openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

pwdMaxAge And pwdExpireWarning not working
by Swapnil Dubey 23 Mar '13

23 Mar '13

Hi All, I am using OpenLdap 2.4.32 on solaris 10. It seems that pwdMaxAge And pwdExpireWarning are not working. Other policies like pwdInHistory, pwdLockout seems to work fine. I cannot see either expiry message or authentication failure in logs after I wait for configured time/seconds. Can somebody help me out with this? -bash-3.00# ./ldapwhoami -x -D uid=admin,ou=People,dc=example,dc=com -W -e ppolicy Enter LDAP Password: ldap_bind: Success (0) (Password expires in 0 seconds) dn:uid=admin,ou=people,dc=example,dc=com Here is my configuration. -bash-3.00# ./ldapsearch -x -b "dc=example,dc=com" "(objectclass=*)" # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # example.com dn: dc=example,dc=com objectClass: dcObject objectClass: domain dc: example # roles, example.com dn: ou=roles,dc=example,dc=com objectClass: organizationalUnit ou: roles # people, example.com dn: ou=people,dc=example,dc=com objectClass: organizationalUnit ou: people # admin, people, example.com dn: uid=admin,ou=people,dc=example,dc=com objectClass: person objectClass: inetOrgPerson cn: admin displayName: Admin givenName: admin mail: admin(a)example.com sn: Admin uid: admin userPassword:: e1NTSEF9NU1WNHpuTHB2N3ZmSkcvaU44VC85QkNJMWVueU5hcDc= # utsacct_provisioner, roles, example.com dn: cn=utsacct_provisioner,ou=roles,dc=example,dc=com objectClass: groupOfUniqueNames cn: utsacct_provisioner uniqueMember: uid=admin,ou=people,dc=example,dc=com # provisioner, roles, example.com dn: cn=provisioner,ou=roles,dc=example,dc=com objectClass: groupOfUniqueNames cn: provisioner uniqueMember: uid=admin,ou=people,dc=example,dc=com # policies, example.com dn: ou=policies,dc=example,dc=com ou: policies objectClass: organizationalUnit objectClass: top # default, policies, example.com dn: cn=default,ou=policies,dc=example,dc=com cn: default objectClass: pwdPolicy objectClass: person objectClass: top pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 2 pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 5 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 0 pwdMaxAge: 2000 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 5 pwdMustChange: FALSE pwdSafeModify: FALSE sn: dummy value # search result search: 2 result: 0 Success # numResponses: 9 # numEntries: 8 Slapd.conf --------------------------------- ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=example,dc=com" ppolicy_use_lockout ppolicy_hash_cleartext Regards, Swapnil

1 1

openldap and AD sync
by 杨峰 23 Mar '13

23 Mar '13

I had set up LDAP on linux side, I want to build a AD with Windows2008R2, and AD should sync the user information from LDAP, is there any suggestion on this?

7 8

shadowLastChange can't be read
by Maria McKinley 23 Mar '13

23 Mar '13

Hi there, I can change the shadowLastChange attribute: maria@mimi:~/sysadmin/ldap$ ldapmodify -x -v -r -W -D "cn=admin,dc=example,dc=com" -f pass.expldap_initialize( <DEFAULT> ) Enter LDAP Password: replace shadowLastChange: 15786 modifying entry "uid=chris,ou=people,dc=example,dc=com" modify complete But, I can't see it: annette:~# ldapsearch -x "uid=chris" shadowLastChange # extended LDIF # # LDAPv3 # base <dc=example,dc=com> (default) with scope subtree # filter: uid=chris # requesting: shadowLastChange # # chris, people, example.com dn: uid=chris,ou=people,dc=example,dc=com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Even though this is my permission: olcAccess: {0}to attrs=shadowLastChange by self write by anonymous auth by dn= "cn=admin,dc=example,dc=com" write by * read olcAccess: {1}to attrs=userPassword by self write by anonymous auth by dn="cn= admin,dc=example,dc=com" write by * none olcAccess: {2}to dn.base="" by * read olcAccess: {3}to * by self write by dn="cn=admin,dc=example,dc=com" write by * read Have I done something wrong with my permissions? Is there something else that could be going on here? thanks, Maria

2 1

Question about OpenLDAP integration with JMS
by Nick 22 Mar '13

22 Mar '13

Dear All, Please tell me, is there any way to integrate OpenLDAP with some JMS service (in particular - Apache ActiveMQ) to make OpenLDAP server post all changes (object creates/upadtes/deletes) to the message bus, and also to receive updates from the message bus? Best regards Nikolay

4 8

pcache overlay help
by brendan kearney 21 Mar '13

21 Mar '13

i am trying to setup the pcache overlay to cache routinely used entries in the DIT. using the below, i am able to load the pcache module: ldapmodify -QY EXTERNAL -H ldapi:/// dn: cn=module,cn=config changetype:add objectClass: olcModuleList cn: module olcModulePath: /usr/lib64/openldap olcModuleLoad: pcache.la then i try to add some caching directives, using the below: ldapmodify -QY EXTERNAL -H ldapi:/// dn: olcOverlay={0}pcache,olcDatabase={2}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcPcacheConfig objectClass: olcPcacheDatabase olcOverlay: {0}pcache olcPcache: hdb 100000 50 1000 100 olcPcacheAttrset: 0 nSRecord sOARecord pTRRecord aRecord cNAMERecord sRVRecord tXTRecord olcPcacheTemplate: "(zoneName=)" 0 3600 olcPcacheTemplate: "(&(zoneName=)(relativeDomainName=))" 0 3600 olcPcacheAttrset: 1 krbprincipalname krbcanonicalname objectclass krbprincipalkey krbmaxrenewableage krbmaxticketlife krbticketflags krbprincipalexpiration krbticketpolicyreference krbUpEnabled krbpwdpolicyreference krbpasswordexpiration krbLastFailedAuth krbLoginFailedCount krbLastSuccessfulAuth nsaccountlock krbLastPwdChange krbLastAdminUnlock krbExtraData krbObjectReferences krbAllowedToDelegateTo olcPcacheTemplate: "(&(|(objectClass=)(objectClass=))(krbPrincipalName=))" 1 3600 olcPcacheAttrset: 2 userPassword cn gidNumber uidNumber loginShell objectClass gecos uid homeDirectory olcPcacheTemplate: "(&(objectClass=)(uid=))" 2 3600 olcPcacheAttrset: 3 cn userPassword memberUid gidNumber uniqueMember olcPcacheTemplate: "(&(objectClass=)(cn=))" 3 3600 olcPcacheTemplate: "(&(objectClass=)(memberUid=))" 3 3600 olcPcacheTemplate: "(&(objectClass=)(gidNumber=))" 3 3600 olcPcacheTemplate: "(&(objectClass=)(|(memberUid=)(uniqueMember=)))" 3 3600 i no longer have logs around the failure, but the error message indicated that the olcDbDirectory could not be found. the DN dn: olcDatabase={2}hdb,cn=config has that specified (olcDbDirectory: /var/lib/ldap), but i am missing something about pcache and the backend sharing this directive. can anyone point me in the right direction about how to get the pcache overlay setup correctly?

2 3

Crash with syncrepl refreshAndPersist and database ldap
by Raffael Sahli 20 Mar '13

20 Mar '13

Hi I run a master slapd with 2.4.33 which has a bdb and an ldap database. A slave server 2.4.33 syncs the bdb database with delta syncrepl (type=refreshAndPersist), and has the same ldap database. So my problem is, that the slave crashes very often (That could be multiple times per hour). I have to kill (9) the daemon and restart it. What I found out is, I can solve the problem with either set the type from refreshAndPersist to refreshOnly or remove the ldap database. I have the problem on other servers, which run with 2.4.31, there I disabled the ldap database on the slave. I'm not sure if it was the same, but I had same problems with 2.4.28 and earlier. So what could that be? Maybe a config problem or a bug? Thanks -- Raffael Sahli public(a)raffaelsahli.com

2 1

ldapsearch returning failure to import cert
by John Rouillard 19 Mar '13

19 Mar '13

Hi all: I am running Scientific Linux 6 (a Red Hat enterprise repackage). Until recently these machines were interacting fine with our ldap setup. We use a self signed cert for the ldap servers and deploy the CA cert in /etc/openldap/cacert.pem. However after the last series of updates ldapsearch has been failing in an interesting way and our sssd caching daemons are failing to connect to our ldaps servers. I am hoping that they are both having the same issue. The relevant installed packages are: openldap-2.4.23-26.el6_3.2.x86_64 openssl-1.0.0-27.el6_4.2.x86_64 nss-util-3.14.0.0-2.el6.x86_64 nss-3.14.0.0-12.el6.x86_64 I am using the command (lightly obscured): ldapsearch -d -1 -v -x -b uid=user,ou=people,dc=staff,dc=example,dc=com -D uid=user,ou=people,dc=staff,dc=example,dc=com -W -H ldaps://auth.staff.example.com/ This fails with the error: TLS: error: connect - force handshake failure: errno 21 - moznss error -8054 TLS: can't connect: TLS error -8054:You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert.. ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) Where is ldapsearch "importing" a cert? Where is it getting its other certs from? I ran strace on ldapsearch and the only cert file I can see it accessing is /etc/openldap/cacert.pem as specified in /etc/openldap/ldap.conf (not counting the /usr/lib64/libnssckbi.so file). The cert in cacert.pem is identical to the one retrieved by running: openssl s_client -connect auth.staff.example.com:636 </dev/null \ 2>/dev/null | sed -ne '/BEGIN CERTIFICATE/,/END CERTIFICATE/p' Here is where it gets a little more interesting: I have a previous CA cert (that used an md5 message digest). If I install that as the CA, ldapsearch works for 2 of my 3 ldap servers. I have used openssl x509 -in ... -text to compare the certificates for my 3 ldap server and they look identical except where they shouldn't be (subject name, subject name digests...). The issuer, issuer digest ... fields are the same. If I use openssl verify -CAfile /etc/openldap/cacert.pem -purpose sslserver -issuer_checks ldap where ldap is the cert retrieved using s_client it validates for all three servers regardless of whether the CAfile is the older md5 or newer cert. Just to add more into the mix, our CentOS 5 boxes have no issues with any of the servers (IIUC they have an entirely different tls/cert level since they do not use Mozilla nss). Thanks for any insight or questions as the answer didn't come to me while I was writing this email 8-). -- -- rouilj John Rouillard System Administrator Renesys Corporation 603-244-9084 (cell) 603-643-9300 x 111

2 1

Re: Problems with authentication against OpenlDAP
by francesco.policastro＠selex-es.com 19 Mar '13

19 Mar '13

Hi, I made some progress, but I am still unable to do what I need. I said that ldapsearch correctly returns the record related to myself from both servers, but one of them, namely that configured with ACL's, also returns some other lines like this: # refldap://ext.domain.net/CN=Configuration,DC=ext,DC=domain,DC=net I use simple bind and these lines are returned because my servers answer on port 389. Querying the Global Catalog on port 3268 removes those lines (and authentication works fine), but GC does not return an attribute I need, i.e. the employeeID. So when the records synchronize I will get problems. I did not find a way to avoid referrals to appear in the answer. Did anyone face and solve this problem? Thanks, Francesco

1 0

None
by Nick 19 Mar '13

19 Mar '13

Dear All, Please tell me, is there support for DIT structure rules or GoverningStructureRule in current version of OpenLDAP? Best regards Nikolay

2 1

openldap-2.4.32 su-ok, rlogin-fails
by Joe Phan 18 Mar '13

18 Mar '13

Hi, I configured a machine to be LDAP Server (openldap-2.4.32) on Solaris 10. Adding users/groups to LDAP Server seems to be ok. From a second machine, I configured it to be LDAP Client using command "ldapclient manual -v -a defaultsearchbase=dc=pg,dc=dtveng,dc=net -a domainname=pg.dtveng.net 10.26.82.16". It was successful. /var/ldap/ldap_client_file contains appropriate LDAP Server information. Openldap-2.4.32 is not installed on the Client Machine. I updated PAM configuration on Client Machine for su and rlogin, results are listed below: - rlogin into Client Machine using root - OK - rlogin into Client Machine using "jphan" user - Fails - After login to Client Machine as root, su from root to "jphan" user - OK (Note: jphan user does not exist in Client Machine /etc/passwd, jphan user exists in LDAP Server) - From "jphan" user, su to another user - Fails Could someone please take a look at the configuration for rlogin PAM below to see if the configuration is correct. Please let me know if there is anything missing from my setup. Do I need to configure pam.conf on LDAP Server machine as well? Any help is greatly appreciated. Best regards, Joe Phan Downloaded and installed following packages from SunFreeWare.com to LDAP Server: openldap-2.4.32-sol10-sparc-local.gz db-4.7.25.NC-sol10-sparc-local.gz gcc-3.3.2-sol10-sparc-local.gz libgcc-3.3-sol10-sparc-local.gz libtool-2.4.2-sol10-sparc-local.gz openssl-1.0.1c-sol10-sparc-local.gz sasl-2.1.25-sol10-sparc-local.gz Client Machine configuration: - /etc/nsswitch.conf: passwd: files ldap group: files ldap shadow: files ldap - /etc/pam.conf: apggd08dev# more pam.conf # login auth requisite pam_authtok_get.so.1 login auth required pam_dhkeys.so.1 login auth required pam_unix_cred.so.1 #login auth required pam_unix_auth.so.1 login auth sufficient pam_unix_auth.so.1 login auth required pam_dial_auth.so.1 login auth required pam_ldap.so.1 debug # # rlogin service (explicit because of pam_rhost_auth) # rlogin auth sufficient pam_rhosts_auth.so.1 rlogin auth requisite pam_authtok_get.so.1 rlogin auth required pam_dhkeys.so.1 rlogin auth required pam_unix_cred.so.1 #rlogin auth required pam_unix_auth.so.1 rlogin auth sufficient pam_unix_auth.so.1 rlogin auth required pam_ldap.so.1 debug # # Kerberized rlogin service # krlogin auth required pam_unix_cred.so.1 krlogin auth binding pam_krb5.so.1 krlogin auth required pam_unix_auth.so.1 # # rsh service (explicit because of pam_rhost_auth, # and pam_unix_auth for meaningful pam_setcred) # rsh auth sufficient pam_rhosts_auth.so.1 rsh auth required pam_unix_cred.so.1 # # Kerberized rsh service # krsh auth required pam_unix_cred.so.1 krsh auth binding pam_krb5.so.1 krsh auth required pam_unix_auth.so.1 # # Kerberized telnet service # ktelnet auth required pam_unix_cred.so.1 ktelnet auth binding pam_krb5.so.1 ktelnet auth required pam_unix_auth.so.1 # # PPP service (explicit because of pam_dial_auth) # ppp auth requisite pam_authtok_get.so.1 ppp auth required pam_dhkeys.so.1 ppp auth required pam_unix_cred.so.1 #ppp auth required pam_unix_auth.so.1 ppp auth sufficient pam_unix_auth.so.1 ppp auth required pam_dial_auth.so.1 ppp auth required pam_ldap.so.1 debug # # Default definitions for Authentication management # Used when service name is not explicitly mentioned for authentication # other auth requisite pam_authtok_get.so.1 other auth required pam_dhkeys.so.1 other auth required pam_unix_cred.so.1 #other auth required pam_unix_auth.so.1 other auth sufficient pam_unix_auth.so.1 other auth required pam_ldap.so.1 debug # # passwd command (explicit because of a different authentication module) # #passwd auth required pam_passwd_auth.so.1 passwd auth sufficient pam_passwd_auth.so.1 passwd auth required pam_ldap.so.1 debug # # cron service (explicit because of non-usage of pam_roles.so.1) # cron account required pam_unix_account.so.1 # # Default definition for Account management # Used when service name is not explicitly mentioned for account management # other account sufficient pam_ldap.so.1 debug other account requisite pam_roles.so.1 other account required pam_unix_account.so.1 # # Default definition for Session management # Used when service name is not explicitly mentioned for session management # other session required pam_unix_session.so.1 # # Default definition for Password management # Used when service name is not explicitly mentioned for password management # other password required pam_dhkeys.so.1 other password requisite pam_authtok_get.so.1 other password requisite pam_authtok_check.so.1 other password required pam_authtok_store.so.1 jphan user info: apggd04dev# ldapsearch -x -b 'dc=pg,dc=dtveng,dc=net' 'uid=jphan' # extended LDIF # # LDAPv3 # base <dc=pg,dc=dtveng,dc=net> with scope subtree # filter: uid=jphan # requesting: ALL # # jphan, people, pg.dtveng.net dn: uid=jphan,ou=people,dc=pg,dc=dtveng,dc=net objectClass: top objectClass: posixAccount objectClass: shadowAccount objectClass: posixGroup cn: jphan uid: jphan uidNumber: 2003 gidNumber: 203 homeDirectory: /export/home/jphan loginShell: /usr/bin/csh gecos:: Sm9lIFBoYW4gMzEwLTk2NC00MTI1IA== shadowLastChange: 0 shadowMax: 0 shadowWarning: 0 userPassword:: ....= # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical