openldap-technical

openldap-technical@openldap.org

4 participants
9991 discussions

Re: opeLDAP + backsql + salted_hashed_password, how to adopt the mappings
by Dan White 17 Dec '12

17 Dec '12

>>On 12/16/12 12:04 +0100, DavidHornung wrote: >>>I have to say thank you! I changed in the table >>>ldap_attr_mappings the value of userPassword from >>>persons.password >>> >>>to >>>text('{CRYPT}'||persons.password) >>> >>>Now I am able to auth again the salted MD5 passwords! >>> >>>One further question: >>>I tried to use blowfish >>>UPDATE persons SET password = crypt('secret', gen_salt('bf')); >>>instead of md5 >>>UPDATE persons SET password = crypt('secret', gen_salt('bf')); >>> >>>but i could not authenticate, what could be the problem? >> >>Check your local manpage for crypt(3) to see if blowfish is supported on >>your system, and that the ID matches the postgresql output. >> > >Yes, it gives > > ID | Method >--------------------------------------------------------- > 1 | MD5 > 2a | Blowfish (not in mainline glibc; added in some > | Linux distributions) > 5 | SHA-256 (since glibc 2.7) > 6 | SHA-512 (since glibc 2.7) > > >and the 2a is also given back from postgresql crypt When using the '{CRYPT}' identifier, you're telling slapd to make a 'crypt' system call to verify the hash. If that is failing for blowfish (but working for md5), that indicates that your problem is likely with how glibc was compiled on your system. Check with your distribution's glibc maintainer to verify they have included blowfish support (for the crypt call). -- Dan White

1 0

Ldap server Behind Firewall
by Hugo Deprez 17 Dec '12

17 Dec '12

Hello, I am currently running OpenLdap behind a checkpoint firewall. Some hosts are reaching the LDAP server, but the source IP is NAT Hide. (original IP is 192.168.0.1 - translated 192.168.1.2). I can see on my firewall many drops coming from the LDAP server to the translated IP. This kind of packet shouldn't exist, as I am using corosync for HA => No packet are coming from the VIP. This maybe a problem on the checkpoint firewall (which is not handling correctly the NAT), but I would like to know if someone already had this behaviour already with any firewall ? Maybe I am missing something on OpenLDAP network flow. Best regards, Hugo

1 0

Re: opeLDAP + backsql + salted_hashed_password, how to adopt the mappings
by Dan White 16 Dec '12

16 Dec '12

>On 12/16/12 08:55 +0100, DavidHornung wrote: >>>I already set up a self-compiled openldap-server 2.4.33 on CentOS6 with >>>back-sql, especially posgtresql as backend. I am already able to >>>authenticate from my MoinMoin Wiki via LDAP - but up to now the >>>passwords are saved in clear text in the postgresql table. >>> >>>Now I want to save the passwords as salted hash, rearding to >>>postgresql documentation >>See chapter 14.4 of the OpenLDAP Administrator's Guide. >> >>If the output of your postgresql crypt function produces a compatible >>format, use a concatenation function to prepend '{CRYPT}' (or other >>identifier) to your hash before postgresql hands the data off to >>back-sql. On 12/16/12 12:04 +0100, DavidHornung wrote: >I have to say thank you! I changed in the table ldap_attr_mappings >the value of userPassword from >persons.password > >to >text('{CRYPT}'||persons.password) > >Now I am able to auth again the salted MD5 passwords! > >One further question: >I tried to use blowfish >UPDATE persons SET password = crypt('secret', gen_salt('bf')); >instead of md5 >UPDATE persons SET password = crypt('secret', gen_salt('bf')); > >but i could not authenticate, what could be the problem? Check your local manpage for crypt(3) to see if blowfish is supported on your system, and that the ID matches the postgresql output. -- Dan White

1 0

opeLDAP + backsql + salted_hashed_password, how to adopt the mappings
by DavidHornung 16 Dec '12

16 Dec '12

Hello, I would really appreciate if you could help me with following. I already set up a self-compiled openldap-server 2.4.33 on CentOS6 with back-sql, especially posgtresql as backend. I am already able to authenticate from my MoinMoin Wiki via LDAP - but up to now the passwords are saved in clear text in the postgresql table. Now I want to save the passwords as salted hash, rearding to postgresql documentation creating a hash UPDATE ... SET pswhash = crypt('new password', gen_salt('bf')); ask for password SELECT pswhash = crypt('entered password', pswhash) FROM ... ; Now my question : How adopt the mappings in backsql to work with the hashes? Cheers, David

2 1

Help needed for Openldap > Active directory slave/proxy setup.
by Marco van Putten 14 Dec '12

14 Dec '12

Hi all, We want to setup a Openldap server which is a slave to our Active directory. The ldap server only has to do replication of the necessary records to act as a address book for non Exchange users. Further more the authentication has to be done against the users in the Active directory. I found some guides/examples to set up the authentication part. But none of them seems to do want we want because it requires to have the user in your Openldap server with a special "userPassword {SASL}user(a)domain.com" entry. But we want the openldap database to only contain contact information and not username/password information. Does anybody know how to set up such a thing and can give me some hints/guides/recipes on how to do this? Thanks, Marco. -- M. (Marco) van Putten TU Delft / Shared Service Centre ICT Marco.vanPutten(a)tudelft.nl

3 3

authz-regexp trouble, help!
by Василий Молостов 14 Dec '12

14 Dec '12

Hi, I have th following directive in the slapd.conf: authz-regexp gidNumber=([^0][0-9]+).uidNumber=([^0][0-9]+),cn=peercred,cn=external,cn=auth ldapi:///ou=people,dc=local???(uidNumber=$2) but server is unable to fetch (slap_sasl2dn: Converted SASL name to <nothing>) here is trace output (slapd -d 2177 -h "ldapi:/// ldaps:/// ldap:///"): 50ca62b8 >>> dnPrettyNormal: <> 50ca62b8 <<< dnPrettyNormal: <>, <> 50ca62b8 do_bind: dn () SASL mech EXTERNAL 50ca62b8 ==>slap_sasl2dn: converting SASL name gidNumber=1000+uidNumber=1000,cn=peercred,cn=external,cn=auth to a DN 50ca62b8 ==> rewrite_context_apply [depth=1] string='gidNumber=1000+uidNumber=1000,cn=peercred,cn=external,cn=auth' 50ca62b8 ==> rewrite_rule_apply rule='gidNumber=([^0][0-9]+).uidNumber=([^0][0-9]+),cn=peercred,cn=external,cn=auth' string='gidNumber=1000+uidNumber=1000,cn=peercred,cn=external,cn=auth' [1 pass(es)] 50ca62b8 ==> rewrite_context_apply [depth=1] res={0,'ldapi:///ou=people,dc=local??sub?(uidNumber=1000)'} 50ca62b8 slap_parseURI: parsing ldapi:///ou=people,dc=local??sub?(uidNumber=1000) ldap_url_parse_ext(ldapi:///ou=people,dc=local??sub?(uidNumber=1000)) 50ca62b8 <==slap_sasl2dn: Converted SASL name to <nothing> 50ca62b8 SASL Authorize [conn=1001]: proxy authorization allowed authzDN="" 50ca62b8 send_ldap_sasl: err=0 len=-1 50ca62b8 do_bind: SASL/EXTERNAL bind: dn="gidNumber=1000+uidNumber=1000,cn=peercred,cn=external,cn=auth" sasl_ssf=0 50ca62b8 send_ldap_response: msgid=1 tag=97 err=0 Direct sasl authz mapping works fine, but URI does not, what's wrong with this stuff? How I can check URI correctness for slapd or get tracing info from ldap_url_parse_ext/slap_sasl2dn about why they returned nothing? With wich access rights slapd does its internal query ? How to configure them ?

3 2

rwm/relay and ldapwhoami
by Tim Watts 13 Dec '12

13 Dec '12

OK - must be missing something really basic - and I am new to LDAP... I have a server (ldapmaster) that serves dc=new,dc=example,dc=com and a seperate server, ldaplegacy, that uses slapd-ldap + rwm to proxy-translate requests aimed at: dc=old,dc=example,dc=com So: ldapsearch -x -b dc=old,dc=example,dc=com -H ldap://ldaplegacy/ returns ... # me, people, old.example.com dn: uid=me,ou=people,dc=old,dc=example,dc=com objectClass: top objectClass: inetOrgPerson ... nice - exactly as expected. But ldapwhoami -x -W -D uid=me,ou=people,dc=old,dc=example,dc=com -H ldap://ldaplegacy/ returns (after successful bind) dn:uid=me,ou=people,dc=new,dc=example,dc=com Why doesn't the DN get translated? The config section that's relevant on ldaplegacy is: slapd.conf ############################### ... database relay suffix "dc=old,dc=example,dc=com" relay "dc=new,dc=example,dc=com" overlay rwm rwm-suffixmassage "dc=new,dc=example,dc=com" ... ############################### I thought I needed more magic to translate the replies, but that *looks* like it is happening with ldapsearch??? Cheers! Tim -- Tim Watts Personal Blog: http://www.dionic.net/tim/ "History will be kind to me for I intend to write it."

2 2

ppolicy and rwm/relay segfaulting
by Tim Watts 13 Dec '12

13 Dec '12

Hi, This is weird - quite possible a config problem, I'm hoping someone can spot it :) I have a minimal slapd server which works fine with either an rwm/relay section or a ppolicy section - but not both at once. I'm happy to explain *why* I need to do this if asked, but for now it would just clutter this message. I do have a Really Good(TM) reason. ============ Actual problem =================== We load slapd up with actual entries for the dc=new,dc=example,dc=com domain. slapd is configured to map all records with rwm/relay to dc=old,dc=example,dc=com so clients with the old config still work. ie we load a real record: 1) dn: uid=testuser,ou=people,dc=new,dc=example,dc=com and we want clients asking about 2) dn: uid=testuser,ou=people,dc=old,dc=example,dc=com will be served from (1) ======== OK here's an example ================ === Server ==== Running debian 6 server with debian slapd 2.4.23-7.2 /usr/sbin/slapd -d 4 -h "ldap:/// ldaps:/// ldapi:///" -g openldap -u openldap -f /etc/ldap/slapd.conf === Test client === Running test against the "old" realm: ldapwhoami -x -W -D uid=testuser,ou=people,dc=old,dc=example,dc=com # Enter the wrong password and it fails correctly and server runs OK. # Enter the right password and the client says: ldap_result: Can't contact LDAP server (-1) Server says (last few lines from slapd): [rw] bindDN: "uid=testuser,ou=people,dc=old,dc=example,dc=com" -> "uid=testuser,ou=people,dc=old,dc=example,dc=com" [rw] bindDN: "uid=testuser,ou=people,dc=old,dc=example,dc=com" -> "uid=testuser,ou=people,dc=new,dc=example,dc=com" => ldap_bv2dn(uid=testuser,ou=people,dc=new,dc=example,dc=com,0) <= ldap_bv2dn(uid=testuser,ou=people,dc=new,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=testuser,ou=people,dc=new,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=testuser,ou=people,dc=new,dc=example,dc=com)=0 => bdb_entry_get: ndn: "uid=testuser,ou=people,dc=new,dc=example,dc=com" => bdb_entry_get: oc: "(null)", at: "(null)" => bdb_entry_get: ndn: "cn=default,ou=pwpolicies,dc=new,dc=example,dc=com" => bdb_entry_get: oc: "(null)", at: "(null)" ==> hdb_bind: dn: uid=testuser,ou=people,dc=new,dc=example,dc=com send_ldap_result: err=0 matched="" text="" => bdb_entry_get: ndn: "uid=testuser,ou=people,dc=new,dc=example,dc=com" => bdb_entry_get: oc: "(null)", at: "(null)" Segmentation fault However, queries against the "new" domain work: ldapwhoami -x -W -D uid=testuser,ou=people,dc=new,dc=example,dc=com Enter LDAP Password: dn:uid=testuser,ou=people,dc=new,dc=example,dc=com If I disable ppolicy in slapd.conf, queries agains the "old" domain work: root@ldaptest1:/etc# ldapwhoami -x -W -D uid=testuser,ou=people,dc=old,dc=example,dc=com Enter LDAP Password: dn:uid=testuser,ou=people,dc=new,dc=example,dc=com (the rewrite is not perfect - but that may not matter for my clients). Almost certainly I have done something stupid - and it seems clear that ppolicy is being upset by the relay mappings. Any ideas how to fix would be *very* welcome - I have been all over Google and the man pages. All the best! Tim OK - boring stuff: slapd.conf ########################################### ####################################################################### # Global Directives: # Features to permit allow bind_anon_cred bind_anon_dn update_anon # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/ppolicy.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel sync stats sizelimit 5000 tool-threads 1 modulepath /usr/lib/ldap moduleload back_hdb moduleload back_relay moduleload rwm moduleload ppolicy overlay rwm rwm-rewriteEngine on backend hdb ####################################################################### # Global ACLs # # Ensure read access to the base for things like # supportedSASLMechanisms. access to dn.base="" by * read # The userPassword by default can be changed # by the entry owning it if they are authenticated. # This ACL must be first or password leakage will happen!!! access to attrs=userPassword,shadowLastChange by peername.path="/var/run/slapd/ldapi" manage by dn="cn=admin,dc=new,dc=example,dc=com" manage by set="user/uid & [cn=sysadmin,ou=groups,dc=new,dc=example,dc=com]/memberUid" write by self write by * auth # The admin dn has full write access, everyone else # can read everything. Local unix domain socket (root only) # Can do everything access to * by peername.path="/var/run/slapd/ldapi" manage by dn="cn=admin,dc=new,dc=example,dc=com" manage by set="user/uid & [cn=sysadmin,ou=groups,dc=new,dc=example,dc=com]/memberUid" write by * read ####################################################################### # Main new.example.com authoritative database # database hdb suffix dc=new,dc=example,dc=com rootdn "cn=admin,dc=new,dc=example,dc=com" rootpw "{SSHA}NoNoNooo..." directory "/var/lib/ldap" dbconfig set_cachesize 0 134217728 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass eq lastmod on checkpoint 512 30 ####################################################################### # # Password Policy # # overlay ppolicy ppolicy_default "cn=default,ou=pwpolicies,dc=new,dc=example,dc=com" ppolicy_use_lockout ppolicy_hash_cleartext ####################################################################### # Virtual maps - compatibility with old.example.com only # # map dc=old to dc=new # database relay suffix "dc=old,dc=example,dc=com" relay "dc=new,dc=example,dc=com" overlay rwm rwm-suffixmassage "dc=new,dc=example,dc=com" ########################################### Initial database loaded with slapadd from this ldif: ########################################### dn: dc=new,dc=example,dc=com objectClass: top objectClass: dcObject objectClass: organization o: new.example.com dc: new dn: cn=admin,dc=new,dc=example,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: NoNoNoooo... dn: ou=people,dc=new,dc=example,dc=com objectClass: organizationalUnit ou: people dn: ou=groups,dc=new,dc=example,dc=com objectClass: organizationalUnit ou: groups dn: ou=pwpolicies,dc=new,dc=example,dc=com objectClass: organizationalUnit ou: pwpolicies # # # Standard policy for normal people # dn: cn=default,ou=pwpolicies,dc=new,dc=example,dc=com objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: userPassword pwdMinAge: 0 pwdMaxAge: 15811200 pwdExpireWarning: 1814400 pwdGraceAuthnLimit: 3 pwdInHistory: 6 pwdCheckQuality: 2 pwdMaxFailure: 5 pwdMinLength: 8 pwdLockout: TRUE pwdLockoutDuration: 300 pwdFailureCountInterval: 300 pwdMustChange: TRUE pwdAllowUserChange: TRUE pwdSafeModify: FALSE dn: uid=testuser,ou=people,dc=new,dc=example,dc=com objectClass: top objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount cn: Test User employeeType: Staff gecos: Test User gidNumber: 1000 givenName: Test homeDirectory: /homes/testuser loginShell: /bin/bash mail: testuser(a)new.example.com sn: User uid: testuser uidNumber: 1000 userPassword: {SSHA}NoNoNoooo... dn: cn=ddh-staff,ou=groups,dc=new,dc=example,dc=com objectClass: top objectClass: posixGroup cn: ddh-staff description: Test Group gidNumber: 1000 memberUid: testuser dn: cn=sysadmin,ou=groups,dc=new,dc=example,dc=com objectClass: top objectClass: posixGroup cn: sysadmin description: Staff: System Admin Group gidNumber: 1001 memberUid: testuser ########################################### ########################################### ########################################### ########################################### ########################################### ########################################### -- Tim Watts Personal Blog: http://www.dionic.net/tim/ "A fanatic is one who can't change his mind and won't change the subject."

4 10

Search for the last gidNumber/uidNumber
by cbulist 13 Dec '12

13 Dec '12

Hi, I would like to do a search using ldapsearh in order to get the last gidNumber/uidNumber assigned. Any clue? Thanks in advance!

2 2

How to find a users last password change date/time
by Kyle Harris 12 Dec '12

12 Dec '12

Hello All, I am new to OpenLDAP but have it up and running and have allowed users to change their own password. I was about to start working on a Perl script to grab the last password change date/time and email a user a few days before it expires. I have done that before with Perl using Active Directory as the LDAP server. The problem is that when I use ldapsearch, I can see the user attributes including the hashed password but I don't see where it stores the last time a password was changed? In the event it matters, I am using bdb as the database and everything else including logins is working fine. Am I using the wrong tool? How can I get this information? Thank you in advance.

3 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical