openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

RE: N-Way Multi-Master
by Quanah Gibson-Mount 22 Jan '14

22 Jan '14

--On Wednesday, January 22, 2014 2:00 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Thanks Quanah...I was wondering about that (both points --> slapcat and > only focusing on the actual dbases in MMR), too. > > I will attempt that (slapcat)...first. You might find this script useful as well: <https://github.com/Zimbra-Community/zimbra-sources/blob/master/main/ZimbraS…> --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

openldap.org down?
by Patrick Lists 22 Jan '14

22 Jan '14

Hi, I wanted to check if 2.4.39 had been released yet but the website does not seem to work. I only seen "Connecting" followed by "Connected" and then nothing. Regards, Patrick

2 3

RE: Antw: Adding attributes to cn=config
by Borresen, John - 0442 - MITLL 22 Jan '14

22 Jan '14

Thanks, I should've caught that. Going too fast and not enough coffee. -----Original Message----- From: Ulrich Windl [mailto:Ulrich.Windl@rz.uni-regensburg.de] Sent: Wednesday, January 22, 2014 3:02 AM To: Borresen, John - 0442 - MITLL Subject: Antw: Adding attributes to cn=config >>> "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> schrieb >>> am 21.01.2014 um 17:38 in Nachricht <201401211638.s0LGccwE074678(a)boole.openldap.org>: > Ok, > > Trying to add the following: > > objectClass: olcGlobal --> this is the objectClass on another server > that has SSL already set up. > dn: cn=config > changetype: add > olcTLSCipherSuite: HIGH:MEDIUM+TLSv1+SSLv3 > olcTLSCertificateFile: /usr/local/openldap/etc/openldap/CA/cacert.pem > olcTLSCertificateKeyFile: > /usr/local/openldap/etc/openldap/CA/private/cakey.pem > adding new entry "cn=config" > ldapmodify: Object class violation (65) > additional info: no objectClass attribute > > I've read the various manpages that deal with ldif formats, > ldapmodify, ldapadd, etc and been googling too. > > What am I missing? You want to "modify" cn=config, not "add" it. You want to "add" atributes. I'm surprised that someone with a "mit.edu" adress has such primitive problems ;-) Ulrich > > Thanks in advance. > > John D. Borresen (Dave) > Linux/Unix Systems Administrator > MIT Lincoln Laboratory > Surveillance Systems Group > 244 Wood St > Lexington, MA 02420 > Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

1 0

N-Way Multi-Master
by Borresen, John - 0442 - MITLL 22 Jan '14

22 Jan '14

***NOTE: Btw, I can't get to the openldap.org site, this morning. Receiving a "Bad Response" Anyway, setting up (or attempting) an N-way Multi-Master (in the end will be 3-way Multi-Master -- the below is only a 2-Way). Been reading the man pages, and the procedure(s) in section 18.3.3 in the "24 Admin Guide", etc. Currently, have two servers (going to build one more) to play with. (1) [root@<client_of_server2> openldap]# ldapsearch -W -x -H "ldap://<server2>.example.ldap" -ZZ -v -D cn=admin,cn=config -b cn=config olcOverlay={0}syncprov ldap_initialize( ldap://<server2>.example.ldap ) Enter LDAP Password: filter: olcOverlay={0}syncprov requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: olcOverlay={0}syncprov # requesting: ALL # # {0}syncprov, {0}config, config dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top objectClass: olcSyncProvConfig olcOverlay: {0}syncprov (2) [root@<server1> openldap]# ldapsearch -W -x -H "ldap://<server1>.example.ldap" -ZZ -v -D cn=admin,cn=config -b cn=config olcOverlay=syncprov ldap_initialize( ldap://<server1>.example.ldap ) Enter LDAP Password: filter: olcOverlay=syncprov requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: olcOverlay=syncprov # requesting: ALL # # {0}syncprov, {0}config, config dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top objectClass: olcSyncProvConfig olcOverlay: {0}syncprov (3) [root@<server1> openldap]# ldapsearch -W -x -H "ldap://<server1>.example.ldap" -ZZ -v -D cn=admin,cn=config -b cn=config olcDatabase=config ldap_initialize( ldap://<server1>.example.ldap ) Enter LDAP Password: filter: olcDatabase=config requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: olcDatabase=config # requesting: ALL # # {0}config, config dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcAddContentAcl: TRUE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,cn=config olcRootPW: {SSHA}**** olcSyncUseSubentry: FALSE olcMonitoring: FALSE olcSyncrepl: {0}rid=001 provider=ldap://<server1>.example.ldap binddn="cn=co nfig" bindmethod=simple credentials=<password> searchbase="cn=config" type=r efreshAndPersist retry="5 5 300 5" timeout=1 When I attempted to add the olcSyncrepl attribute, I added two "rids" but, somehow it only took one. Now, I can't add a second, nor can I delete the rid=001. With the configuration as it stands, I know it is in a loop. Attempt to add the second rid, again: #Add_LDIF: dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncrepl olcSyncreple: {1}rid=002 provider://<server2>.example.ldap binddn="cn=config" bindmethod=simple credentials=<password> searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 I receive the following error: LDAP error code 53: shadow context; no update referral If I attempt to add an olcUpdateRef, the following error appears: "must appear after syncrepl or updatedn" Even if, what appears to me, I add it after the syncrepl attribute. This is a test configuration...so, back-tracking is not a problem. Just would like to know if the Admin Guide missed a few steps and/or I did and where. Again, right now, the openldap.org site cannot be reached...so, I can't review the manual to see what I may have missed. Thanks in advance; Dave Borresen MIT Lincoln Lab

1 0

Adding attributes to cn=config
by Borresen, John - 0442 - MITLL 21 Jan '14

21 Jan '14

Ok, Trying to add the following: objectClass: olcGlobal --> this is the objectClass on another server that has SSL already set up. dn: cn=config changetype: add olcTLSCipherSuite: HIGH:MEDIUM+TLSv1+SSLv3 olcTLSCertificateFile: /usr/local/openldap/etc/openldap/CA/cacert.pem olcTLSCertificateKeyFile: /usr/local/openldap/etc/openldap/CA/private/cakey.pem adding new entry "cn=config" ldapmodify: Object class violation (65) additional info: no objectClass attribute I've read the various manpages that deal with ldif formats, ldapmodify, ldapadd, etc and been googling too. What am I missing? Thanks in advance. John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

3 6

Implementing PPolicy
by Joshua Schaeffer 21 Jan '14

21 Jan '14

I'm trying implement the password policy overlay into my openldap setup, I'm running a Debian 7 server and installed openldap with the package manager. =================================================== root@baneling:~# dpkg -l | grep slapd ii slapd 2.4.31-1+nmu2 amd64 OpenLDAP server (slapd) =================================================== I currently have my ldap server setup for authentication and authorization, I'm using libnss-ldapd and libpam-ldapd on my other machines to search the ldap directory and would like to implement the password policy provided by the overlay. I believe I've added the schema, loaded thedynamic module, and added the overlay to my databasecorrectly, however I'm not sure it's actually working. I've been mostly followingthis article and the openldap documentation: http://www.zytrax.com/books/ldap/ch6/ppolicy.html http://www.openldap.org/doc/admin24/overlays.html#Password Policies <http://www.openldap.org/doc/admin24/overlays.html#Password%20Policies> Here is my slapd.d config (shortened for brevity): =================================================== root@baneling:~# slapcat -b cn=config [...] dn: cn=module{1},cn=config objectClass: olcModuleList cn: module{1} structuralObjectClass: olcModuleList entryUUID: ad917d22-1583-1033-9e53-473d795f568b creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20140119183138Z olcModuleLoad: {0}ppolicy.so olcModulePath: /usr/lib/ldap entryCSN: 20140119183433.154615Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20140119183433Z [...] dn: cn={4}ppolicy,cn=schema,cn=config objectClass: olcSchemaConfig cn: {4}ppolicy [...] dn: olcOverlay={0}ppolicy,olcDatabase={1}hdb,cn=config objectClass: olcPPolicyConfig olcOverlay: {0}ppolicy olcPPolicyDefault: cn=default,ou=Policies,dc=harmonywave,dc=com olcPPolicyHashCleartext: TRUE olcPPolicyUseLockout: TRUE structuralObjectClass: olcPPolicyConfig entryUUID: 3c8dc8ce-158d-1033-9e57-473d795f568b creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20140119194003Z entryCSN: 20140119194003.774030Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20140119194003Z =================================================== And my container for the default policy: =================================================== root@baneling:~# ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b ou=Policies,dc=harmonywave,dc=com SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: ou=Policies,dc=harmonywave,dc=com ou: Policies objectClass: top objectClass: organizationalUnit dn: cn=default,ou=Policies,dc=harmonywave,dc=com cn: default objectClass: pwdPolicy objectClass: person objectClass: top pwdAttribute: userPassword pwdAllowUserChange: TRUE pwdExpireWarning: 432000 pwdFailureCountInterval: 1800 pwdGraceAuthNLimit: 10 pwdInHistory: 10 pwdLockout: TRUE pwdLockoutDuration: 1800 pwdMaxAge: 7776000 pwdMaxFailure: 6 pwdMinAge: 86400 pwdMinLength: 10 pwdMustChange: FALSE pwdSafeModify: TRUE sn: passwdpolicy =================================================== However, I'm not sure the policy is actually being applied. I thought it might be because I originally created my user before adding the schema and overlay, so I deleted the user and recreated it. I'm able to log into a server using my uid, however if I try to change my password I get the following: =================================================== jschaeffer@defiler:~$ passwd (current) LDAP Password: New password: Retype new password: password change failed: Constraint violation passwd: Authentication token manipulation error passwd: password unchanged =================================================== I've been entering mycurrent password correctly when it asks and I am using a complex new password. I also don't see any of the ppolicy attributes on my user (pwdChangeTime, pwdFailureTime, pwdGraceUseTime, etc): =================================================== root@baneling:~# ldapsearch -LLL -x -D cn=admin,dc=harmonywave,dc=com -W -H ldapi:/// -b uid=jschaeffer,ou=People,dc=harmonywave,dc=com Enter LDAP Password: dn: uid=jschaeffer,ou=People,dc=harmonywave,dc=com objectClass: top objectClass: account objectClass: posixAccount uid: jschaeffer cn: Joshua Schaeffer uidNumber: 3000 gidNumber: 3000 homeDirectory: /home/jschaeffer loginShell: /bin/bash gecos: Joshua Schaeffer userPassword:: .... =================================================== I've been searching around for on the web for answers to the passwd issue, but I've not been able to find anything useful. Does anyone know how to verify that the ppolicy overlay is actually working?

2 3

re: sudoCommand" limitation
by Juergen.Sprenger＠swisscom.com 21 Jan '14

21 Jan '14

Hi Michel, > Are there any limitations of the "sudoCommand" values? e.g. length <= 64 attributetype ( 1.3.6.1.4.1.15953.9.1.3 NAME 'sudoCommand' DESC 'Command(s) to be executed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) The LDAP definition for the IA5 String syntax is: ( 1.3.6.1.4.1.1466.115.121.1.26 DESC 'IA5 String' ) http://tools.ietf.org/search/rfc4517#section-3.3.15 AFAIK there should be no limitation of length according to rfc4517. Regards Juergen

1 0

LDIF and cn=config
by Côme BERNIGAUD 21 Jan '14

21 Jan '14

Hello, I'm trying to figure out what's happening with my LDAP. I insert an LDIF modifying a schema in cn=schema,cn=config, OpenLDAP gives me an error "No such object", but it still does the modification. How can I do to avoid having this error while the modification is working? I can't just ignore the error because I intend to script this and I need to know if it actually succeeded or not. Please have a look at the log attached to understand my problem. Côme

1 0

"sudoCommand" limitation?
by michel.del-piero＠isc-ejpd.admin.ch 20 Jan '14

20 Jan '14

Hi Are there any limitations of the "sudoCommand" values? e.g. length <= 64 Regards Michel

2 1

RE24 testing call (2.4.39)
by Quanah Gibson-Mount 20 Jan '14

20 Jan '14

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.39 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

5 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical