openldap-technical

openldap-technical@openldap.org

3 participants
9990 discussions

OpenLDAP with ssl client certs
by Brent Bice 05 Nov '13

05 Nov '13

I was recently asked if we could use ssl client certs as a 2nd form of authentication with OpenLDAP and didn't know for sure. Is it possible to have OpenLDAP require both a DN/password pair *and* a client ssl cert? Just to see if I could make any form of client cert authentication work, I took a test-bed instance of OpenLDAP and added this line to slapd.conf: TLSVerifyClient allow Then I created a self-signed ssl cert, converted it to a .der binary file, then added it to an LDAP record's userCertificate attribute with this: dn: <my-dn> changetype: modify add: userCertificate;binary userCertificate;binary:< file:///tmp/ldapclient.bin Then I found my ldap client of choice doesn't seem to have an option to authenticate via client certs, and didn't see any command line options for ldapsearch for specifying a client ssl cert/key pair. So I edited ~/.ldaprc and added: BINDDN <my-dn> TLS_REQCERT demand TLS_CERT /tmp/ldapclient.crt TLS_KEY /tmp/ldapclient.key But when I run ldapsearch -x with no -D and -W options, it's clearly still just binding anonymously. When I run ldapsearch -x with a -D and no -W option it says I can't bind without a password. :-) So... I'm clearly missing something here. How do I get ldapsearch to try to authenticate with the SSL cert? Or is it possibly trying but failing because slapd can't validate the self-signed client cert I made? It's definitely finding and using my .ldaprc file because I can change BASE, PORT, and HOST settings in there and don't have to specify 'em on the command line afterwards, but as near as I can tell it's not using the client cert. Brent

5 12

ldap users shows up in user list, but unable to login
by slacker lnx 04 Nov '13

04 Nov '13

Hi I am using LDAP for authenticating users. I have some Fedora 8 servers which are setup as ldap clients. When I create users in LDAP it shows up on all clients. I can do an 'ldapsearch' or 'getent passwd' and all the clients shows up the ldap users. But on one of the client, I am unable to login (through ssh) using the ldap userids. When I login as root and try to switch user I get a message 'user does not exist' (getent passwd and ldapsearch shows the user). On all other clients it works fine. I compared the config files in /etc/pam.d/ and /etc/nsswitch.conf but I don't see any difference. What else can I check, which other config files do I need to look at? I had followed the same steps while configuring all ldap clients. Please help Thanks

3 4

Mixing multi-master and master-slave replication
by Robert Minsk 04 Nov '13

04 Nov '13

As a factility we have locations world wide. Within each facility we would like to use multi-master replication. We would also like to sync each facility to a glued set of databases on the global servers with simple master slave replication. See ASCII art diagram below. If every OpenLDAP server across all our locations has a unique "serverID" will the global master-slave replication play nice with the facility multi-master replication? -------- -------- -------- -------- | la01 |<-- multi-master --> | la02 | | ny01 |<-- multi-master -->| ny02 | -------- -------- -------- -------- | | -- master-slave -- -- master-slave -- | | v v ------------ | global01 | ------------ -- Robert Minsk Systems and Software Engineer WWW.METHODSTUDIOS.COM <http://www.methodstudios.com> 730 Arizona Ave, Santa Monica, CA 90401 O:+1 310 434 6500 <tel:+13104346500> // F:+1 310 434 6501 <tel:+13104346501> Los Angeles <http://www.methodstudios.com/signature/url/los-angeles><http://www.methodstudios.com/signature/url/los-angeles> This e-mail and any attachments are intended only for use by the addressee(s) named herein and may contain confidential information. If you are not the intended recipient of this e-mail, you are hereby notified any dissemination, distribution or copying of this email and any attachments is strictly prohibited. If you receive this email in error, please immediately notify the sender by return email and permanently delete the original, any copy and any printout thereof. The integrity and security of e-mail cannot be guaranteed.

2 2

Invalid credentials
by yan＠seiner.com 31 Oct '13

31 Oct '13

I am setting up a simple LDAP server. I have a few entries that I am playing with for user authentication. I have phpldapadmin set up and I can verify that the passwords are correct. However, when I test authentication usign ldapwhoami or ldapsearch (anonymous) it always fails with invalid credentials or no records found. Can anyone provide any clues on what might be going on? yan@NewMoon:/etc$ ldapwhoami -x -W -D uid=yan,ou=People,dc=seiner,dc=lan -H ldap://eluonhea1.seiner.lan/ -d 255 ldap_url_parse_ext(ldap://eluonhea1.seiner.lan/) ldap_create ldap_url_parse_ext(ldap://eluonhea1.seiner.lan:389/??base) Enter LDAP Password: ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP eluonhea1.seiner.lan:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 192.168.128.21:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x7f567246c800 ptr=0x7f567246c800 end=0x7f567246c83c len=60 0000: 30 3a 02 01 01 60 35 02 01 03 04 22 75 69 64 3d 0:...`5...."uid= 0010: 79 61 6e 2c 6f 75 3d 50 65 6f 70 6c 65 2c 64 63 yan,ou=People,dc 0020: 3d 73 65 69 6e 65 72 2c 64 63 3d 6c 61 6e 80 0c =seiner,dc=lan.. 0030: xx (password deleted) ber_scanf fmt ({i) ber: ber_dump: buf=0x7f567246c800 ptr=0x7f567246c805 end=0x7f567246c83c len=55 0000: 60 35 02 01 03 04 22 75 69 64 3d 79 61 6e 2c 6f `5...."uid=yan,o 0010: 75 3d 50 65 6f 70 6c 65 2c 64 63 3d 73 65 69 6e u=People,dc=sein xx (password deleted) ber_flush2: 60 bytes to sd 3 0000: 30 3a 02 01 01 60 35 02 01 03 04 22 75 69 64 3d 0:...`5...."uid= 0010: 79 61 6e 2c 6f 75 3d 50 65 6f 70 6c 65 2c 64 63 yan,ou=People,dc 0020: 3d 73 65 69 6e 65 72 2c 64 63 3d 6c 61 6e 80 0c =seiner,dc=lan.. xx (password deleted) ldap_write: want=60, written=60 0000: 30 3a 02 01 01 60 35 02 01 03 04 22 75 69 64 3d 0:...`5...."uid= 0010: 79 61 6e 2c 6f 75 3d 50 65 6f 70 6c 65 2c 64 63 yan,ou=People,dc 0020: 3d 73 65 69 6e 65 72 2c 64 63 3d 6c 61 6e 80 0c =seiner,dc=lan.. xx (password deleted) ldap_result ld 0x7f5672464250 msgid 1 wait4msg ld 0x7f5672464250 msgid 1 (infinite timeout) wait4msg continue ld 0x7f5672464250 msgid 1 all 1 ** ld 0x7f5672464250 Connections: * host: eluonhea1.seiner.lan port: 389 (default) refcnt: 2 status: Connected last used: Thu Oct 31 09:42:03 2013 ** ld 0x7f5672464250 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x7f5672464250 request count 1 (abandoned 0) ** ld 0x7f5672464250 Response Queue: Empty ld 0x7f5672464250 response count 0 ldap_chkResponseList ld 0x7f5672464250 msgid 1 all 1 ldap_chkResponseList returns ld 0x7f5672464250 NULL ldap_int_select read1msg: ld 0x7f5672464250 msgid 1 all 1 ber_get_next ldap_read: want=8, got=8 0000: 30 0c 02 01 01 61 07 0a 0....a.. ldap_read: want=6, got=6 0000: 01 31 04 00 04 00 .1.... ber_get_next: tag 0x30 len 12 contents: ber_dump: buf=0x7f567246daa0 ptr=0x7f567246daa0 end=0x7f567246daac len=12 0000: 02 01 01 61 07 0a 01 31 04 00 04 00 ...a...1.... read1msg: ld 0x7f5672464250 msgid 1 message type bind ber_scanf fmt ({eAA) ber: ber_dump: buf=0x7f567246daa0 ptr=0x7f567246daa3 end=0x7f567246daac len=9 0000: 61 07 0a 01 31 04 00 04 00 a...1.... read1msg: ld 0x7f5672464250 0 new referrals read1msg: mark request completed, ld 0x7f5672464250 msgid 1 request done: ld 0x7f5672464250 msgid 1 res_errno: 49, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_dump: buf=0x7f567246daa0 ptr=0x7f567246daa3 end=0x7f567246daac len=9 0000: 61 07 0a 01 31 04 00 04 00 a...1.... ber_scanf fmt (}) ber: ber_dump: buf=0x7f567246daa0 ptr=0x7f567246daac end=0x7f567246daac len=0 ldap_msgfree ldap_err2string ldap_bind: Invalid credentials (49) ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 3 0000: 30 05 02 01 02 42 00 0....B. ldap_write: want=7, written=7 0000: 30 05 02 01 02 42 00 0....B. ldap_free_connection: actually freed ========================= slapd.conf root@EluOnHea1:/etc/openldap# cat slapd.conf | grep -v ^# | grep -v ^$ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema pidfile /var/run/slapd.pid argsfile /var/run/slapd.args moduleload back_bdb.la access to * by self write by users read by anonymous auth database ldif suffix "dc=seiner,dc=lan" rootdn "cn=admin,dc=seiner,dc=lan" rootpw xxx directory /usr/lib/openldap-data

1 0

ldap_set_option() of LDAP_OPT_X_TLS_REQUIRE_CERT
by Todd Lyons 31 Oct '13

31 Oct '13

Hello, I'm a developer on the Exim MTA and I have some questions about differing behavior I am seeing across different systems. I would like some suggestions about the best way to handle each issue. First, I have not gotten "a ton of complaints." One person contacted me with the issues I am describing below. I do not know his server or client versions, other than his workstation is Debian Squeeze. I'll just refer to him as "the guy". Second, my test server is running openldap 2.3.34, my workstation on which I am running my test builds of Exim is using openldap 2.4.28 client libs. Issues: 1. When multiple servers are specified, our ldap code just did an unbind to all servers defined when it was finished. The guy contacted me with the problem that the unbind call hangs when one of the ldap servers was unavailable for whatever reason. On *my* system, the blind unbind worked properly no matter if the bind succeeded. I modified the ldap code so that it only unbinds if the original bind succeeded. That seems the proper/correct way to handle it in all cases, so this issue really is already solved. I'm just wondering if there are any gotchas I might be missing by doing it this way. 2. A few months ago I helped (a different) someone troubleshoot a really strange problem where setting the LDAP_OPT_X_TLS_REQUIRE_CERT option in our code did not have any impact on his machine. Our code set that option per connection. It turns out that, for him, setting that option per connection did not affect the TLS require cert option that the bind used. He found some comment somewhere advising that NULL for the ldap handle sets the option globally in the ldap client. We tried it and it solved the problem for him. I saw identical behavior on my system (NULL worked, ldap handle did not) so we assumed that the code had never really worked properly. I then changed our ldap code to use NULL instead of the ldap handle when setting the TLS require cert option. The guy (with the current problem) runs a system that worked just fine previously, but using the new code (NULL instead of ldap handle when setting TLS require cert option) does not affect the TLS require certificate setting when his bind is attempted. After much testing and debugging, I had him merely change that one line back to using the ldap handle in ldap_set_option() and it then worked properly for him. So I have two systems (mine and his) which behave differently after the ldap_set_option() on LDAP_OPT_X_TLS_REQUIRE_CERT. In a fit of psychotic testing, I decided on my system to just blindly set it both globally and per connection. It worked, and produced no errors. That surprised me, I expected one or the other to complain. My potential code looks like the following (apologize if Gmail wraps), can you explain any pitfalls of doing it this way? Should the two be #ifdef guarded by client lib version checks or something? /* Use NULL ldap handle b/c is global in some client libs */ rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &cert_option); if (rc) { DEBUG(D_lookup) debug_printf("Unable to set TLS require cert_option(%d) globally: %s\n", cert_option, ldap_err2string(rc)); } /* Use current ldap handle b/c is per-connection in others */ rc = ldap_set_option(ld, LDAP_OPT_X_TLS_REQUIRE_CERT, &cert_option); if (rc) { DEBUG(D_lookup) debug_printf("Unable to set TLS require cert_option(%d) on LDAP server " "%s%s: %s\n", cert_option, host, porttext, ldap_err2string(rc)); } Any comments or suggestions are appreciated. ...Todd -- The total budget at all receivers for solving senders' problems is $0. If you want them to accept your mail and manage it the way you want, send it the way the spec says to. --John Levine

1 1

substring matching rule not working in extensible search filter
by David Coutadeur 31 Oct '13

31 Oct '13

Hi everybody, I tryied this filter in a ldapsearch operation: (&(objectClass=inetOrgPerson)(description:2.5.13.7:=*abcd)) but this results in a "Bad search filter (-7)". However if I write this without the joker it works: (&(objectClass=inetOrgPerson)(description:2.5.13.7:=abcd)) I don't see any restriction on matching rule extensible notation in RFC 4515 (http://tools.ietf.org/html/rfc4515). Is this syntax not implemented in OpenLDAP, or did I make a mistake in my filter ? Thank you in advance, DC

1 0

invalid value for attributeType objectClass
by limpteam＠gmail.com 31 Oct '13

31 Oct '13

Hello community! Have a Centos 6.4 server with new openldap 2.4.23-32.el6_4.1 installled. I'm new to ldap and just install it and configure for easy use. I edit only than 2 files olcDatabase={0}config.ldif and olcDatabase={2}bdb.ldif It's starts, I worked with it, add some OU and CN via phpLdapAdmin and tested it on Thunderbird. But after I decide to restart slapd i got error: PROXIED attributeDescription "DC" inserted. str2entry: invalid value for attributeType objectClass #0 (syntax 1.3.6.1.4.1.1466.115.121.1.38) slaptest: bad configuration file! and didn't start. it's problem with ppolicy and pwdAttribute? How can i solve this? Thanks for answer! P.S. Google can't help me or I just don't understand the whole theory.

2 1

About LDAP PAM authentication
by Ernesto Manuel Suarez Ojeda 30 Oct '13

30 Oct '13

Hi, I have 4 goals in configurating ldap pam authentication in my workstations Ubuntu 12.04 and 10.04: 1. Authenticate both ldap users and unix users. 2. Login using cached credentials when ldap server is down. 3. Warnings and dialog for password change when password expired or is about to expire. 4. Password length and complexity check. We have an openldap server with an operational ppolicy.schema and we need a comprehensive explanation about configuring Ubuntu clients for achieve this goals. I have read some documents but I'm not satisfied. Thanks, Ernesto Suárez Ojeda

1 0

OpenLDAP 2.4.26 SRPM for RHEL
by Aaron Bennett 30 Oct '13

30 Oct '13

Hi, Just in case anyone's using them, I've updated the SRPMS for our local build of OpenLDAP for RHEL/CentOS to 2.4.36. https://wordpress.clarku.edu/abennett/2012/03/16/openldap-src-rpms-for-rhel… It's basically as stock-as-possible, build against BDB 5.1.29 and OpenSSL. - Aaron --- Aaron Bennett Manager of Systems Administration Clark University ITS W:508.793.7315

2 1

limit on number of members in groupOfNames
by Dorit Eitan 30 Oct '13

30 Oct '13

2 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical