openldap-technical

openldap-technical@openldap.org

3 participants
9868 discussions

authentication problems
by Friedrich Locke 12 Jan '13

12 Jan '13

Dear list member, i am trying to retrieve data from a openldap server. When i issue ldapsearch from local machine itself, every thing works ok, but when i try from a remote host, i got problems related to GSSAPI authentication. Here you have: sioux@gustav$ ldapsearch -D cn=ypldap,ou=appsrv,dc=ufv,dc=br -b uid=vlobo,ou=people,dc=ufv,dc=br -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <uid=vlobo,ou=people,dc=ufv,dc=br> with scope subtree # filter: (objectclass=*) # requesting: ALL # # vlobo, people, ufv.br dn: uid=vlobo,ou=people,dc=ufv,dc=br uid: vlobo objectClass: organizationalRole objectClass: posixAccount objectClass: qmailUser cn: Valter Lobo uidNumber: 2001 gidNumber: 2000 homeDirectory: /home/vlobo loginShell: /bin/sh gecos: Valter Lobo,,, # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 sioux@gustav$ ############################################################################ But when i try from a remote host (the same command line with -h option, of course): sioux@lion$ ldapsearch -D cn=ypldap,ou=appsrv,dc=ufv,dc=br -b ou=people,dc=ufv,dc=br -h gustav.cpd.ufv.br -W Enter LDAP Password: SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Miscellaneous failure (see text) (open(/tmp/krb5cc_1000): No such file or directory) sioux@lion$ What is it my mistaken ? Thanks in advance.

2 1

cluster
by Friedrich Locke 12 Jan '13

12 Jan '13

Hi! I am aware that openldap supports custering, but i have some doubts. Is this cluster based on a single write server/multiple read server ? Or i may have multiple read/write server ? Does an openldap cluster scales unlimited ? I mean: if I need more space or processing power, it is just to add a new server . I would like to use a configuration like: The space requirement would be spread over the number of servers; A client can connect to any node of the cluster for read/write operation; To increase space/processing power, just add a new node. Is that possible with openldap ? PS: keep in mind that there is a huge difference in allowing multiple write/read over a set of nodes that keep is own copy of the data and a set of nodes whose data is spread accross them all.

2 1

Re: ldap update ( 2.2 to 2.4)
by Dan White 11 Jan '13

11 Jan '13

>On Thu, Jan 10, 2013 at 12:34 PM, Dan White <dwhite(a)olp.net> wrote: > >> On 01/10/13 12:04 -0200, Bruno Furtado wrote: >> >>> Hi Folks! >>> >>> I'm newbie to LDAP and I received a mission to update the version. >>> >>> Today is running Openldap 2.2.23 and I need to update to OpenLDAP 2.4.28. >>> all update attempts failed. I observed that the new version have a >>> different method of configuration. >>> >>> What the best way to do this? >>> >> >> What error messages did you receive? >> >> You can use slaptest (with both -f and -F options) to convert your >> configuration to the newer configuration database format (see man >> slapd-config), although you can still use a slapd.conf based configuration. >> >> See chapters 10, 19, and appendix B of the OpenLDAP Administrator's Guide, >> and the man pages for slapcat/slapdd. You should dump the contents of your >> databases on the old system with slapcat, and slapadd them on the new >> installation. On 01/11/13 17:29 -0200, Bruno Furtado wrote: >Hi Dan, > >I tried both settings. > >This is the error message: > > 50f066f8 str2entry: invalid value for attributeType objectClass #1 >(syntax 1.3.6.1.4.1.1466.115.121.1.38) This error means that you have a value within your input, for an objectClass, which is invalid per rfc2252 and is not accepted by the newer version of slapd that you are using. Try to found out which entry in your input is causing the error. -- Dan White

1 0

Openldap Server Issue - ver-2.4.23 (Jun 22 2012 14:02:53)
by Arvind Navale 11 Jan '13

11 Jan '13

Hi There, Need help with resolving an configuration issue I am having with openldap server (OpenLDAP: slapd 2.4.23 (Jun 22 2012 14:02:53) ) running a CentOS-6.3 1. Have a openldap server setup with TLS running on CentOS-6.3 rpm -qa | grep ldap openldap-devel-2.4.23-26.el6.x86_64 python-ldap-2.3.10-1.el6.x86_64 apr-util-ldap-1.3.9-3.el6_0.1.x86_64 openldap-servers-2.4.23-26.el6.x86_64 openldap-2.4.23-26.el6.x86_64 openldap-clients-2.4.23-26.el6.x86_64 pam_ldap-185-11.el6.x86_64 ldapjdk-4.18-6.el6.x86_64 3. Have generated self signed server certificates using openssl command. openssl req -x509 -nodes -days 3650 -newkey rsa:1048 -keyout /etc/openldap/certs/server-key.pem -out /etc/openldap/certs/server-cert.pem 3. Have a CentOS-6.3 setup a openldap client and enable TLS. rpm -qa | grep ldap openldap-2.4.23-26.el6.x86_64 python-ldap-2.3.10-1.el6.x86_64 openldap-clients-2.4.23-26.el6.x86_64 apr-util-ldap-1.3.9-3.el6_0.1.x86_64 pam_ldap-185-11.el6.x86_64 4. When I try to login on a LDAP client, I am seeing following debugging messages in LDAP server side, >>> slap_listener(ldaps://:389/) daemon: listen=7, new connection on 14 daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: added 14r (active) listener=(nil) conn=1000 fd=14 ACCEPT from IP=xxx.xxx.xxx.xxxx:55585 (IP=0.0.0.0:389) daemon: activity on 2 descriptors daemon: activity on: 14r daemon: read active on 14 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(14) connection_get(14): got connid=1000 connection_read(14): checking for input on id=1000 TLS: file server-cert.pem does not end in [.0] - does not appear to be a CA certificate directory file with a properly hashed file name - skipping. TLS: file server-key.pem does not end in [.0] - does not appear to be a CA certificate directory file with a properly hashed file name - skipping. TLS: error: no server certificate: must specify a certificate for the server to use TLS: error: could not initialize moznss security context - error -5939:No more entries in the directory TLS: can't create ssl handle. connection_read(14): TLS accept failure error=-1 id=1000, closing connection_closing: readying conn=1000 sd=14 for close connection_close: conn=1000 sd=14 5. I generate the hash in the directory were the certs are and then try connecting again, see different slapd debugging messages conn=1001 fd=14 ACCEPT from IP=10.90.180.220:55586 (IP=0.0.0.0:389) daemon: activity on 1 descriptor daemon: activity on: 14r daemon: read active on 14 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(14) connection_get(14): got connid=1001 connection_read(14): checking for input on id=1001 TLS: error: could not initialize moznss security context - error -5925:The one-time function was previously called and failed. Its error code is no longer available TLS: can't create ssl handle. connection_read(14): TLS accept failure error=-1 id=1001, closing connection_closing: readying conn=1001 sd=14 for close connection_close: conn=1001 sd=14 daemon: removing 14 daemon: activity on 1 descriptor daemon: activity on: conn=1001 fd=14 closed (TLS negotiation failure) Is there any bug with the version of openldap I am using? Appreciate any and every help from any of the group member to resolve the issue. Thank you, anlinux.

2 1

setting rootpw for cn=monitor
by Chris Card 11 Jan '13

11 Jan '13

Hi all, I'm seeing an issue with setting the rootpw for the cn=monitor database and syncrepl replication (multi-master syncrepl). I am seeing this problem with openldap 2.4.31 at the moment, but I intend to upgrade to 2.4.34 when that becomes available. When I just have one LDAP server (ldap1 say), I can set the olcrootdn to cn=monitor and set the olcrootpw without any error, so I have something like: dn: olcDatabase={2}monitor,cn=config objectClass: olcDatabaseConfig olcDatabase: {2}monitor olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcSyncUseSubentry: FALSE olcMonitoring: FALSE olcRootPW: {SSHA}************** olcRootDN: cn=monitor When I create another LDAP server (ldap2 say) and set up multi-master syncrepl replication for cn=config between ldap1 and ldap2 I see an error in the slapd log on ldap2 like: olcRootPW: value #0: <olcRootPW> can only be set when rootdn is under suffix No olcSuffix is set for the cn=monitor database in the cn=config, but all the cn=monitor DNs are of the form cn=X,cn=Y,...,cn=monitor, so it seems that the suffix of the cn=monitor database is effectively cn=monitor. Any ideas? Chris

4 6

installing a new cacert - the transition
by Adam Wolfe 10 Jan '13

10 Jan '13

Greetings all. I am looking at having to install a new ca cert on our ldap server(s) and thus swapping out the client certs as well. This totals roughly 250 different machines. I am wondering as to the easiest way to go about this. Is there some grace period that can be set to allow me to relax and get to all the clients over a week's time? Or possibly the ability to use two certs? Then just slowly remove the old ones from the clients?

2 1

ldap update ( 2.2 to 2.4)
by Bruno Furtado 10 Jan '13

10 Jan '13

Hi Folks! I'm newbie to LDAP and I received a mission to update the version. Today is running Openldap 2.2.23 and I need to update to OpenLDAP 2.4.28. all update attempts failed. I observed that the new version have a different method of configuration. What the best way to do this? Best regards, -- Bruno Furtado

2 1

How to change a schema attribute definition or how to change the slapd configuration?
by Philip Colmer 10 Jan '13

10 Jan '13

I'm using OpenLDAP on Ubuntu 12.04. The installation of OpenLDAP automatically installs the schemas for core, cosine, nis and inetorgperson. In the nis schema, posixGroup is defined as structural but I need it to be auxiliary. Is it possible to change that definition? My database is completely empty - I've literally uninstalled OpenLDAP and then reinstalled it in an attempt to try and find a clean way of solving my problem. Alternatively - and perhaps better since I'm a bit worried about changing *just* that one thing - is it possible for me to export the slapd configuration in a way that I can then edit the configuration to replace nis with rfc2037bis and create everything afresh? Unfortunately, because the installation on Ubuntu does all of the slapd configuration automatically, I don't know what parameters are being specified. Many thanks for any help or suggestions provided. Philip

3 5

Re: LDAP - not starting
by Oshadha Gunawardena 10 Jan '13

10 Jan '13

Well I don't think so When I issue * netstat -lt | grep ldap* it shows nothing On Thu, Jan 10, 2013 at 7:01 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, January 10, 2013 6:29 AM +0530 Oshadha Gunawardena < > oshadha.rocky(a)gmail.com> wrote: > > >> >> >> >> >> >> >> Hi all, >> >> I myself is struggling to configure and starting up the openldap server >> (v 2.4.33). Every time I started the server >> >> service slapd start >> >> I'm getting this error - and it never starts >> > > Your output shows it started just fine. It looks like the status command > is broken. > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

LDAP - not starting
by Oshadha Gunawardena 10 Jan '13

10 Jan '13

Hi all, I myself is struggling to configure and starting up the openldap server (v 2.4.33). Every time I started the server *service slapd start* I'm getting this error - and it never starts check-config.sh[3003]: Configuration directory '/etc/openldap/slapd.d' does not exist. check-config.sh[3003]: Warning: Usage of a configuration file is obsolete! runuser[3006]: pam_unix(runuser:session): session opened for user ldap by (uid=0) runuser[3006]: pam_unix(runuser:session): session closed for user ldap slapd[3019]: @(#) $OpenLDAP: slapd 2.4.33 (Oct 31 2012 12:02:13) $ slapd[3021]: bdb_monitor_db_open: monitoring disabled; configure monitor database to enable slapd[3021]: slapd starting slapd[3021]: daemon: shutdown requested and initiated. slapd[3021]: slapd shutdown: waiting for 0 operations/tasks to finish slapd[3021]: slapd stopped. When I issue the *service slapd status* slapd.service - OpenLDAP Server Daemon Loaded: loaded (/usr/lib/systemd/system/slapd.service; disabled) Active: failed (Result: timeout) since Thu, 10 Jan 2013 06:21:30 +0530; 21s ago Process: 3019 ExecStart=/usr/sbin/slapd -u ldap -h ${SLAPD_URLS} $SLAPD_OPTIONS (code=exited, status=0/SUCCESS) Process: 3003 ExecStartPre=/usr/libexec/openldap/check-config.sh (code=exited, status=0/SUCCESS) CGroup: name=systemd:/system/slapd.service My slapd.conf file * **include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema database bdb suffix "dc=test,dc=lan" rootdn "cn=Manager,dc=test,dc=lan" rootpw {SSHA}6U9AkmiHv9XpWBDyD9fsjhtF/NC0wpiq directory /mydata/Downloads/ldap/ # Global Read ACL access to * by self write by * read # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret* My ldap.conf file * # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example,dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never TLS_CACERTDIR /etc/openldap/certs* I'm kind of new to LDAP and Openldap so appreciate some assistance Thanks, Oshadha.

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical