openldap-technical

openldap-technical@openldap.org

11 participants
9979 discussions

chaining and returning errors
by Frank Van Damme 29 Jun '12

29 Jun '12

List, I'm setting up chaining. And I want to get errors, no referrals :) my olcDatabase looks like this: olcDatabase={0}ldap,olcOverlay={1}chain,olcDatabase={1}hdb,cn=config objectClass: olcChainDatabase (auxiliary) objectClass: olcConfig (abstract) objectClass: olcDatabaseConfig (structural) objectClass: olcLDAPConfig (structural) objectClass: top (abstract) olcDatabase: {0}ldap olcDbIDAssertBind: bindmethod="simple" binddn="uid=lalalala" credentials="foo" mode="self" olcDbURI: ldap://example.com here is this object's parent: olcOverlay={1}chain,olcDatabase={1}hdb,cn=config objectClass: olcConfig (abstract) objectClass: olcOverlayConfig (structural) objectClass: top (abstract) olcOverlay: {1}chain The problem is that I can't insert an olcChainReturnError attribute into it. The schema doesn't allow it. I tried to add the olcChainConfig objectClass to the olcDatabase={1} object, which requires me to fill in an extra attribute "olcOverlay" - I tried {1}chain and "chain" and "{0}ldap" but either give me an error 65 "invalid structural object class chain". -- Frank Van Damme No part of this copyright message may be reproduced, read or seen, dead or alive or by any means, including but not limited to telepathy without the benevolence of the author.

2 2

Re: Memberof overlay with posixGroup
by Marcio Merlone 29 Jun '12

29 Jun '12

Em 28-06-2012 12:39, Julien Soula escreveu: > On Thu, Jun 28, 2012 at 10:34:48AM -0300, Marcio Merlone wrote: >> I am trying to implement memberof overlay on Ubuntu 10.04.4 LTS and >> OpenLDAP 2.4.21-0ubuntu5.7 over posixGroup, not groupOfNames. I >> created the following ldif: >> >> .../... >> >> adding new entry "olcOverlay={2}memberof,olcDatabase={1}hdb,cn=config" >> ldap_add: Other (e.g., implementation specific) error (80) >> additional info: member attribute="memberUid" must either >> have DN (1.3.6.1.4.1.1466.115.121.1.12) or nameUID >> (1.3.6.1.4.1.1466.115.121.1.34) syntax > overlay memberof only supports DN as membership attribute (as DN and > nameUID type). I don't know any workaround for your case. Sorry for the noise, I SWEAR, I was so sure posixGroup use DN as membership, overlooked that. Thanks and best regards. -- *Marcio Merlone*

1 0

Memberof overlay with posixGroup
by Marcio Merlone 28 Jun '12

28 Jun '12

Greetings, I am trying to implement memberof overlay on Ubuntu 10.04.4 LTS and OpenLDAP 2.4.21-0ubuntu5.7 over posixGroup, not groupOfNames. I created the following ldif: root@venus:~# cat memberof.ldif dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: memberof - add: olcModuleLoad olcModuleLoad: refint dn: olcOverlay={2}memberof,olcDatabase={1}hdb,cn=config objectClass: olcConfig objectClass: olcMemberOf objectClass: olcOverlayConfig objectClass: top olcOverlay: {2}memberof olcMemberOfRefInt: TRUE olcMemberOfGroupOC: posixGroup olcMemberOfMemberAD: memberUid olcMemberOfMemberOfAD: memberOf dn: olcOverlay={3}refint,olcDatabase={1}hdb,cn=config objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcRefintConfig objectClass: top olcOverlay: {3}refint olcRefintAttribute: memberof memberuid manager owner seeAlso roleOccupant root@venus:~# And got the error: root@venus:~# ldapadd -x -D "cn=admin,cn=config" -W -f memberof.ldif Enter LDAP Password: modifying entry "cn=module{0},cn=config" adding new entry "olcOverlay={2}memberof,olcDatabase={1}hdb,cn=config" ldap_add: Other (e.g., implementation specific) error (80) additional info: member attribute="memberUid" must either have DN (1.3.6.1.4.1.1466.115.121.1.12) or nameUID (1.3.6.1.4.1.1466.115.121.1.34) syntax root@venus:~# Is this a specific version problem, is it not doable or have I screwed something? Thanks for any help, please let me know if you need further information. Regards. -- *Marcio Merlone*

1 0

Strange TLS issue while upgrading from openldap 2.3 to 2.4
by Guillaume Rousse 28 Jun '12

28 Jun '12

Hello list. I recently faced a strange issue while upgrading from openldap 2.3 to 2.4 (from centos 5.7 to 6.2, actually): the change was transparent for every applications excepted Zimbra, for which any authentication attempt was suffering from an unexplained 30s additional delay. Just switching from explicit TLS usage on port 389 to explicit SSL usage on port 636 was enough to fix the issue. The logs shows than the delay occurs between the moment where the bind operation succeed, and the moment the client connection get closed: Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 fd=135 ACCEPT from IP=128.93.142.13:41191 (IP=0.0.0.0:389) Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 op=0 STARTTLS Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 op=0 RESULT oid= err=0 text= Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 fd=135 TLS established tls_ssf=256 ssf=256 Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 op=1 BIND dn="uid=fauge00C,ou=people,dc=inria,dc=fr" method=128 Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 op=1 BIND dn="uid=fauge00C,ou=people,dc=inria,dc=fr" mech=SIMPLE ssf=0 Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 op=1 RESULT tag=97 err=0 text= ... Jun 14 11:56:34 ildapslave2 slapd[16618]: conn=2787 fd=135 closed (connection lost) Before the upgrade, the connection get closed immediatly, and there is no such delay. Using higher logging level doesn't provide additional useful details, excepted maybe more details about connection termination: Jun 14 12:53:21 ildapslave2 slapd[7156]: connection_read(109): checking for input on id=1135 Jun 14 12:53:21 ildapslave2 slapd[7156]: ber_get_next on fd 109 failed errno=0 (Success) Jun 14 12:53:21 ildapslave2 slapd[7156]: connection_read(109): input error=-2 id=1135, closing. I'm aware than this behaviour change may actually come from underlying libraries, such as bdb for instance, rather than openldap itself, but that's still quite a curious issue. Does anyone have a clue about this problem ? -- The more cordial the buyer's secretary, the greater the odds that the competition already has the order -- Murphy's Laws on Technology n°38

3 7

back-meta and SSL
by Peter Ga 26 Jun '12

26 Jun '12

Hello, one question to back-meta: Is it possible to have several ldaps:// URLs as entries, without client-side authentication? I.e. I just want to configure the CA cert path and connect to a ldaps repository ('normal' ssl, no starttls). I saw the section in the man page about idassert-bind, but was not completely sure they apply to ldaps URLs without authentication. Best regards, Peter

1 0

Security Deadlock?
by suomi 26 Jun '12

26 Jun '12

Hi listers this is on Fedora 17 running openldap-servers-2.4.31-2.fc17.x86_64 When trying to start slapd on this sysem, I run into the following deadlock: 1. [root@myws ~]# systemctl status slapd.service slapd.service - OpenLDAP Server Daemon Loaded: loaded (/usr/lib/systemd/system/slapd.service; enabled) Active: failed (Result: timeout) since Tue, 26 Jun 2012 14:23:02 +0200; 16s ago Process: 2531 ExecStart=/usr/sbin/slapd -u ldap -h ${SLAPD_URLS} $SLAPD_OPTIONS (code=exited, status=0/SUCCESS) Process: 2467 ExecStartPre=/usr/libexec/openldap/check-config.sh (code=exited, status=0/SUCCESS) CGroup: name=systemd:/system/slapd.service When I checked /var/log/localmessages, I found Jun 26 13:08:21 casablanca slapd[838]: ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={0}config.ldif" I remembered, that this was exactly the file, where I had introduced the olcRootPW attribute for the cn=config subtree. So I removed the olcRootPW attribute from this file. 2. Then I could start slapd, no problem. 3. I tried to go into the cn=config subtree of the DIT on that slapd server. I tried it withoud password, since I had removed the password from this subtree. I got: Return Code from Bind: 48 Message: LDAP_INAPPROPRIATE_AUTH: The server requires the client which had attempted to bind anonymously or without supplying credentials to provide some form of credentials 4. I tried to go into the cn=config subtree of the DIT on that slapd server using the password I had usually used at this point. I got: Return Code from Bind: 49 Message: LDAP_INVALID_CREDENTIALS: The wrong password was supplied or the SASL credentials could not be processed 5. I googled around and found the following: ... Obvious approach: slapcat -n0 -F old/slapd.d > config.ldif edit config.ldif slapadd -n0 -F new/slapd.d -l config.ldif test using new/slapd.d deploy ... which I followed because I thought that such a clever approach can come only from a clever openldap guy. But when I tried to introduce the edited config.ldif into the DIT, I got [root@myws /etc/openldap]# slapadd -n0 -F slapd.d -l /tmp/slapd.config.ldif slapadd: could not add entry dn="cn=config" (line=1): _ 1.03% eta none elapsed none spd 4.5 M/s Closing DB... [root@myws /etc/openldap]# 6. I am now at the point, that I cannot access the cn=config subtree, because I cannot define the password to access this subtree and because, to access that subtree, I need to have defined the appropriate password. Looks very much kin'o like a deadlock. Is there anybody out there who knows how to circumvent this deadlock or do I need to file a bug to openldap? Thanks for your patience. suomi

2 1

Controlled LDAP Proxy/Relay
by W.Siebert＠t-systems.com 25 Jun '12

25 Jun '12

Hello, thanks for your answer. But I don't have any local users. All users are in two targets: domain01.com and domain99.net (AD). Where I should place userPassword attribute? My problem: We have a VoIP realized by Cisco Unified Call Manager (CUCM). There are several thousand users in the customers directory (domain01.com) using CUCM for Voice and ca 100 adminusers in the supplier directory (domain99.net). No trusting, different companies. Because CUCM can use only one directory to authenticate users I've implemented a OpenLDAP Metadirectory that proxying this 2 Microsft AD targets. But meta backend tries to authenticate by the first target, if the user was not found, by the second. Result: Intrusion detection register a lot of unsuccessfully login attempts. Therefore my question: Is it possible to implement the controlled proxy with OpenLDAP ? E.g., like Radiusproxy based on realm: when username is _xxx(a)domain01.com_<mailto:_xxx@domain01.com_> go to the target1, and when username is _xxx(a)domain99.net_<mailto:_xxx@domain99.net_> go to the target2. Can you help me please Kind regards Waldemar ################################################################ On 08/02/2012 09:58, W.Siebert(a)t-systems.com<mailto:W.Siebert@t-systems.com> wrote: > Is it possible to implement the controlled proxy with OpenLDAP ? > E.g., like Radiusproxy based on realm: when username is > _xxx(a)domain01.com_<mailto:_xxx@domain01.com_> <mailto:xxx@domain01.com> go to the target1, and > when username is _xxx(a)domain99.net_<mailto:xxx@domain99.net<mailto:_xxx@domain99.net_<mailto:xxx@domain99.net>> go to the target2. Yes, a combination of meta database config in slapd.conf and appropriate SASL config. In your schema, use the following in userPassword: userPassword: {SASL}xxx@DOMAIN where DOMAIN is whichever domain the user needs to be authenticated against. In slapd.conf: database meta suffix dc=local rootdn cn=administrator,dc=local rootpw secret # domain01 uri ldaps://domain01.com:3269/ou=domain01.com,dc=local lastmod off suffixmassage "ou=domain01.com=local" "dc=domain01,dc=com" idassert-bind bindmethod=simple binddn="cn=binder,dc=domain01,dc=com" credentials="password" flags=non-prescriptive idassert-authzFrom "dn.exact:cn=administrator,dc=local" # domain02 uri ldaps://domain02.com:3269/ou=domain02.com,dc=local lastmod off suffixmassage "ou=domain02.com=local" "dc=domain02,dc=com" idassert-bind bindmethod=simple binddn="cn=binder,dc=domain02,dc=com" credentials="password" flags=non-prescriptive idassert-authzFrom "dn.exact:cn=administrator,dc=local" In saslauthd.conf you need to create the appropriate search base for authentication based on the domain in the userPassword field: ldap_servers: ldapi://%2Fvar%2Frun%2Fslapd%2Fldapi-meta ldap_search_base: ou=%d,dc=local ldap_filter: (sAMAccountName=%U) ldap_auth_method: bind ldap_bind_dn: cn=administrator,dc=local ldap_password: secret ldap_deref: never ldap_use_sasl: no Hopefully this is enough info to get you going. -- Liam Gretton liam.gretton(a)le.ac.uk<mailto:liam.gretton@le.ac.uk> HPC Architect http://www.le.ac.uk/its IT Services Tel: +44 (0)116 2522254 University of Leicester, University Road Leicestershire LE1 7RH, United Kingdom

2 3

Ldap filter to get group members
by dhanushka ranasinghe 25 Jun '12

25 Jun '12

Hi... guys i have a LDAP server and its has a group called . cn=internal ou=group,dc=example,dc=com --users of this group is : uid=user1,ou=user,dc=example,dc=com uid=user2,ou=user,dc=example,dc=com i need to only to authenticate the users under cn=internal .... LDAP search for the cn=internal group as follows , dn: cn=internal,ou=group,dc=example,dc=com objectClass: groupOfNames objectClass: top cn: internal member: uid=user1,ou=user,dc=example,dc=com member: uid=user2,ou=user,dc=example,dc=com member: uid=user3,ou=user,dc=example,dc=com member: uid=user4,ou=user,dc=example,dc=com by the way All the users are stored at base OU=user,DC=example,DC=com This is what we are using (&(objectClass=groupOfNames)(memberOf=CN=internal,OU=group,DC=example,DC=com)) seems like its not working .. what the LDAP search filter i need to use to get only the members of the cn=internal group authenticated... Thanks

3 4

Reject requests on non-secure connections
by Terry Gardner 23 Jun '12

23 Jun '12

Is it possible to configure the server to reject requests on non-secure connections with the exception of the StartTLS extended request? In other words, when an LDAP client connects on the clear-text port, can the server be configured to reject all requests on that exception except for the StartTLS extended request in order to prevent clients from transmitting data in the clear?

2 1

Full Backup/Restore slapd
by galemberti greg 22 Jun '12

22 Jun '12

Hi, I want to implement a full backup procedure of my LDAP (schema, ACL, Data ...). * To save my schema i used the command: "slapcat -H ldap:///cn={4}my,cn=schema,cn=config -l schema.ldif" * To save my config, i used the command: "slapcat -H ldap:///olcDatabase={1}hdb,cn=config = config -l config.ldif * To save my accounts, i used the command: "slapcat -H ldap:///dc=my,dc=my -l accounts.ldif Now, when I want to test the restore on another server : * To restore my schema i used the command: "sudo -u openldap slapadd -v -b cn=config -l schema.ldiff " > OK * To restore my accounts i used the command: "sudo -u openldap slapadd -v -c -b cn=config -l accounts.ldiff " > OK * To restore my config i used the command: "sudo -u openldap slapadd -v -c -b olcDatabase={1}hdb,cn=config -l config.ldiff > KO. Indeed the slapadd command does not update the record so I get an error because they already exist. Also, how do I restore my configuration? Tks for your help PS : i use a debian squeeze server.

3 3

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical