openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Password Policy
by Selcuk Yazar 17 Dec '11

17 Dec '11

Hi, we are using openldap on redhat EL6 with postfix and JAMM schema. I wantto activate password policy for ldap but i cannot add default password schema , i try to apply step that tells on http://www.zytrax.com/books/ldap/ch6/ppolicy.html but i cannot add dn: cn=default,ou=policies,dc=myhosting,dc=example class, it gives ldap_bind: Invalid DN syntax (34) additional info: invalid DN error. what is the problem ? thanks in advance [image: image.png] -- Selçuk YAZAR http://www.selcukyazar.blogspot.com

2 2

Adding an object class with required attributes to an existing entry
by Nick Milas 16 Dec '11

16 Dec '11

Hi, I want to add a new objectclass using an ldif; this objectclass requires some attributes (according to schema). I can't make it work. For posixAccount class, required attributes are: cn gidNumber homeDirectory uid uidNumber I already have cn and uid. I am trying: dn: uid=userx,ou=people,dc=example,dc=com changetype: modify add: ObjectClass objectClass: posixAccount uidNumber: 1700 homeDirectory: /var/members/userx gidNumber: 48 loginShell: /bin/false and it fails. I've tried other ways too, like including existing objectclasses in the LDIF (I've read about that in a blog), using a separate add statement for optional attribute loginShell, etc. but nothing worked. If the ObjectClass to add does not specify REQUIRED attributes in the schema, there is no problem in adding it. How should I formulate the LDIF? Please advise. Thanks, Nick

3 6

Mozilla NSS / OpenLdap 2.4.23 cert not readable?
by Aaron Bennett 16 Dec '11

16 Dec '11

Hello, I'm trying to grok Mozilla NSS prior to deploying Openldap 2.4.23 on RHEL 6.2. I've been working through creating a self-signed cert and I think I have one that works. At least, if I do: [root@animal ~]# certutil -d /etc/pki/nssdb/ -L Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI its Cu,Cu,Cu animal.clarku.edu p,p,p the its cert is the one I used to sign. If I do: [root@animal ~]# certutil -d /etc/pki/nssdb/ -L -n animal.clarku.edu Then I see a normal looking cert: Certificate: Data: Version: 3 (0x2) Serial Number: 00:96:7c:e7:ea Signature Algorithm: PKCS #1 SHA-1 With RSA Encryption Issuer: "CN=ITS Self Signed" Validity: Not Before: Mon Dec 12 16:01:27 2011 Not After : Mon Mar 12 16:01:27 2012 Subject: "CN=animal.clarku.edu,O=Clark University ITS,L=Worcester,ST= Massachusetts,C=US" Here's what I've got in cn=config: olcTLSCACertificatePath: /etc/pki/nssdb/ olcTLSCertificateFile: animal.clarku.edu If do those commands as the ldap user with sudo -u ldap, I get the same output. I can even run "certutil -V -n animal.clarku.edu -u SR -d /etc/pki/nssdb/" and I get "certificate is valid". However when I start slapd, I get: [root@animal slapd.d]# service slapd start animal.clarku.edu is not readable by "ldap" [WARNING] Starting slapd: [ OK ] What am I missing? Thanks, Aaron --- Aaron Bennett Manager of Systems Administration Clark University ITS

4 8

Ldap+Nfsv4+kerberos *nix / *bsd puzzle.
by Harry Coin 16 Dec '11

16 Dec '11

Hello group! Looking for guidance on an ldap+NFS4+Kerberos puzzle in a mixed OS local environment. Simple demo case, four computers on a little net. box 1: Running openlap server, kerberos KDC, kadmin, lets say it's running freebsd, doesn't matter. nfs server & client. box 2: Linux box. nfs server & client. box 3: *bsd/Solaris box. nfs server & client. box 4: misc user box, could be *bsd or *nix. Networking: Nfs4 secured with kerberos. That means No uid/gid numbers on the wire, only user@box. NSS is active on all boxes, reaching out to the ldap server on box 1 for info for what is not in the local passwd file searched first. Popular package X gets installed on box 2 and box 3. Package X is a drop-root privilege package, has its own uid/gid!=0. It is active on the net, might write log files or get data files via nfs on either of the other two computers in the setup. The maintainers for package X in the *bsd world have chosen a different number for the uid / gid for the package X daemon than the maintainers for package X have chosen in the *nix world. Those get written in the local passwd file on each system at package X install / download time. Note: Package X does _not_ get installed on the ldap server box #1, or box #4. There is no entry in the #1 or #4 system's passwd file for nss to find for the daemon associated with package X. nfsuserd via nss must find the package X user in ldap or the files will be unreadable or seem 'owned' by nobody:nogroup on 1 or 4 if say config or log files edited/accessed from there. Puzzle: What should the posixAccount uidNumber and gidNumber value be in ldap for uid=packageXdaemon? Alternatives: 1: Choose no entry, leave it out of the ldap db: PackageXDaemon's files will be owned by nobody:nogroup on box 1. Security Fail. 2: Choose *nix for the uid/gid in the ldap database on box 1. Fail: The files will be stored with a uid/gid that might collide with another account in the passwd database on the *bsd server. 3: Choose *bsd for the uid/gid in the ldap database on box 1: Fail: The *nix user on box 4's nfsuserid will get the bsd uid/gid from ldap which could create files not actually owned by something colliding in the *nix passwd database on box 4. 4: Instead storing all the users once under an ou=Account... create ou=AccountBSD and ou=AccountNix, duplicate the whole account tree but vary the apropos uid/gid pair under each tree with all the other remaining equal, manage collisions when amending the database. Not so pretty. 5: Edit the schema to replace uidNumber and gidNumber with uidNixNumber / uidBsdNumber & etc. for gid. Breaks code expecting standard uidNumber gidNumber in the default ldap schemas. There are so many packages that could be X, you can imagine not wanting to have to qualify and patch all of them to use a common uid/gid number. (And it gets even worse in a mixed nfs3 / nfs4 environment where uid/gid numbers actually go over the wire in some cases, and user@box in others, let's leave that to the side for now). I'm leaning toward #5 to avoid storing all the other account information under two different trees. But I'd prefer a scheme were there is a not-edited standard schema tree stored once under 'ou=Account' but with a different overlay for the uid/gid elements if looked up as AccountNix or AccountBsd. I'm sure someone has done battle with this already, what's the right answer? Thanks Harry Coin

3 3

slapdindex
by Allan E. Johannesen 16 Dec '11

16 Dec '11

First, I'm running 2.4.27 A year and a half ago, running 2.4.something-less-than-27, we installed a device which queried LDAP and was causing a load on the ldap servers. I found it was looking for an attribute we didn't have. I indexed the attribute and I believed that the load was reduced. I did not add the objectclass which offered the attribute to our objectclasses. Was I imagining things? Recently, we have another black box that queries ldap. I can't control the attributes which it requests. I added the attributes to the index and ran the slapindex and no new .bdb files were generated, even using the -q -t flags, which claims to truncate a database before scanning for the attribute. That sounded like a way to maybe trick it into making an empty database, but no dice. As an experiment, I ran slapadd to create a new database, with those attributes in the index list. It didn't add any of them, nor did it create that single attribute which I believed I had "fixed" last year. I'm reasonably sure that prior openldap versions of both slapindex and slapadd would create the index for an attribute listed as indexed without it appearing in the data. I'm curious to know if I was wrong that indexing an attribute would speed the search even if the attribute did not appear in the schemas used. Also, does this mean that I have to add whatever schema that new ldap-client black-box wants to search in order to make the index in order to reduce that client's ldap server load? Thanks for any insights.

1 0

Fresh install on debian with cn=config and slapd.conf conversion
by reyman 16 Dec '11

16 Dec '11

On Thu, Dec 15, 2011 at 10:24 AM, Raffael Sahli <public(a)raffaelsahli.com>wrote: > On 12/15/2011 09:46 AM, rey sebastien wrote: > >> Le jeu. 15 déc. 2011 08:51:29 CET, Raffael Sahli a écrit : >> >>> >>> >>>> OK, it's work, i have a fonctionnal slapd.d/cn=config folder, but i >>>> don't understand why i can't access to openldap with >>>> cn=admin,dc=parisgeo,dc=cnrs,**dc=fr and good password generated by >>>> >>>> >>>> My slapd.conf before conversion contain the SSHA password generated by >>>> slappasswd for rootDn : >>>> ----- >>>> >>>> database bdb >>>> suffix "dc=parisgeo,dc=cnrs,dc=fr" >>>> rootdn "cn=admin,dc=parisgeo,dc=cnrs,**dc=fr" >>>> rootpw {SSHA}xxxxxxxxxxxxxxxxxxxxx >>>> >>>> ---- >>>> I try this : root@xxxxx:/usr/local/etc/**openldap/slapd.d# ldapsearch >>>> -D cn=admin,dc=parisgeo,dc=cnrs,**dc=fr -W -x 'userName=*' >>>> Enter LDAP Password: ldap_bind: Invalid credentials (49) >>>> >>>> Bizarre ... >>>> Perhaps i can try to redefine the rootdn, because it disapear with >>>> conversion ? >>>> Do you have an idea about this ? >>>> >>>> Thanks, >>>> SR. >>>> >>>> >Use slapadd. Again, RTFM. Everything you've asked in the past week or >>> so has been documented in the manpages and the Admin Guide. Read and learn. >>> >>> Yes right, @rey rtfm, and ask your question again, if you're sure your >>> point is not in the OpenLDAP manual. >>> But i'm sure you will find your answer there. >>> >>> >>> >>> >Please trim irrelevant text from your emails. Please update your >>> Subject line to something relevant to the actual discussion topic. >>> @Howard, please say that to the guy who ask questions, and not me^^ >>> >>> >>> Raffael Sahli wrote: >>> >>>> On 14.12.2011 16:54, rey sebastien wrote: >>>> >>>>> Le 13/12/2011 16:48, Raffael Sahli a écrit : >>>>> >>>> >>> Hi! >>>>> It's not easy to start with zero configuration with cn=config new >>>>> openldap administration .. >>>>> I create my bd.ldif based on the slapd.ldif example in the >>>>> /usr/local/etc/openldap directory. >>>>> But how can i insert this ldif with >>>>> >>>>> ldapadd -Y EXTERNAL -H ldapi:/// -f myldiffile.ldif >>>>> >>>>> if i cannot run slapd without configuration ? >>>>> How do you start a fresh install of openldap in this case? there is an >>>>> option to run slapd without zero configuration? >>>>> Thanks a lot, >>>>> >>>> >>> Use slapadd. Again, RTFM. Everything you've asked in the past week or so >>> has been documented in the manpages and the Admin Guide. Read and learn. >>> >>> >>> >> Everything ? really ... Install from sources with specific init script >> installation on debian ? Also, i find nothing about a fresh install >> directly with cn=config (without conversion of slapd.conf) into the admin >> guide ... >> >> I'm not a junior system administrator, i make a phd in geography / >> geomatics, and i have only one week before christmas to create and populate >> a new ldap in my laboratory. I try to learn the maximum with google/debian >> tutorial and a lot of false tutorial, but actually, and i'm sorry about >> that, i have no time to read all the man page, and all the admin guide ... >> >> Thanks you again for the time you take to answer to my question Raffael, >> and others. >> > > First, change the subject, your problem has nothing to do with SSL. > > And to your root password problem, if you just convert your offline config > to online config, you root password will be the same as before. > Did it worked with the offline configuration? > Or change the olcRootPW manually in the config ldif of your database. > > Hum i check into my config ldif and olcRootPW doesn't appear. # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 7bbc1dd2 dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: slapd.conf.seb olcConfigDir: /usr/local/etc/openldap/slapd.d/ olcArgsFile: /usr/local/var/run/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcLocalSSF: 71 olcLogLevel: Stats olcPidFile: /usr/local/var/run/slapd.pid olcReadOnly: FALSE olcReverseLookup: FALSE olcSaslHost: claroline.parisgeo.cnrs.fr olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCRLCheck: none olcTLSVerifyClient: never olcToolThreads: 1 olcWriteTimeout: 0 structuralObjectClass: olcGlobal entryUUID: 065b0668-632b-4573-a915-bbe2caf96586 creatorsName: cn=config createTimestamp: 20111214212046Z entryCSN: 20111214212046.446261Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20111214212046Z I try to re-add the pasword with slapmodify : dn:cn=config changetype: modify add: olcRootDN olcRootDN: cn=admin,dc=parisgeo,dc=cnrs,dc=fr dn: cn=config changetype: modify add: olcRootPW olcRootPW: {SSHA}1dWxkkRtyUJt5fDga0Pn4EAyKQ5RPI4+ root@xxxxx:/usr/local/etc/openldap# ldapadd -Y EXTERNAL -H ldapi:/// -f initSlapd.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "cn=config" ldap_modify: Insufficient access (50) Hum, i don't really understand why i have not access, i change only password, rootsuffix, and rootdn into the slapd.conf before conversion .. I try to add manually the attribute olcRootPw, olcSuffix,olcRootDN olcSuffix: dc=parisgeo,dc=cnrs,dc=fr olcRootDN: cn=admin,dc=parisgeo,dc=cnrs,dc=fr olcRootPW: {SSHA}1dWxkkRtyUJt5fDga0Pn4EAyKQ5RPI4+ I have this error at restart : Dec 15 10:52:04 claroline slapd[11462]: olcSuffix: value #0: suffix <DC=parisgeo,DC=cnrs,DC=fr> not allowed in frontend database. Hum i think it's a good idea to remove all config/data file, restart with a fresh slapd.conf and retry the conversion .. > > -- > Raffael Sahli > public(a)raffaelsahli.com > Switzerland > > -- <http://stackoverflow.com/users/385881/reyman64>

3 4

ACL question - minimum rights for Apache HTTP Server Bind User
by Axel Birndt 15 Dec '11

15 Dec '11

Hi @All, currently i'am using a special user "cn=bind,ou=technical,ou=user,dc=2axels-company,dc=de" as bind user in my apache.conf file. ----apache.conf------- ..... AuthType basic AuthBasicProvider ldap AuthName "LDAP-geschuetztes Verzeichnis" AuthLDAPUrl "ldap://localhost:389/ou=user,dc=2axels-company,dc=de?cn?sub" AuthLDAPBindDN "cn=bind,ou=technical,ou=user,dc=2axels-company,dc=de" # it doesn't work, if the bind password is encrypted... isn't it ?? #AuthLDAPBindPassword {SHA}pfiSFDDFSAAE$$%j8BTtCUqs9IZWsQ= # Because this, the password is currently used as an unencrypted one: AuthLDAPBindPassword xxxxxxxxxxx Require ldap-group cn=awstats,ou=groups,dc=2axels-company,dc=de .... ---------------------------------- Now my question: which minimum acl rights are needed for the Bind User: "cn=bind,ou=technical,ou=user,dc=2axels-company,dc=de" to connect to the ldap server and check the group from the user who try to login. I hope my description is understandable... Thanks and regards Axel -- Gruß Axel ------------------------------

4 4

Account question
by NetNinja 15 Dec '11

15 Dec '11

Hello, I have a two different user accounts and one works the other not so much. The account user03 works on both Solaris 10 and RHEL clients. While test01 can do everything but login to the Solaris 10 client, I can use this account to login to the RHEL client though. Can someone look at my accounts below and tell me why user03 works and test01 doesn't? # user03, People, test.net dn: uid=user03,ou=People,dc=test,dc=net uid: user03 cn: user03 objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 603 gidNumber: 500 homeDirectory: /home/user03 gecos: user03 # test01, People, test.net dn: uid:test01,ou=People,dc=test,dc=net uid: test01 cn: test01 objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowMax: 0 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 701 gidNumber: 500 homeDirectory: /home/test01 # ldapclient list NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_BINDDN= uid=proxyagent,ou=People,dc=test,dc=net NS_LDAP_BINDPASSWD= password NS_LDAP_SERVERS= X.X.X.X:389 NS_LDAP_SEARCH_BASEDN= dc=test,dc=net NS_LDAP_SERVER_PREF= X.X.X.X NS_LDAP_CACHETTL= 0 NS_LDAP_CREDENTIAL_LEVEL= proxy NS_LDAP_SERVICE_SEARCH_DESC= passwd:ou=People,dc=test,dc=net NS_LDAP_SERVICE_SEARCH_DESC= group:ou=People,dc=test,dc=net NS_LDAP_SERVICE_SEARCH_DESC= shadow:ou=People,dc=test,dc=net NS_LDAP_SERVICE_AUTH_METHOD= pam_ldap:simple I'm still testing so I ran ldapclient manual. When I feel that I have the the right setting, I will load the profile into LDAP. Any suggestions will be great.

3 4

Re: N-Way Multimaster. No base DN returned from server.
by Arturo Borrero Gonzalez 15 Dec '11

15 Dec '11

2011/12/15 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Thursday, December 15, 2011 12:59 AM +0100 Arturo Borrero Gonzalez > <cer.inet(a)linuxmail.org> wrote: > >> Hi there. >> >> I followed the documentation in openldap website for setting up a >> N-Way multimaster LDAP cluster. I have two nodes, but I will be >> expanding to 3 or 4 in a near future. >> When doing an ldapsearch, I get all the server data, but when accesing >> with ApacheDirectoryStudio (with same credentials) I get nothing. >> Nothing is wrong in logfiles. I guess a problem in ACLs, but it >> doesn't work even when binding as RootDN (and as seen in oficial >> documentation, rootdn is over the scope of any ACL) > > > If it works with ldapsearch, and it doesn't work with Apache Directory > Studio, then it sounds to me like there is a bug with Apache Directory > Studio. I would advise you take the issue up with that project. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration I've installed phpLDAPadmin and it's tells me: dc=example,dc=es -- The object doesn't exist. Create it now? And this seem to be the same problem I have with Apache Directory Studio. Doing slapcat i get the database, and doing ldapsearch I get the database only if I set the base dn with -b "dc=example,dc=es". But something is misconfigured in my server ¿Any idea? -- /* Arturo Borrero Gonzalez || cer.inet(a)linuxmail.org */ /* Use debian gnu/linux! Best OS ever! */

1 1

SSL/TLS testing
by Jayavant Patil 15 Dec '11

15 Dec '11

Hi, I am using openldap-2.4.19-4.x86_64 on fedora 12 machine. I have enabled openldap SSL/TLS. How do I know (test) that I am using SSL/TLS connections instead of normal ldap:///? -- Thanks & Regards, Jayavant Ningoji Patil Engineer: System Software Computational Research Laboratories Ltd. Pune-411 004. Maharashtra, India. +91 9923536030.

8 26

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical