openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

allow to pass on "undefined" filters in meta
by Markus.Storm＠t-systems.com 12 Nov '14

12 Nov '14

Hi I've run into a problem trying to deploy back-meta in front of an Active Directory target. I believe that to resolve it, I need to get a new option implemented. I need to issue a request through a back-meta proxy . That query happens to contain a matching rule which is not implemented in OpenLDAP so slapd does not know to evaluate the query. The target that the query will ultimately be passed on to (an Active Directory) does know to process the query, though. OpenLDAP, however, considers the filter to be "undefined" and thus on relaying the request to the AD target, back-meta replaces a portion of the original query with a "(?=undefined)" filter as documented in e.g. slapd-meta manpage "noundeffilter" option. But I need the original query to be passed on. It's in fact a _valid_ LDAP request, just OpenLDAP happens to be unable to parse it. But at least in my setup, slapd does not have to do _anything_ about the query other than to pass it on, so I find it inacceptable that it replaces the query just because it doesn't understand it. Please, can you add an option switch to the code to allow for passing on original queries *without* replacing undefined portions ? I have not found any other solution to my problem. I tried to make OpenLDAP aware of the undefined portion by adding the matching rule to the schema but I failed. Seems that would need to be planted into the code, and not being a programmer, that's not as easy as it is with expanding the schema by some new attributes. Also, while of course any parser/feature enhancement will always be appreciated, I would think that to implement the matching rule is not the best way of fixing things: I believe there will always be situations where OpenLDAP cannot parse the input while another LDAP server can. For a proof of concept, I hacked servers/slapd/back-meta/map.c (around line 581 as of 2.4.39) and but - again, I'm not a programmer - I feel incapable of turning this into a full-blown patch free of side effects, also I want the modification to become available to anyone. So I'm hoping for you to implement the switch mentioned above, maybe as a third possible setting for the "noundeffilter" option. Thanks a lot in advance, best regards Markus Storm

3 4

[PATCH] Fix OpenLDAP build when using LibreSSL
by Xin Li 12 Nov '14

12 Nov '14

Hi, A FreeBSD user have proposed the patch below to solve OpenLDAP compile issue when using LibreSSL, which I think would be good to share with upstream. The patch can be found at: https://svnweb.freebsd.org/ports/head/net/openldap24-server/files/patch-des… The patch was created by "Spil Oss <spil.oss(a)gmail.com>" so credit should go to the submitter: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=194841 Cheers, --- libraries/liblutil/passwd.c.orig 2014-09-19 03:48:49.000000000 +0200 +++ libraries/liblutil/passwd.c 2014-11-05 19:57:10.807555025 +0100 @@ -38,11 +38,11 @@ # include <openssl/des.h> -typedef des_cblock des_key; -typedef des_cblock des_data_block; -typedef des_key_schedule des_context; -#define des_failed(encrypted) 0 -#define des_finish(key, schedule) +typedef DES_cblock DES_key; +typedef DES_cblock DES_data_block; +typedef DES_key_schedule DES_context; +#define DES_failed(encrypted) 0 +#define DES_finish(key, schedule) #elif defined(HAVE_MOZNSS) /* @@ -53,9 +53,9 @@ */ #define PROTYPES_H 1 # include <nss/pk11pub.h> -typedef PK11SymKey *des_key; -typedef unsigned char des_data_block[8]; -typedef PK11Context *des_context[1]; +typedef PK11SymKey *DES_key; +typedef unsigned char DES_data_block[8]; +typedef PK11Context *DES_context[1]; #define DES_ENCRYPT CKA_ENCRYPT #endif @@ -664,10 +664,10 @@ * abstract away setting the parity. */ static void -des_set_key_and_parity( des_key *key, unsigned char *keyData) +DES_set_key_and_parity( DES_key *key, unsigned char *keyData) { memcpy(key, keyData, 8); - des_set_odd_parity( key ); + DES_set_odd_parity( key ); } @@ -677,7 +677,7 @@ * implement MozNSS wrappers for the openSSL calls */ static void -des_set_key_and_parity( des_key *key, unsigned char *keyData) +DES_set_key_and_parity( DES_key *key, unsigned char *keyData) { SECItem keyDataItem; PK11SlotInfo *slot; @@ -699,7 +699,7 @@ } static void -des_set_key_unchecked( des_key *key, des_context ctxt ) +DES_set_key_unchecked( DES_key *key, DES_context ctxt ) { ctxt[0] = NULL; @@ -712,37 +712,37 @@ } static void -des_ecb_encrypt( des_data_block *plain, des_data_block *encrypted, - des_context ctxt, int op) +DES_ecb_encrypt( DES_data_block *plain, DES_data_block *encrypted, + DES_context ctxt, int op) { SECStatus rv; int size; if (ctxt[0] == NULL) { /* need to fail here... */ - memset(encrypted, 0, sizeof(des_data_block)); + memset(encrypted, 0, sizeof(DES_data_block)); return; } rv = PK11_CipherOp(ctxt[0], (unsigned char *)&encrypted[0], - &size, sizeof(des_data_block), - (unsigned char *)&plain[0], sizeof(des_data_block)); + &size, sizeof(DES_data_block), + (unsigned char *)&plain[0], sizeof(DES_data_block)); if (rv != SECSuccess) { /* signal failure */ - memset(encrypted, 0, sizeof(des_data_block)); + memset(encrypted, 0, sizeof(DES_data_block)); return; } return; } static int -des_failed(des_data_block *encrypted) +DES_failed(DES_data_block *encrypted) { - static const des_data_block zero = { 0 }; + static const DES_data_block zero = { 0 }; return memcmp(encrypted, zero, sizeof(zero)) == 0; } static void -des_finish(des_key *key, des_context ctxt) +DES_finish(DES_key *key, DES_context ctxt) { if (*key) { PK11_FreeSymKey(*key); @@ -817,7 +817,7 @@ static void lmPasswd_to_key( const char *lmPasswd, - des_key *key) + DES_key *key) { const unsigned char *lpw = (const unsigned char *) lmPasswd; unsigned char k[8]; @@ -832,7 +832,7 @@ k[6] = ((lpw[5] & 0x3F) << 2) | (lpw[6] >> 6); k[7] = ((lpw[6] & 0x7F) << 1); - des_set_key_and_parity( key, k ); + DES_set_key_and_parity( key, k ); } static int chk_lanman( @@ -843,10 +843,10 @@ { ber_len_t i; char UcasePassword[15]; - des_key key; - des_context schedule; - des_data_block StdText = "KGS!@#$%"; - des_data_block PasswordHash1, PasswordHash2; + DES_key key; + DES_context schedule; + DES_data_block StdText = "KGS!@#$%"; + DES_data_block PasswordHash1, PasswordHash2; char PasswordHash[33], storedPasswordHash[33]; for( i=0; i<cred->bv_len; i++) { @@ -864,21 +864,21 @@ ldap_pvt_str2upper( UcasePassword ); lmPasswd_to_key( UcasePassword, &key ); - des_set_key_unchecked( &key, schedule ); - des_ecb_encrypt( &StdText, &PasswordHash1, schedule , DES_ENCRYPT ); + DES_set_key_unchecked( &key, &schedule ); + DES_ecb_encrypt( &StdText, &PasswordHash1, &schedule , DES_ENCRYPT ); - if (des_failed(&PasswordHash1)) { + if (DES_failed(&PasswordHash1)) { return LUTIL_PASSWD_ERR; } lmPasswd_to_key( &UcasePassword[7], &key ); - des_set_key_unchecked( &key, schedule ); - des_ecb_encrypt( &StdText, &PasswordHash2, schedule , DES_ENCRYPT ); - if (des_failed(&PasswordHash2)) { + DES_set_key_unchecked( &key, &schedule ); + DES_ecb_encrypt( &StdText, &PasswordHash2, &schedule , DES_ENCRYPT ); + if (DES_failed(&PasswordHash2)) { return LUTIL_PASSWD_ERR; } - des_finish( &key, schedule ); + DES_finish( &key, schedule ); sprintf( PasswordHash, "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x", PasswordHash1[0],PasswordHash1[1],PasswordHash1[2],PasswordHash1[3], @@ -1139,10 +1139,10 @@ ber_len_t i; char UcasePassword[15]; - des_key key; - des_context schedule; - des_data_block StdText = "KGS!@#$%"; - des_data_block PasswordHash1, PasswordHash2; + DES_key key; + DES_context schedule; + DES_data_block StdText = "KGS!@#$%"; + DES_data_block PasswordHash1, PasswordHash2; char PasswordHash[33]; for( i=0; i<passwd->bv_len; i++) { @@ -1160,12 +1160,12 @@ ldap_pvt_str2upper( UcasePassword ); lmPasswd_to_key( UcasePassword, &key ); - des_set_key_unchecked( &key, schedule ); - des_ecb_encrypt( &StdText, &PasswordHash1, schedule , DES_ENCRYPT ); + DES_set_key_unchecked( &key, &schedule ); + DES_ecb_encrypt( &StdText, &PasswordHash1, &schedule , DES_ENCRYPT ); lmPasswd_to_key( &UcasePassword[7], &key ); - des_set_key_unchecked( &key, schedule ); - des_ecb_encrypt( &StdText, &PasswordHash2, schedule , DES_ENCRYPT ); + DES_set_key_unchecked( &key, &schedule ); + DES_ecb_encrypt( &StdText, &PasswordHash2, &schedule , DES_ENCRYPT ); sprintf( PasswordHash, "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x", PasswordHash1[0],PasswordHash1[1],PasswordHash1[2],PasswordHash1[3], -- Xin LI <delphij(a)delphij.net> https://www.delphij.net/ FreeBSD - The Power to Serve! Live free or die

2 1

LDAP auth is failing when I disconnect and re-connect AD server
by Adarsha S 12 Nov '14

12 Nov '14

Hi All, I've a setup where I've installed openldap-2.4.25 on debian machine to access windows 2003 AD server. my radius server use the libraire of openldap-2.4.25. Along with this i'm using samba to join the AD domain and bring up winbindd. The senario is this way. After I've started my radius server, winbindd process autherthication works fine. Now I disconnect my AD server for a while.Try to authenticate. It fails. This is a valid senario. But after I re-connect my AD server still the authentication says invalid users. I would like to know how to debug this issue as i'm not able to get logs also. Thanks in Advance, Adarsha

1 0

adding VLV support to OpenLDAP 2.4.31
by Igor Shmukler 12 Nov '14

12 Nov '14

Hello, I apologize if I am posting to the wrong mailing list. I have a simple problem, which I am sure any OpenLDAP administrator can easily solve... I am not an administrator, however. Hence being unable to answer this trivial question presents a real problem. I am stuck. Any assistance would be greatly appreciated. I am trying to add Virtual List View support to an OpenLDAP server on hosted Ubuntu. The distro version is Ubuntu 14.04.1 LTS. The OpenLDAP server is already running. I receive responses to basic commands, but VLV is not working. When I run the version command, I get: vq@vq-HVM-domU:~$ slapd -VV @(#) $OpenLDAP: slapd (Ubuntu) (Mar 17 2014 21:20:08) $ buildd@aatxe:/build/buildd/openldap-2.4.31/debian/build/servers/slapd I added the following lines to the slapd.conf file (located for some reason in a funky place /usr/share/slapd/slapd.conf ) moduleload sssvlv.so overlay sssvlv My path seems to be OK: modulepath /usr/lib/ldap The dynamic library appears to be in the right place as well: vq@vq-HVM-domU:~$ ls -l /usr/lib/ldap/sssvlv.so lrwxrwxrwx 1 root root 19 Mar 17 2014 /usr/lib/ldap/sssvlv.so -> sssvlv-2.4.so.2.8.3 vq@vq-HVM-domU:~$ ls -l /usr/lib/ldap/sssvlv-2.4.so.2.8.3 -rw-r--r-- 1 root root 26872 Mar 17 2014 /usr/lib/ldap/sssvlv-2.4.so.2.8.3 I cut out a piece of dmesg, just in case: [ 0.000000] Linux version 3.13.0-32-generic (buildd@kissel) (gcc version 4.8. 2 (Ubuntu 4.8.2-19ubuntu1) ) #57-Ubuntu SMP Tue Jul 15 03:51:08 UTC 2014 (Ubuntu 3.13.0-32.57-generic 3.13.11.4) I tried to figure out how to see what OpenLDAP modules are loaded, but did not find the appropriate documentation, at least quickly. Sorry again. I am sure the list subscribers where where to look. I unfortunately do not. There is no slapd-config executable on this system. Hence, I am assuming that slapd.conf is being used. Please advise what I am missing and/or doing wrong. Any suggestions are welcome If this is a totally wrong place to ask, please direct me to an appropriate resource. The server fault forums did not produce immediate results. Thank you, Igor Shmukler

5 16

Fwd: interaction of LastBind and Accesslog modules
by David Tello 11 Nov '14

11 Nov '14

i have a problem with the modules lastbind and access log. Without lastbind modulo i can to audit the login of users finding the bind entries in the accesslog database. My problem is that when i active the lastbind module, this bind entries not appear in access log database. Instead appear modify entries that modify the AUTHTIMESTAMP attribute in the users that did the login, and the reqAuthnz of the modify is the rootDN of the directory. I can change the mode to audit the login finding this new entries, but i want to know if this is the normal funcionality or this a problem in the interaction of both. Thanks to all.

3 4

export directory in LDIF format
by Jerry 11 Nov '14

11 Nov '14

I have a strange problem exporting my directory into LDIF format. I am using the "mdb" format with openldap. /usr/local/sbin/slapcat -l MyDomain.net.ldif -b "dc=MyDomain,dc=net" If I run this command after starting "slapd", it works fine. However, I have this configured to run from a CRON job at midnight. It fails with this message: 5460a615 mdb_db_open: database "dc=MyDomain,dc=net" cannot be opened: No such file or directory (2). Restore from backup! 5460a615 backend_startup_one (type=mdb, suffix="dc=MyDomain,dc=net"): bi_db_open failed! (2) slap_startup failed This also occurs from the command line if the database has not been accessed for several hours, usually on a weekend. Restarting "slapd" immediately corrects the problem. I have checked and "slapd" is running when the failure occurs. I tried accessing the database and then using the backup command; however, the failure still continues. That is assuming that it failed to begin with obviously. Is there some sort of a "sleep" mode or something like that, that I am not aware of, or some really hard to debug "bug" somewhere? -- Jerry

4 4

How do I say to LDAP to use my configuration instead of the default one?
by Abel Guzmán Sánchez 11 Nov '14

11 Nov '14

Hi, I am writing because some time ago I have done some things with LDAP. But I am unable to make the new versions work (2.4.x). Basically I create the config file but I am unable to say to LDAP to use it instead of the default one. Is that clear somewhere in the documentation? can anyone help me? I have followed the official documentation and I managed to compile and create the config files (Config manual <http://www.openldap.org/doc/admin24/slapdconf2.html>), after this I have an ldif file like this: root@helpDesk10000:~# cat base.ldif # example config file - global configuration entry dn: cn=config objectClass: olcGlobal cn: config # olcReferral: ldap://root.openldap.org # internal schema dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema # include the core schema include: file:///usr/local/etc/openldap/schema/core.ldif <http:///usr/local/etc/openldap/schema/core.ldif%3C/p%3E%3Cp%3E#> <http:///usr/local/etc/openldap/schema/core.ldif%3C/p%3E%3Cp%3E#> # <http:///usr/local/etc/openldap/schema/core.ldif%3C/p%3E%3Cp%3E#> global database parameters dn: olcDatabase=frontend,cn=config objectClass: olcDatabaseConfig olcDatabase: frontend olcAccess: to * by * read # set a rootpw for the config database so we can bind. # deny access to everyone else. dn: olcDatabase=config,cn=config objectClass: olcDatabaseConfig olcDatabase: config olcRootPW: {SSHA}EQpw7T2x2Num+krwRjq/ZYczmRgaX1Km olcAccess: to * by * none # HDB definition for example.com dn: olcDatabase=bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: hdb olcSuffix: dc=helpdesk,dc=co,dc=bw olcDbDirectory: /var/lib/ldap-database olcRootDN: cn=Manager,dc=helpdesk,dc=co,dc=bw olcRootPW: {SSHA}teY3/6WO7uoGrCmaDu9NKmvgn87WlCCw olcDbIndex: uid pres,eq olcDbIndex: cn,sn pres,eq,approx,sub olcDbIndex: objectClass eq olcAccess: to attrs=userPassword by self write by anonymous auth by dn.base="cn=Admin,dc=helpdesk,dc=co,dc=bw" write by * none olcAccess: to * by self write by dn.base="cn=Admin,dc=helpdesk,dc=co,dc=bw" write by * read root@helpDesk10000:~# Then the LDAP add apparently works: root@helpDesk10000:~# ldapadd -Y EXTERNAL -H ldapi:/// -vn -f base.ldif add objectClass: olcGlobal add cn: config !adding new entry "cn=config" add objectClass: olcSchemaConfig add cn: schema !adding new entry "cn=schema,cn=config" add objectClass: olcSchemaConfig add cn: core add olcAttributeTypes: ( 2.5.4.2 NAME 'knowledgeInformation' DESC 'RFC2256: knowledge information' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) ( 2.5.4.4 NAME (...) add olcDbDirectory: /var/lib/ldap-database add olcRootDN: cn=Manager,dc=helpdesk,dc=co,dc=bw add olcRootPW: {SSHA}teY3/6WO7uoGrCmaDu9NKmvgn87WlCCw add olcDbIndex: uid pres,eq cn,sn pres,eq,approx,sub objectClass eq add olcAccess: to attrs=userPassword by self write by anonymous auth by dn.base="cn=Admin,dc=helpdesk,dc=co,dc=bw" write by * none to * by self write by dn.base="cn=Admin,dc=helpdesk,dc=co,dc=bw" write by * read !adding new entry "olcDatabase=bdb,cn=config" root@helpDesk10000:~# after that I start slapcat and it says this: root@helpDesk10000:~# slapcat 545b828d bdb_db_open: warning - no DB_CONFIG file found in directory /usr/local/var/openldap-data: (2). Expect poor performance for suffix "dc=my-domain,dc=com". 545b828d bdb_monitor_db_open: monitoring disabled; configure monitor database to enable root@helpDesk10000:~# *How do I say to LDAP to use my configuration instead of the default one?* Thank you!

2 1

PFS: ITS#7506 in master but not in release
by Christopher Odenbach 10 Nov '14

10 Nov '14

Hi, while I was trying to find out why slapd does not use Perfect Forward Secrecy I found bug #7506 from september 2013. The patch has already been applied to the master branch but still cannot be found in any released version since. Why is this so? I would like to see good encryption in OpenLDAP for Debian. Regards, Christopher -- ====================================================== Dipl.-Ing. Christopher Odenbach Zentrum fuer Informations- und Medientechnologien Universitaet Paderborn Raum N5.311 odenbach(a)uni-paderborn.de Tel.: +49 5251 60 5315 ======================================================

4 6

Ppolicy not working on openldap on ubuntu 12.04 server
by Guruprasad Kulkarni 10 Nov '14

10 Nov '14

Hi, I am using Ubuntu 12.04 LTS server and have installed openldap on it. The commands used were: apt-get install slapd ldap-utils dpkg-reconfigure slapd I selected the default options for the questions asked. I am having a hard time trying to make ppolicy work on it. I loaded the ppolicy.schema by making the following change to /etc/ldap.conf: include /etc/ldap/schema/ppolicy.schema I even tried the command "moduleload ppolicy.la" None have worked. If anyone knows of a way to make it work, please let me know. -Guruprasad

2 1

Backing up openldap
by Jerry 10 Nov '14

10 Nov '14

Before changing over to "mdb" from "bdb", I ran a script that used slapcat to generate an LDIF file every night. Since updating to "mdb", that script fails if "slapd" is running. That is expected behavior from what I have been reading. <http://www.openldap.org/faq/data/cache/288.html> My question is how do I export the directory into an LDIF file if "slapd" is running, or is that not supported? I could easily modify the script to shut down the program, backup the directory in an LDIF format and restart the program; however, that seems overly ambitious. I understand that "replication" is an option, but I don't know if I really want to go that route at this time. -- Jerry

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical