openldap-technical

openldap-technical@openldap.org

5 participants
9899 discussions

Using LDAP how to restrict users to certain applications only
by Geo P.C. 07 May '13

07 May '13

Hi We are using many applications like zabbix, phabricator, AC etc. We need to integrate LDAP in all these applications. These application support LDAP but not group based authentication. Please let us know is there any option to restrict selected users to login. We created all users under ou ‘users’ . [image: Inline image 1] On these application we need to login certain users only. How we can restrict it as we can’t able to restrict on application side In these application they provide only “Base DN” and “Search Attribute” so we can’t able to give dn: ou=users,ou=system as it gives access to all users. So is it possible to give Base DN as “cn=Zabbix,ou=groups,ou=system” and this group contains only user1 and user2. SO it will restrict users. Please let us know how we can implement this scenario. Thanks in advance please help us to solve this issue. Thanks Geo

3 4

Unable to login applications using LDAP alias
by Geo P.C. 07 May '13

07 May '13

We have several applications and we are able to integrate LDAP successfully. In application we have given base dn as ou=People,dc=geo,dc=com and the user dn: uid=geo_pc,ou=People,dc=geo,dc=com can able to login to the application successfully. Now we created an alias as follows: dn: uid=geo_pc,ou=Applications,ou=Groups,dc=geo,dc=com aliasedobjectname: uid=geo_pc,ou=People,dc=geo,dc=com objectclass: alias objectclass: extensibleObject objectclass: top uid: geo_pc Now in application we have given base dn as ou=Applications,ou=Groups,dc=geo,dc=com but with this user ou=Applications,ou=Groups,dc=geo,dc=com we are unable to login to the application. Please let us know is there any additional configuration we need to done. Can anyone please help us on it. Thanks Geo

2 1

password policy and pwdMustChange behavior
by Felix Schmitt 07 May '13

07 May '13

Hi, I'm installing an OpenLDAP directory server at a customer and we're also implementing password policies. We do have set the pwdMustChange attribute to true in our policy. During the tests I was a bit surprised that a user for which I've set the password did not require to change his password but was allowed access with the new password. Reading the documentation and the (expired) draft standard clearly suggests a different behavior. pwdMustChange (true or false) This attribute specifies with a value of "TRUE" that users must change their passwords when they first bind to the directory after a password is set or reset by a password administrator. If this attribute is not present, or if the value is "FALSE", users are not required to change their password upon binding after the password administrator sets or resets the password. This attribute is not set due to any actions specified by this document, it is typically set by a password administrator after resetting a user's password. Then I did some research on the web and found this thread http://www.openldap.org/lists/openldap-technical/201106/msg00178.html It seems an administrator needs to additionally set the pwdReset attribute to force the user to change the password. The question is: Why does an administrator need to set this attribute? Why isn't this done by the directory server on its own? The directory server does change a few other password policy related attributes as can be seen from the audit log (see below). Thus it should be possible to do the same for the pwdReset attribute. This behavior of OpenLDAP is different from what I'm used from the Sun (now Oracle) Directory Server where the pwdReset attribute is changed automatically. Best regards Felix # modify 1367849424 dc=telefonica,dc=com cn=Manager,dc=example,dc=com IP=192.168.186.141:52267 conn=1561 dn: uid=fbtwo,ou=people,dc=de,dc=telefonica,dc=com changetype: modify replace: userPassword userPassword:: e1NTSEF9VzNpZmtPRkROQTk0MCtmR3pIanZOcTdxbk9QUDArNTM= - replace: pwdChangedTime pwdChangedTime: 20130506141024Z - delete: pwdGraceUseTime - add: pwdHistory pwdHistory: 20130506141024Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}AU4VVldD3ct JnHil4AZPHnIC4G1aobhg - replace: entryCSN entryCSN: 20130506141024.395155Z#000000#001#000000 - replace: modifiersName modifiersName: cn=Manager,dc=example,dc=com - replace: modifyTimestamp modifyTimestamp: 20130506141024Z - # end modify 1367849424 ---- Felix Schmitt Blumenweg 24 phone: +49 8092 20796 D-85567 Grafing mobile: +49 172 842 99 12 Germany mailto:Felix-Schmitt@t-online.de

1 0

Unable to use TLS in a 2-WayMaster/MirrorMode Setup
by Thomas Macaigne 06 May '13

06 May '13

Hi, It's been a few days I'm trying to replicate my actual LDAP server on a new one. @(#) $OpenLDAP: slapd 2.4.21 (Dec 19 2011 15:18:58) $ buildd@roseapple:/build/buildd/openldap-2.4.21/debian/build/servers/slapd and @(#) $OpenLDAP: slapd (Oct 17 2012 19:48:41) $ buildd@komainu:/build/buildd/openldap-2.4.28/debian/build/servers/slapd for the replica. The replication part works great, but whenever I try to use TLS it fails. Here is how I proceed: - Genereate the certs (tried with CA.sh, CA.pl, certtools) -> I use the servers fqdn as CN (hostname --fqdn gives the right output) - Copy files to /etc/ldap/ssl - chmod 660 them and chown openldap:openldap An ouput of slapcat can be found here: http://paste.ubuntu.com/5638646/ When I try to check if TLS is working by using -ZZ of ldapsearch: ie: ldapsearch -xLLL -b dc=beware,dc=fr -D cn=admin,dc=beware,dc=fr -w motdepasse -H ldap://master.beware.fr/ -ZZ I get no error. The errors I get are: May 6 16:14:20 master slapd[1057]: slapd starting May 6 16:14:23 master slapd[1057]: slap_client_connect: URI=ldap://slave.beware.fr/ DN="cn=admin,cn=config" ldap_sasl_bind_s failed (-1) May 6 16:14:23 master slapd[1057]: do_syncrepl: rid=002 rc -1 retrying (4 retries left) May 6 16:14:23 master slapd[1057]: slap_client_connect: URI=ldap://slave.beware.fr Warning, ldap_start_tls failed (-1) May 6 16:14:26 master slapd[1057]: slap_client_connect: URI=ldap://slave.beware.fr DN="cn=admin,dc=beware,dc=fr" ldap_sasl_bind_s failed (-1) May 6 16:14:26 master slapd[1057]: do (on the slave) e.fr Error, ldap_start_tls failed (-1) May 6 16:14:55 slave slapd[1278]: do_syncrepl: rid=003 rc -1 retrying (4 retries left) May 6 16:15:00 slave slapd[1278]: slap_client_connect: URI=ldap://master.beware.fr/ DN="cn=admin,cn=config" ldap_sasl_bind_s failed (-1) May 6 16:15:00 slave slapd[1278]: do_syncrepl: rid=001 rc -1 retrying (3 retries left) May 6 16:15:00 slave slapd[1278]: slap_client_connect: URI=ldap://master.beware.fr Error, ldap_start_tls failed (-1) May 6 16:15:00 slave slapd[1278]: do_syncrepl: rid=003 rc -1 retrying (3 retries left) output of slapd -d 16383 5187bb09 slap_client_connect: URI=ldap://master.beware.fr Error, ldap_start_tls failed (-1) 5187bb09 daemon: activity on 1 descriptor 5187bb09 daemon: activity on:5187bb09 5187bb09 daemon: epoll: listen=7 active_threads=0 tvp=zero 5187bb09 daemon: epoll: listen=8 active_threads=0 tvp=zero 5187bb09 do_syncrepl: rid=003 rc -1 retrying (3 retries left) Regards,

2 1

invalid value for attributeType olcSuffix while restoring cn=config (slapd-2.4.33)
by Igor Zinovik 06 May '13

06 May '13

Hello, openldap-technical@ readers. I backed up cn=config from openldap-2.4.33 and now i try to restore it, but with no success. I made backup copy this way: ldap1# sudo slapcat -b cn=config -F /etc/openldap/slapd.d -l config.ldif After this i created new clean VM with opensuse 12.3 and slapd 2.4.33 opensuse# slapadd -u -F /etc/openldap/slapd.d -b cn=config -l config.ldif 5187acde str2entry: invalid value for attributeType olcSuffix #0 (syntax 1.3.6.1.4.1.1466.115.121.1.12) slapadd: could not parse entry (line=3206) _################### 98.19% eta none elapsed none spd 19.9 M/s opensuse# fgrep -n olcSuffix config.ldif 522:olcAttributeTypes: ( OLcfgDbAt:0.10 NAME 'olcSuffix' EQUALITY distinguishedNam 1049: n $ olcSuffix $ olcSubordinate $ olcAccess $ olcAddContentAcl $ olcLastMod $ 3205:olcSuffix: dc=example,dc=ru 3411:olcSuffix: cn=example-log LDIF content around line 3206 is following: 3201: dn: olcDatabase={1}mdb,cn=config 3202: objectClass: olcDatabaseConfig 3203: objectClass: olcMdbConfig 3204: olcDatabase: {1}mdb 3205: olcSuffix: dc=example,dc=ru 3206: olcAddContentAcl: FALSE Here is trace: 5187b22a <<< dnPrettyNormal: <olcDatabase={1}mdb,cn=config>, <olcDatabase={1}mdb,cn=config> 5187b22a >>> dnPretty: <dc=example,dc=ru> 5187b22a str2entry: invalid value for attributeType olcSuffix #0 (syntax 1.3.6.1.4.1.1466.115.121.1. 12) slapadd: could not parse entry (line=3201)

1 0

Use LDAP netgroup to control NFS exports?
by jupiter 06 May '13

06 May '13

Hi, I am running LDAP server and NFS server on CentOS 6, is it true that LDAP can be used to control NFS exports authentication, uid and gid setting without needing to specifie client IP addresses , anonuid and anongid on NFS exports file? I saw some sample such as to define "/tmp/nfs2 @mynetgrp(rw,no_root_squash)" to exports file, it seems to me, you can add new user with IP address to LDAP entry anytine without updating exports file in NFS server? If it is correct, has the netgroup schema already been defined in /etc/openldap/schema? Could anyone kindly point me a link for document or howto for the setting in both LDAP and NFS exports? Thank you. Kind regards. Jupiter

2 1

About ppolicy
by Jacques Foucry 06 May '13

06 May '13

Hello Folks, On my openldap server I was using shadowAccount to enforce password change for my users. It works, but it's not really secure. Users can reuse old passwors, etc. So I had a look to ppolicy and appli this tutorial: http://theslashroot.blogspot.fr/2011/12/openldap-with-ppolicy.html Some things are not clear for me. Did I have to disable shadowAccount on my schema? If not is shadowLastChange will be updated? I hope I need to include ppolicy schema on all my replica. Thanks in advance for your help, Jacques Foucry -- Jacques Foucry *NOVΛSPARKS * IT Manager Tel : +33 (0)1 42 68 12 61 jacques.foucry(a)novasparks.com

2 2

Modern Password Hashes in Openldap?
by Chris Hiestand 04 May '13

04 May '13

Since SSHA-1 is weak these days I'd like to switch to PBKDF2, Bcrypt or the like with key stretching. Since Openldap does not support relatively strong hashes, do you guys use SASL to store stronger hashes? If so, what kind of backend are you using to store hashes? Background: OclHashcat can generate tens of billions of SHA-1 hashes per second with off-the-shelf hardware. But it can only generate thousands of bcrypt hashes per second on similar hadware: https://hashcat.net/forum/thread-1541.html .

4 4

Questions about multiple identical values in a field
by Nicolas Mora 04 May '13

04 May '13

Hello, I'm currently programming a connector between a CardDAV server and a LDAP server in php. I'm using the schema inetOrgPerson which is good for most of the data but I have a problem with multiple equal data. The VCard data is set like this : ADR;TYPE=HOME:;;123 1st av;Montreal;QC;GGG RT3;CA which is translated into : street:: 123 1st av l: Montreal st:QC postalcode: GGG RT3 By default in the inetOrgPerson schema, the country code is not added, so I add a personalized schema with 2 fields : - countryCode ('c') - VCardUnassigned ('vcardunassigned') The second one is when a vcard field has no correspondance in the ldap schema Problem is, when you have multiple fields with the same value, you get an error 0x14 - LDAP_TYPE_OR_VALUE_EXISTS. Which is logical but kinda annoying if you want for example to add a second address in the same state or country, like : ADR;TYPE=HOME:;;321 42nd st;Montreal;QC;GGG RT1;CA Is there a way to save multiple equal values for an entry for some fields ?

4 3

Re: Questions about multiple identical values in a field
by Erwann Abalea 04 May '13

04 May '13

2013/5/3 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Friday, May 03, 2013 6:24 PM +0200 Erwann Abalea <eabalea(a)gmail.com> > wrote: > > Can't you use the postalAddress attribute? >> With your examples, it should be something like: >> postalAddress: 123 1st av$Montreal$QC$GGG RT3$CA >> >> postalAddress: 321 42nd st$Montreal$QC$GGG RT1$CA >> > > This is almost the correct way to format it... it should be: > > postalAddress: 123 1st av $ Montreal $ QC $ GGG RT3 $ CA > If I correctly read RFC2252, the space character around the "$" isn't required: postal-address = dstring *( "$" dstring ) dstring = 1*utf8 And the provided examples don't include such spaces. I would also note that there is no guaranteed return order for values > unless you use weighted attributes. Is the weighted attribute standardized LDAP, or specific to OpenLDAP? I can't find supportive definition in RFC45* documents. > Generally the best thing to do if you are going to have multiple > addresses (say home, work, business, mailing, etc) is to have custom > attributes specifically for those addresses > Or maybe a subordinate leaf for each address (with address elements splitted in several attributes), to be able to use search filters. -- Erwann.

4 5

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical