openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

debugging OpenLDAP client
by Igor Shmukler 19 Nov '14

19 Nov '14

Hello, I wrote a client to make RFC 2696 (paged results) requests. My client gets results fine, yet size and cookie values are always 0, "" - this should not be the case. I tried with ldapsearch(1) and it does paging fine. Hence, it makes sense to assume that the server is OK and opaque/cookie must not be empty. At the same time, format of my ASN object is fine. I need to understand where exactly, I messed up. In order to debug this, I added a logging LDIF and set debug to -1 any. It shows quite a lot of information, but I did not notice size and cookie values being dumped into syslog(3). Is there a way to have separate values that go into the packets printed out? I see that there is an option for BER 0x10 and parse 0x800 as well as others. Thank you, Igor Shmukler

4 8

make test failure due to libsasl2.so.3 not found
by Guruprasad Kulkarni 19 Nov '14

19 Nov '14

I am using ubuntu 12.04.5 LTS I installed cyrus-sasl-2.1.26 (created symlink from /usr/lib/sasl2 to /usr/local/lib/sasl2) I used the following options for configuration: --enable-debug --enable-hdb --enable-ppolicy --enable-syncprov --with-cyrus-sasl Configuration, make depend and make were successful. I then proceeded to "make test" and I got the error: ../clients/tools/ldapsearch: error while loading shared libraries: libsasl2.so.3: cannot open shared object file: No such file or directory The file libsasl2.so.3 is present in /usr/local/lib I set LDFLAGS="-L/usr/local/lib -L/usr/local/lib/sasl2" Do I need to set some other flags to make the tests work? -Guruprasad

3 3

Re: any help on "ldap_sasl_bind_s failed (53)"
by wailok tam 19 Nov '14

19 Nov '14

thx for your reply. do i put in the slave conf file the same thing as the following command? > ldapsearch -x -H ldap://mail.ier.hit-u.ac.jp -W -D > 'cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp' '(uid=someone)' ------------------------------ On Wed, Nov 19, 2014 9:25 AM GMT Jephte Clain wrote: >hello, > >I would say, try to understand the meaning of what you do. The >openldap admin guide is a good place to start. > >- for instance, on the slave, you bind to the master with dn >uid=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp and password >secretofreplicator >does this objet exist *on the master*? with the right password? does >this account have the right acl to read everything on the master >(i.e., on the master, the acl is defined for cn=replicator,... which >is not the same as uid=replicator,...) >- also, why would you use the replicator dn as the rootdn for the slave? > >one last thing: I advise you change the password of both the master >and slave. posting the file with the hash password of the root dn on >the internet is not a good idea :-) > >good luck > > >2014-11-19 11:38 GMT+04:00 wailok tam <wailoktam(a)yahoo.com>: >> Hi, I am new to ldap. I am following the book "Mastering Openldap" to set up >> replication >> but I am getting the error given in the title when I start the slave with >> "splad -d sync" . Replication does >> not work. >> >> ****************************************************************************************************** >> >> slapd.conf of the Master: >> >> include /etc/openldap/schema/core.schema >> include /etc/openldap/schema/cosine.schema >> include /etc/openldap/schema/inetorgperson.schema >> include /etc/openldap/schema/nis.schema >> include /etc/openldap/schema/samba.schema >> >> >> #modulepath /usr/lib/openldap >> #moduleload syncprov.la >> >> # Allow LDAPv2 client connections. This is NOT the default. >> allow bind_v2 >> >> # Do not enable referrals until AFTER you have a working directory >> # service AND an understanding of referrals. >> #referral ldap://root.openldap.org >> >> pidfile /var/run/openldap/slapd.pid >> argsfile /var/run/openldap/slapd.args >> >> #sasl-realm ier.hit-u.ac.jp >> #sasl-host localhost >> #authz-regexp uid=([^,]*),cn=ier.hit-u.ac.jp,cn=DIGEST-MD5,cn=auth >> cn=$1,dc=ier,dc=hit-u,dc=ac,dc=jp >> >> ####################################################################### >> # ldbm and/or bdb database definitions >> ####################################################################### >> >> database bdb >> suffix "dc=ier,dc=hit-u,dc=ac,dc=jp" >> rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" >> #rootpw {MD5}x1Ktlhm0p7RPnl/G01rhTQ== >> rootpw secret >> #password-hash {MD5} >> directory /var/lib/ldap >> >> TLSCACertificateFile /usr/share/ssl/certs/nii-odca2.crt >> TLSCertificateFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt >> TLSCertificateKeyFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.key >> >> overlay syncprov >> syncprov-checkpoint 50 10 >> syncprov-sessionlog 100 >> >> # Indices to maintain for this database >> index objectClass eq,pres >> index ou,cn,mail,surname,givenname eq,pres,sub >> index uidNumber,gidNumber,loginShell eq,pres >> index uid,memberUid eq,pres,sub >> index nisMapName,nisMapEntry eq,pres,sub >> index entryCSN,entryUUID eq >> idlcachesize 1000 >> >> >> access to attrs=userPassword >> by self write >> by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write >> by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read >> by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read >> by anonymous auth >> by * none >> >> >> >> access to attrs=SambaLMPassword,SambaNTPassword >> by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write >> by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read >> by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read >> by self read >> by anonymous auth >> by * none >> >> access to * >> by self write >> by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write >> by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read >> by * read >> >> ***************************************************************************************************** >> >> sladp.conf of the slave: >> >> include /etc/openldap/schema/core.schema >> include /etc/openldap/schema/cosine.schema >> include /etc/openldap/schema/inetorgperson.schema >> include /etc/openldap/schema/nis.schema >> include /etc/openldap/schema/samba.schema >> >> # Allow LDAPv2 client connections. This is NOT the default. >> allow bind_v2 >> >> # Do not enable referrals until AFTER you have a working directory >> # service AND an understanding of referrals. >> #referral ldap://root.openldap.org >> >> pidfile /var/run/openldap/slapd.pid >> argsfile /var/run/openldap/slapd.args >> >> ####################################################################### >> # ldbm and/or bdb database definitions >> ####################################################################### >> >> database bdb >> suffix "dc=ier,dc=hit-u,dc=ac,dc=jp" >> #rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" >> rootdn "cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp" >> #rootpw {MD5}x1Ktlhm0p7RPnl/G01rhTQ== >> rootpw secretofreplicator >> #password-hash {MD5} >> directory /var/lib/ldap >> #TLSCACertificateFile /usr/share/ssl/certs/nii-odca2.crt >> #TLSCertificateFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt >> #TLSCertificateKeyFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.key >> >> >> # Replicas of this database >> #updatedn cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp >> #updateref uri=ldap://192.168.84.22 >> >> # Indices to maintain for this database >> index objectClass eq,pres >> index ou,cn,mail,surname,givenname eq,pres,sub >> index uidNumber,gidNumber,loginShell eq,pres >> index uid,memberUid eq,pres,sub >> index nisMapName,nisMapEntry eq,pres,sub >> index entryCSN,entryUUID eq >> idlcachesize 1000 >> >> >> #access to attrs=userPassword >> # by dn="cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp" write >> # by self write >> # by anonymous auth >> # by * none >> >> >> #access to * >> # by dn="cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp" write >> # by self write >> # by * read >> >> >> >> >> #loglevel stats sync >> >> syncrepl rid=001 >> provider=ldap://mail.ier.hit-u.ac.jp >> type=refreshAndPersist >> interval=00:00:05:00 >> searchbase="dc=ier,dc=hit-u,dc=ac,dc=jp" >> binddn="uid=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" >> bindmethod=simple >> # bindmethod=sasl saslmech=DIGEST-MD5 >> # authcid=replicator >> credentials=secretofreplicator >> >> updateref ldap://mail.ier.hit-u.ac.jp/ >> >> >> ***************************************************************************************** >> what puzzles me is that: >> >> I try on the slave to access the master with >> ldapsearch -x -H ldap://mail.ier.hit-u.ac.jp -W -D >> 'cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp' '(uid=someone)' >> >> and it works. >> >> What is wrong? I really need your help. >> >> > > > >-- >cordialement, >Jephté Clain >Direction des Systèmes d'Information >et des Usages Numériques - 2IG >Tél. 0262 93 86 31 >Fax. 0262 93 81 06 >

2 1

openldap 2.4.40 with cyrus sasl 2.1.26 on ubuntu 12.04lts
by Guruprasad Kulkarni 15 Nov '14

15 Nov '14

Hi, I am using ubuntu 12.04lts I installed cyrus sasl version 2.1.26 using the following steps: ./configure --disable-digest --without-saslauthd make make install I had to use the option without-saslauthd, otherwise it would fail. Now I tried to install openldap 2.4.40 with the following options ./configure --enable-hdb --enable-ppolicy --enable-syncprov --with-cyrus-sasl During make test, I get the error: ../clients/tools/ldapsearch: error while loading shared libraries: libsasl2.so.3: cannot open shared object file: No such file or directory Do I need to use the option --with-saslauthd while installing cyrus sasl to be able to use --with-cyrus-sasl option while installing openldap? -Guruprasad

4 5

ldapsearch and ldappasswd, one can't find user account.
by Grant Schoep 14 Nov '14

14 Nov '14

So I am trying to setup a command line script to simply changing users passwords. I know there are Perl modules and the like, but right now I just want to try to use ldapsearch and ldappasswd. >From my workstation(just a client of the LDAP server). ldapsearch is working fine. When I run ldapsearch -x -H ldaps://blah.blah:#### -W -D uid=mradmin,ou=service-accounts,ou=taco,dc=bell,dc=com -b ou=taco,dc=bell,dc=com "(&(cn=*)(uid=testuser))" This returns info. Looking at those results, it returned what I think I was looking for ... dc: uid=testuser,ou=people,ou=taco,dc=bell,dc=com ... So I then ran. ldappasswd -x -H ldaps://blah.blah:#### -D "uid=mradmin,ou=service-accounts,ou=taco,dc=bell,dc=com" -W "uid=testuser,ou=people,ou=taco,dc=bell,dc=com" And I get the following error Result: No such object (32) Additional info: Error in search for entry "oid=1.3.6.1.4.1.4203.1.11.1,cn=features,cn=config". I very new to dealing with LDAP, so I could be missing something simple from the command line. Thanks for any pointers.

2 1

pwdCheckModule not allowed on openldap 2.4.40 (ubuntu server 12.04)
by Guruprasad Kulkarni 14 Nov '14

14 Nov '14

Hi, I installed openldap 2.4.40 on ubuntu 12.04LTS I enabled ppolicy while configuring the installation. ./configure --enable-hdb --enable-ppolicy --enable-syncprov --with-tls I want to specify a password check module (to check for minimum upper cases, lower cases, digits, etc). I got the module from http://ltb-project.org/wiki/documentation/openldap-ppolicy-check-password I created a password policy very similar to the one given in the documentation: dn: cn=default,ou=policies,dc=example,dc=com cn: default objectClass: pwdPolicy objectClass: person objectClass: top pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 1 pwdCheckModule: check_password.so pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 0 pwdInHistory: 5 3 pwdLockout: TRUE pwdLockoutDuration: 60 0 pwdMaxAge: 1200 pwdMaxFailure: 3 pwdMinAge: 0 pwdMinLength: 8 pwdMustChange: FALSE pwdSafeModify: FALSE sn: dummy value slapd.conf: modulepath /usr/local/lib moduleload check_password.so While adding this password policy to ldap, I get the error: ldap_add: Object class violation (65) attribute info: attribute 'pwdCheckModule' not allowed The log level is 256 and doesn't say much besides giving the same error. Let me know where I have gone wrong. -Guruprasad

2 1

Re: adding VLV support to OpenLDAP 2.4.31
by Igor Shmukler 13 Nov '14

13 Nov '14

Hello, I want to thank everyone who reads this mailing list and especially those who provided advice, which helped me to finally configure my server. You are amazing. Thank you

1 0

Re: adding VLV support to OpenLDAP 2.4.31
by Igor Shmukler 13 Nov '14

13 Nov '14

Hi Chris, vq@vq-HVM-domU:~$ ldapsearch -x -w Vq0106%% -D "cn=admin,dc=nodomain" -b cn=config # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 vq@vq-HVM-domU:~$ cat /usr/share/slapd/sssvlv.ldif dn: olcOverlay=sssvlv,olcDatabase={1}bdb,cn=config objectClass: olcSssVlvConfig olcOverlay: sssvlv olcSssVlvMax: 10 olcSssVlvMaxKeys: 5 In order to actually get the search working, I use base dc=nodomain It is not my choice. I inherited the server and the configuration. Nor do I know much about OpenLDAP configuration. I am a programmer and my job is [among other things] hacking the client piece. Unfortunately, there is nobody else [better] qualified to configure the server. Hence, I am filling in for an administrator. The "ldapsearch -x -w SECRET -D "cn=admin,dc=nodomain" -b dc=nodomain" version works fine and I do in fact get results. Sincerely, Igor Shmukler On Wed, Nov 12, 2014 at 11:47 AM, Chris Card <ctcard(a)hotmail.com> wrote: > > > >> Hi Chris, >> >> Sorry to bother you again. >> >>>>>>> ldapadd -x -w <password> -D cn=config -f <ldif file> >> >> -D cn=config was giving me an authentication error. I used >> credentials, which work for ldapsearch and got a syntax error. >> >> vq@vq-HVM-domU:~$ ldapadd -x -w SECRET -D "cn=admin, dc=nodomain" -f >> /usr/share/slapd/sssvlv.ldif >> ldap_add: Invalid syntax (21) >> additional info: objectClass: value #0 invalid per syntax >> > Is cn=admin,dc=nodomain the rootdn for the cn=config directory? > > Does > > ldapsearch -x -w SECRET -D "cn=admin,dc=nodomain" -b cn=config > > work? > > What are the contents of sssvlv.ldif? (it's possible I made a typo, it was untested) > > Chris > >

7 17

OpenLDAP Proxy for Active Directory Authentication (slapd.d)
by Šmucr Jan 13 Nov '14

13 Nov '14

Hello. I need to integrate local OpenLDAP and remote Active directory DS wereas the result is expected to work like this: User wants to authenticate --> Client (Gerrit 2.9.1) connects to the local OpenLDAP server --> The OpenLDAP server searches its local database for a relevant entry * Entry found --> Inform the client * Entry not found --> Delegate the request to the remote Active directory server o Entry found --> Inform the OpenLDAP server --> Inform the client o Entry not found --> Inform the OpenLDAP server --> Inform the client I came across this article [1], but my server uses the slapd.d configuration schema and I can't make it work as there's too little helpful documentation to it. I'll be thankful for every help. Jan [1] http://ltb-project.org/wiki/documentation/general/sasl_delegation

3 3

questions on overlay sssvlv
by Nicolas RENAULT 13 Nov '14

13 Nov '14

Hello, I already post some question about this but without succes, perhaps because i made a mistake and replys in another question thread. So I restart here. testing env so i can make all that i want. openldap 2.4.40 build on opensuse 13.1. try to make a proxy ldap, with use of meta to relay informations from one AD , one EDir and one openLDAP. (just use openLDAP for now) I create a database to get locally the root "dc=example,dc=fr" and firstlevel OU : "ou=TOUT,dc=example,dc=fr" , "ou=TEST,dc=example,dc=fr" I bind the openLDAP on "ou=LDAP,ou=TOUT,dc=example,dc=fr" I add users on the local ou "TEST" simple requests are working without problem. (on "TEST" and on "TOUT" ) activate sssvlv on slapd.conf (because of meta) globally (ie before the statement for the meta database) overlay sssvlv just this line. when a try this search ldapsearch -E 'sss=displayName' -H ldap://localhost -x -D "cn=Manager,dc=example,dc=fr" -b "ou=TEST,dc=example,dc=fr" -w xxxx -s sub "(&(objectClass=user)(displayName=ag*))" displayName I got the user list sort by display name ( they are local user) when i try this : ldapsearch -E 'sss=displayName' -H ldap://localhost -x -D "cn=Manager,dc=example,dc=fr" -b "ou=LDAP,ou=TOUT,dc=example,dc=fr" -w xxxx -s sub "(&(objectClass=user)(displayName=ag*))" displayName I got this : # extended LDIF # # LDAPv3 # base <ou=LDAP,ou=TOUT,dc=example,dc=fr> with scope subtree # filter: (&(objectClass=user)(displayName=ag*)) # requesting: displayName # with server side sorting control # # search result search: 2 result: 0 Success control: 1.2.840.113556.1.4.474 false MAMKAQA= sortResult: (0) Success # numResponses: 1 I understand that the request as been successfull but whitout any results ? any idea ? I'm thinking of a problem with : * bad place for "overlay ssvlv" in slapd.conf (actually it take place juste after moduleload section and just before the ACL statements * problem with remap attribute when asking the distant LDAP * overlay sssvlv not working with meta ? but need some clues to find where is the problem. Regards -- Nicolas

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical