openldap-technical

openldap-technical@openldap.org

7 participants
9901 discussions

role manage can bypass pwdCheckQuality with MOD but not with ADD op
by tempo＠net-c.com 28 Jun '22

28 Jun '22

Hi, I'm doing some testing on userPassword management actually with openldap 2.5.9 I noticed that I could MOD a userPassword without checking quality if my admin role was "manage" However, if I try to ADD a user with its attribute userPassword set, then quality is checked although the role "manage" ppolicy in both cases are the default one (policy subentry not set) Is it normal behavior ? Regards,

3 5

setting slapd logging to STDOUT only
by Alceu Rodrigues de Freitas Junior 26 Jun '22

26 Jun '22

Greetings, My name is Alceu and I'm new to this list. I'm experimenting with OpenLDAP at a Google Cloud, running it as a Pod inside a GKE cluster. I've being struggling to setup slapd to send it's logs to STDOUT only, but it seems in most cases the logs are sent to STDERR. The problem is, for GCP Log Explorer, everything that is sent to STDERR is considered an error, even when it's not. :-) Here is a reference: https://stackoverflow.com/questions/71158475/gcp-log-explorer-shows-wrong-s…. I'm using this open source project <https://github.com/osixia/docker-openldap> to deploy OpenLDAP as a Docker container, but there is no configuration option for that. I would like to make it clear that this project is not using the latest OpenLDAP stable version. AFAIK, slapd will use syslog facility for logging and will write to the terminal if the "-d" option is in use, which in fact it is: $ docker exec -ti openldap /bin/bash root@56529dea5931:/# ps aux USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.7 0.2 76528 47232 ? Ss 20:54 0:00 /usr/bin/python -u /container/tool/run --loglevel debug openldap 21 0.1 0.0 294932 14844 ? Sl 20:54 0:00 /usr/sbin/slapd -h ldap://56529dea5931 ldaps://56529dea5931 ldapi:/// -u openldap -g openldap -d 256 root 25 1.0 0.0 19868 3600 pts/0 Ss 20:54 0:00 /bin/bash root 32 0.0 0.0 38312 3364 pts/0 R+ 20:54 0:00 ps aux Is there any way to configure slapd to use STDOUT for everything, besides using shell redirection (2>&1)? Thanks in advance, Alceu

1 0

Setting to suppress "connection_read(XXX): no connection!"
by Uwe Sauter 24 Jun '22

24 Jun '22

Dear list, is there a way to configure slapd to not emit messages regarding "connection_read(XXX): no connection!"? Currently the configuration contails "loglevel none" but these messages are sent to syslog local4.debug regardless. In case the version is relevant, this is 2.4.59 on RHEL 8.4. slapd is started with URL list "ldap:/// ldaps:/// ldapi:///" Thanks, Uwe

1 0

rwm bindDN context and ppolicy issues
by Kartik Subbarao 23 Jun '22

23 Jun '22

I'm able to specify rwm bindDN rules without password-policy enabled just fine, like this one: rwm-rewriteContext bindDN rwm-rewriteRule "^([^=]+)=([^@]+)@olddomain.com(.+),dc=olddomain,dc=com$" "$1=$2(a)newdomain.com$3,dc=newdomain,dc=com" ":@" However, when I enable password policy (which also works fine on its own), slapd segfaults. From doing a backtrace and stepping through the code, it looks like the crux of the issue is that the mdb_info struct ends up with garbage data: struct mdb_info *mdb = (struct mdb_info *) op->o_bd->be_private; mi_dbenv_home and mi_monitor have random stuff in them. I'm mulling over how much additional time to spend on this. rwm is a very elegant solution to a current issue that could save me a bunch of time to set up additional LDAP servers with the renamed data. If this is an isolated bug for which a quick fix might be possible, I might investigate further. But if it's a thorny issue or just the tip of the iceberg of things where rwm might break unexpectedly, then it may be better for me to consider other options. OpenLDAP developers, what do your instincts say on this? Regards, -Kartik

2 3

Re: LDAP over TLS not doing hostname verification in version 2.4.59
by radiatejava 23 Jun '22

23 Jun '22

Anyone of these issues could be responsible? Just checking OpenLDAP 2.4.46 Release (2018/03/22) Fixed libldap connection delete callbacks when TLS fails to start (ITS#8717) Fixed libldap to not reuse tls_session if TLS hostname check fails (ITS#7373) Thanks On Wed, Jun 22, 2022 at 7:51 AM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > --On Tuesday, June 21, 2022 11:29 PM -0700 radiatejava > <radiatejava(a)gmail.com> wrote: > > > I raised the issue https://bugs.openldap.org/show_bug.cgi?id=9869 but > > it has been set to verified/invalid state now. However, I do not know > > which version addresses the issue. Can anyone tell me which version > > would still verify the hostname when doing LDAP over TLS. > > The OpenLDAP 2.4 series is historic, no bug reports for it will be > considered. > > No changes have been made to OpenLDAP 2.4 series to disable hostname > verification by the OpenLDAP project. If you are using libraries provided > by downstream distributions, they may have made unauthorized changes to how > libldap functions in regards to TLS. Additionally, if you were using an > OpenSSL linked libldap and are now using a GnuTLS linked libldap, then some > behaviors are different as documented in the man pages. > > Generally I'd advise starting with a supported version of OpenLDAP. > > Regards, > Quanah > > > >

2 1

LDAP over TLS not doing hostname verification in version 2.4.59
by radiatejava 22 Jun '22

22 Jun '22

My software was using openldap client 2.4.44 to talk to the LDAP server. We have shifted to 2.4.59 now to address some issues. Ever since we shifted, the new version is allowing LDAP over TLS without hostname verification. In the older ver 2.4.44, I always got this error if hostname did not match the CN value: return code -1 - Can't contact LDAP server) diagnostic message TLS: hostname does not match CN in peer certificate But after the lib update, no such error even if I am using LDAP server IP to do LDAP bind while LDAP server certificate has CN set as some FQDN (say test.ldap.com). Our client side code has not changed while we updated the ldap lib. For our client, we are only doing these settings: ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTDIR, lCertsDir) ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE, lCert) Has there been any change in this regard? How do I enforce hostname verification now? I raised the issue https://bugs.openldap.org/show_bug.cgi?id=9869 but it has been set to verified/invalid state now. However, I do not know which version addresses the issue. Can anyone tell me which version would still verify the hostname when doing LDAP over TLS. Thanks.

2 1

OpenLDAP in Ubuntu Jammy (LTS)
by Sergio Durigan Junior 22 Jun '22

22 Jun '22

Hi there, I would like to inform the OpenLDAP community that, after a few months sorting out the details, the OpenLDAP package of the Ubuntu Jammy (LTS) release will now receive updates every time there's a new patch version released for the 2.5.x upstream series. In fact, if you are using Ubuntu Jammy you can start benefiting from this new policy right away: OpenLDAP 2.5.12 has just been accepted into the jammy-updates repository and should be available soon. I'd like to thank the community for changing your release process recently and electing 2.5.x as your LTS release; this really helped me making the case to obtain a Micro Release Exception from the Ubuntu SRU team :-). If I may, I would also like to make a small request here. It would be very helpful if the OpenLDAP website could also offer the "Release Documents" section (from https://openldap.org/software/) for OpenLDAP 2.5.x as well. Actually, it would also be great if the "Announcement" page could stay available "forever", and be made per-release (instead of having just one "announce.html" page that gets overwritten every time there's a new release). I don't know much about web stuff in general, but I can help with this if needed. Thank you very much, and I hope this email brings news to the Ubuntu OpenLDAP users out there. Cheers, -- Sergio GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

2 2

Upgrade config from 2.4.49 to 2.5.11 is failing.
by farooq.fortinet＠gmail.com 21 Jun '22

21 Jun '22

Current Openldap 2.4.49 is working fine with syncprov configuration. Planing to upgrade to recent versions. Took backup of system using slapcat. Upgraded the dev server to 2.5.11. Now when trying to import config using slapadd. It is failing with following error. overlay_config(): overlay "syncprov" already in list slapadd: could not add entry dn="olcOverlay={1}syncprov,olcDatabase={0}config,cn=config" (line=1900): slapadd shutdown: initiated slapadd destroy: freeing system resources. syncinfo_free: rid=100 Any help or tip? Thanks Farooq

2 1

LMDB: Estimate number of elements between two keys
by Ken Wenzel 17 Jun '22

17 Jun '22

Dear OpenLDAP-Community, is it possible to compute a rough estimate of the number of elements between two given keys for an LMDB database? Currently, I scan the first 1000 keys and extrapolate the count based on the average distance of the keys. Maybe it is also possible to use some information about the common b-tree pages that are shared by both keys? We need this functionality for query optimization within RDF4J. Thank you for your support and best regards, Ken Wenzel

2 2

need help to make OpenLDAP work as "this other directory, plus"
by jarett＠bioteam.net 17 Jun '22

17 Jun '22

Hi all. So, I'm trying to basically put a band-aid over an intentionally broken LDAP implementation. We use Okta as our single source of truth for directory services, and its implementation of LDAP intentionally leaves out uidNumber and gidNumber (and you can't change this) in order to force you to use their insanely expensive "Advanced Server Access" product. This $9500/yr expense for a minimum of 50 machines is a non-starter for the lab project we are trying to get working with LDAP. We're only talking about ~10 machines here and we very much want them to be ultimately authenticating against Okta for their passwords -- because this automatically MFAs them by default, and prevents credential proliferation for the services we run in the lab. So basically what I want to do is set up an LDAP server which passes just about everything through to Okta, but keeps consistent uidNumber and gidNumber values for each user in Okta who logs in. I think this is possible either with the "meta" backend or the "ldap" backend or both, but I'm not clear on how to configure these. I've followed this guide to get OpenLDAP working on a Rocky 8 server: https://kifarunix.com/install-and-setup-openldap-on-rocky-linux-8/ But that guide does not contain instructions for something like this, and even the OpenLDAP documentation is scarce when it comes to configuring backends. e.g.: https://www.openldap.org/doc/admin26/backends.html#LDAP even just for LDAP there is no indication of how I would introduce the bind DN for the backend LDAP or how it would know what to add, and the "meta" backend has no implementation details at all: https://www.openldap.org/doc/admin26/backends.html#Metadirectory Help? Thanks!

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical