openldap-technical

openldap-technical@openldap.org

3 participants
9868 discussions

Why ldapsearch is not working with anonymous bind after upgrading OpenLDAP to v2.4?
by Sachin Divekar 23 Dec '12

23 Dec '12

Dear all, I have a setup of **OpenLDAP v2.3** which I am using for last few years. Following are the lines in `slapd.conf` for access control. access to dn.one="o=abc, c=IN" by * read access to dn.base="o=abc, c=IN" by * none When I do ldapsearch using anonymous bind gives me result. For example following command gives result. ldapsearch -x -h localhost -b "o=abc,c=IN" Now I upgraded the OS, CentOS from 5.5 to 6.3 so the version of OpenLDAP is **OpenLDAP v2.4**. We have not changed the schema. But now the same `ldapsearch` gives me `result: 32 No such object` error. But it works when I added following line in access control configuration. access to dn.one="o=abc, c=IN" by * read access to dn.base="o=abc, c=IN" by anonymous read by * none What can be the reason? Is there any security risk in doing so? Thank you. -- Regards, Sachin Divekar

2 2

Why I can't get back attribute tokenGroups from AD with ldapsearch command?
by ctosgh 22 Dec '12

22 Dec '12

Hi, World I have one question about my recent work on LDAP. Why I can't get tokenGroups back but can get other attributes back with following search against an AD server? [root@fc11-lab ~]# ldapsearch -x -D "cn=admin,cn=Users,dc=jacky,dc=org,dc=cn" -b "cn=Users,dc=jacky,dc=org,dc=cn" -w 11111111 -H "ldap://x.x.x.x:389" "sAMAccountName=user1" cn whenChanged userPrincipalName tokenGroups # extended LDIF # # LDAPv3 # base <cn=Users,dc=jacky,dc=org,dc=cn> with scope subtree # filter: sAMAccountName=user1 # requesting: cn whenChanged userPrincipalName tokenGroups # # search result search: 2 result: 1 Operations error text: 00002120: SvcErr: DSID-03140293, problem 5012 (DIR_ERROR), data 0 # numResponses: 1 However, if I do NOT request tokenGroups attribute I get a successful response. [root@fc11-lab ~]# ldapsearch -x -D "cn=admin,cn=Users,dc=jacky,dc=org,dc=cn" -b "cn=Users,dc=jacky,dc=org,dc=cn" -w 11111111 -H "ldap://x.x.x.x:389" "sAMAccountName=user1" cn whenChanged userPrincipalName # extended LDIF # # LDAPv3 # base <cn=Users,dc=jacky,dc=org,dc=cn> with scope subtree # filter: sAMAccountName=user1 # requesting: cn whenChanged userPrincipalName # # user1, Users, jacky.org.cn dn: CN=user1,CN=Users,DC=jacky,DC=org,DC=cn cn: user1 whenChanged: 20121221012448.0Z userPrincipalName: user1(a)jacky.org.cn # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 I do see entry "CN=user1,CN=Users,DC=jacky,DC=org,DC=cn" has the attribute tokenGroups on AD. Any thoughs? TIA Thanks, Jacky

2 1

nssov works fine, unable to set nssov-pam-session
by Василий Молостов 22 Dec '12

22 Dec '12

Before enabling nssov I have got nslcd working, so the transition from one to another was clear (ubuntu 12.04.1, openldap 2.4.28-1.1ubuntu4.2). according to slapo-nssov man page I have added to my slapd.conf: moduleload nssov overlay nssov nssov-pam userhost nssov-pam-session login nssov-pam-session sshd but olcOverlay=nssov,olcDatabase=hdb,cn=config has no olcNssPamSession and its related values after creation of db. When I add olcNssPamSession into cn=config with above values by hand - loginstatus is working well, but when nssov-pam-session into slapd.conf - none. Does it mean that I am missed something to correctly set nssov-pam-session in slapd.conf?

3 2

RE: META database root DN : no such object
by Bryce Powell 21 Dec '12

21 Dec '12

Aaron, thanks very much for your suggestion. I understand the key concept here is "subordinate", in order to glue the meta database into another superior naming context. I was able to create a LDIF database, containing a baseDN, which was superior to the subordinate META database. The vendor application appears to accept this LDIF database now, as it can verify the existence of the baseDN. My next hurdle will be to get it authorize users based on group membership within the underlying Active Directories. But I think that may be beyond the scope of this forum. Thanks again for your help. Bryce -----Original Message----- From: Aaron Richton [mailto:richton@nbcs.rutgers.edu] Sent: December 20, 2012 03:20 PM To: Bryce Powell Cc: openldap-technical(a)openldap.org Subject: Re: META database root DN : no such object On Thu, 20 Dec 2012, Bryce Powell wrote: > ?When a search with base "dc=foo,dc=com" is attempted, if the scope is > "base" it fails with "no such object"; in fact, the common root > of the two targets (prior to massaging) does not exist.? The vendor > won?t change their code to skip the verification, and recommended I > use Microsoft?s ADAM instead of OpenLDAP. I would prefer to leverage > OpenLDAP, so does anyone have any recommendations as to what I could do? > Thanks, Bryce You're quoting from "scenario 2a" from the man page, which envisions dc=a,dc=foo,dc=com and dc=b,dc=foo,dc=com; your desire is to serve some data at dc=foo,dc=com. So you have to make that exist (obviously). You'll need a data store to place your "dc=foo,dc=com" data, and you'll need to "attach" dc=a,dc=foo,dc=com and dc=b,dc=foo,dc=com. So basically... database meta # maybe ldap or even relay in some installations subordinate suffix "dc=a,dc=foo,dc=com" uri "ldap://a.foo.com/dc=a,dc=foo,dc=com" database meta subordinate suffix "dc=b,dc=foo,dc=com" uri "ldap://b.foo.com/dc=a,dc=foo,dc=com" database mdb # or hdb or bdb or even ldif or..... suffix "dc=foo,dc=com" So then dc=a and dc=b live over the wire, and dc=foo,dc=com can be filled with Whatever You Want. Like, say, your base-scope data at dc=foo,dc=com. You'll almost certainly want to set up some careful ACLs and make sure, in particular, that nobody writes any dc=a/dc=b data to the on-disk database. Without trying it, I don't think it would cause a failure per se, but it would cause a very confused LDAP admin (quite undesirable)! (As for "dc=c" data on-disk, that's up to you and your site.)

1 0

Can we configure the way by which slapd return search response?
by ctosgh 21 Dec '12

21 Dec '12

Hi, All I do the following similiar search against AD and openldap respectively with ldapsearch command. For AD: ldapsearch -x -D "cn=admin,cn=Users,dc=jacky,dc=org,dc=cn" -b "cn=Users,dc=jacky,dc=org,dc=cn" -w 11111111 -H "ldap://x.x.x.x:389" "sAMAccountName=user1" For openldap: ldapsearch -x -D "cn=admin,dc=jacky,dc=com" -b "ou=users,dc=jacky,dc=com" -w 11111111 -H "ldap://x.x.x.x:389" "uid=user" I capture all the packets for above two searchs with tcpdump and I find that AD server will send search response(including search result entry & search result) in ONE packet while openldap will send search result entry and search result independently in two packets. My question: Is how to send search response back(in one or more packets) implementation specific? Thanks, Jacky

1 0

META database root DN : no such object
by Bryce Powell 21 Dec '12

21 Dec '12

Hi, I've configured a META database to proxy two LDAP directories. Each of those LDAP directories is in turn a proxy for an Active Directory. My intention was to use the meta directory as a single point for user authentication, however, the vendor application does not allow one to use the OpenLDAP meta directory. Their LDAP authentication setup wizard performs a verification of the specified baseDN, i.e. the root DN (suffix) of the meta database, and this does not exist. As per the slapd-meta man page: "When a search with base "dc=foo,dc=com" is attempted, if the scope is "base" it fails with "no such object"; in fact, the common root of the two targets (prior to massaging) does not exist." The vendor won't change their code to skip the verification, and recommended I use Microsoft's ADAM instead of OpenLDAP. I would prefer to leverage OpenLDAP, so does anyone have any recommendations as to what I could do? Thanks, Bryce

2 1

Re: Disble the 389 ldapsearch
by Bheeshma SM 20 Dec '12

20 Dec '12

hi I tried ./slapd -h ldap:/// ./slapd -h ldaps:/// Slapd status says its listening to both the ports But when i try ldapsearch -p 389 -h <hostname> it works but with -p 636 its doesnot work. and -H ldap:// works and -H ldaps:// works can you help me out with this. What i want is ldapsearch must not be successful with ldap:// and -p 389 but it must be successfull in ldaps:// and -p 636 Thanks Bhee On Thu, Dec 20, 2012 at 12:49 PM, Allan E. Johannesen <aej(a)wpi.edu> wrote: > See "-h" in slapd to specify the ports on which it will listen, if that's > what > you want to do. >

1 0

Disble the 389 ldapsearch
by Bheeshma SM 20 Dec '12

20 Dec '12

Hi I want to know how to disable the 389 search in Openldap. I am using Openldap 2.4.33 in RHEL 5.8 I have both the search running . ldapsearch -x -H ldap://hostname -D "<>" -w "<>" -b "<>" ldapsearch -x -H ldaps://hostname -D "<>" -w "<>" -b "<>" Both the above searches are running successfully, but i dont want the 389 dat is the ldap://hostname to run, Is there are way i can disable that..? Thanks in advance Bhee

1 0

DB_LOG_AUTOREMOVE not working
by BheeshmaManjunath 19 Dec '12

19 Dec '12

Hi I am using the latest Openldap. Software- Openldap 2.4.33 Server - RHEL 5.8 64 bit When i do an Ldapsearch, Ldapadd, Ldapdelete , the log.00000000x files are getting generated in the directory folder. To auto remove them i did add the " set_flags DB_LOG_AUTOREMOVE " to the DB_CONFIG file which is present in the directory folder itself. And I am using crontab to add the new data on the daily bases, but the log.00000000x files which are generated are not being auto removed..? Can anyone help me regarding this issue..? Is there a need to restart the server before adding the new data on the daily bases..? If so why is it so..? Thanks bhee

3 4

acl issue
by anil beniwal 19 Dec '12

19 Dec '12

Hi We are having below two acl to allow acces for read and write to two different users. First one is working fine, 2nd one is not allowing to write access to Vpwrite user. Can some body help me to rectify it. Scanerio is we want to delegate read access to all the attributes to one user and other user to write access to all the attributes. This is for login. access to attrs=userPassword by self write by dn="cn=Vpwrite,ou=businessUsersGroup,dc=example,dc=com" write by dn="cn=Vpread,ou=businessUsersGroup,dc=example,dc=com" read by anonymous auth by * break Read/Write access access to * by dn="cn=Vwrite,ou=businessUsersGroup,dc=example,dc=com" write by dn="cn=Vread,ou=businessUsersGroup,dc=example,dc=com" read by * none Please let me know , if you need more details. -- Thanks&Regards Anil Beniwal

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical