openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

ppolicy overlay doesn't apply
by Cosmin Ciuraru 12 Apr '12

12 Apr '12

Hello, I am trying to use the ppolicy overlay with openldap, version 2.4.20, installed on a SLES 11 SP1 x64, as a package. I have made the following settings in the openldap.conf: - included the ppolicy.schema - overlay ppolicy - ppolicy_default "cn=pwd,ou=Policies,o=...." I saw that a"'moduleload ppolicy.la" is also required, but I cannot find the library in /usr/lib/openldap/modules (which is empty). I have compiled the source with --enable-ppolicy=mod/yes with --enable-modules=yes, to see if it would generate the library ppolicy.la, but just generated the slapd binary, so, as it gives no error for the config file, I suppose that the ppolicy part is embedded in the slapd. The problem: When I try to change the password for a user in LDAP, the policy doesn't apply. The clients run on the same OS, but different machines, with pam_ldap-184 and nss-ldap-262. If I open the yast2-ldap-client, I can see that it finds the password policy, but it doesn't get applied. If I follow the requests to the LDAP server, I can see that the client issues a request with the filter objectClass=passwordPolicy, which comes from the pam_ldap, which is written to use the Netscape password policy schema. But in my LDAP I use the pwdPolicy schema, which is a more recent one. I know that the password doesn't get applied because I set the checkQuality attribute to 0 and I expect to let me use whatever password I like. The client has the pam_lookup_policy set to yes. Can you please point out what I am missing? Thank you!

3 2

CentOS 6.2 ldap client -> CentOS 5.8 server = all fields *but* password (kinda)?
by Phillippe Welsh 12 Apr '12

12 Apr '12

I know C6 client -> C5 ldap server works. I have a couple of systems that do it. I have one crazy system that just went into production that does not properly authenticate. Here is the scenario: 1. "getent passwd" will show *all* users *and* passwords. 2. "getent passwd USERNAME" will show all user info and *NOT* the password(the field is a "*"). Has anyone come across this behavior? There must be some option I messed up and did not realize it. I have checked for differences from a working system in nsswitch.conf, authconfig, sssd.conf, pam_ldap.conf, nslcd.conf and ldap.conf with no luck. I have looked at "rpm -V openldap" and "rpm -V openldap-clients" with no luck. This is making me crazy! It has to be something simple. Additionally, I have "nscd -i passwd" and tried to stop/start both the nslcd and nscd daemons. Google has not been of very much help with the pattern of search I've tried so far, either... Thanks for any help pj

1 0

Re: slow or inconsistent syncrepl
by Amol Kulkarni 12 Apr '12

12 Apr '12

As per the recommendations, we have done following : 1. Installed openldap 2.4.30 on master & all replicas. 2. We have cascaded the replication by adding another replica in lan which acts as provider for the consumers on wan. There are definite improvements but still we are observing following problem : 1. Bulk changes (1000 records changed) in LDAP on the provider, do not replicate to replicas with busy ldap unless a) the records are updated in smaller batches on provider b) the replication database on the consumer is reset - i.e ldap restarted with -c rid=001 Is there a buffer/queue at the consumer side which overflows? Can it be tuned? Does a busy server drop replication requests? Thanks, Amol. ----- Original Message ----- From: Quanah Gibson-Mount Sent: 03/12/12 03:36 AM To: Amol Kulkarni Subject: Re: slow or inconsistent syncrepl --On Sunday, March 11, 2012 8:51 AM +0100 Amol Kulkarni <amolkulkarni(a)gmx.com> wrote: > > I see that I'm outdated in my tuning as per > http://wiki.zimbra.com/wiki/OpenLDAP_Performance_Tuning. > I'll do these changes and observe the servers. > > In the mean time a new observation regarding syncrepl is that if I do > ldapmodify for 5 - 10 entries in one go the changes get replicated but if > I change about 300 entries in one go, then some entries do not get > replicated on some servers. These changes dont get replicated until I > change those entries again. > > Does this indicate provider resource problem or consumer resource problem > ( or normal behaviour ) ? Changes failing to replicate is not a desired behavior. It is expected to occur in older known buggy releases. If all of your masters & replicas are on 2.4.30, hopefully you won't see that issue any more. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

home directory of added user with him profile environment
by stefano malini 11 Apr '12

11 Apr '12

Hi, i installed an ldap server on debian squeeze. i've to add every user but i don't how to set him home directory with him profile environment. The home directory can be created using mkdir? how to keep the profile environment from /etc/skel? thanks

1 0

RE24 testing call #1 (2.4.31)
by Quanah Gibson-Mount 10 Apr '12

10 Apr '12

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.31 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

6 5

Referral Problem with SQL Backend
by Robert Eikermann 10 Apr '12

10 Apr '12

Hi, I have a problem with my Openldap Server 2.4.23 with SQL Backend. I have configured a referral to another Openldap server, but the referral dn is always the same as the bind dn from my ldapsearch command. So the referral dn is overwritten with the bind dn. The server localhost:389 has rootdn="dc=sselab,dc=de" And localhost:390 has rootdn="dc=tim,dc=sselab,dc=de" Following are the configuration and the Log files of the LDAP Server with SQL Backend at Loglevel -1. In the Logfile you can see the starting of the server + the search "ldapsearch -xLLL -h localhost:389 -b dc=sselab,dc=de". I think at line 4114 one can see how the referral is used. Slapd.conf : <http://pastebin.com/tvtdNaZ6> http://pastebin.com/tvtdNaZ6 sql attribute mappings: <http://image-upload.de/image/WcDeaB/fd191aa422.png> http://image-upload.de/image/WcDeaB/fd191aa422.png sql entries: <http://image-upload.de/image/qGiBOY/51496a9462.png> http://image-upload.de/image/qGiBOY/51496a9462.png sql object classes: <http://image-upload.de/image/Rei0X3/4f6b2b43f5.png> http://image-upload.de/image/Rei0X3/4f6b2b43f5.png sql oc mapping: <http://image-upload.de/image/TRscIQ/7141e04af6.png> http://image-upload.de/image/TRscIQ/7141e04af6.png sql referral: <http://image-upload.de/image/LGxZKQ/28773fadf7.png> http://image-upload.de/image/LGxZKQ/28773fadf7.png ldap Log: <http://pastebin.com/N8NCyLzt> http://pastebin.com/N8NCyLzt To demonstrate the behavior: Search for the referral Object: user@user-desktop:~$ ldapsearch -M -xLLL -h localhost:389 "(objectClass=referral)" '*' ref dn: dc=tim,dc=sselab,dc=de objectClass: referral objectClass: extensibleObject dc: tim ref: ldap://localhost:390/dc=tim,dc=sselab,dc=de# which is exactly what I want! But searching all objects: user@user-desktop:~$ ldapsearch -xLLL -h localhost:389 -b dc=sselab,dc=de dn: dc=sselab,dc=de objectClass: dcObject dc: sselab . # refldap://localhost:390/dc=sselab,dc=de??sub Results with the wrong dn in refldap! Search with the dc=tim DN : user@user-desktop:~$ ldapsearch -xLLL -h localhost:389 -b dc=tim,dc=sselab,dc=de Referral (10) Referral: ldap://localhost:390/dc=tim,dc=sselab,dc=de??sub If you need more Information please let me know. Best regards Robert Eikermann

2 1

Minimum length for uid attribute
by Priscilla V 10 Apr '12

10 Apr '12

Hi all, I am trying to use openldap users for authentication with postfix. For users with uid length 2 it says user unknown in local recipient table. But ldapsearch returns the result if queried. Is there any configuration for minimum length or what could be the issue? Kindly help. Regards Priscilla

3 3

Translucent overlay and local entities
by Eugene Vilensky 09 Apr '12

09 Apr '12

Greetings, Pardon if this is an RTFM, but is it possible to store entities locally using the translucent overlay? The overlay works for what we are trying to do when it comes to search and modifying attributes on an entry, but I would like to create a local groupofnames, consisting of remote UIDs. For example, this LDIF imports OK: #!RESULT OK #!CONNECTION ldap://xxxxx #!DATE 2012-04-09T16:01:33.961 dn: cn=instructors,ou=Groups,dc=xxxx,dc=zzz changetype: add objectClass: groupofnames member: uid=nate member: uid=penelope member: uid=rhonda cn: instructors But searching for it does not bring back a result. However, it must have gone somewhere since if I try to import the same LDIF again: #!RESULT ERROR #!CONNECTION ldap://xxxxx #!DATE 2012-04-09T16:21:28.221 #!ERROR [LDAP: error code 68 - Entry Already Exists] Kind regards, Eugene

1 0

Re: Hashing the userPassword
by Michael Ströder 09 Apr '12

09 Apr '12

Please post your follow-ups on the mailing list so others can respond and learn as well. Suneet Shah wrote: > So if create a user and then set the password on an existing user then, the > password-hash attribute will work? And I can send the password to OpenLDAP in > clear text? Yes. Also note the other poster's hint about using slapo-ppolicy and ppolicy_hash_cleartext if you're allowed to configure the server. > I am curious - if the client hashes the password, in my case it would be my > java program, how will openldap use that hashed password during authentication? > > Wouldnt both (openldap and my java program) need to have the salt used for > hashing? And in this case, only my java program would have that salt. The salt is part of the userPassword value. See more information in OpenLDAP's FAQ-O-MATIC: http://www.openldap.org/faq/data/cache/419.html Ciao, Michael.

2 3

ldapadd: invalid format (line 5) entry for LDAP replication
by Brajabasi Padhy 09 Apr '12

09 Apr '12

Hello Sir, I'm trying to set up a LDAP provider server, but facing problime with folowing command sudo ldapadd -Y EXTERNAL -H ldapi:/// -f provider_sync.ldif I followed all steps provided in th following link, but still failing. https://help.ubuntu.com/10.04/serverguide/C/openldap-server.html I'm getting this error ldapadd: invalid format (line 5) entry: "olcDatabase={1}hdb,cn=config" Please help me if possible. The provider_sync.ldif file copied from the above link. Thnaks for your support. Brajabasi

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical