openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

How to configure ubuntu server with LDAP group based authentication
by Geo P.C. 02 May '13

02 May '13

By installing libnss-ldap we are able to integrate an Ubuntu server with ldap (openldap). But we are unable to configure ldap group based authentication. We need to configure in such a way that user from a particular group need only to login. Please let me know is it possible configure it and please update us the steps or any url. Thanks Geo

3 3

Need help to configure OpenLDAP!!
by pradyumna dash 02 May '13

02 May '13

Hi, Am facing an issue while configuring OpenLDAP. My suffix looks like below in the *slapd.conf* file and apart from the default schema i have used ppolicy. database bdb suffix "dc=example,dc=com,dc=in" rootdn "cn=Manager,dc=example,dc=com,dc=in" # SAG: 20100203 overlay ppolicy ppolicy_default "cn=default,ou=policies,o=test,dc=example,dc=com,dc=in" ppolicy_use_lockout I have prepared the below LDIF to add *test.ldif* ====== dn: dc=com,dc=in dc: com objectClass: top objectClass: domain dn: dc=example,dc=com,dc=in dc: example objectClass: top objectClass: domain dn: ou=People,dc=example,dc=com,dc=in ou: People objectClass: top objectClass: organizationalUnit dn: ou=Group,dc=example,dc=com,dc=in ou: Group objectClass: top objectClass: organizationalUnit Am using the below command to add this LDIF file: *ldapadd -x -W -D "cn=Manager,dc=example,dc=com,dc=in" -f /opt/test.ldif* But am getting the below error. * "adding new entry "dc=com,dc=in" ldap_add: Server is unwilling to perform (53) additional info: no global superior knowledge**"* Please help. Regards, /Neo

5 4

The problem of BINDDN/BINDPW in ldap.conf (2nd time)
by Madas Pál 01 May '13

01 May '13

Earlier thread: > Tianyin Xu asked, Howard Chu answered: > > > ... > > This works quite fine. Then, I write the parameters into ldap.conf as follows: > > -----------------ldap.conf----------------------- > BASE dc=ucsd,dc=edu > BINDDN cn=admin,dc=ucsd,dc=edu > BINDPW 12345 > ----------------------------------------------------- > > Then only BASE has effect. According to the ldap.conf manual, BINDDN is a > > ... > > Those were not OpenLDAP's ldap.conf. BINDPW isn't mentioned in > OpenLDAP documentation because it does not exist in OpenLDAP. Reading > non-OpenLDAP documentation and attempting to apply it to OpenLDAP > software is a pretty reliable means of confusing yourself. My question: It has been clearly stated, that BINDPW cannot be used in ldaprc (at least in the case of openldap). But it is definitely stated in the manpage of ldap.conf, that BINDDN is a legal user-only option of openldap. My ldaprc says: BASE ou=madas,dc=something BINDDN cn=admin,dc=something TLS_REQCERT allow URI ldaps://ip1.ip2.ip3.ip4 BASE and URI has its effect, BINDDN has not. Did I make a mistake? Thank you in advance. man ldap.conf: ... AUTHOR Kurt Zeilenga, The OpenLDAP Project ACKNOWLEDGEMENTS OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from University of Michigan LDAP 3.3 Release. OpenLDAP 2011/11/24 LDAP.CONF(5) ...

2 1

slapd 2.4.33 changes 'dc' to 'ou' after cn=schema,cn=config modification
by Igor Zinovik 30 Apr '13

30 Apr '13

Hello. I'm running openldap 2.4.33 with on-line configuration (slapd-config). Before running slapd with on-line configuration i developed my own schema and after that i converted old fashioned slapd.conf to slapd.d. Today i modified one attribute in my schema from this: olcAttributeTypes: {9}( 2.16.840.1.113730.3.1.217 NAME 'spamassassin' DESC 'Sp amAssassin user preferences settings' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) to this olcAttributeTypes: {9}( 2.16.840.1.113730.3.1.217 NAME 'spamassassin' DESC 'Sp amAssassin user preferences settings' SUP name ) I was binded to cn=config with DN that is not part of that tree, my dn was uid=zinovik,ou=people,dc=...,dc=ru So after that change i noticed that i see following messages while running slaptest: ldap1:~ $ sudo slaptest -vF /etc/openldap/slapd.d 51800ba4 PROXIED attributeDescription "OU" inserted. 51800ba4 PROXIED attributeDescription "DC" inserted. config file testing succeeded I pointed out that this happened because i modified entries in cn=config with modifierName not being part of cn=config namespace. But that is not a problem. Problem happens when i do following ldap1:~ $ cat example.com.ldif dn: dc=example.com,ou=Mail,dc=...,dc=ru objectClass: top objectClass: domain objectClass: amavisAccount dc: example.com amavisLocal: TRUE ldap1:~ $ ldapadd -v -ZZxWD uid=zinovik,ou=people,dc=...,dc=ru -f example.com.ldif add objectClass: top domain amavisAccount add dc: example.com add amavisLocal: TRUE adding new entry "dc=example.com,ou=Mail,dc=...,dc=ru" modify complete ldap1:~ $ ldapsearch -LLLZZxWD uid=zinovik,ou=people,dc=...,dc=ru -b ou=Mail,dc=...,dc=ru -s one '(&)' Enter LDAP Password: dn: dc=example.com,ou=Mail,dc=...,dc=ru objectClass: top objectClass: domain objectClass: amavisAccount ou: example.com amavisLocal: TRUE Why i do not see 'dc' attribute in this entry and why 'ou' appeared? Trace of this operation: 51800cc6 >>> dnPrettyNormal: <dc=example.com,ou=Mail,dc=...,dc=ru> 51800cc6 <<< dnPrettyNormal: <dc=example.com,ou=Mail,dc=...,dc=ru>, <dc=example.com,ou=mail,dc=...,dc=ru> 51800cc6 ==> unique_add <dc=example.com,ou=Mail,dc=...,dc=ru> 51800cc6 oc_check_required entry (dc=example.com,ou=Mail,dc=...,dc=ru), objectClass "domain" 51800cc6 oc_check_required entry (dc=example.com,ou=Mail,dc=...,dc=ru), objectClass "amavisAccount" 51800cc6 oc_check_allowed type "objectClass" 51800cc6 oc_check_allowed type "dc" 51800cc6 oc_check_allowed type "amavisLocal" 51800cc6 oc_check_allowed type "structuralObjectClass" 51800cc6 mdb_dn2entry("dc=example.com,ou=mail,dc=...,dc=ru") 51800cc6 => mdb_dn2id("dc=example.com,ou=mail,dc=...,dc=ru") 51800cc6 <= mdb_dn2id: get failed: MDB_NOTFOUND: No matching key/data pair found (-30798) 51800cc6 => mdb_entry_decode: 51800cc6 <= mdb_entry_decode 51800cc6 mdb_dn2entry("cn=ldap admins,ou=groups,dc=...,dc=ru") 51800cc6 => mdb_dn2id("cn=ldap admins,ou=groups,dc=...,dc=ru") 51800cc6 <= mdb_dn2id: got id=0xfab 51800cc6 => mdb_entry_decode: 51800cc6 <= mdb_entry_decode 51800cc6 mdb_entry_get: rc=0 51800cc6 => mdb_dn2id_add 0x1f19: "dc=example.com,ou=mail,dc=...,dc=ru" 51800cc6 <= mdb_dn2id_add 0x1f19: 0 51800cc6 => index_entry_add( 7961, "dc=example.com,ou=Mail,dc=...,dc=ru" ) 51800cc6 <= index_entry_add( 7961, "dc=example.com,ou=Mail,dc=...,dc=ru" ) success 51800cc6 => mdb_entry_encode(0x00001f19): dc=example.com,ou=Mail,dc=...,dc=ru 51800cc6 <= mdb_entry_encode(0x00001f19): dc=example.com,ou=Mail,dc=...,dc=ru 51800cc6 mdb_add: added id=00001f19 dn="dc=example.com,ou=Mail,dc=...,dc=ru" 51800cc6 send_ldap_result: conn=1000 op=2 p=3 When i try to modify attribute: dn: dc=example.com,ou=Mail,dc=...,dc=ru changetype: modify add: dc dc: example.com I get: modifying entry "dc=example.com,ou=Mail,dc=...,dc=ru" ldap_modify: Object class violation (65) additional info: attribute 'ou' not allowed Even my root object lost its 'dc' attribute somehow: ldap1: ~$ ldapsearch -LLLZZxWD uid=zinovik,ou=people,dc=...,dc=ru -b dc=...,dc=ru -s base '(&)' dn: dc=...,dc=ru ou: ... objectClass: organization objectClass: dcObject o: my organization If it matters i use slapd-mdb as storage backend. I did not changed 'dc' and 'ou': ldap1:~ $ ldapsearch -LLLZZxWD uid=zinovik,ou=people,dc=...,dc=ru -b 'cn={0}core,cn=schema,cn=config' '(&)' olcAttributeTypes|egrep -e "'(ou|dc)'" Enter LDAP Password: olcAttributeTypes: {8}( 2.5.4.11 NAME ( 'ou' 'organizationalUnitName' ) DESC ' olcAttributeTypes: {49}( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domainCompone I do not use slapo-rwm. Here are my overlays for dc=...,dc=ru: dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcMemberOf olcOverlay: {0}memberof olcMemberOfDangling: ignore olcMemberOfRefInt: TRUE olcMemberOfGroupOC: groupOfNames olcMemberOfMemberAD: member dn: olcOverlay={1}refint,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcRefintConfig olcOverlay: {1}refint olcRefintAttribute: seeAlso olcRefintAttribute: uniqueMember olcRefintAttribute: member olcRefintNothing: cn=EMPTY dn: olcOverlay={2}unique,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcUniqueConfig olcOverlay: {2}unique olcUniqueURI: ldap:///ou=Hosts,dc=...,dc=ru?ipHostNumber?sub olcUniqueURI: ldap:///ou=People,dc=...,dc=ru?uid,uidNumber?sub olcUniqueURI: ldap:///ou=Groups,dc=...,dc=ru?cn,gidNumber?sub olcUniqueURI: ldap:///ou=Mail,dc=...,dc=ru?mail,mailLocalAddress?sub dn: olcOverlay={3}syncprov,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig olcOverlay: {3}syncprov olcSpCheckpoint: 200 20 olcSpSessionlog: 100

1 0

slapschema and slapd-mdb
by Igor Zinovik 30 Apr '13

30 Apr '13

Hello. Is it safe to run slapschema with slapd-mdb(5) (while slapd is running in r/w mode)?

1 0

replicating a special objectclass with a seperate syncrepl statement
by Al 30 Apr '13

30 Apr '13

Hi, I am wondering if it is possible to have two syncrepl statements on a consumer that pull from the same source, but do so with a different set of parameters and filters that ensure their is no overlap. Below is an example of what I am interested in trying: olcSyncRepl: rid=001 provider=ldap://server1.example.com binddn="MANAGERDN" bindmethod=simple credentials=$PASSWD searchbase="$BASEDN" type=refreshAndPersist retry="5 5 300 5" timeout=1 filter="(!(objectclass=mygroup))" olcSyncRepl: rid=002 provider=ldap://server1.example.com binddn="MANAGERDN" bindmethod=simple credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly interval=00:00:10:00 retry="5 5 300 5" timeout=1 filter="(objectclass=mygroup)" Basically, I am interested in syncing certain groups occasionally (they have a custom objectclass), but everything else as quickly as possible. Thanks! Al

1 0

Chaining stops working after slapd restart
by jeevan kc 29 Apr '13

29 Apr '13

Hi, I am trying to setup a chain overlay to allow writes to a read-only slave to be chained up to the master. dn: olcOverlay={0}chain,olcDatabase={-1}frontend,cn=configchangetype: add objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: {0}chain dn: olcDatabase=ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config changetype: add objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDBURI: ldap://10.1.0.3/ olcDbIDAssertBind: bindmethod=simple binddn="cn=admin,dc=example,dc=com" credentials=********** mode=self This works until I have to restart the slave ldap server. Can anyone help me fix this problem?

2 1

slow replication
by Meike Stone 29 Apr '13

29 Apr '13

Hello, I've a problem with the speed of replication. I've set up openldap 2.4.33 with a Master and one consumer. At the moment the full replaction takes abaout 32hours. No LDAP operations are made on master or consumer during this time. (I know, i depends on Hardware too, but the two servers are fast ) How long should it need, to replicate a DB from about 6GByte (id2entry.bdb + dn2id.bdb) with 1.6M DN's and about 66M Attributes. Replication is configured with RefreshAndPersist, no DeltaSync. Both servers are on the same IP segment, connected via gigabit ethernet switch. I played in test environment with different parameters: - shm_key - dbnosync - switched off all indexes on consumer except entryUUID and entryCSN - different bdb cachesize - noatime, relatime - ext3/xfs I locked on disk via iostat (nothing seen), no io waits with top, looked on network, but max 5Mbit/s is used, I listen with strace on slapd and I see, that slapd is reading from Network and wrinting it to id2entiry.bdb. Before each Test, I deleted complete ldap db (except DB_CONFIG) and shared memory ipcrm -m Are there similar limitations, that will trigger slow replication like BDB_IDL_LOGN? How can I accelerate this Replication. I'm of the opinion that it was significantly faster with a smaller database. Thanks and kindly regards Meike Configuration: -------------------- Configuration is only a test configuration, some values differs, some are commented out because of playing with them. # Master (Provider) ========================================================== include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/yast.schema include /etc/openldap/schema/rfc2307bis.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_bdb moduleload syncprov sizelimit -1 timelimit 300 tool-threads 8 threads 8 serverID 001 ######################################## database bdb suffix "ou=root" rootdn "cn=admin,ou=root" #loglevel stats sync loglevel 0 rootpw <password> directory /DATA/ldap #cachesize 500000 #dncachesize 500000 #idlcachesize 150000 cachefree 500 dirtyread dbnosync shm_key 7 checkpoint 4096 15 index objectClass,entryUUID,entryCSN eq index cn eq,sub index ownattributes .... overlay syncprov syncprov-checkpoint 100 5 # Consumer ========================================================== include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/yast.schema include /etc/openldap/schema/rfc2307bis.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_bdb moduleload syncprov sizelimit -1 timelimit 300 serverID 002 #loglevel stats sync loglevel 0 ######################################## database bdb suffix "ou=root" rootdn "cn=admin,ou=root" checkpoint 4096 15 rootpw <password> directory /DATA/ldap dbnosync shm_key 7 checkpoint 4096 15 #cachesize 100000 #dncachesize 100000 #idlcachesize 150000 #cachefree 500 #dirtyread syncrepl rid=020 provider=ldap://192.168.1.10 type=refreshAndPersist retry="5 5 300 +" searchbase="ou=root" attrs="*,+" bindmethod=simple binddn="cn=admin,ou=root" credentials=<password> index entryUUID,entryCSN eq #index cn eq,sub mirrormode FALSE

3 5

translucent overlay and memberof overlay together?
by Steve Eckmann 29 Apr '13

29 Apr '13

Are the translucent and memberof overlays supposed to work together? I have one mdb backend with "native" accounts, and another mdb backend for "remote" accounts using the translucent overlay to proxy a remote AD. I want to be able to add remote account entries to groups in the native branch and have a memberof attribute automatically instantiated in the already added local entry associated with the remote entry. That isn't happening, and what I see in the log is something like: memberof_value_modify DN="cn=xxx,ou=users,ou=remote,dc=example,dc=com" add myMemberOf="cn=myGroup,ou=Groups,ou=Native,dc=example,dc=com" failed err=32 The local objectClass for user entries has myMemberOf as a DN-valued attribute (I tried using the builtin "memberOf", but when that didn't work I thought there might be a conflict between the remote attribute name and the local attribute name). I have the memberof overlay applied to both mdb backends. I guess what I'm trying to do is going across backends. Is that an incorrect/unsupported use of the memberof overlay? Thanks. Steve

1 0

back-sql: restart slapd while new entry ldap_entries view
by hornuda 27 Apr '13

27 Apr '13

Hello, I set up a openldap-server with postgresql backend. Everything works fine but: On http://www.wingfoss.com/content/sample-mysql-for-openldap-back-sql you can read you have to restart the slapd server everytime you change one of the ldap_* tables. But my ldap_entries table is a view but I also have to restart slapd, is this a normal behavior? Thank you! hornuda

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical