openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

W.: Newbie: can't connect and enable logging
by cfisi＠arcor.de 22 Nov '11

22 Nov '11

Hi list, I installed OpenLdap on Debian Squeeze. When trying to connect to Openldap jxplorer just says: "Opening connection to ldap://192.168.1.102:389". Nothing more happens. How can I enable logging (in Openldap or jxplorer) and above all how can I connect? Thank you in advance. - Chris

2 2

Using a bitwise filter
by W.Siebert＠t-systems.com 22 Nov '11

22 Nov '11

Hello, I'v implemented a OpenLDAP Metadirectory that proxying 2 Microsft AD targets. Some attributes on Active Directory objects are composed of bitwise flags. Using a bitwise operator is necessary to return only objects that match a particular bit being set. To query Active Directory for user class objects that are disabled: (UserAccountControl:1.2.840.113556.1.4.803:=2) I'm trying to create a filter that selects entries for which the object class is a user but not a computer, and for which the account is not flagged as disabled: (&(objectclass=user)(!(objectclass=Computer))(!(UserAccountControl:1.2.840.113556.1.4.803:=2))) If I connect AD server directly, all is OK, I get a search result. But sending this search to Meta, does not work. Log: slapd[22461]: conn=1004 op=3 SRCH base="dc=meta,dc=pov" scope=2 deref=2 filter="(&(?objectClass=user)(!(?objectClass=Computer))(?=error))" slapd[22461]: conn=1004 op=3 meta_back_search: base="dc=meta,dc=pov" scope=2: no candidate could be selected slapd[22461]: conn=1004 op=3 SEARCH RESULT tag=101 err=32 nentries=0 text= slapd[22461]: conn=1004 op=4 UNBIND My OpenLDAP version: 2.4.26 my config: database meta lastmod off suffix "dc=meta,dc=pov" rootdn "cn=metaguru,dc=meta,dc=pov" rootpw xxxxxxxx uri "ldap://w3kvm.adwal.corporate.net:389/dc=meta,dc=pov" suffixmassage "dc=meta,dc=pov" "dc=adwal,dc=corporate,dc=net" idassert-authzFrom "dn:*" idassert-bind bindmethod=simple binddn="cn=radiator,cn=Users,dc=adwal,dc=corporate,dc=net" credentials="xxxxx" mode=none uri "ldap://w3kvm02.adwal.corporate.net:389/dc=meta,dc=pov" suffixmassage "dc=meta,dc=pov" "dc=second,dc=crocus,dc=com" idassert-authzFrom "dn:*" idassert-bind bindmethod=simple binddn="cn=predator,cn=Users,dc=second,dc=crocus,dc=com" credentials="xxxxxxxx" mode=none Where is my mistake ? Can you help me please Kind regards Waldemar

3 2

Rewrite inside a database backend ?
by Mathieu MILLET 22 Nov '11

22 Nov '11

Hello, I was trying to enable rewrite of partial DN inside a database backend context, but I would like to not add a specific context for this rewrite. Slapo-rwm's man says that this overlay is intended for back-ldap and back-meta, but doesn't say it is restricted to these backends. Is this possible ? Let me explain and give some more details of what I would like to do : My context is : "dc=example,dc=local", which is stored inside a back-bdb (or back-hdb). User Objects would be added by client such as : uid=AA0000000,ou=users,dc=example,dc=local But, I would like to store these objects as : uid=AA0000000,ou=AA,ou=users,dc=example,dc=local So my rewriting configuration lines would be like : rwm-rewriteContext addDN rwm-rewriteRule "^uid=(..)([^,]+),ou=users,dc=example,dc=local$" "^uid=$1$2,ou=$1,ou=users,dc=example,dc=local$" ":" I know that the main purpose of adding one level of OU may not be very elegant, but it could be useful in the future for being able to partition the directory. Sincerely yours, Mathieu. -- Mathieu MILLET mailto:ldap@htam.net

1 0

proxy authentication
by LALOT Dominique 22 Nov '11

22 Nov '11

I am coming back on a thread as there was no answer master or replica (managed by a central team) /\ | (proxied bind) partial replica (no userpassword) (managed by another team) /\ | simple bind Is there a simple way to do that (no kerberos/sasl)? The bind on the partial replica is proxied to another server. Thanks Dom -- Dominique LALOT Ingénieur Systèmes et Réseaux http://annuaire.univmed.fr/showuser.php?uid=lalot

2 1

Limiting host access
by Juergen.Sprenger＠swisscom.com 22 Nov '11

22 Nov '11

Hi, You might want to check out nisNetgroup functionality. 1. add rfc2307bis to Your nis.schema: #attributetype ( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple' # DESC 'Netgroup triple' # SYNTAX 1.3.6.1.1.1.0.0 ) # rfc2307bis attributetype ( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple' DESC 'Netgroup triple' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) 2. add nis-netgroups to Your directory: dn: cn=myhostname,ou=Netgroup,dc=example,dc=com objectClass: top objectClass: nisNetgroup description: users allowed to log in to myhostname cn: myhostname nisNetgroupTriple: (,user1,) nisNetgroupTriple: (,user2,) ... 3. add compat-mode to nsswitch.conf: passwd: compat passwd_compat: ldap group: compat group_compat: ldap 4. add netgroup-entries to /etc/passwd and /etc/shadow: Last line of /etc/passwd: +@ myhostname:x::::: Last line of /etc/shadow: +@ myhostname:NP::::::: Now only local users and users listed in dn: cn=myhostname,ou=Netgroup,dc=example,dc=com can log in to the machine. For easy administration You can group together users in netgroups and allow those as memberNisNetgroup: dn: cn=myhostname,ou=Netgroup,dc=example,dc=com objectClass: top objectClass: nisNetgroup description: users allowed to log in to myhostname cn: myhostname memberNisNetgroup: rhdmin memberNisNetgroup: mysqldba ... Regards Juergen Sprenger

1 0

Re: OpenLDAP syncrepl woes
by Jeffrey Crawford 21 Nov '11

21 Nov '11

Okay using bdb 4.8 seems to be working better, I ran through several mass adds and deletes. I stil get periodic failures of: Nov 21 10:32:27 idm-prod-ldap-2 slapd[41275]: conn=-1 op=0: attribute "reqEnd" index delete failure which is obviously part of the acceslog overlay. I am replicating that DB between the Mirror mode masters so there may be some other issues at play here. I'm attempting to make sure that the accesslog is in sync between them so that if a failover occurs we only need to look at the current active ldap server to see the changes made. On Mon, Nov 21, 2011 at 10:05 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, November 16, 2011 3:49 PM -0800 Jeffrey Crawford > <jeffreyc(a)ucsc.edu> wrote: > >>>> Oh and we are using bdb 4.6 right now (forgot to answer that) > > With all the patches? Oracle lists 4. > > 4.6.21 > Requires log file format upgrade. change log - patches ( 4) good question it's the default FreeBSD build would hope they have included them but I'm not the sysadmin on the box itself. in any case using 4.8 seems to be working (I think) > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

OpenLDAP syncrepl woes
by Jeffrey Crawford 21 Nov '11

21 Nov '11

I'm trying to stabilize our openldap server farm before going live and am finding that despite the contextCSN matching between providers and replicas, the actual content of the server is getting out of sync. This is most prominent when we are testing our population routine and we need to remove all accounts before starting. right now it's only about 22000 entries (It will get much larger). During the mass delete we got the following sprinkled throughout the logs on all machines: ==== Nov 15 15:47:16 idm-prod-ldap-2 slapd[33070]: bdb(dc=domain,dc=name): previous transaction deadlock return not resolved Nov 15 15:47:16 idm-prod-ldap-2 slapd[33070]: => bdb_idl_delete_key: cursor failed: Invalid argument (22) and the various replicas would still have accounts left over but they wouldn't match each other. Granted the above issues might be explained away in that we don't yet have enough ram on the machines yet, however it does seem to present us with a problem when we notice the discrepancy, how do we during run time re-sync the data from the provider server? I have tried the slapd -c rid=2,csn=20111114000000.000000Z but that doesn't seem to do any good. (I've tried several different values of csn=0 csn=20111114000000.000000Z#000000#000#000000 etc. to no avail) I guess my question is two fold, how do I really verify replication is working properly and is in sync, and how to I force a replica to just take the current content from a provider without question. (I don't really want to remove the database and have it re-sync, rather have it go through and check the content and update as needed). Thanks Jeffrey Crawford

3 11

slapo-rwm and NAME aliases
by Michael Ströder 21 Nov '11

21 Nov '11

HI! Some address book LDAP clients are stupid and cannot be re-configured which LDAP attributes contain the specific address information. In particular I'm struggling with Outlook's LDAP address book which expects 'streetAddress' instead of 'street'. I'm using slapo-rwm for mapping other attributes. That works. But rwm-map attribute streetAddress street does not return streetAddress in the search result probably because 'streetAddress' and 'street' gets normalized to the same attribute type description. What to do in such a case? It' part of the standard schema shipped with OpenLDAP and I don't want to mess up this. Ciao, Michael.

1 0

LDAP query to Active Directory backend
by Khaled Blah 21 Nov '11

21 Nov '11

Hello to all, I've been witnessing a strange thing when (LDAP-) querying an Active Directory backend (Windows Server 2003): the output data I receive seems to be encoded in the ISO8859 character set when I would expect it to be UTF-8. Has anyone else experienced anything like this? I'd be glad to learn how to make sure the AD backend gives UTF-8 data back. I use OpenLDAP 2.4.23 on Ubuntu 10.04 and 11.04 Regards, Khaled

2 1

OpenLDAP SASL Passthrough
by Raffael Sahli 21 Nov '11

21 Nov '11

Hi, I'm so confused with the sasl passthrough implementation. I set for the user test in my ldap tree the password {SASL}test@MY_REALM Keytab: [test@ldap-master001 /]#--> ls /etc/krb5.keytab -l -rw-r----- 1 root openldap 1078 2011-11-11 11:56 /etc/krb5.keytab SASL GSSAPI Auth: works well [test@ldap-master001 /]#--> ldapwhoami SASL/GSSAPI authentication started SASL username: test@MY_REALM SASL SSF: 56 SASL data security layer installed. dn:uid=test,cn=mycomany.net,cn=gssapi,cn=auth SASL SLAPD Config: [root@ldap-master001 /]#---> cat /usr/lib/sasl2/slapd.conf pwcheck_method: saslauthd saslauthd_path: /var/run/saslauthd/mux keytab: /etc/krb5.keytab testsaslauthd works well: [root@ldap-master001 /]#---> testsaslauthd -u test -p MYPASSWORD -r MY_REALM -s ldap 0: OK "Success." sasl debug log: saslauthd[26077] :do_auth : auth success: [user=test] [service=ldap] [realm=MY_REALM] [mech=kerberos5] saslauthd[26077] :do_request : response: OK But the ldapsearch simplebind command takes 7-10s... [test@ldap-master001 /]#--> ldapsearch -D uid=test,ou=users,dc=my,dc=company -w MYPASSWORD -s base -b '' -x ldap_bind: Invalid credentials (49) And the sasl debug log shows: saslauthd[26076] :do_auth : auth failure: [user=test] [service=ldap] [realm=MY_REALM] [mech=kerberos5] [reason=saslauthd internal error] WTF, why works testsaslauthd well but failed with ldap auth? The kerberos server works well in both commands..... root@ldap-master001:/usr/local/etc/openldap# /usr/local/libexec/slapd -V @(#) $OpenLDAP: slapd 2.4.21 (Nov 10 2011 11:20:35) $ root@ldap-master001:/usr/local/src/openldap-2.4.21/servers/slapd root@ldap-master001:/usr/local/etc/openldap# saslauthd -v saslauthd: /usr/local/lib/liblber-2.4.so.2: no version information available (required by saslauthd) saslauthd: /usr/local/lib/libldap_r-2.4.so.2: no version information available (required by saslauthd) saslauthd 2.1.23 authentication mechanisms: sasldb getpwent kerberos5 pam rimap shadow ldap Thank you

3 6

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical