap's ACLs syntax valid; <attr1> [val[.<basic-style>]=<regex>],<attr2> e.g. to dn.subtree="ou=People,dc=foo,dc=com" attrs=entry,objectClass val.regex="objvalue1|objvalue2",attr1,attr2 by <who> <what> Thanks

4 9

OpenLDAP as proxy to Active Directory backend
by Jeff Lebo 15 Oct '14

15 Oct '14

Goal: LDAP server in Internet facing DMZ to provide authentication for externally hosted applications using internal AD credentials. I've done a LOT of reading and testing, and there is one thing I am still not 100% clear on: Is it possible to do this WITHOUT having a local user database on the OpenLDAP proxy? We will have thousands of users that will need to authenticate, and I can't maintain another user database (adds, removes, etc..). Is there a way to make OpenLDAP just act more like a reverse proxy and forward anything that matches a specific domain on to the internal LDAP/AD server for password verification?

4 8

LDAP, autofs and nested directories
by Lasse Knudsen 13 Oct '14

13 Oct '14

Greetings, I have run into a little snag, i know this is possible but, there is something that escapes me, my issue is as follows. I would like to have nested directories available, something to this effect, i need all directories to be created by the automounter, the problem is that i can't make configuration changes that always work, there is something that seems not to work as i would. what i would like to achieve is that the automounter creates my entire structure. for instance /fpc/apps (for some reason this works) and the two chess directories mount /fcp/co/home (co is created but home is not) i would like the ldap structure to be clean and neat, but it looks messy and its not clear to me when i make changes that it will work. So my question how do i go about creating this structure in a reliable way, most guides i have found only deal with creating a directory in / but does not go any further? And it bothers me that i have to use the slashes, like this “cn=/fpc/apps” Any suggestions how i can create this in a way that works? I have included my automount structure and my autofs confs thank you in advance lk

1 0

Q. null-modification with ppolicy?
by Ulrich Windl 13 Oct '14

13 Oct '14

Hi! Is it possible that ppolicy overlay does null-modifications on login for user entries that don't have a password policy? I see changes like this (diff of LDIF dump): -entryCSN: 20130910073734.028691Z#000000#001#000000 +entryCSN: 20141013114030.580239Z#000000#001#000000 modifiersName: cn=Admin,dc=domain,dc=org -modifyTimestamp: 20130910073734Z +modifyTimestamp: 20141013114030Z That is only the modification times seem changed. Regards, Ulrich

1 0

Antw: Questions on ppolicy (SLES11)
by Ulrich Windl 13 Oct '14

13 Oct '14

>>> I wrote: > Hello! > > I started to configure ppolicy in SLES11 SP3, and I think I succeeded with > the LDAP part. However I did not understand how to integrate ppolicy to the > OS, specifically: > > I created one test user with a ppolicy, and expectation is that on first > login the passowrd should be canged (minus grace logins). According to the > syslog ppolicy triggers an expired password: > > slapd[3990]: ppolicy_bind: Setting warning for password expiry for > uid=windl2,ou=domain,dc=org = 0 seconds > > However the user when logging in gets no type of message at all. It also > seems that nothing is changed in the LDAP database when this message occurs. The answer to this part is: If nscd is stil using the same connection, it won't detect ppolicy. After restarting nscd, things work as expected on that client. > So what is actually "set" there? > > When the user actually changes the password, I see the following attributes > changed in LDAP: > userPassword, pwdHistory, shadowLastChange > > What's not quite clear is when using SSHA-hashed passwords, what changes can > be done regarding pwdCheckQuality. I can imagine that some checks will work > if the client uses the extended operation to change the password, but not if > the password is changed by an ordinary LDAP modify request. Is that correct? It seems password history and minimum length can still be checked. Unsure about the rest. I also discovered that the attempt to change the password (after being logged in) may consume another grace login. This may be of interest if the actual password change failed or was aborted. > > Finally, maybe a stupid question: How does authentication against LDAP work? > In the classical UNIX mechanism, the authenticating process would query the > user name, then fetch the hashed password for that user, get the password > from the user, hash it using the same salt, and then compare the results for > a match. To my understanding you cannot get the hashed password from LDAP > until authenticated, so that looks like a egg-hen paradoxon to me. > > If anybody could enlighten me, I'd be glad. > > Regards, > Ulrich > >

1 0

Questions on ppolicy (SLES11)
by Ulrich Windl 13 Oct '14

13 Oct '14

Hello! I started to configure ppolicy in SLES11 SP3, and I think I succeeded with the LDAP part. However I did not understand how to integrate ppolicy to the OS, specifically: I created one test user with a ppolicy, and expectation is that on first login the passowrd should be canged (minus grace logins). According to the syslog ppolicy triggers an expired password: slapd[3990]: ppolicy_bind: Setting warning for password expiry for uid=windl2,ou=domain,dc=org = 0 seconds However the user when logging in gets no type of message at all. It also seems that nothing is changed in the LDAP database when this message occurs. So what is actually "set" there? When the user actually changes the password, I see the following attributes changed in LDAP: userPassword, pwdHistory, shadowLastChange What's not quite clear is when using SSHA-hashed passwords, what changes can be done regarding pwdCheckQuality. I can imagine that some checks will work if the client uses the extended operation to change the password, but not if the password is changed by an ordinary LDAP modify request. Is that correct? Finally, maybe a stupid question: How does authentication against LDAP work? In the classical UNIX mechanism, the authenticating process would query the user name, then fetch the hashed password for that user, get the password from the user, hash it using the same salt, and then compare the results for a match. To my understanding you cannot get the hashed password from LDAP until authenticated, so that looks like a egg-hen paradoxon to me. If anybody could enlighten me, I'd be glad. Regards, Ulrich

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical