openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

slapadd question
by Mundry, Marvin 27 Jan '14

27 Jan '14

hi, when I use slapadd to setup cn=config I get > slapadd: warning, missing attrs entryUUID,entryCSN from entry dn="olcDatabase=bdb,cn=config" warnings (one for each database and overlay that is configured) as soon as I add an olcSyncrepl attribute to "dn: olcDatabase=config,cn=config" should I be worried about these warnings? what I am doing: slapadd -S 1 -bcn=config -l slapd.ldif -F slapd.d/ with slapd.ldif having the following content: dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /usr/local/openldap/var/run/slapd.args olcPidFile: /usr/local/openldap/var/run/slapd.pid dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/local/openldap/libexec/openldap olcModuleload: back_bdb.la dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema include: file:///usr/local/openldap/etc/openldap/schema/core.ldif dn: olcDatabase=frontend,cn=config objectClass: olcDatabaseConfig olcDatabase: frontend dn: olcDatabase=config,cn=config objectClass: olcDatabaseConfig olcDatabase: config olcRootDN: cn=admin,cn=config olcRootPW:: e1NTSEF9L1Q1US9ibUl0V3pYRnpOUG9iajdsbk5IVVJmS2E5Ykk= olcSyncrepl: rid=001 provider=ldap://someldapserver/ binddn="cn=acme" credentials=secret bindmethod=simple searchbase="cn=config" type=refreshAndPersist dn: olcDatabase=bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: bdb olcSuffix: dc=my-domain,dc=com olcRootDN: cn=Manager,dc=my-domain,dc=com olcRootPW: secret olcDbDirectory: /usr/local/openldap/var/openldap-data Best regards, Marvin

2 1

Ldap Autofs Connection Issue
by Borresen, John - 0442 - MITLL 27 Jan '14

27 Jan '14

All, Here is an interesting dilemma that we are trying to figure out. server1.example.ldap server2.example.ldap client1.example.ldap All running 2.4.38, this is a test environment. Server1 is a client to itself, server2 is a client to itself, and client1 is a client to server2. client1's LDAP Autofs (in the /etc/nsswitch.conf) is pointing to server2...and it works fine. In the /etc/sysconfig/autofs file on the client (client1) the URI entry indicates: "ldap://server2.example.ldap"; and the /etc/nsswitch.conf file shows "ldap" On both server1 and server2, for now -- because if fails otherwise, the URI in the /etc/sysconfig/autofs shows "ldaps://server1.production.ldap"; and the /etc/nsswitch.conf file shows "ldap". As you can see, the production server is using port 636 (SSL), the test environment is using TLS over port 389. Neither test environment server holds the production certificates, and the production side is not holding the test environment certs. Another interesting tidbit, is all the Automount/NFS servers are NetApp filers and they hold certs for the Production Environment, except one which is a Test Filer (in the Test Environment). Sorry if this sounds like an old "Abbott & Costello" routine from the 30's... If anyone can shed some light on what to look for. That would be great. By the way, permission is not an issue. I can explicitly mount all mountpoints to all three in the test environment. The issue is LDAP and Autofs in the Test environment. Thanks, in advance. -----Original Message----- From: openldap-technical-bounces(a)OpenLDAP.org [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Dieter Klünter Sent: Friday, January 24, 2014 4:09 PM To: openldap-technical(a)openldap.org Subject: Re: Ldap Connection Issue Am Fri, 24 Jan 2014 14:45:25 -0500 schrieb "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu>: > All, > > Very similar issue that Warron was/is having. > > Server1: # ldapsearch -W -x -ZZ -b cn=config -v -D cn=admin,cn=config > Server1: # ldapsearch -W -x -ZZ -H ldap://server2.example.ldap -b > cn=config -v -D cn=admin,cn=config > > These commands work (they returns the dbase as expect & desired), both > servers are clients to themselves and the other server (using > self-signed wildcard certificates) Both ldap.confs are identical, the > one on server1 was used on server2. The URI directive looks like: > > uri ldap://server1.example.ldap ldap://server1.<FQDN> > ldap://server2.example.ldap ldap://server2.<FQDN> > > Server2: > > a) # ldapsearch -W -x -ZZ -b cn=config -v -D cn=admin,cn=config > Fails with: > ldap_initialize( <DEFAULT> ) > ldap_start_tls: Connect error (-11) > > > b) # ldapsearch -W -x -ZZ -H ldap://server2.example.ldap -b > cn=config -v -D cn=admin,cn=config > > ldap_initialize( ldap://server2.example.ldap:389/??base ) > > ldap_start_tls: Connect error (-11) > > > c) # ldapsearch -W -x -ZZ -h ldap://server1.example.ldap -b > cn=config -v -D cn=admin,cn=config > > d) ldap_initialize( ldap://ldap:%2F%2Fserver1.example.ldap) > > e) Could not create LDAP session handle for > URI=ldap://ldap:%2F%2Fgp42-admin4.llan.ll.mit.edu (-9): Bad parameter > to an ldap routine > > There is one other client that like server1 can search the dbase(s) on > both servers (it too is a client of both servers). > > Any ideas at what to look for? read on ldapsearch(1) and distinction of -h and -H parameters. furthermore read on LDAP URL and escape sequences (RFC-4516). -Dieter -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

1 0

Question about olcServerID
by Philip Colmer 27 Jan '14

27 Jan '14

If I extend my existing OpenLDAP implementation to support N-way multi-master, is it acceptable for the first server to retain an olcServerID of 0 (the default when OpenLDAP gets installed) or do I need to change it to a non-zero value? Probably a stupid question but I thought I better ask before making any changes :-) Thanks. Philip

1 0

Re: SLAPD Proxy and AD backend - Binding by UPN.
by egidiomelissano＠libero.it 25 Jan '14

25 Jan '14

> You can configure dovecot to use any (unique) user record attribute for authentication Could you give me an example, please? Regards, Egidio.

2 1

SLAPD Proxy and AD backend - Binding by UPN.
by egidiomelissano＠libero.it 25 Jan '14

25 Jan '14

Hello everyone. First of all, I'm a newbie in OpenLDAP Server administration (but not in Active Directory). Said that, this is my goal: - set up an LDAP Front End-Server to a AD Back-End Server - and, so far, there are many infos about this. But I wanna do it in an environment where there are many UX services which binding to AD Server, and any service of these needs ldap-client configuration, with insertion and storing of credential for binding. One of these is Dovecot which do ldap-authentication of any user of its by a typical fashion... user: ad_username(a)my.ad psw: ad_username_password Hence, I wish to avoid spreading of AD-binding-credentials gathering this couple of data in just one point of my system: that is, OpenLDAP proxy or SLAPD Front-End. I've already tried to do it. First of all, I got an error at installation stage which gave me crazy and I've not yet solved: i.e, after copy of DB_CONFIG example file to lib directory: root@lamp ~# rm -fr /var/lib/ldap/* && rm -fr /etc/ldap/slapd.d/* && cp /usr/share/slapd/DB_CONFIG /var/lib/ldap/DB_CONFIG when I run: root@lamp ~# slapadd -v -l xdom.ldif+ I get an error like the following: 52e1597b bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap: (14). Even though DB_CONFING is there and has right permissions... Anyway, I discovered that this issues was not blocking, so I went forward. I populate splap.d: root@lamp ~# slaptest -f /etc/ldap/slapd.conf -F /etc/ldap/slapd.d/ 52e280b2 bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap: (14). Expect poor performance for suffix "dc=xdom,dc=loc". I gave right permission to directories: root@lamp ~# chown -R openldap:openldap /etc/ldap/slapd.d/ && chown -R openldap:openldap /var/lib/ldap/ and I started LDAP Service: root@lamp ~# service slapd start At this time, I tested OpenLDAP Proxy Server by 5 combinations of ldap request: 1) bypassing OpenLDAP Proxy Server and directly binding AD Server by conventional D.N.: ldapsearch -H ldap://server.my.ad -D "cn=ad_user,ou=ced,dc=my,dc=ad" -w ad_user_password -x -b "ou=ced,dc=my,dc=ad" -LLL "(sAMAccountName=*)" and it works. 2) bypassing OpenLDAP Proxy Server and directly binding AD Server by U.P.N (User Principal Name): ldapsearch -H ldap://server.my.ad -D ad_user(a)my.ad -w ad_user_password -x -b "ou=ced,dc=my,dc=ad" -LLL "(sAMAccountName=*)" and it works. 3) through OpenLDAP Proxy Server without any binding: ldapsearch -x -b "ou=ced,dc=my,dc=ad" -LLL "(sAMAccountName=*)" and it works. 4) through OpenLDAP Proxy Server and binding by conventional D.N.: ldapsearch -D "cn=ad_user,ou=ced,dc=my,dc=ad" -w ad_user_password -x -b "ou=ced,dc=my,dc=ad" -LLL "(sAMAccountName=*)" and it works. 5) through OpenLDAP Proxy Server and binding by U.P.N (User Principal Name): ldapsearch -D ad_user(a)my.ad -w ad_user_password -x -b "ou=ced,dc=my,dc=ad" - LLL "(sAMAccountName=*)" and it DOES NOT works. And it is a very BIG BIG problem for me: I cannot force users to authenticate themselves in Dovecot by complicated and unacceptable (because of comma, equal and space characters) D.N.!!!! I tried to face this issue by Rewriting Overlay, just to discover that these library rewrite BINDDN only after "dnPrettyNormal()" call (making "rewriting- method" useless...) Now, please: help me!!!! What can I do? How can I solve my issue??? And how can I avoid DB_CONFING issue? Regards, Egidio. PS: follow my ldap.conf and slapd.conf ## LDAP.CONF #################################### BASE dc=xdom,dc=loc URI ldap://localhost TLS_CACERT /etc/ssl/certs/ca-certificates.crt ## SLAPD.CONF #################################### include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args logfile /var/log/slapd.log loglevel -1 modulepath /usr/lib/ldap moduleload back_bdb moduleload back_ldap moduleload rwm tool-threads 1 database bdb suffix "dc=xdom,dc=loc" checkpoint 1024 15 rootdn "cn=droot,dc=xdom,dc=loc" rootpw {SSHA}Xhy4Gc0k5DU+gfpbpkv+PJWJ92Itp5rJ Database ldap Suffix "dc=ts,dc=dipvvf,dc=it" Uri "ldap://server.my.ad/ ldap://server2.my.ad/" rebind-as-user idassert-bind bindmethod=simple binddn="cn=email ed. demon,ou=email,ou=virtualization,ou=ced,dc=ts, dc=dipvvf,dc=it" credentials=xxxxxx mode=none idassert-authzFrom "*" overlay rwm rwm-rewriteEngine on rwm-rewriteMap ldap samacc "ldap://vfdc1.ts.dipvvf.it/dc=ts,dc=dipvvf,dc=it?dn? sub?samaccountname=" #"ldap:///dc=ts,dc=dipvvf,dc=it?dn?sub?samaccountname=" rwm-rewriteContext bindDN rwm-rewriteRule "^([^,]+)@[^,]+$" "${samacc($1)}" ":@I"

2 1

Ldap Connection Issue
by Borresen, John - 0442 - MITLL 24 Jan '14

24 Jan '14

All, Very similar issue that Warron was/is having. Server1: # ldapsearch -W -x -ZZ -b cn=config -v -D cn=admin,cn=config Server1: # ldapsearch -W -x -ZZ -H ldap://server2.example.ldap -b cn=config -v -D cn=admin,cn=config These commands work (they returns the dbase as expect & desired), both servers are clients to themselves and the other server (using self-signed wildcard certificates) Both ldap.confs are identical, the one on server1 was used on server2. The URI directive looks like: uri ldap://server1.example.ldap ldap://server1.<FQDN> ldap://server2.example.ldap ldap://server2.<FQDN> Server2: a) # ldapsearch -W -x -ZZ -b cn=config -v -D cn=admin,cn=config Fails with: ldap_initialize( <DEFAULT> ) ldap_start_tls: Connect error (-11) b) # ldapsearch -W -x -ZZ -H ldap://server2.example.ldap -b cn=config -v -D cn=admin,cn=config ldap_initialize( ldap://server2.example.ldap:389/??base ) ldap_start_tls: Connect error (-11) c) # ldapsearch -W -x -ZZ -h ldap://server1.example.ldap -b cn=config -v -D cn=admin,cn=config d) ldap_initialize( ldap://ldap:%2F%2Fserver1.example.ldap) e) Could not create LDAP session handle for URI=ldap://ldap:%2F%2Fgp42-admin4.llan.ll.mit.edu (-9): Bad parameter to an ldap routine There is one other client that like server1 can search the dbase(s) on both servers (it too is a client of both servers). Any ideas at what to look for? thanks in advance John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Ph: (781) 981-1609 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

2 2

LMDB as separate library
by Jan Staněk 24 Jan '14

24 Jan '14

Hello, I'm trying to package LMDB for Fedora as possible system-wide replacement for Oracle's BerkeleyDB. The main trouble is that in current state the LMDB builds an unversioned liblmdb.so, although having a option to link the binaries dynamically without patching the Makefile would be also nice. I want to ask, are there any intentions to release the LMDB as separable library (with versioned soname, etc.)? Thanks in advance, Jan -- Jan Stanek - Red Hat Associate Developer Engineer - Databases Team

2 1

ldap_bind: Invalid credentials (49)
by W Forum W 24 Jan '14

24 Jan '14

Hi, I try to add the samba.schema in my openldap server (Debian Wheezy), default installed. slapd: 2.4.31 ldap-utils 2.4.31 I followed this tutorial https://help.ubuntu.com/10.04/serverguide/samba-ldap.html I can use ldapsearch, ldapadd and ldapmodify with my cn=admin,dc=example,dc=com password but when I try to add the new schema to the directory with ldapadd -x -D cn=admin,cn=config -W -f /tmp/cn\=samba.ldif I get ldap_bind: Invalid credentials (49) Is there a different password for cn=admin,cn=config? I was never asked to create it. And how can I change it if necessary? Many thanks!!!

4 4

Re: ldap_add: Object class violation (65), additional info: attribute 'host' not allowed
by W Forum W 24 Jan '14

24 Jan '14

Hi, Thanks for the quick response I am using Debian wheezy. I installed the ldapns.schema from the deb package but I still when I try to add a user (as a ldif file with a host attribute defined) a get the error ldap_add: Object class violation (65) additional info: attribute 'host' not allowed If I remove the host attribute (from ldif file) the user is added successfully. How can I get the host attribute working? Many thanks On 01/20/2014 05:43 PM, Joshua Schaeffer wrote: > There is some information from the Debian wiki > (https://wiki.debian.org/LDAP/PAM) on adding a host attribute to a > user, but I'm sure it applies to other distro's as well: > > To add the "host" attribute to a user, he should have an objectClass > that supports this. The "account" objectClass has the attribute, but > is not compatible with the "inetOrgPerson" objectClass. To work around > this, you can use the "ldapns" schema, supplied with the libpam-ldap > <http://packages.debian.org/libpam-ldap> package. This schema provides > the "hostObject" objectClass, which has the proper "host" attribute. > > > On Mon, Jan 20, 2014 at 9:08 AM, W Forum W <wforumw(a)gmail.com > <mailto:wforumw@gmail.com>> wrote: > > Hi > I try to add a user but the host attribute is not accept > (everything else is fine) > > ldapadd -x -W -D "cn=admin,dc=example,dc=com" -f user.ldif > Enter LDAP Password: > adding new entry "uid=user,ou=Users,dc=example,dc=comt" > ldap_add: Object class violation (65) > additional info: attribute 'host' not allowed > > how can i add a host attribute > i have following schema installed > > core.schema > cosine.schema > nis.schema > inetorgperson.schema > samba.schema > > thanks in advance > >

2 1

providing a default value for an attribute (w/ translucent proxy)
by Dan Pritts 23 Jan '14

23 Jan '14

Hi all - I've got a familiar story, I'm sure. I have a campus-wide AD infrastructure that I'd like to leverage. Unfortunately, my LDAP client (an Isilon NAS) requires some attributes that AD doesn't populate. e.g., homeDirectory. As it turns out, the silly thing doesn't even use these values, at least not for our use case. But the entire lookup fails if it doesn't get something back for those attributes. I presumably can use a translucent proxy to set these attributes locally. I tested this successfully. Ideally, though, instead of creating DNs for each person on the translucent proxy server, I'd like to just have slapd fill in a default value for these attributes when they are empty. I would also be happy with a method that just overwrites the existing attribute, regardless of whether it exists. Again, for ALL DNs... I don't want to create each account individually in both places. I thought maybe the rewrite overlay would allow this but it seems like I was incorrect (please advise if it can be done). I have poked around and found no other way to do this. Am I missing something? thanks -- Dan Pritts ICPSR Computing & Network Services University of Michigan +1 (734)615-7362

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical