openldap-technical

openldap-technical@openldap.org

16 participants
9908 discussions

Openldap doesn't force password change and other related problems
by Francesco Belli 04 Mar '13

04 Mar '13

Hello All, I probably have something misconfigured on my openldap server, but it seems that this is not so easy to debug (for me). I use openldap 2.4.23 with ppolicy and accesslog overlays. I have the following behaviours: - when pwdMustChange and pwdReset are set to true, after login, user is not prompted to change the password, however if I run: [def_auditor@localhost fbelli]$ ldapwhoami -x -e ppolicy -D uid=def_auditor,ou=people,dc=pippo,dc=com -w ****** -ZZ -H ldap://mkernel ldap_bind: Success (0); Password must be changed (Password expires in 0 seconds) dn:uid=def_auditor,ou=people,dc=pippo,dc=com - When there are less of pwdExpireWarning seconds and user authenticates (bash shell or ldapsearch), it doesn't get any warning. - When password is expired and user uses one of his pwdGraceAuthNLimit, he doesn't get any warning (but it will get lockedout after). It looks like that for some reason the openldap server doesn't send warnings back to the user. However if user tryes to change the password to one that doesn't match the policy, it gets the correct warnings. Following there is my standard password policy: dn: ou=Policies,dc=aivp,dc=vtp ou: Policies description: Directory policies. objectClass: organizationalUnit dn: cn=Standard,ou=Policies,dc=aivp,dc=vtp cn: Standard description: Standard password policy. pwdAttribute: 2.5.4.35 pwdMinAge: 172800 pwdMaxAge: 5184000 pwdCheckQuality: 1 pwdCheckModule: check_password.so pwdMinLength: 8 pwdExpireWarning: 604800 pwdGraceAuthNLimit: 1 pwdInHistory: 20 pwdLockout: TRUE pwdLockoutDuration: 900 pwdMaxFailure: 3 pwdFailureCountInterval: 1200 pwdMustChange: TRUE objectClass: device objectClass: pwdPolicy objectClass: pwdPolicyChecker Overlay configuration: dn: olcOverlay={2}ppolicy objectClass: olcPPolicyConfig objectClass: olcOverlayConfig olcOverlay: ppolicy olcPPolicyDefault: cn=Standard,ou=Policies,dc=aivp,dc=vtp olcPPolicyUseLockout: TRUE olcPPolicyHashCleartext: TRUE And an example of an user when first inserted: dn: uid=def_auditor,ou=people,dc=aivp,dc=vtp cn: def_auditor gidnumber: 601 homedirectory: /home/def_auditor loginshell: /bin/bash objectclass: account objectclass: posixAccount objectclass: top uid: def_auditor uidnumber: 634 userPassword:: ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= pwdReset: TRUE Thanks in advance for any advice Best Regards, Francesco Belli

1 0

N-WAY replication cn=config and virtual IP
by Lanfeust troy 04 Mar '13

04 Mar '13

Hi all, today i have a little problem with openldap configuration. I have 2 server configured as N-WAY replication on database and cn=config. into cn=config we have olcServerId: 1 ldap://ldap-int1.domaine.fr olcServerId: 2 ldap://ldap-int2.domaine.fr replication is working. However to provide service to client we want to use a Virtual IP adresse. ( ldap-int-vip.domaine.fr ) On two server i have installed keepalived demon to manage Virtual IP. On nominal time the VIP is owned by ldap-int1 but she can going on ldap-int2 My problem is the slapd binary which don't want to start on secondary server I want to start slapd demon on all interface but if we use ldap://* in command line to start slapd he say: read_config: no serverID / URL match found. Check slapd -h arguments. How to make this configuration ? thanks

1 0

Setting Authentication & Access for ldap backend
by Chris Chipman 03 Mar '13

03 Mar '13

I have three servers running openldap 2.4. On superior server I have all account information. ldap://a.example.com On subordinate server I have an address book. ldap://b.example.com On third server I use an ldap backend to tie the two together. ldap://c.example.com Using 3rd server (ldap://c.example.com) to search and modify, I can authenticate on 1st server (a.example.com). But because no user account information is stored on 2nd server (b.example.com) I can't authenticate, or modify any entries there. My question is, how do I set up the ability to change entries in the subordinate database, if no entries can be bound to? Server One: olcSuffix: dc=example,dc=com olcDatabase: {1}hdb olcDBDirectory: /var/lib/ldap With an entry like so: dn: ou=address,dc=example,dc=com objectClass: extensibleobject objectClass: referral ou: address ref: ldap://b.example.com Server 2: olcReferral: ldap://a.example.com olcSuffix: ou=address,dc=example,dc=com olcDatabase: {1}hdb olcDBDirectory: /var/lib/ldap With an entry: dn: cn=Bob,ou=address,dc=example,dc=com objectClass: inetorgperson cn: Bob gn: Bob sn: Smith Server 3: olcSuffix: dc=example,dc=com olcDatabase: {1}ldap olcDBUri: ldap://a.example.com olcDBRebindAsUser: TRUE olcDBChaseReferrals: TRUE

1 0

Please help: Any way to query host membership in nested ldap groups?
by Gelen James 02 Mar '13

02 Mar '13

Hi all, I have a openldap server setup with netsted netgruops,. Say the netgroups are: ngA: (host1, -, - ), (host2, -, - ) ngB: ngA, (host3, - - ) ngc: ngB, (host4, -, -) Is there a way to find host1's membership? so that it can return: ngA, ngB, ngC? Thanks a lot. --Gelen

1 0

Unable to authenticate via pam_ldap
by Meghanand Acharekar 01 Mar '13

01 Mar '13

I've LDAP production server running over last 1 years without any issues, I'm suddently getting password fail error while authenticating via pam_ldap.so its show following error message, I'm able to authenticate using ldap client utilities like ldapsearch, also via some java application, On client side I got following error message in /var/log/secure Failed password for [username] from xx.xx.xx.xx port 38473 ssh2 fatal: Access denied for user [username] by PAM account configuration On LDAP server logs. => access_allowed: read access denied by auth(=xd) send_search_entry: conn 1711 access to attribute userPassword, value #0 not allowed ACL configuration on LDAP server access to attrs=userPassword by self write by anonymous auth by dn.base="cn=Manager,dc=example,dc=com" write by * none access to attrs=shadowLastChange by self write by * read access to * by self write by dn.base="cn=Manager,dc=example,dc=com" write by * read pam_ldap (/etc/pam.d/system-auth) configuration - client side #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_ldap.so try_first_pass auth sufficient pam_unix.so nullok use_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 debug minclass=4 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=0 minlen=8 password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok password sufficient pam_ldap.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_mkhomedir.so skel=/etc/skel/ umask=0077 session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_ldap.so The strange thing is I haven't made any changes on server or client side since a long time. Regards, Meghanand N. Acharekar " A proud Linux User " Reg Linux User #397975 ------------------------------------------ The gates in my computer are AND, OR and NOT; they are not Bill..

2 1

OpenLDAP slave-master synchronization problem
by Tian Zhiying 01 Mar '13

01 Mar '13

Hello， I have two openldap servers, and have configured the master-slave synchronization, but have a problem: When an entry in master server is changed it is automatically changed in the slave server. But, when an entry in slave server is changed it is not automatically changed in the master server. In the slave server slapd.conf config file, I've set up “updateref ldap://192.168.100.11:389“ , the 192.168.100.11 is my master server. The following is my configuration. Master Configuration: allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args access to * by * write database bdb suffix "dc=domain,dc=com" rootdn "cn=root,dc=domain,dc=com" overlay ppolicy rootpw {SSHA}DyNIn6rweGRnQP0ntGaZxynMllSA3/w4 directory /var/lib/ldap index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub replogfile /var/lib/ldap/openldap-master-replog loglevel 4095 replica host=192.168.70.15:389 binddn="cn=sa,dc=domain,dc=com" bindmethod=simple credentials=miao3p Slave Configuration: allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args access to * by * write database bdb suffix "dc=domain,dc=com" rootdn "cn=root,dc=domain,dc=com" overlay ppolicy rootpw {SSHA}sgBwprgmRciOEGTLjE5K9J22msm+U9NW directory /var/lib/ldap index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub updatedn "cn=sa,dc=domain,dc=com" updateref ldap://192.168.100.11:389 Any ideas? Thank you very much. Tian Zhiying

3 4

Is there any way to change structuralObjectClass of an LDAP entry?
by Marco Pizzoli 28 Feb '13

28 Feb '13

Hi all, yes, I already know this is not possible. But I have a particular scenario and maybe someone could give advice. In an LDAP tree I inherited some times ago, I have entries created many years ago by using a schema definition which implied an entry to acquire as structuralObjectClass a custom objectClass. This custom objectClass (let's say it's called custObjectClass) inherits from inetOrgPerson and mandates some specific attributes. Now, all entries are created expliciting the following objectClasses: - top - person - organizationalPerson - inetOrgPerson - custObjectClass The outcome is these entries have custObjectClass as structuralObjectClass. Now, I would like to make some cleaning on this tree, and I would like to change some schema definition on objects. First of all, I would like to NOT have custObjectClass as structuralObjectClass. Obviously I could slapcat my slapd engine, change the ldif and then re-import as new. But I would prefer to not switch off my slapd engine in the meantime. I can't afford that, to be honest... One idea I had was to create a replica consumer, change on it the schema definition (custObjectClass inheriting from TOP and being auxiliary instead of structural), and let the replication create the entries with the correct "structurality". I self-discovered this way is not viable, considering OL refuses to insert an entry with source structuralObjectClass not being defined structural on the slave as well. Now I'm asking for help to the community. Any hint welcome. How would you do? Thanks in advance Marco

2 1

additional info: objectClasses: value #0 invalid per syntax
by Jimmy Royer 28 Feb '13

28 Feb '13

Hello, I am starting out with openldap and I don't know it that much. I got the error mentioned in the title when trying to add an object class, which is apparently a very common one per my google searches. I've read that common causes are: * extraneous white space (especially trailing white space) * improperly encoded characters (LDAPv3 uses UTF-8 encoded Unicode) * empty values (few syntaxes allow empty values) This is the object class file I am trying to add, I picked it as an example on some website, to have something minimal and make it easier to test: # cat exObjectClasses.ldif dn: cn=schema changetype: modify add: objectClasses objectClasses: ( 2.16.840.1.113730.3.2.2.9 NAME 'blogger' DESC 'Someone who has a blog' SUP inetOrgPerson STRUCTURAL MAY blog ) I've checked if there was any trailing spaces at the end with the following: # cat -vte exObjectClasses.ldif dn: cn=schema$ changetype: modify$ add: objectClasses$ objectClasses: ( 2.16.840.1.113730.3.2.2.9$ NAME 'blogger'$ DESC 'Someone who has a blog'$ SUP inetOrgPerson STRUCTURAL$ MAY blog )$ I've made sure the file is UTF-8: # iconv -f ASCII -t UTF-8 exObjectClasses.ldif > exObjectClasses.ldif.utf8 And I don't think there are any empty values defined in the LDIF file. So when I type this command, I still have the "invalid per syntax error: # ldapmodify -x -W -H "ldaps://127.0.0.1" -D cn=Manager,dc=modelsolv,dc=com -f exObjectClasses.ldif Enter LDAP Password: modifying entry "cn=schema" ldap_modify: Invalid syntax (21) additional info: objectClasses: value #0 invalid per syntax This is the content of the /etc/openldap/slapd.conf file: # cat slapd.conf # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules # - modulepath is architecture dependent value (32/64-bit system) # - back_sql.la overlay requires openldap-server-sql package # - dyngroup.la and dynlist.la cannot be used at the same time # modulepath /usr/lib/openldap # modulepath /usr/lib64/openldap # moduleload accesslog.la # moduleload auditlog.la # moduleload back_sql.la # moduleload chain.la # moduleload collect.la # moduleload constraint.la # moduleload dds.la # moduleload deref.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload memberof.la # moduleload pbind.la # moduleload pcache.la # moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # moduleload rwm.la # moduleload seqmod.la # moduleload smbk5pwd.la # moduleload sssvlv.la # moduleload syncprov.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by running # /usr/libexec/openldap/generate-server-cert.sh. Your client software may balk # at self-signed certificates, however. TLSCACertificatePath /etc/openldap/certs TLSCertificateFile "\"OpenLDAP Server\"" TLSCertificateKeyFile /etc/openldap/certs/password # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! # enable on-the-fly configuration (cn=config) database config access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none # enable server status monitoring (cn=monitor) database monitor access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.exact="cn=Manager,dc=my-domain,dc=com" read by * none ####################################################################### # database definitions ####################################################################### database bdb suffix "dc=modelsolv,dc=com" checkpoint 1024 15 rootdn "cn=Manager,dc=modelsolv,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw SECRET # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM I was able to add a few entries in LDAP so far. So I know I am able to reach the server, the connection is fine, and LDAP is somewhat functional. But I can't modify the schema with objectclasses. Is there anything obvious that I am doing wrong? Do you have any recommendation for debugging further? Regards, Jimmy Royer

4 4

Limit on number of attrs in replica conf?
by Marco Pizzoli 28 Feb '13

28 Feb '13

Hi all, Is it possible I discovered a limit on the number of attributes I can specify on the "attrs" parameter of the replica directive in slapd.conf? In my config file, for the replica directive, I explicited a long list of attributes. On the provider side I can see, on the provider slapd logs, that only 8 of the attrs I specified on the replica directive are actually asked. Plus objectClass, structuralObjectClass and entryCSN. Is that the expected behaviour? I already checked on the man page and I don't see this limitation explicited Thanks in advance Marco

1 1

internal_modify in overlays
by Tim Watts 28 Feb '13

28 Feb '13

Hi, Does anyone know of a bit of code I can look at that does an *internal* (completed inline) LDAP_MOD_REPLACE operation on one attribute without chaining (ie it does a return 0)? I've found Sun docs for doing this in a slapi plugin but not an openldap slapd plugin. Reason: Basically, I've been hacking on smbkrb5pwd.c and discovered if I do a "return 0;" at the end, I can prevent chaining (not documented but found some openldap hacking - denyop.c - that demonstrated this). At this point, smbkrb5pwd.c has changed our MIT Kerberos principal's password, and "return 0" prevenrs_modsts slapd from chaining onto the code that tries to set a local hash into userPassword. And it does it without causing a nasty client error. I thought: would it not be nice to set userPassword: to {SASL}UID(a)KERB.REALM now... Each user's auth method gets switched upon the first successful password change that propagates to kerberos. However, all the existing overlays seem to set extra attributes by setting up a request in ->rs_mods off the original request. I assume these get actioned after a "return SLAP_CB_CONTINUE". So - how do set an attribute if we are halting the chain at our overlay? Cheers :) Tim -- Tim Watts Personal Blog: http://squiddy.blog.dionic.net/ http://www.sensorly.com/ Crowd mapping of 2G/3G/4G mobile signal coverage

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical