openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Allow invalid certificates for a single host
by Jared 09 Oct '13

09 Oct '13

Hi, all. I'm having trouble figuring out how to allow SSL connections (using ldapsearch) to a single host with an invalid certificate. I know this can be done using TLS_REQCERT=allow (or never), but the same account also connects to multiple other hosts using certificate-based authentication, and the problem is that I can get those two configurations to work together. To illustrate, here's the current ~/.ldaprc file for this user: TLS_CERT /home/ldap/certs/admin.crt TLS_KEY /home/ldap/certs/admin.key TLS_REQCERT demand SASL_MECH external That works fine for everything but this one new host. I'm not able to fix the the SSL issue on this host, so for now I need to work around it. If I replace the above ~/.ldaprc with this: HOST server.domain.com PORT 636 TLS_REQCERT allow Then ldapsearch works fine for this new server, but, of course, SASL/cert auth fails for everything else. So, how do I get these to work together, with that first configuration example set as the default for all hosts *except* server.domain.com? Here's what I've tried so far: * Appending the configuration for server.domain.com to the existing ~/.ldaprc file - it doesn't have an effect, like the global stuff is overriding the host-specific options * Adding the server.domain.com config to /etc/openldap/ldap.conf, but ~/.ldaprc takes precedence over this, so again it has no effect. * Creating a separate ~/.ldaprc-server file and exporting LDAPRC=.ldaprc-server - in this case, both ~/.ldaprc AND ~/.ldaprc-server are sourced (found using strace), so again my host-specific settings are ignored. * exporting both LDAPNOINIT=true and LDAPRC=.ldaprc-server, but that prevents either rc file from being sourced * exporting LDAPNOINIT=true and calling ldapsearch with: LDAPTLS_REQCERT=allow ldapsearch -H ldaps://server.domain.com ... - this also seems to have no effect, though I'm sure I must be missing something simple, but I'm out of ideas at this point. Would appreciate any tips or pointers. Thanks! -- Jared

4 13

Modification hooks for the OpenLDAP system
by Mailing Lists 09 Oct '13

09 Oct '13

Hi, I was looking into OpenLDAP and couldn't find the following information in the documentation: Is there any possibility to have hooks in the openLDAP system which allow a customizable action to be performed when records are added/deleted/updated? An example for this would be to send a message to an external system in case a modification of the directory service has occured, so that this system can act on this (the 'external' system could, of course, belong to the same organization as well). E.g. for improving synchronization with GAE (but I could name some other uses for it too). I have found a prior post on hooks for authentication (http://www.openldap.org/lists/openldap-software/200510/msg00549.html) but this is not what I am looking for. If it is not supported in openLDAP, are there any plug-ins which do support it? Thanks in advance!

3 2

New release request
by Marco Pizzoli 09 Oct '13

09 Oct '13

Hi all, considered the importance of the patches which have landed in the last few days, could I ask to start with a testing call for a new release? I'm confident they could solve the crashes I have been facing since I started working heavily with back-mdb and I'm only allowed to work with "official" releases. Thanks in advance as usual Marco

2 1

Some things strange
by Jacques Foucry 09 Oct '13

09 Oct '13

Hello list, On a test VM I create a replica of my LDAP server, install pureFtp-ldap and configure it. It work perfectly. I can login on my vm, use ftp user too. But when I try to start ldap with the init script, it failed. I found that on the log file: > Oct 8 16:02:38 ldap-test slapd[3507]: @(#) $OpenLDAP: slapd (Apr 23 2013 12:16:04) $#012#011root@lupin:/tmp/buildd/openldap-2.4.31/debian/build/servers/slapd > Oct 8 16:02:38 ldap-test slapd[3507]: daemon: bind(10) failed errno=2 (No such file or directory) > Oct 8 16:02:38 ldap-test slapd[3507]: slapd stopped. > Oct 8 16:02:38 ldap-test slapd[3507]: connections_destroy: nothing to destroy. If I launch it on the cli: # slapd Everything work perfectly. I can figure what's wrong with the startup script. Is somebody could see what's wrong ? Thanks in advance, Jacques Foucry -- Jacques Foucry *NOVΛSPARKS * IT Manager Tel : +33 (0)1 42 68 12 61 jacques.foucry(a)novasparks.com

2 2

slapo-lastbind and chaining
by Christian Kratzer 08 Oct '13

08 Oct '13

Hi, it seems this has been asked before but I am not sure of the conclusion: http://www.openldap.org/lists/openldap-technical/201211/msg00078.html I have setup setup with slapo-lastbind configured on some slaves that have a working chaining configuration to the masters. It seems that the authTimestmap attribute from slapo-lastbind is not getting replicated. >From looking at the source code for lastbind it seems we would need to implement something similar to olcPPolicyForwardUpdates from ppolicy.c If none of the gurus here don't object the code looks clean enough that I would attempt to port forwarding of updates from slapo-ppolicy to slapo-lastbind. ( olcLastbindForwardUpdates ) Greetings Christian -- Christian Kratzer CK Software GmbH Email: ck(a)cksoft.de Wildberger Weg 24/2 Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart Web: http://www.cksoft.de/ Geschaeftsfuehrer: Christian Kratzer

4 6

Problem TLS
by felas 07 Oct '13

07 Oct '13

Hi i have installed OpenLdap in local, and i try to enabled the TLS Auth. I follow this guide https://help.ubuntu.com/12.04/serverguide/openldap-server.html#openldap-ser… but when i try to auth with my program(in Eclipse) i have this error: Unable to connect to server 192.168.1.156:636 (91) Connect Error java.net.ConnectException: Connection Refused

2 1

Migrating to new production servers via syncrepl
by samuli.seppanen＠gmail.com 07 Oct '13

07 Oct '13

Hi, I'm phasing out two OpenLDAP production servers[1] in a master-master configuration. The production servers can't afford more than a few mins of downtime, so migrating using slapcat/slapadd is out of the question. So, what I'm ending up doing is migrating using syncrepl. Here's the plan, with arrows pointing from the provider to the consumer: old1 <-> old2 -> new1 -> new2 Once the replicas on "new1" and "new2" are complete, I plan to 1) Direct all LDAP reads to "new1" 2) Direct all LDAP writes to "new1" (=make it briefly the only active LDAP server) 3) Change the replication config on "new1" so that it fetches changes from "new2" instead of "old2" 4) Restart slapd on new1 (it uses slapd.conf) to activate the change 4) Start offloading LDAP reads/writes to "new2" (e.g. using a loadbalancer) A couple of questions: . Does this plan makes sense in general? - Which caveats I should be aware of? - How can I ensure the replicas are complete and in the same state[1]? - Does switching the replication provider for "new1" from "old2" to "new2" cause any side-effects? Also, when is full reload of the replica[2] required/suggested? I've managed to end up with incomplete replicas on "old2" a couple of times even if I've wiped /var/lib/ldap and started replication from scratch. Any suggestions or pointers are most welcome! Also let me know if you need more info (configs, etc) and I'll provide it. Best regards, Samuli Seppänen --- [1] I've used these command so far: $ cd /var/lib/ldap $ db_stat -d <database-file> If the numbers (data items etc) match, can I be sure the replicas are identical? I've also checked the contextCSN on the using something like this: $ ldapsearch -H ldap://old2:389 -D "cn=admin,dc=domain,dc=com" -x -W -v -s base -b "dc=domain,dc=com" $ ldapsearch -H ldap://new1:389 -D "cn=admin,dc=domain,dc=com" -x -W -v -s base -b "dc=domain,dc=com" $ ldapsearch -H ldap://new2:389 -D "cn=admin,dc=domain,dc=com" -x -W -v -s base -b "dc=domain,dc=com" The output seems to be identical for "old2" and "new1", but "new2" differs, even though the database seems identical if checked with db_stat. I assume this is normal given the replication chaining (see above). [2] Starting slapd with the "-c rid=<rid>" switch should do this, correct?

4 5

Q: restrict access using "peername"
by Ulrich Windl 04 Oct '13

04 Oct '13

Hi! Can anybody present an example that uses "peername" with a hostname (not an IP address) to restrict access? I once tried and locked out clients I did not want to lock out. It seemed that the name match failed... slapd.access(5) seems to lack an example. Regards, Ulrich

2 1

Openldap server with TLS not working
by Axel Grosse 04 Oct '13

04 Oct '13

Hi I am new to OpenLDAP and have to configure and LDAP Proxy in one project. Thanks to the mailing lists I managed to setup and configure the Ldap Proxy an get it working one 389 . One of the next requirenents is to secure the outside connection with SSL. So I have to configure LDAP over SSL .. I am using openldap 2.3.43-12.el5 on Redhat EL 5.5 (Tikanga) I created the certificates with openssl 0.9.8e-12.el5_4.6 and configured the slapd.conf part of slapd.conf # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. TLSCACertificateFile /etc/openldap/ssl/VordelCA.crt TLSCertificateFile /etc/openldap/ssl/VordelDevInt.crt TLSCertificateKeyFile /etc/openldap/ssl/VordelDev.key TLSCipherSuite HIGH:MEDUIM:!SSLv2 TLSVerifyClient never ... ###### server got up on 636 but when I try to connect I get SSL handshake error ... when I test on the server itself .. openssl s_client -connect 192.168.30.169:389 -showcerts -CAfile ./ssl/VordelCA.crt CONNECTED(00000003) 710:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188: I got this one ... any idea whats my problem ? regards Axel

7 16

Log level will not change.
by espeake＠oreillyauto.com 04 Oct '13

04 Oct '13

Here is the contents of configlog.ldif dn: cn=config changetype: modify delete: olcLogLEvel - add: olcLogLevel olcLogLevel: 0 I run the following commend: ldapmodify -Wx -D "uid=admin,dc=oreillyauto,dc=com" -H ldap://tntest-ldap-1.oreillyauto.com -c -f /tmp/configlog.ldif the output shows: Enter LDAP Password: modifying entry "cn=config" Except the loglevel cn=config does not change. The modifyTimeStamp and entryCSN change to match the server. I have a 3 node MMR cluster on 2.4.31. I am working on a build to go to 2.4.36, but in the mean time I need to get this working. Thanks, Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

5 7

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical