openldap-technical

openldap-technical@openldap.org

9897 discussions

invalid syntax (21) error while importing password password policy
by Philip Bubel 17 Sep '13

17 Sep '13

Running OpenLdap 2.4.23 on Centos 6.4 and we are having truoble enabling password polices. I've read a number of FAQ's online, plus spent hours searching for a solution to this problem, although a lot of folks seem to have the same issue I haven't been able to find a solution that works for us. I run into trouble running ldapadd to import the new policy. I end up with the invalid syntax error I've included below, along with a copy of the .ldif file and my slapd.conf file. I was able to create the policies OU without issue, I also tried using the OID for pwdAttribute instead of userPassword. [root@asu10d schema]# ldapadd -D "cn=Manager,dc=XXXX,dc=test" -W -x -f /tmp/ppolicy.ldif Enter LDAP Password: adding new entry "cn=policy,ou=policies,dc=XXXX,dc=test" ldap_add: Invalid syntax (21) additional info: pwdAttribute: value #0 invalid per syntax Contents of policy.ldif n: cn=policy,ou=policies,dc=XXXX,dc=test cn: default objectClass: pwdPolicy objectClass: person objectClass: top pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 2 pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 5 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 0 pwdMaxAge: 0 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 5 pwdMustChange: FALSE pwdSafeModify: FALSE sn: dummy value Contents of my slapd.conf include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema include /etc/openldap/schema/samba.schema include /etc/openldap/schema/pmi.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/lib64/openldap moduleload ppolicy.la TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt TLSCertificateFile /etc/pki/tls/certs/slapd.pem TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem database config access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.exact="cn=Manager,dc=XXXX,dc=test" read by * none database bdb suffix "dc=XXXXX,dc=test" checkpoint 1024 15 rootdn "cn=Manager,dc=XXXX,dc=test" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw hello (Temp password used for testing) overlay ppolicy policy_default "cn=default,ou=policies,dc=XXXX,dc=test" policy_use_lockout directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub

6 21

RE: invalid syntax (21) error while importing password password policy
by Quanah Gibson-Mount 17 Sep '13

17 Sep '13

--On Tuesday, September 17, 2013 8:28 PM +0000 Sebastian Bianchi <Sebastian.Bianchi(a)zaisgroup.com> wrote: > Can anyone tell me how to get off this list? I can tell you a second time to stop hijacking threads. Read the email I sent you earlier about how to get removed. --Quanah -- Quanah Gibson-Mount Lead Engineer Zimbra Software, LLC -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Multi-master setup in debian
by Listas de Correo 17 Sep '13

17 Sep '13

Hi, I've "inherited" from a former sysadmin (among many other things) an LDAP server to administer :) ... it's installed on Debian 6.0; it's currently working ok but the company has another remote site now and wants to have a secondary LDAP server on the new location (in order to support the new remote users). Looking into the documentation I think the best configuration option is a N-way multi-master replication setup; unfortunately, I don't have experience with LDAP so I found difficult to implement this; I've found some good tutorials on the web but they're written for other versions of LDAP (for example, they use slapd.conf but on Debian, the configuration is in several directories under /etc/ldap/slapd.d). My big question is: ¿do you know of any resource (url link, book, whatever) that I can use as a reference to make this configuration? (in particular, I'd be more than happy if provides some examples in Debian). Of course, I'm willing to do my own work (study, research, etc) but I need some guidance regarding where to start (assume I have little LDAP knowledge). Thanks in advance for any help, tip, etc you may have!

7 9

Fwd: [GENERAL] Using LDAP for PostgreSQL permissions/authentication
by Stephan Fabel 17 Sep '13

17 Sep '13

Found on the Postgres mailing list... seems like some folks like to do user provisioning with config management tools rather than LDAP. I don't agree with the guy, but he does point out one issue that I find interesting, which is the absense of a "history" of sorts. Are you guys thinking of some sort of "snapshotting" / COW feature? Would something like that even make sense? -Stephan ---------- Forwarded message ---------- From: Stephen Frost Date: Fri, Sep 13, 2013 at 10:29 AM Subject: Re: [GENERAL] Using LDAP for PostgreSQL permissions/authentication Cc: pgsql-general(a)postgresql.org * Bill Moran wrote: > As documented, LDAP solves a few of the problems we have -- since everyone > will be in LDAP, we can use LDAP's password complexity rules and password > expiration to handle those security requirements, and (of course) when > someone changes their password, they don't have to remember to change it > on every server ... these are big wins. Better is to use Kerberos, imv. It's what AD does. > But it doesn't help with the headache of creating the accounts on all the > servers, or dropping them as part of employee termination procedures, or > doing security audits, or changing permissions on multiple servers when > an employee gets a promotion, etc. Nope; I'd use puppet or chef or something along those lines to deal with this aspect, much as I'd do with Unix accounts. Using nsswitch and tying every user name look up to LDAP has certain.. drawbacks. > Thus, when I go to log in as wmoran, LDAP checks my password, then informs > PostgreSQL to allow me in with specified roles, and I can do operations > granted to those roles. That's a little over-simplistic, isn't it? What about objects which are created by the 'wmoran' account? > Obviously, that's not how it works now ... my question is why not? Is it just > a matter of nobody's gotten to it yet, or are there issues that make such > an implementation difficult/troublesome/impossible? If it's possible, does > anyone have any concept of how hard it would be to implement? My gut feeling on this is 'pretty darn hard' and 'not sure there are many who really want it'. That last particularly because tools like puppet and chef exist and solve this problem in a better way, imv anyway, than LDAP. Back in the day, I was a big proponent of LDAPv3 and all of the nice things it did, but the complexities involved in "what happens when the network goes away" grew tiring and managing accounts through a config management system which also tracks history of changes, both to the master repo and to the individual systems, wins hands down. Thanks, Stephen ----------------------------------------

3 2

RE: unsubscribe
by Quanah Gibson-Mount 17 Sep '13

17 Sep '13

--On Tuesday, September 17, 2013 4:04 PM +0000 Sebastian Bianchi <Sebastian.Bianchi(a)zaisgroup.com> wrote: > How can I unsubscribe from this list? It is going to > Ryan.Palamara(a)zaisgroup.com and he is no longer with the company. This first thing you should never do is hijack a thread. You can read over <http://www.openldap.org/lists/> for information about the lists. Which, for example, can take you to <http://www.openldap.org/lists/mm/listinfo/openldap-technical> and then you can get the information on how to contact the moderator if you can't force unsubscribe your old employee. --Quanah -- Quanah Gibson-Mount Lead Engineer Zimbra Software, LLC -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

openldap mods check attributetype undefined
by Chandrashekar Kola 16 Sep '13

16 Sep '13

Hello All, We have a openldap 2 nodes running on mirrormode set up. We recently added a new attributetype, after that we are seeing this message on slave node. And i can see the Attributype from ApacheDirectory studio on Masternode but not on slave node. syncrepl_message_to_entry: rid=001 mods check (userid: attribute type undefined) Both the nodes have the same schema file and both are running on openldap 2.4 version. Does anybody get into this issue. *Thanks, * *Chandu *

2 1

Re: ldap replication getting lost
by Ashok Kumar Shah 16 Sep '13

16 Sep '13

Thanks. yup i will upgrade to the latest stable. ~Ashok On Mon, Sep 16, 2013 at 9:48 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Saturday, September 14, 2013 2:00 PM +0530 Ashok Kumar Shah < > ashok.shah(a)flipkart.com> wrote: > > Openldap Version: 2.4.23 >> > > Your issue was known fixed in a later release. I would suggest, as I > repeatedly do, that you use a current build. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Lead Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

ldap replication getting lost
by val john 16 Sep '13

16 Sep '13

Hi guys im running simple ldap replication setup , ldap slave node sites behind the firewall and port 389 is open to all and my ldap replication works fine for most of the time , (slave node getting updated real time ) But some times slave just stop getting the update from the master server , But when is restart slave ldap server replication start again , .... as fallows Aug 21 11:59:24 ldapmirror slapd[18107]: do_syncrep2: rid=004 cookie=rid=004,sid=002,csn=20130821160107.813479Z#000000#002#000000 Aug 21 11:59:24 ldapmirror slapd[18107]: syncrepl_entry: rid=004 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) Aug 21 11:59:24 ldapmirror slapd[18107]: <= bdb_equality_candidates: (entryUUID) not indexed Aug 21 11:59:25 ldapmirror slapd[18107]: syncrepl_entry: rid=004 be_search (0) Aug 21 11:59:25 ldapmirror slapd[18107]: syncrepl_entry: rid=004 uid=user1,ou=staff,dc=example,dc=com Aug 21 11:59:25 ldapmirror slapd[18107]: slap_queue_csn: queing 0xcc1060 20130821160107.813479Z#000000#002#000000 Aug 21 11:59:25 ldapmirror slapd[18107]: slap_graduate_commit_csn: removing 0xcc0a40 20130821160107.813479Z#000000#002#000000 Aug 21 11:59:25 ldapmirror slapd[18107]: syncrepl_entry: rid=004 be_modify uid=user1,ou=staff,dc=example,dc=com (0) Aug 21 11:59:25 ldapmirror slapd[18107]: slap_queue_csn: queing 0xcc1060 20130821160107.813479Z#000000#002#000000 Aug 21 11:59:25 ldapmirror slapd[18107]: slap_graduate_commit_csn: removing 0x1a55a70 20130821160107.813479Z#000000#002#000000 Ldap slave configuration .. syncrepl rid=004 provider=ldap://ldap.example.com bindmethod=simple binddn="cn=admin,ou=staff,dc=example,dc=com" credentials="passwd" searchbase="dc=example,dc=com" schemachecking=off type=refreshAndPersist retry="60 +" mirrormode on Is there any reason for such behavior , Please advice Thank You John

5 5

Attributes rewriting
by Vitaliy Aleksandrov 16 Sep '13

16 Sep '13

Hello, List I've been trying to find a working example to understand how slapo-rwm, slapd-meta and slapd-relay work for the last 3 days with no success. I just need to substitute one attribute by another for a single LDAP user. Lets say I have a posixAccount Object with cn = user1 as shown below. dn: uid=user1,ou=People,dc=localnet uid: user1 cn: user1 objectClass: account objectClass: posixAccount objectClass: shadowAccount ..... Also I have two LDAP users (organizationalRole): admin. simpleuser. I want to configure openldap in a way which allows "simpleuser" to make queries using "(description=user1)" instead of ("cn=user1") to find previously mentioned user object. The only thing I was able to configure is the suffixmassage, but can't find a way how to add rwm-map to my configuration. Could somebody point me to the working example.

1 1

slapd.conf deprecate as of 2.5?
by Daniel Jung 15 Sep '13

15 Sep '13

Hi, Quick search through the list shows that slapd.conf will not be supported as of 2.5? Is this still the case? When can we expect 2.5 minor release? Thanks for your answer in advance.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical