openldap-technical

openldap-technical@openldap.org

7 participants
9864 discussions

Getting the list of members in an AD group
by Sankar P 04 Jun '14

04 Jun '14

Hi, I have the SID of an AD group. I want to get the list of members who belong to that group. All the documentation page that I search for points me to the reverse only (i.e., getting all the groups membership information of a user). Can someone show me to the relevant way to get the users who belong to a group whose SID I have ? Thanks. -- Sankar P http://psankar.blogspot.com

6 15

ACL inconsistency
by John Alex. 04 Jun '14

04 Jun '14

Hi all, I use the following rules in my configuration: olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern al,cn=auth" manage by * break olcAccess: {1}to dn.one="ou=people,dc=xmpl,dc=co" filter="(pwdReset=TRUE)" a ttrs=userPassword by * none olcAccess: {2}to dn.subtree="ou=people,dc=xmpl,dc=co" by dn.base="cn=radius, ou=admins,dc=xmpl,dc=co" read by * break olcAccess: {3}to attrs=userPassword by anonymous auth olcAccess: {4}to dn.base="dc=xmpl,dc=co" by * read olcAccess: {5}to dn.subtree="ou=people,dc=xmpl,dc=co" by * read I have issues with rule {1} which I have set in order to disallow ldap bind and radius authentication from users whose password has been reset. I found out that this rule works when I request all attributes of a matching entry (uid=jdoe,ou=people,dc=xmpl,dc=co), but if I request specifically the attribute userPassword, its value is returned as if this rule did not exist: % ldapsearch -H ldapi:/// -D "cn=radius,ou=admins,dc=xmpl,dc=co" -W -x -b "ou=people,dc=xmpl,dc=co" "uid=jdoe" # extended LDIF # # LDAPv3 # base <ou=people,dc=xmpl,dc=co> with scope subtree # filter: uid=jdoe # requesting: ALL # # jdoe, people, xmpl.co dn: uid=jdoe,ou=people,dc=xmpl,dc=co objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top cn: John Doe sn: Doe uid: jdoe # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 % ldapsearch -H ldapi:/// -D "cn=radius,ou=admins,dc=xmpl,dc=co" -W -x -b "ou=people,dc=xmpl,dc=co" "uid=jdoe" "userPassword" # extended LDIF # # LDAPv3 # base <ou=people,dc=xmpl,dc=co> with scope subtree # filter: uid=jdoe # requesting: userPassword # # jdoe, people, xmpl.co dn: uid=jdoe,ou=people,dc=xmpl,dc=co userPassword:: dGVzdDEyMw== # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 ------------------------------------------ slapacl shows it should be ok in any case: % slapacl -F /usr/local/etc/openldap/slapd.d/ -v -D "cn=radius,ou=admins,dc=xmpl,dc=co" -b "uid=jdoe,ou=people,dc=xmpl,dc=co" authcDN: "cn=radius,ou=admins,dc=xmpl,dc=co" entry: read(=rscxd) children: read(=rscxd) objectClass=inetOrgPerson: read(=rscxd) objectClass=organizationalPerson: read(=rscxd) objectClass=person: read(=rscxd) objectClass=top: read(=rscxd) structuralObjectClass=inetOrgPerson: read(=rscxd) entryUUID=e959dfb8-76b6-1033-8972-4b1922a532ac: read(=rscxd) creatorsName=cn=admin,dc=xmpl,dc=co: read(=rscxd) createTimestamp=20140523111245Z: read(=rscxd) cn=John Doe: read(=rscxd) sn=Doe: read(=rscxd) uid=jdoe: read(=rscxd) userPassword=****: none(=0) pwdChangedTime=20140602101409Z: read(=rscxd) pwdReset=TRUE: read(=rscxd) entryCSN=20140602101723.590271Z#000000#000#000000: read(=rscxd) modifiersName=cn=admin,dc=xmpl,dc=co: read(=rscxd) modifyTimestamp=20140602101723Z: read(=rscxd) % slapacl -F /usr/local/etc/openldap/slapd.d/ -v -D "cn=radius,ou=admins,dc=xmpl,dc=co" -b "uid=jdoe,ou=people,dc=xmpl,dc=co" userPassword/read authcDN: "cn=radius,ou=admins,dc=xmpl,dc=co" read access to userPassword: DENIED ------------------------------------------ If I change the rule and keep just the filter or the attribute, like: olcAccess: {1}to dn.one="ou=people,dc=xmpl,dc=co" filter="(pwdReset=TRUE)" b y * none OR olcAccess: {1}to dn.one="ou=people,dc=xmpl,dc=co" attrs=userPassword by * no ne then it seems to work ok in all cases. # /usr/local/libexec/slapd -V @(#) $OpenLDAP: slapd 2.4.39 (May 9 2014 09:26:03) $ root@xmpl.co:/usr/ports/net/openldap24-server/work/openldap-2.4.39/servers/slapd Am I doing something wrong or is this a bug? Thanks in advance, John

2 2

ldapsearch utf-8 results
by Nicolas Cauchie 01 Jun '14

01 Jun '14

Hello there I use a Debian 7.4 server with ldapsearch to search data about users on an Active Directory database. When a result of a search contains specials characters (such as é, è, à), no result is given, but if I delete special characters to the user profile, it works. How could I make it work with special caracters (guess it's a UTF-8 problem ?) ? Thanks in advance Nicolas -- signature -----

5 6

Incremental ACLs somehow do not work
by Dominik George 31 May '14

31 May '14

Hi, I have these ACLs in place: olcAccess: {0}to dn.base="dc=teckids,dc=org" by group.exact="cn=ldapadmin,ou=Groups,dc=teckids,dc=org" manage by dn="cn=admin,dc=teckids,dc=org" manage by self read continue by * auth break olcAccess: {1}to dn.base="ou=Mailinglists,dc=teckids,dc=org" by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read continue by * break olcAccess: {2}to attrs=userPassword,shadowLastChange,loginShell by self write continue by anonymous auth continue by * break olcAccess: {3}to dn.subtree="ou=People,dc=teckids,dc=org" attrs=cn,uid,loginShell,homeDirectory,uidNumber,gidNumber,gecos by dn="cn=nslcd,dc=teckids,dc=org" read continue by * break olcAccess: {4}to dn.subtree="ou=People,dc=teckids,dc=org" attrs=uid,mailLocalAddress,mailRoutingAddress by dn="cn=postfix,dc=teckids,dc=org" read continue by * break olcAccess: {5}to dn.subtree="ou=Members,ou=People,dc=teckids,dc=org" attrs=employeeNumber by dn.subtree="ou=Board,ou=Members,ou=People,dc=teckids,dc=org" read continue by * none stop olcAccess: {6}to dn.subtree="ou=Members,ou=People,dc=teckids,dc=org" by dn.subtree="ou=Members,ou=People,dc=teckids,dc=org" read continue by * break olcAccess: {7}to dn.subtree="ou=Groups,dc=teckids,dc=org" by dn="cn=nslcd,dc=teckids,dc=org" read continue by * break olcAccess: {8}to dn.subtree="ou=Domains,dc=teckids,dc=org" by dn="cn=postfix,dc=teckids,dc=org" read continue by * break olcAccess: {9}to attrs=cn,uid,userPassword by * auth break But still, even a simple bind fails because it somehow does not get the auth privileges defined in the first stanza. The ACL log says: http://paste.ubuntu.com/7544324/ What did I miss? Cheers, Nik

2 2

Req for How to configure LMDB Database as backend
by Varadharajan S 30 May '14

30 May '14

I'm attempting to setup OpenLDAP 2.4.39 on Ubuntu 14.04 LTS and am getting lost on how to switch from the default hdb/bdb backend to mdb. On http://www.openldap.org/doc/admin24/backends.html#Overview in the 11.4. LMDB section it states: 11.4.2. back-mdb Configuration Unlike the HDB/BDB backends, the mdb backend can be instantiated with very few configuration lines: include ./schema/core.schema database mdb directory ./mdb suffix "dc=example,dc=com" rootdn "cn=mdb,dc=example,dc=com" rootpw mdb maxsize 1073741824 However it doesn't state where to make these entries. After installing OpenLDAP through dpkg or apt-get, I have an /etc/ldap/slapd.d/cn=config directory, which contains a file named olcDatabase={1}hdb.ldif. A grep of the directory returns other files containing various entries referencing hdb. Can anyone advise or provide a link on how to remove the hdb/bdb database configurations and how to use mdb? I've been googling the better part of this morning and while I have found a few howto's and guide's, they all just have bits of "do this" with no specification of where to do it or in what file. Or am I just missing something in general? Also, even if i try to reconfigure through #dpkg-reconfigure slapd doesn't ask while in the database selection ? It's having option to select bdb or hdb only.In our organization we are using 389 DS already and once we saw this LMDB feature in openldap, we are planning to migrate slapd.But while starting itself, we are struck.Please help us on the same.If possible include the clear configurarion steps in the official doc. Regards, Varad

4 6

Quick question re: memberOf and refInt overlays
by Mark Cairney 30 May '14

30 May '14

Hi, I suspect the answer is going to turn out to be blindingly obvious but I noticed this when reviewing my config of the 2 overlays mentioned and I thought this looked a little bit odd: dn: olcOverlay={1}memberof,olcDatabase={1}hdb,cn=config objectClass: olcMemberOf objectClass: olcOverlayConfig olcOverlay: {1}memberof olcMemberOfDangling: ignore olcMemberOfGroupOC: groupOfNames olcMemberOfMemberAD: member olcMemberOfMemberOfAD: memberOf olcMemberOfRefInt: TRUE dn: olcOverlay={3}refint,olcDatabase={1}hdb,cn=config objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcRefintConfig objectClass: top olcOverlay: {3}refint olcRefintAttribute: member olcRefintAttribute: memberOf So I have olcMemberOfRefint set to TRUE in the memberOf overlay and olcRefintAttribute: memberOf set in the refint overlay. Is this correct or should it only be defined in one of these overlays? If it is defined in both overlays as it currently is, can this cause issues such as contention/deadlocking as there are 2 overlays essentially trying to do the same thing. Or does it not actually matter? I'm using an HDB backend just in case that makes any difference. Kind regards, Mark -- /**************************** Mark Cairney ITI UNIX Section Information Services University of Edinburgh Tel: 0131 650 6565 Email: Mark.Cairney(a)ed.ac.uk *******************************/ The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

1 0

On-disk-format of back-mdb depends on LDAP syntax?
by Michael Ströder 29 May '14

29 May '14

HI! Does the on-disk-format of back-mdb depends on which LDAP syntax is used for an attribute? So if the LDAP syntax for an an existing attribute would change I have to reimport the MDB? Background: I've changed (as a work-around for a broken client software) the LDAP syntax of a custom attribute from Boolean to IA5String. After that I could still read the attribute. But when deleting the attribute slapd returned noSuchAttribute(16). I had to remove the whole entry. BTW: No index configured this attribute. Ciao, Michael.

2 3

Making sure this is a real issue before I submit it
by Mark Henning 29 May '14

29 May '14

Good Afternoon, I am in the process of building an LDAP schema which has a number of attributes which will be constrained to specific values. I have run into an issue where slaptest will build the ldif file without syntax errors, but when slapd starts up it can't find the X-ENUM syntax defined in the same file. # service slapd start Checking configuration files for slapd: [FAILED] olcAttributeTypes: value #0 olcAttributeTypes: Syntax not found: "1.3.6.1.4.1.39235.2.3.500" config error processing cn={5}test,cn=schema,cn=config: olcAttributeTypes: Syntax not found: "1.3.6.1.4.1.39235.2.3.500" slaptest: bad configuration file! [root@DNEAA18S2 openldap]# slapd -V @(#) $OpenLDAP: slapd 2.4.23 (Jan 28 2014 09:30:02) $ mockbuild(a)x86-022.build.eng.bos.redhat.com: /builddir/build/BUILD/openldap-2.4.23/openldap-2.4.23/build-servers/servers/slapd I have simplified the problem to a single syntax, attribute and object class. The .schema file and resulting ldif are attached. Is this a legitimate issue to report, or have I made some subtle syntax / contextual error that is preventing the attribute from finding the syntax? Cordially, -Mark Henning

2 1

Use active directory to check password but keep all user data in LDAP
by Mattias Segerdahl 28 May '14

28 May '14

Hello, I was wondering if it is possible to configure OpenLDAP 2.4 to only check the password validation with Active Directory and have the rest of the user attributes, such as mail, loginShell, homeDirectory, etc. come from OpenLDAP? Any pointers, guides, howto’s or even “let me google that for you” are highly appreciated. Cheers Mattias

5 4

RDN
by Artur Nike 28 May '14

28 May '14

Hi all, Is the suffix dc=example,dc=com in tree is a valid rdn ? and whether the drawing http://www.zytrax.com/books/ldap/ch2/dit-dn-rdn.pngis correct? Regards Mariusz

5 6

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical