openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Question on assigning a new user with admin role
by Kumar, Amit 26 Jun '13

26 Jun '13

Hi, I have little experience with managing LDAP servers. Previously with just one file slapd.conf it was lot easier to assign a user a role of an admin, just by giving access to attrs=...by With newer version of openldap-servers-2.4.23-26 on RHEL 6.x this is not the same, and hope you can help me understand this to assign access to user to be able to manage the directory. So I began giving access to attrs=userPassword by self write by dn="NEW USER DN ...." write by * auth ...similarly I did this for all attributes I wanted this user to manage. I made the above changes in my slapd.conf, but this does not allow the new user to manage the directory, he is just like any other user who can browse but not write to it. What more do I need to do? Best, Amit

2 3

unsupported extended operation
by Rodney Simioni 26 Jun '13

26 Jun '13

Hi, I just compiled openldap with: ./configure --prefix=/usr/local/openldap --enable-ldap --with-tls=openssl --with-cyrus-sasl --enable-crypt I did a 'make depend', 'make', and a 'make install'; I didn't see any errors. I fired up ldap with: './slapd -d127 -h "ldap:///"' Then I went to test my install with:' ldapsearch -x -ZZ -d1 -H ldap://blah.com/' And I'm still getting: ldap_msgfree ldap_err2string ldap_start_tls: Protocol error (2) additional info: unsupported extended operation ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 3 ldap_free_connection: actually freed Does anybody have a clue? This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free. Thank you.

5 6

openldap and MozNSS
by Rodney Simioni 25 Jun '13

25 Jun '13

Greetings, I have heard through the grapevine that it is best not to use openldap with MozNSS support for SSL/TLS and to use openssl. I'm using a Red Hat pkg of openldap with version 2.4.23. How do I know if this version has openssl compiled? If it is compiled for openssl, how do I tell openldap not to use MOzNSS? Thanks! This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free. Thank you.

2 6

RHEL 6.3 /Openldap-2.4.35
by Darouichi, Aziz 25 Jun '13

25 Jun '13

Hi All, I am trying to compile Openldap-2.4.35 on RHEL 6.3 to enable SSL/TLS and I get the following error: -configure: WARNING: Could not locate TLS/SSL package -configure: WARNING: TLS data protection not supported! - I installed openssl-1.0.1e - gnutls-2.8.6 - libgcrypt-1.5.2 - libgpg-error-1.8 - DB-6.0.19I run config with the following options: CPPFLAGS="-I/opt/local/DB-6/include/" LDFLAGS="-L/opt/local/DB-6/lib/" ./configure --enable-hdb --enable-bdb --enable-overlays=mod --enable-ppolicy=yes --prefix=/opt/local Any help will be great :) Thank You, Aziz

2 2

SASL Proxy Authorization
by Vishesh kumar 25 Jun '13

25 Jun '13

Hi Members, I am trying to get SASL Proxy Authorization in work. GSSAPI authentication is already in place ++++++++++++ SASL/GSSAPI authentication started SASL username: admin(a)LINUXMANTRA.LOCAL SASL SSF: 56 SASL data security layer installed. dn:uid=admin,cn=gssapi,cn=auth ++++++++++++++++++++++++++ But following command giving error ldapsearch -d 1 -Y GSSAPI -X "uid=vishesh,dc=linuxmantra,dc=local" -b"dc=linuxmantra,dc=local" -s base I already mentioned "authzTo: dn:uid=vishesh,dc=linuxmantra,dc=local" for admin DN. Thanks in advance for your help. -- http://linuxmantra.com

2 2

Defining search depth for mod_ldap.
by Mangesh Sawant 25 Jun '13

25 Jun '13

Hi, when searching a user mod_ldap returns only parent node attributes. Is there any setting so that search will return parent node attributes as well. LDAP URS is as follows: LdapUrl=ldap:// 172.16.100.237/ou=radiusUserProfile,dc=mtnl,dc=com?uid,userPassword,cn,sn? Here I could get back only uid,userPassword. cn and sn were blank, which are attributes of child nodes. -- Thanks And Regards , Mangesh Sawant .

2 1

understanding ldap
by Rodney Simioni 25 Jun '13

25 Jun '13

Please correct me if I am wrong. These questions are stemming from a Red Hat Linux Server. /etc/openldap/ldap.conf # this config file is openldap server's ldap config file? /etc/ldap.conf # This config file is for ldap's clients? If I want to test test if LDAP is configured with TLS/SSL with this command ldapsearch -d -1 -x -LLL -ZZ, do I need a ldap client config file? This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free. Thank you.

4 4

etiquette when asking questions
by Brendan Kearney 24 Jun '13

24 Jun '13

i have several questions that i am looking for information on, but they are not all related to each other. is it proper etiquette to send a separate thread for each topic, or can one post a series of questions in one thread? my questions run the gambit from access, groups and ACLs to SASL+Kerberos, inheritance of structural object classes, and group types (groupOfNames vs posixAccount). thank you, brendan

2 1

OpenLDAP export in Oracle DB (10g) - not as backend
by Lukas Lehner 24 Jun '13

24 Jun '13

Hi I want an interface to OpenLDAP (with sudoers) to Oracle DB. I have no access to OpenLDAP server, but an LDAP admin user. The OpenLDAP data in Oracle DB should be relational, the same logic like in OpenLDAP. How is the easiest? Is there already finished scripts?

2 2

no-op search control, large result sets and abandon
by Michael Ströder 22 Jun '13

22 Jun '13

HI! In web2ldap I've implemented a feature some time ago which uses the no-op search control to determine the overall number of results when only displaying a partial result set. Obviously this does not scale well when interactively browsing into a container with many entries. So I'm considering whether to make this configurable (default off) or to make something automagically. My current working code sends a search no-op request with small timeout (5 sec), catches the error if the no-op search would take longer (Python exception ldap.TIMEOUT) and sends abandon request in this case. The idea is trying to determine the overall number of results only if it does not put too much burden on the server. But I wonder whether sending the abandon request really helps to reduce the server load: Does slapd immediately stop processing the no-op search request? Or does it generate the result set but not return it to the client? Ciao, Michael.

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical