openldap-technical

openldap-technical@openldap.org

3 participants
9868 discussions

opeLDAP + backsql + salted_hashed_password, how to adopt the mappings
by DavidHornung 16 Dec '12

16 Dec '12

Hello, I would really appreciate if you could help me with following. I already set up a self-compiled openldap-server 2.4.33 on CentOS6 with back-sql, especially posgtresql as backend. I am already able to authenticate from my MoinMoin Wiki via LDAP - but up to now the passwords are saved in clear text in the postgresql table. Now I want to save the passwords as salted hash, rearding to postgresql documentation creating a hash UPDATE ... SET pswhash = crypt('new password', gen_salt('bf')); ask for password SELECT pswhash = crypt('entered password', pswhash) FROM ... ; Now my question : How adopt the mappings in backsql to work with the hashes? Cheers, David

2 1

Help needed for Openldap > Active directory slave/proxy setup.
by Marco van Putten 14 Dec '12

14 Dec '12

Hi all, We want to setup a Openldap server which is a slave to our Active directory. The ldap server only has to do replication of the necessary records to act as a address book for non Exchange users. Further more the authentication has to be done against the users in the Active directory. I found some guides/examples to set up the authentication part. But none of them seems to do want we want because it requires to have the user in your Openldap server with a special "userPassword {SASL}user(a)domain.com" entry. But we want the openldap database to only contain contact information and not username/password information. Does anybody know how to set up such a thing and can give me some hints/guides/recipes on how to do this? Thanks, Marco. -- M. (Marco) van Putten TU Delft / Shared Service Centre ICT Marco.vanPutten(a)tudelft.nl

3 3

authz-regexp trouble, help!
by Василий Молостов 14 Dec '12

14 Dec '12

Hi, I have th following directive in the slapd.conf: authz-regexp gidNumber=([^0][0-9]+).uidNumber=([^0][0-9]+),cn=peercred,cn=external,cn=auth ldapi:///ou=people,dc=local???(uidNumber=$2) but server is unable to fetch (slap_sasl2dn: Converted SASL name to <nothing>) here is trace output (slapd -d 2177 -h "ldapi:/// ldaps:/// ldap:///"): 50ca62b8 >>> dnPrettyNormal: <> 50ca62b8 <<< dnPrettyNormal: <>, <> 50ca62b8 do_bind: dn () SASL mech EXTERNAL 50ca62b8 ==>slap_sasl2dn: converting SASL name gidNumber=1000+uidNumber=1000,cn=peercred,cn=external,cn=auth to a DN 50ca62b8 ==> rewrite_context_apply [depth=1] string='gidNumber=1000+uidNumber=1000,cn=peercred,cn=external,cn=auth' 50ca62b8 ==> rewrite_rule_apply rule='gidNumber=([^0][0-9]+).uidNumber=([^0][0-9]+),cn=peercred,cn=external,cn=auth' string='gidNumber=1000+uidNumber=1000,cn=peercred,cn=external,cn=auth' [1 pass(es)] 50ca62b8 ==> rewrite_context_apply [depth=1] res={0,'ldapi:///ou=people,dc=local??sub?(uidNumber=1000)'} 50ca62b8 slap_parseURI: parsing ldapi:///ou=people,dc=local??sub?(uidNumber=1000) ldap_url_parse_ext(ldapi:///ou=people,dc=local??sub?(uidNumber=1000)) 50ca62b8 <==slap_sasl2dn: Converted SASL name to <nothing> 50ca62b8 SASL Authorize [conn=1001]: proxy authorization allowed authzDN="" 50ca62b8 send_ldap_sasl: err=0 len=-1 50ca62b8 do_bind: SASL/EXTERNAL bind: dn="gidNumber=1000+uidNumber=1000,cn=peercred,cn=external,cn=auth" sasl_ssf=0 50ca62b8 send_ldap_response: msgid=1 tag=97 err=0 Direct sasl authz mapping works fine, but URI does not, what's wrong with this stuff? How I can check URI correctness for slapd or get tracing info from ldap_url_parse_ext/slap_sasl2dn about why they returned nothing? With wich access rights slapd does its internal query ? How to configure them ?

3 2

rwm/relay and ldapwhoami
by Tim Watts 13 Dec '12

13 Dec '12

OK - must be missing something really basic - and I am new to LDAP... I have a server (ldapmaster) that serves dc=new,dc=example,dc=com and a seperate server, ldaplegacy, that uses slapd-ldap + rwm to proxy-translate requests aimed at: dc=old,dc=example,dc=com So: ldapsearch -x -b dc=old,dc=example,dc=com -H ldap://ldaplegacy/ returns ... # me, people, old.example.com dn: uid=me,ou=people,dc=old,dc=example,dc=com objectClass: top objectClass: inetOrgPerson ... nice - exactly as expected. But ldapwhoami -x -W -D uid=me,ou=people,dc=old,dc=example,dc=com -H ldap://ldaplegacy/ returns (after successful bind) dn:uid=me,ou=people,dc=new,dc=example,dc=com Why doesn't the DN get translated? The config section that's relevant on ldaplegacy is: slapd.conf ############################### ... database relay suffix "dc=old,dc=example,dc=com" relay "dc=new,dc=example,dc=com" overlay rwm rwm-suffixmassage "dc=new,dc=example,dc=com" ... ############################### I thought I needed more magic to translate the replies, but that *looks* like it is happening with ldapsearch??? Cheers! Tim -- Tim Watts Personal Blog: http://www.dionic.net/tim/ "History will be kind to me for I intend to write it."

2 2

ppolicy and rwm/relay segfaulting
by Tim Watts 13 Dec '12

13 Dec '12

Hi, This is weird - quite possible a config problem, I'm hoping someone can spot it :) I have a minimal slapd server which works fine with either an rwm/relay section or a ppolicy section - but not both at once. I'm happy to explain *why* I need to do this if asked, but for now it would just clutter this message. I do have a Really Good(TM) reason. ============ Actual problem =================== We load slapd up with actual entries for the dc=new,dc=example,dc=com domain. slapd is configured to map all records with rwm/relay to dc=old,dc=example,dc=com so clients with the old config still work. ie we load a real record: 1) dn: uid=testuser,ou=people,dc=new,dc=example,dc=com and we want clients asking about 2) dn: uid=testuser,ou=people,dc=old,dc=example,dc=com will be served from (1) ======== OK here's an example ================ === Server ==== Running debian 6 server with debian slapd 2.4.23-7.2 /usr/sbin/slapd -d 4 -h "ldap:/// ldaps:/// ldapi:///" -g openldap -u openldap -f /etc/ldap/slapd.conf === Test client === Running test against the "old" realm: ldapwhoami -x -W -D uid=testuser,ou=people,dc=old,dc=example,dc=com # Enter the wrong password and it fails correctly and server runs OK. # Enter the right password and the client says: ldap_result: Can't contact LDAP server (-1) Server says (last few lines from slapd): [rw] bindDN: "uid=testuser,ou=people,dc=old,dc=example,dc=com" -> "uid=testuser,ou=people,dc=old,dc=example,dc=com" [rw] bindDN: "uid=testuser,ou=people,dc=old,dc=example,dc=com" -> "uid=testuser,ou=people,dc=new,dc=example,dc=com" => ldap_bv2dn(uid=testuser,ou=people,dc=new,dc=example,dc=com,0) <= ldap_bv2dn(uid=testuser,ou=people,dc=new,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=testuser,ou=people,dc=new,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=testuser,ou=people,dc=new,dc=example,dc=com)=0 => bdb_entry_get: ndn: "uid=testuser,ou=people,dc=new,dc=example,dc=com" => bdb_entry_get: oc: "(null)", at: "(null)" => bdb_entry_get: ndn: "cn=default,ou=pwpolicies,dc=new,dc=example,dc=com" => bdb_entry_get: oc: "(null)", at: "(null)" ==> hdb_bind: dn: uid=testuser,ou=people,dc=new,dc=example,dc=com send_ldap_result: err=0 matched="" text="" => bdb_entry_get: ndn: "uid=testuser,ou=people,dc=new,dc=example,dc=com" => bdb_entry_get: oc: "(null)", at: "(null)" Segmentation fault However, queries against the "new" domain work: ldapwhoami -x -W -D uid=testuser,ou=people,dc=new,dc=example,dc=com Enter LDAP Password: dn:uid=testuser,ou=people,dc=new,dc=example,dc=com If I disable ppolicy in slapd.conf, queries agains the "old" domain work: root@ldaptest1:/etc# ldapwhoami -x -W -D uid=testuser,ou=people,dc=old,dc=example,dc=com Enter LDAP Password: dn:uid=testuser,ou=people,dc=new,dc=example,dc=com (the rewrite is not perfect - but that may not matter for my clients). Almost certainly I have done something stupid - and it seems clear that ppolicy is being upset by the relay mappings. Any ideas how to fix would be *very* welcome - I have been all over Google and the man pages. All the best! Tim OK - boring stuff: slapd.conf ########################################### ####################################################################### # Global Directives: # Features to permit allow bind_anon_cred bind_anon_dn update_anon # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/ppolicy.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel sync stats sizelimit 5000 tool-threads 1 modulepath /usr/lib/ldap moduleload back_hdb moduleload back_relay moduleload rwm moduleload ppolicy overlay rwm rwm-rewriteEngine on backend hdb ####################################################################### # Global ACLs # # Ensure read access to the base for things like # supportedSASLMechanisms. access to dn.base="" by * read # The userPassword by default can be changed # by the entry owning it if they are authenticated. # This ACL must be first or password leakage will happen!!! access to attrs=userPassword,shadowLastChange by peername.path="/var/run/slapd/ldapi" manage by dn="cn=admin,dc=new,dc=example,dc=com" manage by set="user/uid & [cn=sysadmin,ou=groups,dc=new,dc=example,dc=com]/memberUid" write by self write by * auth # The admin dn has full write access, everyone else # can read everything. Local unix domain socket (root only) # Can do everything access to * by peername.path="/var/run/slapd/ldapi" manage by dn="cn=admin,dc=new,dc=example,dc=com" manage by set="user/uid & [cn=sysadmin,ou=groups,dc=new,dc=example,dc=com]/memberUid" write by * read ####################################################################### # Main new.example.com authoritative database # database hdb suffix dc=new,dc=example,dc=com rootdn "cn=admin,dc=new,dc=example,dc=com" rootpw "{SSHA}NoNoNooo..." directory "/var/lib/ldap" dbconfig set_cachesize 0 134217728 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass eq lastmod on checkpoint 512 30 ####################################################################### # # Password Policy # # overlay ppolicy ppolicy_default "cn=default,ou=pwpolicies,dc=new,dc=example,dc=com" ppolicy_use_lockout ppolicy_hash_cleartext ####################################################################### # Virtual maps - compatibility with old.example.com only # # map dc=old to dc=new # database relay suffix "dc=old,dc=example,dc=com" relay "dc=new,dc=example,dc=com" overlay rwm rwm-suffixmassage "dc=new,dc=example,dc=com" ########################################### Initial database loaded with slapadd from this ldif: ########################################### dn: dc=new,dc=example,dc=com objectClass: top objectClass: dcObject objectClass: organization o: new.example.com dc: new dn: cn=admin,dc=new,dc=example,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: NoNoNoooo... dn: ou=people,dc=new,dc=example,dc=com objectClass: organizationalUnit ou: people dn: ou=groups,dc=new,dc=example,dc=com objectClass: organizationalUnit ou: groups dn: ou=pwpolicies,dc=new,dc=example,dc=com objectClass: organizationalUnit ou: pwpolicies # # # Standard policy for normal people # dn: cn=default,ou=pwpolicies,dc=new,dc=example,dc=com objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: userPassword pwdMinAge: 0 pwdMaxAge: 15811200 pwdExpireWarning: 1814400 pwdGraceAuthnLimit: 3 pwdInHistory: 6 pwdCheckQuality: 2 pwdMaxFailure: 5 pwdMinLength: 8 pwdLockout: TRUE pwdLockoutDuration: 300 pwdFailureCountInterval: 300 pwdMustChange: TRUE pwdAllowUserChange: TRUE pwdSafeModify: FALSE dn: uid=testuser,ou=people,dc=new,dc=example,dc=com objectClass: top objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount cn: Test User employeeType: Staff gecos: Test User gidNumber: 1000 givenName: Test homeDirectory: /homes/testuser loginShell: /bin/bash mail: testuser(a)new.example.com sn: User uid: testuser uidNumber: 1000 userPassword: {SSHA}NoNoNoooo... dn: cn=ddh-staff,ou=groups,dc=new,dc=example,dc=com objectClass: top objectClass: posixGroup cn: ddh-staff description: Test Group gidNumber: 1000 memberUid: testuser dn: cn=sysadmin,ou=groups,dc=new,dc=example,dc=com objectClass: top objectClass: posixGroup cn: sysadmin description: Staff: System Admin Group gidNumber: 1001 memberUid: testuser ########################################### ########################################### ########################################### ########################################### ########################################### ########################################### -- Tim Watts Personal Blog: http://www.dionic.net/tim/ "A fanatic is one who can't change his mind and won't change the subject."

4 10

Search for the last gidNumber/uidNumber
by cbulist 13 Dec '12

13 Dec '12

Hi, I would like to do a search using ldapsearh in order to get the last gidNumber/uidNumber assigned. Any clue? Thanks in advance!

2 2

How to find a users last password change date/time
by Kyle Harris 12 Dec '12

12 Dec '12

Hello All, I am new to OpenLDAP but have it up and running and have allowed users to change their own password. I was about to start working on a Perl script to grab the last password change date/time and email a user a few days before it expires. I have done that before with Perl using Active Directory as the LDAP server. The problem is that when I use ldapsearch, I can see the user attributes including the hashed password but I don't see where it stores the last time a password was changed? In the event it matters, I am using bdb as the database and everything else including logins is working fine. Am I using the wrong tool? How can I get this information? Thank you in advance.

3 2

OpenLDAP as an address book for MS Outlook
by Victor Sudakov 12 Dec '12

12 Dec '12

Dear Colleagues, I have been trying to investigate what is needed in OpenLDAP to have Microsoft Outlook 2007 display a list of names in the addressbook when first accessed in the same way that it does with ActiveDirectory/Exchange. From what I have found out from Web searching, MS Outlook requires a certain set of overlays, supportedCapabilities and supportedControls from the LDAP server to show the addressbook this way. The CommunigatePro LDAP server can emulate those. Are there any success stories or recommendations or howtos how to setup OpenLDAP to provide such service? I am running openldap-server-2.4.33 on FreeBSD. I have tried various combinations of sssvlv and valsort overlays to no avail. Outlook does show contacts from the OpenLDAP addressbook when I specifically search for them, so my general setup (schema etc) seems to be correct. Thank you very much in advance for any input. -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN sip:sudakov@sibptus.tomsk.ru

10 45

Re: MDB and slapcat of subtrees
by Venkat 11 Dec '12

11 Dec '12

Please test after applying < http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commitdiff;h=a2cf… > > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > Thanks Quanah and Howard for the speedy solution, the patch worked -- no more crashes on subtrees. The help is much appreciated! cheers, Ven

1 0

RE: LDAP database timeout settings
by Bryce Powell 11 Dec '12

11 Dec '12

Having done some more research, it appears that Active Directory also has some settings that could result in disconnected connections. I experimented with idle-timeout set to 30 seconds for the LDAP databases, but this seemed to exacerbate the frequency of the errors. The behaviour exhibits as 'dead' connections, and LDAP does not appear to attempt to re-establish these connections. Using the CentOS distro of OpenLDAP 2.4.23 Here are the slapd.conf settings: database ldap readonly on suffix "dc=xyz,dc=local" #noundeffilter yes #use-temporary-conn yes uri "ldap://IP1/ ldap://IP2/ ldap://3/ ldap://IPn/" database ldap readonly on suffix "dc=abc,dc=adroot,dc=abc,dc=bc,dc=ca" #noundeffilter yes #use-temporary-conn yes uri "ldap://IP11/ ldap://IP12/ ldap://13/ ldap://IP1n/" I have some rewrite rules for bindDN, searchEntryDN, searchAttrDN, matchedDN, but I don't believe these settings are relevant to the issue at hand. Essentially I want the connections to be re-established without generating errors. Thanks _____________________________________________ From: Bryce Powell Sent: December 10, 2012 01:32 PM To: openldap-technical(a)openldap.org Subject: LDAP database timeout settings Hi, I have configured two LDAP backend databases, each pointing to a difference Active Directory domain (multiple domain controllers specified per domain). After a period of time after slapd starts, the ldap log file shows multiple entries like this for the various connections (conns=nnnn): Dec 10 13:18:03 vmxxxldap01 slapd[7826]: conn=1004 op=27 SEARCH RESULT tag=101 err=1 nentries=0 text=000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1 Without going into too much detail regarding the configuration, I'm wondering if I need to specify LDAP database configuration settings for: idle-timeout network-timeout man slapd-ldap: idle-timeout <time> This directive causes a cached connection to be dropped an recreated after it has been idle for the specified time. network-timeout <time> Sets the network timeout value after which poll(2)/select(2) following a connect(2) returns in case of no activity. The value is in seconds, and it can be specified as for idle-timeout. I don't understand the explanation for network-timeout though, and am hoping someone can kindly explain it in more detail, and suggest a scenario for its appropriate usage. Also, when is it appropriate to use the ldap.conf NETWORK_TIMEOUT setting? man ldap.conf: NETWORK_TIMEOUT <integer> Specifies the timeout (in seconds) after which the poll(2)/select(2) following a connect(2) returns in case of no activity. Could someone please suggest the best approach for my use case? Of course, I might also be completely off the mark here ... Thanks Bryce Powell

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical