openldap-technical

openldap-technical@openldap.org

7 participants
9864 discussions

referrals
by Balazs Kovacs 15 Oct '14

15 Oct '14

Hi, I'm reading about referrals in RFC4511, which says: "Referrals can be returned in response to any operation request (except Unbind and Abandon, which do not have responses)." Can OpenLDAP slapd return referrals for bind operations? I got them for searches but not for binds. I'm using "Subordinate Knowledge Information" as described here" http://www.openldap.org/doc/admin24/referrals.html If no, can you please tell me the reasoning behind it? Best Regards, Balazs

1 0

<attrlist> syntax in ACLs
by Nikos Voutsinas 15 Oct '14

15 Oct '14

Hi all, Although I suspect what the answer would be, I thought It might be a good idea to confirm with the list. Is the following <attrlist> clause in OpenLdap's ACLs syntax valid; <attr1> [val[.<basic-style>]=<regex>],<attr2> e.g. to dn.subtree="ou=People,dc=foo,dc=com" attrs=entry,objectClass val.regex="objvalue1|objvalue2",attr1,attr2 by <who> <what> Thanks

4 9

OpenLDAP as proxy to Active Directory backend
by Jeff Lebo 15 Oct '14

15 Oct '14

Goal: LDAP server in Internet facing DMZ to provide authentication for externally hosted applications using internal AD credentials. I've done a LOT of reading and testing, and there is one thing I am still not 100% clear on: Is it possible to do this WITHOUT having a local user database on the OpenLDAP proxy? We will have thousands of users that will need to authenticate, and I can't maintain another user database (adds, removes, etc..). Is there a way to make OpenLDAP just act more like a reverse proxy and forward anything that matches a specific domain on to the internal LDAP/AD server for password verification?

4 8

LDAP, autofs and nested directories
by Lasse Knudsen 13 Oct '14

13 Oct '14

Greetings, I have run into a little snag, i know this is possible but, there is something that escapes me, my issue is as follows. I would like to have nested directories available, something to this effect, i need all directories to be created by the automounter, the problem is that i can't make configuration changes that always work, there is something that seems not to work as i would. what i would like to achieve is that the automounter creates my entire structure. for instance /fpc/apps (for some reason this works) and the two chess directories mount /fcp/co/home (co is created but home is not) i would like the ldap structure to be clean and neat, but it looks messy and its not clear to me when i make changes that it will work. So my question how do i go about creating this structure in a reliable way, most guides i have found only deal with creating a directory in / but does not go any further? And it bothers me that i have to use the slashes, like this “cn=/fpc/apps” Any suggestions how i can create this in a way that works? I have included my automount structure and my autofs confs thank you in advance lk

1 0

Q. null-modification with ppolicy?
by Ulrich Windl 13 Oct '14

13 Oct '14

Hi! Is it possible that ppolicy overlay does null-modifications on login for user entries that don't have a password policy? I see changes like this (diff of LDIF dump): -entryCSN: 20130910073734.028691Z#000000#001#000000 +entryCSN: 20141013114030.580239Z#000000#001#000000 modifiersName: cn=Admin,dc=domain,dc=org -modifyTimestamp: 20130910073734Z +modifyTimestamp: 20141013114030Z That is only the modification times seem changed. Regards, Ulrich

1 0

Antw: Questions on ppolicy (SLES11)
by Ulrich Windl 13 Oct '14

13 Oct '14

>>> I wrote: > Hello! > > I started to configure ppolicy in SLES11 SP3, and I think I succeeded with > the LDAP part. However I did not understand how to integrate ppolicy to the > OS, specifically: > > I created one test user with a ppolicy, and expectation is that on first > login the passowrd should be canged (minus grace logins). According to the > syslog ppolicy triggers an expired password: > > slapd[3990]: ppolicy_bind: Setting warning for password expiry for > uid=windl2,ou=domain,dc=org = 0 seconds > > However the user when logging in gets no type of message at all. It also > seems that nothing is changed in the LDAP database when this message occurs. The answer to this part is: If nscd is stil using the same connection, it won't detect ppolicy. After restarting nscd, things work as expected on that client. > So what is actually "set" there? > > When the user actually changes the password, I see the following attributes > changed in LDAP: > userPassword, pwdHistory, shadowLastChange > > What's not quite clear is when using SSHA-hashed passwords, what changes can > be done regarding pwdCheckQuality. I can imagine that some checks will work > if the client uses the extended operation to change the password, but not if > the password is changed by an ordinary LDAP modify request. Is that correct? It seems password history and minimum length can still be checked. Unsure about the rest. I also discovered that the attempt to change the password (after being logged in) may consume another grace login. This may be of interest if the actual password change failed or was aborted. > > Finally, maybe a stupid question: How does authentication against LDAP work? > In the classical UNIX mechanism, the authenticating process would query the > user name, then fetch the hashed password for that user, get the password > from the user, hash it using the same salt, and then compare the results for > a match. To my understanding you cannot get the hashed password from LDAP > until authenticated, so that looks like a egg-hen paradoxon to me. > > If anybody could enlighten me, I'd be glad. > > Regards, > Ulrich > >

1 0

Questions on ppolicy (SLES11)
by Ulrich Windl 13 Oct '14

13 Oct '14

Hello! I started to configure ppolicy in SLES11 SP3, and I think I succeeded with the LDAP part. However I did not understand how to integrate ppolicy to the OS, specifically: I created one test user with a ppolicy, and expectation is that on first login the passowrd should be canged (minus grace logins). According to the syslog ppolicy triggers an expired password: slapd[3990]: ppolicy_bind: Setting warning for password expiry for uid=windl2,ou=domain,dc=org = 0 seconds However the user when logging in gets no type of message at all. It also seems that nothing is changed in the LDAP database when this message occurs. So what is actually "set" there? When the user actually changes the password, I see the following attributes changed in LDAP: userPassword, pwdHistory, shadowLastChange What's not quite clear is when using SSHA-hashed passwords, what changes can be done regarding pwdCheckQuality. I can imagine that some checks will work if the client uses the extended operation to change the password, but not if the password is changed by an ordinary LDAP modify request. Is that correct? Finally, maybe a stupid question: How does authentication against LDAP work? In the classical UNIX mechanism, the authenticating process would query the user name, then fetch the hashed password for that user, get the password from the user, hash it using the same salt, and then compare the results for a match. To my understanding you cannot get the hashed password from LDAP until authenticated, so that looks like a egg-hen paradoxon to me. If anybody could enlighten me, I'd be glad. Regards, Ulrich

2 1

Complementing "set" ACLs documentation
by Ignacio Gallegos 13 Oct '14

13 Oct '14

Hi, I will try to explain "set" ACLs complementing the information originally written by Mark Valence in the openldap-devel archive (http://www.openldap.org/lists/openldap-devel/200006/msg00046.html). Set ACLs are a bit tricky and difficult to understand without the appropiate documentation. I hope this information helps to understand this kind of ACLs. 1. SYNTAX --------- First of all, the sintax in Backus-Naur form: <set> := <base> | "(" <set> ")" | <set> <conj> <set> | <set> "/" <attribute> "*" | <set> "/" <attribute> | <set> "/-" <level> | <set> "/-*" <base> := "this" | "user" | "[" <any text> "]" <conj> := "&" | "|" | "+" <attribute> := an attributeType as defined in the schema Of course, anywhere in the string, submatch replacements can appear in the form $<digit> or ${<digits>} if "set.regex=" is used instead "set=". 1.1. this, user and [] ---------------------- Keyword "this" means the object being accessed. So, if you are trying to read "cn=ignacio,ou=users,dc=foo,dc=com", "this" refers to "cn=ignacio,ou=users,dc=foo,dc=com" object. Keywork "user" means the object used to authenticate. If you are trying to read "cn=ignacio,ou=users,dc=foo,dc=com" authenticated as "cn=admin,dc=foo,dc=com", "user" refers to "cn=admin,dc=foo,dc=com" object. Keyword "[<text>]" means any text you need to use. For example "[cn=admin,dc=foo,dc=com]", "[FOO]". In other words, like strings in any programming language. 1.2. Object attributes ---------------------- Using the keywords of the previous section, you can access to the value of an attribute of a given object using the "/" operator. So, with an object like the next: dn: cn=ignacio,ou=users,dc=foo,dc=com uid: ignacio cn: ignacio description: Ignacio Gallegos Sanchez homeDirectory: /home/ignacio objectClass: posixAccount objectClass: top objectClass: account uidNumber: 800 structuralObjectClass: account gidNumber: 800 userPassword: MyPassword The expression "[cn=ignacio,ou=users,dc=foo,dc=com]/cn" will return "ignacio". The expression "this/uidNumber" will return "800" only if the target object is "cn=ignacio,ou=users,dc=foo,dc=com". 1.3. Operators &, | and + ------------------------- With a brief explanation: * & is a logic AND operator * | is a logic OR operator * + concatenates strings With examples: * "[A] & [A]" will return "A" * "[A] & [B]" will return an empty set * "[A] | [B]" will return "{ A, B }" * "[A] + [B]" will return "AB" * "[ignacio] & user/cn" will return "ignacio" ONLY if the client is authenticated with a user with a "CN" with value "ignacio" * "this & user" will return the object DN if the object used to authenticate is the target object, and will return nothing if not. 1.4. Group recursion -------------------- Using the "*" character we can obtain the group members in a recursive manner. The sintax is: <object>/<attribute>* For example, if we have the next objects: dn: cn=mail,ou=groups,dc=foo,dc=com objectClass: groupOfNames objectClass: top cn: mail member: cn=ignacio,ou=users,dc=foo,dc=com member: cn=claudia,ou=users,dc=foo,dc=com member: cn=clara,ou=users,dc=foo,dc=com dn: cn=web,ou=groups,dc=foo,dc=com objectClass: groupOfNames objectClass: top cn: web member: cn=oliver,ou=users,dc=foo,dc=com member: cn=sandra,ou=users,dc=foo,dc=com dn: cn=all_services,ou=groups,dc=foo,dc=com objectClass: groupOfNames objectClass: top cn: all_services member: cn=web,ou=groups,dc=foo,dc=com member: cn=mail,ou=groups,dc=foo,dc=com member: cn=julian,ou=users,dc=foo,dc=com The expression "[cn=all_services,ou=groups,dc=foo,dc=com]/member*" will return: { "member: cn=ignacio,ou=users,dc=foo,dc=com", "member: cn=claudia,ou=users,dc=foo,dc=com", "member: cn=clara,ou=users,dc=foo,dc=com", "member: cn=oliver,ou=users,dc=foo,dc=com", "member: cn=sandra,ou=users,dc=foo,dc=com", "member: cn=julian,ou=users,dc=foo,dc=com" } 1.5. Distingued Name Levels --------------------------- We can have the different levels of the DN of a given object using the /-<number> operator, or all levels with "/-*". So if the user is "cn=ignacio,ou=admins,ou=users,dc=foo,dc=com": * "user" resolves to "cn=ignacio,ou=admins,ou=users,dc=foo,dc=com" * "user/-1" resolves to "ou=admins,ou=users,dc=foo,dc=com" * "user/-2" resolves to "ou=users,dc=foo,dc=com" * "user/-3" resolves to "dc=foo,dc=com" * "user/-*" resolves to { "cn=ignacio,ou=admins,ou=users,dc=foo,dc=com", "ou=admins,ou=users,dc=foo,dc=com", "ou=users,dc=foo,dc=com", "dc=foo,dc=com", "dc=com", "" } 2. ACCESS CONTROL EVALUATION ---------------------------- After the previous examples, it's time to put it all together. -- The way "set" ACLs works is to grant the access if the expression returns something, don't grant access if the expression returns an empty set --, independtly the authenticated user is. This seems very simple (it's indeed) but can be very dangerous: we can grant access to an object by an unwanted user if we dont write the expression carefully. As usual, it's better to understand it with examples: * access to dn="ou=users,dc=foo,dc=com" by set="[A]" write Will grant write access to any user, because the set expression always return "A" * access to dn="ou=users,dc=foo,dc=com" by set="[A] & [B]" write Will NOT grant write access to any user, because the set expressions always returns an empty set. * access to dn="ou=users,dc=foo,dc=com" by set="user" write Will grant write access to any user, because the set expression always return the user DN. * access to dn="ou=users,dc=foo,dc=com" by set="user/description" write Will grant write access only if the object used to authenticate has the attribute "description" * access to dn="ou=users,dc=foo,dc=com" by set="user & [cn=ignacio,ou=users,dc=foo,dc=com]" write Will grant write access if the user DN is "cn=ignacio,ou=users,dc=foo,dc=com", because this is the only case the expression "user & [cn=ignacio,ou=users,dc=foo,dc=com]" will return something. * access to dn="ou=users,dc=foo,dc=com" by set="user/-2 & [dc=foo,dc=com]" write Will grant write access to any user two levels over "dc=foo,dc=com" domain, independly the "ou" is. In other words, "cn=ignacio,ou=users,dc=foo,dc=com" and "cn=clara,ou=admins,dc=foo,dc=com" will have write access, but "cn=claudia,ou=mail,ou=admins,dc=foo,dc=com" will not. * access to dn="ou=users,dc=foo,dc=com" by set="user/description & this/description" write Will grant write access to any user which description match the accessed object description. * access to dn="ou=users,dc=foo,dc=com" by set="(user/domain & this/domain)/-2 & [dc=foo,dc=com]" write Will grant write access to any user wich domain attribute match accessed object attribute and also domain is equal to "dc=foo,dc=com". * access to dn.regex="cn=(.+?),ou=users,(.+?)$" by set.regex="($1 & [ignacio]) & ($2 & [dc=foo,dc=com])" write Will grant write access if the user cn is "ignacio" and domain is "dc=foo, dc=com". Best Regards, Ignacio Gallegos Sánchez

2 1

schema for host info?
by Doug OLeary 09 Oct '14

09 Oct '14

Hi; I'm looking to store some host information in an ldap directory. Example attributes are: * Hostname * IP * Netmask * Default gateway * Remote console info * H/W * Serial number * Distribution List addresses to contact if the system has issues. Some of those are obvious: host, iphostnumber, ipnetmasknumber and serialnumber; the others somewhat less so. Any suggestions on how I could approach getting this information in my directory? Best case would be a pre-defined schema that I'm unable to find. Runner up would be a pointer from someone who's already faced and solved this issue. Thanks for any help/hints/tips. Doug O'Leary ------------ Senior UNIX/Security Admin CISSP, CISA, RHCE, CEH O'Leary Computers Inc dkoleary(a)olearycomputers.com (w) 630-904-6098 (c) 630-248-2749 linkedin: http://www.linkedin.com/in/dkoleary resume: http://www.olearycomputers.com/resume.html

3 2

Phpldapadmin can't connect openldap
by Onni Hakala 09 Oct '14

09 Oct '14

Hey! I need help with configuring openldap so that it allows logging in to phpldapadmin. Can you please give me hints how to debug my ldap authentication? I have a freshly installed server with ubuntu 14.04. I installed openldap and phpldapadmin following digitalocean tutorial [1]. My goal is to have all my user accounts in openldap. Services which will be using openldap are owncloud and dovecot. I don't have strong experience with openldap so I wanted to have phpldapadmin for easy administration of ldap database. Openldap is now installed and I can verify that it's working by running command below and entering ldap-root password: $ ldapsearch -x -W -D 'cn=admin,dc=XYZXYZ,dc=fi' -b "" -s base -H ldap://localhost Enter LDAP Password: # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: ALL # # dn: objectClass: top objectClass: OpenLDAProotDSE # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Phpldapadmin is also installed and I have verified that it's connecting to ldap. When I try to login to phpldapadmin with same credentials as ldapsearch above. It fails with message: Error: Invalid credentials (49) for user Why are these credentials wrong? I'm sure that password is correct and dn ('cn=admin,dc=XYZXYZ,dc=fi') is correct. Is there something I need to enable in openldap authentication to allow requests from phpldapadmin? I have verified that phpldapadmin is connecting to correct ldap. Firstly I had this error message from phpldapadmin: Error: Can't contact LDAP server (-1) for user But changed /etc/phpldapadmin/config.php to have: $servers->setValue('server','host','ldap://localhost'); I have tried to reinstall both of them several times and still getting this same error. I checked Php error logs (/var/log/apache2/error.log) and they are empty. OPENLDAP VERSION: $ slapd -V @(#) $OpenLDAP: slapd (Ubuntu) (Mar 17 2014 21:20:08) $ buildd@aatxe:/build/buildd/openldap-2.4.31/debian/build/servers/slapd PHPMYADMIN VERSION: 1.2.2 Thanks in advance :)! [1] https://www.digitalocean.com/community/tutorials/how-to-install-and-configu… - Onni Hakala

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical