openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

SLAPD Proxy and AD backend - Binding by UPN.
by egidiomelissano＠libero.it 25 Jan '14

25 Jan '14

Hello everyone. First of all, I'm a newbie in OpenLDAP Server administration (but not in Active Directory). Said that, this is my goal: - set up an LDAP Front End-Server to a AD Back-End Server - and, so far, there are many infos about this. But I wanna do it in an environment where there are many UX services which binding to AD Server, and any service of these needs ldap-client configuration, with insertion and storing of credential for binding. One of these is Dovecot which do ldap-authentication of any user of its by a typical fashion... user: ad_username(a)my.ad psw: ad_username_password Hence, I wish to avoid spreading of AD-binding-credentials gathering this couple of data in just one point of my system: that is, OpenLDAP proxy or SLAPD Front-End. I've already tried to do it. First of all, I got an error at installation stage which gave me crazy and I've not yet solved: i.e, after copy of DB_CONFIG example file to lib directory: root@lamp ~# rm -fr /var/lib/ldap/* && rm -fr /etc/ldap/slapd.d/* && cp /usr/share/slapd/DB_CONFIG /var/lib/ldap/DB_CONFIG when I run: root@lamp ~# slapadd -v -l xdom.ldif+ I get an error like the following: 52e1597b bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap: (14). Even though DB_CONFING is there and has right permissions... Anyway, I discovered that this issues was not blocking, so I went forward. I populate splap.d: root@lamp ~# slaptest -f /etc/ldap/slapd.conf -F /etc/ldap/slapd.d/ 52e280b2 bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap: (14). Expect poor performance for suffix "dc=xdom,dc=loc". I gave right permission to directories: root@lamp ~# chown -R openldap:openldap /etc/ldap/slapd.d/ && chown -R openldap:openldap /var/lib/ldap/ and I started LDAP Service: root@lamp ~# service slapd start At this time, I tested OpenLDAP Proxy Server by 5 combinations of ldap request: 1) bypassing OpenLDAP Proxy Server and directly binding AD Server by conventional D.N.: ldapsearch -H ldap://server.my.ad -D "cn=ad_user,ou=ced,dc=my,dc=ad" -w ad_user_password -x -b "ou=ced,dc=my,dc=ad" -LLL "(sAMAccountName=*)" and it works. 2) bypassing OpenLDAP Proxy Server and directly binding AD Server by U.P.N (User Principal Name): ldapsearch -H ldap://server.my.ad -D ad_user(a)my.ad -w ad_user_password -x -b "ou=ced,dc=my,dc=ad" -LLL "(sAMAccountName=*)" and it works. 3) through OpenLDAP Proxy Server without any binding: ldapsearch -x -b "ou=ced,dc=my,dc=ad" -LLL "(sAMAccountName=*)" and it works. 4) through OpenLDAP Proxy Server and binding by conventional D.N.: ldapsearch -D "cn=ad_user,ou=ced,dc=my,dc=ad" -w ad_user_password -x -b "ou=ced,dc=my,dc=ad" -LLL "(sAMAccountName=*)" and it works. 5) through OpenLDAP Proxy Server and binding by U.P.N (User Principal Name): ldapsearch -D ad_user(a)my.ad -w ad_user_password -x -b "ou=ced,dc=my,dc=ad" - LLL "(sAMAccountName=*)" and it DOES NOT works. And it is a very BIG BIG problem for me: I cannot force users to authenticate themselves in Dovecot by complicated and unacceptable (because of comma, equal and space characters) D.N.!!!! I tried to face this issue by Rewriting Overlay, just to discover that these library rewrite BINDDN only after "dnPrettyNormal()" call (making "rewriting- method" useless...) Now, please: help me!!!! What can I do? How can I solve my issue??? And how can I avoid DB_CONFING issue? Regards, Egidio. PS: follow my ldap.conf and slapd.conf ## LDAP.CONF #################################### BASE dc=xdom,dc=loc URI ldap://localhost TLS_CACERT /etc/ssl/certs/ca-certificates.crt ## SLAPD.CONF #################################### include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args logfile /var/log/slapd.log loglevel -1 modulepath /usr/lib/ldap moduleload back_bdb moduleload back_ldap moduleload rwm tool-threads 1 database bdb suffix "dc=xdom,dc=loc" checkpoint 1024 15 rootdn "cn=droot,dc=xdom,dc=loc" rootpw {SSHA}Xhy4Gc0k5DU+gfpbpkv+PJWJ92Itp5rJ Database ldap Suffix "dc=ts,dc=dipvvf,dc=it" Uri "ldap://server.my.ad/ ldap://server2.my.ad/" rebind-as-user idassert-bind bindmethod=simple binddn="cn=email ed. demon,ou=email,ou=virtualization,ou=ced,dc=ts, dc=dipvvf,dc=it" credentials=xxxxxx mode=none idassert-authzFrom "*" overlay rwm rwm-rewriteEngine on rwm-rewriteMap ldap samacc "ldap://vfdc1.ts.dipvvf.it/dc=ts,dc=dipvvf,dc=it?dn? sub?samaccountname=" #"ldap:///dc=ts,dc=dipvvf,dc=it?dn?sub?samaccountname=" rwm-rewriteContext bindDN rwm-rewriteRule "^([^,]+)@[^,]+$" "${samacc($1)}" ":@I"

2 1

Ldap Connection Issue
by Borresen, John - 0442 - MITLL 24 Jan '14

24 Jan '14

All, Very similar issue that Warron was/is having. Server1: # ldapsearch -W -x -ZZ -b cn=config -v -D cn=admin,cn=config Server1: # ldapsearch -W -x -ZZ -H ldap://server2.example.ldap -b cn=config -v -D cn=admin,cn=config These commands work (they returns the dbase as expect & desired), both servers are clients to themselves and the other server (using self-signed wildcard certificates) Both ldap.confs are identical, the one on server1 was used on server2. The URI directive looks like: uri ldap://server1.example.ldap ldap://server1.<FQDN> ldap://server2.example.ldap ldap://server2.<FQDN> Server2: a) # ldapsearch -W -x -ZZ -b cn=config -v -D cn=admin,cn=config Fails with: ldap_initialize( <DEFAULT> ) ldap_start_tls: Connect error (-11) b) # ldapsearch -W -x -ZZ -H ldap://server2.example.ldap -b cn=config -v -D cn=admin,cn=config ldap_initialize( ldap://server2.example.ldap:389/??base ) ldap_start_tls: Connect error (-11) c) # ldapsearch -W -x -ZZ -h ldap://server1.example.ldap -b cn=config -v -D cn=admin,cn=config d) ldap_initialize( ldap://ldap:%2F%2Fserver1.example.ldap) e) Could not create LDAP session handle for URI=ldap://ldap:%2F%2Fgp42-admin4.llan.ll.mit.edu (-9): Bad parameter to an ldap routine There is one other client that like server1 can search the dbase(s) on both servers (it too is a client of both servers). Any ideas at what to look for? thanks in advance John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Ph: (781) 981-1609 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

2 2

LMDB as separate library
by Jan Staněk 24 Jan '14

24 Jan '14

Hello, I'm trying to package LMDB for Fedora as possible system-wide replacement for Oracle's BerkeleyDB. The main trouble is that in current state the LMDB builds an unversioned liblmdb.so, although having a option to link the binaries dynamically without patching the Makefile would be also nice. I want to ask, are there any intentions to release the LMDB as separable library (with versioned soname, etc.)? Thanks in advance, Jan -- Jan Stanek - Red Hat Associate Developer Engineer - Databases Team

2 1

ldap_bind: Invalid credentials (49)
by W Forum W 24 Jan '14

24 Jan '14

Hi, I try to add the samba.schema in my openldap server (Debian Wheezy), default installed. slapd: 2.4.31 ldap-utils 2.4.31 I followed this tutorial https://help.ubuntu.com/10.04/serverguide/samba-ldap.html I can use ldapsearch, ldapadd and ldapmodify with my cn=admin,dc=example,dc=com password but when I try to add the new schema to the directory with ldapadd -x -D cn=admin,cn=config -W -f /tmp/cn\=samba.ldif I get ldap_bind: Invalid credentials (49) Is there a different password for cn=admin,cn=config? I was never asked to create it. And how can I change it if necessary? Many thanks!!!

4 4

Re: ldap_add: Object class violation (65), additional info: attribute 'host' not allowed
by W Forum W 24 Jan '14

24 Jan '14

Hi, Thanks for the quick response I am using Debian wheezy. I installed the ldapns.schema from the deb package but I still when I try to add a user (as a ldif file with a host attribute defined) a get the error ldap_add: Object class violation (65) additional info: attribute 'host' not allowed If I remove the host attribute (from ldif file) the user is added successfully. How can I get the host attribute working? Many thanks On 01/20/2014 05:43 PM, Joshua Schaeffer wrote: > There is some information from the Debian wiki > (https://wiki.debian.org/LDAP/PAM) on adding a host attribute to a > user, but I'm sure it applies to other distro's as well: > > To add the "host" attribute to a user, he should have an objectClass > that supports this. The "account" objectClass has the attribute, but > is not compatible with the "inetOrgPerson" objectClass. To work around > this, you can use the "ldapns" schema, supplied with the libpam-ldap > <http://packages.debian.org/libpam-ldap> package. This schema provides > the "hostObject" objectClass, which has the proper "host" attribute. > > > On Mon, Jan 20, 2014 at 9:08 AM, W Forum W <wforumw(a)gmail.com > <mailto:wforumw@gmail.com>> wrote: > > Hi > I try to add a user but the host attribute is not accept > (everything else is fine) > > ldapadd -x -W -D "cn=admin,dc=example,dc=com" -f user.ldif > Enter LDAP Password: > adding new entry "uid=user,ou=Users,dc=example,dc=comt" > ldap_add: Object class violation (65) > additional info: attribute 'host' not allowed > > how can i add a host attribute > i have following schema installed > > core.schema > cosine.schema > nis.schema > inetorgperson.schema > samba.schema > > thanks in advance > >

2 1

providing a default value for an attribute (w/ translucent proxy)
by Dan Pritts 23 Jan '14

23 Jan '14

Hi all - I've got a familiar story, I'm sure. I have a campus-wide AD infrastructure that I'd like to leverage. Unfortunately, my LDAP client (an Isilon NAS) requires some attributes that AD doesn't populate. e.g., homeDirectory. As it turns out, the silly thing doesn't even use these values, at least not for our use case. But the entire lookup fails if it doesn't get something back for those attributes. I presumably can use a translucent proxy to set these attributes locally. I tested this successfully. Ideally, though, instead of creating DNs for each person on the translucent proxy server, I'd like to just have slapd fill in a default value for these attributes when they are empty. I would also be happy with a method that just overwrites the existing attribute, regardless of whether it exists. Again, for ALL DNs... I don't want to create each account individually in both places. I thought maybe the rewrite overlay would allow this but it seems like I was incorrect (please advise if it can be done). I have poked around and found no other way to do this. Am I missing something? thanks -- Dan Pritts ICPSR Computing & Network Services University of Michigan +1 (734)615-7362

2 2

Re: Implementing PPolicy
by Dieter Klünter 23 Jan '14

23 Jan '14

Am Wed, 22 Jan 2014 18:14:22 -0700 schrieb Joshua Schaeffer <jschaeffer0922(a)gmail.com>: > Just now getting back to this. I ran the daemon in debug mode, then > ran the passwd utility on a different server for my uid (got the same > results as before and then terminated the daemon) and it output a lot > on the acl's. I attached the full log file. Below is the tail end of > the log: > > =================================================== > 52e068f8 <= acl_mask: [3] mask: read(=rscxd) > 52e068f8 => slap_access_allowed: read access granted by read(=rscxd) > 52e068f8 => access_allowed: read access granted by read(=rscxd) > 52e068f8 => access_allowed: result not in cache (userPassword) > 52e068f8 => access_allowed: read access to > "uid=jschaeffer,ou=People,dc=harmonywave,dc=com" "userPassword" > requested 52e068f8 => acl_get: [1] attr userPassword > 52e068f8 => acl_mask: access to entry > "uid=jschaeffer,ou=People,dc=harmonywave,dc=com", attr "userPassword" > requested > 52e068f8 => acl_mask: to value by "", (=0) > 52e068f8 <= check a_dn_pat: self > 52e068f8 <= check a_dn_pat: anonymous > 52e068f8 <= acl_mask: [2] applying auth(=xd) (stop) > 52e068f8 <= acl_mask: [2] mask: auth(=xd) > 52e068f8 => slap_access_allowed: read access denied by auth(=xd) > 52e068f8 => access_allowed: no more rules > 52e068f8 send_search_entry: conn 1000 access to attribute > userPassword, value #0 not allowed > 52e068fb => bdb_entry_get: found entry: > "uid=jschaeffer,ou=people,dc=harmonywave,dc=com" > 52e068fb => bdb_entry_get: found entry: > "cn=default,ou=policies,dc=harmonywave,dc=com" > 52e068fb => access_allowed: result not in cache (userPassword) > 52e068fb => access_allowed: auth access to > "uid=jschaeffer,ou=People,dc=harmonywave,dc=com" "userPassword" > requested 52e068fb => acl_get: [1] attr userPassword > 52e068fb => acl_mask: access to entry > "uid=jschaeffer,ou=People,dc=harmonywave,dc=com", attr "userPassword" > requested > 52e068fb => acl_mask: to value by "", (=0) > 52e068fb <= check a_dn_pat: self > 52e068fb <= check a_dn_pat: anonymous > 52e068fb <= acl_mask: [2] applying auth(=xd) (stop) > 52e068fb <= acl_mask: [2] mask: auth(=xd) > 52e068fb => slap_access_allowed: auth access granted by auth(=xd) [...] There is an anonymous trying to read a userPassword (and probably trying to modifying it afterwards). Acording to your access rules only auth permissions are granted to anonymous. -Dieter -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

2 1

Access of entryUUID in an overlay module
by Alexander Kläser 23 Jan '14

23 Jan '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear all, I am new to OpenLDAP. In order to process transactions in a separate piece of software, I am parsing the output of a slightly modified version of the auditlog overlay module. As I need to know the entryUUID of a modified LDAP object, I tried to query it and write it along with the other information into the auditlog file. My current patch seems to navigate slapd into a deadlock situation. I do not understand the reason for that and would be very happy if someone may help to point me into the correct direction for implementing this. Here is my patch that I am working with, so far: ==================== - --- ./servers/slapd/overlays/auditlog.c.orig 2014-01-09 12:26:22.060000000 -0500 +++ ./servers/slapd/overlays/auditlog.c 2014-01-17 11:13:34.624000000 - -0500 @@ -24,6 +24,7 @@ #ifdef SLAPD_OVER_AUDITLOG #include <stdio.h> +#include <time.h> #include <ac/string.h> #include <ac/ctype.h> @@ -74,8 +75,13 @@ Modifications *m; struct berval *b, *who = NULL, peername; char *what, *whatm, *suffix; - - time_t stamp; + struct timeval stamp; int i; + int rc; + Entry *e = NULL; + Attribute *a_entryUUID; + char *entryUUID = "NULL"; + BackendInfo *bi = op->o_bd->bd_info; if ( rs->sr_err != LDAP_SUCCESS ) return SLAP_CB_CONTINUE; @@ -119,6 +125,16 @@ if ( !who ) who = &op->o_dn; + /* get the entryUUID */ + //rc = overlay_entry_get_ov( op, &op->o_req_ndn, NULL, NULL, 0, &e, on ); + op->o_bd->bd_info = (BackendInfo *)on->on_info; + rc = be_entry_get_rw( op, &op->o_req_ndn, NULL, NULL, 0, &e ); + op->o_bd->bd_info = bi; + if ( rc == LDAP_SUCCESS ) { + a_entryUUID = attr_find( e->e_attrs, slap_schema.si_ad_entryUUID ); + entryUUID = a_entryUUID->a_vals[0].bv_val; + } + peername = op->o_conn->c_peer_name; ldap_pvt_thread_mutex_lock(&ad->ad_mutex); if((f = fopen(ad->ad_logfile, "a")) == NULL) { @@ -126,9 +142,11 @@ return SLAP_CB_CONTINUE; } - - stamp = slap_get_time(); - - fprintf(f, "# %s %ld %s%s%s %s conn=%ld\n", - - what, (long)stamp, suffix, who ? " " : "", who ? who->bv_val : "", + gettimeofday(&stamp, NULL); + fprintf(f, "# %s %ld.%06ld %s %s%s%s %s conn=%ld\n", + what, stamp.tv_sec, stamp.tv_usec, + entryUUID, + suffix, who ? " " : "", who ? who->bv_val : "", peername.bv_val ? peername.bv_val: "", op->o_conn->c_connid); if ( !BER_BVISEMPTY( &op->o_conn->c_dn ) && @@ -176,7 +194,7 @@ break; } - - fprintf(f, "# end %s %ld\n\n", what, (long)stamp); + fprintf(f, "# end %s %ld.%06ld\n\n", what, stamp.tv_sec, stamp.tv_usec); fclose(f); ldap_pvt_thread_mutex_unlock(&ad->ad_mutex); ==================== thanks so much in advance Alex - -- Dr. Alexander Kläser Open Source Software Engineer Univention GmbH be open. Mary-Somerville-Str.1 28359 Bremen Tel. : +49 421 22232-59 Fax : +49 421 22232-99 klaeser(a)univention.de http://www.univention.de Geschäftsführer: Peter H. Ganten HRB 20755 Amtsgericht Bremen Steuer-Nr.: 71-597-02876 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlLZWZkACgkQgX5Q1Nb/qB0VSACfanVbcP79n3gEnH0zivWSThGA dxUAnj+2NaKhLweCFjFMtGoHPdHzByQZ =DHYq -----END PGP SIGNATURE-----

2 3

Re: N-Way Multi-Master
by Quanah Gibson-Mount 23 Jan '14

23 Jan '14

--On Wednesday, January 22, 2014 9:40 AM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Anyway, setting up (or attempting) an N-way Multi-Master (in the end will > be 3-way Multi-Master -- the below is only a 2-Way). Been reading the > man pages, and the procedure(s) in section 18.3.3 in the "24 Admin > Guide", etc. OpenLDAP version you are using? > Currently, have two servers (going to build one more) to play with. You could slapcat cn=config and manually fix the ldif output and then reload it if you aren't able to modify it. Personally, I avoid configuring cn=config for MMR, and instead focus on MMR for the actual databases. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

3 2

RE: N-Way Multi-Master
by Quanah Gibson-Mount 22 Jan '14

22 Jan '14

--On Wednesday, January 22, 2014 4:56 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > I was not able to get slapcat to work, so, thankfully being a test > environment, it was easy to back step and recreate the slapd.d. > > Now, rereading the Admin Guide...years ago, on our production environment > I did this wrong and trying to correct in our test environment before > rolling it out; but, it was my intent to create MMR but only ended up > creating a Delta-syncrepl. > > Am I mistaken, or do I on each server in the MMR configuration need to > create an accesslog? Looking at the script that Quanah sent, it appears > that it is what's going on. If you are going to set up delta-syncrepl based MMR, then yes, the accesslog db must exist on each master. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical