openldap-technical

openldap-technical@openldap.org

1 participants
9989 discussions

Roles in OpenLDAP with back-sql
by David Rose 08 Sep '12

08 Sep '12

Hi everyone, Is anybody know if it's possible to define roles in OpenLDAP using back-sql? Here's the thing, we need to prevent some of our users to see "everything". We need to filter results for some groups of users. But we need these rules in the database (Postgres) to be able to change them dynamically. Problem is that, currently, when a user send a search query, OpenLDAP does not include in any way the DN of the user who made the query. As a result we have trouble creating scopes by user/group. Thanks

3 3

OPENLDAP 2.4.32 INSTALLATION TEST ERRORS
by Borresen, John - 0442 - MITLL 07 Sep '12

07 Sep '12

All, Any help would be great in resolving the following. I am installing, as the subject states, OpenLDAP_2.4.32 on a CentOS 5.8 x86_64 bit machine(VM). When running the 'make test', it runs for about 30-minutes (it seems) then it bombs out with the following error: >>>>> Starting test057-memberof-refint for hdb... running defines.sh Starting slapd on TCP/IP port 9011... Running ldapadd to build slapd config database... ldapadd failed (21)! >>>>> test057-memberof-refint failed for hdb (exit 21) make[2]: *** [hdb-mod] Error 21 make[2]: Leaving directory `/root/downloads/openldap-2.4.32/tests' make[1]: *** [test] Error 2 make[1]: Leaving directory `/root/downloads/openldap-2.4.32/tests' make: *** [test] Error 2 Looking in the testrun directory for any clues, I find: Test.out: # cat test.out ldap_add: Invalid syntax (21) additional info: objectClass: value #1 invalid per syntax adding new entry "olcDatabase={1}hdb,cn=config" adding new entry "olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config" adding new entry "olcOverlay={1}refint,olcDatabase={1}hdb,cn=config" Then, in the slapd.1.log file: 504a441d conn=1001 op=2 do_add ber_scanf fmt ({m) ber: 504a441d conn=1001 op=2 do_add: dn (olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config) ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt (}) ber: 504a441d >>> dnPrettyNormal: <olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config> => ldap_bv2dn(olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config,0) <= ldap_bv2dn(olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config)=0 504a441d <<< dnPrettyNormal: <olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config>, <olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config> 504a441d conn=1001 op=2 ADD dn="olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config" 504a441d oc_check_required entry (olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config), objectClass "olcMemberOf" 504a441d oc_check_allowed type "objectClass" 504a441d oc_check_allowed type "olcOverlay" 504a441d oc_check_allowed type "olcMemberOfRefInt" 504a441d oc_check_allowed type "olcMemberOfGroupOC" 504a441d oc_check_allowed type "olcMemberOfMemberAD" 504a441d oc_check_allowed type "olcMemberOfMemberOfAD" 504a441d oc_check_allowed type "structuralObjectClass" 504a441d slap_queue_csn: queing 0x4362d690 20120907185941.705554Z#000000#000#000000 504a441d ldif_back_add: "olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config" 504a441d oc_check_required entry (olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config), objectClass "olcMemberOf" 504a441d oc_check_allowed type "objectClass" 504a441d oc_check_allowed type "olcOverlay" 504a441d oc_check_allowed type "olcMemberOfRefInt" 504a441d oc_check_allowed type "olcMemberOfGroupOC" 504a441d oc_check_allowed type "olcMemberOfMemberAD" 504a441d oc_check_allowed type "olcMemberOfMemberOfAD" 504a441d oc_check_allowed type "structuralObjectClass" 504a441d oc_check_allowed type "entryUUID" 504a441d oc_check_allowed type "creatorsName" 504a441d oc_check_allowed type "createTimestamp" 504a441d oc_check_allowed type "entryCSN" 504a441d oc_check_allowed type "modifiersName" 504a441d oc_check_allowed type "modifyTimestamp" 504a441d ldif_read_file: entry file exists: "/root/downloads/openldap-2.4.32/tests/testrun/confdir/cn=config/olcDatabase ={1}hdb.ldif" 504a441d ldif_write_entry: wrote entry "olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config" 504a441d ldif_back_add: err: 0 text: 504a441d send_ldap_result: conn=1001 op=2 p=3 504a441d send_ldap_result: err=0 matched="" text="" 504a441d send_ldap_result: conn=1001 op=2 p=3 504a441d send_ldap_result: err=0 matched="" text="" 504a441d send_ldap_response: msgid=3 tag=105 err=0 ber_flush2: 14 bytes to sd 8 504a441d conn=1001 op=2 RESULT tag=105 err=0 text= 504a441d slap_graduate_commit_csn: removing 0x51f0320 20120907185941.705554Z#000000#000#000000 504a441d connection_get(8) 504a441d connection_get(8): got connid=1001 504a441d connection_read(8): checking for input on id=1001 ber_get_next ber_get_next: tag 0x30 len 180 contents: 504a441d op tag 0x68, time 1347044381 ber_get_next 504a441d conn=1001 op=3 do_add ber_scanf fmt ({m) ber: 504a441d conn=1001 op=3 do_add: dn (olcOverlay={1}refint,olcDatabase={1}hdb,cn=config) ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt (}) ber: 504a441d >>> dnPrettyNormal: <olcOverlay={1}refint,olcDatabase={1}hdb,cn=config> => ldap_bv2dn(olcOverlay={1}refint,olcDatabase={1}hdb,cn=config,0) <= ldap_bv2dn(olcOverlay={1}refint,olcDatabase={1}hdb,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcOverlay={1}refint,olcDatabase={1}hdb,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcOverlay={1}refint,olcDatabase={1}hdb,cn=config)=0 504a441d <<< dnPrettyNormal: <olcOverlay={1}refint,olcDatabase={1}hdb,cn=config>, <olcOverlay={1}refint,olcDatabase={1}hdb,cn=config> 504a441d conn=1001 op=3 ADD dn="olcOverlay={1}refint,olcDatabase={1}hdb,cn=config" 504a441d send_ldap_result: conn=1001 op=3 p=3 504a441d send_ldap_result: err=21 matched="" text="objectClass: value #1 invalid per syntax" 504a441d send_ldap_response: msgid=4 tag=105 err=21 ber_flush2: 54 bytes to sd 8 504a441d conn=1001 op=3 RESULT tag=105 err=21 text=objectClass: value #1 invalid per syntax 504a441d connection_get(8) 504a441d connection_get(8): got connid=1001 504a441d connection_read(8): checking for input on id=1001 ber_get_next ber_get_next: tag 0x30 len 5 contents: 504a441d op tag 0x42, time 1347044381 ber_get_next 504a441d ber_get_next on fd 8 failed errno=0 (Success) 504a441d conn=1001 op=4 do_unbind 504a441d conn=1001 op=4 UNBIND 504a441d connection_close: conn=1001 sd=8 504a441d conn=1001 fd=8 closed 504a441d daemon: shutdown requested and initiated. 504a441d slapd shutdown: waiting for 0 operations/tasks to finish 504a441d slapd shutdown: initiated 504a441d ====> bdb_cache_release_all 504a441d slapd destroy: freeing system resources. 504a441d slapd stopped. Dave Borresen Solaris/Linux Systems Administrator Surveillance Systems Group (Group 42) MIT Lincoln Laboratory 244 Wood Street Lexington, MA 02420 P: 781-981-2954 F: 781-981-5344 john.borresen(a)ll.mit.edu

2 2

Re: Roles in OpenLDAP with back-sql
by Dan White 07 Sep '12

07 Sep '12

(CCing the list) On 09/07/12 17:02 +0200, David Rose wrote: >On 09/07/2012 04:17 PM, Dan White wrote: >> On 09/07/12 15:59 +0200, David Rose wrote: >>> Hi everyone, >>> >>> Is anybody know if it's possible to define roles in OpenLDAP using >>> back-sql? >>> >>> Here's the thing, we need to prevent some of our users to see >>> "everything". We need to filter results for some groups of users. But >>> we need these rules in the database (Postgres) to be able to change >>> them dynamically. >> >> Consider using the dynamic slapd-config backend instead. See chapters 5 >> and 8 of the OpenLDAP Administrator's Guide. > >We have a WebApp that stores all its data in Pg and we'd like to access >it using LDAP without having to replicate the database. And AFAIK >slapd-config and back-sql aren't compatible. I don't know. >>> Problem is that, currently, when a user send a search query, OpenLDAP >>> does not include in any way the DN of the user who made the query. >> >> That seems counterintuitive. Are your users binding anonymously? If so, >> don't do that. > >None of our users are bind anonymously. They're logged in, LDAP knows >who's logged in, but doesn't tell Pg when a search query is passed. How do they 'log in'. Do they bind using user credentials directly to the LDAP server, or do they log in to a website? If the latter, then see if your webapp supporting binding *using the user's credentials* when querying the ldap server. Or see if it supports binding with an authz identity matching the user. -- Dan White

2 2

TLS error - TLS accept failure error=1
by cbulist 06 Sep '12

06 Sep '12

Hi, I have problem configuring TLS in my server (2.4.23). I got the error TLS accept failure error=1 when a client tries to log in using ssh. But if I do a ldapsearch from the client machine to the server I don't have problem and I get the answer from the server: ldapsearch -x -H ldaps://serverldap -D "cn=Manager,dc=sample,dc=com" -W -b "dc=sample,dc=com" 'uid=user1' These are my config files: The client ldap.conf: URI ldaps://serverldap BASE dc=sample,dc=com TLS_CACERT /etc/openldap/cacerts/server.pem The server slapd.conf TLSCACertificateFile /etc/openldap/certs/server.pem TLSCertificateFile /etc/openldap/certs/server.pem TLSCertificateKeyFile /etc/openldap/certs/server.pem The /etc/sysconfig/ldap.conf SLAPD_LDAPS=yes Any help? Thanks!

1 0

Editing the olcAccess
by S, Mohan (GE Energy) 06 Sep '12

06 Sep '12

Hi, I've configured olcAccess for my bdb database and I can't able to modify that using ldapmodify. I tried deleting that : ldapmodify -x -h xxx.example.org -D "cn=replicator,ou=admins,dc=example,dc=org" -w secret -f delete.ldif No error cat delete.ldif changetype: modify delete: olcAccess olcAccess: {0} olcAccess: {1} ldapmodify -x -h xxx.example.org -D "cn=replicator,ou=admins,dc=example,dc=org" -w secret -f add.ldif No error cat add.ldif changetype: modify add: olcAccess olcAccess: to attrs=userPassword by self write by anonymous auth by dn.children="ou=admins,dc=example,dc=org" write by * none olcAccess: to * by self write by dn.children="ou=admins,dc=example,dc=org" write by * read olcAccess: to * by self write by dn.children="ou=melbourne,dc=example,dc=org" write by * read my ldapsearch -xLLL -b cn=config -D cn=admin,cn=config -W olcDatabase={1}bdb returns old olcaccess. New access are not getting reflected. Can anyone guide my how to add/edit olcaccess? Can anyone please help me ... Thanks, Mohan

2 1

RE: Editing the olcAccess
by S, Mohan (GE Energy) 06 Sep '12

06 Sep '12

I could able to do this.. I missed the line in my ldif file dn: olcDatabase={2}bdb,cn=config. Apologize Regards, Mohan From: S, Mohan (GE Energy) Sent: Thursday, September 06, 2012 8:26 PM To: openldap-technical(a)openldap.org Subject: Editing the olcAccess Hi, I've configured olcAccess for my bdb database and I can't able to modify that using ldapmodify. I tried deleting that : ldapmodify -x -h xxx.example.org -D "cn=replicator,ou=admins,dc=example,dc=org" -w secret -f delete.ldif No error cat delete.ldif changetype: modify delete: olcAccess olcAccess: {0} olcAccess: {1} ldapmodify -x -h xxx.example.org -D "cn=replicator,ou=admins,dc=example,dc=org" -w secret -f add.ldif No error cat add.ldif changetype: modify add: olcAccess olcAccess: to attrs=userPassword by self write by anonymous auth by dn.children="ou=admins,dc=example,dc=org" write by * none olcAccess: to * by self write by dn.children="ou=admins,dc=example,dc=org" write by * read olcAccess: to * by self write by dn.children="ou=melbourne,dc=example,dc=org" write by * read my ldapsearch -xLLL -b cn=config -D cn=admin,cn=config -W olcDatabase={1}bdb returns old olcaccess. New access are not getting reflected. Can anyone guide my how to add/edit olcaccess? Can anyone please help me ... Thanks, Mohan

1 0

ACL (Regex) help needed
by Denny Schierz 06 Sep '12

06 Sep '12

hi, I have the following structure: cn=foobar,ou=aliases,dc=domain1,ou=mail,ou=services,ou=department,dc=domain,dc=foo cn=foobar1,ou=aliases,dc=domain2,ou=mail,ou=services,ou=department,dc=domain,dc=foo cn=foobar2,ou=aliases,dc=domain2,ou=mail,ou=services,ou=department,dc=domain,dc=foo cn=foobar likes like: dn: foobar,ou=aliases,dc=domain1,ou=mail,ou=services,ou=department,dc=domain,dc=foo objectClass: inetLocalMailRecipient objectClass: person objectClass: top cn: admin sn: admin description: added_by_dekanat mailLocalAddress: sysop(a)department.domain.foo mailRoutingAddress: foobar(a)department.domain.foo At the moment I have one role "mail" that has access to: dn.sub="ou=mail,ou=services,ou=department,dc=domain,dc=foo" read it works as expected, the mailserver can read all entries. Now I want to create a role, who has permissions to delete/add/modify all entries below ou=aliases, from all domains (dc=domain,ou=mail...), but only, if "description: <string>" is found (for delete/modify only, but not for add). Is that possible? Otherwise, how does it look, if I throw the idea with "only if" ? cu denny

2 1

LDAP Administration
by Brian Green 06 Sep '12

06 Sep '12

Hello, I have recently taken over a bunch of systems controlled by an LDAP database - however, the previous admin. didn't add me to the needed group so that I can fully administer the LDAP directory. Is there a way I can force LDAP to add me to this group? I have root access to the Linux server where the OpenLDAP system is hosted, if that helps. I've tried changing the .acl documents - that didn't seem to work to allow me to add myself to that group. This is a production system, so taking it down for a long period of time, or messing it up, would be bad. Thanks for any help, Brian

2 1

Slaving from Mirror Mode
by Nick Urbanik 05 Sep '12

05 Sep '12

Dear Folks, I am having trouble understanding http://www.openldap.org/doc/admin24/dual_dc.png. In particular, I do not understand the exact meaning of the bidirectional arrows, and the purpose of the upper pair of load balancers. 1, Are the upper load balancers there to chain writes to both mirror mode masters? 2. Are the "replica pool" configured to replicate from both masters or only from one? I am setting up mirror mode masters both in the same data centre, with one slave offsite. Should all the slaves slave from both masters, or should they slave from a load balancer which decides which master is getting the writes at present? Although our slaves are busy, surviving network issues with data consistent and correct is very important. Network outages and strange disconnects are the rule without automated configuration management for network devices. -- Nick Urbanik http://nicku.org 808-71011 nick.urbanik(a)optusnet.com.au GPG: 7FFA CDC7 5A77 0558 DC7A 790A 16DF EC5B BB9D 2C24 ID: BB9D2C24 I disclaim, therefore I am.

4 6

Re: Execute a Filter and get the boolean status true/false
by Puneet Khunteta 05 Sep '12

05 Sep '12

Hello Quanah, then, what should i do to attach the no-op control for the ldap_search_s() operation ? Regards, PKHUN On Thu, Sep 6, 2012 at 12:48 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Wednesday, September 05, 2012 9:03 PM +0200 Michael Ströder < > michael(a)stroeder.com> wrote: > > Puneet Khunteta wrote: >> >>> Basically i need the count how many SearchResultEntry responses you get >>> from ldap_search_s(). >>> >> >> You won't get the count without retrieving the results. >> > > Incorrect. You can use the noop control to do this. We actually do this > now in Zimbra to get the total number of accounts in LDAP without having to > get the full result set back. > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical