openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

ldap, kerberos and authorization by group membership
by brendan kearney 18 Mar '13

18 Mar '13

all, please excuse my ignorance, as i am still learning. i have started working with mit kerberos 5 and openldap. i have the krb5 database in ldap, have several principals created, can can authenticate using kerberos. what i would like to accomplish is authorization based on group membership. i am unclear on how to do this, and if this requires the use of SASL (via the cyrus-sasl packages). am i able to create a groupofnames object, populated with kerberos principals and accomplish authorization by checking for membership of that groupofnames? the scenario is mod_auth_kerb implemented in httpd, or access control via acl in squid. based on group membership, certain functionality or access would be given to authenticated users. i have read and re-read the guide included with openldap, but am still unclear about what is needed. Below is some info about versions, etc... thank you in advance for any guidance. OS: Fedora: 16 x86_64 OpenLDAP: 2.4.26-8 MIT Kerberos: 1.9.4-3 Cyrus SASL: 2.1.23-27 thank you, brendan

2 2

Re: provider/consumer: entries have identical CSN
by Walter Werner 18 Mar '13

18 Mar '13

hi everyone ok, i think i found it :-). It is the sizelimit parameter on the provider. 'The olcSizeLimit/sizelimit attribute/directive specifies the number of entries to return to a search request' Due to the website http://www.zytrax.com/books/ldap/ch6/ It says that 'If no sizelimit directive is defined the default is 500.' No wonder that i had always 500 results with ldapsearch -x, despite the fact, that i deleted some entries. Walter 2013/3/18 Walter Werner <wernwa(a)gmail.com>: > hello everyone > > I still did not solve my problem, but i think the solution could be > really some size limitation (already suggested by Marc) > > LDAP_RES_SEARCH_RESULT (4) Size limit exceeded > > The replication was until Object stud31. So i deleted on provider (on > the test environment i can do that) Objects stud01 until stud06. And > the replication went until stud34. 6 deleted and 3 could replicate. I > guess the other 3 objects where replicated in some other sub trees, i > did not noticed, if the size-limit is a constant. The question is, is > there an easy way to see the difference between the provider and > consumer? > > And the main question is, where can the size limitation (if i am > thinking right) comes from? > > Every help is highly appreciated. > > Walter > > 2013/3/15 Walter Werner <wernwa(a)gmail.com>: >> hi Marc >> >> Thanks a lot for you quick answer. >> >> 2013/3/15 Marc Patermann <hans.moser(a)ofd-z.niedersachsen.de>: >>> Walter, >>> >>> Walter Werner schrieb (15.03.2013 10:58 Uhr): >>> >>> >>>> I get a strange replication problem. After i didn't find a solution >>>> somewhere on internet i decided to post to this mailing-list. Probably >>>> i should describe my system settings. Both consumer and provider are >>>> running on suse 12.1. And i got the errors with openldap version >>>> 2.4.26-3.1.3. Since it is a good >>>> behavior i red somewhere on this email-list, i compiled the latest >>>> openldap v2.4.34 and could unfortunately reproduce the same error. >>> >>> The is a repo, did you know? >>> http://download.opensuse.org/repositories/network:/ldap:/OpenLDAP:/ >>> (it is still 2.4.33, but anyway) >> >> No, i didn't. That can save me a lot of time in the future. >> >>> >>>> Mar 15 09:17:43 ismvm22 slapd[17313]: dn_callback : entries have >>>> identical CSN uid=stud31,ou=Student,ou=People,ou=myou,dc=mybase >>>> 20130315072217.081269Z#000000#000#000000 >>> >>> do the objects differ from provider to consumer? >> >> Especially that stud31 object is exactly the same. I am not sure all >> copied objects are the same, if that was the question. Apparently ldap >> has added the stud objects in alphabetical order. There are all studXX >> until stud31. So after stud31 there should be stud32 stud33 and so on, >> but they are missing on the consumer. It is maybe no accident that in >> the log it ends with stud31 object. >> >> dn_callback : entries have identical CSN uid=stud31... >> >>> >>>> Mar 15 09:17:43 ismvm22 slapd[17313]: do_syncrep2: rid=010 >>>> LDAP_RES_SEARCH_RESULT (4) Size limit exceeded >>>> Mar 15 09:17:43 ismvm22 slapd[17313]: do_syncrep2: rid=010 (4) Size >>>> limit exceeded >>>> Mar 15 09:17:43 ismvm22 slapd[17313]: do_syncrepl: rid=010 rc -2 >>>> retrying (58 retries left) >>> >>> Change that! >> >> Do you mean Size limit exceeded? I already thought about that. Please >> look at the partial configs in the first mail.On the provider time and >> size are set to unlimited for the replicator reader. On the consumer >> it is also set to unlimited. Maybe i forgot some other option. >> >>>> overlay syncprov >>> >>> man slapo-syncprov tells more about options to the syncprov overlay. >> >> There are indeed a lot more. I tried with additional parameter for checkpoint >> >> syncprov-checkpoint 100 10 >> >> No effect. Other options seems to me for speeding up ldap. I do not >> want to complicate things. I don't now if it is useful, before trying >> out something, i also always deleted the database files on the >> consumer to avoid memory effects of some sort. >> >> Still not replicating properly. >> >> Walter

2 1

impact on performance by adding jpeg file
by Jignesh Patel 18 Mar '13

18 Mar '13

We have around 10 million users and trying to add images(only faces), is it wise to do that way? Or should I bring images from database? -jignesh

2 2

Problems with authentication against OpenlDAP
by francesco.policastro＠selex-es.com 18 Mar '13

18 Mar '13

Hi all, I have two OpenLDAP servers (2.4.34) used by some applications to authenticate. Both servers use the meta backend, that is the frontend to two AD domains in separate forests. Ldapsearch correctly finds the users in both servers, while authentication works for one only. I must say that I had to exclude some portions of the trees in order to avoid duplicate names. My "correct" users are in 15 subtrees. In the working server I configured 15 URI's, one for each subtree, specifying for each of them the credentials, the attribute mappings and the suffixmassage. The bad news is that slapd.conf is 580 lines and its maintenance is error prone. That's why I configured the second server with two URI's only and with ACL's to limit the access to the 15 subtrees only. The resulting slapd.conf is much more readable and easy to maintain, but it does not work. The ACL's are all of this type: access to dn.subtree="ou=Users,ou=MySite,dc=FirstSubdomain,dc=Company,dc=com" read by dn.exact="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com" read There are no other ACL's, but I already tried adding something like "access to * by * read" with no success. As said before ldapsearch works fine, while authentication does not. Please look at the excerpt from the log files, for both servers, when I try to authenticate. Both servers start the same sequence, but one stops just after reading the same search result. conn=1033 fd=10 ACCEPT from IP=10.31.222.106:38492 (IP=0.0.0.0:389) conn=1033 op=0 BIND dn="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com" method=128 conn=1033 op=0 BIND dn="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com" mech=SIMPLE ssf=0 conn=1033 op=0 RESULT tag=97 err=0 text= conn=1033 op=1 SRCH base="dc=Company,dc=com" scope=2 deref=0 filter="(sAMAccountName=policastro)" conn=1033 op=1 SRCH attr=sAMAccountName conn=1033 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1033 op=2 UNBIND conn=1033 fd=10 closed =========================== conn=4960 fd=373 ACCEPT from IP=10.31.221.162:40893 (IP=0.0.0.0:389) conn=4960 op=0 BIND dn="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com" method=128 conn=4960 op=0 BIND dn="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com" mech=SIMPLE ssf=0 conn=4960 op=0 RESULT tag=97 err=0 text= conn=4960 op=1 SRCH base="dc=Company,dc=com" scope=2 deref=0 filter="(sAMAccountName=policastro)" conn=4960 op=1 SRCH attr=sAMAccountName conn=4960 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=4960 op=2 BIND anonymous mech=implicit ssf=0 conn=4960 op=2 BIND dn="cn=Policastro Francesco,ou=Users,ou=MySite,dc=FirstSubdomain,dc=Company,dc=com" method=128 conn=4960 op=2 BIND dn="cn=Policastro Francesco,ou=Users,ou=MySite,dc=FirstSubdomain,dc=Company,dc=com" mech=SIMPLE ssf=0 conn=4960 op=2 RESULT tag=97 err=0 text= conn=4960 op=3 UNBIND conn=4960 fd=373 closed conn=4961 fd=373 ACCEPT from IP=10.31.221.162:40894 (IP=0.0.0.0:389) conn=4961 op=0 BIND dn="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com" method=128 conn=4961 op=0 BIND dn="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com" mech=SIMPLE ssf=0 conn=4961 op=0 RESULT tag=97 err=0 text= conn=4961 op=1 SRCH base="dc=Company,dc=com" scope=2 deref=0 filter="(&(!(?employeeID=-*))(employeeID=*)(mail=*)(givenName=*)(sn=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(sAMAccountName=policastro))" conn=4961 op=1 SRCH attr=sAMAccountName conn=4961 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=4961 op=2 SRCH base="cn=Policastro Francesco,ou=Users,ou=MySite,dc=FirstSubdomain,dc=Company,dc=com" scope=0 deref=0 filter="(&(!(?employeeID=-*))(employeeID=*)(mail=*)(givenName=*)(sn=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" conn=4961 op=2 SRCH attr=givenName sn mail employeeID sAMAccountName conn=4961 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=4961 op=3 UNBIND conn=4961 fd=373 closed conn=4962 fd=373 ACCEPT from IP=10.31.221.162:40895 (IP=0.0.0.0:389) conn=4962 op=0 BIND dn="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com" method=128 conn=4962 op=0 BIND dn="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com" mech=SIMPLE ssf=0 conn=4962 op=0 RESULT tag=97 err=0 text= conn=4962 op=1 SRCH base="dc=Company,dc=com" scope=2 deref=0 filter="(sAMAccountName=policastro)" conn=4962 op=1 SRCH attr=sAMAccountName conn=4962 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=4962 op=2 SRCH base="cn=Policastro Francesco,ou=Users,ou=MySite,dc=FirstSubdomain,dc=Company,dc=com" scope=0 deref=0 filter="(objectClass=*)" conn=4962 op=2 SRCH attr=shadowExpire conn=4962 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=4962 op=3 UNBIND Can anyone explain me what happens and how to let the ACL version work? Thanks, Francesco

1 0

LMDB - growing the database
by Shmulik Regev 16 Mar '13

16 Mar '13

Hi, I understand that the DB size has an upper limit set by the call to mdb_env_set_mapsize . I wonder what is the best strategy for growing the size. From what I read, the put operations of either txn or cursor may fail with the MDB_MAP_FULL error but then it is too late to change the DB size. On the other hand I didn't find in mdb_env_stat (or perhaps I didn't understand) any information suggesting how full is the DB so I can't really implement any strategy for preemptively growing the DB based on the used space. Did I miss anything? Cheers, Shmul

3 2

Lua wrapper for LMDB
by Shmulik Regev 16 Mar '13

16 Mar '13

Hi, I've been working on a Lua wrapper for LMDB - https://github.com/shmul/lightningdbm . It is a thin wrapper around the database leveraging upon Lua's elegant integration with C libraries. Feedback is welcomed warmly. Cheers, Shmul

4 4

Multiple uid's?
by R V 15 Mar '13

15 Mar '13

Is there a alias entry that can be used for authentication? Basically I am looking for away to allow a user record to have multiple uid's. Example: uid johnsmith uid jsmith Trying to bring multiple services under one authentication method. The challenging part, some services have varying usernames as list above. Which unfortunately can not be changed. Thanks RV

2 1

Encryption or hash for password?
by Gerhardus Geldenhuis 15 Mar '13

15 Mar '13

Hi I am using the default Ubuntu 12.10 openldap installation and have inherited an existing ldap setup. When I do a slapcat -n 1 It shows userPassword entries as follows: userPassword:: e2NyeFB0fSQxJEkwKGc3bGJjJFpwL3JndlpCZDBlSPZuZGdoMFczTC8= ( password string has been edited... ) I am not sure how this is encoded... is there a way to find out? I have tried md5 which is currently the default encoding for our servers. I have also tried slappasswd with various -h option to see if I can recreate the same hash if it is a hash. I want to add new users using ldif and would like to encrypt/hash their passwords in a similar fashion if possible. Any help would be appreciated. Regards -- Gerhardus Geldenhuis

5 5

provider/consumer: entries have identical CSN
by Walter Werner 15 Mar '13

15 Mar '13

hi to everyone I get a strange replication problem. After i didn't find a solution somewhere on internet i decided to post to this mailing-list. Probably i should describe my system settings. Both consumer and provider are running on suse 12.1. And i got the errors with openldap version 2.4.26-3.1.3. Since it is a good behavior i red somewhere on this email-list, i compiled the latest openldap v2.4.34 and could unfortunately reproduce the same error. The Problem is that the consumer does not replicate all objects. The loglevel on the consumer is loglevel stats sync This is the partial output of the /var/log/messages ... Mar 15 09:17:43 ismvm22 slapd[17313]: dn_callback : entries have identical CSN cn=stud31,nisMapName=ws,ou=autofs,ou=etc,ou=Data,ou=myou,dc=mybase 20130315072217.079828Z#000000#000#000000 Mar 15 09:17:43 ismvm22 slapd[17313]: syncrepl_entry: rid=010 be_search (0) Mar 15 09:17:43 ismvm22 slapd[17313]: syncrepl_entry: rid=010 cn=stud31,nisMapName=ws,ou=autofs,ou=etc,ou=Data,ou=myou,dc=mybase Mar 15 09:17:43 ismvm22 slapd[17313]: syncrepl_entry: rid=010 entry unchanged, ignored (cn=stud31,nisMapName=ws,ou=autofs,ou=etc,ou=Data,ou=myou,dc=mybase) Mar 15 09:17:43 ismvm22 slapd[17313]: syncrepl_message_to_entry: rid=010 DN: uid=stud31,ou=Student,ou=People,ou=myou,dc=mybase, UUID: 5949c18a-cd49-4dec-85dc-68ae129c13d7 Mar 15 09:17:43 ismvm22 slapd[17313]: syncrepl_entry: rid=010 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Mar 15 09:17:43 ismvm22 slapd[17313]: syncrepl_entry: rid=010 inserted UUID 5949c18a-cd49-4dec-85dc-68ae129c13d7 Mar 15 09:17:43 ismvm22 slapd[17313]: dn_callback : entries have identical CSN uid=stud31,ou=Student,ou=People,ou=myou,dc=mybase 20130315072217.081269Z#000000#000#000000 Mar 15 09:17:43 ismvm22 slapd[17313]: syncrepl_entry: rid=010 be_search (0) Mar 15 09:17:43 ismvm22 slapd[17313]: syncrepl_entry: rid=010 uid=stud31,ou=Student,ou=People,ou=myou,dc=mybase Mar 15 09:17:43 ismvm22 slapd[17313]: syncrepl_entry: rid=010 entry unchanged, ignored (uid=stud31,ou=Student,ou=People,ou=myou,dc=mybase) Mar 15 09:17:43 ismvm22 slapd[17313]: do_syncrep2: rid=010 LDAP_RES_SEARCH_RESULT Mar 15 09:17:43 ismvm22 slapd[17313]: do_syncrep2: rid=010 LDAP_RES_SEARCH_RESULT (4) Size limit exceeded Mar 15 09:17:43 ismvm22 slapd[17313]: do_syncrep2: rid=010 (4) Size limit exceeded Mar 15 09:17:43 ismvm22 slapd[17313]: do_syncrepl: rid=010 rc -2 retrying (58 retries left) The config files privider: --------------------------------------------- access to dn.base="" by * read access to dn.base="cn=Subschema" by * read # lege ein replicator reader an der auch passwörter lesen kann limits dn.exact="cn=replicator,dc=mybase" size=unlimited time=unlimited access to * by dn.exact="cn=replicator,dc=mybase" read by * break access to attrs=userPassword,userPKCS12 by self write by * auth access to attrs=shadowLastChange by self write by * read access to * by * read database bdb suffix "dc=mybase" checkpoint 1024 5 cachesize 10000 rootdn "cn=ldapadmin,dc=mybase" directory /opt/var/openldap-data/ # Indices to maintain index objectClass eq index entryUUID eq overlay syncprov ------------------------------------------------------------------ On the consumer side is all same except the syncrepl directive consumer: ------------------------------------------------------- syncrepl rid=10 provider=ldap://172.22.199.121 searchbase="dc=mybase" type=refreshAndPersist retry="30 60 120 +" filter="objectClass=*" scope=sub attrs="*,+" sizelimit=unlimited timelimit=unlimited binddn="cn=replicator,dc=mybase" bindmethod=simple credentials="secred" ------------------------ Any Ideas? I am glad for every help.

2 1

Local group and ldap user combination
by Gerhardus Geldenhuis 14 Mar '13

14 Mar '13

Hi Admittedly this is slightly OT but I were hoping someone could point me in the right direction. I want to be able to grant LDAP users group membership to local groups on a Ubuntu box. For example the adm group. How would I go about doing this? As a very quick test I created a adm group in ldap but it is not having the desired effect. Output from getent group | grep arm adm:x:4: adm:*:4:uid=ggeldenhuis,ou=People,dc=example,dc=com The first adm group is the local file group and the second my ldap group. Am I going about this in the wrong way... ? Regards -- Gerhardus Geldenhuis

3 6

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical