openldap-technical

openldap-technical@openldap.org

1 participants
9868 discussions

SASL Proxy Authorization
by Vishesh kumar 25 Jun '13

25 Jun '13

Hi Members, I am trying to get SASL Proxy Authorization in work. GSSAPI authentication is already in place ++++++++++++ SASL/GSSAPI authentication started SASL username: admin(a)LINUXMANTRA.LOCAL SASL SSF: 56 SASL data security layer installed. dn:uid=admin,cn=gssapi,cn=auth ++++++++++++++++++++++++++ But following command giving error ldapsearch -d 1 -Y GSSAPI -X "uid=vishesh,dc=linuxmantra,dc=local" -b"dc=linuxmantra,dc=local" -s base I already mentioned "authzTo: dn:uid=vishesh,dc=linuxmantra,dc=local" for admin DN. Thanks in advance for your help. -- http://linuxmantra.com

2 2

Defining search depth for mod_ldap.
by Mangesh Sawant 25 Jun '13

25 Jun '13

Hi, when searching a user mod_ldap returns only parent node attributes. Is there any setting so that search will return parent node attributes as well. LDAP URS is as follows: LdapUrl=ldap:// 172.16.100.237/ou=radiusUserProfile,dc=mtnl,dc=com?uid,userPassword,cn,sn? Here I could get back only uid,userPassword. cn and sn were blank, which are attributes of child nodes. -- Thanks And Regards , Mangesh Sawant .

2 1

understanding ldap
by Rodney Simioni 25 Jun '13

25 Jun '13

Please correct me if I am wrong. These questions are stemming from a Red Hat Linux Server. /etc/openldap/ldap.conf # this config file is openldap server's ldap config file? /etc/ldap.conf # This config file is for ldap's clients? If I want to test test if LDAP is configured with TLS/SSL with this command ldapsearch -d -1 -x -LLL -ZZ, do I need a ldap client config file? This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free. Thank you.

4 4

etiquette when asking questions
by Brendan Kearney 25 Jun '13

25 Jun '13

i have several questions that i am looking for information on, but they are not all related to each other. is it proper etiquette to send a separate thread for each topic, or can one post a series of questions in one thread? my questions run the gambit from access, groups and ACLs to SASL+Kerberos, inheritance of structural object classes, and group types (groupOfNames vs posixAccount). thank you, brendan

2 1

OpenLDAP export in Oracle DB (10g) - not as backend
by Lukas Lehner 24 Jun '13

24 Jun '13

Hi I want an interface to OpenLDAP (with sudoers) to Oracle DB. I have no access to OpenLDAP server, but an LDAP admin user. The OpenLDAP data in Oracle DB should be relational, the same logic like in OpenLDAP. How is the easiest? Is there already finished scripts?

2 2

no-op search control, large result sets and abandon
by Michael Ströder 22 Jun '13

22 Jun '13

HI! In web2ldap I've implemented a feature some time ago which uses the no-op search control to determine the overall number of results when only displaying a partial result set. Obviously this does not scale well when interactively browsing into a container with many entries. So I'm considering whether to make this configurable (default off) or to make something automagically. My current working code sends a search no-op request with small timeout (5 sec), catches the error if the no-op search would take longer (Python exception ldap.TIMEOUT) and sends abandon request in this case. The idea is trying to determine the overall number of results only if it does not put too much burden on the server. But I wonder whether sending the abandon request really helps to reduce the server load: Does slapd immediately stop processing the no-op search request? Or does it generate the result set but not return it to the client? Ciao, Michael.

2 1

adding schemas
by Bruno Furtado 22 Jun '13

22 Jun '13

Hi Dan, I'm trying to add new schema with the command: * * *ldapadd -Y EXTERNAL -H ldapi:/// -f qmail.ldif* and I'm getting the following error message: * * *ldap_add: Server is unwilling to perform (53) * *additional info: no global superior knowledge* how can I solve it? best regards, -- Bruno Furtado LinkedIn: http://linkd.in/brunofurtado

2 1

RE: Understanding PKI
by Dave Thompson 22 Jun '13

22 Jun '13

>From: owner-openssl-users(a)openssl.org On Behalf Of Rodney Simioni >Sent: Friday, 21 June, 2013 10:36 >I want to really understand certificates, pki, etc; so forgive me >if these questions are elementary. >Before creating a certificate, I need to generate the CSR on the >actual server where I am going to install the certificate? >(reason why I'm asking is because a wildcard csr was sent to me >and I don't know if I should use the wildcard csr or the one >generated on the server). It can vary depending on who does what, and whether you are doing only server-authentication or client-authentication as well, which is not common for SSL/TLS in general but I don't know for LDAP. Client-authentication is often called "client certificate", although this is loose wording because you actually need the cert *and key*. Similarly server-authentication is often called "server cerificate" but often it is left implicit since it is practically always there. (Formally there are non-authenticating "anonymous" suites in TLS, but they are rarely used and very rarely a good idea.) FWWIW http://www.openldap.org/doc/admin24/tls.html says "All servers are required to have valid certificates, whereas client certificates are optional. Clients must have a valid certificate in order to authenticate via SASL EXTERNAL." Optional could mean 95% but not 100%, or it could mean 2%. The canonical process is: - the "user" system that will be authenticated -- usually server, sometimes client -- generates a keypair and generates a CSR using that keypair (which includes the publickey part) - a CA uses the CSR to create a user cert (which copies the user publickey from the CSR and thus originally from the keypair); the cert is signed using the *CA* key-and-cert. This may be a "public" CA like Verisign or (in your case) GeoTrust, or it can be private, but see below - the user system uses its privatekey and its cert in SSL/TLS - each *peer* system -- all clients for a server usually -- must have the root cert of the CA in its truststore (which as described earlier can be a single file or a directory). For public CAs the roots are available both on the CA site and other places that can be used to confirm their correctness and legitimacy, like every copy of Windows (including IE) or Firefox or Java; private CA roots are generally only available from the CA, whom you must trust - if the CA uses an intermediate cert (or several) which in your case GeoTrust did, then the server *should* send the intermediate cert(s), and optionally the root, in the SSL/TLS handshake. How to do this varies, but in your case it appears openldap doesn't use openssl's option for a chainfile, so you must put the cert(s) in the truststore the server uses. For the rarer case of client authentication, s/server/client/. If someone else generates your key, they can give you the key and let you generate the CSR and request the cert; they can generate the keypair and CSR and let you request the cert; or they can generate the key and CSR and get the cert. In your case your "admin" gave you all three, implying the third choice. The third choice also includes the case where it's really their key; they created a key and CSR and got a cert and (then) decided to let you share their identity. Since this apparently is as you said a "company" cert (and key) it makes sense for you to share. >Once the CSR is created, a CA will use the CSR to create the certificate? Exactly. (The user cert, not the CA cert(s) which are different.) >A CA was sent to me, it's the company's CA (wildcard); if the above answer >is yes, do I use the CA, the private key, and CSR to create the certificate? You didn't get any CA, you got a user cert *issued by* (or from) GeoTrust. GeoTrust is the CA. If I remember (without searching) it is a cert *for* *.securesites.com which is a wildcard, so this cert can be used by any system whose DNSname matches that pattern. >A CSR will only work with the private key it was generated with? A CSR is generated from, and is for, a given keypair (private+public). A cert based on that CSR is for that publickey, and thus only works with that privatekey. Once you have the cert, you don't use the CSR for anything except possibly getting a new cert -- if you want a new cert for the same keypair and Subject name, and any extensions that are specified in the CSR and honored.

1 0

RE: Is my process correct.: openldap using GeoTrust
by Dave Thompson 22 Jun '13

22 Jun '13

> From: owner-openssl-users(a)openssl.org On Behalf Of Rodney Simioni > Sent: Friday, 21 June, 2013 11:38 > Comments below. > > From: owner-openssl-users(a)openssl.org On Behalf Of Dave Thompson > Sent: Thursday, June 20, 2013 6:24 PM <snip> > The wildcard.securesites.com.cert you posted 6/19 has > Issuer: C=US, O=GeoTrust, Inc., CN=GeoTrust SSL CA and AKI > 42:79:54:1B:61:CD:55:2B:3E:63:D5:3C:48:57:F5:9F:FB:45:CE:4A > > GeoTrust doesn't publish that anywhere I can find but > http://www.tbs-certificats.com/FAQ/en/603.html has <snip> > which is an intermediate (not root) cert (verifiably) under > Issuer: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA AKI > C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E > [[Rod's comment]] I need clarification please. The 'Root 2' > is the root CA that I can download from geotrust and the one > provided to me by my sysadmin is an intermeadiate? > > and THAT is "Root 2" (one of several) on > http://www.geotrust.com/resources/root-certificates/index.html > (also in the standard Windows, Firefox, and Java truststores) > The cert from your admin is a *user* cert -- for *.securesites.com. The one I found on tbs-certificats is the relevant intermediate. "Root 2" from GeoTrust, or elsewhere, is the relevant root. > >What command do I use to make sure the key/pair that was > sent to me is > >compatible with GeoTrust's CA? > > Either concatenate the intermediate above and the correct > root (also in PEM) into one file say geotrustCAs.pem and do: > openssl verify -CAfile geotrustCAs.pem yourcertfile > [[Rod's comment]] Are you saying to concatenate the > intermediate root and 'Root 2' which should be downloaded > from geotrust? > The intermediate cert and the root cert. The intermediate is a CA cert, but is not a root cert (or root CA cert). > Or put them as separate files in some directory say mycadir, > create hashnames using c_rehash or by hand, and do: > openssl verify -CApath mycadir yourcertfile > > (The first is usually easier.) > > Assuming (as asked before) your opendlap is using openssl not > MozillaNSS, to use a key&cert with an intermediate cert > openssl requires either configuring a certchain file or > putting the chain cert(s) in the truststore (even if the > cert(s) or truststore aren't needed for verification). > [[Rod's comment]] As you said before, I'm probably using > MozNSS because of the errors I was getting several emails > ago. What should I do? Should I remove MozNSS pkg? I've already > Installed openssl-devel pkg. > Someone else suggested that and I was referring to them. Part of the errorlog you posted before looks consistent with MozNSS, but part looks consistent with openssl to me, so I can't tell. I expect openldap has a way to tell you which it uses, but I don't know how. 'devel' packages probably matter only if you are re-building openldap; are you? If you are in fact using MozNSS, the same principles still apply as to which key and certficates you need where (server vs client), but the specifics of what file(s) you put them are entirely different, so ignore those parts of my instructions. <snip>

1 0

RE: Is my process correct.: openldap using GeoTrust
by Dave Thompson 21 Jun '13

21 Jun '13

>From: owner-openssl-users(a)openssl.org On Behalf Of Rodney Simioni >Sent: Thursday, 20 June, 2013 12:04 >A key/pair was sent to me from my admin and it looked like it came >from GeoTrust. It's a wildcard cert. A privatekey (which in most formats including openssl's is really a keypair) and a matching certificate. You need both. >I downloaded the Root CA from GeoTrust 's web site because LDAP >requires the CA file. The wildcard.securesites.com.cert you posted 6/19 has Issuer: C=US, O=GeoTrust, Inc., CN=GeoTrust SSL CA and AKI 42:79:54:1B:61:CD:55:2B:3E:63:D5:3C:48:57:F5:9F:FB:45:CE:4A GeoTrust doesn't publish that anywhere I can find but http://www.tbs-certificats.com/FAQ/en/603.html has it as -----BEGIN CERTIFICATE----- MIID2TCCAsGgAwIBAgIDAjbQMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVT MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9i YWwgQ0EwHhcNMTAwMjE5MjIzOTI2WhcNMjAwMjE4MjIzOTI2WjBAMQswCQYDVQQG EwJVUzEXMBUGA1UEChMOR2VvVHJ1c3QsIEluYy4xGDAWBgNVBAMTD0dlb1RydXN0 IFNTTCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJCzgMHk5Uat cGA9uuUU3Z6KXot1WubKbUGlI+g5hSZ6p1V3mkihkn46HhrxJ6ujTDnMyz1Hr4Gu FmpcN+9FQf37mpc8oEOdxt8XIdGKolbCA0mEEoE+yQpUYGa5jFTk+eb5lPHgX3UR 8im55IaisYmtph6DKWOy8FQchQt65+EuDa+kvc3nsVrXjAVaDktzKIt1XTTYdwvh dGLicTBi2LyKBeUxY0pUiWozeKdOVSQdl+8a5BLGDzAYtDRN4dgjOyFbLTAZJQ50 96QhS6CkIMlszZhWwPKoXz4mdaAN+DaIiixafWcwqQ/RmXAueOFRJq9VeiS+jDkN d53eAsMMvR8CAwEAAaOB2TCB1jAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFEJ5 VBthzVUrPmPVPEhX9Z/7Rc5KMB8GA1UdIwQYMBaAFMB6mGiNifurBWQMEX2qfWW4 ysxOMBIGA1UdEwEB/wQIMAYBAf8CAQAwOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDov L2NybC5nZW90cnVzdC5jb20vY3Jscy9ndGdsb2JhbC5jcmwwNAYIKwYBBQUHAQEE KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5nZW90cnVzdC5jb20wDQYJKoZI hvcNAQEFBQADggEBANTvU4ToGr2hiwTAqfVfoRB4RV2yV2pOJMtlTjGXkZrUJPji J2ZwMZzBYlQG55cdOprApClICq8kx6jEmlTBfEx4TCtoLF0XplR4TEbigMMfOHES 0tdT41SFULgCy+5jOvhWiU1Vuy7AyBh3hjELC3DwfjWDpCoTZFZnNF0WX3OsewYk 2k9QbSqr0E1TQcKOu3EDSSmGGM8hQkx0YlEVxW+o78Qn5Rsz3VqI138S0adhJR/V 4NwdzxoQ2KDLX4z6DOW/cf/lXUQdpj6HR/oaToODEj+IZpWYeZqF6wJHzSXj8gYE TpnKXKBuervdo5AaRTPvvz7SBMS24CqFZUE+ENQ= -----END CERTIFICATE----- which is an intermediate (not root) cert (verifiably) under Issuer: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA AKI C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E and THAT is "Root 2" (one of several) on http://www.geotrust.com/resources/root-certificates/index.html (also in the standard Windows, Firefox, and Java truststores) >What command do I use to make sure the key/pair that was sent to me >is compatible with GeoTrust's CA? Either concatenate the intermediate above and the correct root (also in PEM) into one file say geotrustCAs.pem and do: openssl verify -CAfile geotrustCAs.pem yourcertfile Or put them as separate files in some directory say mycadir, create hashnames using c_rehash or by hand, and do: openssl verify -CApath mycadir yourcertfile (The first is usually easier.) Assuming (as asked before) your opendlap is using openssl not MozillaNSS, to use a key&cert with an intermediate cert openssl requires either configuring a certchain file or putting the chain cert(s) in the truststore (even if the cert(s) or truststore aren't needed for verification). The manpage on http://linux.die.net/man/5/slapd-config does not indicate any option to configure a chain file; if that is true for the version you are using, use one of the above approaches with olcTLSCACertificateFile or Path .

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical