openldap-technical

openldap-technical@openldap.org

9 participants
9902 discussions

Problem with Chain Overlay
by Stefano 03 Dec '14

03 Dec '14

Hi, I state that I am a beginner to Ldap !!! I have a problem with the configuration of the Chain Overlay. Provider and Consumer are identical CentOS release 6.5 openldap-servers-2.4.40-1.el6.x86_64 On the Consumer: I configured olcPPolicyForwardUpdates=TRUE in the Ppolicy Overlay and olcUpdateRef: ldap://stfalf02devpom.sociale.it in the ldif file of Ldap DB imported the ldif file: dn: olcOverlay=chain,olcDatabase={1}sociale,cn=config objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: chain olcChainCacheURI: FALSE olcChainMaxReferralDepth: 1 olcChainReturnError: FALSE created the directory /usr/local/openldap/etc/openldap/slapd.d/cn=config/olcDatabase= {1}sociale/olcOverlay={4}chain and imported the ldif file: dn: olcDatabase=ldap,olcOverlay={4}chain,olcDatabase={1}sociale,cn=config objectClass: olcChainDatabase objectClass: olcConfig objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: ldap olcDbIDAssertBind: bindmethod=simple binddn="uid=selmopi,ou=admin_esercizio,ou=Utenze,ou=Amministratori,dc=socia le,dc=it" credentials=strofinella mode=self olcDbURI: ldap://stfalf02devpom.sociale.it All operations were successful but the overlay does not work and does not know why, there are no errors in the logs !!! Help, I do not know where to turn !!! Thanks Best Regards Stefano

4 6

Re: Antw: need serious help on replication over ssl - getting do_syncrep1: rid 001 ldap_sasl_bind_s failed (-1)
by wailok tam 03 Dec '14

03 Dec '14

Hi, thanks again for offering further help. Is what you suggesting, c_rehash, equivalent to updating the certificate database, just like what the update-ca-certificate script would do in debian- based distro? I did not do this rehash thing. In the master, I am using an old set of certs which I suppose to be working. In the slave, I put all the certs in the directory they were first gen.erated, as given in the conf file. Will rehash work properly with the certs in those paths (i.e. /etc/pki/CA/)?I So what to do with the output of openssl x509 -noout -text -in <your_certificate>? I cannot try it now. I have tried sth similar a couple of hours ago that output the content of a cert in text. For the master, the issuer is an external orgaization which we bought the cert from. For the slave, the issuer is my orgaization since I generate it myself. I follow the guide in the link to paste the master ca cert after the orig slave ca cert. Does that strange instruction screw things up?I Thanks again in advance. ------------------------------ On Mon, Dec 1, 2014 11:05 AM GMT Ulrich Windl wrote: >>> wailok tam <wailoktam(a)yahoo.com> schrieb am 01.12.2014 um 11:40 in Nachricht ><1171333883.1885274.1417430400586.JavaMail.yahoo(a)jws100208.mail.ne1.yahoo.com>: >> Hi, thanks for your help. I am getting this on the master, no matter I put >> /usr/share/ssl/certs or /usr/share/ssl/certs/nii-odca2.crt for the first >> argument after -CApath >> /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt: >> /C=JP/L=Academe2/O=Hitotsubashi University/OU=Institute of Economic >> Research/CN=mail.ier.hit-u.ac.jperror 20 at 0 depth lookup:unable to get >> local issuer certificateunable to load certificate12574:error:0906D06C:PEM >> routines:PEM_read_bio:no start line:pem_lib.c:647:Expecting: TRUSTED >> CERTIFICATE > >So you have a problem with your issuer certificate: Did you use c_rehash after adding a CA certificate to /etc/ssl/certs? If so, dump your certificates (CA and server) like this >openssl x509 -noout -text -in <your_certificate> >and examine "Issuer" and "Subject" at least. > >Regards, >Ulrich > >> for slave, I am also getting: >> /etc/pki/tls/misc/newcert.pem: /C=JP/ST=Tokyo/L=Kunitachi/O=Hitotsubashi >> Univ./OU=IER/CN=blade-s00.ier.hit-u.ac.jperror 20 at 0 depth lookup:unable to >> get local issuer certificateunable to load >> certificate25730:error:0906D06C:PEM routines:PEM_read_bio:no start >> line:pem_lib.c:647:Expecting: TRUSTED CERTIFICATE >> no matter I put the /etc/pki/CA/ or /etc/pki/CA/cacert.pem for the first >> argument after -CApath >> Any clue? Thanks again in advance. I did not do update-ca-certificates, as >> mentioned in some books, on both the master and the slave. First, on the >> master, I need to use existing cert . So I suppose I dont need to update it. >> Second, I dont know where this command is located on RH...Is that relevant? >> >> From: Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> >> To: openldap-technical(a)openldap.org; wailoktam(a)yahoo.com >> Sent: Monday, December 1, 2014 7:08 PM >> Subject: Antw: need serious help on replication over ssl - getting >> do_syncrep1: rid 001 ldap_sasl_bind_s failed (-1) >> >>> wailok tam <wailoktam(a)yahoo.com> schrieb am 01.12.2014 um 10:04 in Nachricht >> >> >> <674598213.1863113.1417424697693.JavaMail.yahoo(a)jws10083.mail.ne1.yahoo.com>: >> Hi, I would really be grateful if a nice guy would appear and save me with >> this one. Simple bind replication over ldaps port does not work. I don't >> have >> a clue. There are very few guides on setting up replication over ldaps on >> the web or on prints. I am following this one as I am using RH: >> >> Verifying your SSL certificates: >> Try this (preferrably as the same user that slapd uses): >> # openssl verify -CApath /etc/ssl/certs /etc/ssl/servercerts/slapd.pem >> /etc/ssl/servercerts/slapd.pem: OK >> >> If (you are using openssl and) it works, your certificate should be OK; if >> not fix it and repeat the test. >> >> [...] >> >> I'd leave out the "tls_cert=" to switch to automatic cert selection; if that >> soesn't work, something is wrong with your setup; if it works, you can try to >> use a fixed certificate. >> >> Then you could try a manual remote TLS (not SSL) connect (e.g. ldapsearch) >> to your master; if it doesn't work, fix the config and repeat the test. Try >> to retrieve the whole database; if it works, you are quite close, I guess. >> >> Turn on logging for "config" and "sync" at least. Try some modification on >> the master and watch what happens... >> >> Regards, >> Ulrich >> >> >> >> > > > >

2 3

Re: adding a custom attribute
by Igor Shmukler 02 Dec '14

02 Dec '14

Hello Quanah, Thank you for your reply. Do I create a new schema file for my new attribute as in ${new_attribute}.schema and another for the new object using this new attribute? Sincerely, Igor Shmukler On Tue, Dec 2, 2014 at 11:05 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, December 02, 2014 10:55 PM +0200 Igor Shmukler > <igor.shmukler(a)gmail.com> wrote: > >> Hello, >> >> I want to have an ability add "custom attribute[s]" to my LDAP records. >> For example, such an attribute could be sipTelephone, mobile and/or >> something else. >> >> I did a little digging. Please advise whether I am on the right track. >> >> My understanding, at present, is that I would have to modify >> core.schema [located on my Ubuntu under /etc/ldap/schema ] and perhaps >> some other schema files from the same directory. >> >> I found various syntax OIDs. For telephones, for example - >> 1.3.6.1.4.1.1466.115.121.1.50 should be the right one. There is >> another OID for strings - 1.3.6.1.4.1.1466.115.121.1.15 for UTF-8 >> coded strings. >> >> Is editing core.schema the correct way to go? I am eagerly looking for >> advice. > > > Never, ever, edit core.schema. > > You can apply for your own OID, create your own attributes, and then create > objectClasses that use them. That is the correct way to do things. > > --Quanah > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

3 2

Obtaining the hashed password using ldapsearch, from aWwindows 2012 server.
by Mark London 02 Dec '14

02 Dec '14

Hi =- We upgraded the OS of our Active Directory server to Windows 2012. On a linux computer running Redhat 5, we use a script to obtain an account's hashed password, using the ldapsearch command. We request the msSFU30Password attribute. The script works fine for any account that was created before the new server was installed. For new accounts, no password is returned. Does anyone know how to make this possible again? One suggestion by someone, was to install the "Services for Unix <https://en.wikipedia.org/wiki/Windows_Services_for_UNIX>" package, which is now deprecated (I can't find what replaces it!). I installed it, but it didn't seem to help. Any other suggestions? Thanks. Mark London MIT PSFC

4 5

Have problem searching against ldap server after asyn sasl bind
by Qian Li 02 Dec '14

02 Dec '14

Hi All, Recently, I tried to write a ldap client to do ldap search asynchronously, but failed to perform search operation after a successful async sasl (digest-md5) bind. I’ve tried some code, but only succeeded in searching in synchronized sasl bind. I compared the captured sync and async packets: In sync bind, the search packets were encrypted. In async bind, after sasl (digest-md5) binding to ldap server asynchronously (by calling ldap_sasl_interactive_bind() twice), ldap_search_ext() was called. But the search packet was in plain text. Then the ldap server reset the connection or just didn’t response (in the case of MSAD). Did I use the ldap API incorrectly? Or async sasl bind doesn’t support search operation? Any suggestion will be appreciated and sorry for my poor English.

3 9

Debian style cn=config
by Christian Kratzer 01 Dec '14

01 Dec '14

Hi, while looking what debian generates in their cn=config for Debian Jessie I found following acl on the frontend database: dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break olcAccess: {1}to dn.exact="" by * read olcAccess: {2}to dn.base="cn=Subschema" by * read olcSizeLimit: 500 I somehow fail to grasp the relevance of granting manage access to the frontend database. Is it just me or is this is acl just mindless pasting. Apart from that debian jessie is now on openldap 2.4.40 thoug still built agains gnutls. Greetings Christian -- Christian Kratzer CK Software GmbH Email: ck(a)cksoft.de Wildberger Weg 24/2 Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart Mobile: +49 171 1947 843 Geschaeftsfuehrer: Christian Kratzer Web: http://www.cksoft.de/

2 1

need serious help on replication over ssl - getting do_syncrep1: rid 001 ldap_sasl_bind_s failed (-1)
by wailok tam 01 Dec '14

01 Dec '14

Hi, I would really be grateful if a nice guy would appear and save me with this one. Simple bind replication over ldaps port does not work. I don't have a clue. There are very few guides on setting up replication over ldaps on the web or on prints. I am following this one as I am using RH: Technical blurb about Oracle Engineered Systems: Configuring OpenLDAP for High Availability. (Master/Slave or Provider/Consumer configuration) [Part 3 of 4] Some of the suspicious bit are: 1. Concatenating the master CA cert and the original slave CA cert to make a new CA cert for use with the slave. But the server cert and key in the slave was signed with the original slave CA without the concatenation.2. the following line:tls_cert= in the slave replication directive seems to be suggesting the location of the master server certificate in the guide but there is no clear mention. I put the location of the master server certificate in this line. A billion thanks in advance. First the master slapd.conf: include /etc/openldap/schema/core.schemainclude /etc/openldap/schema/cosine.schemainclude /etc/openldap/schema/inetorgperson.schemainclude /etc/openldap/schema/nis.schemainclude /etc/openldap/schema/samba.schema # Allow LDAPv2 client connections. This is NOT the default.allow bind_v2 pidfile /var/run/openldap/slapd.pidargsfile /var/run/openldap/slapd.args ######################################################################## ldbm and/or bdb database definitions####################################################################### database bdbsuffix "dc=ier,dc=hit-u,dc=ac,dc=jp"rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp"rootpw sameforalldirectory /var/lib/ldap TLSCACertificateFile /usr/share/ssl/certs/nii-odca2.crtTLSCertificateFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crtTLSCertificateKeyFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.key overlay syncprovsyncprov-checkpoint 50 10syncprov-sessionlog 100 # Indices to maintain for this databaseindex objectClass eq,presindex ou,cn,mail,surname,givenname eq,pres,subindex uidNumber,gidNumber,loginShell eq,presindex uid,memberUid eq,pres,subindex nisMapName,nisMapEntry eq,pres,subindex entryCSN,entryUUID eq idlcachesize 1000 access to attrs=userPassword by self write by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by anonymous auth by * none access to attrs=SambaLMPassword,SambaNTPassword by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by self read by anonymous auth by * none access to * by self write by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by * read loglevel stats args trace sync ************************************************************************************************************************Next, the slapd.conf of the slave: ### configuration for IER### writeen by T.Tanaka include /etc/openldap/schema/core.schemainclude /etc/openldap/schema/cosine.schemainclude /etc/openldap/schema/inetorgperson.schemainclude /etc/openldap/schema/nis.schemainclude /etc/openldap/schema/samba.schema # Allow LDAPv2 client connections. This is NOT the default.allow bind_v2 # Do not enable referrals until AFTER you have a working directory# service AND an understanding of referrals.#referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pidargsfile /var/run/openldap/slapd.args ######################################################################## ldbm and/or bdb database definitions####################################################################### database bdbsuffix "dc=ier,dc=hit-u,dc=ac,dc=jp"rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp"rootpw sameforalldirectory /var/lib/ldap TLSCACertificateFile /etc/pki/CA/cacert.pemTLSCertificateFile /etc/pki/tls/misc/newcert.pemTLSCertificateKeyFile /etc/pki/tls/misc/clearkey.pem # Replicas of this database # Indices to maintain for this databaseindex objectClass eq,presindex ou,cn,mail,surname,givenname eq,pres,subindex uidNumber,gidNumber,loginShell eq,presindex uid,memberUid eq,pres,subindex nisMapName,nisMapEntry eq,pres,subindex entryCSN,entryUUID eq idlcachesize 1000 access to attrs=userPassword by dn="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" write by self write by anonymous auth by * none access to * by dn="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" write by self write by * read loglevel stats args trace sync syncrepl rid=001 provider=ldaps://mail.ier.hit-u.ac.jp:636 type=refreshOnly interval=00:00:05:00 bindmethod=simple searchbase="dc=ier,dc=hit-u,dc=ac,dc=jp" binddn="uid=root,dc=ier,dc=hit-u,dc=ac,dc=jp" credentials=sameforall tls_cert=/usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt mirrormode onupdateref ldaps://mail.ier.hit-u.ac.jp **************************************************************************************************************************

2 3

Re: OpenLDAP incroyable!
by Quanah Gibson-Mount 01 Dec '14

01 Dec '14

--On Wednesday, November 26, 2014 12:13 PM +0100 Onno van der Straaten <onno.van.der.straaten(a)gmail.com> wrote: > > And....another one. Amazing. So hard to understand the OpenLDAP > interface. Might just as well have been in Chinese. > > > > $ ldapmodify -h zimbra.server.com -p 389 -D "cn=config" -f > olc_password_hash.ldif -W > ldap_initialize( ldap://zimbra.onknows.com:389 ) > Enter LDAP Password: > replace olcPasswordHash: > {SSHA} > modifying entry "olcDatabase={-1}frontend,cn=config" > modify complete > > > So the "modify complete" sort of suggestive of some kind of success > completion or change applied. One would think. No. > > > The olcPasswordHash was "modified complete" to have exact same value as > before. Sort of expected OpenLDAP to be "unwilling to perform", which > often it is. Not now. It just is "willing to ignore". Almost human. Your list of complaints so far: a) You told OpenLDAP to load a file that didn't exist b) You modified a file, by hand, where the first comment in the file is: # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. c) In doing (b), you failed to preserve proper file permissions d) You failed to use the correct tools for doing what you wanted to do, after you broke the configuration (slapcat/slapadd) I'm not really sure what to make of your above complaint. It seems you are saying you think it is an error for ldap to replace a value with itself? All LDAP servers will do that with a replace operation. I.e., there is significant user error present here, and you got yourself into a bad spot, and made it worse via your own actions. A lack of understanding how to use a piece of software does not indicate the software itself is flawed. I will agree that it takes some time to learn how to work with LDAP in general, regardless of it is OpenLDAP, 389, Apache DS, etc. It may indeed be best in your case, to have a graphical UI hiding the grisly details from you, since those details are apparently causing significant challenge in your case. However, in the long run, it pays off significantly to understand the technology you're attempting to use. --Quanah -- Quanah Gibson-Mount Server Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

8 9

ldap update multiple entry by a single command
by Shashi Ranjan 28 Nov '14

28 Nov '14

Hello, I need to update multiple entries in single LDAP modify request for a particular object class. Otherwise I need to first search all the contact and then update one by one. In my case I want to update " l " parameter. l: mysite --> l: newsite Is there any way to update it in single LDAP modify request. dn: cn=test1,ou=comp,ou=people,dc=example,dc= com contactCompany: comp objectClass: cmmContact l: mysite dn: cn=test2,ou=comp,ou=people,dc= example,dc= com contactCompany: comp objectClass: cmmContact l: mysite dn: cn=test3,ou=comp,ou=people,dc= example,dc=com contactCompany: comp objectClass: cmmContact l: mysite P.S.: I am new to OpenLDAP. Thanks & Regards, Shashi Ranjan "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

2 1

Syncrepl N-Way multimaster replication - Configuration issue on Rhel6
by coma 28 Nov '14

28 Nov '14

Hello everybody, i'm currently tring to configure N-Way multimaster replication, and i'm facing two issues with olcServerId and slapd -h options. For information: I'm running on Rhel6.6 with openldap 2.4.39-8. I'm running slapd on non-standard ports (11389 for ldap and ldap with TLS, and 11390 for ldaps) I've tried on standard ports but same issues. I've configured the replication following these two procedures: https://access.redhat.com/solutions/273533 http://www.openldap.org/doc/admin24/replication.html#N-Way%20Multi-Master - First Issue details: When i'm adding olcServerID's on both servers, using following ldif: cat <<EOF | ldapmodify -Y EXTERNAL -H ldapi:/// dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 ldap://server1-test1.test.com olcServerID: 2 ldap://server2-test1.test.com EOF i'm no longer able to restart slapd. Error is: read_config: no serverID / URL match found. Check slapd -h arguments. To resolve it, i've tried to add the URL of my servers in correspondant /etc/sysconfig/ldapExample: SLAPD_LDAP=no SLAPD_LDAPI=yes SLAPD_LDAPS=no SLAPD_URLS="ldap://server1-test1.test.com:11389 ldaps://server1-test1.test.com:11390" But issue "Error is: read_config: no serverID / URL match found." is always present event after a server reboot and a full openldap reinstallationn. - Second issue détails (replication disabled, serverID's removed): With /etc/sysconfig/ldap configured as: SLAPD_LDAP=no SLAPD_LDAPI=yes SLAPD_LDAPS=no SLAPD_URLS="ldap://:11389 ldaps://:11390" i'm able to connect on port 11389/11390 with clear, starttls and SSL using a ldap browser or ldapsearch, But with /etc/sysconfig/ldap configured as: SLAPD_LDAP=no SLAPD_LDAPI=yes SLAPD_LDAPS=no SLAPD_URLS="ldap://server1-test1.test.com:11389 ldaps://server1-test1.test.com:11390" i'm not able to connect anymore. Can you please help me on this? Thanks in advance,

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical