openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Limiting host access
by Jayavant Patil 20 Nov '11

20 Nov '11

Hi, I am using openldap-2.4.19-4 on fedora 12 machine. My question is as follows: How to restrict a user access to some client nodes? Please, explain in detail. -- Thanks & Regards, Jayavant Ningoji Patil +91 9923536030.

2 1

Newbie: can't connect and enable logging
by cfisi＠arcor.de 20 Nov '11

20 Nov '11

Hi list, I installed OpenLdap on Debian Squeeze. When trying to connect to Openldap jxplorer just says: "Opening connection to ldap://192.168.1.102:389". Nothing more happens. How can I enable logging (in Openldap or jxplorer) and above all how can I connect? Thank you in advance. - Chris

3 4

Re: How to configure Unique Overlay in cn=config
by Igor Blanco 19 Nov '11

19 Nov '11

Thanks Quanah: I'm using Debian Stable's repository and would prefer to stay in sync with the repo to ease the maintenance process. AFAIK Debian usually applies critical patches in its own packaging version so maybe some of those issues are already addressed. My exact version is 2.4.23-7.2, which I think that means that is version 7.2 of Debian package or something like this. I'll take some time and check it just in case there is something really nasty that I should be aware of, thank you very much. Going back to unique overlay. I finally managed to configure it, as you say I just added a new module entry but I wasn't seeing the corresponding configuration objectclasses needed. After restarting slapd they appeared. Thank you very much. 2011/11/9 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Monday, November 07, 2011 7:05 PM +0100 Igor Blanco < > iblanco(a)binovo.es> wrote: > > Hello everyone, >> >> >> I'm trying to configure the uniqueness overlay in Debian Squeeze >> (OpenLDAP 2.4.23) using "cn=config" but I can't figure how to do it and >> can't find any good doc about it, the FAQ-O-Matic wasn't very helpful >> this time. >> >> >> I've added a new "olcModuleLoad=unique" attribute in >> "cn=module{0},cn=config" and it hasn't complained, but how and where do I >> set "olcUniqueURI" ? in "olcDatabase={1}hdb,cn=config" ? This attribute >> does not seem to be present in my OpenLDAP installation, do I have to add >> any new schema? >> >> >> Any reference to documentation explaining how to configure "unique" >> overlay within "cn=config" would be much appreciated. A dump of a >> "cn=config" branch correctly configured would be fantastic. >> > > First, I would seriously advise you to upgrade to 2.4.26. 2.4.23 has > numerous, serious issues. You may also want to grab the patch for ITS#7030 > from the git repo (<http://www.openldap.org/**devel/gitweb.cgi?p=openldap. > **git;a=commitdiff;h=**eae46d35d252f5e7cfd623984f0896**e951d507c9<http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commitdiff;h=eae4…> > >) > > As for adding unique, it's pretty trivial. I have a perl script that does > it using Net::LDAP, but you can trivially change this for ldapadd: > > my $ldap = Net::LDAP->new('ldapi://%**2fopt%2fzimbra%2fopenldap%**2fvar%2frun%2fldapi/') > or die "$@"; > my $mesg = $ldap->bind("cn=config", password=>"$ldap_root_**password"); > $mesg->code && die "Bind: ". $mesg->error . "\n"; > my $dn="cn=module{0},cn=config"; > $mesg = $ldap->modify( > $dn, > add =>{olcModuleLoad => 'unique.la'}, > ); > my $bdn="olcDatabase={2}hdb,cn=**config"; > $mesg = $ldap ->search( > base=>"$bdn", > filter=>"(objectClass=**olcUniqueConfig)", > scope=>"sub", > attrs => ['1.1'], > ); > > my $size = $mesg->count; > if ($size == 0) { > $dn="olcOverlay=unique,$bdn"; > $mesg = $ldap->add( "$dn", > attr => [ > 'olcUniqueURI' => 'ldap:///?mail?sub', > 'objectclass' => ['olcOverlayConfig', > 'olcUniqueConfig', ], > ] > ); > $mesg->code && warn "failed to add entry: ", $mesg->error ; > } > $ldap->unbind; > > > > The basic idea is you add a new entry, olcOverlay=unique,<base database > DN> with the objectClasses and the unique URI. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Igor Blanco González Binovo IT Human Project e-mail: iblanco(a)binovo.es Telf. : 943 493611 - 690229375 Dirección: Astigarraga Bidea 2 Planta 6. - Ofi. 3-2 20180 Oiartzun ( Gipuzkoa )

2 1

Question to an ACL
by Andreas Rudat 18 Nov '11

18 Nov '11

Hi, I'm trying to understand these acl's: {0} to attrs=userPassword,shadowLastChange,sambaNTPassword,sambaLMPassword by dn="cn=admin,dc=foo,dc=bar" write <--admin can read/write by anonymous auth <--anonyomous can auth by self write <--- object owner can read/write by * none <--all other users denied {1}to dn.base="" by * read <-- all can read the root dc=foo, dc=bar {2}to * by dn="cn=admin,dc=studsemi,dc=intern" write <-- by * read so with acl 0: users and admin can read/write passwords, all others can do nothing with that acl 1: ALL can read the root dc=foo,dc=bar acl 2: all other attributes can be read by all others and only admin can also modify all other attributes? so if that is correct, then I think acl 1 isnt needed? Thanks

2 3

MDB (Memory-Mapped Database) for OpenLDAP at UKUUG Spring 2012
by Jan-Piet Mens 18 Nov '11

18 Nov '11

Just a short heads-up for those interested in MDB: I note Howard Chu will be speaking at the Spring 2012 UKUUG conference in Edinburg, UK. More details at [1]. -JP [1]: http://www.flossuk.org/Events/Spring2012/Talks

1 0

trigger script on change to db
by E.S. Rosenberg 16 Nov '11

16 Nov '11

I was wondering is it possible to set a slapd syncprov consumer to trigger a script when it receives changes to the db (updates of specific attributes). Basically we have a bunch of flat files that are created and maintained based on information kept in slapd which need to either: - run every X time and just dumbly regenerate the files. - run every X time and somehow establish whether changes happened before regenerating the files (maybe by using the contextCSN attribute of the root object) - run whenever a change happens In a situation with not too many changes the third option is best, and in situations with lots of changes the second option is probably better. But is the third option even possible? Thanks and best regards, Eli

4 6

Search access does not return any result
by sim123 15 Nov '11

15 Nov '11

Hi All, I am playing with access controls on openldap 2.4.26, I have a user with search access on everything access to * by anonymous auth by dn="uid=102,ou=system,dc=example,dc=com" search And when I perform search I get nothing ldapsearch -H "ldap://testldap:389" -D "uid=102,ou=system,dc=example,dc=com" -b "ou=users,dc=example,dc=com" -x -W '(uid=1)' mail cn dn Enter LDAP Password: # extended LDIF # # LDAPv3 # base <ou=users,dc=example,dc=com> with scope subtree # filter: (uid=1) # requesting: mail cn dn # # search result search: 2 result: 0 Success # numResponses: 1 so I get a success but no value, is it a valid response? I want to control access so that the "uid=102" user can do lookup from given attributes but can not do (objectClass=*) to get a list of every entry in the ldap. Thanks for the help

2 4

A question about Mirror mode sync
by Andrew Liu 15 Nov '11

15 Nov '11

Hi All, I set up two machines as LDAP server under mirror replication mode using openldap-2.4.26。 I found a problem: when a server was down, any LDAP *add *operation on the running server will not propagate *immediately *to the previous down server after it has restarted, but the LDAP *delete* operation can do. and I found *after 5-10 *minutes, the *add *operation content can be found on the previous down server. but it seems the time is not constant. My question: How to enable the add operations content to propagates to the previous down server *immediately*? I have ever tried "-c rid=001,sid=001,csn=0 " to force a full load, but didn't take effect. I read the OpenLDAP doc, found the session-log doesn't include add operation, what's sync mechanism of the add operation. Thanks BRs, Andrew I

1 0

Overlays syncrepl and smbk5pwd
by Francesco Storti 15 Nov '11

15 Nov '11

Hi, I am using both syncrepl (for replication) and smbk5pwd (for password synchronisation between samba and ldap account) overlays. I have configured replication in the simplest way: a read-only producer that forwards updates to the provider thought updateref. If I change my password thought passwd command on a client with pam modules configured for gaining information from the provider everything works fine (userPassword, sambaLMPassword and sambaNTPassword are correctly syncronized). Instead, if I change my password thought passwd command on another client with pam modules configured for gaining information from the consumer only the userPassword is changed. I do not understand why. Has someone experimented the same problem? Thank you in advance.

3 3

Re: cn=config ACL consultation (BUG)
by Olivier 15 Nov '11

15 Nov '11

Addendum : Ldap is up and running with my configuration : [root@ldap2]# ps auxwww | grep slapd ldap 17190 0.0 1.1 426480 44384 ? Ssl Nov14 0:05 /usr/sbin/slapd -h ldap:/// -u ldap And the directory sounds to respond exactly as I wish to usual queries. However, here is a slapcat output : [root@ldap2]/usr/sbin/slapcat -F /etc/openldap/slapd.d -l ldap-conf.ldif PROXIED attributeDescription "OU" inserted. PROXIED attributeDescription "DC" inserted. olcSyncrepl: value #0: rootDN must be defined before syncrepl may be used config error processing olcDatabase={1}bdb,cn=config: rootDN must be defined before syncrepl may be used slapcat: bad configuration directory! I checked and that's true that the synchronisation doesn't work properly anymore. I had to reinserted this to have everything working well : dn: olcDatabase={1}bdb,cn=config OlcrootDN cn=Manager,dc=example,dc=fr ( no need for OlcrootPW) -- Olivier On Mon, Nov 14, 2011 at 5:15 PM, Olivier Guillard <olivier(a)guillard.nom.fr> wrote: > Hi there, > > I would like to have your feeling or advices about the following acl > strategy for ldap administration issues (cn=config and actual directory > administration). I have tested that and it sounds to work properly : > > My idea is to create two groups of people : one for those > that administrates accounts in the directory, and another for > those that are able to tune "cn=config" > > Basically, I have the following DIT : cn=config and dn: dc=example,dc=fr > > I have then created two "groupOfnames" (admin-ldap and > admin-dir) and tuned ACL so that : directory admins can modify > accounts and ldap admins can modify "slapd.d" > > I also have removed RootDN as well as RootPW both in : > olcDatabase={0}config,cn=config > as well as in > olcDatabase={1}bdb,cn=config > > so that maintenance operation are not performed as "RootDN" > anymore. > > ANY REACTIONS OR ADVICES ON THAT ? > > > HARE IS HOW I HAVE TUNED THAT : > > # Entries for the two groupofnames : > > dn: cn=admin-dir,ou=system,dc=example,dc=fr > cn: admin-dir > member: uid=guillard,ou=people,dc=example,dc=fr > member: uid=foo,ou=people,dc=example,dc=fr > member: uid=shmol,ou=people,dc=example,dc=fr > objectclass: groupOfNames > objectclass: top > > dn: cn=admin-ldap,ou=system,dc=example,dc=fr > cn: admin-ldap > member: uid=guillard,ou=staff,ou=people,dc=example,dc=fr > member: uid=pick,ou=staff,ou=people,dc=example,dc=fr > objectclass: groupOfNames > objectclass: top > > > ### ACL : > > dn: olcDatabase={0}config,cn=config > objectclass: olcDatabaseConfig > olcaccess: {0}to * by group.exact="cn=admin-ldap,ou=system,dc=example > ,dc=fr" write by * none > ... > > ### And : > > dn: olcDatabase={1}bdb,cn=config > objectclass: olcDatabaseConfig > objectclass: olcBdbConfig > ... > olcaccess: {0}to dn.base="dc=example,dc=fr" by > group.exact="cn=admin-ldap,ou=system,dc=example,dc=fr" write > by group.exact="cn=admin-dir,ou=system,dc=example,dc=fr" read > by dn.base="cn=replication,ou=system,dc=example,dc=fr" read > by * search > olcaccess: {1}to dn.one="dc=example,dc=fr" > by group.exact="cn=admin-ldap,ou=system,dc=example,dc=fr" write > by group.exact="cn=admin-dir,ou=system,dc=example,dc=fr" read > by dn.base="cn=replicator,ou=system,dc=example,dc=fr" > read by users search > by anonymous auth > > ### then : > olcaccess: {2}to dn.subtree="ou=system,dc=example,dc=fr" > by group.exact="cn=admin-ldap,ou=system,dc=example,dc=fr" write > by dn.base="cn=replicator,ou=system,dc=example,dc=fr" read by * none > > ### and : > olcaccess: {3}to dn.subtree="dc=example,dc=fr" > attrs=userPassword,shadowLastChange,loginShell > by group.exact="cn=admin-annuaire,ou=system,dc=example,dc=fr" write > by self write by dn.base="cn=replicator,ou=system,dc=example,dc=fr" > read by users auth by anonymous auth > > ### finally : > olcaccess: {4}to dn.subtree="dc=example,dc=fr" > by group.exact="cn=admin-annuaire,ou=system,dc=example,dc=fr" > write by dn.base="cn=replicator,ou=system,dc=example,dc=fr" > read by users read by anonymous read >

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical