openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

Checking client certificates against CRLs
by David Arroyo 14 Apr '14

14 Apr '14

This question may be better asked in the NSS mailing list. Feel free to let me know if that is the case. I'm building a service based around OpenLDAP and SASL EXTERNAL authentication using client certificates. One of requirements is that we have the ability to revoke client certificates. I've found that the only way to revoke a client certificate using an NSS-linked OpenLDAP (RHEL's default 2.4.23) is to: - Revoke the certificate - Import the CRL into the db referenced by olcTLSCACertificatePath - restart slapd Is there a way to update the CRL without restarting slapd? And is there any way to make slapd request the URL referenced in the client cert's nsCaRevocationUrl attribute? If the answer to this is "use OpenSSL", that's a fine answer. Regards, David

4 6

CRL with OpenSSL
by manu＠netbsd.org 14 Apr '14

14 Apr '14

Hi A cautious handling of heatbleed included renewing private keys and certificates. But that is of no interest if the possibly compromised certificate is not revoked, or if revokation is not enforced. I therefore tried CRL in OpenLDAP (linked with OpenSSL). I first started with client settings, in ~/.ldaprc: BASE dc=example,dc=net URI ldaps://ldap.example.net TLS_CACERT /etc/openssl/certs/ca.crt TLS_REQCERT demand TLS_CACERTDIR /home/manu/openssl/ca TLS_CRLCHECK all As suggested in the man page, I added a copy of /etc/openssl/certs/ca.crt in /home/manu/openssl/ca and tried a ldapsearch on the server. It fails, and with debug output I have: TLS certificate verification: Error, unable to get certificate CRL TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (unable to get certificate CRL). ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) kernel trace show that before the error message, it attemps to open /home/manu/openssl/ca/0726b466.r0 If I rename the CA to that name, it will read it, then fail on: TLS certificate verification: Error, unable to get certificate CRL TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:0906D06C:PEM routines:PEM_read_bio:no start line. That suggests the man page is wrong and it is not expecting a CA there. If I remove the CA from /home/manu/openssl/ca/ and copy the CRL in /home/manu/openssl/ca/0726b466.r0, it reads it without a complain, then tries to read /home/manu/openssl/ca/0726b466.r1 and fail there. If I copy /home/manu/openssl/ca/0726b466.r0 to /home/manu/openssl/ca/0726b466.r1, the message suggests that it is indeed trying to load the CRL from that file: TLS: can't connect: error:0B07D065:x509 certificate routines:X509_STORE_add_crl:cert already in hash table. I have a few questions before I start to read the code, just in case it is a known issue: Why the cryptic file names? And why do I need a second 0726b466.r1 file? Using TLS_CRLCHECK peer instead of TLS_CRLCHECK all does not change the behavior. And is OpenSSL CRL supposed to work? This is OpenLDAP 2.4.33 -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

5 11

Problem after migration openldap 2.3.43 to 2.4.23 --> 32 No Such Object
by Jonas Kellens 14 Apr '14

14 Apr '14

Hello, I have a working openLDAP server version 2.3.43. My configuration there works : the correct users have the correct access. I have set up a new openLDAP-server with newer version 2.3.43. I have no working openLDAP on version 2.3.43. I have tried with the new syntax and with the command /usr/sbin/slaptest -f /etc/openldap/slapd.conf -v to use the build in converion tool, but I always got : ldap_bind: Invalid credentials (49) So I forgot this conversion and continued with the "old" slapd.conf file. But in this configuration (which is just a copy/paste of my openLDAP 2.3.43) no user can query the LDAP entries. So this is the setup : I have a user : cn=U101001,ou=101001,dc=mydomain This user is member of the group : cn=tbook1,ou=gebruikers,ou=101001,dc=mydomain These members can read entries in the tree : ou=tbook1,ou=contacten,ou=101001,dc=mydomain I have in slapd.conf : access to dn.one="ou=tbook1,ou=contacten,ou=101001,dc=mydomain" by group.exact="cn=admins,ou=101001,dc=mydomain" write by group.exact="cn=tbook1,ou=gebruikers,ou=101001,dc=mydomain" read This user cn=U101001,ou=101001,dc=mydomain really exists (if you should doubt) : # extended LDIF # # LDAPv3 # base <cn=U101001,ou=101001,dc=mydomain> with scope subtree # filter: (objectclass=*) # requesting: ALL # # U101001, 101001, mydomain dn: cn=U101001,ou=101001,dc=mydomain cn: U101001 sn: U101001 objectClass: inetOrgPerson objectClass: top userPassword:: e1NTSEF9OVBTNmltR3ZpUEhzK1JRQVpickNVdVR5cS9Iejg5TzY= # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 The group cn=tbook1,ou=gebruikers,ou=101001,dc=mydomain also really exists (if you should doubt) : # tbook1, gebruikers, 101001, mydomain dn: cn=tbook1,ou=gebruikers,ou=101001,dc=mydomain cn: tbook1 member: cn=U101001,ou=101001,dc=mydomain objectClass: groupOfNames objectClass: top # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 When I query the LDAP-tree ou=tbook1,ou=contacten,ou=101001,dc=mydomain with my root-account (cn=Manager,dc=mydomain), the I get results : [root@ldap1 ]# ldapsearch -x -D 'cn=Manager,dc=mydomain' -b "ou=tbook1,ou=contacten,ou=101001,dc=mydomain" -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <ou=tbook1,ou=contacten,ou=101001,dc=mydomain> with scope subtree # filter: (objectclass=*) # requesting: ALL # # tbook1, contacten, 101001, mydomain dn: ou=tbook1,ou=contacten,ou=101001,dc=mydomain ou: tbook1 objectClass: organizationalUnit objectClass: top ...<cut>... # search result search: 2 result: 0 Success # numResponses: 5 # numEntries: 4 But when I query this same LDAP-tree with my user cn=U101001,ou=101001,dc=mydomain, I get : [root@ldap1 openldap]# ldapsearch -x -D 'cn=U101001,ou=101001,dc=mydomain' -b "dc=mydomain" -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=mydomain> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 I also have phpLDAPadmin installed and there I see that there are definitely enries in the LDAP-directory ou=tbook1,ou=contacten,ou=101001,dc=mydomain. So why does my user cn=U101001,ou=101001,dc=mydomain fails to get results ?? Kind regards, Jonas.

6 21

LMDB: fast writes: removing the write mutex ?
by Simon Majou 13 Apr '14

13 Apr '14

Hello, I wanted to know, how we could disable the write lock, in case the application shards the writes per thread ? I guess that would imply to have one btree per thread, isn't it ? We could as well use as many DB as threads (at the cost of also sharding the reads) ? In that case, how can I disable the write lock ? Would commenting LOCK_MUTEX_W() & UNLOCK_MUTEX_W() make the trick ? -- Best regards, Simon

1 0

Problems with slapo-rwm
by Fred Snilees 11 Apr '14

11 Apr '14

Hi I am trying to get slapo-rwm module working in a cn=config setup I have openldap with a local DB and ldap database backing onto a MS AD DB I am trying to rewrite objectclass group to groupOfUniqueNames and attribute member to uniqueMember this is what i use to set it up dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: {4}rwm dn: olcOverlay=rwm,olcDatabase={1}ldap,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: rwm olcRwmRewrite: rwm-rewriteEngine "on" olcRwmMap: {1}objectclass group groupOfUniqueNames olcRwmMap: {2}attribute member uniqueMember olcRwmNormalizeMapped: FALSE but when i try a ldapsearch it doesn't work , the object class and attribute are not re written

2 3

Strange password policy behaviour
by Philip Colmer 10 Apr '14

10 Apr '14

I'm using OpenLDAP 2.4.38. At some distant point when I was testing the configuration of our OpenLDAP server, I must have set pwdInHistory to 5 as I have 5 previous passwords stored in my account object. Before going live, though, I changed my mind and set pwdInHistory to 0. However, my account still retains those five previous passwords. I've tried applying a specific pwdPolicy to my object and setting pwdInHistory to 1 then changing my password but the object still retains 5 previous passwords :-(. Given that pwdHistory is read-only and therefore I cannot delete those entries, does anyone have any suggestions on how I can persuade OpenLDAP to forget those old passwords? I don't think changing the password multiple times is going to fix the problem either. Despite setting pwdInHistory to 1, changing the password multiple times doesn't seem to be working in the way I would expect. The five pwdHistory entries that are being shown by Apache Directory Studio all show a date from the beginning of 2013. I would expect ONE of those entries to be replaced with an entry with today's date and, even better, I would expect OpenLDAP to be removing entries if there are more than pwdInHistory's value. Regards Philip

2 2

2.4.39 error when starting openldap with mdb backend
by ping-shin ching 09 Apr '14

09 Apr '14

Using openldap 2.4.39 on solaris 10 sparc box. Bdb runs without any issue. Mdb fails on startup ( described below) Snip from the slapd.conf------------------------------------- database mdbsuffix "o=vtec,c=au"rootdn "cn=manager,o=vtec,c=au"# Cleartext passwords, especially for the rootdn, should# be avoid. See slappasswd(8) and slapd.conf(5) for details.# Use of strong authentication encouraged.rootpw secret# The database directory MUST exist prior to running slapd AND# should only be accessible by the slapd and slap tools.# Mode 700 recommended.directory /data/irene/var/openldap-data-mdbmaxsize 1073741824 Get this error on startup-------------------------------------- 34628c3 1.2.36.79672281.1.13.3 (rdnMatch): 534628c3 2.5.13.1 (distinguishedNameMatch): 534628c3 matchingRuleUse: ( 2.5.13.1 NAME 'distinguishedNameMatch' APPLIES ( creatorsName $ modifiersName $ subschemaSubentry $ entryDN $ namingContexts $ aliasedObjectName $ dynamicSubtrees $ distinguishedName $ seeAlso $ olcDefaultSearchBase $ olcRootDN $ olcSchemaDN $ olcSuffix $ olcUpdateDN $ olcRelay $ member $ owner $ roleOccupant ) )534628c3 2.5.13.0 (objectIdentifierMatch): 534628c3 matchingRuleUse: ( 2.5.13.0 NAME 'objectIdentifierMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ supportedApplicationContext ) )534628c3 slapd startup: initiated.534628c3 backend_startup_one: starting "cn=config"534628c3 config_back_db_openBackend ACL: access to * by * none 534628c3 config_back_db_open: line 0: warning: cannot assess the validity of the ACL scope within backend naming context534628c3 config_back_db_open: No explicit ACL for back-config configured. Using hardcoded default534628c3 config_build_entry: "cn=config"534628c3 config_build_entry: "cn=schema"534628c3 >>> dnNormalize: <cn={0}core>534628c3 <<< dnNormalize: <cn={0}core>534628c3 config_build_entry: "cn={0}core"534628c3 config_build_entry: "olcDatabase={-1}frontend"534628c3 config_build_entry: "olcDatabase={0}config"534628c3 config_build_entry: "olcDatabase={1}mdb"534628c3 backend_startup_one: starting "o=vtec,c=au"534628c3 mdb_db_open: "o=vtec,c=au"534628c3 mdb_db_open: database "o=vtec,c=au": dbenv_open(/data/irene/var/openldap-data-mdb).534628c3 mdb_db_open: database "o=vtec,c=au": mdb_dbi_open(/data/irene/var/openldap-data-mdb/id2e) failed: MDB_BAD_TXN: Transaction cannot recover - it must be aborted (-30782).534628c3 backend_startup_one (type=mdb, suffix="o=vtec,c=au"): bi_db_open failed! (-30782)534628c3 slapd shutdown: initiated534628c3 slapd destroy: freeing system resources.534628c3 slapd stopped.

1 0

syncrepl question
by John Timon 09 Apr '14

09 Apr '14

Hey, I hope that this is a good forum for this question, if not please feel free to tell me where to go ;) I have recently inherited an existing openldap infrastructure. The LDAP tree also stores Kerberos tickets and principals. the environment is configured with a 'master' ldap server and a bunch of 'consumer' nodes all pointing to it for syncrepl. The syncrepl looks like that olcSyncrepl: {0}rid=312 provider="ldaps://<ldap master>:636/" type=refreshAndPersist interval="00:00:01:00" retry="60 30 300 +" searchbase="<base dn>" bi ndmethod=sasl saslmech=gssapi keepalive=3540:10:3 This master server needs to be decommissioned. So I have chosen one of the consumers in the environment to be the new master. And pointed all of the other consumers to use its IP in the provider field. Syncreplication appears to be working as expected. However the new master still has the original in its provider field. Is the process of promoting this new node to 'master' as simple as stopping slapd, removing the olcSyncRepl line from the hdb.ldif file and restarting slapd? Or is this more to it, I am assuming more to it, but I can't seem to verify that suspicion. Thanks -- JT Experience is what you get when you didn't get what you wanted.

1 0

回复： mirror mode question
by Eileen(=^ω^=) 09 Apr '14

09 Apr '14

Hi Michael and Dieter, Thanks for your kindly replies. In my case, I didn't use any SASL or TLS but "simple" method with operation mode of user/password authenticated. However, I need the rootpw hashed (not cleartext) and the 2 servers (master & slave) synchronized. Could you pls advise how i should modify the syncrepl part? or could you pls provide a sample of the slapd.conf file configuration? Best regards, Eileen ------------------ 原始邮件 ------------------ 发件人: "Michael Ströder";<michael(a)stroeder.com>; 发送时间: 2014年3月5日(星期三) 下午4:09 收件人: "Dieter Klünter"<dieter(a)dkluenter.de>; "openldap-technical"<openldap-technical(a)openldap.org>; 主题: Re: mirror mode & sasl question Dieter Klünter wrote: > Am Wed, 5 Mar 2014 14:38:04 +0800 > schrieb "Eileen(=^ω^=)" <123784635(a)qq.com>: >> This is Eileen from China SINAP. I am a beginner for openldap soft. I >> encountered a problem in my study on two LDAP services replication. >> I have 2 LDAP services, one name LDPA1, the other is LDAP2 . I want >> to make them synchronously in mirror mode. But when I set LDAP >> services rootpw both in hash, the 2 LDAP serivces can’t be >> synchronous. My question is >> 1. if I set my rootpw in hash, my bindmethod must be SASL? If I >> must use sasl method, can I put the sasl service in the same ldap >> service? If bindmethod=sasl then what is the saslmech should be? >> 2. If I change to sasl method, do I need change my database >> record? > > In order to use sasl, passwords must be cleartext and you should > configure an apropriate authz-regexp, see man slapd.conf(5) > You may use any sasl mechanism that you sasl framework provides. > [...] To be more precise: In order to use password-based SASL mechs the passwords have to be stored in clear-text. Well, if working with SASL and TLS (LDAPS, StartTLS) one should consider using client certs and SASL/EXTERNAL for replication. Ciao, Michael.

4 7

help with cn=config and rwm
by Alex Samad - Yieldbroker 08 Apr '14

08 Apr '14

Hi Wondering what an example rwm overlay module would look like in cn=config Trying to apply to a msad ldap backend I would like to change group to groupOfUniqueNames and attributr member to uniqueMember Thanks

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical