openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Re: LDAP + Freeradius + Samba
by Andreas Rudat 27 Oct '11

27 Oct '11

Am 28.10.2011 04:28, schrieb Stewart Walters: > Freeradius already supports posixAccount attributes for LDAP account authentication - check the Freeradius website for a howto. > > Freeradius and OpenLDAP also supports the storing of 802.1x attributes using the RADIUS schema. > > There are numerous howto's available on the web for how to implement either. > > > > > On 28/10/2011, at 3:28 AM, Andreas Rudat <rudat(a)endstelle.de> wrote: > >> Hello, >> >> I got openldap running as user db for samba, now I want to use it also >> as database for radius, I think it should be possible to use it without >> big modifications or? >> >> Thanks >> ok thanks, I will look. Another question is, does I need any other client tools for windows/linux? At the moment I'm using ntlm_auth + mschap Andreas

1 0

Referral and Chain configuration and multiple directories
by sim sim 27 Oct '11

27 Oct '11

Hi All, I have an LDAP server running with all users and respective groups say ( a.example.net). I was wondering if there is any way I could separate user subtree into another OpenLDAP server (b.example.net) and still be able to define those users as member of groups in a.example.net (for a new requirement). Basically I want to separate user repository (which is global) from all other subsystems like my groups or organization units which contains these users as members. If its possible, please point me to the documentation, I tried searching all over but could not find enough example of Referrals or proxying. Another thing I would like to understand that is it a good idea to create another directory server just for user authentication and read, how common it is? Or should I consider replication? Thanks for the help and support.

1 0

LDAP + Freeradius + Samba
by Andreas Rudat 27 Oct '11

27 Oct '11

Hello, I got openldap running as user db for samba, now I want to use it also as database for radius, I think it should be possible to use it without big modifications or? Thanks

2 1

New overlay, your opinion?
by Johan Jakus 27 Oct '11

27 Oct '11

Hi everyone, I've been developing an overlay and I got to a well working solution. But,I would really appreciate your opinions about it before sending it to the contribs. You can see my source on my site: http://www.dataworld.be/johan/openldap/parsearch/parsearch.htm Since I'm a student and I needed to this for my stage, I'will have to write a rapport on how to write an overlay for OverLDAP, I'll be glad to share it as a tutorial for the next overlay developers. Thanks allot! Johan Jakus

2 6

password-policy configuration problems: cannot change passwords
by Marco Weber 27 Oct '11

27 Oct '11

Hello, i'm running openldap with password policy overlay. after the overlay installation and configuration, we cannot change the passwords anymore. ldappasswd -D cn=username,dc=domain,dc=tld -S -W New password: ******** Re-enter new password: ******** Enter LDAP Password: ******** Result: Constraint violation (19) Additional info: Password policy only allows one password value this is my default password policy: dn: cn=password-policy,dc=policies,dc=domain,dc=tld objectClass: person objectClass: pwdPolicy objectClass: top cn: password-policy pwdAttribute: userPassword sn: Default Password Policy pwdAllowUserChange: TRUE pwdExpireWarning: 604800 pwdInHistory: 3 pwdLockout: TRUE pwdLockoutDuration: 7200 pwdMaxAge: 7776000 pwdMaxFailure: 5 pwdMinAge: 180 pwdMinLength: 8 pwdMustChange: TRUE this is my password policy configuration: dn: olcOverlay=ppolicy,dc=policies,dc=domain,dc=tld objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcPPolicyConfig objectClass: top olcOverlay: ppolicy olcPPolicyDefault: cn=password-policy,dc=policies,dc=domain,dc=tld olcPPolicyUseLockout: TRUE Does anyone know what to do? Thanks in advance for any reply, Marco

2 6

Securing cn=config and allowing micro-engineering
by Nick Milas 26 Oct '11

26 Oct '11

Hello, Having migrated from slapd.conf, I would like to ask some questions regarding cases/scenarios where someone - unintentionally - breaks the configuration. So, let's assume that, due to some misspelling or use of wrong values (esp. when using a graphical LDAP Browser - like JXplorer - to maintain the configuration DIT), we have added/modified a setting that would break the installation without warning. *Question 1*: Are there cases where: 1/ LDAP Server will stop immediately? (It is stated that "Beware: You can configure cn=config to an unusable state.", ref. with example: http://www.zytrax.com/books/ldap/ch6/slapd-config.html) 2/ LDAP Server will continue to operate but, if stopped, when restarted it will not be able to restart? If the answer to Q1.2 above is yes: *Question 2*: How can we test at any given point the current configuration to make sure it will be OK if/when restarted (AFAIK, slaptest only tests slapd.conf and not slapd.d configuration)? *Question 3* (especially critical if the answer to Q1.1 or Q1.2 above is yes): If the server is stopped, how can we change manually the config settings (e.g. by editing slapd.d/ files) to attempt to correct it? (In one such test I did, I changed - directly in "cn=config.ldif" file - olcLogLevel as follows: Initial state: olcLogLevel: Config olcLogLevel: Sync New state (removed one attribute value and changed the other): olcLogLevel: -1 and when I tried to start I got: ldif_read_file: checksum error on "/usr/local/openldap/etc/openldap/slapd.d/cn=config.ldif" so I had to re-edit the file and change the values as they were initially, which allowed the server to start. So (to *repeat Question 3*), how can we "re-engineer" cn=config settings when off-line? It is always desirable to be able to do some "low-level engineering" to the configuration (under administrator's or system engineer's responsibility) in case something goes wrong. This is also important in cases of "cloning" the server where we want a copy of the config but we need to change a few settings in the new context. We need to avoid things like "checksum error"! Finally, there might be cases where - after having migrated and worked for a period using cn=config - business/technical needs require the use of overlay(s) or other modules like SLAPI, which would not be supported by cn=config and someone would need to move to slapd.conf configuration (at least temporarily). If such a need arises, *Question 4*: Is there a tool/method to "migrate" to slapd.conf from a slapd.d configuration? Thanks in advance, Nick

9 17

bdb version(s)
by Brett ＠Google 26 Oct '11

26 Oct '11

Hello, Anybody want to comment with regards to what version of bdb they have in use & what they recommend ? Personally i have in installations running 4.8 and 5.2, and both seem fine. Cheers Brett -- *The only thing that interferes with my learning is my education.* * Albert Einstein*

2 1

slapcat -n 0 and slapadd
by Craig White 26 Oct '11

26 Oct '11

Having migrated to dynamic config, I'm looking for a reasonable way to restore in the event of a disaster. The discussion last week got me curious and though I can slapcat -n 0 -l $SOME_FILE I can't slapadd this same file because it complains that I don't have a slapd.conf file, which of course is true... I haven't needed it with the dynamic configuration backend. What's the minimum that I would need in a slapd.conf file so I can simply 'rm -fr /var/lib/ldap/* && slapadd -l $SLAPD_BACKUP' ? -- Craig White ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ craig.white(a)ttiltd.com 1.800.869.6908 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ www.ttiassessments.com Need help communicating between generations at work to achieve your desired success? Let us help!

3 8

OpenLDAP documentation Doxygen
by Johan Jakus 26 Oct '11

26 Oct '11

Hi everyone! While working on my overlay, I add real hard time trying to understand the structure used by OpenLDAP. To help me out, I used Doxygen that automatically generates a map of the structures (and much more) from the source code. You can check this out on my website ( http://www.dataworld.be/johan/openldap/doxygen/). I would highly recommend you to use this tool so that future developers can easily find their way in your structures. The best solution would be to add this kind of documentation to the OpenLDAP website, so that everyone could easily access it. I don't want to judge your way of doing things, I just want to share something that helped me out allot! Best regards, Johan Jakus

1 0

RE: Overlays : Cache - Entry - AttributeDescription
by Hallvard B Furuseth 26 Oct '11

26 Oct '11

A correction to my last message: > If you want to free the entry yourself, instead you can do > > rs_replace_entry(entry_dup(rs->sr_entry)); e = rs->sr_entry; .... send the entry, or whatever... entry_free(e); /* instead of entry_free(rs->sr_entry); */ I don't quite remember, but I think when rs->sr_flags does not assert ownership of the entry, some other module may change the sr_entry pointer. So entry_free(rs->sr_entry) could free the wrong entry. Johan Jakus writes: > I'd like to make the attributes I merged in the entry > "read-only". Because the clients will receive an attribute from the > parents of an object, and I don't want them to to be able to save that > attribute in the object,when for example they change other attributes > values and click on the modify button in a program. Would You have any > idea on how to make that possible? Don't know, but try access controls to prevent user modifications, then bypass that for the mods done by the overlay with <Modifications>.sml_flags |= SLAP_MOD_INTERNAL; Maybe something like objectclass ( <oid> NAME 'jakusAddedAttrs' AUXILIARY MAY ( managed_attr1 $ managed_attr2 $ ... ) ) ... access to filter=(objectclass=jakusAddedAttrs) attrs=@jakusAddedAttrs by * read The alternative would be to intercept update operations and return (prohibited mod ? LDAP_UNWILLING_TO_PERFORM : SLAP_CB_CONTINUE). -- Hallvard

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical