openldap-technical

openldap-technical@openldap.org

7 participants
9864 discussions

Re: OpenLDAP Metadirectory
by Thomas Stegbauer 16 Apr '14

16 Apr '14

Hi, i have in my company two ActiveDirectories. as i have an application which has only the possiblity to query one LDAP-server for authentication i thought about a metadirectory as described here: http://ltb-project.org/wiki/documentation/general/sasl_delegation and here https://www.memolinux.info/doku.php?id=unix:ldap:openldapads&s=meta#backend… so i started with openldap 2.4.31 from debian 7.4. my starting configuration looks like below: what i was missing from the docu, i need a schema, where sAMAccountName, proxyAddresses and so on is defined. so i created the msad.schema as described here: http://serverfault.com/questions/151688/configuring-openldap-as-a-active-di… now i don't get an error when i startup slapd. but when i do an search to the metadirectory for example: "ldapsearch -x -D cn=manager,dc=meta -b dc=meta uid=testuser", i see in the wireshark -the bindreques -the searchrequest within DC=D6200,DC=comp,DC=com -but the search criteria looks like this: (!(objectclass=*)) not (objectclass=*) which finds nothing. and gives me 0 results. also i found: http://www.openldap.org/lists/openldap-technical/201206/msg00168.html But what here unclear, what schema definitions do i need with this? could someone point me to my error, as i am nearly blind for comparing. Thomas slapd.conf ========== # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/misc.schema include /etc/ldap/schema/msad.schema pidfile /var/run/slapd/slapd.pid loglevel 99 # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_hdb moduleload back_ldap moduleload back_meta moduleload rwm access to * by * read # Database database meta suffix "dc=meta" rootdn "cn=Manager,dc=meta" rootpw secret # LDAP 1 uri "ldap://192.168.0.2:3268/ou=vzp,dc=meta" lastmod off suffixmassage "ou=vzp,dc=meta" "DC=D6200,DC=comp,DC=com" idassert-bind bindmethod=simple binddn="CN=Meta,CN=Users,DC=D6200,DC=comp,DC=com" credentials="secret" mode=none flags=non-prescriptive idassert-authzFrom "dn.exact:cn=Manager,dc=meta" overlay rwm rwm-map objectclass account user rwm-map attribute mail proxyAddresses rwm-map attribute uid sAMAccountName rwm-map attribute cn name rwm-map attribute * # LDAP 2 uri ldap:// 192.168.13.2 :3268/ou=azp,dc=meta lastmod off suffixmassage "ou=azp,dc=meta" "DC=d5820,DC=muc,DC=com" idassert-bind bindmethod=simple binddn="CN=Meta,CN=Users,DC=d5820,DC=muc,DC=com" credentials="secret" mode=none flags=non-prescriptive idassert-authzFrom "dn.exact:cn=Manager,dc=meta" overlay rwm rwm-map objectclass account user rwm-map attribute mail proxyAddresses rwm-map attribute uid sAMAccountName rwm-map attribute cn name rwm-map attribute *

1 0

response controls
by Huub Sepers 15 Apr '14

15 Apr '14

Hi, We use openLdap as our user identity store for our SSO solution which is openAM. We want to implement a password expiration strategy. Therefore we have to configure openLdap to return a signal for events like: - password about to expire - password expired - .... The openAM code (java) anticipates "controls" for this purpose. Questions: - How to configure openLdap to return a control when a password is about to expire. - Which java Ldap api should be used to process such a control. Greetings, Huub

3 2

Checking client certificates against CRLs
by David Arroyo 15 Apr '14

15 Apr '14

This question may be better asked in the NSS mailing list. Feel free to let me know if that is the case. I'm building a service based around OpenLDAP and SASL EXTERNAL authentication using client certificates. One of requirements is that we have the ability to revoke client certificates. I've found that the only way to revoke a client certificate using an NSS-linked OpenLDAP (RHEL's default 2.4.23) is to: - Revoke the certificate - Import the CRL into the db referenced by olcTLSCACertificatePath - restart slapd Is there a way to update the CRL without restarting slapd? And is there any way to make slapd request the URL referenced in the client cert's nsCaRevocationUrl attribute? If the answer to this is "use OpenSSL", that's a fine answer. Regards, David

4 6

CRL with OpenSSL
by manu＠netbsd.org 15 Apr '14

15 Apr '14

Hi A cautious handling of heatbleed included renewing private keys and certificates. But that is of no interest if the possibly compromised certificate is not revoked, or if revokation is not enforced. I therefore tried CRL in OpenLDAP (linked with OpenSSL). I first started with client settings, in ~/.ldaprc: BASE dc=example,dc=net URI ldaps://ldap.example.net TLS_CACERT /etc/openssl/certs/ca.crt TLS_REQCERT demand TLS_CACERTDIR /home/manu/openssl/ca TLS_CRLCHECK all As suggested in the man page, I added a copy of /etc/openssl/certs/ca.crt in /home/manu/openssl/ca and tried a ldapsearch on the server. It fails, and with debug output I have: TLS certificate verification: Error, unable to get certificate CRL TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (unable to get certificate CRL). ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) kernel trace show that before the error message, it attemps to open /home/manu/openssl/ca/0726b466.r0 If I rename the CA to that name, it will read it, then fail on: TLS certificate verification: Error, unable to get certificate CRL TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:0906D06C:PEM routines:PEM_read_bio:no start line. That suggests the man page is wrong and it is not expecting a CA there. If I remove the CA from /home/manu/openssl/ca/ and copy the CRL in /home/manu/openssl/ca/0726b466.r0, it reads it without a complain, then tries to read /home/manu/openssl/ca/0726b466.r1 and fail there. If I copy /home/manu/openssl/ca/0726b466.r0 to /home/manu/openssl/ca/0726b466.r1, the message suggests that it is indeed trying to load the CRL from that file: TLS: can't connect: error:0B07D065:x509 certificate routines:X509_STORE_add_crl:cert already in hash table. I have a few questions before I start to read the code, just in case it is a known issue: Why the cryptic file names? And why do I need a second 0726b466.r1 file? Using TLS_CRLCHECK peer instead of TLS_CRLCHECK all does not change the behavior. And is OpenSSL CRL supposed to work? This is OpenLDAP 2.4.33 -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

5 11

Problem after migration openldap 2.3.43 to 2.4.23 --> 32 No Such Object
by Jonas Kellens 14 Apr '14

14 Apr '14

Hello, I have a working openLDAP server version 2.3.43. My configuration there works : the correct users have the correct access. I have set up a new openLDAP-server with newer version 2.3.43. I have no working openLDAP on version 2.3.43. I have tried with the new syntax and with the command /usr/sbin/slaptest -f /etc/openldap/slapd.conf -v to use the build in converion tool, but I always got : ldap_bind: Invalid credentials (49) So I forgot this conversion and continued with the "old" slapd.conf file. But in this configuration (which is just a copy/paste of my openLDAP 2.3.43) no user can query the LDAP entries. So this is the setup : I have a user : cn=U101001,ou=101001,dc=mydomain This user is member of the group : cn=tbook1,ou=gebruikers,ou=101001,dc=mydomain These members can read entries in the tree : ou=tbook1,ou=contacten,ou=101001,dc=mydomain I have in slapd.conf : access to dn.one="ou=tbook1,ou=contacten,ou=101001,dc=mydomain" by group.exact="cn=admins,ou=101001,dc=mydomain" write by group.exact="cn=tbook1,ou=gebruikers,ou=101001,dc=mydomain" read This user cn=U101001,ou=101001,dc=mydomain really exists (if you should doubt) : # extended LDIF # # LDAPv3 # base <cn=U101001,ou=101001,dc=mydomain> with scope subtree # filter: (objectclass=*) # requesting: ALL # # U101001, 101001, mydomain dn: cn=U101001,ou=101001,dc=mydomain cn: U101001 sn: U101001 objectClass: inetOrgPerson objectClass: top userPassword:: e1NTSEF9OVBTNmltR3ZpUEhzK1JRQVpickNVdVR5cS9Iejg5TzY= # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 The group cn=tbook1,ou=gebruikers,ou=101001,dc=mydomain also really exists (if you should doubt) : # tbook1, gebruikers, 101001, mydomain dn: cn=tbook1,ou=gebruikers,ou=101001,dc=mydomain cn: tbook1 member: cn=U101001,ou=101001,dc=mydomain objectClass: groupOfNames objectClass: top # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 When I query the LDAP-tree ou=tbook1,ou=contacten,ou=101001,dc=mydomain with my root-account (cn=Manager,dc=mydomain), the I get results : [root@ldap1 ]# ldapsearch -x -D 'cn=Manager,dc=mydomain' -b "ou=tbook1,ou=contacten,ou=101001,dc=mydomain" -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <ou=tbook1,ou=contacten,ou=101001,dc=mydomain> with scope subtree # filter: (objectclass=*) # requesting: ALL # # tbook1, contacten, 101001, mydomain dn: ou=tbook1,ou=contacten,ou=101001,dc=mydomain ou: tbook1 objectClass: organizationalUnit objectClass: top ...<cut>... # search result search: 2 result: 0 Success # numResponses: 5 # numEntries: 4 But when I query this same LDAP-tree with my user cn=U101001,ou=101001,dc=mydomain, I get : [root@ldap1 openldap]# ldapsearch -x -D 'cn=U101001,ou=101001,dc=mydomain' -b "dc=mydomain" -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=mydomain> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 I also have phpLDAPadmin installed and there I see that there are definitely enries in the LDAP-directory ou=tbook1,ou=contacten,ou=101001,dc=mydomain. So why does my user cn=U101001,ou=101001,dc=mydomain fails to get results ?? Kind regards, Jonas.

6 21

LMDB: fast writes: removing the write mutex ?
by Simon Majou 13 Apr '14

13 Apr '14

Hello, I wanted to know, how we could disable the write lock, in case the application shards the writes per thread ? I guess that would imply to have one btree per thread, isn't it ? We could as well use as many DB as threads (at the cost of also sharding the reads) ? In that case, how can I disable the write lock ? Would commenting LOCK_MUTEX_W() & UNLOCK_MUTEX_W() make the trick ? -- Best regards, Simon

1 0

Problems with slapo-rwm
by Fred Snilees 12 Apr '14

12 Apr '14

Hi I am trying to get slapo-rwm module working in a cn=config setup I have openldap with a local DB and ldap database backing onto a MS AD DB I am trying to rewrite objectclass group to groupOfUniqueNames and attribute member to uniqueMember this is what i use to set it up dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: {4}rwm dn: olcOverlay=rwm,olcDatabase={1}ldap,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: rwm olcRwmRewrite: rwm-rewriteEngine "on" olcRwmMap: {1}objectclass group groupOfUniqueNames olcRwmMap: {2}attribute member uniqueMember olcRwmNormalizeMapped: FALSE but when i try a ldapsearch it doesn't work , the object class and attribute are not re written

2 3

Strange password policy behaviour
by Philip Colmer 10 Apr '14

10 Apr '14

I'm using OpenLDAP 2.4.38. At some distant point when I was testing the configuration of our OpenLDAP server, I must have set pwdInHistory to 5 as I have 5 previous passwords stored in my account object. Before going live, though, I changed my mind and set pwdInHistory to 0. However, my account still retains those five previous passwords. I've tried applying a specific pwdPolicy to my object and setting pwdInHistory to 1 then changing my password but the object still retains 5 previous passwords :-(. Given that pwdHistory is read-only and therefore I cannot delete those entries, does anyone have any suggestions on how I can persuade OpenLDAP to forget those old passwords? I don't think changing the password multiple times is going to fix the problem either. Despite setting pwdInHistory to 1, changing the password multiple times doesn't seem to be working in the way I would expect. The five pwdHistory entries that are being shown by Apache Directory Studio all show a date from the beginning of 2013. I would expect ONE of those entries to be replaced with an entry with today's date and, even better, I would expect OpenLDAP to be removing entries if there are more than pwdInHistory's value. Regards Philip

2 2

2.4.39 error when starting openldap with mdb backend
by ping-shin ching 10 Apr '14

10 Apr '14

Using openldap 2.4.39 on solaris 10 sparc box. Bdb runs without any issue. Mdb fails on startup ( described below) Snip from the slapd.conf------------------------------------- database mdbsuffix "o=vtec,c=au"rootdn "cn=manager,o=vtec,c=au"# Cleartext passwords, especially for the rootdn, should# be avoid. See slappasswd(8) and slapd.conf(5) for details.# Use of strong authentication encouraged.rootpw secret# The database directory MUST exist prior to running slapd AND# should only be accessible by the slapd and slap tools.# Mode 700 recommended.directory /data/irene/var/openldap-data-mdbmaxsize 1073741824 Get this error on startup-------------------------------------- 34628c3 1.2.36.79672281.1.13.3 (rdnMatch): 534628c3 2.5.13.1 (distinguishedNameMatch): 534628c3 matchingRuleUse: ( 2.5.13.1 NAME 'distinguishedNameMatch' APPLIES ( creatorsName $ modifiersName $ subschemaSubentry $ entryDN $ namingContexts $ aliasedObjectName $ dynamicSubtrees $ distinguishedName $ seeAlso $ olcDefaultSearchBase $ olcRootDN $ olcSchemaDN $ olcSuffix $ olcUpdateDN $ olcRelay $ member $ owner $ roleOccupant ) )534628c3 2.5.13.0 (objectIdentifierMatch): 534628c3 matchingRuleUse: ( 2.5.13.0 NAME 'objectIdentifierMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ supportedApplicationContext ) )534628c3 slapd startup: initiated.534628c3 backend_startup_one: starting "cn=config"534628c3 config_back_db_openBackend ACL: access to * by * none 534628c3 config_back_db_open: line 0: warning: cannot assess the validity of the ACL scope within backend naming context534628c3 config_back_db_open: No explicit ACL for back-config configured. Using hardcoded default534628c3 config_build_entry: "cn=config"534628c3 config_build_entry: "cn=schema"534628c3 >>> dnNormalize: <cn={0}core>534628c3 <<< dnNormalize: <cn={0}core>534628c3 config_build_entry: "cn={0}core"534628c3 config_build_entry: "olcDatabase={-1}frontend"534628c3 config_build_entry: "olcDatabase={0}config"534628c3 config_build_entry: "olcDatabase={1}mdb"534628c3 backend_startup_one: starting "o=vtec,c=au"534628c3 mdb_db_open: "o=vtec,c=au"534628c3 mdb_db_open: database "o=vtec,c=au": dbenv_open(/data/irene/var/openldap-data-mdb).534628c3 mdb_db_open: database "o=vtec,c=au": mdb_dbi_open(/data/irene/var/openldap-data-mdb/id2e) failed: MDB_BAD_TXN: Transaction cannot recover - it must be aborted (-30782).534628c3 backend_startup_one (type=mdb, suffix="o=vtec,c=au"): bi_db_open failed! (-30782)534628c3 slapd shutdown: initiated534628c3 slapd destroy: freeing system resources.534628c3 slapd stopped.

1 0

syncrepl question
by John Timon 09 Apr '14

09 Apr '14

Hey, I hope that this is a good forum for this question, if not please feel free to tell me where to go ;) I have recently inherited an existing openldap infrastructure. The LDAP tree also stores Kerberos tickets and principals. the environment is configured with a 'master' ldap server and a bunch of 'consumer' nodes all pointing to it for syncrepl. The syncrepl looks like that olcSyncrepl: {0}rid=312 provider="ldaps://<ldap master>:636/" type=refreshAndPersist interval="00:00:01:00" retry="60 30 300 +" searchbase="<base dn>" bi ndmethod=sasl saslmech=gssapi keepalive=3540:10:3 This master server needs to be decommissioned. So I have chosen one of the consumers in the environment to be the new master. And pointed all of the other consumers to use its IP in the provider field. Syncreplication appears to be working as expected. However the new master still has the original in its provider field. Is the process of promoting this new node to 'master' as simple as stopping slapd, removing the olcSyncRepl line from the hdb.ldif file and restarting slapd? Or is this more to it, I am assuming more to it, but I can't seem to verify that suspicion. Thanks -- JT Experience is what you get when you didn't get what you wanted.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical