openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Newbie question about host base authentication
by Simone Scremin 29 Oct '12

29 Oct '12

Hi all, I'm in the process of learning the OpenLDAP authentication mechanics. I'd need to know what is the best way to configure an host based authentication system that allow to configure a per-user rule to include a group of host to which the user is allowed to login. In example: user Bob needs to authenticate on systems: sys01pra sys02pre sys03pra sys03pre some configuration on the LDAP server enable this hostnames for Bob with a regular expression like: sys0*pr* Is it feasable? Thanks Simone

5 7

Re: Newbie question about host base authentication
by Simone Scremin 29 Oct '12

29 Oct '12

Hi Olivier, thanks for the fast answer. I'm looking at pam_ldap component and I already saw the host based authentication that enables to list hostnames on the server per user. Your idea, if I'm not mistaken, would be to specify this host parameter as some kind of LDAP data structure (ie: groupOfNames) and have the authentication mechanism match on that structure. I'm looking at groupOfNames and it's not clear to me if it can really be used for that purpose but the most obscure point is where the logic for the matching should go. I'm really open to any input on this subject whether it is some example of already implemented solutions or just some direction on how to go forward with the development. Thank you Simone On Oct 29, 2012, at 2:40 PM, Olivier <ldap(a)guillard.nom.fr> wrote: > ---Previous mail sent accidently before ending (sorry for doublon)--- > > Feasable it is (there different ways to do that). > > BTW, I'm also interested to gather some input on that topic. > > @simone : I suggest that you look at pam mecanisms : > http://www.padl.com/OSS/pam_ldap.html > And more specifically at the access.conf syntax. > > You may be interested in : > Hosts, posix groups, group of names and netgroups > > > @list : I would appreciate some input from others about the > best way to store hosts in ldap for this kind of usage : > > Which container to use for hosts (structural class account? > device ? ... ) > > How to deal with groups of hosts : groupOfNames ? posixGroup ? > > Any advice ? > > Thanks, > > > 2012/10/29 Simone Scremin <simone.scremin(a)gmail.com>: >> Hi all, >> I'm in the process of learning the OpenLDAP authentication mechanics. >> I'd need to know what is the best way to configure an host based authentication system that allow to configure a per-user rule to include a group of host to which the user is allowed to login. >> >> In example: >> >> user Bob needs to authenticate on systems: >> >> sys01pra >> sys02pre >> sys03pra >> sys03pre >> >> some configuration on the LDAP server enable this hostnames for Bob with a regular expression like: >> >> sys0*pr* >> >> Is it feasable? >> >> Thanks >> >> Simone >>

1 0

compile 2.4.33 on AIX 6.1 with IBM vac - mdb.c - mdb_cursor_pop fails
by Howard Allison 25 Oct '12

25 Oct '12

Hi I've compiled openldap 2.4.33 on AIX 6.1 and had to edit the file libraries/libmdb/mdb.c. In mdb_cursor_pop I had to comment out the #if MDB_DEBUG directive to make *top visible. #if MDB_DEBUG */ MDB_page *top = mc->mc_pg[mc->mc_top]; /* #endif */ Is this something particular to xlc? Thanks Howard Allison -------------------------------------------------------------------------------------------------------- VERTRAULICHKEIT: Diese Nachricht ist ausschließlich für denjenigen bestimmt, an den sie adressiert ist und kann vertrauliche Informationen enthalten. Falls Sie nicht der Empfänger dieser Nachricht sind, weisen wir Sie darauf hin, dass die unberechtigte Weitergabe oder Verwendung sowie das unberechtigte Verteilen oder Kopieren dieser Nachricht strikt untersagt sind. Falls Sie diese Nachricht irrtümlich erhalten haben, vernichten Sie sie bitte sofort. CONFIDENTIALITY: This message is intended only for the use of the individuality or entity to which it is addressed and may contain information that is privileged, confidential and exempt from disclosure. If you are not the intended recipient you are notified that any dissemination, distribution, use or copying of this communication is strictly prohibited. If you received this message in error, please immediately destroy this message. --------------------------------------------------------------------------------------------------------

2 1

Sincrony groups in LDAP
by rodrigo tavares 23 Oct '12

23 Oct '12

Hello, With paramater retry="60 30 300 +", i can to replicate users. But, I see the groups not copyed for LDAP. I can't replicate the groups. syncrepl rid=123 provider=ldap://10.26.7.45:389 type=refreshOnly interval=00:00:05:00 retry="60 30 300 +" searchbase="dc=company,dc=mg,dc=gov,dc=br" filter="(objectClass=organizationalPerson)" scope=sub attrs="*,+" schemachecking=off bindmethod=simple binddn="cn=admin,dc=company,dc=mg,dc=gov,dc=br" credentials=secret Do I have modificate the objectClass ? Best regards, Rodrigo Faria

2 1

Using replication LDAP
by rodrigo tavares 23 Oct '12

23 Oct '12

Hello ! I'm trying make a replication from master for slave. My configure master: moduleload syncprov.la moduleload back_monitor.la moduleload back_bdb overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 Slave: syncrepl rid=123 provider=ldap://10.26.7.45:389 type=refreshOnly interval=00:00:05:00 searchbase="dc=company,dc=mg,dc=gov,dc=br" filter="(objectClass=organizationalPerson)" scope=sub attrs="*,+" schemachecking=off bindmethod=simple binddn="cn=admin,dc=company,dc=mg,dc=gov,dc=br" credentials=secret I syslog i see this message: Oct 23 10:23:32 replica slapd[1827]: syncrepl rid=123 searchbase="dc=company,dc=mg,dc=gov,dc=br": no retry defined, using default. How I can to resolve it ? Best regards, Rodrigo Faria

3 2

Search response attribute/alias names
by Tele Fone 22 Oct '12

22 Oct '12

Hello, I've searched and think I know the answer, but... This post from several years ago is exactly my issue: www.openldap.org/its/?findid=787 See this one too: www.openldap.org/lists/openldap-software/200105/msg00160.html I would like to know if anything has changed in 10+ years. I'm in the middle of coverting from Critical Path LDAP to OpenLDAP 2.4.26. Critical Path returns the alias name (when requested in search) in search responses. Has there been a magic configuration flag added to make the transition to openldap a bit easier? I understand that openLDAP conforms to the LDAPv3 standard, but had to ask. Thanks.

1 0

ContextCSN generation
by Sven Jourgensen 21 Oct '12

21 Oct '12

I have an odd issue, where I have some new slaves that I added to my pool, they ran fine sync'ing with the master, etc. for weeks, until I added them into use (we're using an F5 frontend) whereupon they started getting a contextCSN which was larger than that of the master. How is the contextCSN generated, I thought the slave could never get ahead of the master, but it's happening consistently, it's not a transient thing, the slave gets a larger contextCSN and keeps it, until the master is updated again. master: contextCSN: 20121010154339.775633Z#000000#000#000000 slave1: contextCSN: 20121010154442.858054Z#000000#000#000000 slave2: contextCSN: 20121010154351.807575Z#000000#000#000000 As soon as I remove them from use, and update the master, they come back into sync. Thanks in advance. SJ

3 4

LDAP Architecture for CardDAV/OpenLDAP interface
by Nicolas Mora 21 Oct '12

21 Oct '12

Hello, I'm using both an OpenLDAP server and an owncloud server, both for different but convergent purposes. The OpenLDAP manages an addressbook that is used by all mail client (Thunderbird, Horde, etc.), and the owncloud server also manages an addressbook for phone numbers, addresses and stuff, this one is a CardDAV one with VCard files. My goal is to converge these 2 different back-ends into one, all the data would be stored in the LDAP server. I did some research about how to do it and I have some clue that I would like to submit to you for feedbacks. The first interrogation is about the VCard/LDAP interface. After studying the VCard format and the different LDAP schemas, mostly RFC 6350 and 2256 and the schema files in the OpenLDAP conf folder in a Debian Stable server. I think that a new schema would do the connection. All the VCard properties can be easily linked to an existing person or inetOrgPerson or another *person objectClass. And the properties that doesn't exist yet are to be created in a schema extension. Also, one or two additional properties fields per property are to be created for the VCard parameters. Actually, there are different objectClass that might be extended: person, inetOrgPerson, organizationalPerson and residentialPerson. Considering that inetOrgPerson, organizationalPerson and residentialPerson are designed for specific purposes, I think that extending the person objectClass would be the best guess, what do you think ? The second question is more about the OpenLDAP configuration to handle this need. Right now, the OpenLDAP server is only used by me as an addressbook and an authentication server, the directory looks like this: dc=babelouest,dc=org | |-ou=addressbook | | | |-cn=Address1 | |-cn=Address2 | |-[...] | |-ou=users | | | |-uid=user1 | |-uid=user2 | |[...] I would like to add another branch to allow users to add their own addressbook entries, these entries would be in read/write mode only for the owner, no one else but him should have access. The new directory would look like this: dc=babelouest,dc=org | |-ou=addressbook (global, read-only for all users) | | | |-cn=Address1 | |-cn=Address2 | |-[...] | |-ou=users | | | |-uid=user1 | |-uid=user2 | |[...] | |-ou=personnalAddressbooks (personnal addressbook entries) | | | |-uid=user1 | | | | | |-cn=Address1 | | |-cn=Address2 | | |-cn=Address3 | | | |-uid=user2 | | | | | |-cn=Address1 | | |-cn=Address2 I took a look at the Access control help page but I couldn't find how to properly set the OpenLDAP configuration like this. Can you help me configuring the slapd.conf ? Thanks in advance. /Nicolas

2 1

Dynamic configuration / admin users
by Simon Walter 19 Oct '12

19 Oct '12

Greetings, First off, I'm sorry if this is the wrong place to ask this. Please direct me to the appropriate list. Here goes with the n00b questions: Debian Squeeze is using the dynamic configuration. While I am sure there are benefits, all the documentation is for static configuration (slapd.conf). I've got a basic tree up and running and several services are using it no problem. There are several things I'd like to do, like replication. For this and some other services, SOGo for example, that don't bind anonymously, I'd like to create some more users for this. I could be mistaken, but perhaps they need some kind of admin privileges. If not, that means that any user can modify anything in the tree. I see various information about ACI and ACL and access.conf. I can't find clear documentation about how any of this relates to dynamic configurations. To conclude, how do I add additional users to a dynamic configured openldap tree and configure those users with specific access permissions? Thank you, Simon

3 3

Mirror mode replication problem
by cbulist 19 Oct '12

19 Oct '12

Hi, We have configured 2 server with openldap 2.4.23-26 version and everything is working well (ppolicy,acl etc). We implemented replication in mirror mode and it is working well. When we add/delete/modify something in serverID 1 it sync the data to serverID2 without problem but when we add/delete/modify in serverID 2 it is not sync to serverID 1. We tried to stop openldap server1 then make changes on server2 and start server 1 again in order to get the changes from server2 but it did not work. According to 2.4 guide: "When a crashed provider is repaired and restarted it will automatically catch up to any changes on the running provider and resync". We appreciate any help to try fix this problem. Thanks in advance! This is the relevant configuration directives: #Server 1 overlay syncprov syscprov-checkpoint 100 10 syscprov-sessionlog 100 serverID 1 syncrepl rid=001 provider=ldap://server2:389 bindmethod=simple binddn="cn=Manager,dc=sample,dc=com" credentials=secret searchbase="dc=sample,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on #Server 2 overlay syncprov syscprov-checkpoint 100 10 syscprov-sessionlog 100 serverID 2 syncrepl rid=001 provider=ldap://server1:389 bindmethod=simple binddn="cn=Manager,dc=sample,dc=com" credentials=secret searchbase="dc=sample,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical