openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

ACLs being ignored with rwm/relay
by Tim Watts 21 Jun '12

21 Jun '12

Hi, Sorry - can't figure this out - would welcome any ideas :) The slapd.conf below contains an ACL: access to attrs=userPassword,shadowLastChange by peername.path="/var/run/slapd/ldapi" write by dn="cn=admin,dc=dighum,dc=kcl,dc=ac,dc=uk" write by anonymous auth by self write by * none which works fine on the "real" DN dc=dighum,dc=kcl,dc=ac,dc=uk - I can add extra attrs like homeDirectory and an unauth'd ldapsearch will not list them - eg: ldapsearch -H ldap://localhost/ -D cn=admin,dc=dighum,dc=kcl,dc=ac,dc=uk -b dc=dighum,dc=kcl,dc=ac,dc=uk However, an ldapsearch -H ldap://localhost/ -D cn=admin,dc=dighum,dc=kcl,dc=ac,dc=uk -b dc=cch,dc=kcl,dc=ac,dc=uk lists the "virtual copy" tree AND includes the userPassword attr for each entry which of course, is rather bad. Anyone see why the ACLs are not being applied to the results of the relay/rwm section? Many thanks, Tim slapd.conf ####################################################################### # Global Directives: # Features to permit #allow bind_v2 # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values loglevel -1 # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_hdb moduleload back_relay moduleload rwm # The maximum number of entries that is returned for a search operation sizelimit 500 # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 1 allow bind_anon_cred bind_anon_dn update_anon backend hdb #backend <other> overlay rwm rwm-rewriteEngine on # Virtual maps # # map ou=staff,dc=cch to dc=dighum # database relay suffix "ou=staff,dc=cch,dc=kcl,dc=ac,dc=uk" relay "dc=dighum,dc=kcl,dc=ac,dc=uk" overlay rwm rwm-suffixmassage "dc=dighum,dc=kcl,dc=ac,dc=uk" ####################################################################### # Specific Directives for database dighum # database hdb suffix dc=dighum,dc=kcl,dc=ac,dc=uk rootdn "cn=admin,dc=dighum,dc=kcl,dc=ac,dc=uk" rootpw "CENSORED" directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass eq lastmod on checkpoint 512 30 ####################################################################### # ACLs # access to attrs=userPassword,shadowLastChange by peername.path="/var/run/slapd/ldapi" write by dn="cn=admin,dc=dighum,dc=kcl,dc=ac,dc=uk" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by peername.path="/var/run/slapd/ldapi" write by dn="cn=admin,dc=dighum,dc=kcl,dc=ac,dc=uk" write by self write by * read ####################################################################### # Specific Directives for database #2, of type 'other' (can be @BACKEND@ too): #database <other> #suffix "dc=debian,dc=org" -- Tim Watts Personal Blog: http://www.dionic.net/tim/

4 10

authentication problem
by Chris 21 Jun '12

21 Jun '12

Hi I use openldap to do authentication on RHEL 6 machines. The problem I'm having is that 2 users doesn't get authenticated. When I do a getent passwd for these users it is as if they doesn't exist but a "ldapsearch -x" shows them. I would appreciate it if someone can point me int the right direction.

4 6

Replication and acl: moddn operation problem.
by Konstantin Menshikov 20 Jun '12

20 Jun '12

Hi. I have replication setup . Full replication of o=company, but user for replication (uid=replica,ou=users,o=company) is limited by ACL. Master configuration: access to dn.subtree="ou=users,o=company" attrs=userPassword by anonymous auth access to dn.base="o=company" by dn.exact="uid=replica,ou=users,o=company" read access to dn.subtree="ou=dev,o=company" by dn.exact="uid=replica,ou=users,o=company" read ####################################################################### # BDB database definitions ####################################################################### database hdb suffix "o=company" rootdn "cn=ldapadm,o=company" rootpw password directory /var/db/openldap-data/o=company overlay syncprov Slave configuration: ####################################################################### # BDB database definitions ####################################################################### database hdb suffix "o=company" rootdn "cn=ldapadm,o=company" rootpw password directory /var/db/openldap-data/o=company syncrepl rid=001 provider=ldap://ro1.devel.ldap.company.ru:389 type=refreshAndPersist retry="5 10 300 +" searchbase="o=company" scope=sub schemachecking=off starttls=critical bindmethod=simple tls_reqcert=never binddn="uid=replica,ou=users,o=company" credentials="password" Replication works. When i move object in forbidden by ACL subtree, then no information about this modification goes to the replica server e.g. operation on master server: dn: ou=groups2,ou=dev,o=company changetype: moddn newrdn: ou=groups2 deleteoldrdn: 1 newsuperior: ou=corp,o=company This object is not deleted and contextCSN is not updated on the replica. Is it expected behavior or not? -- Konstantin Menshikov

2 7

adding schema to master
by Stefano Zanmarchi 20 Jun '12

20 Jun '12

Hi, our master slapd (openldap 2.4.26 on RHEL 5.6) has just one slave, same version, not easily modifiable since not directly under our control. We need to have some more attributes in the master and don't need them to be replicated to the slave. Can I safely add a new schema in the slapd.conf of the master, without doing anything to the slave? Thanks a lot for your help, Stefano

2 1

Re: PAM authentication and PPolicy issues
by Clément OUDOT 20 Jun '12

20 Jun '12

2012/6/20 Francesco Belli <Francesco.Belli(a)vegaspace.com>: > Hi Clement, > I already used pam_password directive, I set it to cleartext, but this parameter is used for password change and not for authentication. As man pam_ldap says "Specifies the password change protocol to use", so not the authentication method. Now my situation is that I have some users in the LDAP server that they have a SHA hash in the userPassword field, and they are correctly authenticated, others that have a clear text password and cannot be authenticated via PAM. Password scheme used in LDAP directory do not prevent any application to authenticate to LDAP. Dig into logs to see what is the real reason of your problem. Clément.

4 4

Re: Uniqueness constraint over multiple attributes
by Michael Ströder 20 Jun '12

20 Jun '12

Jan, please follow-up on the mailing list (Cc:-ed) so others can answer and learn as well. Jan Beerden wrote: > We already tried that. We are trying to prevent user1 to have an email alias > that is the same as user2's primary email address. > [..] > What we would like is that a certain value (email address) has to be unique > across both the email and the alias attribute. Uniqueness is only per attribute. So this is not possible. Ciao, Michael.

1 0

Sun(oracle) directory server to openldap
by Stanislas LEVEAU 20 Jun '12

20 Jun '12

Hi I wonder if someone has already migrated from a Sun DSEE to openldap and establishment of a replication from SUN DSEE to openldap. thanks in advance Regards -- *Stanislas LEVEAU** *Rectorat de Caen 168, rue Caponière B.P. 6184 14061 CAEN Cedex Direction des Systèmes d'Information de l'Académie de Caen Département des infrastructures stanislas.leveau(a)ac-caen.fr Tel : 02.31.30.17.86

4 4

Binding to openldap fails
by Bjoern Wuest 20 Jun '12

20 Jun '12

Hello, I have OpenLDAP running on Ubuntu 12.04 . I use it as central directory for authentication as well as contact list. Authentication with LDAP works - locally and remotely. Also authentication via samba (run on same server as OpenLDAP) works. However, setting up the mail system (dovecot + postfix) I encountered a problem new to me. When I try to bind as a "normal" user (here: bjoern) to LDAP it fails with wrong credentials. I can assure that I did not mistyped the password (tried multiple times). Login to the Linux system and samba with same credentials (i.e. bjoern and his password) works. Here is the part of syslog I expect to be the cause: Jun 17 19:36:45 server slapd[23241]: <<< dnPrettyNormal: <cn=bjoern,ou=Users,dc=domain,dc=my>, <cn=bjoern,ou=users,dc=domain,dc=my> Jun 17 19:36:45 server slapd[23241]: conn=1003 op=0 BIND dn="cn=bjoern,ou=Users,dc=domain,dc=my" method=128 Jun 17 19:36:45 server slapd[23241]: do_bind: version=3 dn="cn=bjoern,ou=Users,dc=domain,dc=my" method=128 Jun 17 19:36:45 server slapd[23241]: Jun 17 19:36:45 server slapd[23241]: ==> hdb_bind: dn: cn=bjoern,ou=Users,dc=domain,dc=my Jun 17 19:36:45 server slapd[23241]: bdb_dn2entry("cn=bjoern,ou=users,dc=domain,dc=my") Jun 17 19:36:45 server slapd[23241]: daemon: epoll: listen=8 active_threads=0 tvp=zero Jun 17 19:36:45 server slapd[23241]: => hdb_dn2id("cn=bjoern,ou=users,dc=domain,dc=my") Jun 17 19:36:45 server slapd[23241]: daemon: epoll: listen=9 active_threads=0 tvp=zero Jun 17 19:36:45 server slapd[23241]: daemon: epoll: listen=10 active_threads=0 tvp=zero Jun 17 19:36:45 server slapd[23241]: daemon: epoll: listen=11 active_threads=0 tvp=zero Jun 17 19:36:45 server slapd[23241]: <= hdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30987) Jun 17 19:36:45 server slapd[23241]: send_ldap_result: conn=1003 op=0 p=3 Jun 17 19:36:45 server slapd[23241]: send_ldap_result: err=49 matched="" text="" Jun 17 19:36:45 server slapd[23241]: send_ldap_response: msgid=1 tag=97 err=49 As I configure OpenLDAP "old school" with slapd.conf, here is the ACL set in slapd.conf: access to attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword by anonymous auth by self write by * none access to * by dn="cn=root,dc=domain,dc=my" write by * read access to dn.base="" by * read Googling for the above "DB_NOTFOUND", the only hint I could find were wrong file permissions. As I have setup my system for quick backup / restore I gave it a try and did "chmod -R 777 /" and also disabled apparmor. Yet, there was no difference in the error message. Could you please give me any indication for a solution? Mit freundlichen Grüßen / Kind regards Bjoern Wuest Hausener Strasse 6a 82269 Geltendorf Mobile: +49 1522 8777840

3 4

TLS issues when setting olcTLSCACertificateFile to the CA bundle
by Patrick Hemmer 20 Jun '12

20 Jun '12

Whenever I set olcTLSCACertificateFile to /etc/pki/tls/certs/ca-bundle.crt LDAP clients get cert errors connecting to the server. But it works fine when I point olcTLSCACertificateFile at the actual server cert instead of the CA bundle. With olcTLSCACertificateFile pointed at /etc/pki/tls/certs/ca-bundle.crt: CLIENT: # LDAPTLS_CACERT=/etc/pki/tls/certs/ca-bundle.crt ldapsearch -H 'ldap://fqdn.to.my.server' -ZZ -x -b '' -s base '+' ldap_start_tls: Connect error (-11) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (unable to get local issuer certificate) SERVER (from "slapd -d conns"): TLS: can't accept: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca. Why is this happening. olcTLSCACertificateFile is supposed to control the certificates that OpenLDAP will recognize, not affect the certificate it gives to clients (right?). This is OpenLDAP 2.4.31 -Patrick

5 8

PAM authentication and PPolicy issues
by Francesco Belli 20 Jun '12

20 Jun '12

Hi Everybody, I'm have some RHEL6 machines that use an LDAP server to authenticate. I need to introduce in the server some checks on passwords using PPolicy. PPolicy works fine, the problem is that to use pwdCheckQuality and pwdInHistory I need to save passwords in clear text in the LDAP server. I did a search to find out if there is a way to let PAM to use clear text password to authenticate but it seems that it sends SHA hashes, so authentication fails. Do you have any suggestion? Thanks, Francesco

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical