openldap-technical

openldap-technical@openldap.org

1 participants
9868 discussions

cn=config chaining or authzTo Strong(er) authentication required (8)
by espeake＠oreillyauto.com 23 Jul '13

23 Jul '13

I am working on setting up a provider/consumer setup for openLDAP version 2.4.28. Everything seems to be working other than referrals. I can query the consumers, I can write directly to the provider. But I get the following when I try to sent a ldapmadify to a consumer and it refers it to the provider. ldapmodify -W -D "uid=ldapadmin,ou=system,dc=example,dc=com" -H ldap://tntest-ldap.example.com -c -f /tmp/epseake.ldif Enter LDAP Password: modifying entry "uid=ESPEAKE,ou=Users,dc=example,dc=com" ldap_modify: Strong(er) authentication required (8) If I run the modify against the provider with the same credentials it will modify the record. I have added authzTo dn.regex:^uid= [^,]*,ou=system,dc=example,dc=com$. I also added authzTo ldap:///dc=example,dc=com???(objectClass=top) This got rid of my error 10 on the referral but now it is asking for strong(er) authentication. I do have certificates on my servers in the correct locations and olcTLSCertificate statements with the directories for the certs and keys. THis is the final step I hope in getting the test environment completed and ready for testing. All help is appreciated. Thank you, Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

2 1

OpenLdap from OpenCSW installation
by michał kępkowski 23 Jul '13

23 Jul '13

Hey, Has anyone of you install OpenLdap from OpenCSW repositories on Solaris? I've try to install using pkgutils: pkgutil -yi CSWopenldap than I read something more an add pkgutil -iy berkeleydb48 pkgutil -i CSWopenldap-back-bdb however my slaptest shows Unrecognized database type (bdb) 51ed5c62 /etc/opt/csw/openldap/slapd.conf: line 53: <database> failed init (bdb) Line 53 is the beginning of database configuration: database bdb Do you have any ideas? Am I configured something bad?

2 1

Slapd starts with "-h" not working as described
by Nathanel Sulimanov 22 Jul '13

22 Jul '13

Hi, I am trying to configure /etc/sysconfig/ldap with following: SLAPD_LDAP=no SLAPD_URLS="ldap://${HOSTNAME} ldaps://${HOSTNAME} ldap://127.0.0.1" ---> This works and Slapd start ok. But While using: SLAPD_URLS="ldap://${HOSTNAME} ldaps://${HOSTNAME} ldap://localhost" ---> Does NOT work. My /etc/hosts looks like this: 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 following RPM installed: openldap-2.4.34-1.el6.x86_64 openldap-clients-2.4.34-1.el6.x86_64 openldap-servers-2.4.34-1.el6.x86_64 And one more issue: How I could verify that ldap server start with proper olcServerID ? Is there any logging should be enabled and what values to look for ? How I could present olcServerID along with ldap://${HOSTNAME} ldaps://${HOSTNAME} ldap://127.0.0.1 command ? Regards,

1 0

Re: ldap syncrepl issue.
by Ashok Kumar Shah 22 Jul '13

22 Jul '13

I am running OpenLDAP 2.4.23. Looks like syncrepl has stuck i am seeing this message from last 2 days every minute i see this message popping up on the logs perhaps this the reason of huge slave lag is 2 days and some hours. Is there a fix for this? *syncrepl_message_to_op: rid=011 be_modrdn uid=user.name,ou=xxxxx,dc=xxxx,dc=com (68)* * do_syncrepl: rid=011 rc 68 retrying* * * Thanks, Ashok On Fri, Jul 12, 2013 at 9:26 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, July 12, 2013 5:40 PM +0530 Ashok <ashok.shah(a)flipkart.com> > wrote: > > >> >> >> >> >> Hi, >> >> I am running ldap master and multiple slave with RefreshandPersist config. >> ldap search for an user shows different set of records. ContextCSN on >> master and slave are exactly same. >> What can i do to fix this. I tried restarting slave ldap but didn't help. >> Also i keep getting do_syncrepl: rid=112 rc 68 retrying every minute. I >> doubt if there is replication issue. >> > > It sounds like it is resyncing the DB, and skipping entries that already > exist: LDAP_ALREADY_EXISTS is error code 68. > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

3 3

Antw: Q: Multi-Master setup
by Ulrich Windl 22 Jul '13

22 Jul '13

>>> I wrote on 16.07.2013 at 09:02: [...] > 2) What is the correct syntax for the second argument (URI): Do you need a > final slash, do you need the port? Currently I'm using a syntax like > "olcServerID: 1 ldap://ldap.domain.org" [...] As nobody did answer, I guess nobody knows how the server matches the ServerID. So let me ask a diffenent question: (How) can I query the ServerID a server uses? Regards, Ulrich

2 2

Openldap-2.4.33 bind problem
by Darouichi, Aziz 19 Jul '13

19 Jul '13

Hi all, I am trying to bind openldap-2.4.33 to vendor SSO using simple bind and I am getting invalid credentials. I have reset the rootdn password more than once to make sure there were no typos, and I am still getting same Invalid Credentials error. This is a copy of my slapd.conf # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /opt/local/etc/openldap/schema/core.schema include /opt/local/etc/openldap/schema/ppolicy.schema # Define global ACLs to disable default read access. include /opt/local/etc/openldap/schema/cosine.schema include /opt/local/etc/openldap/schema/nis.schema include /opt/local/etc/openldap/schema/inetorgperson.schema # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /opt/local/var/run/slapd.pid argsfile /opt/local/var/run/slapd.args sizelimit unlimited #serverID 1 allow bind_v2 loglevel sync "/opt/local/etc/openldap/slapd.conf" 180L, 5417C # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /opt/local/etc/openldap/schema/core.schema include /opt/local/etc/openldap/schema/ppolicy.schema # Define global ACLs to disable default read access. include /opt/local/etc/openldap/schema/cosine.schema include /opt/local/etc/openldap/schema/nis.schema include /opt/local/etc/openldap/schema/inetorgperson.schema # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org # Load dynamic backend modules: # modulepath /opt/local/libexec/openldap # moduleload back_bdb.la # moduleload back_hdb.la # moduleload back_ldap.la #modulepath /usr/lib/openldap #moduleload accesslog.la moduleload auditlog.la #moduleload denyop.la #moduleload dyngroup.la moduleload dynlist.la #moduleload lastmod.la #moduleload pcache.la moduleload ppolicy.la #moduleload refint.la #moduleload retcode.la #moduleload rwm.la #moduleload smbk5pwd.la moduleload syncprov.la moduleload syncprov #moduleload translucent.la moduleload unique.la moduleload valsort.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! # CA singed Certificate and server cert entries: TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /opt/local/etc/openldap/cacert.pem TLSCertificateFile /opt/local/etc/openldap/ldap-tls.curry.edu.cert.pem TLSCertificateKeyFile /opt/local/etc/openldap/ldap-tls.curry.edu.key.pem # Clinet verification not required #TLSVerifyClient never ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=curry,dc=edu" rootdn "cn=ldap,dc=curry,dc=edu" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw {SSHA}gMePUFraA8Fjn63t8FzpYHbp+6g8N6Mz #access to * # by dn.base="cn=ldap,dc=curry,dc=edu" read # by * break # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /opt/local/var/openldap-data syncrepl rid=006 provider=ldap://192.168.60.42 tls_cert=/etc/pki/tls/certs/ldap-tls.curry.edu.cert.pem tls_key=/etc/pki/tls/private/ldap-tls.curry.edu.key.pem tls_cacert=/etc/pki/tls/certs/cacert.pem tls_reqcert=demand searchbase="dc=curry,dc=edu" schemachecking=on timelimit=unlimited sizelimit=unlimited type=refreshAndPersist retry="60 +" # Index to maintain index entryUUID eq index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres index nisMapName,nisMapEntry eq,pres,sub #mirrormode TRUE mirrormode on # define the provider to use the syncprov overlay # (last directives in database section) overlay syncprov # contextCSN saved to database every 100 updates or ten minutes syncprov-checkpoint 100 1 syncprov-sessionlog 100 ################################################################################# # Password Policy # ################################################################################ ################################################################################# # This implies the password policy should be for the entire base DN #ppolicy_default overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=curry,dc=edu" # This implies the passwords should not be in clear text and this directive takes no parameters ppolicy_hash_cleartex

2 1

Q: referral issue
by espeake＠oreillyauto.com 18 Jul '13

18 Jul '13

Okay my referral chaining was working and then stopped working. I get an error 10 when I submit a change to my clustered consumers that are setup to refer writes to my master LDAP server. In looking at the configuration help in the online documentation it shows how to setup the slapd.conf file on the master. The issue here is that everything is setup through cn=config. my consumers do have a slapd.conf file along with cn=config files. I have inherited these servers so I'm sure what the person here before me was trying to do. I have an idea but I didn't like that idea. Here is the chaining command from my slapd.conf file. overlay chain chain-uri "ldap://tntest-ldap-master-1.example.com" chain-rebind-as-user TRUE chain-idassert-bind bindmethod="simple" binddn="uid=admin,dc=oreillyauto,dc=com" credentials="password" mode="self" chain-tls start chain-return-error TRUE The the syncrepl area syncrepl rid 002 provider=ldap://tntest-ldap-master-1.example.com type=refreshOnly interval=00:00:05:00 searchbase-"dc=oreillyauto,dc=com" binddn="uuid=syncrepl,ou=system,dc=oreillyauto,dc=com" credentials=password updatedn "uid=ldapadmin,ou=system,dc=example,dc=com" updateref ldap://tntest-ldap-master-1.example.com I need to be pointed in the right direction please. Thanks, Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

2 1

unable to query rootdn on slave via external auth
by Adrian Bridgett 18 Jul '13

18 Jul '13

This has been driving me up the wall and I wondered if someone could point out the bit I'm missing - the desk is getting badly damaged by my head bashing it :-) On our master server I can query the rootdb no problem, but I can't do this on the slaves - this applies whether I use external or ldaps authentication. I've turned on access and search filter debugging and I can't see any rejections. I'm trying to query contextCSN to ensure that the slave is in sync. "slapcat" works, but seems an ugly hack. I can query all the children - just not the root. The config is the same (ish) on both - here's the slave: dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=example,dc=com olcLastMod: TRUE olcRootDN: cn=admin,dc=example,dc=com olcRootPW:: ....... olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 structuralObjectClass: olcHdbConfig entryUUID: 07f3fede-c201-1031-8b17-f3837148ab05 creatorsName: cn=config createTimestamp: 20121113171221Z olcSyncrepl: {0}rid=000 provider=ldap://ldap.example.com type=refreshandPers ist interval=00:00:00:60 retry="60 10 300 +" timelimit=10 searchbase="dc=example ,dc=com" binddn="cn=admin,dc=example,dc=com" bindmethod=simple credent ials=..... starttls=critical tls_reqcert=demand attrs="*,+" olcUpdateRef: ldap://ldap.example.com olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcDbIndex: objectClass eq olcDbIndex: cn,sn pres,eq,sub olcDbIndex: uid,uidNumber,gidNumber,memberOf,sudoUser,memberUid pres,eq olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=example,dc=com" manage by group.exact="cn=admins, ou=Group,dc=example,dc=com" manage by dn.exact=gidNumber=0+uidNumber=0,cn=p eercred,cn=external,cn=auth manage by * none olcAccess: {1}to attrs=SambaLMPassword,SambaNTPassword by self write by dn="cn =freenas-auth,ou=services,dc=example,dc=com" read by dn="cn=admin,dc=example ,dc=com" manage by group.exact="cn=admins,ou=Group,dc=example,dc=com" ma nage by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth mana ge by * none olcAccess: {2}to dn.base="" by * read olcAccess: {3}to * by self write by dn="cn=admin,dc=example,dc=com" manage b y group.exact="cn=admins,ou=Group,dc=example,dc=com" manage by dn.exact=gid Number=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * read olcAccess: {4}to dn.base="dc=example,dc=com" by * read On the slave: ldapsearch -Y EXTERNAL -H ldapi:/// -b dc=example,dc=com -s base -Q# extended LDIF # search result search: 2 result: 0 Success # numResponses: 1 On the master: ldapsearch -Y EXTERNAL -H ldapi:/// -b dc=example,dc=com -s base dn: dc=example,dc=com objectClass: top objectClass: dcObject objectClass: organization o: example.com dc: example # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1

2 6

olcPasswordHash
by Nerijus Kislauskas 18 Jul '13

18 Jul '13

Hi community, We want implement password politics in our DIT, and are testing ppolicy and found issues using olcPasswordHash, Password Modify Extension and so. Here are my testings: 1) My cn=config with olcPasswordHash and olcSuffix values $ ldapsearch -D "cn=admin,dc=ktu,dc=lt" -W -x -b "cn=config" olcPasswordHash olcSuffix dn: cn=config olcPasswordHash: {SSHA} ... # {-1}frontend, config dn: olcDatabase={-1}frontend,cn=config olcPasswordHash: {SSHA} olcPasswordHash: {SHA} olcPasswordHash: {SMD5} olcPasswordHash: {MD5} olcPasswordHash: {CRYPT} ... # {2}hdb, config dn: olcDatabase={2}hdb,cn=config olcSuffix: dc=ktu,dc=lt $ 2) My testing user exists without userPassword attribute $ ldapsearch -D "cn=admin,dc=ktu,dc=lt" -W -x -b "eduPersonPrincipalName=testuser9(a)ktu.lt,ou=People,ou=Users,dc=ktu,dc=lt" userPassword Enter LDAP Password: dn: eduPersonPrincipalName=testuser9(a)ktu.lt,ou=People,ou=Users,dc=ktu,dc=lt $ 3) Making a password for a test user. As documentation says "ldappasswd uses the LDAPv3 Password Modify (RFC 3062) extended operation." $ ldappasswd -h localhost -D "cn=admin,dc=ktu,dc=lt" -x -W -S "eduPersonPrincipalName=testuser9(a)ktu.lt,ou=People,ou=Users,dc=ktu,dc=lt" New password: Re-enter new password: Enter LDAP Password: $ 4) userPassword is somehow gets multivalued $ ldapsearch -D "cn=admin,dc=ktu,dc=lt" -W -x -b "eduPersonPrincipalName=testuser9(a)ktu.lt,ou=People,ou=Users,dc=ktu,dc=lt" userPassword Enter LDAP Password: # testuser9(a)ktu.lt, People, Users, ktu.lt dn: eduPersonPrincipalName=testuser9(a)ktu.lt,ou=People,ou=Users,dc=ktu,dc=lt userPassword:: e1NTSEF9RlE3VjRYa003RVJ6eGFTNjR4ZkFRSzRGZEk4cFk0UDQ= --> {SSHA}FQ7V4XkM7ERzxaS64xfAQK4FdI8pY4P4 userPassword:: e1NTSEF9K1JtbWl3M0RxTTV3aEl0U3g5TjVrZWRETlpES3NROUg= --> {SSHA}+Rmmiw3DqM5whItSx9N5kedDNZDKsQ9H userPassword:: e1NIQX1maVFONTAreDdRajZDTk9BWS9hbXFSUmlxQlU9 --> {SHA}fiQN50+x7Qj6CNOAY/amqRRiqBU= userPassword:: e1NNRDV9VUdaa3ZDSWI5Qld4a1VNcUhyZEl3ZElTbnJ3PQ== --> {SMD5}UGZkvCIb9BWxkUMqHrdIwdISnrw= userPassword:: e01ENX1SN3pseDA5WW4waG4yOVYrbktuNENBPT0= --> {MD5}R7zlx09Yn0hn29V+nKn4CA== userPassword:: e0NSWVBUfTFNZVAud1ZxenEvdWM= --> {CRYPT}1MeP.wVqzq/uc $ I guess "frontend" database has so called global olcPasswordHash directive in effect over all databases. I also guess, that 1 SSHA form comes from cn=config, and other 5 forms comes from "frontend". Does anyone know if this is true? 5) if above is true, overwriting globals in local database config seems like a solution to me, but ... $ ldapmodify -D "cn=admin,dc=ktu,dc=lt" -W -x <<EOF > dn: olcDatabase={2}hdb,cn=config > changetype: modify > add: olcPasswordHash > olcPasswordHash: {SSHA} > EOF Enter LDAP Password: modifying entry "olcDatabase={2}hdb,cn=config" ldap_modify: Object class violation (65) additional info: attribute 'olcPasswordHash' not allowed $ Is it possible to get rid of not secure forms of password schemes? I always believed, that password-hash (olcPasswordHash) should help to do that. Maybe I don't know something? I also think, that it could be related to ITS#7625 <http://www.openldap.org/its/index.cgi/Incoming?id=7625;expression=ppolicy;p…>, why ppolicy shows "Additional info: Password policy only allows one password value" error message. Please, help to clear things out. System: Debian 7.0 (wheezy) OpenLDAP: 2.4.31 (from package) Thank you. -- Pagarbiai, Nerijus Kislauskas KTU ITD, Litnet valdymo centras Studentu g. 48a - 101, Kaunas tel.: (8~37) 30 06 45 mob. tel.: 8-614-93889 e-mail.: nerijus.kislauskas(a)ktu.lt

1 1

Re: Upgrade to 2.4.35 Causes Instability, Errors
by Tim Gustafson 18 Jul '13

18 Jul '13

> So you didn't answer anything about the old version of OpenLDAP versus the > current one. I would note that according to the db_stat output, you've > experienced zero deadlocks. That seems somewhat in conflict with your > earlier report. Did you run db_recover (resetting the stats)? Sorry; I missed that one. We were running 2.4.33 before the upgrade. I have not run db_recover in between the original report and now. It is worth noting that the deadlock errors have ceased in the log file, but I can't speak to whether or not we're more stable than we were before; as I mentioned earlier, it seemed kinda random when it would crash. I was thinking that doing a slapcat and then cleaning out the database files and then slapadd'ing everything back might be helpful. Do you agree? -- Tim Gustafson tjg(a)ucsc.edu 831-459-5354 Baskin Engineering, Room 313A

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical