openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

How to get all attributes of a entry
by ctosgh 22 Jan '13

22 Jan '13

Hi, All I enabled memberOf overlay feature. Now I can get memberOf back with ldapsarch. ldapsearch -x -D "cn=admin,dc=xxx,dc=xxx" -b "dc=xxx,dc=xxx" -w xxx -H "ldap://10.139.36.7:389" "cn=user2" "memberOf" However, with above command other attributes, such as cn and sn, can't be retrieved back... As manual said, memberOf is a opertional attribute so that you should require it explicitly.. Is there a way that I can retrieve all other attributes in addition to memberOf? Thanks, Jacky

2 2

Microsoft Outlook (2011) jpegPhoto and thumbnailPhoto Suffixed With ';binary'
by Eren Türkay 22 Jan '13

22 Jan '13

Hello, I am testing my tree with outlook 2011 (for mac) to see if everything works expected. When I search a contact in address book, photo of the user is not shown. I searched the problem and learned that outlook uses thumbnailPhoto attribute for photos. Then, I created an outlook compatibility schema that includes thumbnailPhoto attribute. However, photos still not shown, at which time I started investigating the problem. I debugged the problem using the network analyzer and realized that Outlook 2011 requests awkward attribute names suffixed with the word ';binary'. When searching, it requests these attributes below along with standard ones: - userSMIMECertificate;binary - userCertificate;binary - thumbnailPhoto;binary - jpegPhoto;binary Since these attributes are not present in my tree (though I have 'normal' ones without a suffix), they are not sent to outlook client so photos are not shown. I, then, tried to change my compatibility schema to use 'thumbnailPhoto;binary', but I got an error stating that the attribute name is not valid. OpenLDAP does not seem to accept ';' character in attribute names. Probably, AD accepts ';' character in attribute names and outlook 2011 works with AD. Apart from not seeing photos, you cannot send encrypted e-mail using outlook because you cannot send a user certificate with openldap (';binary' suffix). So, if you try to use current openldap with outlook, you will miss 2 features, encryption on photos. I'm not sure if ';binary' suffix is done on purpose to make other LDAP servers work with outlook harder. Is there any workaround for it? Being able to include ';' in attribute name will probably fix the problem but I don't know if ';' is acceptable in LDAP standard. Regards, Eren -- . 73! DE TA1AET http://linkedin.com/in/erenturkay

2 1

Re: slapd segfaults with mdb
by Meike Stone 22 Jan '13

22 Jan '13

> File an ITS (http://www.openldap.org/its/) with a full backtrace of all > threads from gdb. => #7496 Thanks

1 0

Continuous mode (ldapmodify -c) not working
by Ori Bani 21 Jan '13

21 Jan '13

Am I doing something wrong? Here is an example: $ ldapmodify -c -x -D 'cn=config' -W Enter LDAP Password: <password> dn: olcDatabase={0}config,cn=config changetype: modify delete: olcSizeLimit - modifying entry "olcDatabase={0}config,cn=config" ldap_modify: No such attribute (16) additional info: modify/delete: olcSizeLimit: no such attribute

2 12

slapd segfaults with mdb
by Meike Stone 21 Jan '13

21 Jan '13

Hello, I play a little with the mdb on a test machine, and imported our db from production system. (about 1,500,000 entires, 2,5GByte ldif from slapcat) I took the slapd source from git today, and because of segmentation fault, I compiled slapd with debugging symbols. My configuration is simple: -------------------------------------------- include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/yast.schema include /etc/openldap/schema/rfc2307bis.schema include /etc/openldap/schema/my_ldap_attributes.schema include /etc/openldap/schema/my_ldap_ObjectClasses.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args sizelimit -1 timelimit 300 disallow bind_anon require authc gentlehup on tool-threads 4 serverID 001 ############################ # mdb database definitions ############################ database mdb suffix "ou=root" rootdn "cn=admin,ou=root" rootpw password directory /var/lib/ldap/ldap.mdb loglevel 256 maxsize 10737418240 envflags writemap,nometasync index objectClass,entryUUID,entryCSN eq index cn eq,sub . . . some other own indexes here -------------------------------------------- I started my search via: /tmp/ol/usr/local/bin/ldapsearch -x -h localhost -w password -D cn=admin,ou=root -b'ou=root' '(objectClass=*)' >/dev/null and got in the syslog folloing meassge: Jan 21 17:50:31 debld02 kernel: [348860.053152] slapd[19394]: segfault at 7f760f974ce8 ip 000000000053bea1 sp 00007f738b10a650 error 4 in slapd [400000+227000] Because of this, I configured the kernel to core dump: sysctl -w kernel.core_pattern=/tmp/core sysctl -w kernel.core_uses_pid=1 sysctl -w kernel.suid_dumpable=2 ulimit -c unlimited ulimit -v unlimited and got the result via: ~# gdb /tmp/ol/usr/local/libexec/slapd /tmp/core.19386 Core was generated by `/tmp/buildforopenldaptechnical/usr/local/libexec/slapd -h ldap:/// -f /etc/op'. Program terminated with signal 11, Segmentation fault. #0 0x000000000053bea1 in mdb_entry_decode (op=0xc3a020, data=0x7f738b10a770, e=0x7f738b11a828) at id2entry.c:666 666 a->a_desc = mdb->mi_ads[*lp++]; (gdb) How can I solve this? Btw.: This error is repeatable and I saw the same error with the release OL2.4.33. Thanks Meike

2 1

openldap 2.4.33 from source, can't find slapd.d directory
by Benin Technologies 21 Jan '13

21 Jan '13

3 5

ACL: Permissions with Groups and 'memberOf' Using Regex
by Eren Türkay 21 Jan '13

21 Jan '13

Hello, I'm designing a directory structure for our radio amateur union, and I have a problem with somewhat complex ACL (for me). Before I ask my question, I want to mention that this structure is not in production so it can always change. I may have designed the structure wrong, and there would be a better way to represent it. However, I believe that this is the correct way of representing our amateur radio union's organization. As a radio amateur union, we have different branches across different cities. These branches have their own members, and own managers, Additionally, there is a unit which is the manager of the whole union. Their members are listed in "cn=general-managers,<base dn>". All of the user information is stored under "ou=people,<base dn>" and 'memberOf' overlay is enabled. The structure is below: ==== BEGIN: directory structure ==== - <base dn> - cn=general-managers (groupOfNames) - ou=branch - ou=foo-city - cn=managers (groupOfNames) - cn=members (groupOfNames) - ou= bar-city - cn=managers (groupOfNames) - cn=members (groupOfNames) ... ... - ou=people cn=ta1aet (inetOrgPerson) memberOf: cn=managers,ou=foo-city,ou-branch,<base-dn> memberOf: cn=members,ou=foo-city,ou-branch,<base-dn> cn=CALLSIGN1 memberOf: cn=members,ou=foo-city,ou-branch,<base-dn> cn=CALLSIGN2 memberOf: cn=members,ou=bar-city,ou-branch,<base-dn> cn= CALLSIGNn ... ... ==== END: directory structure ==== So far, I have achieved to write an ACL for "ou=people". The users have write permission to some of the attributes such as "givenName, sn, mail, address" but they don't have permission to edit "title" (which should be edited by his manager in his branch) What I am aiming is listed below. 1- People in cn=managers,ou=XXXX,ou=branch should be able to add new user/member under "ou=people,<base dn>". (Of course, setting member attribute their branch "cn=members,ou=XXXX,ou=branch") 2- These managers (cn=managers,ou=XXX,ou=branch) should only be able to edit attributes of members registered to them. So, only people that are member of "cn=members,ou=XXX,ou=branch" should be edited by "cn=managers,ou=XXX,ou=branch". 3- Any user should be able to edit some (e.g not 'title') of his attributes (I've done it but I'm not sure if it can be done in a more elegant way. Config is attached at the end). 4- General managers should be able to edit the tree and children of "ou=branch,<base dn>" as well as "ou=people,<base dn>". This looks a bit easier compared to 1 and 2. I have searched through all regular expressions tutorials but none of them includes such a membership example. "access to" syntax has "filter" option. Since 'access to' requires <what> clause first, I thought of using regular expression to filter the people accordingly to their 'memberOf' attributes, somehow (-don't know how :) -) match their branches that they belong to, and give access to corresponding manager group. However, 'filter' does not seem to accept regular expressions and it requires a direct attribute. I cannot further proceed right now, and I will really appreciate a hand on this issue. My best regards and 73s! Eren ==== BEGIN: current olcAccess ==== olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonym ous auth by dn="cn=admin,dc=trac,dc=org,dc=tr" write by * none olcAccess: {1}to dn.base="dc=trac,dc=org,dc=tr" by dn="cn=admin,dc=trac,dc=o rg,dc=tr" write by * read by anonymous none olcAccess: {2}to dn.base="ou=people,dc=trac,dc=org,dc=tr" attrs="entry,objec tClass" by dn.one="ou=people,dc=trac,dc=org,dc=tr" read by anonymous none olcAccess: {3}to dn.one="ou=people,dc=trac,dc=org,dc=tr" attrs="givenName,sn ,mail" by self write by dn.one="ou=people,dc=trac,dc=org,dc=tr" read olcAccess: {4}to dn.one="ou=people,dc=trac,dc=org,dc=tr" attrs="entry,object Class,cn,givenName,sn,title,mail" by dn.one="ou=people,dc=trac,dc=org,dc=tr " read by anonymous none ==== END: current olcAccess ==== -- . 73! DE TA1AET http://linkedin.com/in/erenturkay

1 1

Rewriting query and results
by Kurt Roeckx 20 Jan '13

20 Jan '13

Hi, I have PBX that queries the ldap server, but I'm not very happy with how it behaves, and of course have no control over what it does. It sends a query for "sn=foo*". But I want it to run a query that checks against fields like cn, givenName and sn. I also want to query to be "*foo*" instead of "foo*". It only requests the fields sn, givenName and the various phone numbers and then shows sn and givenName. I want it to display cn instead. So I guess I want to return the value of cn in sn and don't return a givenName. I've been looking at slapo-rwm manpage, but it's not really making much sense to me. Can someone guide me on how to do it? Kurt

1 0

Understanding dynamic configuration
by Ori Bani 20 Jan '13

20 Jan '13

Hello, I'm struggling a little with understanding the dynamic configuration system (sorry, but wanted to say my vote is for file-based config; the way some of this config has been put into LDAP feels forced and unnecessarily convoluted). Specifically, I'm having a hard time getting my mind around how to manage and secure the configuration database. What's tripping me up is how to reconcile the separate ldif files that contain global server-level configuation settings and config database level settings with what I understand to be the recommended way to manage those things -- using OpenLDAP client tools. When starting a fresh server (CentOS6.3, installed from yum if that matters here), it's not clear to me how I can bind using ldapadd in order to modify global server settings. Right now, I suspect the trouble is that the default databases have been created without a olcRootPw. Do I have to violate best practices just long enough to add that setting to the cn=config/olcDatabase={0}config.ldif file? After that, do I bind to "cn=config" in order to change global configuration settings using the base DN "cn=config"? (The olcRootDN is in the config database ldif file is "cn=config") To modify settings for the configuration database itself, do I also use the same bind ("cn=config") but use a base DN of "olcDatabase={0}config.ldif,cn=config"? I'm also curious, many of the examples I see for things like cn=Modules don't use the full DN, which I think is cn=Modules,cn=config. Why is this? I've read the website docs, the man pages, but I don't see any information that addresses how to initially bind to and start configuring the server in the Right Way. The quick start guide would be a good place for that, but it still talks about slapd.conf. Thanks for the help and for the good software

2 1

unable to sasl bind to openldap .
by mallapadi niranjan 20 Jan '13

20 Jan '13

Hi all, I need some help in finding more about the below error: Jan 20 05:34:58 ldap2 slapd[2561]: conn=1025 op=1 RESULT tag=97 err=14 text=SASL(0): successful result: Jan 20 05:34:58 ldap2 slapd[2561]: conn=1025 op=2 BIND dn="" method=163 Jan 20 05:34:58 ldap2 slapd[2561]: SASL [conn=1025] Failure: Inappropriate authentication Jan 20 05:34:58 ldap2 slapd[2561]: conn=1025 op=2 RESULT tag=97 err=50 text=SASL(-14): authorization failure: Inappropriate authentication Jan 20 05:34:58 ldap2 slapd[2561]: conn=1025 op=3 UNBIND Jan 20 05:34:58 ldap2 slapd[2561]: conn=1025 fd=31 closed More information: Openldap version:openldap-servers-2.4.23-26.el6_3.2.x86_64 What i am trying to do is i have configure bind (named) to store it's records in LDAP server using plugin provided by bind-dyndb-ldap-1.1.0-0.9.b1.el6.x86_64, And i have configure named.conf to access ldap server only through GSSAPI. options { listen-on port 53 { 127.0.0.1; }; listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; forward first; forwarders { }; #dnssec-enable yes; #dnssec-validation yes; #dnssec-lookaside auto; allow-recursion { any; }; /* Path to ISC DLV key */ #bindkeys-file "/etc/named.iscdlv.key"; #managed-keys-directory "/var/named/dynamic"; tkey-gssapi-credential "dnsadmin(a)EXAMPLE.ORG"; tkey-domain "EXAMPLE.ORG"; }; logging { channel default_debug { file "data/named.run"; severity dynamic; }; }; zone "." IN { type hint; file "named.ca"; }; include "/etc/named.rfc1912.zones"; include "/etc/named.root.key"; dynamic-db "openldap" { library "ldap.so"; #arg "uri ldapi://%2fvar%2frun%2fldapi"; arg "uri ldap://localhost"; arg "base cn=dns,dc=example,dc=org"; arg "fake_mname ldap2.example.org."; arg "auth_method sasl"; arg "sasl_mech GSSAPI"; arg "sasl_user dnsadmin(a)EXAMPLE.ORG"; arg "zone_refresh 30"; }; As you can see named checks for dnsadmin(a)EXAMPLE.ORG as it sasl authentication user, dnsadmin(a)EXAMPLE.ORG is an user who exists in ldap records dn: cn=dnsadmin,ou=People,dc=example,dc=org cn: dnsadmin sn: user objectClass: person objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux userPassword:: U2VjcmV0MTIz krbPrincipalName: dnsadmin(a)EXAMPLE.ORG krbLoginFailedCount: 0 krbPrincipalKey:: MIIByKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBsDCCAawwVKAHMAWgAwIBAKFJ MEegAwIBEqFABD4gACUNiDAaRqfI6BDKN9YZ/DhvIf6TfUZY8pdWQ5HvM1ZI/DOxdPnIoXfnbjRT+ i7D7lMpkixzcxcFki3fFDBEoAcwBaADAgEAoTkwN6ADAgERoTAELhAAqBkEvL+gzUndM8TNS7ik+I 1weyacnVPB3PaFjtteeQBLcmrqikUN9eCWTDgwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAM0347z v8kK3gj0A9SYOzUDa7Hc89pG1dg4LOdJfam6QkNGamezP45ZnFLzGSQ/oTR76I3YwRKAHMAWgAwIB AKE5MDegAwIBF6EwBC4QAC3muW46EjvmxYXnvzA11/kiUrGwknrOL/dtcVVhx2ul81zChqkfuHYjU BbTMDygBzAFoAMCAQChMTAvoAMCAQihKAQmCADtDnWrNBUuisnbEstExWOiwQphTqqXyrzPi1XQ3U jvE0TpMZUwPKAHMAWgAwIBAKExMC+gAwIBA6EoBCYIAFNul3CO38n/hMzLT9lT31ma7ObzhJ9B1qn BIGSvn7wDSiH2dw== krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20130119232256Z krbExtraData:: AALQKvtQcm9vdC9hZG1pbkBFWEFNUExFLk9SRwA= krbExtraData:: AAgBAA== named reads /etc/named.keytab file to get dnsadmin(a)EXAMPLE.ORG [root@ldap2 master]# klist -k /etc/named.keytab Keytab name: WRFILE:/etc/named.keytab KVNO Principal ---- -------------------------------------------------------------------------- 2 dnsadmin(a)EXAMPLE.ORG 2 dnsadmin(a)EXAMPLE.ORG 2 dnsadmin(a)EXAMPLE.ORG 2 dnsadmin(a)EXAMPLE.ORG 2 dnsadmin(a)EXAMPLE.ORG 2 dnsadmin(a)EXAMPLE.ORG what i am looking for is when bind tries to connect using " dnsadmin(a)EXAMPLE.ORG" to ldap server i am seeing below error Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 op=0 RESULT tag=97 err=14 text=SASL(0): successful result: Jan 20 05:47:43 ldap2 slapd[2561]: connection_input: conn=1031 deferring operation: binding Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 op=1 BIND dn="" method=163 Jan 20 05:47:43 ldap2 slapd[2561]: connection_input: conn=1031 deferring operation: binding Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 op=1 RESULT tag=97 err=14 text=SASL(0): successful result: Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 op=2 BIND dn="" method=163 Jan 20 05:47:43 ldap2 slapd[2561]: SASL [conn=1031] Failure: Inappropriate authentication Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 op=3 UNBIND Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 op=2 RESULT tag=97 err=50 text=SASL(-14): authorization failure: Inappropriate authentication Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 fd=34 closed Can any one help me on how to enable more debugging to get more info about the error=50 (Insufficient access error) , Below is my olcAuthRegexp configuration: # config dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /opt/setup-openldap/sample-slapd.conf olcConfigDir: /etc/openldap/slapd.d/ olcAllows: bind_v2 ... .. ... ... .... olcTLSCACertificateFile: /etc/pki/tls/certs/cacert.pem olcTLSCertificateFile: /etc/pki/tls/certs/server.pem olcTLSCertificateKeyFile: /etc/pki/tls/certs/serverkey.pem olcTLSVerifyClient: allow olcToolThreads: 1 olcWriteTimeout: 0 olcAuthzRegexp: {0}uid=(.*),cn=EXAMPLE.ORG,cn=gssapi,cn=auth uid=$1,ou=People ,dc=example,dc=org olcLogLevel: stats And the output of ldapwhoami [root@ldap2 master]# ldapwhoami -Y GSSAPI -H ldapi:/// SASL/GSSAPI authentication started SASL username: dnsadmin(a)EXAMPLE.ORG SASL SSF: 56 SASL data security layer installed. dn:uid=dnsadmin,cn=example.org,cn=gssapi,cn=auth I just want to find out why named when trying to sasl bind with openldap it fails, Thanks Niranjan

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical