openldap-technical

openldap-technical@openldap.org

13 participants
9906 discussions

Re: Patching openldap?
by Christian Manal 22 Oct '11

22 Oct '11

Am 11.10.2011 22:12, schrieb NetNinja: > I tryed your command today. I still can't get it to work. I listed all > the files I have edited. Can you look over it and tell if I'm missing > anything. Thanks for your help. Please keep your replies on the list. Others might run into similar problems and find this helpful. > I ran this: > ldapclient manual -v > -a defaultSearchBase="dc=test,dc=net" > -a domainName="test.net" > -a authenticationMethod="simple" > -a defaultServerList="10.0.0.2" > -a preferredServerList="10.0.0.2" > -a serviceSearchDescriptor="passwd:ou=People,dc=test,dc=net" > -a serviceSearchDescriptor="group:ou=Group,dc=test,dc=net" > 10.0.0.2 > > I don't have TLS, automount or netgroups setup yet. > > bash-3.00# ldapclient list > NS_LDAP_FILE_VERSION= 2.0 > NS_LDAP_SERVERS= 10.0.0.2 > NS_LDAP_SEARCH_BASEDN= dc=test,dc=net > NS_LDAP_CACHETTL= 0 > NS_LDAP_SERVICE_SEARCH_DESC= passwd:ou=People,dc=test,dc=net > NS_LDAP_SERVICE_SEARCH_DESC= group:ou=Group,dc=test,dc=net > > I tried to add more lines but I was getting a lot of errors. What kind of errors? > /etc/nsswitch.conf > passwd: files ldap > group: files ldap > host: files ldap Are you sure you want to resolve hostnames via LDAP and not DNS? > what i have running on RHEL > ldapsearch -x <snip> > ---------------- I have added a proxy entry before I have not done so > yet. Do I still need one if I'm useing manual and not init? If your data can be accessed anonymously, you don't need proxy credentials. > My PAM file > > # login service (explicit because of pam_dial_auth) > # > login auth requisite pam_authtok_get.so.1 > login auth required pam_dhkeys.so.1 > login auth required pam_unix_cred.so.1 > login auth sufficient pam_unix_auth.so.1 > login auth required pam_dial_auth.so.1 > login auth required pam_ldap.so.1 My "auth" blocks look like this: login auth requisite pam_authtok_get.so.1 login auth required pam_dhkeys.so.1 login auth required pam_unix_cred.so.1 login auth required pam_dial_auth.so.1 login auth sufficient pam_ldap.so.1 use_first_pass ignore_unknown_user login auth required pam_unix_auth.so.1 > # > # rlogin service (explicit because of pam_rhost_auth) > # > rlogin auth sufficient pam_rhosts_auth.so.1 > rlogin auth requisite pam_authtok_get.so.1 > rlogin auth required pam_dhkeys.so.1 > rlogin auth required pam_unix_cred.so.1 > rlogin auth sufficient pam_unix_auth.so.1 > rlogin auth required pam_ldap.so.1 > # > # Kerberized rlogin service > # > krlogin auth required pam_unix_cred.so.1 > krlogin auth required pam_krb5.so.1 > # > # rsh service (explicit because of pam_rhost_auth, > # and pam_unix_auth for meaningful pam_setcred) > # > rsh auth sufficient pam_rhosts_auth.so.1 > rsh auth required pam_unix_cred.so.1 > # > # Kerberized rsh service > # > krsh auth required pam_unix_cred.so.1 > krsh auth required pam_krb5.so.1 > # > # Kerberized telnet service > # > ktelnet auth required pam_unix_cred.so.1 > ktelnet auth required pam_krb5.so.1 > # > # PPP service (explicit because of pam_dial_auth) > # > ppp auth requisite pam_authtok_get.so.1 > ppp auth required pam_dhkeys.so.1 > ppp auth required pam_unix_cred.so.1 > ppp auth sufficient pam_unix_auth.so.1 > ppp auth required pam_dial_auth.so.1 > ppp auth required pam_ldap.so.1 > # > # Default definitions for Authentication management > # Used when service name is not explicitly mentioned for authentication > # > other auth requisite pam_authtok_get.so.1 > other auth required pam_dhkeys.so.1 > other auth required pam_unix_cred.so.1 > other auth sufficient pam_unix_auth.so.1 > other auth required pam_dial_auth.so.1 > other auth required pam_ldap.so.1 > # > # passwd command (explicit because of a different authentication module) > # > passwd auth sufficient pam_passwd_auth.so.1 > passwd auth required pam_ldap.so.1 > # > # cron service (explicit because of non-usage of pam_roles.so.1) > # > cron account required pam_unix_account.so.1 > # > # Default definition for Account management > # Used when service name is not explicitly mentioned for account management > # > other account sufficient pam_ldap.so.1 > other account requisite pam_roles.so.1 > other account required pam_unix_account.so.1 You can omit pam_ldap here. It only produces error messages in the logs for me. > # > # Default definition for Session management > # Used when service name is not explicitly mentioned for session management > # > other session required pam_unix_session.so.1 > # > # Default definition for Password management > # Used when service name is not explicitly mentioned for password management > # > other password required pam_dhkeys.so.1 > other password requisite pam_authtok_get.so.1 > other password requisite pam_authtok_check.so.1 > other password required pam_authtok_store.so.1 > # > > > On Sun, Oct 9, 2011 at 10:31 AM, Christian Manal > <moenoel(a)informatik.uni-bremen.de> wrote: >> Am 09.10.2011 14:33, schrieb NetNinja: >>> On Sat, Oct 8, 2011 at 4:54 AM, Christian Manal >>> <moenoel(a)informatik.uni-bremen.de> wrote: >>>> Am 07.10.2011 23:58, schrieb NetNinja: >>>>> Ok that's good to know. >>>>> I was reading in the book "Solaris 10 System Administration Essential" >>>>> and it says on pg 365 that the openldap server needs to be patched so >>>>> that the ldapclient init utility will configure properly. >>>>> >>>>> Do you happen to remeber how you setup the Solaris Native client? This >>>>> my current issue, I installed openldap on a RHEL 5.5 server and have all >>>>> the Linux servers working with the ldap server but the Solaris servers >>>>> won't let me login as a ldap user. I can do a ldapsearch, id, getent and >>>>> get info on ldap users. I am in the process of troubleshooting the issue >>>>> and I'm not sure what I'm doing wrong? My setup is very basic, no TLS, >>>>> uatomount or replication. I will add these later when I know what i'm doing. >>>>> >>>>> Anyway thanks for your help. If you have any advice on ldapclient setup >>>>> let me know. >>>>> >>>>> On Fri, Oct 7, 2011 at 3:41 PM, Christian Manal >>>>> <moenoel(a)informatik.uni-bremen.de >>>>> <mailto:moenoel@informatik.uni-bremen.de>> wrote: >>>>> >>>>> Am 07.10.2011 20:25, schrieb NetNinja: >>>>> > Hello, >>>>> > I have been reading up on OpenLDAP. I have installed it on RHEL >>>>> 5.5 but >>>>> > I have seen documention saying that openldap needs to be patched >>>>> to work >>>>> > with Solaris. Can someone tell me if this still the case and if so >>>>> where >>>>> > to get the patch. If not any info you can provide wold be great. >>>>> > >>>>> > Thanks >>>>> > >>>>> > >>>>> >>>>> Hi, >>>>> >>>>> I've been running OpenLDAP on Solaris 10 for years now. It works out of >>>>> the tarball, no patches needed. >>>>> >>>>> >>>>> Regards, >>>>> Christian Manal >>>>> >>>>> >>>>> >>>>> >>>>> >>>> >>>> >>>> Here's an example of an ldapclient invocation that works for me: >>>> >>>> ldapclient manual \ >>>> -a authenticationMethod="tls:simple" \ >>>> -a credentialLevel="proxy" \ >>>> -a defaultSearchBase="dc=example,dc=org" \ >>>> -a defaultSearchScope="sub" \ >>>> -a defaultServerList="ldap1.example.org,ldap2.example.org" \ >>>> -a domainName="example.org" \ >>>> -a preferredServerList="ldap1.example.org,ldap2.example.org" \ >>>> -a serviceSearchDescriptor="passwd:ou=People,dc=example,dc=org" \ >>>> -a serviceSearchDescriptor="group:ou=Group,dc=example,dc=org" \ >>>> -a serviceSearchDescriptor="netgroup:ou=Netgroup,dc=example,dc=org" \ >>>> -a >>>> serviceSearchDescriptor="auto_home:ou=auto_home,ou=Mounts,dc=example,dc=org" >>>> \ >>>> -a attributeMap="auto_home:automountMapName=ou" \ >>>> -a attributeMap="auto_home:automountKey=cn" \ >>>> -a proxyDN="uid=proxyauth,ou=people,dc=example,dc=org" \ >>>> -a proxyPassword="foobar" >>>> >>>> >>>> Before you invoke that, you need to modify /etc/nsswitch.ldap to your >>>> needs (ldapclient will copy that to /etc/nsswitch.conf). You also need >>>> to put your TLS certs into /var/ldap in NSS format (you can >>>> generate/convert them with certutil[1]) and edit /etc/pam.conf for LDAP >>>> authentication. >>>> >>>> >>>> Regards, >>>> Christian Manal >>>> >>>> >>>> [1] http://www.mozilla.org/projects/security/pki/nss/tools/certutil.html >>>> >>> >>> Thanks, >>> >>> I will try your command. Since you used ldapclient manual and not >>> ldapclient init I don't need to add a profile of proxy ldif file to >>> the ldap server, right? >> >> Right. It's possible to deposit most of those infos in a profile in the >> DIT, but since I have a script for configuring LDAP clients it doesn't >> make any difference for me. I have only one set of settings for Solaris >> boxes. Though, it might be worth looking into for you, if you have >> different setups. >> >> >>> I have been using examples like the one you >>> just gave me and I can only get the info from the server. The password >>> seems to not work. I get the same erros on the prompt that I would get >>> if the password or username where wrong. Though I have not tried the >>> command with the serviceSearchDescriptor before maybe this is what I'm >>> missing. >> >> You replaced the credentials with existing ones from your DIT, right? Do >> they work with ldapsearch? Does the DN have read access to the user and >> group data in your DIT? >> >> You might want to call ldapclient with '-v' to get some debugging info. >> >> >>> I'm also not using TLS or automount can I leave these out, for now? >>> Sotls:simple would be simple, right. >> >> Right. >> >> >>> Also could Solaris 10 not want to >>> work because I'm not using TLS? >> >> I don't think so. It shouldn't make any difference. Though, I'd >> recommend adding TLS support before putting anything in production. >> >> >>> Anyway thanks for your time. I will let you know if it works. >>> >> >> >> Regards, >> Christian Manal >> >> > > >

2 3

Abwesenheit: openldap-technical Digest, Vol 47, Issue 22
by tkircht＠ipodion.at 22 Oct '11

22 Oct '11

Ich bin vom 21.10.2011 bis einschließlich 2.11.2011 nicht in Wien. Ich werde meine Mailbox in dieser Zeit nur sporadisch abfragen können. Bitte wenden Sie sich mit Ihren Anfragen in dieser Zeit an unser Büro unter office(a)ipodion.at bzw. der Telefonnummer 01/21632985-00. Vielen Dank Thomas Kirchtag

1 0

Abwesenheit: openldap-technical Digest, Vol 47, Issue 21
by tkircht＠ipodion.at 21 Oct '11

21 Oct '11

1 0

Overlays : Cache - Entry - AttributeDescription
by Johan Jakus 21 Oct '11

21 Oct '11

Hi everyone, I’m still working on my overlay for an OpenLDAP server, and I’ve a few questions, I hope you could help me with: 1. In my overlay, I search for the attribute of a parent (recursively) and then, I return it in the response using the “attr_merge” function as used in the “content” overlay. But, this seems to be a permanent change, the server will always return that attribute, till I restart the server. It’s like if the “attr_merge” function add the attribute in some kind of cache that is only cleared when the server shuts down. I ‘would like my attribute to be return only when I ask it, is there some other function that allow this or maybe a way to clear that cache? 2. I need to free some variables at the end of the request. It seems that the server goes through the response function one last time at the end of the request with an empty entry, I used that condition to free my variable. This seems to work perfectly, but is there may be another way to do that? 3. To determine what attribute I need to look up for parent’s attributes, I use a symbol before the attribute in the search request (ex: “_street”). This means that when the attribute arrives in the search function, it has no attribute description because the attribute name isn’t valid of course! So, I change the name, save the attribute name for later use and then use the “slap_str2ad” function do add the attribute description! But this means that the server as to go look for that attribute description again and this means decreasing the performance. My question is: Is there a way to change and saved the attribute name before the server loads the attribute descriptions and calls the search function? Since I’ve found a workarounds for question 2 and 3, question 1 is my biggest problem to make my overlay work properly! Thanks for your coming answers! Johan Jakus

2 4

Re: howto view slapd configuration : ldapsearch VS slapcat
by Howard Chu 20 Oct '11

20 Oct '11

Olivier Guillard wrote: > Thanks Howard, > >> you can't ask for just a specific list of attributes. slapcat always >> returns whole entries. > > That's what I didn't get : thanks. The slapcat(8) manpage says: The entry records will include all (user and operational) attributes stored in the database. >> You haven't shown an example of the command you attempted > > I tried almost the same with the attribute that I try to retreive included : > >> slapcat -H "ldap:///cn=config??sub?(olcDatabase=*)" > slapcat -H "ldap:///cn=config?olcAccess?sub?(olcDatabase=*)" > >> but obviously you did it wrong. > > You are obviously right since I get this : > > usage: slapcat [-v] [-d debuglevel] [-f configfile] [-F configdir] [-o > <name>[=<value>]] [-c] > [-g] [-n databasenumber | -b suffix] [-l ldiffile] [-a filter] [-s > subtree] [-H url] > > I thought that my URI was correct though. The slapcat(8) manpage says: -H URI use dn, scope and filter from URI to only handle matching entries. It says nothing about using an attribute list in the URI. Did you think we were just joking? That what the docs say is not what is actually meant? -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: howto view slapd configuration : ldapsearch VS slapcat
by Sébastien Bernard 20 Oct '11

20 Oct '11

Le 19/10/2011 15:51, Olivier Guillard a écrit : > Hi Seb, > > Isn't there any way to pass filters to slapcat see spécific > part of the configuration ? > >>> ldapsearch -x -LLL -D uid=admin,cn=config -W -s sub -b "cn=config" >>> "(olcDatabase=*)" olcAccess > [snip ...] Unfortunately not. Slapcat is meant to dump the whole context. You can eventualy use a small perl script to sort the relevant nodes afterwards. Else ldapsearch with '*' '+' should give you all the attributes included in the database. ldapsearch -x -LLL -D uid=admin,cn=config -W -s sub -b "cn=config" "(olcDatabase=*)" '*' '+' The '+' adds the operational attributes. S. Bernard

3 4

Query filter on number of values in multi-valued attributes
by Nick Milas 19 Oct '11

19 Oct '11

A quick question: Is there a way to formulate a query filter to say: "Find all entries which include two or more values (or exactly n values) in attribute xYZ" or we must create a script to test? Thanks, Nick

2 1

syncrepl + slapd-relay + slapo-rwm some clarification needed
by Jeffrey Crawford 19 Oct '11

19 Oct '11

Hello all, We have a need to populate one of our replicas with mapped attributes long story short, using a ldap proxy to perform the mapping will not be sufficient since the attributes are being used by OpenLDAP itself. I've found that when setting up a slapd-relay to virtualize the suffix and then use rwm to perform the mapping I get the desired view. However when trying to replicate the content using a replication account things start acting weird I think mostly because syncrepl processes changes via logs and update instructions from the provider to the consumer. That being the case the syncrepl RefreshAndPersist actually changes the values from the original update instruction. Ergo the replica looking at the virtualized suffix (using relay) actually gets the attribute populated that I wanted mapped. Meaning the replica and the relay view don't agree rather the replica and the original data agree. I've found that if I use the syncrepl RefreshOnly the replica yields the desired results however that is performed on intervals so the data isn't immediately available. So Have I missed something on the RefreshAndPersist method that would also yield the desired results? Or is RefreshAndPersist always going to see the original change being made even if the underlying relay view shows the mapped attributes? Ugh the above is so complex to describe Below is an example to facilitate a quick explanation. ### Provider hdb database dn: cn=record,dc=suffix,dc=org cn: record attr1: value1 attr2: value2 attr3: value3 ### Provider relay database dn: cn=record,dc=suffix,dc=org,cn=mapped cn: record attr1: value1 attr2: value3 | | attr3: value2 | Values switched | #### { Replica Section } ##################################### ### replica from cn=mapped using RefreshAndPersist (Undesired) dn: cn=record,dc=suffix,dc=org cn: record attr1: value1 attr2: value2 attr3: value3 ### replica from cn=mapped using RefreshOnly (Desired) dn: cn=record,dc=suffix,dc=org,cn=mapped cn: record attr1: value1 attr2: value3 | | attr3: value2 | Values switched |

2 2

howto view slapd configuration : ldapsearch VS slapcat
by Olivier 19 Oct '11

19 Oct '11

Hello, I have trouble to use slapcat to browse in my slapd configuration? For example, with ldapsearch I use this to see ACL : ldapsearch -x -LLL -D uid=admin,cn=config -W -s sub -b "cn=config" "(olcDatabase=*)" olcAccess What would be the equivalent with slapcat (run with "-F /etc/openldap/slapd.d") ? Thanks --- Olivier

2 1

syncrepl provider not working after upgrade to 2.4.26
by Nick Milas 19 Oct '11

19 Oct '11

Hi, I have a syncrepl provider v2.4.22 working fine (the only provider in our organization). I upgraded with the same configuration to v2.4.26 and provider is not working (neither over ldaps: nor over ldap:). Otherwise connectivity is fine (with any ldap client) both with ldap and with ldaps. I get (in all consumers): Oct 17 21:21:32 vmail slapd[14621]: do_syncrep2: rid=111 LDAP_RES_SEARCH_RESULT Oct 17 21:21:32 vmail slapd[14621]: do_syncrep2: rid=111 LDAP_RES_SEARCH_RESULT (53) Server is unwilling to perform Oct 17 21:21:32 vmail slapd[14621]: do_syncrep2: rid=111 (53) Server is unwilling to perform Oct 17 21:21:32 vmail slapd[14621]: do_syncrepl: rid=111 rc -2 retrying How can I troubleshoot the issue further? Current config on the provider is: overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 and on consumers: syncrepl rid=111 provider=ldaps://ldap.example.com tls_reqcert=never type=refreshAndPersist retry="60 +" searchbase="dc=example,dc=com" schemachecking=off bindmethod=simple binddn="cn=someuser,dc=example,dc=com" credentials="password" Thanks, Nick

4 6

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical