openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

request for brief documentation
by tirumala chenchala 22 Feb '12

22 Feb '12

Dear team, This is tirumala rao, working as a system administrator in infronics systems ltd, and i want to configure the open ldap server in my office and i have choose open ldap version-2.4.29 in the centos-6 and my problem is that i refered open ldap documentation but i didn't under stand "how to configure slapd" and i didn't find slapd.conf file in my centos-6.2 Actually i installed the open ldap in centos by using the command yum install openldap* and the out put as i have enclosed in to attachment 1, please find the attachment and guide me how to configure slapd after install in centos-6.2 And in /etc/openldap folder i found the files as in attachment 2 Thanks for advance and Please help me how to done the issue.

4 3

Re: daemon: bind(6) failed errno=98 (Address,already in use)
by stefano 22 Feb '12

22 Feb '12

thank you! there was a process: openldap 1797 0.0 0.3 23752 4004 ? Ssl 11:48 0:00 /usr/sbin/slapd -h ldap:/// ldapi:/// -g openldap -u openldap -f /etc/ldap/slapd.conf after kill it i restarted without problems. i increased the loglevel to "4" and tried another time to test the server: ldapsearch -x -W -D 'cn=Administrator,dc=amahoro,dc=bi' -b "" -s base with the next answer: ldap_bind: Invalid credentials (49) and then restarting server is failed. checking on syslog: Feb 22 12:06:40 debservbis slapd[1890]: connection_get(13) Feb 22 12:06:40 debservbis slapd[1890]: ==> hdb_bind: dn: cn=Administrator,dc=amahoro,dc=bi Feb 22 12:06:40 debservbis slapd[1890]: send_ldap_result: err=49 matched="" text="" Feb 22 12:06:40 debservbis slapd[1890]: connection_get(13) killed another time the openldap process. restarting is ok. trying to change the password with ldappasswd the answer is ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database on syslog: Feb 22 12:12:42 debservbis slapd[1958]: @(#) $OpenLDAP: slapd 2.4.23 (Jun 16 2011 02:53:39) $#012#011buildd@murphy:/build/buildd-openldap_2.4.23-7.2-i386-Y1mwvF/openldap-2.4.23/debian/build/servers/slapd Feb 22 12:12:42 debservbis slapd[1958]: daemon: bind(8) failed errno=98 (Address already in use) Feb 22 12:12:42 debservbis slapd[1958]: daemon: bind(8) failed errno=98 (Address already in use) Feb 22 12:12:42 debservbis slapd[1958]: slapd stopped. Feb 22 12:12:42 debservbis slapd[1958]: connections_destroy: nothing to destroy. and restarting failed. mmmmmmmmmmmm!

1 1

TIME_WAIT
by arun.sasi1＠wipro.com 22 Feb '12

22 Feb '12

Hello Team, I have a problem with my LDAP server. There are many TIME_WAIT connections (more than 5000). MinimumConnectionsInPool=1 MaximumConnectionsInpool=20 Thanks & Regards, Arun Sasi V ------------------------------------------------------------------------ ------------------------------------------------------------- Sr. Engineer - Server Management (UNIX), Wipro Infotech (GSMC) |Direct +918213029356 Mob: +919731031500 | E: arun.sasi1(a)wipro.com <mailto:koresh.dash@wipro.com> Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

Re: Howto implement RBAC with OU's and posixGroups
by Fred van Zwieten 22 Feb '12

22 Feb '12

*Hi Milan, I know RedHat's IPA server can do this, but that based on 389 Directory Server. Also, have a look here: http://www.mail-archive.com/sssd-devel@lists.fedorahosted.org/msg06902.html This guy succeeded, but with a combi of posixGroup and groupOfMembers. I'll try to see if I get you suggestion working, although I don't like to change the default schema too much. Ideally nss_ldap should give us more options in this regard. *Greetz, Fred <http://epsilon.eridani.nl> 2012/2/22 Ponjevic, Milan <Milan.Ponjevic(a)travelocity.com> > Hi Fred,**** > > ** ** > > Have you tried ‘hacking’ your schema, and change for example ‘STRUCTURAL’ > to ‘AUXILIARY’. In that case you would be able to specify both posixGroup > and groupOfMembers, or even use groupOfNames.**** > > ** ** > > Have a lok at this**** > > > http://serverfault.com/questions/224750/dn-based-linux-groups-from-ldap/226… > **** > > ** ** > > I am also struggling to understand what is the best way to implement this, > and I would really appreciate if somebody already done it, and can share > the idea.**** > > ** ** > > Regards**** > > ** ** > > ** ** > > ** ** > > *From:* openldap-technical-bounces(a)OpenLDAP.org [mailto: > openldap-technical-bounces(a)OpenLDAP.org] *On Behalf Of *Fred van Zwieten > *Sent:* 22 February 2012 11:00 > *To:* openldap-technical(a)openldap.org > *Subject:* Re: Howto implement RBAC with OU's and posixGroups**** > > ** ** > > Howard, > > So, what is the right way? Could you give me an example how to set this up > or give me a reference to a good source on this? > > Thank you! > > Greetz,**** > > ** ** > > Fred <http://epsilon.eridani.nl>**** > > > > **** > > 2012/2/22 Howard Chu <hyc(a)symas.com>**** > > Fred van Zwieten wrote:**** > > Hi llg, > > I fail to see how this solves my RBAC need. > > Let me give an example: > > Say, personA is in ou DeptA. Then, ideally personA would based on being in > this ou, become member of group webserver > > No, when I move personA to ou DeptB, this would mean that, on the next > login, > it looses it's membership to group Webserver, but now becomes member of ie > group mailservers > > This way, you implement security policies based on the role of a person.** > ** > > ** ** > > This is not the right way to implement roles. Generally DNs are intended > to be constant (though obviously they are allowed to change, changes should > be infrequent).**** > > > How could this ideally be done with OpenLDAP? > > Greetz,**** > > Fred <http://epsilon.eridani.nl> > > > > 2012/2/22 llg <llg(a)portaildulibre.fr <mailto:llg@portaildulibre.fr>>**** > > > > Hi, > persons should use inetOrgPerson and PosixAccount schemas : > gidNumber > gives primary group. > > Then define specific branch ou=posix based on PosixGroup schema and add > the uid of the person in memberUid multiple values attribute to specify > secondary gid. > > Regards > Llg > > Le 22/02/2012 10:22, Fred van Zwieten a écrit :**** > > Hi all, > > warning: openldap newbie.. > > is it possible to have a person put into an OU and, because of this, > will become member of some group in such a way that this group shows up > in linux using "id". This to implement some form of RBAC. I found > GroupofMembers, but that has nothing to do with OU's. Also, it seems > posixGroup and groupOfMembers objecttypes are no longer allowed together > because the are both STRUCTURAL. > > In AD this is possible. > > Greetz,**** > > Fred <http://epsilon.eridani.nl>**** > > ** ** > > > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/**** > > ** ** >

1 0

Howto implement RBAC with OU's and posixGroups
by Fred van Zwieten 22 Feb '12

22 Feb '12

Hi all, warning: openldap newbie.. is it possible to have a person put into an OU and, because of this, will become member of some group in such a way that this group shows up in linux using "id". This to implement some form of RBAC. I found GroupofMembers, but that has nothing to do with OU's. Also, it seems posixGroup and groupOfMembers objecttypes are no longer allowed together because the are both STRUCTURAL. In AD this is possible. Greetz, Fred <http://epsilon.eridani.nl>

4 5

adding new databases and olc*dbconfig must attributes
by ben thielsen 21 Feb '12

21 Feb '12

i was experimenting a bit with adding new databases to the config, and found that if the olcsuffix attribute was not provided, it would fail: >cat db.ldif dn: olcDatabase=hdb,cn=config changetype: add objectClass: olcHdbConfig olcDatabase: hdb olcDbDirectory: /var/lib/ldap/example.org >ldapadd -xWZZH 'ldap://dsa.example.com/' -D 'uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=com' -f db.ldif Enter LDAP Password: adding new entry "olcDatabase=hdb,cn=config" ldap_add: Other (e.g., implementation specific) error (80) additional info: <olcDbDirectory> failed startup >tail -F slapd.log Feb 21 19:39:41 flip slapd[19134]: conn=1535 fd=64 ACCEPT from IP=192.168.1.1:36891 (IP=0.0.0.0:389) Feb 21 19:39:41 flip slapd[19134]: conn=1535 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Feb 21 19:39:41 flip slapd[19134]: conn=1535 op=0 STARTTLS Feb 21 19:39:41 flip slapd[19134]: conn=1535 op=0 RESULT oid= err=0 text= Feb 21 19:39:41 flip slapd[19134]: conn=1535 fd=64 TLS established tls_ssf=128 ssf=128 Feb 21 19:39:43 flip slapd[19134]: conn=1535 op=1 BIND dn="uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=com" method=128 Feb 21 19:39:43 flip slapd[19134]: conn=1535 op=1 BIND dn="uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=com" mech=SIMPLE ssf=0 Feb 21 19:39:43 flip slapd[19134]: conn=1535 op=1 RESULT tag=97 err=0 text= Feb 21 19:39:43 flip slapd[19134]: conn=1535 op=2 ADD dn="olcDatabase=hdb,cn=config" Feb 21 19:39:43 flip slapd[19134]: hdb_db_open: need suffix. Feb 21 19:39:43 flip slapd[19134]: backend_startup_one (type=hdb, suffix="(null)"): bi_db_open failed! (-1) Feb 21 19:39:43 flip slapd[19134]: olcDbDirectory: value #0: <olcDbDirectory> failed startup (0?:?X#024c?/ldap/example.org)! Feb 21 19:39:43 flip slapd[19134]: conn=1535 op=2 RESULT tag=105 err=80 text=<olcDbDirectory> failed startup Feb 21 19:39:43 flip slapd[19134]: conn=1535 op=3 UNBIND Feb 21 19:39:43 flip slapd[19134]: conn=1535 fd=64 closed providing an olcSuffix attribute in the ldif allowed the new database to be added without error: >ldapadd -xWZZH 'ldap://dsa.example.com/' -D 'uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=com' -f db.ldif Enter LDAP Password: adding new entry "olcDatabase=hdb,cn=config" >tail -F slapd.log Feb 21 19:43:21 flip slapd[19134]: conn=1537 fd=44 ACCEPT from IP=192.168.1.1:36900 (IP=0.0.0.0:389) Feb 21 19:43:21 flip slapd[19134]: conn=1537 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Feb 21 19:43:21 flip slapd[19134]: conn=1537 op=0 STARTTLS Feb 21 19:43:21 flip slapd[19134]: conn=1537 op=0 RESULT oid= err=0 text= Feb 21 19:43:21 flip slapd[19134]: conn=1537 fd=44 TLS established tls_ssf=128 ssf=128 Feb 21 19:43:23 flip slapd[19134]: conn=1537 op=1 BIND dn="uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=com" method=128 Feb 21 19:43:23 flip slapd[19134]: conn=1537 op=1 BIND dn="uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=com" mech=SIMPLE ssf=0 Feb 21 19:43:23 flip slapd[19134]: conn=1537 op=1 RESULT tag=97 err=0 text= Feb 21 19:43:23 flip slapd[19134]: conn=1537 op=2 ADD dn="olcDatabase=hdb,cn=config" Feb 21 19:43:24 flip slapd[19134]: conn=1537 op=2 RESULT tag=105 err=0 text= Feb 21 19:43:24 flip slapd[19134]: conn=1537 op=3 UNBIND this behavior wasn't really all that surprising to me, as i don't really know in what capacity there might be a database without a suffix defined, even if it were just "", but what i am curious about is the schema definition for the olcHdbConfig object class. the best i can tell, only olcDatabase and olcDbDirectory are MUST attributes, while olcSuffix is not: >ldapsearch -xH 'ldap://dsa.example.com/' -s base -b 'cn=subschema' '*' '+' | grep -iFA 5 "NAME 'olcHdbConfig'" objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.2.1.2 NAME 'olcHdbConfig' DESC 'HDB backend configuration' SUP olcDatabaseConfig STRUCTURAL MUST olcDbDirectory MAY ( olcDbCacheSize $ olcDbCheckpoint $ olcDbConfig $ olcDbCryptFile $ olcDb CryptKey $ olcDbNoSync $ olcDbDirtyRead $ olcDbIDLcacheSize $ olcDbIndex $ ol cDbLinearIndex $ olcDbLockDetect $ olcDbMode $ olcDbSearchStack $ olcDbShmKey $ olcDbCacheFree $ olcDbDNcacheSize $ olcDbPageSize ) ) >ldapsearch -xH 'ldap://dsa.example.com/' -s base -b 'cn=subschema' '*' '+' | grep -iFA 7 "NAME 'olcDatabaseConfig'" objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.0.4 NAME 'olcDatabaseConfig' DESC ' OpenLDAP Database-specific options' SUP olcConfig STRUCTURAL MUST olcDatabase MAY ( olcHidden $ olcSuffix $ olcSubordinate $ olcAccess $ olcAddContentAcl $ olcLastMod $ olcLimits $ olcMaxDerefDepth $ olcPlugin $ olcReadOnly $ olcRe plica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplicationInterval $ olc ReplogFile $ olcRequires $ olcRestrict $ olcRootDN $ olcRootPW $ olcSchemaDN $ olcSecurity $ olcSizeLimit $ olcSyncUseSubentry $ olcSyncrepl $ olcTimeLimi t $ olcUpdateDN $ olcUpdateRef $ olcMirrorMode $ olcMonitoring ) ) why is olcSuffix not a MUST attribute if the database can't be added without it? are there cases different than my exercise where a database might be added without the need for a suffix? it's not anything that's causing an insurmountable hurdle, just mostly curious if this was intended. -ben

2 1

Re: slapd.conf & ldap.conf - Re: LDAP guide, manuals
by stefano 21 Feb '12

21 Feb '12

thanks! i downloaded Mastering OpenLDAP. i will follow it hope to improve competence thanks

1 0

Issue with using ldap replace with memberof−dangling set as error.
by Vikram 20 Feb '12

20 Feb '12

Hi, I'm working on writing an custom authorization app on top of openldap. I am currently using openldap version 2.4.26, and using the c api to interact with it. I am trying to use the memberof overlay with memberof−dangling set to error and memberof−refint set to true. I noticed a weird issue which happens here. Steps: 1. I add a group with one/zero members who is present in the system. 2. I update the group with one or more non existent users using ldap_modify_ext with mod_op as LDAP_MOD_REPLACE. In this case, ldap throws up the error 'send_ldap_result: err=19 matched="" text="adding non-existing object as group member" ' , but still goes ahead and adds the non existing member to the group even though the operation should fail. Note that in the "memberof−dangling drop" case the non existent users are not added, though no error is thrown. This seems to be working as expected. Also doing ldap_modify_ext with LDAP_MOD_ADD works as expected too, where the same error this thrown but users are not added. Am I missing something? My slapd.conf has the following relevant configurations: overlay memberof memberof-group-oc customGroup memberof-dangling error memberof-refint true Thanks, Vikram [Reposting as I do not see my first attempt in the archives]

1 0

slapd.conf & ldap.conf
by stefano 20 Feb '12

20 Feb '12

hi, i need help about ldap configuration, please. i configured slapd.conf like this: /include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd.args loglevel none modulepath /usr/lib/ldap moduleload back_hdb sizelimit 500 backend hdb database hdb suffix "dc=amahoro,dc=bi" directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_lockers 1500 index objectClass eq lastmod on checkpoint 512 30 / andldap.conf like this: /# # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. BASE dc=amahoro,dc=bi URI ldap://192.168.5.4 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never/ but running ldapsearch the answer is /ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)/ what is wrong? thanks

2 3

Ldap users "not seen" by application
by teoman.onay＠degroof.be 20 Feb '12

20 Feb '12

Hi, I hope i'm in the right place to ask my question... I use openldap for user authentication on linux servers. Everything seems ok except for scheduled jobs. We use a software to launch processes based on event or schedule. An agent is installed on every servers. Unfortunately it doesn't "see" the users from the ldap. When it tries to launch the process it fails with an error like the user doesn't exists. The workaround is to create a local user but i'd prefer to use an ldap one. Do you know how i could solve that ? Tkx Teo P before printing this email, think about the environment. ******************************************************************************* This e-mail is intended only for the person or entity to which it is addressed. It may contain confidential and/or privileged information. Any copying, disclosure, distribution or other use of the content of this e-mail by persons or entities other than the intended recipient is prohibited. Please contact immediately the sender if you have received this e-mail in error and delete it from all locations of your computer. The company on behalf of which the present e-mail is sent is validly committed only if the rules on the delegation of powers, as set out in the appropriate documents, have been complied with. Furthermore, due to the risks inherent to the use of the Internet, the company is not liable for the content of this e-mail if altered, changed or falsified. *******************************************************************************

2 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical