openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

proxy user
by Jignesh Patel 22 Nov '13

22 Nov '13

How to create a proxy user in LDAP and assign it to main user? Jignesh Patel Chief Architect iCare.com LLC 14001 NW 4th Street Sunrise, FL 33325 O: 954-616-5604 F: 954-616-5609 jignesh(a)icare.com CONFIDENTIALITY NOTE: The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, please immediately reply to the sender that you have received this communication in error and then delete it. Thank you.

2 1

creating proxy LDAP
by Jignesh Patel 22 Nov '13

22 Nov '13

We have a requirement to expose our LDAP to public domain. In that case I need to setup internal LDAP and a proxy LDAP, that is the way I see it. Any inputs on the design highly appreciated. We are using openldap with MDB. Jignesh Patel Chief Architect iCare.com LLC 14001 NW 4th Street Sunrise, FL 33325 O: 954-616-5604 F: 954-616-5609 jignesh(a)icare.com CONFIDENTIALITY NOTE: The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, please immediately reply to the sender that you have received this communication in error and then delete it. Thank you.

2 1

hide namingcontexts
by openldap＠downhomelinux.com 22 Nov '13

22 Nov '13

I am trying to lock down an openldap server (2.4.23). Using the FAQ I have limited the user entries with: {1)to attrs=userPassword by self =xw by anonymous auth {2)to * by users read However, I cannot figure out how to match the namingContexts attribute with olcaccess to also prevent unauthenticated users from listing the directories served. I have tried many variations of the following based on search results: to attrs=namingContexts by * none to dn.exact="" attrs=namingContexts by * none to dn.base="" attrs=namingContexts val/distinguishedNameMatch="dc=mydomain,dc=com" by * none Can anyone help? Thanks

3 3

Q: "opjectClass: top" or not?
by Ulrich Windl 22 Nov '13

22 Nov '13

Hi! Sorry, this is a somewhat generic question: I wonder what difference it makes whether I specify "objectClass: top" for an object, or not: Conceptually, "top" is included automatically (so the objectClass attribute goes to any structural class), but when I fetch an object, I never see the "top" objectClass. Explicitly specifying "objectClass: top" makes every object a few bytes larger. So is there any reason to explicitly specify "objectClass: top"? Regards, Ulrich

3 2

fwd field
by arun.sasi1＠wipro.com 22 Nov '13

22 Nov '13

Hello Team, I have a mail server which is authenticating with OPenLDAP; when I set mail forwarding option I get the below error code LDAP Error Code - 17 - Undefined attribute type so I would like to know how to enable fwd filed and related field like out of office in OpenLDAP. which schema I should use in my openldap to enable it. I have below schema already enabled. include /ldap/etc/openldap/schema/corba.schema include /ldap/etc/openldap/schema/core.schema include /ldap/etc/openldap/schema/cosine.schema include /ldap/etc/openldap/schema/duaconf.schema include /ldap/etc/openldap/schema/dyngroup.schema include /ldap/etc/openldap/schema/inetorgperson.schema include /ldap/etc/openldap/schema/java.schema include /ldap/etc/openldap/schema/misc.schema include /ldap/etc/openldap/schema/nis.schema include /ldap/etc/openldap/schema/openldap.schema include /ldap/etc/openldap/schema/ppolicy.schema include /ldap/etc/openldap/schema/collective.schema include /ldap/etc/openldap/schema/samba.schema Thanks -Arun Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

3 5

Modify indexes on a delta-syncrepl consumer
by ML mail 21 Nov '13

21 Nov '13

Hello, I am using two OpenLDAP 2.4.31 servers with delta-syncrepl as replication method. So far everything works perfectly but I was wondering how I can modify cn=config settings on the consumer. For instance I would like to add new indexes (olcDbIndex) on the consumer to my replicated HDB database but this fails as you can see here: ldap_modify: Server is unwilling to perform (53) additional info: shadow context; no update referral I understand that it does not want me to modify any settings on my consumer but I was thinking this should be possible no? If not this means if I want to change a setting on the consumer I need to delete my whole database on the consumer configure it and add replication again. Any one has an idea what am I doing wrong here? Cheers, M.L.

3 6

openldap database replication and multiple hosts TLScertificates question
by lux-integ 21 Nov '13

21 Nov '13

Greetings, I am learning to configure/use openldap. I have a question regarding database replication I have a primary openldap server. I prepared/installed openssl certificates for the server -and he slapd.conf has these lines #--- Define SSL and TLS properties TLSCertificateFile /etc/certs/ldap1stServerCert.pem TLSCertificateKeyFile /etc/certs/ldap1stServerKey.pem TLSCACertificateFile /etc/certs/cacert.pem #---if client authentication is/isNOT required TLSVerifyClient demand I want to replicate the database over two other hosts. Call these 2ndServer and 3rdserver. Both of these computers ALSO have ssl certificates in /etc/certs like so:- #### in 2nd ldap host /etc/certs/ldap2ndServerCert.pem /etc/certs/ldap2ndServerKey.pem /etc/certs/cacert.pem #### in 3rd ldap host /etc/certs/ldap3rdServerCert.pem /etc/certs/ldap3rdServerKey.pem /etc/certs/cacert.pem As regards these certificates (the fact that they are not the same ) I would like to know what happens when I try to do replication.. I am following the guides 18.3.1.1. Syncrepl configuration ( http://www.openldap.org/doc/admin24/replication.html ) and 18.3.2. Delta-syncrepl ( also from http://www.openldap.org/doc/admin24/replication.html ) ( In otherwords is is best to remove the certificates and install after replication or whatever. ) Thanks in advance sincerely LuxInteg

2 1

SSL authentication to Active Directory via OpenLDAP client
by Ashwin Kumar 21 Nov '13

21 Nov '13

I have set up Active Directory to serve requests over SSL (ldaps://). Also, I have generated the certificate files on Windows 2008 server. (I have copied the self-signed certificate to test.cer) I have downloaded test.cer file to my linux machine to use it with Openldap client. The .cer file is present in /etc/openldap/certs directory and the content of ldap.conf file is TLS_CACERTDIR /etc/openldap/certs However, when I issue an ldapsearch on the Active Directory I end up with the following error: ldapsearch -x -H ldaps://192.168.1.84:636 -D CN=Administrator,CN=Users,DC=test,DC=ldap,DC=com -b CN=Administrator,CN=Users,DC=test,DC=ldap,DC=com -w Admin123 ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) My question: 1) Is this how I use my *.cer file? 2) How do I convert it to a proper file recognized by openldap clients? 3) What am I missing? (Very new to ldap and Active Directory) 4) Any useful resource or documentation to get ldaps working? Thanks. -- Ashwin kumar (http://ashwinkumar.me)

1 0

Error while updating olcDbConfig
by Daniel Jung 20 Nov '13

20 Nov '13

Hi wonderful ppl at openldap- Running 2.4.37 - on centos 6.4 using following ldif to update olcDbConfig dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcDbConfig olcDbConfig: set_lg_max 10485760 olcDbConfig: set_lg_regionmax 262144 olcDbConfig: set_lg_bsize 2097152 olcDbConfig: set_lg_dir /var/lib/ldap/ olcDbConfig: set_lk_max_locks 8192 olcDbConfig: set_lk_max_objects 8192 olcDbConfig: set_flags DB_LOG_AUTOREMOVE olcDbConfig: set_tas_spins 1 - ldapmodifyx -d 1 -h localhost -D 'cn=Manager,cn=config' -W -f /var/tmp/ldif Getting the following error res_errno: 80, res_error: <failed to reopen database, rc=22>, res_matched: <> ldap_free_request (origid 2, msgid 2) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (}) ber: ldap_msgfree ldap_err2string ldap_modify: Other (e.g., implementation specific) error (80) additional info: failed to reopen database, rc=22 Going through the list lead me to believe that changes will be applied after the restart? but didnt say it causes an error. Also does olcDbNoSync play a role here ? Can someone shed some light on this?

3 5

Re: Openldap for proxy AD
by Clément OUDOT 20 Nov '13

20 Nov '13

2013/11/20 Willy Ramos <wrm(a)cdtn.br>: > Em 20/11/2013 10:26, Clément OUDOT escreveu: > >> 2013/11/20 <wrm(a)cdtn.br>: >>> >>> Thank you. >>> >>> Yes, the credentials are stored in AD. >>> >>> I saw this documentation, >>> http://ltb-project.org/wiki/documentation/general/sasl_delegation >>> >>> Helped me very much, but I think there are some wrong in my >>> saslauth.conf, >>> because when I put the AD server and ldap_filter = (sAMAccountName=%u is >>> Ok Success SASL, " but when I put my localhost like this: >>> >>> ldap_servers: ldaps://127.0.0.1 #or ldap://localhost >>> #ldap_servers: ldaps://1.1.2.1 >>> ldap_version: 3 >>> ldap_auth_method: bind >>> ldap_search_base: cn=users,dc=foobar,dc=br >>> #ldap_filter: (sAMAccountname=%u) >>> #ldap_filter: (userPrincipalName=%u) >>> ldap_filter: uid=%u >>> ldap_bind_dn: cn=vmail,cn=users,dc=foobar,dc=br #or >>> cn=admin,dc=foobar >>> ldap_password: abc@123 >>> ldap_deref: never >>> ldap_restart: yes >>> ldap_scope: sub >>> ldap_use_sasl: no >>> ldap_start_tls: no >>> ldap_timeout: 10 >>> >>> >>> testsaslauthd -u usertst -p password >>> >>> NO "authentication failed" >>> >>> See the log: >>> >>> Nov 20 09:13:23 mail slapd[12776]: conn=1139 fd=18 ACCEPT from >>> IP=127.0.0.1:50194 (IP=0.0.0.0:636) >>> Nov 20 09:13:23 mail slapd[12776]: conn=1139 fd=18 TLS established >>> tls_ssf=256 ssf=256 >>> Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=0 BIND >>> dn="cn=vmail,cn=users,dc=foobar,dc=br" method=128 >>> Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=0 BIND >>> dn="cn=vmail,cn=users,dc=foobar,dc=br" mech=SIMPLE ssf=0 >>> Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=0 RESULT tag=97 err=0 >>> text= >>> Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=1 SRCH >>> base="cn=users,dc=foobar,dc=br" scope=2 deref=0 filter="(uid=usertst)" >>> Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=1 SRCH attr=dn >>> Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=1 SEARCH RESULT tag=101 >>> err=0 nentries=0 text= >>> >>> What can I do to fix this? >>> >> The log says that the entry is not found (nentries=0) either because >> it does not exist, either because you can't read it (ACL). >> >> But what are you using localhost behind your SASL pass trough? Seems >> like you are doing a loop on your LDAP server. >> >> >> Clément. >> > > That is a problem, because don´t found the base but when I´m using > ldapsearch my search is acepted, very strange. > > how this example: > ldapsearch -x -H ldaps://localhost -b dc=foobar,dc=com -D > cn=usertst,cn=users,dc=foobar,dc=com -w password > > I see all objects in database, when I do this command. > > If you had another idea please tell me, I just was seeing that link in the > ltb-project.org. where tell me to use in localhost SASL. > Seems you don't really understand how it works. OpenLDAP talks to saslauthd on localhost, then saslauthd talks to AD. So don't configure localhost in saslauthd, just set your AD settings in saslauthd.conf. Clément.

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical