openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

bug(?) with initial/seed syncrepl
by Jephte Clain 19 Apr '14

19 Apr '14

hello, (note: english is not my primary language. I'll do my best to be clear...) I have scripts to test several replication scenarii, that setup the LDAP environment then allow me to play with parameters as I see fit. I believe that there is a bug with the "seed replication" that allow one to build an exact clone of a master with minimal configuration on the slave side. Before I fill an ITS, I'd like to confirm with you that I do the right thing (tm) note: the tests below require 2 VMs, or running the two slapd instances in chroots, because a clone replica requires the data files to be in the same path... this is openldap 2.4.39 on debian squeeze I attach a script to replicate the problem. it requires root (it uses chroots) use 0start.sh to: - create a ldap server to be served on ldap://localhost:3890 - start the master in chroot (the logs are in /jclain-slapd-test/master.data/slapd.log) - create a seed ldap replica to be served on ldap://localhost:3891 with ldap://localhost:3890 as the provider - start it in chroot with option -c rid=0 (the logs are in /jclain-slapd-test/slave.data/slapd.log) use 1stop.sh to: - stop the servers - umount the chroots If I understand the manual correctly, after 0start.sh, the replica should be identical to the master thanks to -c rid=0 BUT, the log on the replica says: 534d5481 dn_callback : new entry is older than ours cn=config ours 20140415154713.807278Z#000000#000#000000, new 20140415154704.888204Z#000000#000#000000 and indeed, the seed entries are NOT overwritten I have to "touch" them on the master to force the replication. so my question is: do I use the -c option correctly, or is there a bug? thanks for your help. regards, -- Jephté Clain Direction des Systèmes d'Information et des Usages Numériques - 2IG Tél. 0262 93 86 31 Fax. 0262 93 81 06

1 1

Date format
by Frans Lanting - IT Admin 19 Apr '14

19 Apr '14

Hi Folks, This refers to the OpenLDAP found in OS X Server, which Apple calls Open Directory. I'm trying to determine the time when an OpenLDAP replica got its last update from the OpenLDAP master, so on a replica I do the following: % sudo slapconfig -getreplicaconfig Replica LDAP server Updated: 2014-04-18 22:29:01 +0000 List Of Replicas od-example.com - OK My question is the date/time format as seen above, since it does not appear to be GMT/UTC or the server time, so any clarification on this would be most appreciated! I don't see any reference to this slapconfig man page or in Apple server documentation. Thanks in advance, Dan

2 1

attribute for storing SSH RSA host keys
by ML mail 17 Apr '14

17 Apr '14

Hello, On my already existing OpenLDAP server I would like to add an attribute in order to store SSH RSA host keys. Currently there are no such attributes (for example: sshRSAHostKey) in any standard schemas. What would be the best strategy to add this attribute to my OpenLDAP server? Create a new objectClass? or simply add it to another already standard objectClass such as the NIS schema? Regards ML

4 6

Re: OpenLDAP Metadirectory
by Thomas Stegbauer 16 Apr '14

16 Apr '14

Hi, i have in my company two ActiveDirectories. as i have an application which has only the possiblity to query one LDAP-server for authentication i thought about a metadirectory as described here: http://ltb-project.org/wiki/documentation/general/sasl_delegation and here https://www.memolinux.info/doku.php?id=unix:ldap:openldapads&s=meta#backend… so i started with openldap 2.4.31 from debian 7.4. my starting configuration looks like below: what i was missing from the docu, i need a schema, where sAMAccountName, proxyAddresses and so on is defined. so i created the msad.schema as described here: http://serverfault.com/questions/151688/configuring-openldap-as-a-active-di… now i don't get an error when i startup slapd. but when i do an search to the metadirectory for example: "ldapsearch -x -D cn=manager,dc=meta -b dc=meta uid=testuser", i see in the wireshark -the bindreques -the searchrequest within DC=D6200,DC=comp,DC=com -but the search criteria looks like this: (!(objectclass=*)) not (objectclass=*) which finds nothing. and gives me 0 results. also i found: http://www.openldap.org/lists/openldap-technical/201206/msg00168.html But what here unclear, what schema definitions do i need with this? could someone point me to my error, as i am nearly blind for comparing. Thomas slapd.conf ========== # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/misc.schema include /etc/ldap/schema/msad.schema pidfile /var/run/slapd/slapd.pid loglevel 99 # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_hdb moduleload back_ldap moduleload back_meta moduleload rwm access to * by * read # Database database meta suffix "dc=meta" rootdn "cn=Manager,dc=meta" rootpw secret # LDAP 1 uri "ldap://192.168.0.2:3268/ou=vzp,dc=meta" lastmod off suffixmassage "ou=vzp,dc=meta" "DC=D6200,DC=comp,DC=com" idassert-bind bindmethod=simple binddn="CN=Meta,CN=Users,DC=D6200,DC=comp,DC=com" credentials="secret" mode=none flags=non-prescriptive idassert-authzFrom "dn.exact:cn=Manager,dc=meta" overlay rwm rwm-map objectclass account user rwm-map attribute mail proxyAddresses rwm-map attribute uid sAMAccountName rwm-map attribute cn name rwm-map attribute * # LDAP 2 uri ldap:// 192.168.13.2 :3268/ou=azp,dc=meta lastmod off suffixmassage "ou=azp,dc=meta" "DC=d5820,DC=muc,DC=com" idassert-bind bindmethod=simple binddn="CN=Meta,CN=Users,DC=d5820,DC=muc,DC=com" credentials="secret" mode=none flags=non-prescriptive idassert-authzFrom "dn.exact:cn=Manager,dc=meta" overlay rwm rwm-map objectclass account user rwm-map attribute mail proxyAddresses rwm-map attribute uid sAMAccountName rwm-map attribute cn name rwm-map attribute *

1 0

response controls
by Huub Sepers 15 Apr '14

15 Apr '14

Hi, We use openLdap as our user identity store for our SSO solution which is openAM. We want to implement a password expiration strategy. Therefore we have to configure openLdap to return a signal for events like: - password about to expire - password expired - .... The openAM code (java) anticipates "controls" for this purpose. Questions: - How to configure openLdap to return a control when a password is about to expire. - Which java Ldap api should be used to process such a control. Greetings, Huub

3 2

Checking client certificates against CRLs
by David Arroyo 15 Apr '14

15 Apr '14

This question may be better asked in the NSS mailing list. Feel free to let me know if that is the case. I'm building a service based around OpenLDAP and SASL EXTERNAL authentication using client certificates. One of requirements is that we have the ability to revoke client certificates. I've found that the only way to revoke a client certificate using an NSS-linked OpenLDAP (RHEL's default 2.4.23) is to: - Revoke the certificate - Import the CRL into the db referenced by olcTLSCACertificatePath - restart slapd Is there a way to update the CRL without restarting slapd? And is there any way to make slapd request the URL referenced in the client cert's nsCaRevocationUrl attribute? If the answer to this is "use OpenSSL", that's a fine answer. Regards, David

4 6

CRL with OpenSSL
by manu＠netbsd.org 15 Apr '14

15 Apr '14

Hi A cautious handling of heatbleed included renewing private keys and certificates. But that is of no interest if the possibly compromised certificate is not revoked, or if revokation is not enforced. I therefore tried CRL in OpenLDAP (linked with OpenSSL). I first started with client settings, in ~/.ldaprc: BASE dc=example,dc=net URI ldaps://ldap.example.net TLS_CACERT /etc/openssl/certs/ca.crt TLS_REQCERT demand TLS_CACERTDIR /home/manu/openssl/ca TLS_CRLCHECK all As suggested in the man page, I added a copy of /etc/openssl/certs/ca.crt in /home/manu/openssl/ca and tried a ldapsearch on the server. It fails, and with debug output I have: TLS certificate verification: Error, unable to get certificate CRL TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (unable to get certificate CRL). ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) kernel trace show that before the error message, it attemps to open /home/manu/openssl/ca/0726b466.r0 If I rename the CA to that name, it will read it, then fail on: TLS certificate verification: Error, unable to get certificate CRL TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:0906D06C:PEM routines:PEM_read_bio:no start line. That suggests the man page is wrong and it is not expecting a CA there. If I remove the CA from /home/manu/openssl/ca/ and copy the CRL in /home/manu/openssl/ca/0726b466.r0, it reads it without a complain, then tries to read /home/manu/openssl/ca/0726b466.r1 and fail there. If I copy /home/manu/openssl/ca/0726b466.r0 to /home/manu/openssl/ca/0726b466.r1, the message suggests that it is indeed trying to load the CRL from that file: TLS: can't connect: error:0B07D065:x509 certificate routines:X509_STORE_add_crl:cert already in hash table. I have a few questions before I start to read the code, just in case it is a known issue: Why the cryptic file names? And why do I need a second 0726b466.r1 file? Using TLS_CRLCHECK peer instead of TLS_CRLCHECK all does not change the behavior. And is OpenSSL CRL supposed to work? This is OpenLDAP 2.4.33 -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

5 11

Problem after migration openldap 2.3.43 to 2.4.23 --> 32 No Such Object
by Jonas Kellens 14 Apr '14

14 Apr '14

Hello, I have a working openLDAP server version 2.3.43. My configuration there works : the correct users have the correct access. I have set up a new openLDAP-server with newer version 2.3.43. I have no working openLDAP on version 2.3.43. I have tried with the new syntax and with the command /usr/sbin/slaptest -f /etc/openldap/slapd.conf -v to use the build in converion tool, but I always got : ldap_bind: Invalid credentials (49) So I forgot this conversion and continued with the "old" slapd.conf file. But in this configuration (which is just a copy/paste of my openLDAP 2.3.43) no user can query the LDAP entries. So this is the setup : I have a user : cn=U101001,ou=101001,dc=mydomain This user is member of the group : cn=tbook1,ou=gebruikers,ou=101001,dc=mydomain These members can read entries in the tree : ou=tbook1,ou=contacten,ou=101001,dc=mydomain I have in slapd.conf : access to dn.one="ou=tbook1,ou=contacten,ou=101001,dc=mydomain" by group.exact="cn=admins,ou=101001,dc=mydomain" write by group.exact="cn=tbook1,ou=gebruikers,ou=101001,dc=mydomain" read This user cn=U101001,ou=101001,dc=mydomain really exists (if you should doubt) : # extended LDIF # # LDAPv3 # base <cn=U101001,ou=101001,dc=mydomain> with scope subtree # filter: (objectclass=*) # requesting: ALL # # U101001, 101001, mydomain dn: cn=U101001,ou=101001,dc=mydomain cn: U101001 sn: U101001 objectClass: inetOrgPerson objectClass: top userPassword:: e1NTSEF9OVBTNmltR3ZpUEhzK1JRQVpickNVdVR5cS9Iejg5TzY= # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 The group cn=tbook1,ou=gebruikers,ou=101001,dc=mydomain also really exists (if you should doubt) : # tbook1, gebruikers, 101001, mydomain dn: cn=tbook1,ou=gebruikers,ou=101001,dc=mydomain cn: tbook1 member: cn=U101001,ou=101001,dc=mydomain objectClass: groupOfNames objectClass: top # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 When I query the LDAP-tree ou=tbook1,ou=contacten,ou=101001,dc=mydomain with my root-account (cn=Manager,dc=mydomain), the I get results : [root@ldap1 ]# ldapsearch -x -D 'cn=Manager,dc=mydomain' -b "ou=tbook1,ou=contacten,ou=101001,dc=mydomain" -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <ou=tbook1,ou=contacten,ou=101001,dc=mydomain> with scope subtree # filter: (objectclass=*) # requesting: ALL # # tbook1, contacten, 101001, mydomain dn: ou=tbook1,ou=contacten,ou=101001,dc=mydomain ou: tbook1 objectClass: organizationalUnit objectClass: top ...<cut>... # search result search: 2 result: 0 Success # numResponses: 5 # numEntries: 4 But when I query this same LDAP-tree with my user cn=U101001,ou=101001,dc=mydomain, I get : [root@ldap1 openldap]# ldapsearch -x -D 'cn=U101001,ou=101001,dc=mydomain' -b "dc=mydomain" -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=mydomain> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 I also have phpLDAPadmin installed and there I see that there are definitely enries in the LDAP-directory ou=tbook1,ou=contacten,ou=101001,dc=mydomain. So why does my user cn=U101001,ou=101001,dc=mydomain fails to get results ?? Kind regards, Jonas.

6 21

LMDB: fast writes: removing the write mutex ?
by Simon Majou 13 Apr '14

13 Apr '14

Hello, I wanted to know, how we could disable the write lock, in case the application shards the writes per thread ? I guess that would imply to have one btree per thread, isn't it ? We could as well use as many DB as threads (at the cost of also sharding the reads) ? In that case, how can I disable the write lock ? Would commenting LOCK_MUTEX_W() & UNLOCK_MUTEX_W() make the trick ? -- Best regards, Simon

1 0

Problems with slapo-rwm
by Fred Snilees 12 Apr '14

12 Apr '14

Hi I am trying to get slapo-rwm module working in a cn=config setup I have openldap with a local DB and ldap database backing onto a MS AD DB I am trying to rewrite objectclass group to groupOfUniqueNames and attribute member to uniqueMember this is what i use to set it up dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: {4}rwm dn: olcOverlay=rwm,olcDatabase={1}ldap,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: rwm olcRwmRewrite: rwm-rewriteEngine "on" olcRwmMap: {1}objectclass group groupOfUniqueNames olcRwmMap: {2}attribute member uniqueMember olcRwmNormalizeMapped: FALSE but when i try a ldapsearch it doesn't work , the object class and attribute are not re written

2 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical