openldap-technical

openldap-technical@openldap.org

7 participants
9901 discussions

Usage of groups in an access control
by Marco de Booij 28 Jan '13

28 Jan '13

I use openLDAP already for years to store my users so I have to define them only once. The users can logon to both Linux and Windows (samba). Now I want to add address-books and manage the access rights. I have a problem with the usage of groups in an access control. I want to gave addressbooks in my LDAP but they should not be accessible by everybody. I used http://www.openldap.org/faq/data/cache/52.html to configure openLDAP but it does not seem to work. I have created a group like this: dn: cn=abk-admin,ou=Roles,dc=example,dc=com objectClass: groupOfNames member: cn=My ENTRY,ou=People,dc=example,dc=com cn: abk-admin and an address-book like this: dn: ou=abk1,ou=Addressbooks,dc=example,dc=com ou: abk1 objectClass: organizationalUnit objectClass: top (Both entries are output of slapcat. I did not put in the attributes like creatorsName and entryUUID) In the slapd:conf I have the following access rules: access to attrs=userPassword,sambaNTPassword,sambaLMPassword,sambaPwdMustChange,sambaPwdLastSet by dn="cn=admin,dc=example,dc=com" write by dn="cn=proxyuser,dc=example,dc=com" read by anonymous auth by self write by * none access to attrs=shadowLastChange,shadowMax by self write by * read access to dn.base="" by * read access to * by dn="cn=admin,dc=example,dc=com" write by * read access to dn.children="ou=abk1,ou=Addressbooks,dc=example,dc=com" by dn="cn=admin,dc=example,dc=com" write by groupOfNames="cn=abk-admin,ou=Roles,dc=example,dc=com" write by groupOfNames="cn=abk-user,ou=Roles,dc=example,dc=com" read by * none I searched around and changed dn.children by dn.subtree and dn.one but the result is the same. I can read the entries but I cannot insert or delete an entry. I can only do this with admin but only if the line for admin is defined. What did I do wrong or understood wrong? I tried to find the answer on the internet but was not able :( OpenLDAP: slapd 2.4.23 (Jun 16 2011 02:53:39) Debian 6.0.6 Regards, Marco

4 6

Re: Permissions, users, startup when install from source
by Ori Bani 28 Jan '13

28 Jan '13

Thanks for your reply, >> If compiling and installing from source, I don't see any information >> in the manual about how to auto-start the software and about >> process/file/directory permissions and ownership. I'm still searching >> the Faq-O-Matic (which is a little frustrating). >> >> Taking a step back, I'd love to install from yum on RHEL/CentOS and >> let it be taken care of in a trusted manner. But we require better >> password hashing than SHA1, so we are required to compile by hand >> using the passwd/sha2 contributed module (little surprised this isn't >> accepted into the core project, but I'm sure there are reasons). >> Maybe I can find this in a third-party repo somewhere? > > Not sure what you mean. the SHA2 contrib module is shipped with every > OpenLDAP release. Thus, as best I can tell, it is indeed included. My "surprised" comment is in reference to the fact that the default build of OpenLDAP only supports SHA1, which is widely regarded as deprecated. Why hasn't the sha2 module been migrated out of the contrib directory is what I am getting at (which commonly requires situations like this -- forcing people who wouldn't otherwise do so to install from source just to obtain this feature). One could argue that situations like this contribute to the lack of adoption of stronger password schemes in general. Something of an off-topic tangent. > If you are using RHEL or CentOS, you may be interested in > <http://ltb-project.org/wiki/download#openldap> Great. I will investigate. Does anyone else know of any yum-compatible repos that have a sha2-enabled OpenLDAP build in them? Anyone know anything about the OpenLDAP packages in RepoForge? I actually only assumed without testing that the OpenLDAP package in the CentOS base repo doesn't have the sha2 module compiled in. I should go back and check that assumption. Also, reflecting on the installation of the sha2 module, it occurs to me that short of the CentOS repo package already having sha2 compiled in, the best course of action is probably to compile only the sha2 module and use it with the CentOS package --- including the module in the slapd configuration seems to be the extent of integration, so that should work, no? If so, I think this would be the best option. >> After installation, what is commonly done in this regard? Create >> user/group "ldap" with no login shell and chown ldap:ldap on >> /usr/local/var/openldap-data? Is that all? > > It depends on your needs. I have done anything from running slapd as root, > to running it as a specific user. I'd welcome pointers to somewhere this is discussed (don't see it in the docs, maybe in the FAQ?). I don't have needs that are much different than anyone else. I naively assume slapd should generally not be run as root. In that case, is creating a ldap user/group and chowning the openldap-data directory the only things to do? >> Then what do people use for auto-starting the software (presumably >> with -u ldap -g ldap) in a RedHat environment? > > I wrote my own startup script that works with chkconfig. > <http://linuxcommand.org/man_pages/chkconfig8.html> I'm looking for anyone who wants to share such scripts. Thanks kindly for your time, much appreciated.

5 9

Re: syncrepl issue
by Meike Stone 28 Jan '13

28 Jan '13

> > a) Use a current release. That would be 2.4.33. > b) Delta-syncrepl supports MMR in current releases > c) The reason I suggest delta-syncrepl is because syncrepl is known to be > problematic, particularly with MMR. If you want reliable replication, use > delta-syncrepl. Is it recommended in MMR setups to use delta-syncrepl before syncrepl in general? Are there any disadvantages, like using more RAM, or other things to care..? Thanks, Meike

2 1

replication between a back-sql master and back-hdb slave
by Benin Technologies 28 Jan '13

28 Jan '13

Hi, I set up a back-sql server to access some existing data in a postgresql database. I was wondering if it's possible to replicate that server to some (read-only) back-hdb servers. Thanks BT

2 2

Is any way to make proxy cache working for acl requests?
by Tio Teath 28 Jan '13

28 Jan '13

I'm thick and tired of configuring this dame thing! I mean slapo-pcache. It just won't work. Is any way to force this to cache JUST EVERYTHING, including ACL requests to remote server? I don't care of disk or memory usage, I just want dame thing working!

1 0

back-sql : defining groups
by DavidHornung 27 Jan '13

27 Jan '13

Hello, until now I don't understand how to add users to a group in Openldap with back-sql I use a VIEW for ldap_entries like described in the manual pages of slapd-sql. CREATE VIEW ldap_entries (id, dn, oc_map_id, parent, keyval) AS SELECT 0, UPPER(’o=MyCompany,c=NL’), 3, 0, ’baseObject’ FROM unixusers WHERE userid=’root’ UNION SELECT (1000000000+userid), UPPER(CONCAT(CONCAT(’cn=’,gecos),’,o=MyCompany,c=NL’)), 1, 0, userid FROM unixusers UNION SELECT (2000000000+groupnummer), UPPER(CONCAT(CONCAT(’cn=’,groupnaam),’,o=MyCompany,c=NL’)), 2, 0, groupnummer FROM groups; How can I add users to a group? 1.) build additional entries like uid=testuser,cn=group1,o=MyCompany,c=NL OR 2.) use the memberOf Attribute (but how?) Thank you for your answers Cheers, David

1 0

Re: slapcat output is truncated every now and then
by Bálint Réczey 25 Jan '13

25 Jan '13

Hi Quanah, 2013/1/25 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Friday, January 25, 2013 12:07 AM +0100 Bálint Réczey < > balint(a)balintreczey.hu> wrote: > > >> I have a attached two patches hoping that they may be useful. >> > > I suggest you file an ITS if you want them considered for inclusion: > I have file them under http://www.openldap.org/its/index.cgi?findid=7503 and http://www.openldap.org/its/index.cgi?findid=7504 hopefully complying to the instructions. Please CC me in further related discussions about the problem because I will unsubscribe from the list for now. Cheers, Balint

2 2

using back-sql with cn=config
by Benin Technologies 25 Jan '13

25 Jan '13

Hi, Has anyone out there managed to successfully convert slapd.conf into cn=config with back-sql enabled ? I'm on Debian 6 / OpenLDAP 2.4.33 with back-sql support (./configure --enable-sql) According tohttp://www.openldap.org/software/release/changes.html, back-sql supports dynamic config as of version 2.4.27. So I converted slapd.conf to slapd.d, conversion went well. However, when I start slapd, I get the following message : # /usr/local/libexec/slapd -u openldap -g openldap -d -1 ....... 50ff3f0a<<< dnPrettyNormal:<cn=root,dc=example,dc=com>,<cn=root,dc=example,dc=com> 50ff3f0a olcSqlInsEntryStmt: value #0:<olcSqlInsEntryStmt> extra cruft after<SQL expression>. 50ff3f0a config error processing olcDatabase={1}sql,cn=config: <olcSqlInsEntryStmt> extra cruft after<SQL expression> 50ff3f0a send_ldap_result: conn=-1 op=0 p=0 50ff3f0a send_ldap_result: err=19 matched="" text="" 50ff3f0a slapd destroy: freeing system resources. 50ff3f0a slapd stopped. 50ff3f0a connections_destroy: nothing to destroy. The error message seems to be "extra cruft after<SQL expression>" If I edit slapd.d/cn=config/olcDatabase={1}sql.ldif and I comment the line starting with olcSqlInsEntryStmt, then slapd starts fine. So what's the right syntax for olcSqlInsEntryStmt ??? Thanks Ben

2 2

slapd not starting at boot when compiled with --enable-sql
by Benin Technologies 25 Jan '13

25 Jan '13

Hi, I'm not sure wether this is an OpenLDAP issue or a Debian issue... When installing OpenLDAP 2.4.33 from source on Debian 6.0.4 with back-sql support, I'm unable to make it start at boot. I tested it a few times to isolate the problem, and the simple fact of installing OpenLDAP with "--enable-sql" seems to be the cause. My "/etc/init.d/slapd" file works fine, but the service won't start at boot. Does anybody have an idea ? Below the details of my tests, I tried two configurations, without and with back-sql enabled : Config 1°/ I installed OpenLDAP 2.4.33 WITHOUT back-sql support. (plain "./configure") I installed an adequate "/etc/init.d/slapd" file (inspired from the file shipped with the Debian package installation), and then I installed the slapd service (update-rc.d slapd defaults). When I reboot the debian server, everything works fine, slapd starts. Config 2°/ Same installation, but this time WITH back-sql support (./configure --enable-sql) Like before, I deployed my "/etc/init.d/slapd" file. The file works fine ("/etc/init.d/slapd start" starts the OpenLDAP server) Then I install the slapd service, it seems to install well (update-rc.d slapd defaults). But when I reboot, slapd fails to start. I tried the following commands : # service slapd start Starting OpenLDAP: slapd failed! # /etc/init.d/slapd start Starting OpenLDAP: slapd. # service slapd stop Stopping OpenLDAP: slapd So it seems the "slapd" service can not be started by the "service" command (and thus cannot be launched a boot). NOTE that the ONLY difference between Config 1 and Config 2 is that I compiled OpenLDAP with "--enable-sql". At this point, I don't even use a back-sql backend (I'm still with the default configuration, using the bdb backend). Does anybody have an idea what's happening ? One last thing : I tried also to compile OpenLDAP with back-sql as a dynamic loaded module (./configure --enable-modules --enable-sql=mod). Same result, if my "slapd.conf" contains the instructions to dynamically load "back_sql.la", then : - OpenLDAP doesn't start at boot - "#service slapd start" doesn't work - "#/etc/init.d slapd start" still works Ben Note : I tried to use insserv instead of update-rc.d, same result

1 0

Re: syncrepl issue
by Frank Luo 25 Jan '13

25 Jan '13

thanks. I am using 2.4.23 sudo /opt/openldap/libexec/slapd -V @(#) $OpenLDAP: slapd 2.4.23 (Mar 9 2011 11:39:07) $ I understand that delta-syncrepl will significantly reduce traffic but that should not be the problem here. Also we have mirror mode turned on and I read "Note: Delta-syncrepl is not yet supported with MirrorMode." Frank On Fri, Jan 25, 2013 at 2:14 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Friday, January 25, 2013 11:59 AM -0500 Frank Luo > <frank.luoy(a)gmail.com> wrote: > >> We have 4 openldap servers, 1 and 2 are masters with mirror mode., 3 >> and 4 are slaves. 3 and 4 sometimes get out of sync with masters. But >> a few minutes or a few hours later, it can get synced again with some >> "random" events. The reason I call it "random" because I could not >> find any patter yet. This happens almost every day. > > > a) Always note the version of OpenLDAP you are using > b) Use delta-syncrepl > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical