openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

Q: frontend and cn=Subschema
by Ulrich Windl 08 Sep '14

08 Sep '14

Hi! forgive a beginner's question, but: If I examine cn=Subschema, I see the following object classes: objectClass[0] top objectClass[1] subentry objectClass[2] subschema objectClass[3] extensibleObject And among the attributes is ldapSyntaxes. ldapSyntaxes however is not part of subentry or subschema; according to the schemata presented, ldapSyntaxes is only part of olcGlobal and olcSchemaConfig. So should cn=Subentry have olcSchemaConfig as auxiliary object class? And in which object class should structuralObjectClass (and things like createTimestamp) belong? Regards, Ulrich

2 1

OpenLDAP self-signed certificates issue
by Vijay Ganesan 08 Sep '14

08 Sep '14

For SSL, I'm trying to install a self-signed certificate to OpenLDAP (version 2.4.28 on Ubuntu 12.04). Followed the following steps: *1. Created server certificate using:* openssl req -newkey rsa:1024 -x509 -nodes -out server.pem -keyout server.pem -days 365 *2. Added following entries to /usr/share/slapd/slapd.conf:* TLSCACertificateFile server.pem TLSCertificateFile server.pem TLSCertificateKeyFile server.pem *3. Restarted openldap:* sudo /etc/init.d/slapd restart *4. Tried to read the certs:* openssl s_client -connect localhost:636 -showcerts This causes the following error: *CONNECTED(00000003)* *140409289410208:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177:* *---* *no peer certificate available* *---* *No client certificate CA names sent* *---* *SSL handshake has read 0 bytes and written 213 bytes* *---* *New, (NONE), Cipher is (NONE)* *Secure Renegotiation IS NOT supported* *Compression: NONE* *Expansion: NONE* *---* Can someone help with what might be wrong in the setup? Thanks -- - Vijay

5 9

LDAP gateway to RADIUS serverf
by David R 08 Sep '14

08 Sep '14

Dear All, I have setup 2 factor authentication on a RADIUS server (OTP).The user has to authenticate using:login: adusernamepassword: ADpasswordGENERATEDPIN My issue is that some applications like VMWare supports only LDAP authentication. So i was wondering how i could use RADIUS server for authentication inside LDAP. I have found some elements like pw-radius.so, but this is clearly not fully documented. So I was wondering if one of you has ever implemented this kind of solution and how... Kind reagrds, David

3 2

accesslog search filter using reqAttr
by John Alex. 08 Sep '14

08 Sep '14

Hi all, Is anyone using "reqAttr" of accesslog overlay to find ldap requests for specific attributes? Our accesslog db contains some entries like for example: dn: reqStart=20140902092840.000001Z,cn=accesslog objectClass: auditSearch reqStart: 20140902092840.000001Z reqEnd: 20140902092840.000002Z reqType: search reqSession: 1018 reqAuthzID: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth reqDN: dc=example,dc=com reqResult: 0 reqScope: sub reqDerefAliases: never reqAttrsOnly: FALSE reqFilter: (objectClass=*) reqAttr: userPassword reqEntries: 7 reqTimeLimit: 3600 reqSizeLimit: 500 I am trying to search using the filter "(reqAttr=userPassword)" but no results are returned, while "(reqAttr=*)" returns all entries. What am I missing? Using version 2.4.39 John

1 1

slap_client_connect error
by Gremaud Cyrill 08 Sep '14

08 Sep '14

Hello ! I’m trying to setup N-way multi master replication with openLDAP 2.4 but I have an error when I reload my servers. slapd_client_connect : URI=ldap://lda2.gremaud.local DN=“cn=config” ldap_sasl_bind_s failed (-1) How this error is possible ? I can make a ldapsearch with dn=config and correct password on all my servers… thanks for your help.

1 0

LMDB : MDB_BAD_RSLOT on mdb_txn_begin
by Venkat Murty 06 Sep '14

06 Sep '14

Hello, What is the reason I get MDB_BAD_RSLOT on mdb_txn_begin? This is a read transaction. -venkat

1 0

Mail System Error - Returned Mail
by dieter＠dkluenter.de 05 Sep '14

05 Sep '14

Your message could not be delivered

1 0

sha2 module and 2.4.39, iterations question
by bitsofinfo 04 Sep '14

04 Sep '14

Hi - openldap version = 2.4.39 With: moduleload pw-sha2.la I have an application that generates SHA256 b64 encoded hashes w/ a 4byte (16bit) salt and stores them in userPassword and binds work fine When I add this to slapd.conf: password-crypt-salt-format $5$rounds=1000$%.16s And change my application to add 1000 iterations when it writes to userPassword, then binds fail pw in userPassword is generated in this format: {SSHA256}b64Encoded(sha256Digest1000Iterations(pw+salt)+salt) Is "password-crypt-salt-format" the correct place to specify we want to use iterations on our hashes? Is this configurable?

2 2

Re[4]: Trying to Mirror 2 OpenLDAP servers
by Sterling Sahaydak 04 Sep '14

04 Sep '14

Thanks Quanah, Appreciate the prompt reply and as you advised, I'll try the other build you mentioned. Best Regards, Sterling ------ Original Message ------ From: "Quanah Gibson-Mount" <quanah(a)zimbra.com> To: "Sterling Sahaydak" <sterling.sahaydak(a)pi-coral.com>; openldap-technical(a)openldap.org Sent: 9/4/2014 7:12:22 PM Subject: Re: Re[2]: Trying to Mirror 2 OpenLDAP servers >--On Thursday, September 04, 2014 11:52 PM +0000 Sterling Sahaydak ><sterling.sahaydak(a)pi-coral.com> wrote: > >>I think your response, you may be getting confused with someone else? >> >>I haven't been on IRC - don't have an account there or even installed >>to >>check, so not sure of the dialog or reference you are referring to. >> >>As to the build, I'm on CentOS and not RHEL, so as to the build it's >>relatively up to date on that platform and definitely not 4 years old. >>Maybe a couple months old only. >> >>My understanding is this is not restricted to RHEL only, so still >>inquiring to the community assistance here. If there is another >>please, >>then please let me know. > >Ah, interesting timing... Someone was on IRC with a nick similar to >your name asking almost identical questions. ;) > >In any case, everything I noted still stands. Avoid the RHEL build >(that's what is in CentOS). Use a sane build. Otherwise you're just >wasting everyone's time. > >--Quanah > > >-- > >Quanah Gibson-Mount >Server Architect >Zimbra, Inc. >-------------------- >Zimbra :: the leader in open source messaging and collaboration

1 0

Re[2]: Trying to Mirror 2 OpenLDAP servers
by Sterling Sahaydak 04 Sep '14

04 Sep '14

I think your response, you may be getting confused with someone else? I haven't been on IRC - don't have an account there or even installed to check, so not sure of the dialog or reference you are referring to. As to the build, I'm on CentOS and not RHEL, so as to the build it's relatively up to date on that platform and definitely not 4 years old. Maybe a couple months old only. My understanding is this is not restricted to RHEL only, so still inquiring to the community assistance here. If there is another please, then please let me know. Running into the following: slapd -d sync @(#) $OpenLDAP: slapd 2.4.23 (Feb 3 2014 19:11:35) $ mockbuild@c6b10.bsys.dev.centos.org:/builddir/build/BUILD/openldap-2.4.23/openldap-2.4.23/build-servers/servers/slapd /etc/openldap/slapd.conf: line 163: warning, destination attributeType 'sAMAccountName' is not defined in schema PROXIED attributeDescription "SAMACCOUNTNAME" inserted. /etc/openldap/slapd.conf: line 213: rootdn is always granted unlimited privileges. bdb_monitor_db_open: monitoring disabled; configure monitor database to enable slapd starting TLS: error: the certificate '/etc/openldap/certs/ldap_example_net.crt' could not be found in the database - error -12285:Unable to find the certificate or key necessary for authentication.. TLS: certificate '/etc/openldap/certs/ldap_example_net.crt' successfully loaded from PEM file. TLS: no unlocked certificate for certificate 'CN=ldap.example.net,O="xx-xxxxxxx, INC.",L=xxxx,ST=xxxxxx,C=US'. do_syncrep2: rid=001 LDAP_RES_INTERMEDIATE - REFRESH_DELETE In my slapd.conf I have setup (Provider setup): TLSCertificateFile /etc/openldap/certs/ldap_example_net.crt TLSCertificateKeyFile /etc/openldap/certs/ldap_example_net.key TLSCACertificateFile /etc/openldap/certs/CAcompany.crt serverID 1 overlay syncprov #syncprov-checkpoint 100 10 syncprov-checkpoint 100 2 syncprov-sessionlog 100 #LDAP Sync - Slave - Consumer syncrepl rid=001 provider=ldaps://ldap-west.examplel.net bindmethod=simple binddn="cn=xxxxx,ou=Roles,dc=pcoral,dc=net" credentials=xxxxxxxxxxxx searchbase="dc=example,dc=net" filter="(objectclass=*)" attrs="*" schemachecking=on type=refreshAndPersist interval=00.00.00:30 retry="60 +" mirrormode on So, not sure why the synchronization isn't working? Thanks. ------ Original Message ------ From: "Quanah Gibson-Mount" <quanah(a)zimbra.com> To: "Sterling Sahaydak" <sterling.sahaydak(a)pi-coral.com>; openldap-technical(a)openldap.org Sent: 9/4/2014 5:47:38 PM Subject: Re: Trying to Mirror 2 OpenLDAP servers >--On Thursday, September 04, 2014 3:30 PM -0700 Quanah Gibson-Mount ><quanah(a)zimbra.com> wrote: > >>--On Thursday, September 04, 2014 10:14 PM +0000 Sterling Sahaydak >><sterling.sahaydak(a)pi-coral.com> wrote: >> >>> >>>Just updated slapd.conf with CA Certs and trying to get mirroring >>>synchronization to work. >>> >>>Running into the following: >>> >>>slapd -d sync >>>@(#) $OpenLDAP: slapd 2.4.23 (Feb 3 2014 19:11:35) $ >> >>Don't waste your time using this build, as you were already informed >>on >>IRC. > >Since you quit IRC in a huff, I'll give you some follow on thoughts: > >a) It is not the community's job to support the broken builds that RHEL >created. They are known to have numerous problems, some of which were >inflicted by RH itself by doing custom patches against OpenLDAP. > >b) 2.4.23 is over 4 years old at this point. There have been numerous >bugs fixed since that release, particularly around MMR. > >c) RHEL links to the non-standard NSS encryption libraries, which are >utterly broken in concept, which may be the cause of your cert issues > >d) There are freely available current alternatives to using the crap >shipped by RHEL if you are not comfortable with building OpenLDAP >yourself. You should investigate using them rather than complaining >that the community is refusing to support RHEL's garbage. > >Alternatives: ><http://www.symas.com/> - They offer free OpenLDAP builds sanely linked >to OpenSSL. They also provide support contracts, with extremely >knowledgable staff (The primary openldap developer works for them, for >example). > ><http://ltb-project.org/wiki/> - They offer free OpenLDAP builds sanely >linked to OpenSSL. They also have a support forum for their builds. > >--Quanah > >-- > >Quanah Gibson-Mount >Server Architect >Zimbra, Inc. >-------------------- >Zimbra :: the leader in open source messaging and collaboration

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical