openldap-technical

openldap-technical@openldap.org

24 participants
9804 discussions

Re: PAM authentication and PPolicy issues
by Clément OUDOT 20 Jun '12

20 Jun '12

2012/6/20 Francesco Belli <Francesco.Belli(a)vegaspace.com>: > Hi Clement, > I already used pam_password directive, I set it to cleartext, but this parameter is used for password change and not for authentication. As man pam_ldap says "Specifies the password change protocol to use", so not the authentication method. Now my situation is that I have some users in the LDAP server that they have a SHA hash in the userPassword field, and they are correctly authenticated, others that have a clear text password and cannot be authenticated via PAM. Password scheme used in LDAP directory do not prevent any application to authenticate to LDAP. Dig into logs to see what is the real reason of your problem. Clément.

4 4

Re: Uniqueness constraint over multiple attributes
by Michael Ströder 20 Jun '12

20 Jun '12

Jan, please follow-up on the mailing list (Cc:-ed) so others can answer and learn as well. Jan Beerden wrote: > We already tried that. We are trying to prevent user1 to have an email alias > that is the same as user2's primary email address. > [..] > What we would like is that a certain value (email address) has to be unique > across both the email and the alias attribute. Uniqueness is only per attribute. So this is not possible. Ciao, Michael.

1 0

Sun(oracle) directory server to openldap
by Stanislas LEVEAU 20 Jun '12

20 Jun '12

Hi I wonder if someone has already migrated from a Sun DSEE to openldap and establishment of a replication from SUN DSEE to openldap. thanks in advance Regards -- *Stanislas LEVEAU** *Rectorat de Caen 168, rue Caponière B.P. 6184 14061 CAEN Cedex Direction des Systèmes d'Information de l'Académie de Caen Département des infrastructures stanislas.leveau(a)ac-caen.fr Tel : 02.31.30.17.86

4 4

Binding to openldap fails
by Bjoern Wuest 20 Jun '12

20 Jun '12

Hello, I have OpenLDAP running on Ubuntu 12.04 . I use it as central directory for authentication as well as contact list. Authentication with LDAP works - locally and remotely. Also authentication via samba (run on same server as OpenLDAP) works. However, setting up the mail system (dovecot + postfix) I encountered a problem new to me. When I try to bind as a "normal" user (here: bjoern) to LDAP it fails with wrong credentials. I can assure that I did not mistyped the password (tried multiple times). Login to the Linux system and samba with same credentials (i.e. bjoern and his password) works. Here is the part of syslog I expect to be the cause: Jun 17 19:36:45 server slapd[23241]: <<< dnPrettyNormal: <cn=bjoern,ou=Users,dc=domain,dc=my>, <cn=bjoern,ou=users,dc=domain,dc=my> Jun 17 19:36:45 server slapd[23241]: conn=1003 op=0 BIND dn="cn=bjoern,ou=Users,dc=domain,dc=my" method=128 Jun 17 19:36:45 server slapd[23241]: do_bind: version=3 dn="cn=bjoern,ou=Users,dc=domain,dc=my" method=128 Jun 17 19:36:45 server slapd[23241]: Jun 17 19:36:45 server slapd[23241]: ==> hdb_bind: dn: cn=bjoern,ou=Users,dc=domain,dc=my Jun 17 19:36:45 server slapd[23241]: bdb_dn2entry("cn=bjoern,ou=users,dc=domain,dc=my") Jun 17 19:36:45 server slapd[23241]: daemon: epoll: listen=8 active_threads=0 tvp=zero Jun 17 19:36:45 server slapd[23241]: => hdb_dn2id("cn=bjoern,ou=users,dc=domain,dc=my") Jun 17 19:36:45 server slapd[23241]: daemon: epoll: listen=9 active_threads=0 tvp=zero Jun 17 19:36:45 server slapd[23241]: daemon: epoll: listen=10 active_threads=0 tvp=zero Jun 17 19:36:45 server slapd[23241]: daemon: epoll: listen=11 active_threads=0 tvp=zero Jun 17 19:36:45 server slapd[23241]: <= hdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30987) Jun 17 19:36:45 server slapd[23241]: send_ldap_result: conn=1003 op=0 p=3 Jun 17 19:36:45 server slapd[23241]: send_ldap_result: err=49 matched="" text="" Jun 17 19:36:45 server slapd[23241]: send_ldap_response: msgid=1 tag=97 err=49 As I configure OpenLDAP "old school" with slapd.conf, here is the ACL set in slapd.conf: access to attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword by anonymous auth by self write by * none access to * by dn="cn=root,dc=domain,dc=my" write by * read access to dn.base="" by * read Googling for the above "DB_NOTFOUND", the only hint I could find were wrong file permissions. As I have setup my system for quick backup / restore I gave it a try and did "chmod -R 777 /" and also disabled apparmor. Yet, there was no difference in the error message. Could you please give me any indication for a solution? Mit freundlichen Grüßen / Kind regards Bjoern Wuest Hausener Strasse 6a 82269 Geltendorf Mobile: +49 1522 8777840

3 4

TLS issues when setting olcTLSCACertificateFile to the CA bundle
by Patrick Hemmer 20 Jun '12

20 Jun '12

Whenever I set olcTLSCACertificateFile to /etc/pki/tls/certs/ca-bundle.crt LDAP clients get cert errors connecting to the server. But it works fine when I point olcTLSCACertificateFile at the actual server cert instead of the CA bundle. With olcTLSCACertificateFile pointed at /etc/pki/tls/certs/ca-bundle.crt: CLIENT: # LDAPTLS_CACERT=/etc/pki/tls/certs/ca-bundle.crt ldapsearch -H 'ldap://fqdn.to.my.server' -ZZ -x -b '' -s base '+' ldap_start_tls: Connect error (-11) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (unable to get local issuer certificate) SERVER (from "slapd -d conns"): TLS: can't accept: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca. Why is this happening. olcTLSCACertificateFile is supposed to control the certificates that OpenLDAP will recognize, not affect the certificate it gives to clients (right?). This is OpenLDAP 2.4.31 -Patrick

5 8

PAM authentication and PPolicy issues
by Francesco Belli 20 Jun '12

20 Jun '12

Hi Everybody, I'm have some RHEL6 machines that use an LDAP server to authenticate. I need to introduce in the server some checks on passwords using PPolicy. PPolicy works fine, the problem is that to use pwdCheckQuality and pwdInHistory I need to save passwords in clear text in the LDAP server. I did a search to find out if there is a way to let PAM to use clear text password to authenticate but it seems that it sends SHA hashes, so authentication fails. Do you have any suggestion? Thanks, Francesco

2 1

autogenerated/virtual attributes
by btb＠bitrate.net 19 Jun '12

19 Jun '12

given an entry such as: dn=cn=abuse,ou=example.net,ou=mail,ou=groups,dc=example,dc=com objectclass=mailgroup cn=abuse member=uid=jdoe,ou=people,ou=accounts,dc=example,dc=com i'd like the entry to also include an attribute, generated automatically, based on the rdn of the entry and the superior's rdn. for example: dn=cn=abuse,ou=example.net,ou=mail,ou=groups,dc=example,dc=com objectclass=mailgroup cn=abuse member=uid=jdoe,ou=people,ou=accounts,dc=example,dc=com maillocaladdress=abuse(a)example.com where maillocaladdress is the automatically generated attribute. is this possible? it seems like something an overlay might accommodate, so i thought i might try experimenting with slapo-rwm, but wanted to also ask here in the meantime. thanks -ben

3 4

How does slapd get "secret" for a DN?
by ctosgh 19 Jun '12

19 Jun '12

Greetings, As section 15.2.3 in http://www.openldap.org/doc/admin24/sasl.html said "The server's copy of the shared-secret may be stored in Cyrus SASL's own sasldb database, in an external system accessed via saslauthd, or in LDAP database itself" How does slapd know where the secret is stored? Does slapd try each place in a predefined sequence? Thanks, Jacky

2 1

LDAP Educational Resources
by Roger Martinez 18 Jun '12

18 Jun '12

Hello all, Does anyone have any websites that they can recommend for a simple "getting started" approach to configuring OLC configuration of LDAP? I'm stuck at trying to figure out how to add my own DIT (dc=example,dc=net) so that i can add entries to it. Any guidance will be much appreciated. And thanks to Quanah and Nick for replying to my last request for help! -- Roger Martinez Intern incNETWORKS, inc.

2 2

syncrepl in refreshOnly mode, why nentries=0?
by Warren Howard 18 Jun '12

18 Jun '12

Dear All, I have a single provider and a single consumer setup. The consumer is set up to do syncrepl of type=refreshOnly and everything looks to be in order i.e. comparing the output of ldapsearch for provider and consumer shows that the directories are in sync. When I look at the logs on the provider I see that at times when there is "nothing to do" (the directories are in sync) that nentries=0 in the SEARCH RESULT from the syncrepl connection initiated by the consumer. Then, for example, when one new entry is on the provider, I see nentries=1 in the SEARCH RESULT when the consumer connects. So for syncrepl, nentries represents the difference in entries between the provider and the consumer. But this is not what I expected to find, I expected nentries from a syncrepl connection to match nentries from an equivalent (i.e. same search parameters) ldapsearch connection. Is my logic wrong and if so why? Regards, Warren.

2 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical