openldap-technical

openldap-technical@openldap.org

3 participants
9990 discussions

Accelog overlay do not register unbind idletimeout
by David Tello 11 Feb '14

11 Feb '14

Hi all, I have a doubt. I have a idletimeout and it's working correctly. The session die after this time and new binds are required. The problem es that this automatic unbind isn't appears in the accesslog. No problem with the binds but there isn't any automatic unbind. I think that the configuration of overlay accesslog is correct, because the manual unbind appears correctly. Someone know if is this the normal behavior? Thanks for your time.

1 0

Problem with ppolicy
by Mikael Nehlsen 11 Feb '14

11 Feb '14

Hello! I have a problem with the ppolicy module. I have 2 ldaptrees dc=example,dc=com and o=external and I want to have password policies (lockout after 5 failed login attempts) and I can see that it works on dc=example,dc=com but it does not work on o=external. Both trees save failed login attempts but only the first tree locks people out o=external just saves more and more failed attempts but never lockout the user. I have tried a lot of things and I can not figure out what the problem is. I hope someone here can help me. It is 2 replicated ubuntu 10.04 servers with openldap 2.4.21-0ubuntu5.7 and the ppolicy configuration looks like this: ppolmodule.ldif : dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModuleLoad: ppolicy.la ldapadd -x -D "cn=admin,cn=config" -w password -f ~/ppolmodule.ldif -h ldap1 ppol.ldif: dn: ou=policies,dc=example,dc=com objectClass: organizationalUnit objectClass: top ou: policies dn: cn=default,ou=policies,dc=example,dc=com objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: 2.5.4.35 pwdLockout: TRUE pwdLockoutDuration: 1800 pwdMaxFailure: 5 pwdMinLength: 6 ldapadd -x -D "cn=admin,dc=example,dc=com" -w password -f ~/ppol.ldif -h ldap1 ppol_external.ldif: dn: ou=policies,o=external objectClass: organizationalUnit objectClass: top ou: policies dn: cn=default,ou=policies,o=external objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: 2.5.4.35 pwdLockout: TRUE pwdLockoutDuration: 1800 pwdMaxFailure: 5 pwdMinLength: 6 ldapadd -x -D "cn=admin,dc=example,dc=com" -w password -f ~/ppol_external.ldif -h ldap1 ppoloverlay.ldif: dn: olcOverlay=ppolicy,olcDatabase={1}bdb,cn=config olcOverlay: ppolicy objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcPPolicyHashCleartext: TRUE olcPPolicyUseLockout: FALSE olcPPolicyDefault: cn=default,ou=policies,dc=example,dc=com ppoloverlay_external.ldif: dn: olcOverlay=ppolicy,olcDatabase={2}bdb,cn=config olcOverlay: ppolicy objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcPPolicyHashCleartext: TRUE olcPPolicyUseLockout: FALSE olcPPolicyDefault: cn=default,ou=policies,o=external ldapadd -x -D "cn=admin,cn=config" -w password -f ~/ppoloverlay.ldif -h ldap1 ldapadd -x -D "cn=admin,cn=config" -w password -f ~/ppoloverlay_external.ldif -h ldap1 I tried with only one default policy for both trees as well, it made no difference. /Mikael

1 1

Recommended version of BDB package
by Mark Cairney 10 Feb '14

10 Feb '14

Hi, Having recently experienced some issues with our Live server (2.4.38, Scientific Linux 6.4 64-bit) I was looking into possible causes and found the following Debian bug report which suggests that BDB 5.X is problematic with OpenLDAP. What's the "best" version of BDB to go with- I see 4.7.25 "with patches" mentioned in the posting and I noticed that this is the version shipped with LTB. If I were to downgrade my BDB database would this be the best one to go for? I would like to migrate to MDB but there's an issue with alias de-referencing that's a bit of a deal-breaker for us at the moment as a number of our departments use them to provide subsets of their own users(ITS#7657). Kind regards, Mark -- /**************************** Mark Cairney ITI UNIX Section Information Services University of Edinburgh Tel: 0131 650 6565 Email: Mark.Cairney(a)ed.ac.uk *******************************/ The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

5 9

compile error with 2.4.39 on Solaris 10 (SPARC)
by Amos 10 Feb '14

10 Feb '14

get an error when attempting to compile, 64-bit: /bin/sh ../../libtool --mode=compile gcc -m64 -I/usr/local/BerkeleyDB.5.3/include -I/usr/local/include/openssl -I/usr/local/include/sasl -g -O2 -I../../include -I../../include -DLDAP_LIBRARY -c version.c /bin/sh ../../libtool --mode=link gcc -m64 -I/usr/local/BerkeleyDB.5.3/include -I/usr/local/include/openssl -I/usr/local/include/sasl -g -O2 -L/usr/local/lib/sparcv9 -R/usr/local/lib/sparcv9 -L/usr/local/BerkeleyDB.5.3/lib/sparcv9 -R/usr/local/BerkeleyDB.5.3/lib/sparcv9 -release 2.4 -version-info 12:2:10 -rpath /usr/local/lib/sparcv9 -o libldap.la bind.lo open.lo result.lo error.lo compare.lo search.lo controls.lo messages.lo references.lo extended.lo cyrus.lo modify.lo add.lo modrdn.lo delete.lo abandon.lo sasl.lo gssapi.lo sbind.lo unbind.lo cancel.lo filter.lo free.lo sort.lo passwd.lo whoami.lo getdn.lo getentry.lo getattr.lo getvalues.lo addentry.lo request.lo os-ip.lo url.lo pagectrl.lo sortctrl.lo vlvctrl.lo init.lo options.lo print.lo string.lo util-int.lo schema.lo charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo tls2.lo tls_o.lo tls_g.lo tls_m.lo turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo assertion.lo deref.lo ldif.lo fetch.lo version.lo ../../libraries/liblber/ liblber.la -lresolv -lgen -lnsl -lsocket -lsasl2 -lssl -lcrypto gmake[2]: *** No rule to make target `../../libraries/liblber/liblber.la', needed by `apitest'. Stop. gmake[2]: Leaving directory `/usr/soft/that/openldap-2.4.39/src/default/sparcv9_sun_solaris2.10/libraries/libldap' gmake[1]: *** [all-common] Error 1 gmake[1]: Leaving directory `/usr/soft/that/openldap-2.4.39/src/default/sparcv9_sun_solaris2.10/libraries' gmake: *** [all-common] Error 1 I get the same thing when attempting 32-bit compile: /bin/sh ../../libtool --mode=compile gcc -I/usr/local/BerkeleyDB.5.3/include -I/usr/local/include/openssl -I/usr/local/include/sasl -g -O2 -I../../include -I../../include -DLDAP_LIBRARY -c version.c /bin/sh ../../libtool --mode=link gcc -I/usr/local/BerkeleyDB.5.3/include -I/usr/local/include/openssl -I/usr/local/include/sasl -g -O2 -L/usr/local/lib -R/usr/local/lib -L/usr/local/BerkeleyDB.5.3/lib -R/usr/local/BerkeleyDB.5.3/lib -release 2.4 -version-info 12:2:10 -rpath /usr/local/lib -o libldap.la bind.lo open.lo result.lo error.lo compare.lo search.lo controls.lo messages.lo references.lo extended.lo cyrus.lo modify.lo add.lo modrdn.lo delete.lo abandon.lo sasl.lo gssapi.lo sbind.lo unbind.lo cancel.lo filter.lo free.lo sort.lo passwd.lo whoami.lo getdn.lo getentry.lo getattr.lo getvalues.lo addentry.lo request.lo os-ip.lo url.lo pagectrl.lo sortctrl.lo vlvctrl.lo init.lo options.lo print.lo string.lo util-int.lo schema.lo charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo tls2.lo tls_o.lo tls_g.lo tls_m.lo turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo assertion.lo deref.lo ldif.lo fetch.lo version.lo ../../libraries/liblber/liblber.la -lresolv -lgen -lnsl -lsocket -lsasl2 -lssl -lcrypto gmake[2]: *** No rule to make target `../../libraries/liblber/liblber.la', needed by `apitest'. Stop. gmake[2]: Leaving directory `/usr/soft/that/openldap-2.4.39/src/default/sparcv9_sun_solaris2.10/libraries/libldap' gmake[1]: *** [all-common] Error 1 gmake[1]: Leaving directory `/usr/soft/that/openldap-2.4.39/src/default/sparcv9_sun_solaris2.10/libraries' gmake: *** [all-common] Error 1 Didn't encounter this with 2.4.38. Amos

2 1

Slow to add 1 million items
by Andrew Eross 10 Feb '14

10 Feb '14

Hello all, I've been Google'ing around and searching the archives, but I haven't quite been able to find an answer, so I wanted to ask the list. I've been experimenting with OpenLDAP adds to see how quickly we can get data inserted into the DB. I'm using Ubuntu 10.04, and I've tried both the packaged OpenLDAP 2.4.21 using hdb, and just recently the latest OpenLDAP 2.4.39 using lmdb, both with relatively similar results. The short version is: to insert 1 million records, it's taking about 8 hours on a machine with 2GB RAM / 3Ghz / SSD, which seems like a long time to me. The insert method is to use a single big ldiff file like this: ### snip ### dn: cn=newtest0,ou=customer,dc=test,dc=com objectclass: inetOrgPerson userPassword: 90sac90sudasdjcao0sdjtest telephoneNumber: 61400000000 sn: none dn: cn=newtest1,ou=customer,dc=test,dc=com objectclass: inetOrgPerson userPassword: 90sac90sudasdjcao0sdjtest telephoneNumber: 61400000000 sn: none ### snip ### Then add it with ldapadd: ldapadd -x -D cn=admin,dc=test,dc=com -w test -f ./test My configuration (for mdb in this instance) used with 2.4.39 is this: ### config ### include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema database mdb directory /usr/local/var/openldap-data suffix "dc=test,dc=com" rootdn "cn=admin,dc=test,dc=com" rootpw test maxsize 1980732000 #Indexes index cn,telephoneNumber eq index objectClass eq ### config ### Any ideas or things I could try? Thank you! Andrew

7 13

Openldap shutdown expectedly
by Liu Yongjian 10 Feb '14

10 Feb '14

I have make a question on http://stackoverflow.com/questions/21619553/openldap-unexpectedly-shutdown Can anyone help me? -- Thank you

2 1

Have you seen this FUD - IT pros suffer OpenLDAP configuration headaches ?
by Gavin Henry 09 Feb '14

09 Feb '14

http://searchdatacenter.techtarget.com/feature/IT-pros-suffer-OpenLDAP-conf… Any one been in touch with them? -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretec.co.uk Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 24 Cormack Park, Rothienorman, Inverurie, Aberdeenshire, AB51 8GL. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html Do you know we have our own VoIP provider called SureVoIP? See http://www.surevoip.co.uk OpenPGP (GPG/PGP) Public Key: 0x8CFBA8E6 - Import from hkp://subkeys.pgp.net or http://www.suretecgroup.com/0x8CFBA8E6.gpg

18 20

SASL DIGEST-MD5 works but PLAIN/LOGIN fails
by Michael Ströder 09 Feb '14

09 Feb '14

HI! I'd like let users authenticate via SASL/PLAIN or SASL/LOGIN so they do not have to deal with full bind-DNs, my client does not have to search the user and to avoid slapo-rwm. Yes, the connection is protected with TLS. Later it has to work with hashed userPassword values. It should be feasible. Or not? Test system: latest OpenLDAP RE24 cyrus-sasl-2.1.25-28.1.2.x86_64 shipped with openSUSE 13.1 In my test setup everything works with DIGEST-MD5 but not with PLAIN or LOGIN (clear-text userPassword value for testing). The log shows that the SASL username gets mapped by authz-regexp to the correct LDAP user entry: 52f60408 <==slap_sasl2dn: Converted SASL name to uid=user,ou=dept,o=example 52f60408 slap_sasl_getdn: dn:id converted to uid=user,ou=dept,o=example But SASL does not use "pwcheck_method: slapd" for mechs PLAIN/LOGIN but works with DIGEST-MD5: $ ldapwhoami -H ldapi:/// -Y DIGEST-MD5 -U user -w secret SASL/DIGEST-MD5 authentication started SASL username: user SASL SSF: 128 SASL data security layer installed. dn:uid=user,ou=dept,o=example $ ldapwhoami -H ldapi:/// -Y LOGIN -U user -w secret SASL/LOGIN authentication started ldap_sasl_interactive_bind_s: Authentication method not supported (7) additional info: SASL(-4): no mechanism available: checkpass failed $ ldapwhoami -H ldapi:/// -Y PLAIN -U user -w secret SASL/PLAIN authentication started ldap_sasl_interactive_bind_s: Authentication method not supported (7) additional info: SASL(-4): no mechanism available: Password verification failed The trace shows for PLAIN or LOGIN (running slapd -d config,stats,stats2,acl,args,trace): SASL [conn=1002] Error: unknown password verifier(s) slapd My /usr/lib64/sasl.conf contains: ---------------------------- snip ---------------------------- pwcheck_method: slapd mech_list: plain login digest-md5 external ---------------------------- snip ---------------------------- I've checked that this is the right file by setting "pwcheck_method: foobar" which appears in the logs then. My slapd.conf contains: ---------------------------- snip ---------------------------- disallow bind_anon require bind LDAPv3 strong # SSF value for ldapi:// localSSF 256 # minimum required SSF value (security strength factor) security transport=128 sasl=0 # Since we require TLS we can relax this sasl-secprops none,minssf=0 ---------------------------- snip ---------------------------- Any clue? Ciao, Michael.

5 8

rwm-rewriteMap for bindDN and slapo-ppolicy
by Michael Ströder 08 Feb '14

08 Feb '14

HI! I'm trying to use slapo-rwm to simplify bind-DNs used. I'm also using slapo-lastbind to record the last simple bind timestamp and slapo-ppolicy also for recording pwdFailureTime. Using latest RE24 of course. Something like this defined *within* the database section: ---------------------- snip ---------------------- overlay accesslog [..] rwm-rewriteMap slapd uid2dn "ldap:///o=example?entryDN?sub?" rwm-rewriteContext bindDN rwm-rewriteRule "^(uid=[^,]+),o=example$" "${uid2dn($1)}" ":@I" overlay lastbind overlay ppolicy ppolicy_default cn=ppolicy-default,cn=ampua,ou=ampua ppolicy_hash_cleartext ppolicy_use_lockout slapo-lastbind correctly updates the attribute 'authTimestamp' in the entry referenced by the rewritten bind-DN. slapo-ppolicy does *not* correctly update the attribute 'pwdFailureTime' in the entry referenced by the rewritten bind-DN. ---------------------- snip ---------------------- Any idea what's going on? BTW: Using the rwm-rewriteMap in a MMR setup causes seg faults in a running provider slapd when bringing up another empty provider. Have to examine that further though. Ciao, Michael.

1 1

slapd-meta exclude syntax; larger problem with rwm, collective attributes.
by Dan Pritts 07 Feb '14

07 Feb '14

Hi folks - first, a simple, direct question. I'm trying to use the meta backend, and exclude part of the back-end directory (which is AD, if that matters). I tried the following config: -------------------------- include /usr/local/pkg/openldap-2.4.39/etc/openldap/schema/core.schema include /usr/local/pkg/openldap-2.4.39/etc/openldap/schema/cosine.schema include /usr/local/pkg/openldap-2.4.39/etc/openldap/schema/inetorgperson.schema include /usr/local/pkg/openldap-2.4.39/etc/openldap/schema/nis.schema pidfile /var/run/openldap/slapd-filter.pid argsfile /var/run/openldap/slapd-filter.args loglevel any access to * by * read database meta suffix "dc=adsroot,dc=itd,dc=umich,dc=edu" uri "ldap://adsroot.itd.umich.edu/dc=adsroot,dc=itd,dc=umich,dc=edu" rootdn "cn=Manager,dc=adsroot,dc=itd,dc=umich,dc=edu" #subtree-exclude "ou=ICPSR,ou=Organizations,ou=UMICH,dc=adsroot,dc=itd,dc=umich,dc=edu" #subtree-exclude "ou=ICPSR,ou=Accounts,ou=UMICH,dc=adsroot,dc=itd,dc=umich,dc=edu" subtree-exclude "dn.subtree:ou=ICPSR,ou=Organizations,ou=UMICH,dc=adsroot,dc=itd,dc=umich,dc=edu" subtree-exclude "dn.subtree:ou=ICPSR,ou=Accounts,ou=UMICH,dc=adsroot,dc=itd,dc=umich,dc=edu" -------------------------- As you can see i tried two syntaxes for subtree-exclude. with either one, a search for "cn=danno" returns dn: cn=danno,ou=ICPSR,ou=Accounts,ou=UMICH,dc=adsroot,dc=itd,dc=umich,dc=edu What am I doing wrong? Or do I misunderstand what subtree-exclude is supposed to be doing? openldap 2.4.39 on centos 6, x64. The larger question - As I posted last week I am trying to put a proxy in front of Active Directory. AD has most of the required attributes for my application, but I need to fill in a couple that are missing. Translucent proxy makes sense, combined with the collect overlay. Unfortunately, slapd crashes when it encounters a DN from AD that has one of the collect attributes (its 7797). Not just a lookup failure, a hard crash. :( So, it next occurred to me to use another instance of slapd with rwm as a "filter" to remove the attributes I am trying to use with collect. It's complicated further by the fact that some subtrees have different attributes that I want to filter, or not. I tried soemthing like this: -------------------------- database ldap uri ldap://foo suffix ou=foo,dc=example,dc=edu [ rwm entries to leave only the attributes i want for ou=foo ] database ldap uri ldap://foo suffix ou=bar,dc=example,dc=edu [ rwm entries to leave only the attributes i want for ou=bar ] database meta uri ldap://foo suffix dc=example,dc=edu subtree-exclude ou=foo subtree-exclude ou=bar -------------------------- I had to add the third database entry, with the root dn, before auth would work. Presuming that i can actually make meta work with the subtree-exclude like I want, should a config like this work? As it is, everything is being returned from the third database entry, with the suffix at the root DN. So, I'm not sure if this idea of combining multiple ldap databases would work. thanks for any input! danno -- Dan Pritts ICPSR Computing & Network Services University of Michigan +1 (734)615-7362

2 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical