openldap-technical

openldap-technical@openldap.org

3 participants
9990 discussions

"LDAP Injection" attacks
by Howard Chu 29 Dec '13

29 Dec '13

A paper and presentation making the rounds, claiming to show how webapps using LDAP are vulnerable to search filter spoofing attacks. http://www.youtube.com/watch?v=wtahzm_R8e4 http://www.blackhat.com/presentations/bh-europe-08/Alonso-Parada/Whitepaper… Can't imagine that work like this gets peer-reviewed, because it's mostly garbage. They concoct a scenario in section 4.1.1 of their paper, supposedly showing how filter manipulation can allow a webapp user to bypass LDAP-based authentication. It's ridiculous drivel though, since LDAP-based authentication uses Bind requests and not search filters. Most LDAP deployments don't even give search/compare access to userPassword attributes in the first place. Just in case anybody out there might be bitten by this info - client-enforced security is no security at all. This is why slapd has such an extensive ACL engine - you enforce access controls on the server, and then it doesn't matter what kind of garbage requests your clients send to you, they can only ever access information that they were allowed to access. This is also why the old pam_ldap authorization scheme was such a bad idea, it relied on the LDAP client (pam_ldap) to correctly implement authorization, instead of the server. (Multiply that by hundreds or thousands of clients and you have an unmanageable, insecurable mess.) This is why we have nssov today. Of course, this is no excuse to be sloppy when writing your web apps. But if you've configured ACLs to adequately protect your data, then it doesn't matter how sloppy your clients are. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

4 9

write access issue
by Umar Draz 28 Dec '13

28 Dec '13

Hi I am trying to rename the (dn) entry through a normal user which is first authenticate it self, but I there is an error while renaming the dn entry text=no write access to old parent's children here is my slapd.conf access settings. # Sample access control policy: access to attrs=userPassword,shadowLastChange by self write by dn="cn=admin,dc=mydomain,dc=com" write by * auth access to * by self write by dn="cn=admin,dc=mydom,dc=com" write by * read Would you please help, what I need to set? Br. Umar

3 4

Oracle OpenLDAP PPolicy ppolicy and the hierarchy
by David Barr 28 Dec '13

28 Dec '13

In Use: Oracle OpenLDAP 2.4.30, I cannot change to the OpenLDAP version that one can compile. Problem: I have the module and overlay in the conf files and slaptest says it's fine. Both files are from Openldap.org version 2.4.37But how do I test it? I have created unix shell scripts to do actions like add, delete, modify, view, etc. I can share these if requested. But I am unsure on the lock, unlock, policy stuff. Also, How should the OpenLDAP hierarchy look? Here's mine: dn: dc=bozo_company,dc=com ou: com objectClass: dcObject objectClass: organizationalUnit objectClass: top dc: bozo_company userPassword: {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX dn: cn=Directory Administrators,dc=bozo_company,dc=com objectClass: top objectClass: groupOfUniqueNames cn: Directory Administrators uniqueMember: cn=clownadmin,ou=Special Users,dc=bozo_company,dc=com uniqueMember: cn=david.barr,ou=People,dc=bozo_company,dc=com dn: ou=Groups,dc=bozo_company,dc=com objectClass: top objectClass: organizationalUnit ou: Groups dn: ou=People,dc=bozo_company,dc=com objectClass: top objectClass: organizationalUnit ou: People dn: ou=Special Users,dc=bozo_company,dc=com objectClass: top objectClass: organizationalUnit ou: Special Users description: Special Administrative Accounts dn: cn=Accounting Managers,ou=groups,dc=bozo_company,dc=com objectClass: top objectClass: groupOfUniqueNames cn: Accounting Managers ou: groups description: People who can manage accounting entries uniqueMember: cn=clownadmin,ou=Special Users,dc=bozo_company,dc=com uniqueMember: uid=Replica,ou=People,dc=bozo_company,dc=com uniqueMember: cn=david.barr,ou=People,dc=bozo_company,dc=com dn: cn=HR Managers,ou=groups,dc=bozo_company,dc=com objectClass: top objectClass: groupOfUniqueNames cn: HR Managers ou: groups description: People who can manage HR entries uniqueMember: cn=clownadmin,ou=Special Users,dc=bozo_company,dc=com uniqueMember: cn=david.barr,ou=People,dc=bozo_company,dc=com dn: cn=QA Managers,ou=groups,dc=bozo_company,dc=com objectClass: top objectClass: groupOfUniqueNames cn: QA Managers ou: groups description: People who can manage QA entries uniqueMember: cn=clownadmin,ou=Special Users,dc=bozo_company,dc=com uniqueMember: cn=david.barr,ou=People,dc=bozo_company,dc=com dn: cn=PD Managers,ou=groups,dc=bozo_company,dc=com objectClass: top objectClass: groupOfUniqueNames cn: PD Managers ou: groups description: People who can manage engineer entries uniqueMember: cn=clownadmin,ou=Special Users,dc=bozo_company,dc=com uniqueMember: cn=david.barr,ou=People,dc=bozo_company,dc=com dn: ou=Services,dc=bozo_company,dc=com ou: Services objectClass: top objectClass: organizationalUnit dn: ou=DML,ou=Services,dc=bozo_company,dc=com ou: DML objectClass: top objectClass: organizationalUnit dn: ou=1.0,ou=DML,ou=Services,dc=bozo_company,dc=com ou: 1.0 objectClass: top objectClass: organizationalUnit dn: ou=UserForm,ou=1.0,ou=DML,ou=Services,dc=bozo_company,dc=com ou: UserForm objectClass: top objectClass: organizationalUnit dn: ou=Configuration,ou=1.0,ou=DML,ou=Services,dc=bozo_company,dc=com ou: Configuration objectClass: top objectClass: organizationalUnit dn: cn=Configuration:#ID#Configuration:SystemConfiguration,ou=Configuration,ou=1 .0,ou=DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: Configuration:#ID#Configuration:SystemConfiguration dn: cn=Configuration:#ID#Configuration:CustomRoles,ou=Configuration,ou=1.0,ou=DM L,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: Configuration:#ID#Configuration:CustomRoles dn: cn=Configuration:#ID#Configuration:DmlManagedDirectory,ou=Configuration,ou=1 .0,ou=DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: Configuration:#ID#Configuration:DmlManagedDirectory dn: cn=UserForm:#ID#UserForm:DefaultUserForm,ou=UserForm,ou=1.0,ou=DML,ou=Servic es,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultUserForm dn: cn=UserForm:#ID#UserForm:DefaultNtUserForm,ou=UserForm,ou=1.0,ou=DML,ou=Serv ices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultNtUserForm dn: cn=UserForm:#ID#UserForm:DefaultHomeForm,ou=UserForm,ou=1.0,ou=DML,ou=Servic es,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultHomeForm dn: cn=UserForm:#ID#UserForm:DefaultDMLObjectForm,ou=UserForm,ou=1.0,ou=DML,ou=S ervices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultDMLObjectForm dn: cn=UserForm:#ID#UserForm:DefaultCreateForm,ou=UserForm,ou=1.0,ou=DML,ou=Serv ices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultCreateForm dn: cn=UserForm:#ID#UserForm:DefaultObjectClassSelectionForm,ou=UserForm,ou=1.0, ou=DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultObjectClassSelectionForm dn: cn=UserForm:#ID#UserForm:DefaultDisplayComponentFields,ou=UserForm,ou=1.0,ou =DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultDisplayComponentFields dn: cn=UserForm:#ID#UserForm:DefaultEditFieldForm,ou=UserForm,ou=1.0,ou=DML,ou=S ervices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultEditFieldForm dn: cn=UserForm:#ID#UserForm:DefaultListFormsForm,ou=UserForm,ou=1.0,ou=DML,ou=S ervices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultListFormsForm dn: cn=UserForm:#ID#UserForm:DefaultEditFormForm,ou=UserForm,ou=1.0,ou=DML,ou=Se rvices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultEditFormForm dn: cn=UserForm:#ID#UserForm:DefaultGroupForm,ou=UserForm,ou=1.0,ou=DML,ou=Servi ces,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultGroupForm dn: cn=UserForm:#ID#UserForm:DefaultFindLibrary,ou=UserForm,ou=1.0,ou=DML,ou=Ser vices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultFindLibrary dn: cn=UserForm:#ID#UserForm:DefaultGroupFilterForm,ou=UserForm,ou=1.0,ou=DML,ou =Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultGroupFilterForm dn: cn=UserForm:#ID#UserForm:DefaultOuForm,ou=UserForm,ou=1.0,ou=DML,ou=Services ,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultOuForm dn: cn=UserForm:#ID#UserForm:DefaultDomainForm,ou=UserForm,ou=1.0,ou=DML,ou=Serv ices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultDomainForm dn: cn=UserForm:#ID#UserForm:DefaultLocalityForm,ou=UserForm,ou=1.0,ou=DML,ou=Se rvices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultLocalityForm dn: cn=UserForm:#ID#UserForm:DefaultFindForm,ou=UserForm,ou=1.0,ou=DML,ou=Servic es,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultFindForm dn: cn=UserForm:#ID#UserForm:DefaultSearchConfigForm,ou=UserForm,ou=1.0,ou=DML,o u=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultSearchConfigForm dn: cn=Configuration:#ID#Configuration:DefaultSearchOptions,ou=Configuration,ou= 1.0,ou=DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: Configuration:#ID#Configuration:DefaultSearchOptions dn: cn=UserForm:#ID#UserForm:DefaultCOSTemplateForm,ou=UserForm,ou=1.0,ou=DML,ou =Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultCOSTemplateForm dn: cn=UserForm:#ID#UserForm:DefaultExtensionsEditForm,ou=UserForm,ou=1.0,ou=DML ,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultExtensionsEditForm dn: cn=UserForm:#ID#UserForm:DefaultManagedDirectoryForm,ou=UserForm,ou=1.0,ou=D ML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultManagedDirectoryForm dn: cn=UserForm:#ID#UserForm:DefaultOrganizationPickerForm,ou=UserForm,ou=1.0,ou =DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultOrganizationPickerForm dn: cn=UserForm:#ID#UserForm:DefaultListNamingAttributesForm,ou=UserForm,ou=1.0, ou=DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultListNamingAttributesForm dn: cn=UserForm:#ID#UserForm:DefaultNamingAttributeForm,ou=UserForm,ou=1.0,ou=DM L,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultNamingAttributeForm dn: cn=UserForm:#ID#UserForm:DefaultRolesForm,ou=UserForm,ou=1.0,ou=DML,ou=Servi ces,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultRolesForm dn: cn=UserForm:#ID#UserForm:DefaultRoleForm,ou=UserForm,ou=1.0,ou=DML,ou=Servic es,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultRoleForm dn: cn=UserForm:#ID#UserForm:DefaultDeleteForm,ou=UserForm,ou=1.0,ou=DML,ou=Serv ices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultDeleteForm dn: cn=UserForm:#ID#UserForm:DefaultDeleteGeneralPurposeForm,ou=UserForm,ou=1.0, ou=DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultDeleteGeneralPurposeForm dn: cn=UserForm:#ID#UserForm:DefaultEnableForm,ou=UserForm,ou=1.0,ou=DML,ou=Serv ices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultEnableForm dn: cn=UserForm:#ID#UserForm:DefaultDisableForm,ou=UserForm,ou=1.0,ou=DML,ou=Ser vices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultDisableForm dn: cn=UserForm:#ID#UserForm:DefaultRenameForm,ou=UserForm,ou=1.0,ou=DML,ou=Serv ices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultRenameForm dn: cn=UserForm:#ID#UserForm:DefaultConfigBackupRestoreForm,ou=UserForm,ou=1.0,o u=DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultConfigBackupRestoreForm dn: cn=UserForm:#ID#UserForm:DefaultBrowseForm,ou=UserForm,ou=1.0,ou=DML,ou=Serv ices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultBrowseForm dn: cn=Configuration:#ID#Configuration:ComponentProperties,ou=Configuration,ou=1 .0,ou=DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: Configuration:#ID#Configuration:ComponentProperties dn: cn=Configuration:#ID#Configuration:DefaultFormConfiguration,ou=Configuration ,ou=1.0,ou=DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: Configuration:#ID#Configuration:DefaultFormConfiguration dn: cn=Configuration:#ID#Configuration:DefaultRoles,ou=Configuration,ou=1.0,ou=D ML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: Configuration:#ID#Configuration:DefaultRoles dn: cn=Configuration:#ID#Configuration:DefaultCapabilities,ou=Configuration,ou=1 .0,ou=DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: Configuration:#ID#Configuration:DefaultCapabilities dn: cn=Configuration:#ID#Configuration:DefaultNamingAttributesConfiguration,ou=C onfiguration,ou=1.0,ou=DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: Configuration:#ID#Configuration:DefaultNamingAttributesConfiguration dn: cn=UserForm:#ID#UserForm:DefaultEditPasswordForm,ou=UserForm,ou=1.0,ou=DML,o u=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultEditPasswordForm dn: cn=Configuration:#ID#Configuration:WPSearchOptions,ou=Configuration,ou=1.0,o u=DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: Configuration:#ID#Configuration:WPSearchOptions dn: cn=UserForm:#ID#UserForm:WPSearchLibrary,ou=UserForm,ou=1.0,ou=DML,ou=Servic es,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:WPSearchLibrary dn: cn=UserForm:#ID#UserForm:WPSearchForm,ou=UserForm,ou=1.0,ou=DML,ou=Services, dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:WPSearchForm dn: cn=UserForm:#ID#UserForm:WPViewForm,ou=UserForm,ou=1.0,ou=DML,ou=Services,dc =bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:WPViewForm dn: cn=clownadmin,ou=Special Users,dc=bozo_company,dc=com sn: clownadmin ou: People ou: Special Users cn: clownadmin objectClass: top objectClass: person objectClass: organizationalPerson userPassword: {SHA}ZC/bQou6tU8wl3TJ6dCoSasxgVA= dn: uid=Replica,ou=People,dc=bozo_company,dc=com uid: Replica cn: Replica objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {SSHA}xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx shadowLastChange: 13761 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 22222 gidNumber: 100 homeDirectory: /tmp gecos: Replica userid for slave LDAP servers dn: cn=david.m.barr,ou=People,dc=bozo_company,dc=com uid: david.m.barr sn: david.m.barr ou: People cn: david.m.barr objectClass: top objectClass: person objectClass: organizationalPerson objectClass: uidObject objectClass: pwdPolicyChecker objectClass: pwdPolicy pwdCheckModule:: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX pwdAttribute: userPassword userPassword: {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX dn: cn=Test.user02,ou=People,dc=bozo_company,dc=com uid: Test.user02 sn: Test.user02 ou: People cn: Test.user02 objectClass: top objectClass: person objectClass: organizationalPerson objectClass: uidObject objectClass: pwdPolicyChecker objectClass: pwdPolicy pwdCheckModule:: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX pwdAttribute: userPassword pwdLockout: TRUE userPassword: {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX dn: cn=Test.user04,ou=People,dc=bozo_company,dc=com uid: Test.user04 sn: Test.user04 ou: People cn: Test.user04 objectClass: top objectClass: person objectClass: organizationalPerson objectClass: uidObject userPassword: {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX dn: ou=Policies,dc=bozo_company,dc=com objectClass: top objectClass: organizationalUnit ou: Policies dn: cn=Password Policy,ou=Policies,dc=bozo_company,dc=com objectClass: top objectClass: pwdPolicy objectClass: person description: The default password policy pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 2 pwdExpireWarning: 3600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 5 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 0 pwdMaxAge: 5184000 pwdMaxFailure: 5 pwdMinAge: 3600 pwdMinLength: 5 pwdMustChange: TRUE pwdSafeModify: FALSE sn: Password Policy cn: Password Policy dn: ou=Standard Policy,ou=Policies,dc=bozo_company,dc=com objectClass: top objectClass: organizationalUnit objectClass: pwdPolicy objectClass: pwdPolicyChecker ou: Standard Policy pwdAttribute: userPassword pwdCheckQuality: 2 pwdMaxFailure: 3 pwdMustChange: TRUE pwdSafeModify: TRUE pwdLockoutDuration: 0 pwdCheckModule: ou=Standard Policy,ou=Policies,dc=bozo_company,dc=com pwdAllowUserChange: TRUE description: Standard Password Policy pwdMaxAge: 7776002 pwdExpireWarning: 432000 pwdFailureCountInterval: 120 pwdMinLength: 14 pwdInHistory: 10 pwdGraceAuthNLimit: 0 pwdMinAge: 86400 dn: cn=accesslogname,dc=bozo_company,dc=com objectClass: top objectClass: person objectClass: organizationalPerson ou: accesslogname description: accesslog sn: accesslogname cn: accesslogname dn: cn=john.d.doe,ou=People,dc=bozo_company,dc=com uid: john.d.doe sn: john.d.doe ou: People cn: john.d.doe objectClass: top objectClass: person objectClass: organizationalPerson objectClass: uidObject userPassword: {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Anyone out there who can help? -David dbc(a)usa.net ________________________________ CONFIDENTIALITY NOTICE: The information contained in this electronic mail (email) transmission (including attachments), is intended by MCLANE ADVANCED TECHNOLOGIES for the use of the named individual or entity to which it is addressed and may contain information that is privileged, confidential and/or protected as a trade secret. It is not intended for transmission to, or receipt by, any individual or entity other than the named addressee(s). If you have received this email in error, please delete it (including attachments) and any copies thereof without printing, copying or forwarding it, and notify the sender of the error by email reply immediately.

8 17

recursion in olcLimits
by Mundry, Marvin 27 Dec '13

27 Dec '13

Hi, is there a way in openldap to define limits (search result size limits) for the members of a group and the members of sub groups of that group recursively (i.e. something like the setspec syntax for acls)? for acls the recursion could be done via: access to dn.subtree="ou=branch1,dc=organization,dc=com" by set="[cn=chiefcommanders,ou=groups,dc=organization,dc=com]/member* & user" manage the "group[/oc[/at]]=<pattern>" form what I understand does not allow to recursively resolve members of sub groups. Thanks, Marvin

1 0

MMR config question - serverID without URL and CSN too old, ignoring in the log
by Daniel Jung 26 Dec '13

26 Dec '13

Set up 4 way MMR setup with 2.4.37, centos 6. Reading the doc[0] indicates that adding the URL is an optional and is used to avoid future serverID collision and using the number alone does work without any issue. Based on that information, i created 3 MMR setup with each provider with unique serverids and unique rid within each sever pointing to other providers. I have seen examples where each provider has multiple serverIDs (all providers), as the doc indicates, this is possible only if URL option is specified. Since i didnt use the URL, i only configured single serverID per the provider in the global cn=config. I had tested cn=config with 2 MMR and i didnt see the CSN too old, ignoring message in the log. But, when i set it up to be 3 way MMR, i am seeing this msg with new sync where other provider sends do_synrepl2 to the original provider and hence CSN too old, ignoring is logged. I searched the mailing list and some of the reputable members here have mentioned it is due to wrong MMR serverID setup. Could you point out if serverid without URL may be the culprit to this problem? I see no other issues other than this, replication to other consumers work fine and data are in synced. my setup serverID and rid setup. serverID 1 rid 000 for replicating from serverID 2 rid 001 for replication from serverID 3 serverID 2 rid 000 for serverID 1 rid 001 for serverID 3 serverID 3 rid 000 for serverID 1 rid 001 for serverID 2 Thank you [0] http://www.zytrax.com/books/ldap/ch6/#serverid

1 1

How to sync UID/GID?
by Peng Yu 26 Dec '13

26 Dec '13

Hi, I'm able to create an OpenLDAP server. I can use ldapsearch to query the server. https://help.ubuntu.com/12.10/serverguide/openldap-server.html http://serverfault.com/questions/19323/is-it-feasible-to-have-home-folder-h… I see on the above URL that OpenLDAP can be used to sync UID/GID. But it is not clear to how to do it. Could anybody point me some directions? Thanks. "... as you have to keep the UID and GIDs in sync - use something like OpenLDAP ..." -- Regards, Peng

2 1

missing libldif.so library ?
by Daniel Jung 26 Dec '13

26 Dec '13

Hi, I can't seem to find this lib anymore after upgrading to 2.4.37. Is this lib not being built anymore? Thanks

3 3

LDAP Proxy
by Keith Hamburg 24 Dec '13

24 Dec '13

I'm trying to configure a third party product to obtain the list of valid users based on a group membership in a corporate active directory server. The third party product is not capable of querying for users based on group membership. It can only use an OU or objectClass. The corporate AD server has a very broad "All Users" OU and we can't add an OU or objectClass to AD . I would like to configure an OpenLDAP proxy using that can dynamically create an OU by querying the members of a group. Is this possible using overlays? Another possibility is that try to synchronize OpenLDAP with AD based on a filter that includes membership in only one group. Would either of these methods work or is there another solution I haven't mentioned? Thanks, Keith

1 0

MDB_BAD_RSLOT while executing slapacl
by Igor Zinovik 24 Dec '13

24 Dec '13

Hello. Today I run slapacl to test access rights and saw this: ldap3# sudo slapacl -F /etc/openldap/slapd.d/ ... ... 52a8ae51 mdb_opinfo_get: err MDB_BAD_RSLOT: Invalid reuse of reader locktable slot(-30783) read access to o: ALLOWED At http://symas.com/mdb/doc/group__errors.html#ga1b6cbb28da30e28c48c9df66dd398… I read explanation that this error means: Txn has too many dirty pages. slapd 2.4.36 with Linux kernel 3.7.10 x86_64. In my slapd I have single database with mdb backend: dn: olcDatabase={1}mdb,config ... olcDbNoSync: FALSE olcDbMaxSize: 1073741824 olcDbMode: 0600 olcDbSearchStack: 16 Two questions: 0. What might cause this error? 1. Should I worry about this?

2 8

How to configure LDAP for sync passwd and group between ubuntu machines?
by Peng Yu 24 Dec '13

24 Dec '13

Hi, I'm trying to find a succinct description on how to use LDAP for sync passwd and group between ubuntu machines. I only find some general information on LDAP but not specific for sync passwd and group. Could anybody point me some simple instructions on how to do so? Thanks. -- Regards, Peng

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical