openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Compile openldap library with GSSAPI enabled
by Michele 19 Feb '13

19 Feb '13

Hi all, I'm trying to build OpenLDAP enabling the GSSAPI module, but I can't find any reference on that in the configure file. I'm doing that because I'm writing a client program that want to login to a Windows AD via kerberos. Any help is appreciated.

3 6

ldapi without TLS and ldap with TLS?
by Patrick Lists 19 Feb '13

19 Feb '13

Hi, I'm tying achieve the following with OpenLDAP RE24 from last week: Connections on ldapi:/// are plain text and ldap connections require TLS with client cert auth. I thought I could do that with: # global configuration settings dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/openldap34/slapd34.args olcPidFile: /var/run/openldap34/slapd34.pid olcLogFile: /var/log/openldap34/slapd34.log olcLogLevel: -1 olcTLSCACertificateFile: /etc/pki/tls/certs/ca.crt olcTLSCertificateFile: /etc/pki/tls/certs/server.crt olcTLSCertificateKeyFile: /etc/pki/tls/private/server.key olcTLSCipherSuite: TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:@STRENGTH olcTLSVerifyClient: demand <--- olcLocalSSF: 0 <--- olcSecurity: tls=256 <--- Since I'm seeing the error below clearly I thought wrong: 5121a107 >>> slap_listener(ldapi:///) 5121a107 daemon: listen=11, new connection on 15 5121a107 daemon: added 15r (active) listener=(nil) 5121a107 conn=1009 fd=15 ACCEPT from PATH=/var/run/ldapi (PATH=/var/run/ldapi) [snip] 5121a107 conn=1009 op=0 BIND dn="cn=ReadOnly,dc=example,dc=com" method=128 5121a107 do_bind: version=3 dn="cn=ReadOnly,dc=example,dc=com" method=128 5121a107 send_ldap_result: conn=1009 op=0 p=3 5121a107 send_ldap_result: err=13 matched="" text="TLS confidentiality required" [snip] 5121a107 conn=1009 op=0 RESULT tag=97 err=13 text=TLS confidentiality required Anyone have an idea how I can achieve my goal? Thanks! Patrick

2 4

Problem in user authentication with LDAP + SSSD
by Cristiane França 18 Feb '13

18 Feb '13

Hi, I'm an authentication problem with my server CentOS 6.3, there are installer LDAP (openldap-2.4.23-26) and SSSD (sssd-1.8.0-32). The LDAP server is working fine but the integration between LDAP + SSSD has a problem because it can not authenticate the user on the server Can anyone help me identify the problem? I've revised all the configuration and found nothing wrong. ::::: slapd.conf ::::: include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/misc.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid TLSCACertificateFile /etc/openldap/cacert.pem TLSCertificateFile /etc/openldap/servercrt.pem TLSCertificateKeyFile /etc/openldap/serverkey.pem access to * by self write by users auth by anonymous read database bdb suffix "dc=domain,dc=com,dc=br" checkpoint 1024 15 rootdn "cn=Manager,dc=domain,dc=com,dc=br" rootpw xxxxxxxxxx directory /database/ldap index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub database monitor loglevel 768 ::::: sssd.conf ::::: [sssd] config_file_version = 2 reconnection_retries = 3 sbus_timeout = 30 services = nss, pam domains = default [nss] filter_groups = root filter_users = root reconnection_retries = 3 [pam] reconnection_retries = 3 debug_level = 8 [domain/default] ldap_tls_reqcert = never auth_provider = ldap ldap_id_use_start_tls = False chpass_provider = ldap krb5_realm = EXAMPLE.COM cache_credentials = True debug_timestamps = True ldap_default_authtok_type = password ldap_search_base = dc=domain,dc=com,dc=br debug_level = 9 id_provider = ldap ldap_default_bind_dn = cn=Manager,dc=domain,dc=com,dc=br min_id = 100 ldap_uri = ldap://localhost/ krb5_kdcip = kerberos.example.com ldap_default_authtok = xxxxxxxxxx ldap_tls_cacertdir = /etc/openldap/cacerts :::: nsswitch.conf ::::: passwd: files sss shadow: files sss group: files sss hosts: files dns bootparams: nisplus [NOTFOUND=return] files ethers: files netmasks: files networks: files protocols: files rpc: files services: files netgroup: files sss publickey: nisplus automount: files ldap aliases: files nisplus LOG: Feb 18 14:50:01 primario slapd[16064]: conn=1119 op=185 SRCH base="dc=domain,dc=com,dc=br" scope=2 deref=0 filter="(&(uid=cristiane)(objectClass=posixAccount))" Feb 18 14:50:01 primario slapd[16064]: conn=1119 op=185 SRCH attr=objectClass uid userPassword uidNumber gidNumber gecos homeDirectory loginShell krbPrincipalName cn modifyTimestamp modifyTimestamp shadowLastChange shadowMin shadowMax shadowWarning shadowInactive shadowExpire shadowFlag krbLastPwdChange krbPasswordExpiration pwdAttribute authorizedService accountExpires userAccountControl nsAccountLock host loginDisabled loginExpirationTime loginAllowedTimeMap Feb 18 14:50:01 primario slapd[16064]: conn=1119 op=185 SEARCH RESULT tag=101 err=32 nentries=0 text= Thanks Cristiane

2 1

Where is the TLSCertificateFile in cn=config?
by Sascha Ziemann 18 Feb '13

18 Feb '13

I am looking for the right DN in the cn=config tree for the following options of the legacy slapd.conf file: TLSCertificateFile /path/to/server-certificate.pem TLSCertificateKeyFile /path/to/private-key.pem TLSCACertificateFile /path/to/CA-certificates Where do I have to put the path names? Maybe someone can update the FAQ: http://www.openldap.org/faq/data/cache/185.html

2 1

How to create cn=config DIT
by arantza serrano 17 Feb '13

17 Feb '13

Hello, I've installed my first openldap using the source downloaded in openldap web pages. when the make install finishs i don't find the cn=config DIT, it hasn't been created during intallation process. How can i created the cn=config directory after the installation? Sorry if i'm asking a foolishness Thanks

3 3

does openldap/hdb support transactions ?
by Benin Technologies 17 Feb '13

17 Feb '13

Hi, They say that Berkeley HDB is an ACID database, but does OpenLDAP support transactions ? And if yes, how do you start and commit/rollback a transaction ? Thanks Ben

3 2

User Private Groups
by Omar Hijab 17 Feb '13

17 Feb '13

Hello, Does openLDAP support User Private Groups by having memberOf return a fake self-group through some rewriting rule? Our campus has a SUN LDAP for user data that is not under our control. Our Mac and Linux clients use it for authentication. This server does not provide group management as a service. Because of this, we set up a separate openLDAP server to create/store groups. With clients bound to both servers, this works seamlessly. Because of this, we want our server to respond to memberOf queries with a fake private self-group in addition to legitimate groups the user is in, this without creating and storing private groups on our server. Is this do-able? Omar ----------------------------------------------------------------------- Omar Hijab Associate Dean for Faculty Affairs and Operations College of Science and Technology Temple University Email: hijab(a)temple.edu Web: http://www.cst.temple.edu/~hijab/ ------------------------------------------------------------------------

1 0

ACL and New users binding as anonym haveous
by cbulist 15 Feb '13

15 Feb '13

Hi, We have openldap 2.4.33 running without problem. In our first configuration we created a simple ACL in order to get access to every user. access to * by * read Then we changed it to: access to * by self write by anonymous auth by * none This ACL rules works perfectly with users that were logged by ssh before to change but users created and that never were logged after this ACL can not login. I review the openldap log file and I can see the user is trying to bind using anonymous instead of its uid. Are there any way to send the full user DN (uid=user,ou=People,dc=company,dc=com) to Ldap? Thanks in advance!

2 1

Advice request : LDAP server discovering
by Olivier 15 Feb '13

15 Feb '13

Hello, in the case I was not knocking at the right door, please accept my apologies, but as I suspect that some of you could provide some advices I post this here. In summary the issue I try to solve is "which mecanism should I deloy to route ldap requests to the right ldap server". Here is the situation : My hosts and services are distributed in 3 distinct operationnal sites (site A, site B, site C). I have three ldap servers (one on each site) that are configured to be exact replication of the others (I use openldap syncrepl in multimaster mode). On the client side (linux boxes), authentication on my hosts are based on ldap (posixaccounts/nsswitch/pam/ldap.conf and sssd). I also have deployed things such as centralized sudoer rules in ldap. At this stage, I have configured hosts so that ldap queries are sent to "the closer" ldap server first, then to another one if the first timeout : nsswitch.conf tells to query ldap (sss), and here is an extract of my ldap.conf for a host located in site A: > URI ldap://ldapA.mydom.fr ldap://ldapB.mydom.fr ldap://ldapC.mydom.fr For a host located in site C, I have declared this in ldap.conf: > URI ldap://ldapC.mydom.fr ldap://ldapB.mydom.fr ldap://ldapA.mydom.fr I would like to change that. Rather than declaring three ldap server references in configurations on the client side, I would like to implement some sort of mecanism thanks to which I would only need to declare one reference on the client side (routing ldap queries to ldap service, not to ldap servers). I see different possibilities to do that, such as setting up some sort of "heartbeat" or using some DNS trick such as multiple IN A for the same DNS RR, using sortlist option, or DNS SRV records ( _ldap._tcp. ) See: http://www-01.ibm.com/software/network/directory/library/publications/jndid… http://www.rjsystems.nl/en/2100-dns-discovery-openldap.php http://www.ietf.org/proceedings/50/I-D/ldapext-locate-05.txt http://ipamworldwide.com/bind-options/sortlist-option.html Intuitively, my preference would go to use an "_ldap._tcp" srv record, but I'm not sure if nsswitch (or clients such as sssd) would interpret this kind of DNS responses correctly (what I mean by "correctly" is "client would query an up and running ldap server found in the NS response list." Even better: "would query the faster one to respond" ). Any advice ? Experience ? Article to read ? Thanks, --- Olivier

2 2

Why is DN invalid?
by David Cunningham 13 Feb '13

13 Feb '13

Hello all, I've installed openldap 2.4.33 on OpenSUSE 11 and am trying out the perl backend. I got my certificate issues sorted out and everything seems good - until I search our university server which returns dn's such as: unbCaId=9e3454b178993cc73619606d22c7882755c9cb0d,ou=people,dc=unb,dc=ca When I return entry from search routine in perl module I get error "str2entry: entry -1 has invalid DN". I can't see anything wrong with the dn (other than it is ugly). Are there length restrictions for individual components of a dn? All similar problems I've discovered on the net are issues with commas, plus signs, quotes or unicode characters. No doubt there is something I've overlooked so please point me in the right direction. cheers, Dave C.

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical