openldap-technical

openldap-technical@openldap.org

15 participants
9797 discussions

Complementing "set" ACLs documentation
by Ignacio Gallegos 13 Oct '14

13 Oct '14

Hi, I will try to explain "set" ACLs complementing the information originally written by Mark Valence in the openldap-devel archive (http://www.openldap.org/lists/openldap-devel/200006/msg00046.html). Set ACLs are a bit tricky and difficult to understand without the appropiate documentation. I hope this information helps to understand this kind of ACLs. 1. SYNTAX --------- First of all, the sintax in Backus-Naur form: <set> := <base> | "(" <set> ")" | <set> <conj> <set> | <set> "/" <attribute> "*" | <set> "/" <attribute> | <set> "/-" <level> | <set> "/-*" <base> := "this" | "user" | "[" <any text> "]" <conj> := "&" | "|" | "+" <attribute> := an attributeType as defined in the schema Of course, anywhere in the string, submatch replacements can appear in the form $<digit> or ${<digits>} if "set.regex=" is used instead "set=". 1.1. this, user and [] ---------------------- Keyword "this" means the object being accessed. So, if you are trying to read "cn=ignacio,ou=users,dc=foo,dc=com", "this" refers to "cn=ignacio,ou=users,dc=foo,dc=com" object. Keywork "user" means the object used to authenticate. If you are trying to read "cn=ignacio,ou=users,dc=foo,dc=com" authenticated as "cn=admin,dc=foo,dc=com", "user" refers to "cn=admin,dc=foo,dc=com" object. Keyword "[<text>]" means any text you need to use. For example "[cn=admin,dc=foo,dc=com]", "[FOO]". In other words, like strings in any programming language. 1.2. Object attributes ---------------------- Using the keywords of the previous section, you can access to the value of an attribute of a given object using the "/" operator. So, with an object like the next: dn: cn=ignacio,ou=users,dc=foo,dc=com uid: ignacio cn: ignacio description: Ignacio Gallegos Sanchez homeDirectory: /home/ignacio objectClass: posixAccount objectClass: top objectClass: account uidNumber: 800 structuralObjectClass: account gidNumber: 800 userPassword: MyPassword The expression "[cn=ignacio,ou=users,dc=foo,dc=com]/cn" will return "ignacio". The expression "this/uidNumber" will return "800" only if the target object is "cn=ignacio,ou=users,dc=foo,dc=com". 1.3. Operators &, | and + ------------------------- With a brief explanation: * & is a logic AND operator * | is a logic OR operator * + concatenates strings With examples: * "[A] & [A]" will return "A" * "[A] & [B]" will return an empty set * "[A] | [B]" will return "{ A, B }" * "[A] + [B]" will return "AB" * "[ignacio] & user/cn" will return "ignacio" ONLY if the client is authenticated with a user with a "CN" with value "ignacio" * "this & user" will return the object DN if the object used to authenticate is the target object, and will return nothing if not. 1.4. Group recursion -------------------- Using the "*" character we can obtain the group members in a recursive manner. The sintax is: <object>/<attribute>* For example, if we have the next objects: dn: cn=mail,ou=groups,dc=foo,dc=com objectClass: groupOfNames objectClass: top cn: mail member: cn=ignacio,ou=users,dc=foo,dc=com member: cn=claudia,ou=users,dc=foo,dc=com member: cn=clara,ou=users,dc=foo,dc=com dn: cn=web,ou=groups,dc=foo,dc=com objectClass: groupOfNames objectClass: top cn: web member: cn=oliver,ou=users,dc=foo,dc=com member: cn=sandra,ou=users,dc=foo,dc=com dn: cn=all_services,ou=groups,dc=foo,dc=com objectClass: groupOfNames objectClass: top cn: all_services member: cn=web,ou=groups,dc=foo,dc=com member: cn=mail,ou=groups,dc=foo,dc=com member: cn=julian,ou=users,dc=foo,dc=com The expression "[cn=all_services,ou=groups,dc=foo,dc=com]/member*" will return: { "member: cn=ignacio,ou=users,dc=foo,dc=com", "member: cn=claudia,ou=users,dc=foo,dc=com", "member: cn=clara,ou=users,dc=foo,dc=com", "member: cn=oliver,ou=users,dc=foo,dc=com", "member: cn=sandra,ou=users,dc=foo,dc=com", "member: cn=julian,ou=users,dc=foo,dc=com" } 1.5. Distingued Name Levels --------------------------- We can have the different levels of the DN of a given object using the /-<number> operator, or all levels with "/-*". So if the user is "cn=ignacio,ou=admins,ou=users,dc=foo,dc=com": * "user" resolves to "cn=ignacio,ou=admins,ou=users,dc=foo,dc=com" * "user/-1" resolves to "ou=admins,ou=users,dc=foo,dc=com" * "user/-2" resolves to "ou=users,dc=foo,dc=com" * "user/-3" resolves to "dc=foo,dc=com" * "user/-*" resolves to { "cn=ignacio,ou=admins,ou=users,dc=foo,dc=com", "ou=admins,ou=users,dc=foo,dc=com", "ou=users,dc=foo,dc=com", "dc=foo,dc=com", "dc=com", "" } 2. ACCESS CONTROL EVALUATION ---------------------------- After the previous examples, it's time to put it all together. -- The way "set" ACLs works is to grant the access if the expression returns something, don't grant access if the expression returns an empty set --, independtly the authenticated user is. This seems very simple (it's indeed) but can be very dangerous: we can grant access to an object by an unwanted user if we dont write the expression carefully. As usual, it's better to understand it with examples: * access to dn="ou=users,dc=foo,dc=com" by set="[A]" write Will grant write access to any user, because the set expression always return "A" * access to dn="ou=users,dc=foo,dc=com" by set="[A] & [B]" write Will NOT grant write access to any user, because the set expressions always returns an empty set. * access to dn="ou=users,dc=foo,dc=com" by set="user" write Will grant write access to any user, because the set expression always return the user DN. * access to dn="ou=users,dc=foo,dc=com" by set="user/description" write Will grant write access only if the object used to authenticate has the attribute "description" * access to dn="ou=users,dc=foo,dc=com" by set="user & [cn=ignacio,ou=users,dc=foo,dc=com]" write Will grant write access if the user DN is "cn=ignacio,ou=users,dc=foo,dc=com", because this is the only case the expression "user & [cn=ignacio,ou=users,dc=foo,dc=com]" will return something. * access to dn="ou=users,dc=foo,dc=com" by set="user/-2 & [dc=foo,dc=com]" write Will grant write access to any user two levels over "dc=foo,dc=com" domain, independly the "ou" is. In other words, "cn=ignacio,ou=users,dc=foo,dc=com" and "cn=clara,ou=admins,dc=foo,dc=com" will have write access, but "cn=claudia,ou=mail,ou=admins,dc=foo,dc=com" will not. * access to dn="ou=users,dc=foo,dc=com" by set="user/description & this/description" write Will grant write access to any user which description match the accessed object description. * access to dn="ou=users,dc=foo,dc=com" by set="(user/domain & this/domain)/-2 & [dc=foo,dc=com]" write Will grant write access to any user wich domain attribute match accessed object attribute and also domain is equal to "dc=foo,dc=com". * access to dn.regex="cn=(.+?),ou=users,(.+?)$" by set.regex="($1 & [ignacio]) & ($2 & [dc=foo,dc=com])" write Will grant write access if the user cn is "ignacio" and domain is "dc=foo, dc=com". Best Regards, Ignacio Gallegos Sánchez

2 1

schema for host info?
by Doug OLeary 09 Oct '14

09 Oct '14

Hi; I'm looking to store some host information in an ldap directory. Example attributes are: * Hostname * IP * Netmask * Default gateway * Remote console info * H/W * Serial number * Distribution List addresses to contact if the system has issues. Some of those are obvious: host, iphostnumber, ipnetmasknumber and serialnumber; the others somewhat less so. Any suggestions on how I could approach getting this information in my directory? Best case would be a pre-defined schema that I'm unable to find. Runner up would be a pointer from someone who's already faced and solved this issue. Thanks for any help/hints/tips. Doug O'Leary ------------ Senior UNIX/Security Admin CISSP, CISA, RHCE, CEH O'Leary Computers Inc dkoleary(a)olearycomputers.com (w) 630-904-6098 (c) 630-248-2749 linkedin: http://www.linkedin.com/in/dkoleary resume: http://www.olearycomputers.com/resume.html

3 2

Phpldapadmin can't connect openldap
by Onni Hakala 09 Oct '14

09 Oct '14

Hey! I need help with configuring openldap so that it allows logging in to phpldapadmin. Can you please give me hints how to debug my ldap authentication? I have a freshly installed server with ubuntu 14.04. I installed openldap and phpldapadmin following digitalocean tutorial [1]. My goal is to have all my user accounts in openldap. Services which will be using openldap are owncloud and dovecot. I don't have strong experience with openldap so I wanted to have phpldapadmin for easy administration of ldap database. Openldap is now installed and I can verify that it's working by running command below and entering ldap-root password: $ ldapsearch -x -W -D 'cn=admin,dc=XYZXYZ,dc=fi' -b "" -s base -H ldap://localhost Enter LDAP Password: # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: ALL # # dn: objectClass: top objectClass: OpenLDAProotDSE # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Phpldapadmin is also installed and I have verified that it's connecting to ldap. When I try to login to phpldapadmin with same credentials as ldapsearch above. It fails with message: Error: Invalid credentials (49) for user Why are these credentials wrong? I'm sure that password is correct and dn ('cn=admin,dc=XYZXYZ,dc=fi') is correct. Is there something I need to enable in openldap authentication to allow requests from phpldapadmin? I have verified that phpldapadmin is connecting to correct ldap. Firstly I had this error message from phpldapadmin: Error: Can't contact LDAP server (-1) for user But changed /etc/phpldapadmin/config.php to have: $servers->setValue('server','host','ldap://localhost'); I have tried to reinstall both of them several times and still getting this same error. I checked Php error logs (/var/log/apache2/error.log) and they are empty. OPENLDAP VERSION: $ slapd -V @(#) $OpenLDAP: slapd (Ubuntu) (Mar 17 2014 21:20:08) $ buildd@aatxe:/build/buildd/openldap-2.4.31/debian/build/servers/slapd PHPMYADMIN VERSION: 1.2.2 Thanks in advance :)! [1] https://www.digitalocean.com/community/tutorials/how-to-install-and-configu… - Onni Hakala

2 2

more too old cmp -1 output in the log
by Daniel Jung 09 Oct '14

09 Oct '14

Running on 2.4.39 centos 6.4 in MMR setup ( 4 servers ). 001 is the provider that was being written to at the time. The log is from 001. Could you advise whether my understanding of the log is correct? synrepl consumer on serverID=001 is polling syncrepl provider on serverID=001 and 003 and gets the CSN that is older that its own. We were doing a lot of writes during this time and there were cmp -1 104480 or simiar entries in the log. I had similar issue in the past while running 2.4.37 and it crashed slapd at that time but it didnt this time. The CSN were all synced at the end without any issue. Could you advise what could be causing this? Oct 8 20:36:50 servername slapd[58097]: srs csn 20141008181030.452659Z#000000#001#000000 Oct 8 20:36:50 servername slapd[58097]: log csn 20140723214017.586869Z#000000#001#000000 Oct 8 20:36:50 servername slapd[58097]: cmp -1, too old Oct 8 20:36:50 servername slapd[58097]: log csn 20140723214017.847644Z#000000#001#000000 Oct 8 20:36:50 servername slapd[58097]: cmp -1, too old Oct 8 20:36:50 servername slapd[58097]: log csn 20140723214122.276227Z#000000#001#000000 Oct 8 20:36:50 servername slapd[58097]: cmp -1, too old Oct 8 20:36:50 servername slapd[58097]: log csn 20140723214515.997173Z#000000#001#000000 Oct 8 20:36:50 servername slapd[58097]: cmp -1, too old Oct 8 20:36:50 servername slapd[58097]: log csn 20140723214734.650752Z#000000#001#000000 Oct 8 20:36:50 servername slapd[58097]: log csn 20140723220152.569135Z#000000#003#000000 Oct 8 20:36:50 servername slapd[58097]: cmp -1, too old Oct 8 20:36:50 servername slapd[58097]: log csn 20140723220328.184724Z#000000#001#000000 Oct 8 20:36:50 servername slapd[58097]: cmp -1, too old Oct 8 20:36:50 servername slapd[58097]: log csn 20140723222016.864642Z#000000#001#000000 Oct 8 20:36:50 servername slapd[58097]: cmp -1, too old Oct 8 20:36:50 servername slapd[58097]: log csn 20140723232832.307038Z#000000#003#000000 Oct 8 20:36:50 servername slapd[58097]: cmp -1, too old Oct 8 20:36:50 servername slapd[58097]: log csn 20140723232958.001298Z#000000#003#000000

2 3

syncrepl and LDAP_BUSY on LDBM by ITS#7904
by Леонид Юрьев 08 Oct '14

08 Oct '14

Hi all, We got a trouble with 2.4.40 syncrepl in the the multi-master mode. I think is too complex for analyse, and so not yet testcase is ready. But I noticed a change in ITS#7904 and the impact of LDAP_BUSY upon syncrepl. http://www.openldap.org/devel/gitweb.cgi?p=openldap.git&a=search&h=refs%2Ft… For instance, I assume that in case the LDAP_BUSY returned from ldap_sync_search(), then a syncrepl-connection would be closed and reestablished. Let see around the line 1554 of server/slapd/syncrepl.c and below. https://github.com/leo-yuriev/openldap-lmdb-challenge/blob/master/servers/s… Also, nowadays it is no repeatable read txn-isolation during the search and transfer data over a network. Does it influence upon syncrepl or not? Could anybody dispel my doubts? Leonid.

2 2

Map NFShomedirectory to new value
by Frans Lanting - IT Admin 08 Oct '14

08 Oct '14

Hi Folks, We are using an external OpenLDAP to authenticate users on a FreeBSD server and would like to re-map the NFSHomeDirectory to a different location. Currently that value looks like: /afs/home.example.com/users/t/jsmith We'd like to map it to something along the lines of: /users/jsmith If anyone could please point me in the right direction of how to do this, I'd be much appreciated. Cheers, Dan

4 3

Re: OpenLDAP, SASL and TLS
by Kristof Takacs 08 Oct '14

08 Oct '14

I use the following version: - OpenLDAP (2.4.35), but I have tried 2.4.39 as well - Cyrus SASL (2.1.26) - OpenSSL (1.0.1h) - Heimdal ( I beleive 1.5.2) Thanks, Kris On Mon, Oct 6, 2014 at 1:30 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Monday, October 06, 2014 2:27 PM -0400 Kristof Takacs < > kristof.takacs(a)gmail.com> wrote: > > > I use the following open source libraries: >> - OpenLDAP >> - Cyrus SASL >> - OpenSSL >> - Heimdal >> > > It is always critical to list the versions of software you are using. > Please do so. > > --Quanah > > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

3 8

Re: Problem adding olcModuleLoad
by Daniel Jung 07 Oct '14

07 Oct '14

sorry isnt module name memberof? On Mon, Oct 6, 2014 at 7:45 PM, Daniel Jung <mimianddaniel(a)gmail.com> wrote: > sorry isnt module name memberof? > > On Mon, Oct 6, 2014 at 6:39 PM, Howard Chu <hyc(a)symas.com> wrote: > >> Daniel Jung wrote: >> >>> running 2.4.39 >>> >>> # module{0}, config >>> dn: cn=module{0},cn=config >>> objectClass: olcModuleList >>> cn: module{0} >>> olcModuleLoad: {0}syncprov.la <http://syncprov.la> >>> olcModuleLoad: {1}auditlog.la <http://auditlog.la> >>> >>> ldif: >>> dn: cn=module{0},cn=config >>> changetype: modify >>> add: olcModuleLoad >>> olcModuleLoad: memberof >>> >>> using ldapmodify >>> modifying entry "cn=module{0},cn=config" >>> ldap_modify: Other (e.g., implementation specific) error (80) >>> additional info: <olcModuleLoad> handler exited with 1 >>> >>> What am i missing here? >>> >> >> You're missing a valid module name. >> >> -- >> -- Howard Chu >> CTO, Symas Corp. http://www.symas.com >> Director, Highland Sun http://highlandsun.com/hyc/ >> Chief Architect, OpenLDAP http://www.openldap.org/project/ >> > >

3 4

Problem with Index creation
by Joaquin Estrada 07 Oct '14

07 Oct '14

Hi folks. I am having a problem with index creation and am wondering if anyone here has seen this or knows what may be happening. We recently deployed a new proxy server product in our environment and have been working with the vendor to resolve some problems. This device connects to our existing LDAP server environment though a new database we added, per the vendor¹s requirements. One of the problems I am seeing is that, since the addition of this device, we are getting a lot of of the ³<= bdb_equality_cadidates: (uniqueMember) not indexed² messages showing up in the slapd log files. In order to resolve this, I¹ve attempted to create a new equality index on this attribute however no matter what I do, slapindex will not create an index! The following steps were done: 1. Shut down Slapd 2. Modify the slapd.conf file and add the ³index uniqueMember eq² entry to the current list of indexes. 3. Save the slapd.conf file. 4. Navigate to the current path for the database files and delete all existing index ³bdb² files. 5. Run a slapindex f (location of slapd) -b (suffix of database to reindex) I¹ve done this several times, once without deleting the current index files and then a few others after I¹ve deleted the current index files. The slapindex tool will recreate all of the indexes except the ³uniqueMember² index. I do not see an index file for this, and of course starting slapd back up results in the same messages in the log. So, what could be causing this? Is it possible that the vendor is using a filter improperly? If there is no data in the uniqueMember attribute for any of the records would it prevent slapindex from creating an index file? Any help would be appreciated!

1 0

Problem adding olcModuleLoad
by Daniel Jung 07 Oct '14

07 Oct '14

running 2.4.39 # module{0}, config dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModuleLoad: {0}syncprov.la olcModuleLoad: {1}auditlog.la ldif: dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: memberof using ldapmodify modifying entry "cn=module{0},cn=config" ldap_modify: Other (e.g., implementation specific) error (80) additional info: <olcModuleLoad> handler exited with 1 What am i missing here? Thanks

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical