openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Re: TLS problem
by devzero2000 04 Feb '13

04 Feb '13

On Tue, Jan 29, 2013 at 7:31 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, January 29, 2013 10:22 AM +0200 Chris <chris(a)flamengro.co.za> > wrote: > > Hi >> >> I am running Openldap 2.4.23 on RHEL6. I can telnet to the server on both >> 389 636 ports. >> I can do a ldapsearch and ldapadd without any errors. I get this error >> when I start the slapd daemon. >> > > In addition to the issue noted by Rich, I would note that you are using an > ancient release with numerous known issues that is not suitable for a > production LDAP server. I would strongly advise you to use a current > OpenLDAP release. If you do not feel comfortable building OpenLDAP > yourself, there are packages available at <http://ltb-project.org/wiki/** > download#openldap <http://ltb-project.org/wiki/download#openldap>> that > should meet your needs. > Yes, probably it is the best thing to do. BUT have you recently looked to the bugfix openldap backport from RED HAT ? Or from other commercial distro ? New feature is a point, but old bugfix are another. JMHO. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > >

1 0

client server connection to LDAP/Kerberos
by Asmaa Ahmed 04 Feb '13

04 Feb '13

Hello, I recently added Kerberos authentication to my LDAP server, and I am trying to connect the other servers to it.I have a server running Davical shared calendar, and I hope to get it working with my LDAP server again after Kerberos integration. Here is my configuration which was working before the integration and my source is "http://wiki.davical.org/w/Configuration/LDAP#Kerberos_Authentication" $c->authenticate_hook['config'] = array( 'host' => 'ldap.domain.com', //host name of your LDAP Server 'port' => '389', //port// 'bindDN' => 'cn=admin,dc=domain,dc=com', //DN to bind request to this server (if required)// 'passDN' => 'password', //Password of request bind 'baseDNUsers' => 'ou=People,dc=domain,dc=com', //where to look for valid user 'filterUsers' => 'objectClass=*', //filter which must validate a user according to RFC4515, i.e. surrounded by brackets 'protocolVersion' => 3, // important for simple auth (no sasl)// 'startTLS' => true, // securing your LDAP connection 'i_use_mode_kerberos' => "i_know_what_i_am_doing", My slapd error logs:Jan 31 23:40:00 ldap slapd[1059]: conn=1273 fd=43 ACCEPT from IP=203.28.247.193:56887 (IP=0.0.0.0:389)Jan 31 23:40:00 ldap slapd[1059]: conn=1273 op=0 BIND dn="" method=128Jan 31 23:40:00 ldap slapd[1059]: conn=1273 op=0 RESULT tag=97 err=0 text=Jan 31 23:40:00 ldap slapd[1059]: conn=1273 op=1 SRCH base="ou=People,dc=domain,dc=com" scope=2 deref=0 filter="(objectClass=*)"Jan 31 23:40:00 ldap slapd[1059]: conn=1273 op=1 SRCH attr=uid modifyTimestamp cn mailJan 31 23:40:00 ldap slapd[1059]: conn=1273 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text=Jan 31 23:40:00 ldap slapd[1059]: conn=1273 op=2 UNBIND My OLC configuration:root@ldap:/var/log# ldapsearch -LLLQY EXTERNAL -H ldapi:/// -b cn=config "(|(cn=config)(olcDatabase={1}hdb))"dn: cn=configobjectClass: olcGlobalcn: configolcArgsFile: /var/run/slapd/slapd.argsolcAuthzRegexp: {0}uid=([^,]+),cn=domain.com,cn=gssapi,cn=auth uid=$1 ,ou=people,dc=domain,dc=comolcLogLevel: statsolcPidFile: /var/run/slapd/slapd.pidolcSaslRealm: DOMAIN.COMolcToolThreads: 1 dn: olcDatabase={1}hdb,cn=configobjectClass: olcDatabaseConfigobjectClass: olcHdbConfigolcDatabase: {1}hdbolcDbDirectory: /var/lib/ldapolcSuffix: dc=domain,dc=comolcAccess: {0}to attrs=userPassword,shadowLastChange by anonymous auth by * no neolcAccess: {1}to dn.subtree="ou=krb5,dc=domain,dc=com" by dn="c n=adm-srv,ou=krb5,domain,dc=com" write by dn="cn=kdc-srv,ou =krb5,domain,dc=com" read by * noneolcAccess: {2}to attrs=loginShell,gecos by self write by users read by * noneolcAccess: {3}to dn.base="" by * readolcAccess: {4}to * by users read by * noneolcLastMod: TRUEolcRootDN: uid=admin,ou=people,domain,dc=com Any suggestion to fix the binding and get my search working again with kerberos authentication ? Thanks.

2 4

Access control
by Philip Colmer 04 Feb '13

04 Feb '13

I'm trying to get access control for writing to groups as automated as possible, in as much as I would like LDAP to be able to determine who is able to write based on other attributes. I've been able to successfully do this if I only need to grant access to one or a few individuals, by specifying their DN as a value to an attribute, and then using this ACL: add: olcAccess olcAccess: {2}to dn.sub="ou=groups,dc=example,dc=com" by dnattr="owner" write by users read by * none That works really well - I just add the owner attribute to an object, specify the owner's DN and they can then write to the object. However, for larger scale permissions, I need to be able to use the membership of a group. Now I've read http://www.openldap.org/faq/data/cache/52.html and seen that you can specify: access to <what> by group/<objectclass>/<attributename>=<DN> <access> However, that would require me to explicitly set the DN of the group in the access control itself. What I want/need to be able to do is for LDAP to read the DN of the group that has permission, in the same what that it does with dnattr. I thought that I had read something about this being possible with sets, but slapd.access says that "The statement set=<pattern> is undocumented yet." so I'm not clear if that is the most appropriate way to proceed. Can someone please advise on how this might be accomplished? Thanks. Philip

2 5

configure ldap + cyrus sasl on debian 6
by Benin Technologies 03 Feb '13

03 Feb '13

Hi, I tried to install OpenLDAP with Cyrus SASL support on Debian. I'm running Debian 6.0.4, and until now I was using an 2.4.23 installation, from debian packages. First attempt : installation of OpenLDAP 2.4.33 with default configure options. After installation, I converted slapd.conf to cn=config Then I dropped the database, and tried to rebuild a new one by loading a ldif file (like I'm used to do with my previous installation, from Debian packages) ldapadd -Y EXTERNAL -H ldapi:/// -f myfile.ldif ldapadd: not compiled with SASL support Second attempt I installed Cyrus-SASL-2.1.26 (with default configure options) Then I installed OpenLDAP, "--with-cyrus-sasl" This time, I got the following message: ldapadd -Y EXTERNAL -H ldapi:/// -f myfile.ldif ldap_sasl_interactive_bind: Can't contact LDAP server (-1) What step did I miss ? B.

2 4

problem with ldap group check in squid
by Fuhrmann, Marcel 03 Feb '13

03 Feb '13

Hello, i'm trying to to configure squid to use a ldap (ADS 2008) group check to give access to the internet. The squid mailing list couldn't help me. Maybe you can. /usr/lib64/squid/squid_ldap_group -d -v3 -b 'ou=OU3,ou=OU2,ou=OU1,dc=DOMAIN,dc=LOCAL' -f \ '(&(sAMAccountName=%v)(memberOf=cn=%a,ou=USERGRUPPEN,dc=DOMAIN,dc=LOCAL))' -D cn=LDAP,cn=USERS,dc=DOMAIN,dc=LOCAL \ -w PASSWORT -h DOMAINCONTROLLER testuser internet Connected OK group filter '(&(sAMAccountName=testuser) (memberOf=cn=internet,ou=USERGROUPS,dc=DOMAIN,dc=LOCAL))', searchbase 'ou=OU3,ou=OU2,ou=OU1,dc=DOMAIN,dc=LOCAL' ERR The user TESTUSER is in OU3. The group INTERNET is in a OU called USERGROUPS. TESTUSER is member of INTERNET. But it doesn't work. Can somebody give me advice? Thanks a lot -- Marcel

1 1

Hello!!
by Bob Fitch 02 Feb '13

02 Feb '13

http://www.bellacroquercreations.com/components/com_content/yaid352.php Bob Fitch 2/3/2013 5:35:12 AM _____

1 0

slapd-meta and tls_reqcert=allow
by Jim Vanes 01 Feb '13

01 Feb '13

I'm using OpenLDAP 2.4.23-26 from Centos 6. I seem to be hitting a configuration issue regarding slapd-meta and SSL/TLS. Here is my meta config: database meta suffix "dc=virtual,dc=local" rootdn "cn=root,dc=virtual,dc=local" rootpw password # Local uri ldap://localhost/dc=ds1,dc=virtual,dc=local suffixmassage "dc=ds1,dc=virtual,dc=local" "dc=lab,dc=local" idassert-bind bindmethod=simple binddn="cn=root,dc=lab,dc=local" credentials=password #Remote AD server uri ldap://10.33.63.125:389/dc=ad1,dc=virtual,dc=local tls start suffixmassage "dc=ad1,dc=virtual,dc=local" "dc=mslab,dc=local" idassert-bind bindmethod=simple binddn="CN=Sync,CN=Users,DC=lab,DC=local" credentials="Password1" starttls="yes" tls_reqcert="allow" It seems as though tls_reqcert="allow" is ignored for the remote AD server. If set that variable in the ldap.conf everything works fine. But shouldn't the above function as an override to the default of 'demand'? The behaviour is the same when I change the above to use SSL instead. Another thing I noticed was that adding tls_crlcheck="none" to my idassert-bind line causes slaptest to fail..not sure if this is related or not. /etc/openldap/slapd.conf: line 68: "idassert-bind <args>": unable to parse field "tls_crlcheck=none". slaptest: bad configuration file! I must be misunderstanding the docs. Any help would be appreciated.

3 4

missing entry in slapcat backup
by Meike Stone 01 Feb '13

01 Feb '13

Hello dear List, I tried to import a slapcat backup from our production machine in a test environment and got following message: debld02:~ # time slapadd -w -q -f /etc/openldap/slapd.conf -l /backup.ldif 50f98421 mdb_monitor_db_open: monitoring disabled; configure monitor database to enable -#################### 100.00% eta none elapsed 09m18s spd 4.6 M/s Closing DB...Error, entries missing! entry 1156449: ou=a,ou=b,ou=c,ou=root First I did not noticed this message, but now I see the database is broken, because the node "ou=a" is missing. So my questions: - What ist the origin for such orphaned nodes (In MMR, it happens and I see a few glue records, but in my backup this one node is complete missing...)? - How can I prevent from such entires and how can I recognize them without importing? - How can I remove this entry (esp. in production DB without downtime), because a delete show following messages: ~ # ldapdelete -x -h localhost -w password -D cn=admin,ou=root 'cn=cname,ou=a,ou=b,ou=c,ou=root' ldap_delete: Other (e.g., implementation specific) error (80) additional info: could not locate parent of entry and if I try to add this missing node, then I get: ldapadd -x -h localhost -w password -D"cn=admin,ou=root" -f test.ldif adding new entry ou=a,ou=b,ou=c,ou=root ldap_add: Already exists (68) Thanks for help Meike

4 11

Duplicate attributeType: "2.5.4.35"
by rodrigo tavares 01 Feb '13

01 Feb '13

Hello, In my samba.schema, added the atribute userPassword. attributetype ( 1.3.6.1.4.1.7165.2.1.24 NAME 'sambaLMPassword' DESC 'LanManager Password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.7165.2.1.25 NAME 'sambaNTPassword' DESC 'MD4 hash of the unicode password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE ) attributetype ( 2.5.4.35 NAME 'userPassword' DESC 'RFC2256/2307: password of user' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128}) Then, i excute command slapindex -v. root@fileserver02:/etc/ldap/schema# slapindex -v WARNING! Runnig as root! There's a fair chance slapd will fail to start. Check file permissions! /etc/ldap/schema/samba.schema: line 195 attributetype: Duplicate attributeType: "2.5.4.35" slapindex: bad configuration file! What´s wrong ? Rodrigo

3 4

server-side sub-search
by Benin Technologies 31 Jan '13

31 Jan '13

Hi, Is it possible to do a server-side sub-search before returning the data to the client ? Let's say I have this tree : ---> dc=com | |-->dc=mycompany | | --> cn=Jane Doe | |-- objectClass=inetOrgPerso |-- cn=Jane Doe |-- mobile : 11223344 | --> cn=secretary | |-- objectClass=organizationalRole |--cn=secretary |--telephoneNumber=12345678 |--roleOccupant=cn=Jane Doe,dc=mycompany,dc=com I'd like to return, in a single search, something like : cn : Jane Doe - mobile : 11223344 - telephoneNumber : 12345678 Can this be done ? Ben

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical