openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Start a nNew thread

Jim Vanes
by Jim Vanes 26 Feb '13

26 Feb '13

   http://www.locksmithsbethnalgreen.com/va/bm9wtj55qrblk7e27s4pn.gs39g?assmdd…   Jim Vanes2/26/2013 6:23:42 PM

1 0

Re: meta backend subtree directive ignored by conversion to cn=config
by francesco.policastro＠selex-es.com 26 Feb '13

26 Feb '13

Even worse: if I start the server using slapd.conf, not cn=config, the subtree-include directives seem to be ignored. With reference to the previously attached file if I search users from the root ( "dc=newco,dc=com") I find them also outside the included subtrees; e.g I find users under "ou=UsersDisable, ou=Users,ou=2nd-location,dc=first,dc=newco,dc=com". Is it there anything wrong in my config file? Did I misunderstand the directive? Thanks, Francesco Policastro

1 0

slapd, SASL passthrough and changing passwords smashing userPassword
by Tim Watts 25 Feb '13

25 Feb '13

Hi folks, I hope this is a quick and easy one :) I have slapd 2.4.23 working with passthrough to MIT kerberos via saslauthd. I use smbkrb5pwd (a hack on smbk5pwd) to pass password changes through to kerberos (creating or modifying the target principle as required) To enable a particular user to bind to slapd with their kerberos password, I'm setting: userPassword: {SASL}myuid(a)MY.KERBEROS.REALM.EXAMPLE.COM This works *very nicely*. Except one thing... Using passwd via pam_ldap or ldappasswd directly smashes userPassword: and replaces the value with the password hash. Both machanisms are doing EXOP password changes. Is there any way to stop this happening when the mechanism in userPassword is {SASL} ? Or maybe there is another way to enable global SASL password passthroughs? ====== I'm in a transition phase. I need to import the slapcat output from the old LDAP server to my new one. At this point, all authentication should be done with the existing userPassword hash. Password changes should update this hash and create/modify principles on the kerberos server. 3 months later, I want to switch the auth mechanism on all accounts to passthrough to kerberos, at which point, ldappasswd should still work but via smbkrb5pwd updating kerberos. Maybe my strategy is wrong, but that's the basic problem I need to solve. Am I trying this the wrong way? Cheers and thanks in advance for any ideas. Tim -- Tim Watts Personal Blog: http://www.dionic.net/tim/ "She got her looks from her father. He's a plastic surgeon."

3 4

Access permissions to add new entries
by Philip Colmer 25 Feb '13

25 Feb '13

Hi I wanted to run a scenario past everyone to see if there is a better approach to the one I am thinking of implementing. The OU structure we have is: +- dc=example,dc=com +-- ou=accounts +--- ou=subsidiary1 +--- ou=subsidiary2 +--- ou=special +--- ou=staff +--- ou=the-rest I have two groups defined - one group needs to be able to create new entries under the staff OU, and the other group needs to be able to create new entries under the OUs subsidiary1, subsidiary2 and the-rest. Nobody (except for LDAP admin) should be able to create entries under OU special. More specifically, I want group members to be able to *add* new entries but modification and deletion of entries should only be done by the LDAP admin. I *may* want to allow group members to modify entries in the future but certainly just add for now. A couple of notes about subsidiary1/subsidiary2: * they aren't really called that :-) * more will get added over time, with corresponding changes in permissions required. In other words, I can't use a regex to match against "subsidiary", but I want an ACL implementation that, if possible, can cope with future OUs being created without modifying the ACLs. So, my thinking is: 1. Have an ACL that blocks write access to "special". 2. Have an ACL that grants write access to "staff" for members of the staff account managers group. 3. Have one ACL that grants write access to all other OUs for members of the non-staff account managers group. If that makes sense ... access to dn.exact="ou=special,ou=accounts,dc=example,dc=com" attrs=children by * none access to dn.exact="ou=staff,ou=accounts,dc=example,dc=com" attrs=children by group="cn=account-mgrs-staff,ou=mailing,ou=groups,dc=example,dc=com" add by * none access to dn.sub="ou=staff,ou=accounts,dc=example,dc=com" attrs=entry by group="cn=account-mgrs-staff,ou=mailing,ou=groups,dc=example,dc=com" add by * none How do I do the rules for the other OUs? Can I have just two rules? One to allow access to the children attribute and one to allow access to the entry attribute? If so, it would need to be on the OUs *beneath* ou=accounts so that members of the group cannot create entries within ou=accounts. So would this work? access to dn.one="ou=accounts,dc=example,dc=com" attrs=children by group="cn=account-mgrs-non-staff,ou=mailing,ou=groups,dc=example,dc=com" add by * none access to dn.sub="ou=accounts,dc=example,dc=com" attrs=entry by group="cn=account-mgrs-non-staff,ou=mailing,ou=groups,dc=example,dc=com" add by * none I'm not sure if members of account-mgrs-non-staff would be blocked from adding to ou=staff ... Suggestions or help appreciated. Regards Philip

1 0

ppolicy overlay with sasl bind
by General Stone 23 Feb '13

23 Feb '13

Hello, can I use the ppolicy overlay wtih sasl binds? It seems, that it dosn't work?! Greetings Markus -- Key fingerprint = A0D9 F306 0FC0 30E7 62DB E785 A192 2A30 5CF1 224D ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Die Theorie ist immer nur so gut wie ihre Praxis. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

RE24 testing call (OpenLDAP 2.4.34)
by Quanah Gibson-Mount 22 Feb '13

22 Feb '13

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.34 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

4 14

new module overlay modtrigger
by Maarten Vanraes 22 Feb '13

22 Feb '13

Hey, a few years back i wrote an overlay module "modtrigger", that executes a script on modifications. Some of the comments i got was that it should really require to work with the new config structure. Finally i've done that, but i'm sure it could be improved. So, i'm kind of asking if someone can review it and give some pointers to improve. and next if it's possible to include in the openldap distribution, in the overlay section or contrib section.

2 4

slapd ACL to allow Password Modify exop by ldappasswd - but deny direct modification via ldapmodify
by Tim Watts 22 Feb '13

22 Feb '13

Hi, I've been through google and the man pages - no avail. If anyone can help, I'd be very grateful :) slapd.conf acl: access to attrs=userPassword by peername.path="/var/run/slapd/ldapi" manage by dn="cn=admin,dc=dighum,dc=kcl,dc=ac,dc=uk" manage by self write by * auth This allows ldappasswd to work, but of course, it also allows anybody to issue an ldapmodify against their own record and store a weak hash (eg {crypt} ) or worse, bypass my check_password plugin policy enforcer. Removing the "self write" line kills ldapmodify, but also seems to break the password modify exop issues by ldappasswd. So - how do I allow ldappasswd to work (which respects the policies and allows the server to hash the password using its default hash - SSHA1 in my case) whilst disallowing *direct* modify access to the userPassword: entry? Answers on a postcard, or a wet herring as appropriate :-| Many thanks! Tim -- Tim Watts Personal Blog: http://squiddy.blog.dionic.net/ http://www.sensorly.com/ Crowd mapping of 2G/3G/4G mobile signal coverage

1 1

ppolicy pwdCheckModule failure and still calling other overlays
by Tim Watts 21 Feb '13

21 Feb '13

I realise this is a long shot, but if pwdCheckModule is enabled in ppolicy AND the module it calls FAILS a prospective password (for being too weak) - should slapd actually be calling the next overlay in the stack?? Common sense says ppolicy should bomb out? Here are the overlay configs in slapd.conf: <backend hdb database stuff> overlay smbkrb5pwd smbkrb5pwd-enable krb5 smbkrb5pwd-krb5realm DIGHUM.KCL.AC.UK smbkrb5pwd-requiredclass posixAccount # # Password Policy - this runs check_password.so compiled from # /vol/source/ldap_check_password/1.0/check_password.c # # overlay ppolicy ppolicy_default "cn=default,ou=pwpolicies,dc=dighum,dc=kcl,dc=ac,dc=uk" ppolicy_use_lockout ppolicy_hash_cleartext The idea is: ppolicy is configured to call my own password_check.so and that works nicely - that exits with EXIT_FAILURE if it fails. smbkrb5pwd is OpinSys.fi's modification to smbk5pwd to work with MIT kerberos. That works too (after I fixed something). It will set the principle's password and create the principle is it doesn't exist. The failure scenario is: 1) No principle for the UID in question; 2) The UID in question has a DN in slapd; 3) Set password for UID - choose one that will fail the ppolicy checks; 4) do an ldappasswd change for UID Result: ldappasswd says it fails and the user password hash in slapd is not changed. However, smbkrb5pwd was still called and managed to create a principle for UID with the weak password - bypassing the policy. The best answer to my mind is: Fix smbkrb5pwd to be able to add a default kerberos policy to any created principles. Such a policy can replace ppolicy for password strength checking. I think I can do this. However, it bothers me - is there no way to make the failure of one overlay bomb the stack out (rather like PAM)? Or perhaps ppolicy is not actually "failing" as such?? Any ideas? Cheers! Tim -- Tim Watts Personal Blog: http://squiddy.blog.dionic.net/ http://www.sensorly.com/ Crowd mapping of 2G/3G/4G mobile signal coverage

1 0

Indices is missing?
by Vit Dua 21 Feb '13

21 Feb '13

Hi, I have indexed my mdb by: slapcat -f slapd.conf -q After that, I can find entries quickly with the filter: mail=viet...(a)example.com But I cannot find the entry: mail=viet2000000(a)example.com,dc=example,dc=com with that filter. However, I can search that entry with other filter: mail=viet200000*(a)example.com My slapd.conf: index mail eq Thanks, Viet

3 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical