openldap-technical

openldap-technical@openldap.org

19 participants
9800 discussions

CA and Intermediate Certificates
by Andrew Devenish-Meares 14 Aug '14

14 Aug '14

Hi All, We are currently assessing changing our TLS Certificate setup. We have been using a self-signed CA to issue certificates for our OpenLDAP setup, which has required us to supply the CA to anyone outside our organisation that wishes to use our OpenLDAP over TLS or SSL. We're currently starting to migrate our certificates to AusCERT, as we get a good deal as a University. As AusCERT is an intermediate CA, so we need to use a chain to get this to work. The server side works, as per the documentation, by adding the intermediate CA with the root CA in the olcTLSCertificateCAFile. This means that we need to install the intermediate certificate on clients that connect to our LDAP using SSL or TLS. Admittedly this isn't vastly different to what we need to do now in supplying our own CA. Looking at our Linux clients in particular, we need to add an appropriate TLS_CACERT directive to our openldap/ldap.conf. Is the intention, then, to point the client at the appropriate CA files? Is there a reason that OpenLDAP doesn't use the regular system CA store? Is there any reason for us not to point to the CA store that's already maintained? Cheers -- Andrew Devenish-Meares Solutions Analyst Information Technology University of New England Armidale NSW 2351 e: adevenis(a)une.edu.au p: 02 6773 4098 w: http://une.edu.au/itd

6 9

Specifying multiple password hashes
by Michael 14 Aug '14

14 Aug '14

Since both the password-hash and password-crypt-salt-format are Global options, is it possible to specify the password-hash on a per BDB backend basis? For example, I have 4 BDB backends and I'd like them all to have the CRYPT and salt listed below sans one BDB backend where it needs to be CLEARTEXT. However, when I specify this configuration in sladp.conf and bounce slapd I get the following error when trying to change a users password with the ldappasswd command. It's worth nothing that an ldapmodify to the userPassword attribute works just fine. I use security ssf=256, which is a Global option as well on a per BDB backend basis and this works just fine so I assumed this config for hashes would work as well. Error message: "Result: Constraint violation (19) Additional info: Password policy only allows one password value" Relevant config below: ## GLOBAL SETTING password-hash {CRYPT} password-crypt-salt-format $6$%.12s ### BDB DATABASE SETTING database bdb suffix "dc=testldap,dc=com" rootdn "cn=LDAPAdmin,dc=testldap,dc=com" directory /var/lib/ldap/testldap password-hash {CLEARTEXT}

2 2

How to do a case insensitive substring search on a case-sensitive field ?
by Guillermo-Nicolas Guénon Díaz 14 Aug '14

14 Aug '14

Hello, [First of all, sorry if this question has already been answered before: the search on this mailing list does not work currently so I haven't been able to check.] I need to write a filter so that when the user of my software introduces any substring of the content of a field in any case (upper, lower or mixed case), it finds the entry. It must work even if the user does not input a complete word, but just a part of a word. The field is called "supName" and it follows the DirectoryString syntax. This means that the default matching rule is exact and case sensitive ("caseExactMatch"). But according to: http://www.zytrax.com/books/ldap/apa/types.html , this syntax should allow also "caseIgnoreMatch" and "caseIgnoreSubstringsMatch" matching rules. I though I just needed to force to use the last one ("caseIgnoreSubstringsMatch"), so I tried this filter: (supName:caseIgnoreSubstringsMatch:=*somesubstring*) But this does not work. I make my tests using Apache Directory Studio, and that tool refuses to accept the above filter. It complains on the asterisks, and I don't understand why, since I am using a Substring match (and thus asterisks should be allowed). If I run the filter from command line (using ldapsearch), I get this error message: ldap_search_ext: Bad search filter (-7) Therefore this is not an issue with Apache Directory Studio. So my question is: What is the correct way of defining a case-insensitive substring filter on a field that is case-sensitive by default? Yesterday I filled a question in StackOverflow regarding this same issue. There are more details and examples in that question: http://stackoverflow.com/questions/25290494/case-insensitive-substring-ldap… Any help would be greatly appreciated ! Thank you very much. Nicolas

2 1

slapd.conf loglevel for slapo-rwm operations?
by Anthony Clark 13 Aug '14

13 Aug '14

Hello, What loglevel should I set to see the "[rw]" operations performed by slapo-rwm? Thanks! -Anthony Clark, DevOps and Skulduggery.

1 0

Create Distribution List
by Jerry 12 Aug '14

12 Aug '14

I don't know if this is the best place to ask this question, but it is probably as good as any to start. I am a new user of OpenLDAP. I formerly, and still do use the MS Outlook address book to store my contacts. I can duplicate most of the features of the MS Address book, except the ability to create distribution lists. I just cannot figure out how to accomplish this feat. Using MS Outlook, or Claws-Mail on my FreeBSD machine, I can type in a distribution name and all of the email addresses are filled in. EXAMPLE: distribution list name=my-list john(a)somewhere.com jill(a)anotherISP.net jim(a)hisISP.com Some of these distribution lists are quite large. I cannot fine out a way to create a similar list in OpenLDAP, which is a serious buzz, not to mention deal killer in this instance. Thanks! -- Jerry

5 5

LMDB storing generated values
by Simon Majou 11 Aug '14

11 Aug '14

Hello, Is there a way to write a value one part at a time ? For instance a value which is being generated, or received. >From the doc I found 2 put methods, but they expect a pointer to the full value. -- Best regards, Simon

2 2

Migration process in detail
by Rodrigo Coutinho 11 Aug '14

11 Aug '14

Hi, in a near future I will need to migrate from Oracle OID to Openldap. Could you please share more details of your migration process, the approach taken, the problems you faced and how did you resolved them. Right now I can't see how can I migrate the encripted user passwords. Is it possible ? I would appreciate any information you could provide. Thank you in advance A transmiss�o de mensagens por e-mail n�o � absolutamente segura ou livre de erros. A mensagem pode ser intercetada, alterada, perdida, destru�da, chegar ao destinat�rio com atraso, ou mesmo com v�rus, n�o obstante o IFAP utilizar software anti-v�rus. Esta mensagem, incluindo eventuais ficheiros anexos, pode conter informa��o confidencial ou privilegiada e destina-se a uso exclusivo dos seus destinat�rios. Se n�o for o destinat�rio pretendido, informamos que a recebeu por engano, pelo que, qualquer utiliza��o, distribui��o, reencaminhamento ou outra forma de revela��o a terceiros, impress�o ou c�pia s�o expressamente proibidos. Se recebeu esta mensagem por engano, por favor contacte imediatamente o remetente por e-mail, e apague de imediato a mensagem do seu sistema inform�tico. O IFAP declina qualquer responsabilidade por erros ou omiss�es na presente mensagem e eventuais consequ�ncias, que resultem das situa��es referidas.

1 0

Auto Response
by Paul 10 Aug '14

10 Aug '14

1 0

Why cannot run slapadd -l backup.ldif which requires deprecated lsapd.conf?
by jupiter 09 Aug '14

09 Aug '14

Hi, I am running openldap version 2.4.23 on CentOS 6.5, there is no slapd.conf, according to the document it is deprecated. But when I run slapadd, it got an error. # slapadd -v -l /root/backup.ldif could not stat config file "/etc/openldap/slapd.conf": No such file or directory (2) slapadd: bad configuration file! Now I am confused, if the slapd.conf is deprecated why the slapadd sdepends on it? How can I generate the slapd.conf, or copy a template of slpad.conf? Thank you and appreciate your advice - j

3 6

LMDB and writes
by Bill Hastings 09 Aug '14

09 Aug '14

Hi All Just getting my feet wet with LMDB. Is it possible for multiple threads write into LMDB concurrently? Or should writes be serialized to LMDB? Thanks Bill

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical