openldap-technical

openldap-technical@openldap.org

12 participants
9961 discussions

ppolicy on consumers
by Andrei BĂNARU 21 Feb '13

21 Feb '13

Hi, Did anyone manage to get the *ppolicy overlay* to work on the *consumers *? The user gets the *pwdAccountLockedTime *attribute on the provider and the consumers. To validate this I use: /[root@opennms ~]# //*ldapwhoami -x -e ppolicy -D "uid=user1,ou=People,ou=Country1,dc=example,dc=com" -w'password' -h ldap-master.example.com*//* *//*ldap_bind: Invalid credentials (49); Account locked*/ where *ldap-master.example.com* is the *provider*. /[root@opennms ~]# //*ldapwhoami -x -e ppolicy -D "uid=user1,ou=People,ou=Country1,dc=example,dc=com" -w'password' -h ldap.example.ro*//* *//*dn:uid=user1,ou=People,ou=Country1,dc=example,dc=com*/ where *ldap.example.ro* is one of the *consumers*. The same issue occurs also on expired passwords. On the consumer I've used *ppolicy_forward_updates* and that works like a charm. Did I miss something vital in the configuration ? Thx! -- Andrei BĂNARU Internal Support CCNA Security, CCIP StreamWIDE Romania

1 0

enabling logs in openLDAP
by Jignesh Patel 21 Feb '13

21 Feb '13

How to enable logs to capture authentication information in openLDAP 2.4.33

2 1

Append `git log -p COMMIT~..COMMIT` to an OpenLDAP commit message
by SATOH Fumiyasu 21 Feb '13

21 Feb '13

FYI. https://github.com/fumiyas/mail-filters/blob/master/openldap-commitmail-adj… -- -- Name: SATOH Fumiyasu @ OSS Technology Corp. (fumiyas @ osstech co jp) -- Business Home: http://www.OSSTech.co.jp/ -- GitHub Home: https://GitHub.com/fumiyas/ -- PGP Fingerprint: BBE1 A1C9 525A 292E 6729 CDEC ADC2 9DCA 5E1C CBCA

1 0

meta backend subtree directive ignored by conversion to cn=config
by francesco.policastro＠selex-es.com 20 Feb '13

20 Feb '13

Hi all, I realized that the subtree-include directives I use in my meta backend are not converted at all to cn=config. I cannot find them in cn=config tree. The slapd version is 2.4.33 as patched after ITS#7525 (openldap-648d28f.tar.gz) Here is my slapd.conf: ==================================================== # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/dyngroup.schema attributetype ( 1.2.840.113556.1.4.221 NAME 'sAMAccountName' EQUALITY caseExactMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE ) attributetype ( 1.2.840.113556.1.4.35 NAME 'employeeID' EQUALITY caseExactMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE ) attributetype ( 1.2.840.113556.1.4.8 NAME 'userAccountControl' EQUALITY integerMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.27' SINGLE-VALUE ) attributetype ( 1.2.840.113556.1.4.656 NAME 'userPrincipalName' EQUALITY caseExactMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE ) # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 pidfile /var/run/slapd.pid # ---------------------- backend meta backend hdb # ---------------------- # ---------------------- database meta # ---------------------- suffix "dc=newco,dc=com" readonly on rootdn "cn=LdapBindUser,dc=newco,dc=com" rootpw secret1 # no anonymous bind require authc conn-ttl 25m dncache-ttl disabled access to * by * none # first domain uri "ldap://server1.it.domain1.com/dc=first,dc=newco,dc=com" idassert-bind bindmethod=simple binddn="cn=LDAP User,ou=ITStaff,dc=it,dc=domain1,dc=com" credentials=secret2 chase-referrals no rebind-as-user true map objectclass groupOfNames * map objectclass person * suffixmassage "dc=first,dc=newco,dc=com" "dc=it,dc=domain1,dc=com" subtree-include "ou=Applications,ou=Groups Shared,dc=first,dc=newco,dc=com" subtree-include "ou=Users,ou=1st-location,dc=first,dc=newco,dc=com" subtree-include "ou=Users,ou=2nd-location,dc=first,dc=newco,dc=com" subtree-include "ou=Users,ou=3rd-location,dc=first,dc=newco,dc=com" # map visible attributes to matching attributes on backend map attribute distinguishedName * map attribute givenName * map attribute description * map attribute sn * map attribute cn * map attribute mail * map attribute samAccountName * map attribute userAccountControl * map attribute employeeID * map attribute userPrincipalName * # map everything else to null map attribute * # second domain uri "ldap://server2.domain2.net/ou=organizationalUnit,dc=second,dc=newco,dc=com" idassert-bind bindmethod=simple binddn="cn=ldap-2,cn=Users,dc=domain2,dc=net" credentials=secret3 chase-referrals no rebind-as-user true map objectclass groupOfNames * map objectclass person * suffixmassage "dc=second,dc=newco,dc=com" "dc=domain2,dc=net" subtree-include "ou=Users,ou=1st-location,ou=organizationalUnit,dc=second,dc=newco,dc=com" subtree-include "ou=My-ou,ou=1st-location,ou=organizationalUnit,dc=second,dc=newco,dc=com" subtree-include "ou=Remote Sites,ou=organizationalUnit,dc=second,dc=newco,dc=com" # map visible attributes to matching attributes on backend map attribute distinguishedName * map attribute givenName * map attribute description * map attribute sn * map attribute cn * map attribute mail * map attribute samAccountName * map attribute userAccountControl * map attribute employeeID pager map attribute userPrincipalName * # map everything else to null map attribute * # ---------------------- database hdb # ---------------------- suffix dc=domain-groups,dc=com" rootdn "cn=groupsRoot,dc=domain-groups,dc=com" rootpw secret4 overlay dynlist dynlist-attrset groupOfURLs memberURL member directory /usr/local/var/openldap-data ============================================= Did anyone successfully use subtrees with cn=config? Thanks, Francesco Policastro

1 0

Openldap Chaining
by jeevan kc 20 Feb '13

20 Feb '13

Hello guys here is my proceudre that I wrote for OpenLDAP chaining. My question is since I have a master and two slaves on the replication, where do these overlay go? On the slaves only or both master and slaves. Please respond. Thanks · Create /usr/local/etc/openldap/slapd.d/cn=config/olcDatabase={-1}frontend · Create /usr/local/etc/openldap/slapd.d/cn=config/olcDatabase={-1}frontend/olcOverlay={0}chain · Add olcOverlay={0}chain.ldif to /usr/local/etc/openldap/slapd.d/cn=config/olcDatabase={-1}frontend dn: olcOverlay={0}chain objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: {0}chain olcChainCacheURI: FALSE olcChainMaxReferralDepth: 1 olcChainReturnError: TRUE structuralObjectClass: olcChainConfig · Add olcDatabase={0}ldap.ldif to /usr/local/etc/openldap/slapd.d/cn=config/olcDatabase={-1}frontend/olcOverlay={0}chain dn: olcDatabase={0}ldap objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: {0}ldap olcDbStartTLS: none starttls=no olcDbRebindAsUser: FALSE olcDbChaseReferrals: TRUE olcDbTFSupport: no olcDbProxyWhoAmI: FALSE olcDbProtocolVersion: 3 olcDbSingleConn: FALSE olcDbCancel: abandon olcDbUseTemporaryConn: FALSE olcDbConnectionPoolMax: 16 olcDbSessionTrackingRequest: FALSE olcDbNoRefs: FALSE olcDbNoUndefFilter: FALSE structuralObjectClass: olcLDAPConfig · Add olcDatabase={1}ldap.ldif to /usr/local/etc/openldap/slapd.d/cn=config/olcDatabase={-1}frontend/olcOverlay={0}chain dn: olcDatabase={1}ldap objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: {1}ldap olcDbURI: "ldap://master.dc.us" olcDbStartTLS: none starttls=no olcDbIDAssertBind: mode=self flags=prescriptive,proxy-authz-non-critical bindm ethod=simple timeout=0 network-timeout=0 binddn="cn=manager,o=dc,c=us” credentials="l4s3rj3t" keepalive=0:0:0 olcDbRebindAsUser: FALSE olcDbChaseReferrals: TRUE olcDbTFSupport: no olcDbProxyWhoAmI: FALSE olcDbProtocolVersion: 3 olcDbSingleConn: FALSE olcDbCancel: abandon olcDbUseTemporaryConn: FALSE olcDbConnectionPoolMax: 16 olcDbSessionTrackingRequest: FALSE olcDbNoRefs: FALSE olcDbNoUndefFilter: FALSE structuralObjectClass: olcLDAPConfig · Restart slapd

2 3

Listing linux users
by Thiago Parolin 20 Feb '13

20 Feb '13

Hi all. My scenario is: openldap/samba pdc server for authenticating Windows and Linux. I need to know when a user, from Linux clients, logs in and out from the system. If some problem occurs, i need to know who was logged, in particular computer, in that time. With windows computers, the "last" bash command (in server) gave me the information needed, but with linux clients i don't know what i have to do. They are not listed with "last" command. I don't want to redirect all auth logs from clients to my server. It probably will overload my server. There are some way to do this?

2 1

How to search for all the dynamic groups a member belongs to?
by Carlos Santos 20 Feb '13

20 Feb '13

Hello to all of you, So, the situation is the following: I have a dynamic group (objectClass: groupOfURLs) and on my ldap filter I fetch the users UID. When I access the content of the group, there are a set of members there, one of them is testUser1, but when I search for (&(objectClass=groupOfURLs)(uid=testUser1)) the search result is empty. However when I search for an attribute which is native to the class, such as owner, the search returns the group. Is it possible for an ldap search to return the dynamic groups a user belongs to? -- cumprimentos, Carlos Santos

2 1

paged search fails through proxy
by Eimar Koort 20 Feb '13

20 Feb '13

Hi, I'm a bit in dead end. Scenario: Active Direcotory & openldap (2.4.33) proxy. Paged search through proxy is not working. I'm not sure about this OID "1.2.840.113556.1.4.1339". OpenLdap ldap.h tells that this oid is LDAP_CONTROL_X_DOMAIN_SCOPE. According to O'Reilly AD cookbook: "No referrals generated" with longer description "Informs the server not to generate any referrals in a search response". May this be the reason for paged search to fail? Same query runs without any problems directly within Active Directory domain controller's. As i read from google, it should be possible to make paged search work, but i can't figure it out how. eimar@box: /tmp > ldapsearch -LLL -H ldaps://olp-test.example.ee -P 3 -E pr=500/noprompt -D "CN=ldap-auth,CN=Users,DC=example,DC=ee" -W -b "ou=workers,dc=example,dc=ee" "(objectClass=person)" samaccountname -s sub > results.txt Enter LDAP Password: Size limit exceeded (4) eimar@box: /tmp > grep dn\: results.txt | wc -l 1000 which is the default search limit in AD. Openldap proxy log: Feb 20 12:45:27 olp-test slapd[1788]: connection_get(10) Feb 20 12:45:27 olp-test slapd[1788]: send_ldap_result: err=0 matched="" text="" Feb 20 12:45:27 olp-test slapd[1788]: connection_get(10) Feb 20 12:45:27 olp-test slapd[1788]: SRCH "ou=workers,dc=example,dc=ee" 2 0 Feb 20 12:45:27 olp-test slapd[1788]: 0 0 0 Feb 20 12:45:27 olp-test slapd[1788]: filter: (objectClass=person) Feb 20 12:45:27 olp-test slapd[1788]: attrs: Feb 20 12:45:27 olp-test slapd[1788]: samaccountname Feb 20 12:45:27 olp-test slapd[1788]: 1.1 Feb 20 12:45:27 olp-test slapd[1788]: sub Feb 20 12:45:27 olp-test slapd[1788]: Feb 20 12:45:27 olp-test slapd[1788]: conn=1007 op=1: non-critical control "1.2.840.113556.1.4.1339" not supported; stripped. Feb 20 12:45:27 olp-test slapd[1788]: => ldap_back_munge_filter "(objectClass=person)" Feb 20 12:45:27 olp-test slapd[1788]: <= ldap_back_munge_filter "(objectClass=person)" (0) Feb 20 12:45:27 olp-test slapd[1788]: send_ldap_result: err=4 matched="" text="" Feb 20 12:45:27 olp-test slapd[1788]: connection_get(10) And here is my slapd.conf: olp-test /usr/local/etc/openldap # cat slapd.conf include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args sizelimit unlimited #limits * size.pr=unlimited size.prtotal=unlimited modulepath /usr/local/libexec/openldap moduleload back_bdb moduleload back_ldap loglevel 4 TLSCipherSuite ALL:!ADH:@STRENGTH TLSCACertificateFile /usr/local/etc/openldap/certs/cert.crt TLSCertificateFile /usr/local/etc/openldap/certs/cert.crt TLSCertificateKeyFile /usr/local/etc/openldap/certs/cert.pem TLSVerifyClient try database ldap suffix "dc=example,dc=ee" rootdn "dc=example,dc=ee" uri "ldaps://dc1.example.ee:636/" idassert-bind bindmethod=simple binddn="CN=LDAP-Auth,CN=Users,DC=example,DC=ee" credentials="somepw" mode=anonymous flags=override idassert-authzFrom "dn.regex:.*" overlay pcache readonly on proxycache bdb 3500 1 50 1200 directory /var/db/openldap-data index cn,sn,uid eq,sub index objectclass eq proxycachequeries 400 proxyattrset 0 uid mail cn sn givenName proxytemplate (uid=) 0 600 proxytemplate (mail=) 0 600 proxytemplate (&(uid=)(mail=)) 0 600 Regards -- Eimar Koort ( eimar.koort(a)gmail.com )

1 0

modifying cn=config - Invalid credentials (49)
by Asmaa Ahmed 19 Feb '13

19 Feb '13

Hi, I am trying to modify cn=config, but I don't understand why It doesn't work any more. root@auth-dev:/etc/ldap# ldapsearch -v -x -D 'cn=admin,cn=config' -W ldap_initialize( <DEFAULT> )Enter LDAP Password: ldap_bind: Invalid credentials (49)root@auth-dev:/etc/ldap# ldapsearch -v -x -D 'cn=admin,^C-W root@auth-dev:/etc/ldap# cat /etc/ldap/slapd.d/cn=config/olcDatabase\=\{0\}config.ldifdn: olcDatabase={0}configobjectClass: olcDatabaseConfigolcDatabase: {0}configolcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * breakolcRootDN: cn=admin,cn=configstructuralObjectClass: olcDatabaseConfigentryUUID: 7904eb62-0b79-1032-92e0-3d0a3fa53956creatorsName: cn=configcreateTimestamp: 20130215050825ZentryCSN: 20130215050825.984665Z#000000#000#000000modifiersName: cn=configmodifyTimestamp: 20130215050825Z Thanks.

4 10

Compile openldap library with GSSAPI enabled
by Michele 19 Feb '13

19 Feb '13

Hi all, I'm trying to build OpenLDAP enabling the GSSAPI module, but I can't find any reference on that in the configure file. I'm doing that because I'm writing a client program that want to login to a Windows AD via kerberos. Any help is appreciated.

3 6

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical