openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Anonymous access
by jm130794 05 Oct '11

05 Oct '11

Hello, I have a little question. I've installed a kerberized openldap server. All works fine with kerberos tickets :) My problem : is it possible to get a ldap awser with a anonymous access ? I can't ! When I try a resquest, I get that : ldapsearch -x -h 192.168.1.1 # extended LDIF # # LDAPv3 # base <> (default) with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 I certainely made a mistake, but where ? Thanks, JM

2 1

Microsoft Windows Terminal Service integration with OpenLDAP
by pradyumna dash 05 Oct '11

05 Oct '11

Hi, I would like to know, how to integrate Microsoft windows terminal service with OpenLDAP, can pGINA will help me to achieve this ? or i have to look for something else. Please suggest. Regards, Neo

3 3

Compare-Request on hashed userPassword
by Michael Ströder 05 Oct '11

05 Oct '11

HI! We have {SSHA}-hashed passwords in attribute userPassword. One application sends CompareRequests with the clear-text password instead of a BindRequest to validate the password which obviously fails. The application vendor claims it is too much effort to change that behaviour in the application. I guess this can only be solved in slapd by a custom overlay intercepting the CompareRequest (which is effort too). Or is there any other solution I don't know of? Ciao, Michael.

6 10

Re: V 2.4.x schema extensions
by Bryce Powell 05 Oct '11

05 Oct '11

Hi, Thanks to both responders. The final working version of local.schema now looks like this: attributeType ( 1.3.6.1.4.1.22280.1021.3.1 NAME 'x-sdids-passwordExpirationTime' DESC 'TELUS defined password policy attribute type used by enPortal.' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE USAGE userApplications ) objectclass ( 1.3.6.1.4.1.22280.1021.4.1 NAME 'x-sdids-enPortal' DESC 'Indicates that this entry has additional attributes used by enPortal.' AUXILIARY MAY x-sdids-passwordExpirationTime ) After restarting slapd, and adding the 'x-sdids-enPortal' objectClass to an existing entry, I was able to add a 'x-sdids-passwordExpirationTime' attribute value. Nice. Thanks, Bryce Powell

1 0

Unable to create home directory (LDAP Authentication)
by vijay s sheelavantar 05 Oct '11

05 Oct '11

Hi,I am trying to create the home directories for the users automatically(using pam_mkhomedir.so) when they login using SSH.I have added the below line to /etc/pam.d/system-auth file.PHP Code:session     optional        pam_mkhomedir.so skel=/etc/skel umask=0022   user authentication is done by a LDAP server, and the machine is running Fedora OS.I am getting the below errors.PHP Code:Creating directory '/home/vijay'. Unable to create directory /home/vijay: Permission denied Last login: Wed Oct  5 16:03:53 2011 from 10.254.194.148 Could not chdir to home directory /home/vijay: No such file or directory   Kindly help me to solve this problem.Warm Regards,Vijay S.

2 1

V 2.4.x schema extensions
by Bryce Powell 04 Oct '11

04 Oct '11

Hi, I need an attribute to store password expiry date for the inetOrgPerson objectClass entries in my directory. Since I could not find this or similar attribute in the existing set of schemas (including the ppolicy schema), I have tried to implemented an extension in a custom local.schema: objectclass ( 1.3.6.1.4.1.22280.1021.4.1 NAME 'x-sdids-enPortal' DESC 'Indicates that this entry has additional attributes used by enPortal.' AUXILIARY ) # The "MAY" directive below prevents slapd form starting, and is therefore commented out. # MAY 1.3.6.1.4.1.22280.1021.3.1 ) attributeType ( 1.3.6.1.4.1.22280.1021.3.1 NAME 'x-sdids-passwordExpirationTime' DESC 'TELUS defined password policy attribute type used by enPortal.' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE USAGE userApplications ) I figured the best bet would be an auxiliary objectClass. After including the new local.schema file in the slapd.conf, and restarting slapd, I get an error when trying to add the new attribute value to an existing or new inetOrgPerson entry: Oct 4 10:37:43 vmsdildap04 slapd[31176]: conn=1 op=22 MOD dn="uid=john(a)abc.com,ou=CUSTOMER,ou=Users,dc=private,dc=sdi" Oct 4 10:37:43 vmsdildap04 slapd[31176]: conn=1 op=22 MOD attr=x-sdids-passwordExpirationTime Oct 4 10:37:43 vmsdildap04 slapd[31176]: Entry (uid= john(a)abc.com,ou=CUSTOMER,ou=Users,dc=private,dc=sdi), attribute 'x-sdids-passwordExpirationTime' not allowed Oct 4 10:37:43 vmsdildap04 slapd[31176]: entry failed schema check: attribute 'x-sdids-passwordExpirationTime' not allowed Oct 4 10:37:43 vmsdildap04 slapd[31176]: conn=1 op=22 RESULT tag=103 err=65 text=attribute 'x-sdids-passwordExpirationTime' not allowed I believe this error 65, as per the OpenLDAP docs, is: H.35. objectClassViolation (65) Indicates that the entry violates object class restrictions. The value I am specifying for the attribute is 20111004164129Z I have also tried to first add an objectClass attribute value to an existing entry with value 'x-sdids-enPortal', and then add the 'x-sdids-passwordExpirationTime' attribute value, with the same outcome. Thanks, Bryce Powell

3 2

connection problem with ldapmodify -Y EXTERNAL -H ldapi:///
by Andreas Rudat 04 Oct '11

04 Oct '11

Hello, everytime I try *ldapmodify -Y EXTERNAL -H ldapi:///* * I get the following SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 and thats all, same with password (-W), it stopped at all and no log messages. Thanks Andreas *

4 11

Re: Login takes more time (LDAP)
by vijay s sheelavantar 04 Oct '11

04 Oct '11

Hello, This was problem with the directory permissions where cacert.pem file was stored. The directory on the client machine had the permissions "drwx------" but the correct permission required was "drwxr-xr-x" this. I changed the directory permissions where cacert.pem file is stored on client machine to "drwxr-xr-x" and now there is no delay. This problem is fixed now.  Thank you very much. Warm Regards,VIJAY S.

1 0

Re: Login takes more time (LDAP)
by vijay s sheelavantar 04 Oct '11

04 Oct '11

Hi,I followed your suggestions, I have set 'UseDNS no' in sshd_config and restarted sshd. I tried 'getent passwd' and 'getent group' there is no delay in the output of these commands. I tried to create home directory after login using pam_mkhomedir.so but failed.  I am getting delay only while login. I am getting below errors during login. Please see the below error and kindly help me to fix this delay problem. Last login: Fri Sep 30 15:22:53 2011 from 10.254.194.148Could not chdir to home directory /home/kim: No such file or directoryid: cannot find name for user ID 105-bash-3.2$ Thanks and Regards,Vijay S.

3 2

Different replication methods in OpenLDAP 2.4
by Bob Fitch 03 Oct '11

03 Oct '11

Hi, I'm trying to correctly conceptualize the different replication models in OpenLDAP 2.4 and I'm a little unsure if I have my facts right. As far as I can tell from the OpenLDAP 2.4 Administrator's Manual the following is true: LDAP Sync Replication (a.k.a syncrepl) - Single Master Replication - Provides HA for reads to the directory but not for writes. - Provides data consistency - Replicates all attributes of the modified DN, even the unchanged ones. Delta Sync Replication - Single Master Replication - Provides HA for reads to the directory but not for writes - Provides data consistency - Replicates only the modified attributes of the modified DN N-Way Multi-Master Replication - As the name suggests, Multi-Master Replication - Provides HA for reads and writes to the directory. - Does not provide data consistency MirrorMode Replication - Hybrid between SMR and MMR - Creates chicken and egg problem with regards to HA - external frontend is a potential failure point and must also be made HA - Provides HA for reads and writes to the directory (assuming external frontend is made HA) - Both OpenLDAP servers can replicate changes to each other, however all directory writes are forced through one server at a time by the external frontend. - Provides data consistency - Does not support Delta Sync Repl (yet) Unfortunately I do not have the capacity to test MirrorMode Replication, so I was hoping I could hear from someone who has practical experience with it to let me know if I'm off-base there. Also, does N-Way Multi-Master Replication support Delta Sync Replication? Unlike MirrorMode Replication which specifically denotes that it can't, the section on N-Way Multi-Master Replication doesn't implicitly say one way or another. I guess I could assume then that it does, but I'd prefer not to - you know what they say about assumptions ;-) Many thanks in advance, Bob

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical