openldap-technical

openldap-technical@openldap.org

5 participants
9899 discussions

OpenLDAP multimaster
by 25Dollar Tech 02 Jul '13

02 Jul '13

Hello Team, I have a few concern about OpenLDAP multimaster restoration and migration. Scenario I have OpenLDAP multimaster configured on ubuntu 9.04 and OPenLDAP version is 2.4.15. i.e. NODE1 and NODE2 Unfortunatly NODE2 has crashed due to server hardware failure. and running my OpenLDAP infra for a while without multi-master server but I have multimaster confoguraiton on NODE1 which is working without any issues. Question 1) Is it possible to bind new OpenLDAP version and OS ubuntu 12.04 with existing OpenLDAP multimaster server; existing NODE1 server has config DB and HDB already configured and it contains more than 10000 entry. and NODE2 is already crashed. 2) If yes then what will be procedure to replicate config DB or how to equalize the database. -- *Thanks & Regards, 25dollarTech Team https://sites.google.com/site/25dollartech/* *Email: 25dollartechhelp(a)gmail.com*

2 1

pure_ftpd & LDAP
by maral 02 Jul '13

02 Jul '13

hey! I installed Pure-ftpd + Ldap and add a user in Ldap but Pure-ftpd don't recognize that user how can i fix this issue?

2 2

OpenLDAP Proxy using PKCS#11/SmartCard client authentication
by Stefan Scheidewig 01 Jul '13

01 Jul '13

Hello, we have two LDAP instances. LDAP A acts as proxy for LDAP B using the ldap-backend. Now we configured LDAP B to use client authentication. We successfully established a connection to LDAP B using OpenSSL s_client and the PKCS#11 engine (OpenSSL engine library). Now we want the LDAP proxy to establish the connection using this pkcs11 engine (we compiled the ldap proxy to use OpenSSL as TLS implementation). Is there a posibility to tell the LDAP proxy to use the certificate and key from the smartcard (e.g. something like pkcs11:slot_1-id_42) ? Thank you in advance, Stefan Scheidewig -- Mit freundlichen Grüßen, Stefan Scheidewig T-Systems Multimedia Solutions GmbH BU Content & Collaboration Solution PF 54 Integrated Content Portals Dipl.-Inf. Stefan Scheidewig Softwareentwickler Hausanschrift: Riesaer Str. 5, 01129 Dresden, Germany Postanschrift: Postfach 10 02 24, 01072 Dresden, Germany +49 351 2820 2924 (Tel) +49 351 2820 5118 (Fax) Stefan.Scheidewig(a)t-systems.com (E-Mail) Internet: http://www.t-systems-mms.com T-Systems Multimedia Solutions GmbH Aufsichtsrat: Klaus Werner (Vorsitzender) Geschäftsführung: Peter Klingenburg, Susanne Heger Handelsregister: Amtsgericht Dresden HRB 11433 Sitz der Gesellschaft Dresden Ust-IdNr.: DE 811 807 949

4 9

ACL - grant access to subtree by regex
by Ole 29 Jun '13

29 Jun '13

Hi, I'm really new to OpenLDAP and try to grant domain-admins access to their domain-subtree in our historicaly grown LDAP Structure. The Structure is like this: ou=somedomain.tld,ou=mail,dc=example,dc=tld ou=admins,ou=somedomain.tld,ou=mail,dc=example,dc=tld cn=admin(a)somedomain.tld,ou=admins,ou=somedomain.tld,ou=mail,dc=example,dc=tld The ACL I try to use (according to [1]) is: access to dn.regex=".+,ou=([^,]+),ou=mail,dc=example,dc=tld$" by dn.onelevel,expand="ou=admins,ou=$1,ou=mail,dc=example,dc=tld" write by * break but it doesn't take effect. After hours of thinking about the problem and searching in the internet I still can't get the poit. Thank you for reading, Ole [1] http://www.openldap.org/faq/data/cache/973.html

2 4

Types of Groups, Structural objects and Inheritance
by Brendan Kearney 29 Jun '13

29 Jun '13

list members, As a caveat to my ACLs, most of my groups are the posixGroup class. from what i understand, that means i need to use set ACLs, instead of group ACLs. this does not seem to be a big deal, and is covered in the admin guide. that being said, i am looking to find out what the functional differences between a posixGroup and groupOfNames are? are there significant reasons to use one over the other? in my environment, i have the ability to recreate all the posixGroup objects as groupOfNames objects, if it would help with the creation of ACLs and other work to be done. is that a worthwhile effort? In my searching, i have found an explicit reason to keep using the posixGroup type, as NFSv4 ACLs can only use posixGroup types of groups. the dependency is because of the use of memberUid attributes. would there be any other explicit reasons to use one group type over another? my users have inetOrgPerson as their structural class, and as such i cannot add the NFSv4RemotePerson class to their list of objectClass attributes. the NFSv4RemotePerson class is structural as well. i have heard about the ability to create a hierarchy of objectClass objects so that an object can inherit the properties of all the SUP classes. is there a way i can create this hierarchy to allow multiple structural class attributes to be inherited by user objects? i have not found much info around doing this. are there any pointers? thanks in advance, brendan

3 3

Openldap-2.4.35 TLS/SSl
by Darouichi, Aziz 29 Jun '13

29 Jun '13

Hi, I am trying to configure TLS/SSL and I have a Cert from Geotrust . I configure slapd.conf with the followings: # TLS/SSL information # TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /opt/local/etc/openldap/GeoTrust_Global_CA.cer TLSCertificateFile /opt/local/etc/openldap/rhea.curry.edu.pem.cer TLSCertificateKeyFile /opt/local/etc/openldap/rhea.key.pem But when I check the cert using "openssl s_client -connect 192.168.60.43:636 -CApath /opt/local/etc/openldap/" I get CONNECTED(00000003) 140230373582504:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 321 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE I checked the log I see TLS connection

3 2

LB health check during syncrepl refresh
by Michael Ströder 28 Jun '13

28 Jun '13

HI! Inspired by ITS#7616 and looking at our monitoring: If I bring up a syncrepl consumer with empty DB it seems contextCSN attribute is missing in DB base entry during refresh phase. This is nice because we could use that in the load-balancer health check to prevent clients to connect to this replica until all data is loaded into the consumer and contextCSN is present. So is it guaranteed that contextCSN is missing during lengthy refresh phase? Ciao, Michael.

2 1

Unable to edit cn=config
by Michael Roth 28 Jun '13

28 Jun '13

Hello openldap masters, I have a big issue and I'm praying someone can help me Am I able to change the ACL so I can edit cn=config to load a module in? If so how do I do that? How I setup my working LDAP with the script here: http://www.ghacks.net/2010/08/31/set-up-your-ldap-server-on-ubuntu-10-04/ I'm now using Ubuntu 12.04 Server x64 Working on this module here: http://raerek.blogspot.com/2012/06/sync-ldap-and-samba-passwords-using.html When I load changes into LDAP I'm denied. $ sudo ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f smbkrb5pwd_load.ldif modifying entry "cn=module{0},cn=config" ldap_modify: Insufficient access (50) $ sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f smbkrb5pwd_load.ldif ldap_sasl_interactive_bind_s: Unknown authentication method (-6) additional info: SASL(-4): no mechanism available: $ ldapsearch -xLLL -b cn=config -D cn=admin,cn=config -W olcDatabase=hdb olcAccess Enter LDAP Password: dn: olcDatabase={1}hdb,cn=config olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=domain,dc=net" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=admin,dc=domain,dc=net" write by * read Regards, ~Mike

2 6

MDB resizing
by Liam Gretton 28 Jun '13

28 Jun '13

I'm evaluating upgrading our LDAP services and moving from hdb to mdb. I don't seem to be able to get my MDB database to resize by changing the value of maxsize, whether increasing it or decreasing it. I'm using slapd.conf, so changes to the config require a restart. Looking at debug output when slapd starts I can see that the new value of maxsize is being read. If I delete the database and rebuild with slapadd then it's created with the new size. I see there was an ITS#7471 reporting a similar issue, but this was apparently fixed in 2.4.34 (if that's what RE24 is) - I'm using 2.4.35. In my config maxsize is the only MDB setting I've used, everything else will be using default values. Should it be possible to resize MDB this way? I haven't been able to track down much information about resizing beyond the issue report mentioned above. In practice I expect it's something that I'll rarely (if ever) have to do, but I'd like to at least understand what I should be able to do. -- Liam Gretton liam.gretton(a)le.ac.uk Systems Specialist http://www.le.ac.uk/its IT Services Tel: +44 (0)116 2522254 University of Leicester, University Road Leicestershire LE1 7RH, United Kingdom

1 0

Controlling access to users
by Mathew Wilson 28 Jun '13

28 Jun '13

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical