openldap-technical

openldap-technical@openldap.org

23 participants
9804 discussions

Re: AD proxy in OpenLDAP
by Christopher O'Kelly 04 Apr '12

04 Apr '12

(feeling a tad silly, now that I have discovered I was not replying to the actual mailing list but to single people.) OK so I have managed to get both the ldap and hdb databases to coexist, mostly through copying code straight from the ldapglue test in the OpenLDAP build files. The ldif file I use now for my backend is as follows - dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/lib/ldap olcModuleload: back_hdb olcModuleload: back_ldap dn: olcDatabase={1}ldap,cn=config objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {1}ldap olcSuffix: ou=internal,dc=companyname,dc=local olcSubordinate: TRUE olcDbURI: "ldap://companyname.local" olcDbRebindAsUser: FALSE olcDbChaseReferrals: TRUE dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcSuffix: dc=companyname,dc=local olcLastMod: TRUE olcRootDN: cn=admin,dc=companyname,dc=local olcRootPW: {SSHA}hashed password olcDbDirectory: /var/lib/ldap olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: sn pres,eq,sub olcDbCheckpoint: 512 30 olcAccess: to attrs=userPassword by dn="cn=admin,dc=minecorp,dc=local" write by anonymous auth by self write by * none olcAccess: to attrs=shadowLastChange by self write by * read olcAccess: to dn.base="" by * read olcAccess: to * by dn="cn=admin,dc=companyname,dc=local" write by * read I can search dc=companyname,dc=local fine, I see the users in this tree and the Internal OU. However I do not see any of the users from the AD linked to by this database. I know I can ldap search it from the server and get results, so I believe that either I need to construct my search differently or it is an authentication issue. As I read it, I need to use idassert-bind, specifying a user from AD with read access, and that user will be used to search AD. I have a few questions leading from this - The first is: does anyone know the syntax for idassert-bind as it applies to ldif files to be ldapadded to the RTC? As I read it, if it were slapd.conf I would want - idassert-bind bindmethod=simple binddn="cn=proxy,ou=service accounts,ou=users,dc=companyname,dc=local" credentials="password" mode=self but I am unsure how to structure this for RTC. The second is - am I correct in thinking that, once this is all working, a search with (objectclass=*) on the dc=companyname,dc=local should return all the users in that branch as well as all the users in AD? Or will I need to craft my search differently to deal with the proxy? The third is also just a confirmation - is idassert-bind meant for what I think it is? Should it contain a user not in the local DSA but in the one I am proxying to? Or have I misread?

1 0

RE: ppolicy master/slave issue
by Chris Jacobs 04 Apr '12

04 Apr '12

Nope - I merely left out the chain directives. Given the choice between "forward ppolicy updates" or "allow users to change their passwords anywhere", we went with the former. We never identified how to get them to /both/ work and require actual user authentication. This is ok in our environment - and as it turns out we kind of like this limitation. Our corp environment authenticates off the master servers and we simply tell people to use a corp servers to change their password. We don't have any users (besides myself) whose desktop's authenticate from our OpenLDAP infrastructure - it's only our servers. Here's the bits we simply removed from the conf (from the thread you're quoting, the rest is largely the same): chain-uri ldaps://ldap-vip.corp.example.net/ chain-rebind-as-user TRUE chain-idassert-bind bindmethod="simple" binddn="cn=root,dc=example,dc=net" credentials="secret" mode="self" chain-tls ldaps chain-return-error TRUE Someone else hopped onto the thread indicating they had the same problems - but no one ever chimed in with "this is what's going on" or "this is what you're doing wrong". Such is free community support. :) We're now using the RHEL6/CentOS6 2.4.23 supplied packages (nearly a sin in this mailing list, but everything is working fine for us) but haven't approached attempting this again as we're used to this limitation. Of course, that wouldn't be the case if user desktops authenticated from local slave ldap servers, but we're not in that situation and really, we've a lot of other fish in the frying pan. Good luck! - chris From: Limb, Jong (VDSS) [mailto:Jong.Limb@dss.virginia.gov] Sent: Wednesday, April 04, 2012 7:45 AM To: Chris Jacobs Subject: ppolicy master/slave issue Were you ever able to figure out why the authentication against a slave works regardless of the password as you describe below? I am having the exact same problem. Thanks. Jong Limb Division of Information Systems Virginia Department of Social Services 804-726-7823 Hello again, I'm having an odd issue with ppolicy and my master/slave config. First, my goals General use: Slave handles all reads locally. Writes get forwarded to the master by the slave. Password policy: When password failures happen on clients using slave ldap servers, the failures, etc, get passed to the master to get replicated to the slaves. I understand this would be done using the ppolicy option: ppolicy_forward_updates Authentication: Actually authenticate (more later). To the problem: --------------- When I leave the section in the chain bit of SLAVE slapd.conf below marked by lines intact (which bind as root): * ppolicy_forward_updates seems to work great - the master shows matching "pwdFailureTime" attributes. * Regardless of password entered, you get a shell. User/bad password = get a shell! This being a problem should be obvious. I suspect that's due to the chain overlay section... ________________________________ This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

1 0

openldap proxy to AD
by Induni, Marco 04 Apr '12

04 Apr '12

Hi all, I'm building an openldap proxy to an AD server and adding a little of "intelligence" based on the client request. Unfortunately the client/program asking information about an account, need to be setup with user and password. There is a way to let the proxy "ignore" this user and password and instead just use the ones specified on the slapd.conf file ? Or setup fake credential somewhere ? In detail, query are something like: ldapsearch -x -h openldap-proxy -w "secret" -D "CN=MGRADREAD05,CN=MGR,DC=example,DC=com" -b "dc=pmm,dc=int" userPrincipalName=TST-USER10 but I need that the proxy exclude the "-w "secret" -D "CN=MGRADREAD05,CN=MGR,DC=example,DC=com" part, and use the one on the conf file. In fact if I do a query like: ldapsearch -x -h openldap-proxy -w "secret" -D "CN=MGRADREAD05,CN=MGR,DC=example,DC=com" -b "dc=pmm,dc=int" userPrincipalName=TST-USER10 it works. Here the slapd.conf database meta suffix "dc=pmm,dc=int" uri "ldap://10.10.10.1/dc=pmm,dc=int" suffixmassage "dc=pmm,dc=int" "dc=media,dc=int" rewriteContext searchFilter rewriteRule "userPrincipalName=(.*)(a)rtsi.ch" "userPrincipalName=%1(a)rsi.ch" ":" rewriteRule "sAMAccountName=([:alnum:])" "userPrincipalName=%1(a)rtr.ch" ":" idassert-bind bindmethod=simple binddn="CN=svc-adread05,CN=AdminAccounts,OU=RSI,OU=Units,DC=media,DC=int " credentials="Comano2012" mode=self idassert-authzFrom "dn.regex:.*" Any idea ? Many thank's and best regards. Marco ****************************************************** Visit: http://www.rsi.ch This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify postmaster(a)rsi.ch

2 2

Convert *.schema to *.ldif
by Francis Swasey 04 Apr '12

04 Apr '12

I don't see any description in the admin guide about how to convert a *.schema file into a *.ldif file. Google tells me that most people are using slaptest with the -F and -f parameters with a specially crafted slapd.conf file. As the person who is responsible for a *.schema file and develops it not on a machine that has the openldap server software installed, that process is not anything I'm interested in. Looks like it should be a fairly simple set of transformations. Looking at the *.schema and *.ldif that are provided with the openldap source - I am left wondering how they were created, since they have comments, they were obviously not created via the slaptest -F <x> -f <y> method. I would like to programatically do this -- my ability to vi two files and make identical changes has been known to be fallable! I found the fusiondirectory-schema2ldif perl script - but it is not complete and silently drops keywords it doesn't like which is a really nasty coding style generating garbage from quality schemas. Suggestions? Code examples? Thanks, -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

6 7

Password expiration
by Collins, Cris L. 04 Apr '12

04 Apr '12

I am running OpenLDAP as packaged for CentOS 5 and having problems with password expiration. Users are being told every time they login that their password has expired and to change their password. When ShadowMax is changed to 99999 their passwords are not expiring. The preferable setting is 90 days. ShadowLastChange is updating to the correct date when they input a new password. Thank you for you time and input as to why this might be occurring.

4 3

centralized sudo policies : ACL issue
by Olivier 04 Apr '12

04 Apr '12

A quite trivial issue I have : I have installed centralized policy sudo rules in ldap server (I use "schema.OpenLDAP" from "http://www.sudo.ws" ). I also have configured linux clients to check ldap rules to grant sudo access to certain ressources ( I declared "sudoers_base" in nslcd.conf and "sudoers: ldap" in nsswitch.conf ). That works, but I'm still not happy :-) To make it work, I need to authorize reading on the sudoers DIT branch for user, which I would like to avoid ( BTW, normally /etc/sudoers is not readable by users ). Anyone knows any way to remove sudo rules reading rights to usual users while having rules working for everyone ( I was thinking about an ldap proxy user used to read sudo rules in ldap, but I haven't found how to declare it ) ? Thanks, --- Olivier

2 1

Hashing the userPassword
by Suneet Shah 04 Apr '12

04 Apr '12

Hello, I am creating a user in OpenLDAP using Java. The user is being successfully created, but the passwords are being stored in clear text. Is there something that I need to change in the OpenLDAP configuration to enable storing the password securely using ssha? thank you for your help suneet

3 2

modifyTimeStamp not modified on replica
by jehan procaccia 03 Apr '12

03 Apr '12

Hello when I modify the mail attribute on the master, the attribute is correctly replicated on the replica, but the modifyTimeStamp isn't !? shouldn't it be modified !? The master is runing openldap-servers-2.3.43-12.el5_7.10 the replica that failes to replicate modifyTimeStamp is an openldap-servers-2.4.23-20.el6.i686 on a openldap-servers-2.3.43-12.el5_7.10 replica, modifyTimeStamp is correctly updated ! could it be a openldap version incompatibility ? or perhaps an ACL miss-configuration !? Thanks for your help .

2 5

Ubuntu can't connect to SambaPDC
by Imre Bertalan 03 Apr '12

03 Apr '12

Hi guys. This is not really an OpenLDAP question, but it seems we have some fine qualified users here, so I'll ask this question here. :) I have a nice working Zentyal 2.2 server with DNS and SambaPDC. Windows client's can join the domain with the network users ans they see all the shared folders too. My problem is that I don't know how to join a domain with Ubuntu. Tried with likewise-open and likewise-open-gui, but all the time, it sais Bad_DNS_Package. Same error message comes when I try to join from terminal with the command "*sudo domainjoin-cli join DOMAIN USER*" I also installed samba, smbclient, winbind on the client. I heard that it could be because the server is set to allow Win clients only. Could that be? Thanks in advance! Imi

2 1

Active Directory connected to OpenLDAP (master)
by Sylvain 03 Apr '12

03 Apr '12

Hi ! Currently, we've got an OpenLDAP which acts as a master and contains 20000+ users and groups, we want to keep it. CIO ask us to deploy Windows with AD connected to our master OpenLDAP. I've googled a lot and I don't find any clean solutions like replica (OpenLDAP -> AD). Another solution could be use of referrals on the AD but I doubt ? Unclean solutions found are use of LSC or MIIS/FIM which are not real-time... A little help would be cool :) Best regards, Sylvain

3 8

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical