openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Assertion failure -- using relay backend and translucent overlay
by Mattias Andersson 29 Jan '12

29 Jan '12

Hi, I have configured a proxy server with its own local database that is used both to override existing attributes of a remote database and to add its own entries to the directory. I have configured the local database as subordinate and I have configured a relay database that is also pointing to the local database, but it is using the translucent overlay to connect to the remote ldap directory. My slapd.conf configuration: backend hdb backend ldap database hdb directory /var/lib/ldap suffix "dc=foo,dc=example,dc=com" rootdn "cn=admin,dc=foo,dc=example,dc=com" rootpw secret index objectClass eq subordinate database relay suffix "dc=example,dc=com" overlay rwm rwm-suffixmassage "dc=foo,dc=example,dc=com" overlay translucent uri ldap://ldap.example.com translucent_bind_local This configuration actually does exactly what I have been trying to achieve. I can override user attributes and at the same time I can add additional group entries without having root access to the remote server. I have tested it with the ldap nss service in linux and it works without errors. The updated user accounts are correctly retrieved and the new groups are added transparently. If I use ldapsearch, it will search both the local and the remote server. The problem that I've experienced is that when I'm using a different ldap client, such as Softerra LDAP Administrator, then the daemon crashes when a search query is performed: slapd starting conn=1000 fd=11 ACCEPT from IP=X.X.X.X:61230 (IP=0.0.0.0:389) conn=1000 op=0 BIND dn="" method=128 conn=1000 op=0 RESULT tag=97 err=0 text= conn=1000 op=1 SRCH base="dc=example,dc=com" scope=0 deref=0 filter="(objectClass=*)" conn=1000 op=1 SRCH attr=1.1 conn=1000 op=1: back-relay for DN="dc=example,dc=com" would call self. slapd: /build/buildd/openldap-2.4.25/servers/slapd/attr.c:236: attr_dup2: Assertion `j < i' failed. Aborted The message that "back-relay would call itself" is also logged when using ldapsearch, but ldapsearch does not cause an assertion failure: slapd starting conn=1000 fd=11 ACCEPT from IP=127.0.0.1:36760 (IP=0.0.0.0:389) conn=1000 op=0 BIND dn="" method=128 conn=1000 op=0 RESULT tag=97 err=0 text= conn=1000 op=1 SRCH base="dc=example,dc=com" scope=2 deref=0 filter="(objectClass=*)" conn=1000 op=1: back-relay for DN="dc=example,dc=com" would call self. PROXIED attributeDescription "ORCLNETDESCSTRING" inserted. conn=1000 op=1 SEARCH RESULT tag=101 err=4 nentries=300 text= conn=1000 op=2 UNBIND conn=1000 fd=11 closed I'm happy with the proxy functionality that I've managed to configure (which is working), but it's definitely a security vulnerability when simply using a different LDAP client causes the server to crash. Is there any way I could avoid the assertion failure? Should I post a bug report? TIA, Mattias

2 2

syncrepl failing with ldap_start_tls failed (-11)
by Iain Georgeson 29 Jan '12

29 Jan '12

Hello, * Summary: I'm trying to set up syncrepl in my LDAP infrastructure. The logs on my consumer show that syncrepl is failing to negotiate TLS when connecting to the provider. Other LDAP commands such as ldapsearch and sssd show no problem connecting using the same TLS configuration. At this point, I don't have a good idea of how to continue debugging this problem. Are there any more configuration items affecting TLS I should be looking at? Or any way of getting more details on the TLS nagotiation? * The provider ("auth-00.[MYDOMAIN]"): slapd 2.4.23 from openldap-servers-2.4.23-15.el6.x86_64 on Scientific Linux 6. TLS is configured with [cn=config] olcTLSCACertificateFile: /etc/ssl/[MYCA].pem olcTLSCertificateFile: /etc/ssl/certs/auth-00.crt.pem # Has CN=auth-00.[MYDOMAIN] olcTLSCertificateKeyFile: /etc/ssl/private/auth-00.key.pem olcTLSVerifyClient: never If I try: $ ldapsearch -ZZ -x -H ldap://auth-00.[MYDOMAIN]/ uid=iain it connects and cheerfully returns objects * The provider ("auth-01.MYDOMAIN"): Same slapd version, same package, same OS. syncrepl configuration: olcSyncrepl: rid=001 provider=ldap://auth-00.[MYDOMAIN]:389 bindmethod=simple timeout=0 network-timeout=0 binddn="cn=syncrepl,dc=[MYDOMAIN]" credentials="[MYPASSWORD]" keepalive=0:0:0 filter="(objectClass=*)" searchbase="dc=[MYDOMAIN]" scope=sub schemachecking=off type=refreshAndPersist retry="10 3 120 5 600 +" starttls=critical tls_cacert=/etc/ssl/MYCA.pem * The error Consumer: Jan 28 11:53:12 auth-01 slapd[5595]: slapd starting Jan 28 11:53:12 auth-01 slapd[5595]: slap_client_connect: URI=ldap://auth-00.[MYDOMAIN]:389 Error, ldap_start_tls failed (-11) Jan 28 11:53:13 auth-01 slapd[5595]: do_syncrepl: rid=001 rc -11 retrying (2 retries left) Provider receiving syncrepl connection: Jan 28 11:53:23 auth-00 slapd[10701]: conn=7849 fd=32 ACCEPT from IP=[AUTH-01'S IP]:42669 (IP=0.0.0.0:389) Jan 28 11:53:23 auth-00 slapd[10701]: conn=7849 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 28 11:53:23 auth-00 slapd[10701]: conn=7849 op=0 STARTTLS Jan 28 11:53:23 auth-00 slapd[10701]: conn=7849 op=0 RESULT oid= err=0 text= Jan 28 11:53:23 auth-00 slapd[10701]: conn=7849 fd=32 closed (TLS negotiation failure) Provider receiving ldapsearch connection: Jan 28 13:55:59 auth-00 slapd[22621]: conn=1099 fd=103 ACCEPT from IP=[AUTH-01'S IP]:42765 (IP=0.0.0.0:389) Jan 28 13:55:59 auth-00 slapd[22621]: conn=1099 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 28 13:55:59 auth-00 slapd[22621]: conn=1099 op=0 STARTTLS Jan 28 13:55:59 auth-00 slapd[22621]: conn=1099 op=0 RESULT oid= err=0 text= Jan 28 13:55:59 auth-00 slapd[22621]: conn=1099 fd=103 TLS established tls_ssf=256 ssf=256 Jan 28 13:55:59 auth-00 slapd[22621]: conn=1099 op=1 BIND [...] Thanks, Iain. -- Systems Engineer KAUST Visualisation Laboratory

2 2

ldapsearch -y works great, -w barks
by Randy Schultz 28 Jan '12

28 Jan '12

Howdy, I'm confused as to why an operation with the -y filename works great, but the same operation with the -w pw dies with "ldap_bind: Invalid credentials (49)". The first file I've attached is with the -y, it works. The second is with the -w. I did notice the difference where the working one had a "." at the end of the pw, which was not present when using the -w option. To make sure I was not entering a typo on the commandline pw, I wrote a quick script, just a #!/bin/sh P=`cat p2` echo "|$P|" ldapsearch -v -d -1 -x -w "$P" -D cn=manager,dc=earlham,dc=edu -b ou=People,dc=earlham,dc=edu -h xaga This also died with invalid credentials after printing out the pw. Anybody have an idea what's going on? -- Randy (schulra(a)earlham.edu) 765.983.1283 <*> nosce te ipsum

4 4

Trying to get passthrough auth working with OpenLDAP and Kerberos
by Chastity Blackwell 27 Jan '12

27 Jan '12

For the last two weeks I have been on a sojourn through the wonderful world of LDAP, Kerberos, and SASL, which has had me banging my head against the desk more often than not. Today I'm finally crying uncle and asking for some help. We're running Centos 5.4, currently with OpenLDAP for user info and Kerberos for authentication, but we want to be able to use LDAP for authentication on a bunch of devices that can't use Kerberos natively. So I've been trying to get the passthrough auth working. So far, I think I've made a lot of progress, but I've run into a wall. Kerberos and LDAP are working in my testbed, and I can kinit and do an ldapwhoami no problem. testsaslauthd also gives me a success when I run it. However, when try to do a simple bind: [chas@ldapsandbox]$ ldapwhoami -x -D 'uid=chas,ou=People,dc=test,dc=domain' -W Enter LDAP Password: ldap_bind: Invalid credentials (49) [chas@ldapsandbox]$ syslog shows this: 2012-01-25T12:04:55-08:00 ldapsandbox slapd[14363]: conn=6 fd=15 ACCEPT from IP=10.17.136.50:55923 (IP=0.0.0.0:389) 2012-01-25T12:04:55-08:00 ldapsandbox slapd[14363]: conn=6 op=0 BIND dn="uid=chas,ou=People,dc=test,dc=domain" method=128 2012-01-25T12:04:55-08:00 ldapsandbox slapd[14363]: SASL [conn=6] Failure: cannot connect to saslauthd server: No such file or directory 2012-01-25T12:04:55-08:00 ldapsandbox slapd[14363]: conn=6 op=0 RESULT tag=97 err=49 text= 2012-01-25T12:04:55-08:00 ldapsandbox slapd[14363]: conn=6 fd=15 closed (connection lost) Meanwhile, the saslauthd I'm running with /usr/sbin/saslauthd -a kerberos5 -d doesn't even show a connection or anything to the console. Any idea why it can't connect to the saslauthd server? Here's my OpenLDAP slapd.conf: include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args TLSCACertificateFile /etc/openldap/cacert.crt TLSCertificateFile /etc/openldap/ldapsandbox.crt TLSCertificateKeyFile /etc/openldap/ldapsandbox.key authz-regexp uid=([^/]*),cn=gssapi,cn=auth uid= $1,ou=People,dc=test,dc=domain access to * by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by * read database bdb suffix "dc=test,dc=domain" directory /var/lib/ldap index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub And here's my /etc/sasl2/slapd.conf: pwcheck_method: saslauthd saslauthd_path: /var/run/sasl2/mux Any ideas?

4 18

How to enable monitoring in OpenLdap with cn=config Backend
by Axel Birndt 25 Jan '12

25 Jan '12

Hi @All, i would like to ask you how could i enable the monitoring backend in Openldap. I'am using the cn=config Backend. A little bit "googling" does not give me the needed information. I found something like this: http://dkluenter.gmxhome.de/ffg-tutorium.pdf , but with no information, how to enable the monitoring. At openldap.org, the section http://www.openldap.org/devel/admin/monitoringslapd.html#Monitor configuration via cn=config(5) the section "18.1. Monitor configuration via cn=config(5)" is empty. In the archive from this list i found the following thread http://www.openldap.org/lists/openldap-technical/201110/msg00122.html but this thread don't help me to got an idea what i should do, to configure the monitoring in openldap. Do you have a doc or howto with further information about this? I need the documentation for the cn=config backend. I don't have an slapd.conf! Thanks and regards, Axel -- Gruß Axel ------------------------------

6 24

Creating a special entry
by Frank Bonnet 25 Jan '12

25 Jan '12

Hello Due to the usage of a third party software I need to create a special account into our OpenLDAP directory that have the following privileges read, compare, browse Help greatly appreciated on guidance to create such entry. info links welcome thank you

2 1

slapadd not allowed on first database
by Kwasi Gyasi - Agyei 25 Jan '12

25 Jan '12

Hi, I'm trying to migrate data using openldap migrations tools, however I keep get error below which I don't understand. I don;t even know where ldap is getting the second database from cause I don;t have that defined anywhere slapd.conf has only one database. Error: ------------------ The first database does not allow slapadd; using the first available one (2) slapadd: line 1: database #2 (dc=my-domain,dc=com) not configured to hold "dc=4things,dc=co,dc=za"; no database configured for that naming context slapd.conf : ------------------ # ###### SAMPLE 1 - SIMPLE DIRECTORY ############ # # NOTES: inetorgperson picks up attributes and objectclasses # from all three schemas # # NB: RH Linux schemas in /etc/openldap # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema # NO SECURITY - no access clause # defaults to anonymous access for read # only rootdn can write # NO REFERRALS # DON'T bother with ARGS file unless you feel strongly # slapd scripts stop scripts need this to work pidfile /var/run/slapd.pid # enable a lot of logging - we might need it # but generates huge logs loglevel -1 # MODULELOAD definitions # not required (comment out) before version 2.3 moduleload back_bdb.la # NO TLS-enabled connections # backend definition not required ####################################################################### # bdb database definitions # # replace example and com below with a suitable domain # # If you don't have a domain you can leave it since example.com # is reserved for experimentation or change them to my and inc # ####################################################################### database bdb suffix "dc=4things, dc=co, dc=za" # root or superuser rootdn "cn=system-admin, dc=4things, dc=co, dc=za" rootpw {SSHA}password # The database directory MUST exist prior to running slapd AND # change path as necessary directory /var/lib/ldap/4things.co.za # Indices to maintain for this directory # unique id so equality match only index uid eq # allows general searching on commonname, givenname and email index cn,gn,mail eq,sub # allows multiple variants on surname searching index sn eq,sub # sub above includes subintial,subany,subfinal # optimise department searches index ou eq # if searches will include objectClass uncomment following # index objectClass eq # shows use of default index parameter index default eq,sub # indices missing - uses default eq,sub index telephonenumber # other database parameters # read more in slapd.conf reference section cachesize 10000 checkpoint 128 15 Any ideas? I have Googled for almost a week now and I come across nothing... -- Multimedia and Communication | Property | Entertainment Kwasi Owusu Gyasi - Agyei *cell* (+27) (0) 76 466 4488 *website *www.4things.co.za *email *kwasi.gyasiagyei(a)4things.co.za *skype *kwasi.gyasiagyei *role* Developer.Designer.Software Architect

3 2

slapcat and slapadd
by Andreas Laesser 24 Jan '12

24 Jan '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi @all, I've a problem doing a slapcat and adding the dump again to another (empty) ldap server... doing a slapcat on my "master" gives me a file with: <snip> root@foobar /etc/ldap # head -100 ldapFullCat.ldif dn: objectClass: top objectClass: dcObject objectClass: organization o: spsc.tugraz.at dc: spsc structuralObjectClass: organization entryUUID: 292ab862-cb04-1030-9e71-dd10406d8585 creatorsName: cn=admin,dc=spsc,dc=tugraz,dc=at createTimestamp: 20120104094228Z entryCSN: 20120104094228.808452Z#000000#000#000000 modifiersName: cn=admin,dc=spsc,dc=tugraz,dc=at modifyTimestamp: 20120104094228Z dn: objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: e1NTSEF9WlQ5UmdyUFpJVDVuM3ByS0ErM3M5TFplU0RHcnFMN3g= structuralObjectClass: organizationalRole entryUUID: 292b04fc-cb04-1030-9e72-dd10406d8585 creatorsName: cn=admin,dc=spsc,dc=tugraz,dc=at createTimestamp: 20120104094228Z entryCSN: 20120104094228.810430Z#000000#000#000000 modifiersName: cn=admin,dc=spsc,dc=tugraz,dc=at modifyTimestamp: 20120104094228Z dn: dc=SPSC,dc=TUGRAZ,dc=AT dc: SPSC objectClass: dcObject objectClass: organizationalUnit ou: SPSC structuralObjectClass: organizationalUnit entryUUID: ffae9024-9a0c-1028-8a8f-881a13d527c4 creatorsName: cn=admin,dc=SPSC,dc=TUGRAZ,dc=AT createTimestamp: 20040913201236Z entryCSN: 20040913201236.000000Z#000001#000#000000 modifiersName: cn=admin,dc=SPSC,dc=TUGRAZ,dc=AT modifyTimestamp: 20040913201236Z contextCSN: 20120119135137.038345Z#000000#000#000000 contextCSN: 20120120100955.690312Z#000000#001#000000 dn: ou=people,dc=SPSC,dc=TUGRAZ,dc=AT ou: people objectClass: organizationalUnit structuralObjectClass: organizationalUnit entryUUID: ffc2d0b6-9a0c-1028-8a90-881a13d527c4 creatorsName: cn=admin,dc=SPSC,dc=TUGRAZ,dc=AT createTimestamp: 20040913201236Z entryCSN: 20040913201236.000000Z#000002#000#000000 modifiersName: cn=admin,dc=SPSC,dc=TUGRAZ,dc=AT modifyTimestamp: 20040913201236Z .... </snip> But if I want to add this file at my other server, it gives me: root@barfoo /etc/ldap # slapadd -l ldapFullCat.ldif -f ./slapd.conf slapadd: line 1: cannot add entry with empty dn="" _ 0.02% eta elapsed none spd 3.0 M/s Closing DB... Any Ideas? Of course, if I delete the first two entries it works, but then the ldap didn't work correctly. thanks and regards Andreas - -- ========================================================================= _____________ / ___________/ Andreas Laesser / //_// /____/ Signal Proc.& Speech Communication Lab. __/ /___/ / __ Graz University of Technology /___//____//___/ Inffeldgasse 16c/EG | A-8010 Graz | Austria http://www.spsc.tugraz.at Tel: +43 (0)316 873 -4443 Fax: DW 104439 ========================================================================= -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAk8ZQBUACgkQ1nmbrmNF2lObwQCeKnF+elTztwQCu9DhjbN4eKhB 8nQAn2CuBh2WNyjlTfWZhbzMeh6IFXbg =xheX -----END PGP SIGNATURE-----

3 4

Need help to change ldap password from client side
by sivakumar R 24 Jan '12

24 Jan '12

*Dear All, I've recently configured a LDAP Server, I am facing a small problem when i'm trying to change my password from client side by giving the command "passwd". It is giving the following error in terminal Changing password for user ****. Enter login(LDAP) password: New password: Retype new password: LDAP password information update failed: Insufficient access passwd: Authentication token manipulation error Also in /var/log/messages it is showing the following error message Jan 24 15:43:57 mail passwd: pam_ldap: ldap_modify_s Insufficient access Jan 24 15:43:57 mail gnome-keyring-daemon[6329]: gck_module_new: assertion `funcs' failed Jan 24 15:43:57 mail gnome-keyring-daemon[6329]: module_instances: assertion `module' failed Jan 24 15:43:57 mail gnome-keyring-daemon[6329]: egg_error_message: assertion `error' failed Jan 24 15:43:57 mail gnome-keyring-daemon[6329]: couldn't find secret store module: (unknown) Jan 24 15:43:57 mail gnome-keyring-daemon[6329]: lookup_login_keyring: assertion `GCK_IS_SESSION (session)' failed Jan 24 15:43:57 mail gnome-keyring-daemon[6329]: create_credential: assertion `GCK_IS_SESSION (session)' failed Jan 24 15:43:57 mail gnome-keyring-daemon[6329]: egg_error_message: assertion `error' failed Jan 24 15:43:57 mail gnome-keyring-daemon[6329]: couldn't create new login credential: (unknown) Also this is my ACL configuration details of /etc/openldap/slapd.conf access to attr=userPassword by anonymous auth by self write by * none access to * by * read Please help to resolve this Cordially Shiv *

3 2

How to configure Openldap with the new LDIF configuration
by André Ribas 20 Jan '12

20 Jan '12

Hi there, I am trying to setup a Samba + OpenLDAP server here but it has been a while since the last time that I did it. Last time that I did it, the slapd was configured by the file slapd.conf but now I realized that it has a new configuration method based on LDIF files. I'm a little confused with this new method and every tutorial that I find on the Internet says that I should write a slapd.conf and use the migration tool. But doing that I'll not be using the best feature of the new method (on-line updates) so I want to learn the new way. Sorry for this newbie question but I am not understanding how to use it to add a schema file or even change some configuration. Do anyone have some tips or even a good tutorial (maybe even a samba related one) that teaches how to do it in the "right" way? Thanks and sorry for any English mistakes (this is one of my very first mail to an English listing) André Ribas

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical