openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

A bit confused about rootpw
by D C 16 Apr '13

16 Apr '13

I'm trying to replicate a production problem, so I setup a test server. I rsynced everything from /etc/openldap and /var/lib/ldap, and confirmed that both systems have the same exact openldap packages installed. For some reason on the test box, I cannot bind as the rootdn, it keeps saying invalid credentials. reluctantly, i've updated slapd.conf with a new rootpw, but that doesn't seem to be working either. I've ran grep -RHi olcRootPW on the slapd.d directory, but it came back with nothing. Any thoughts? rsync options used "-avz --delete" Thanks, Dan

2 2

RE: help -- Regarding the jks certificate error
by Chris Jacobs 15 Apr '13

15 Apr '13

> Hi, > > // Either explicitly tell your tools to trust the CA for the cert via config or the > command line – How do I tell my tools (which tools?) to trust the CA for the > cert in config or the cmd line? > > I have put all the certs in my openldaps client ldap.conf file. All the jks certs > are created by kaytool command. > None of the below work : > > #TLS_CACERT /etc/openldap/cacerts/123keystore.jks // server is started > using jks certificates for secure connections.. this is not working TLS_CACERT > /etc/openldap/cacerts/789server.cer // This didn’t work # TLS_CACERT > /etc/openldap/cacerts/789server.pem // I converted the cer to pem file.. > But even this didn’t work TLS_CACERTDIR /etc/openldap/cacerts > > // Perhaps even (I'm mostly guessing) adding the CA to your systems trusted > CA certs Start by getting your CA's cert. – how to add CA to my clients trusted > CA certs? CJ: That's on a per OS basis. It's rarely made easy. But after more reading, unlikely to help you. > In openldap cmd ldapsearch, there is no option to specify the cert path. It > picks the cert files/dir from the /etc/openldap/ldap.conf CJ: I was mistaken. I thought there was. > Jks(java key store) certs(created by the server) work with openldap clients > by just copying the certs to client machine and adding the path in ldap.conf > file ? Or do we need pem certs only? CJ: We use base64 encoded certs. I tried looking into what type of cert was acceptable to openldap, but failed to find it. The cert should look similar to: -----BEGIN CERTIFICATE----- MIIF3jCCBMagAwIBAgIKf/7gwAAAAAAJ5zANBgkqhkiG9w0BAQUFADBVMRMwEQYK [plenty of lines similar] Vtm/MSZk5cBjnM84+MK3sVdE -----END CERTIFICATE----- > I am a newbie..Pls guide me..Thanks. CJ: I'm not that much better I'm afraid. Some things to consider: Make sure you're putting the CA's cert for openldap to ref, and not the actual cert being used. If you find yourself still stuck, try reading: http://www.openldap.org/faq/data/cache/185.html and make sure you understand CAs, certs signed by that CA, etc. We've some JKS certs we have to monitor in our environment, and we use the following to export java/JKS certs to x509 Base64 encoded PEM format: keytool -exportcert -keystore [store-with-CA-cert] -alias [alias-name-of-CA-cert] -storepass [password] -rfc Use that cert with your ldap toolset. > Regards, > Sridhar Sontha > > > > From: Chris Jacobs [mailto:Chris.Jacobs@apollogrp.edu] > Sent: Friday, April 12, 2013 9:39 PM > To: Sontha, Sridhar; 'openldap-technical(a)openldap.org'; 'openldap- > technical-request(a)openldap.org' > Subject: Re: help -- Regarding the jks certificate error > > Your cert is self signed and not trusted by your client. > > Either explicitly tell your tools to trust the CA for the cert via config or the > command line. Perhaps even (I'm mostly guessing) adding the CA to your > systems trusted CA certs. > > Start by getting your CA's cert, and reading the ldapsearch man page. > > - chris > > ________________________________________ > From: openldap-technical-bounces(a)OpenLDAP.org <openldap-technical- > bounces(a)OpenLDAP.org> > To: openldap-technical(a)openldap.org <openldap- > technical(a)openldap.org>; openldap-technical-request(a)openldap.org > <openldap-technical-request(a)openldap.org> > Sent: Fri Apr 12 20:24:03 2013 > Subject: help -- Regarding the jks certificate error Hi There, > I am using an ldap server created using unbounded ldap API (Java). And > the server is started to support both ldap and ldaps. Sever uses java > keystore (.jks) certificates namely 123keystore.jks and 456truststore.jks and > some 789server.cer (all these files are protected by some passoword). The > server is listening at port # 1636 for all ldaps connections. > I am able to connect to the server using (ldaps) some java ldap clients and > able to bind and search successfully. But when I try to connect to the server > using openldap client, it is NOT working, getting SSL > routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed error. > > I get the below error when I try to do the search using ldaps://<ip>:1636 > > ldapsearch -w 'xxxxxx1234' -H ldaps://xx.xx.xx.xxx:1636 -b > "o=person,o=hp" -D "id=xxxx89,o=person,o=hp" > > [bea@devcg4sdmbl01 ldapsearch -w 'xxxxxx1234' -H > ldaps://xx.xx.xx.xxx:1636 -b "o=person,o=hp" -D > "id=xxxx89,o=person,o=hp" > ldap_create > ldap_url_parse_ext(ldaps://x.x.x.x:1636) > ldap_pvt_sasl_getmech > ldap_search > put_filter: "(objectclass=*)" > put_filter: simple > put_simple_filter: "objectclass=*" > ldap_send_initial_request > ldap_new_connection 1 1 0 > ldap_int_open_connection > ldap_connect_to_host: TCP xx.x.xx.xx:1636 > ldap_new_socket: 3 > ldap_prepare_socket: 3 > ldap_connect_to_host: Trying 10.0.59.164:1636 > ldap_connect_timeout: fd: 3 tm: -1 async: 0 TLS trace: > SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 > write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS > certificate verification: depth: 0, err: 18, subject: > /C=xxx/ST=x/L=xxx/O=xxxx/OU=xxx/CN=xxx, > issuer: /C=xxx/ST=xxx/L=xxxx/O=xxxxx/OU=xxx/CN=xxxxx > TLS certificate verification: Error, self signed certificate TLS trace: SSL3 alert > write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server > certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B > TLS: can't connect. > ldap_perror > ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) > additional info: error:14090086:SSL > routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed > > Here is my ldap.conf : located at /etc/openldap/ldap.conf > > URI ldaps://x.x.x.x:1636/ > BASE o=person,o=hp > HOST <IP> > PORT 1636 > #TLS_CACERT /etc/openldap/cacerts/123keystore.jks // server is started > using jks certificates for secure connections.. this is not working TLS_CACERT > /etc/openldap/cacerts/789server.cer // This didn’t work # TLS_CACERT > /etc/openldap/cacerts/789server.pem // I converted the cer to pem file.. > But even this didn’t work TLS_CACERTDIR /etc/openldap/cacerts > TLS_REQCERT require > > What is the correct configuration to make this work? Can I use the jks > certificates in openldap client to connect to server which is using jks for > ldaps connections? What is missing here? Pls help fix this issue. > Same openldap client works fine for non-secure and simple authentication > ldap connections. The problem is only when I try to use ldaps from the > client. > > Thanks in advance. Let me know if you need more info. > > > Regards, > Sridhar Sontha > > > > > ________________________________________ > This message is private and confidential. If you have received it in error, > please notify the sender and remove it from your system. > This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

2 2

Merge two LDAP store in one proxy with attribute mapping?
by Yoann Gini 14 Apr '13

14 Apr '13

Hello, Actually working on a Samba 3.x integration on an Apple OpenDirectory, I’m wondering one thing. Is that possible to make a LDAP proxy composing record as a proxy from two existing LDAP database? For example, I’ve one LDAP db with my user and an other with my password hash, I would like to try to create a third LDAP access point to get a unified access to both informations. Best regards, Yoann

2 2

Augmented data in a proxy?
by Yoann Gini 14 Apr '13

14 Apr '13

Hello, Actually working on a Samba 3.x integration on an Apple OpenDirectory, I’m wondering one thing. Is it possible to use proxy feature of LDAP to augment existing data ? For example, I would like to extend the Apple LDAP schema by adding the Samba support but I don’t want to store this additional data in the main store. If it’s possible, I would like to use a dedicated LDAP server configured to use my original LDAP server as backend and who can be allowed to store locally extra data from specific schema. Do you know a way to do that? Best regards, Yoann

2 2

help -- Regarding the jks certificate error
by Sontha, Sridhar 13 Apr '13

13 Apr '13

Hi There, I am using an ldap server created using unbounded ldap API (Java). And the server is started to support both ldap and ldaps. Sever uses java keystore (.jks) certificates namely 123keystore.jks and 456truststore.jks and some 789server.cer (all these files are protected by some passoword). The server is listening at port # 1636 for all ldaps connections. I am able to connect to the server using (ldaps) some java ldap clients and able to bind and search successfully. But when I try to connect to the server using openldap client, it is NOT working, getting SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed error. I get the below error when I try to do the search using ldaps://<ip>:1636 ldapsearch -w 'xxxxxx1234' -H ldaps://xx.xx.xx.xxx:1636 -b "o=person,o=hp" -D "id=xxxx89,o=person,o=hp" [bea@devcg4sdmbl01 ldapsearch -w 'xxxxxx1234' -H ldaps://xx.xx.xx.xxx:1636 -b "o=person,o=hp" -D "id=xxxx89,o=person,o=hp" ldap_create ldap_url_parse_ext(ldaps://x.x.x.x:1636) ldap_pvt_sasl_getmech ldap_search put_filter: "(objectclass=*)" put_filter: simple put_simple_filter: "objectclass=*" ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP xx.x.xx.xx:1636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.0.59.164:1636 ldap_connect_timeout: fd: 3 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 18, subject: /C=xxx/ST=x/L=xxx/O=xxxx/OU=xxx/CN=xxx, issuer: /C=xxx/ST=xxx/L=xxxx/O=xxxxx/OU=xxx/CN=xxxxx TLS certificate verification: Error, self signed certificate TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. ldap_perror ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Here is my ldap.conf : located at /etc/openldap/ldap.conf URI ldaps://x.x.x.x:1636/ BASE o=person,o=hp HOST <IP> PORT 1636 #TLS_CACERT /etc/openldap/cacerts/123keystore.jks // server is started using jks certificates for secure connections.. this is not working TLS_CACERT /etc/openldap/cacerts/789server.cer // This didn't work # TLS_CACERT /etc/openldap/cacerts/789server.pem // I converted the cer to pem file.. But even this didn't work TLS_CACERTDIR /etc/openldap/cacerts TLS_REQCERT require What is the correct configuration to make this work? Can I use the jks certificates in openldap client to connect to server which is using jks for ldaps connections? What is missing here? Pls help fix this issue. Same openldap client works fine for non-secure and simple authentication ldap connections. The problem is only when I try to use ldaps from the client. Thanks in advance. Let me know if you need more info. Regards, Sridhar Sontha

2 2

pwdReset - ldapmodify : Undefined attribute type (17)
by cbulist＠gmail.com 12 Apr '13

12 Apr '13

Hi, I'm trying to add pwdReset attribute to a user in order to reset the user password but It fails. I added the pwdReset attribute to the schema using Apache Directory Studio but I'm getting the same error. Any recommendation?...Thanks!! This is the command that I run: ldapmodify -c -H ldap://localhost -x -D "cn=Manager,dc=sample,dc=com" -w "password" <<EOF dn: uid=aaa,ou=People,dc=sample,dc=com changetype: modify replace: userPassword userPassword:test changetype: modify add: pwdReset pwdReset: TRUE EOF This is the output: ldapmodify: Undefined attribute type (17) additional info: changetype: attribute type undefined

2 1

ldapadd failing with mdb backend
by Chris Card 12 Apr '13

12 Apr '13

Hi, I'm doing some testing with an mdb backend with the openldap 2.4.35, and I'm seeing an issue where ldapadd is failing for an object which worked fine with a bdb backend. The error from ldapadd is "ldap_add: Other (e.g., implementation specific) error (80)" and when I run slapd with "-d -1" I see the error "mdb_add: dn2id_add failed: Invalid argument (22)" in the debug logging. Running an unoptimized slapd under gdb I have traced the error to lines 4887-8 in mdb.c, in mdb_cursor_put: if (F_ISSET(mc->mc_db->md_flags, MDB_DUPSORT) && data->mv_size > MDB_MAXKEYSIZE) return EINVAL; and from gdb I can see that data->mv_size = 512: (gdb) p *data $1 = {mv_size = 512, mv_data = 0x2f2e858} The error appears to be related to the length of the DN of the object being added, but there are longer DNs in the directory which were loaded successfully with slapadd. Any ideas? Chris

2 1

Users quotas with LDAP.
by Luis H. Forchesatto 12 Apr '13

12 Apr '13

Greetings. What is the best wat to store user disk quotas on LDAP. I got two (and there will be more) servers running and both will authenticate on LDAP. What are the best ways to manage user quotas with LDAP? -- Att.* *** Luis H. Forchesatto

2 1

LDAP search from Active Directory 2008r2
by John 11 Apr '13

11 Apr '13

Hi all, We are doing LDAP search from our Active Directory, the AD enabled "Require signing" option, please see the attachement. We can't let it work right now. I did online google search, LDAP SASL should be the way. But are there any reference or guide to install and configure LDAP SASL? Thanks John

1 0

back-perl not working with cn=config
by Benin Technologies 11 Apr '13

11 Apr '13

Hi, I'm unable to set up a back-perl backend directly in cn=config mode. However, if I set it up in slapd.conf mode, and then convert it to cn=config mode, it works fine. It's not convenient, because I have to set all my perl backends up before converting to cn=config. Here's the ldif file I'm using to set up a back-perl backend in cn=config mode (it's inspired from the files I get by converting slapd.conf into cn=config with slaptest) # Load dynamic backend modules dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/local/libexec/openldap olcModuleload: back_perl.la # Database settings dn: olcDatabase=perl,cn=config objectClass: olcDatabaseConfig objectClass: olcDbPerlConfig olcDatabase: perl olcSuffix: dc=mydomain,dc=org olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=Manager,dc=mydomain,dc=org olcRootPW:: c2VjcmV0 olcSyncUseSubentry: FALSE olcMonitoring: FALSE olcPerlModulePath: /usr/local/etc/openldap/perl olcPerlModule: SampleLDAP olcPerlFilterSearchResults: FALSE And here's what I get when I try to load the file: ldapadd -Y EXTERNAL -H ldapi:/// -f perl-backend.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "cn=module,cn=config" adding new entry "olcDatabase=perl,cn=config" ldap_result: Can't contact LDAP server (-1) After that, if I start OpenLDAP I get a segmentation fault: root@ldap:/tmp# /usr/local/libexec/slapd -u openldap -g openldap -h "ldap:/// ldapi:///" -d 16383 .... 51585496 perl backend db init Segmentation fault Like I said, if I set back-perl up in slapd.conf mode and then convert it to cn=config, everything works fine. Something must be wrong with my LDIF file, but what ??? It seems to be the same as the one generated by slaptest when converting from slapd.conf mode. Ben

2 5

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical