openldap-technical

openldap-technical@openldap.org

23 participants
9804 discussions

Help with password policy
by Gabriella Turek 29 Mar '12

29 Mar '12

Setup: OpenLDAP 2.4 SUSE SLES11, chaining (read only) to an AD directory I've set up a simple default pwd policy and configured it in slapd.conf: - Included the schema /etc/openldap/schema/ppolicy.schema - Under my db configuration added the entries overlay ppolicy ppolicy_default "cn=default,ou=pwpolicies,dc=niwa,dc=local" - The policy is simply: dn: cn=default,ou=pwpolicies,dc=example,dc=com cn: default ….. pwdMinLength: 8 pwdAllowUserChange: TRUE But when I run tests with too short a password the password still gets changed. No error messages. One thing I am confused about is that the documentation says to include the moduleload directive in slapd.con but I can't find any modules, the directory where they are supposed to be is empty. slapd –VVV indicates that it includes the static overlay. Any help is highly appreciated, I am quite a newby at this. Gaby -- Dr Gabriella Turek Sr. Software Engineer, Systems Development Team NIWA Auckland, New Zealand Tel: +64 9 3754645 www.niwa.co.nz NIWA - Enhancing the benefit of New Zealand’s natural resources. -- Please consider the environment before printing this email. NIWA is the trading name of the National Institute of Water & Atmospheric Research Ltd.

3 2

Can dynlist query from database hdb access entries in a database ldap on the same slapd?
by Judd Maltin 28 Mar '12

28 Mar '12

START slapd.conf: overlay dynlist dynlist-attrset myGroupOfURLs myMemberURL # happy.net: I can query through this proxy just fine. database ldap suffix "dc=happy,dc=net" uri "ldap://ldap1.lga6.us.happy.net" acl-bind bindmethod=simple binddn="cn=replicant,ou=Service Accounts,dc=happy,dc=net" credentials=my!!replicant # happy.com: the following database has dc=happy,dc=com data in it already. database hdb suffix "" rootdn "cn=Manager,dc=happy,dc=com" rootpw secret directory /var/lib/ldap index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # indexes for replication index entryCSN,entryUUID eq overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 200 END slapd.conf START good dynlist entry dn: cn=admin2,ou=Groups,dc=happy,dc=com objectClass: posixGroup objectClass: top objectClass: myGroupOfURLs cn: admin2 gidNumber: 20005 myMemberURL: ldap:///cn=sysadmins,ou=Groups,dc=happy,dc=com?memberUID?base?(objectClass=posixGroup) works great and populates my memberUID just great. END good dynlist entry START bad dynlist entry dn: cn=admin2,ou=Groups,dc=happy,dc=com objectClass: posixGroup objectClass: top objectClass: myGroupOfURLs cn: admin2 gidNumber: 20005 myMemberURL: ldap:///cn=sysadmins,ou=Groups,dc=happy,dc=net?memberUID?base?(objectClass=posixGroup) FAILS no entries in memeberUID - it a naming context mixup because "suffix ''" above? -- Judd Maltin T: 917-882-1270 F: 501-694-7809 A loving heart is never wrong.

3 3

Not deleted in Syncrepl
by s_hira＠nifty.com 27 Mar '12

27 Mar '12

Hi, All I confirmed the problem that was not deleted in syncrepl of V2.4.30. The provider operates it in "syncprov-sessionlog 100". After I delete 150 in a provider, and going syncrepl Only 100 cases are deleted in the consumer side. After examining it, the following parts seem to have a problem. servers/slapd/overlays/syncprov.c:2638 if ( sl->sl_num > 0 ) { int i; for ( i=0; i<sl->sl_numcsns; i++ ) { /* SID not present == new enough */ if ( minsid < sl->sl_sids[i] ) { do_play = 1; break; } /* SID present and new enough */ if ( minsid == sl->sl_sids[i] && ber_bvcmp( &mincsn, &sl->sl_mincsn[i] ) >= 0 ) { do_play = 1; break; } } /* SID not present == new enough */ if ( i == sl->sl_numcsns ) do_play = 1; } if ( do_play ) { do_present = 0; /* mutex is unlocked in playlog */ syncprov_playlog( op, rs, sl, srs, ctxcsn, numcsns, sids ); } else { ldap_pvt_thread_mutex_unlock( &sl->sl_mutex ); } Then, it corrected as follows. === - if ( minsid == sl->sl_sids[i] - && ber_bvcmp( &mincsn, &sl->sl_mincsn[i] ) >= 0 ) { + if ( minsid == sl->sl_sids[i] ) { + if ( ber_bvcmp( &mincsn, &sl->sl_mincsn[i] ) >= 0 ) { do_play = 1; + } break; } Is this correction wrong? HIRABAYASHI Satoshi s_hira(a)nifty.com

2 1

How to bind ldap2.4 with user certificate ?
by Olivier 27 Mar '12

27 Mar '12

Hello, is there any way to bind an ldap server using user certificates rather than user/password ? I have experimented that using "bindmethod=sasl" and "saslmech=external" "tls_cacert=CAFILE" and "tls_cert=PROXYUSERFILE" in olcSyncRepl section, but I would like to also be able to bind ldap with a personnal certificate rather than with a "user/passwd" when using ldapsearch for example. How should I configure my "ldap.conf" and call "ldapsearch" to bind as such ? Thanks --- Olivier

2 1

Cannot convert slapd.conf with blanks in pathes
by frank.offermanns＠caseris.de 27 Mar '12

27 Mar '12

slaptest has problems with blanks in pathes: slapd.conf extraction: logfile "C:/temp/Blank Dir/log/slapd.log" ... directory "C:/temp/Blank Dir/accessdata" slaptest -f "C:\temp\Blank Dir\slapd.conf" -F "C:\temp\Blank Dir\slapd.d" will succeed when a blank is in the path of "logfile" or "directory" but when I start slapd I get a "<olcLogFile> extra cruft after <file>". When I remove the quotation marks slaptest fails with the message "<logfile> extra cruft after <file>". I can only fix this by manually editing the config.ldif-files, which I know is forbidden. But due to the fact that I can't start slapd I can't use ldapmodify to modify it. So what to do? I tested with windows version of OpenLDAP. Regards, Frank

1 0

client ldap with 2 ldap.conf
by stefano 27 Mar '12

27 Mar '12

hi, a second question. i installed ldap-auth-config on a client. i've seen that i have /etc/ldap.conf and also /etc/ldap/ldap.conf which one is available? how could i understand which is in use?

2 1

clients: libnss-ldapd or libnss-ldap?
by stefano 27 Mar '12

27 Mar '12

hi, am installing ldap clients. the server is squeeze so i used libnss-ldapd. what about ubuntu 9.10-10-10 clients? libnss-ldap or libnss-ldapd?

2 2

Re: can't modify or add uidNumber attribute
by stefano 27 Mar '12

27 Mar '12

On 03/27/2012 09:34 AM, Hallvard B Furuseth wrote: > On Tue, 27 Mar 2012 09:10:17 +0200, stefano <stefano.malini(a)gmail.com> > wrote: >> On 03/27/2012 08:13 AM, Hallvard B Furuseth wrote: I wrote: >> Have you done something as root, so root owns some of the >> database files but you try to run slapd as another user (with -u)? >> If so, fix the file permsisions and then avoid working as root. >> >> Sorry, I mean file ownerships. Though it could be file or >> directory permissions too, come to think of it. >> >> thanks, but, which permissions of which file do i have to check? > > The directory and contentes named by the 'directory' > directive(s) in slapd.conf, aka olcDbDirectory in cn=config. > these are the permissions of 'directory' /var/lib/ldap/ drwxr-xr-x 2 openldap openldap 4096 Mar 27 07:58 ldap must be writable by users also? i mean rwxrwxr-x? and its contents is: root@amahoro:/var/lib/ldap# ls -l total 11448 -rw-r--r-- 1 openldap openldap 4096 Mar 27 07:58 alock -rw------- 1 root root 24576 Mar 26 16:08 __db.001 -rw------- 1 root root 352256 Mar 26 16:08 __db.002 -rw------- 1 root root 2629632 Mar 26 16:08 __db.003 -rw------- 1 root root 163840 Mar 26 16:07 __db.004 -rw------- 1 root root 876544 Mar 26 16:08 __db.005 -rw------- 1 root root 32768 Mar 26 16:08 __db.006 -rw-r--r-- 1 openldap openldap 96 Mar 23 08:24 DB_CONFIG -rw------- 1 openldap openldap 8192 Mar 26 16:07 dn2id.bdb -rw------- 1 openldap openldap 32768 Mar 26 15:14 id2entry.bdb -rw------- 1 openldap openldap 10485760 Mar 26 16:07 log.0000000001 -rw------- 1 root root 8192 Mar 26 16:07 objectClass.bdb

2 1

Re: can't modify or add uidNumber attribute
by stefano 26 Mar '12

26 Mar '12

The situationis worsethan expected the situation is worse. now, trying to run an ldapsearch i have the message "can't contact LDAP server". on syslog the last lines are: Mar 26 16:11:33 amahoro slapd[1603]: @(#) $OpenLDAP: slapd 2.4.23 (Jun 16 2011 02:53:39) $#012#011buildd@murphy:/build/buildd-openldap_2.4.23-7.2-i386-Y1mwvF/openldap-2.4.23/debian/build/servers/slapd Mar 26 16:11:33 amahoro slapd[1604]: hdb_db_open: database "dc=amahoro,dc=bi" cannot be opened, err 13. Restore from backup! Mar 26 16:11:33 amahoro slapd[1604]: bdb(dc=amahoro,dc=bi): txn_checkpoint interface requires an environment configured for the transaction subsystem Mar 26 16:11:33 amahoro slapd[1604]: bdb_db_close: database "dc=amahoro,dc=bi": txn_checkpoint failed: Invalid argument (22). Mar 26 16:11:33 amahoro slapd[1604]: backend_startup_one (type=hdb, suffix="dc=amahoro,dc=bi"): bi_db_open failed! (13) Mar 26 16:11:33 amahoro slapd[1604]: bdb_db_close: database "dc=amahoro,dc=bi": alock_close failed Mar 26 16:11:33 amahoro slapd[1604]: slapd stopped. what's happens? -------- Original Message -------- Subject: can't modify or add uidNumber attribute Date: Mon, 26 Mar 2012 16:21:17 +0200 From: stefano <stefano.malini(a)gmail.com> To: openldap-technical(a)openldap.org hi, i was modifying uidNumber attribute of a user but then has been standing for a few minutes and I stopped it: root@amahoro:~# ldapmodify -x -W -D 'cn=Manager,dc=amahoro,dc=bi' Enter LDAP Password: dn: uid=stefano,cn=Admins,dc=amahoro,dc=bi changetype: modify replace: uidNumber uidNumber: 1001 modifying entry "uid=stefano,cn=Admins,dc=amahoro,dc=bi" . . . ctrl+c then with an ldapsearch for this user there was not the uidNumber attribute: dn: uid=stefano,cn=Admins,dc=amahoro,dc=bi uid: stefano cn: Stefano Malini sn: Malini gidNumber: 1000 homeDirectory: /home/Admins/stefano mail: stefano.malini(a)gmail.com objectClass: inetOrgPerson objectClass: top objectClass: posixAccount objectClass: shadowAccount userPassword:: e1NTSEF9b2pNOG1UT3NrT2ZVaDVyd1pUWUpSeWg3YXNxc1lXSHo= uidNumber: 1001 trying to add it root@amahoro:~# ldapmodify -x -W -D 'cn=Manager,dc=amahoro,dc=bi' Enter LDAP Password: dn: uid=stefano,cn=Admins,dc=amahoro,dc=bi changetype: add add: uidNumber uidNumber: 1001 adding new entry "uid=stefano,cn=Admins,dc=amahoro,dc=bi" ldap_add: Undefined attribute type (17) additional info: add: attribute type undefined you can see the error message what is wrong?

2 2

idletimeout and writetimeout
by Tianyin Xu 26 Mar '12

26 Mar '12

Hi, Who can kindly tell me what are the two directives "idletimeout" and "writetimeout" used for? I do appreciate if someone can give me some sample examples. I set the values of the two configurations to be very small but no connections are terminated. :-( Thanks in advance! Tianyin -- Tianyin XU, http://cseweb.ucsd.edu/~tixu/

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical