openldap-technical

openldap-technical@openldap.org

9 participants
9873 discussions

OpenLDAP 2.4.23 - Syncrepl - TLS Trouble
by Alexey Tyurikov 14 Sep '11

14 Sep '11

Dear OpenLDAP experts, I'm about to setup an OpenLDAP server with the following features: - TLS/SSL with self-signed certificates - TLS-encrypted N-way replication (Syncrepl) My environment: - 2 x RHEL 6.0 - OpenLDAP 2.4.23 I try to sync both databases: cn=config and backend-db. The problem is that I'm not able to turn on TLS for both sync-connections at the same time. It works for each connection but only if the second one is unencrypted. Working configuration: ----- olcDatabase={0}config,cn=config ... olcSyncrepl: {0}rid=001 provider=ldap://ldapserver1.com binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=002 provider=ldap://ldapserver2.com binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 ... olcDatabase={1}bdb,cn=config ... olcSyncrepl: {0}rid=003 provider=ldap://ldapserver1.com binddn="cn=manager,dc=ldap,dc=com" bindmethod=simple credentials=password searchbase="dc=ldap,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes tls_cacert=/etc/openldap/cacerts/ca.pem olcSyncrepl: {1}rid=004 provider=ldap://ldapserver2.com binddn="cn=manager,dc=ldap,dc=com" bindmethod=simple credentials=password searchbase="dc=ldap,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes tls_cacert=/etc/openldap/cacerts/ca.pem ----- (desired) Configuration, which doesn't work: ----- olcDatabase={0}config,cn=config ... olcSyncrepl: {0}rid=001 provider=ldap://ldapserver1.com binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 starttls=yes tls_cacert=/etc/openldap/cacerts/ca.pem olcSyncrepl: {1}rid=002 provider=ldap://ldapserver2.com binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 starttls=yes tls_cacert=/etc/openldap/cacerts/ca.pem ... olcDatabase={1}bdb,cn=config ... olcSyncrepl: {0}rid=003 provider=ldap://ldapserver1.com binddn="cn=manager,dc=ldap,dc=com" bindmethod=simple credentials=password searchbase="dc=ldap,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes tls_cacert=/etc/openldap/cacerts/ca.pem olcSyncrepl: {1}rid=004 provider=ldap://ldapserver2.com binddn="cn=manager,dc=ldap,dc=com" bindmethod=simple credentials=password searchbase="dc=ldap,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes tls_cacert=/etc/openldap/cacerts/ca.pem ----- /etc/openldap/cacerts/ca.pem contains CA certificates of both servers. What is wrong? I would be very thankful for every advise.

2 1

Re: How to disable cn=config module in OpenLDAP
by pradyumna dash 14 Sep '11

14 Sep '11

Hi, Yes i tried below ldapsearch -x -h l <http://somehost.com/>dap1.example.com -b cn=Manager,dc=example,dc=com It asked me to provide the password i have provided that then it shows the same error, nothing came up. I have checked my ldap.conf as well it looks okay. Regards, Neo On Wed, Sep 14, 2011 at 6:41 PM, Bill MacAllister <whm(a)stanford.edu> wrote: > > > --On Wednesday, September 14, 2011 06:35:09 PM +0200 pradyumna dash < > neomatrixgem(a)gmail.com> wrote: > > Hi, >> >> ldapsearch -x shows the content of LDAP database as well wothout any >> additional options. I can see the same in one of my servers,I took a dump >> of >> the running server by slapcat and restored the same in this server. >> >> I can see the data by slapcat but ldapsearch is not working. >> >> The box where ldap running fine its using slapd.d backend, but this server >> i >> have configured to run from slapd.conf file, can it be a issue with the DB >> backup and restore as they are both using different backend? >> >> Regards, >> Neo >> > > Did you even try my suggestion? The error message that you got back, i.e. > "32 no such object" is telling you that you have not supplied a baseDN > for the search. > > Bill > > P.S. Top posting to replies sucks. > > > On Wed, Sep 14, 2011 at 6:29 PM, Bill MacAllister <whm(a)stanford.edu> >> wrote: >> >> >>> >>> --On Wednesday, September 14, 2011 06:20:03 PM +0200 pradyumna dash < >>> neomatrixgem(a)gmail.com> wrote: >>> >>> I have fixed this by deleting the slapd.d and also changed the script to >>> >>>> read slapd.conf file but now >>>> >>>> when am trying ldapserach -x its showing 32 no such object >>>> >>>> but the below command works >>>> >>>> ldapsearch -LLL -Wx -D "cn=Manager,dc=mail,dc=domain,****dc=com >>>> >>>> why is that ? >>>> >>>> >>> Because you did it wrong. There is not enough information in your >>> message to tell much more than you contacted an LDAP server and >>> got an error message. You might want to try using a fully specified >>> search and work back from there. For example: >>> >>> ldapsearch -x -h somehost.com -b cn=sometree,dc=domain,dc=com >>> >>> Bill >>> >>> >>> Regards, >>> >>>> Neo >>>> On Wed, Sep 14, 2011 at 5:34 PM, pradyumna dash <neomatrixgem(a)gmail.com >>>> > wrote: >>>> >>>> Hi , >>>> >>>>> >>>>> Can i disable cn=config module, I just want to use plain old slapd.conf >>>>> file. How to disable that. So that LDAP wont use the directory. >>>>> >>>>> Am using SLES 11 SP1 and i tried deleteting the directory but if i am >>>>> unable to restart the service. >>>>> >>>>> Regards, >>>>> Neo >>>>> >>>>> >>>>> >>> >>> -- >>> >>> Bill MacAllister >>> Infrastructure Delivery Group, Stanford University >>> >>> >>> > > > -- > > Bill MacAllister > Infrastructure Delivery Group, Stanford University > >

2 1

secure passwords
by sim123 14 Sep '11

14 Sep '11

Hi All, I am trying to store SSHA passwords in openldap instead of plain text via C code and wondering how this works. I tried exploring archives, FAQ etc and what I gathered from there is openLDAP has built in support for various password encryption algorithm however it does not have any APIs for generating passwords and password-has directive works with ldpapassword utility only. http://www.openldap.org/faq/data/cache/906.html If I use some tool like Apache DS and modify my userPassword attribute to be SSHA instead of plain text it all works. I want to know how this works under the hood? Who is responsible for generating hashed passwords? If I generate it using some C routine how does LDAP Server retrieves it during the bind operation? I would really appreciate if there is any related documentation available. Thanks for the help and support.

4 10

Re: How to disable cn=config module in OpenLDAP
by pradyumna dash 14 Sep '11

14 Sep '11

Hi, ldapsearch -x shows the content of LDAP database as well wothout any additional options. I can see the same in one of my servers,I took a dump of the running server by slapcat and restored the same in this server. I can see the data by slapcat but ldapsearch is not working. The box where ldap running fine its using slapd.d backend, but this server i have configured to run from slapd.conf file, can it be a issue with the DB backup and restore as they are both using different backend? Regards, Neo On Wed, Sep 14, 2011 at 6:29 PM, Bill MacAllister <whm(a)stanford.edu> wrote: > > > --On Wednesday, September 14, 2011 06:20:03 PM +0200 pradyumna dash < > neomatrixgem(a)gmail.com> wrote: > > I have fixed this by deleting the slapd.d and also changed the script to >> read slapd.conf file but now >> >> when am trying ldapserach -x its showing 32 no such object >> >> but the below command works >> >> ldapsearch -LLL -Wx -D "cn=Manager,dc=mail,dc=domain,**dc=com >> >> why is that ? >> > > Because you did it wrong. There is not enough information in your > message to tell much more than you contacted an LDAP server and > got an error message. You might want to try using a fully specified > search and work back from there. For example: > > ldapsearch -x -h somehost.com -b cn=sometree,dc=domain,dc=com > > Bill > > > Regards, >> Neo >> On Wed, Sep 14, 2011 at 5:34 PM, pradyumna dash <neomatrixgem(a)gmail.com >> >wrote: >> >> Hi , >>> >>> Can i disable cn=config module, I just want to use plain old slapd.conf >>> file. How to disable that. So that LDAP wont use the directory. >>> >>> Am using SLES 11 SP1 and i tried deleteting the directory but if i am >>> unable to restart the service. >>> >>> Regards, >>> Neo >>> >>> > > > -- > > Bill MacAllister > Infrastructure Delivery Group, Stanford University > >

2 1

How to disable cn=config module in OpenLDAP
by pradyumna dash 14 Sep '11

14 Sep '11

Hi , Can i disable cn=config module, I just want to use plain old slapd.conf file. How to disable that. So that LDAP wont use the directory. Am using SLES 11 SP1 and i tried deleteting the directory but if i am unable to restart the service. Regards, Neo

2 2

Bind with attribute + RDN instead of DN
by sim123 13 Sep '11

13 Sep '11

Hi All, I want third party applications to authenticate against my ldap using any attribute (specially mail & password) is it possible to do a bind using any attribute with/without RDN rather then DN? For example my LDAP user looks like this : dn: uid=1,ou=users,dc=example,dc=local objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top cn: Josh sn: Cho mail: joshcho(a)example.com uid: 1 userPassword: joshcho I can bind to ldap if I use DN & password but I can not bind to ldap if I use any attribute like mail=joshcho(a)example.com,ou=users,dc=example,dc,local & password Would greatly appreciate any help. Thanks *simon*

3 5

Problem replicating ACL changes in back-config from master to slaves: SEGFAULT
by Uwe Werler 13 Sep '11

13 Sep '11

Hello list, I created a ldap master serving a ldif-db cn=config,cn=server for a bunch of slave servers replicating their config with suffixmassage cn=config. The master is 2.4.25 and the slaves are 2.4.25 and 2.4.26. If I change ACL's in the db definition of a bdb database at the master db cn=config,cn=server all slave servers segfault with: Error: closing the transaction region with active transactions slapd daemon: abnormal condition, shutdown initiated. slapd shutdown: waiting for 2 operations/tasks to finish Segmentation fault Any hint? Regards Uwe

1 0

Re: Need Help On Master-Master Replication Setup!!
by pradyumna dash 13 Sep '11

13 Sep '11

Hi, Thanks for the suggestion, but i never did it before , if you can share a doc or something would be great. I use the openssl to generate the certificate, so even i dont know how to configure subjectAltNames. Also if you can explain a bit how i should i proceed would be appreciated. Example : ldap1.example.com ldap2.example.com So in the load balancer what to configure and how to create the certificate. Please help. Regards, Pradyumna On Fri, Sep 9, 2011 at 7:35 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, September 08, 2011 10:17 PM +0200 pradyumna dash < > neomatrixgem(a)gmail.com> wrote: > > Hi, >> >> >> I would like to setup OpenLDAP Mater-Master replication, before that i >> would like to know something more about it, because i >> never implemented the same. >> >> >> Suppose i have 2 servers ldap1.example.com and ldap2.example.com >> >> >> I will configure M-M replication with LDAPS, in this scenario how my >> architecture should be? Do i need to keep it behind the loadbalancer or >> what are the steps to do it? >> How come the client will come to know if any of the server is down, it >> will talk to the other server, because in my ldap.conf file i will have a >> single URI/host entry >> pointing to one of the server and also how to create the certificate, do >> i need 2 individiual certificate 1 for ldap1 and 1 for ldap2? >> > > I would suggest a cert for ldap1 and ldap2, both with having > subjectAltNames for a load balanced name too, so clients can work directly > to the servers and directly with the LB name. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

3 11

OpenLDAP Windows setup
by Ashish Chawla 12 Sep '11

12 Sep '11

Hi, I installed OpenLDAP on windows XP by running the application installer. I am new to OpenLDAP and facing lots of issues while running client tools. Am not able to add new users or run utilities like slapcat.exe- it gives error: " slapcat: database doesn't support necessary operations". Can somebody tell me a quick way of adding users and organizations and also if there is a way of capturing the detailed errors. I know that I can get help from this forum only. Any help in this regard will be of great use to me. Thanks, Ashish Chawla ________________________________ ::DISCLAIMER:: ----------------------------------------------------------------------------------------------------------------------- The contents of this e-mail and any attachment(s) are confidential and intended for the named recipient(s) only. It shall not attach any liability on the originator or HCL or its affiliates. Any views or opinions presented in this email are solely those of the author and may not necessarily reflect the opinions of HCL or its affiliates. Any form of reproduction, dissemination, copying, disclosure, modification, distribution and / or publication of this message without the prior written consent of the author of this e-mail is strictly prohibited. If you have received this email in error please delete it and notify the sender immediately. Before opening any mail and attachments please check them for viruses and defect. -----------------------------------------------------------------------------------------------------------------------

1 0

Re: Change a user dn
by Juan Diego Calle 12 Sep '11

12 Sep '11

Ok, let me rephrase this, I have read many books, like O'reilly s LDAP system administratoro, or docs like Or http://tools.ietf.org/html/rfc4511#section-4.9, that explains this exactly The Modify DN operation allows a client to change the Relative Distinguished Name (RDN) of an entry in the Directory and/or to move a subtree of entries to a new location in the Directory. The Modify DN Request is defined as follows: ModifyDNRequest ::= [APPLICATION 12] SEQUENCE { entry LDAPDN, newrdn RelativeLDAPDN, deleteoldrdn BOOLEAN, newSuperior [0] LDAPDN OPTIONAL } Fields of the Modify DN Request are: - entry: the name of the entry to be changed. This entry may or may not have subordinate entries. - newrdn: the new RDN of the entry. The value of the old RDN is supplied when moving the entry to a new superior without changing its RDN. Attribute values of the new RDN not matching any attribute value of the entry are added to the entry, and an appropriate error is returned if this fails. I read the paragraph above, and it seems pretty straight forward, I believe I understand how it works, but when I try to apply this to what I need I dont know what to do. I can change the UID, or other fields from the users or groups, but i can change the dn. For me Openldap has being really hard to understand, it is really technical, usually i am really good at this stuff. I am pretty sure I have huge gaps of knowledge that requires more reading, and a better understanding of the standards. But that is why I usually ask here when I am stuck. This is usually the last place I resort when I dont have answers. Thanks, Juan Diego ----- Original Message ----- From: masarati(a)aero.polimi.it To: "Juan Diego Calle" <juandiego.calle(a)soportelibre.com> Cc: openldap-technical(a)openldap.org Sent: Monday, September 12, 2011 4:08:57 PM GMT -05:00 Colombia Subject: Re: Change a user dn You didn't try all combinations of parameters, you need to be exhaustive when doing trial and error, otherwise there is no guarantee you get to the right combination in a finite amount of time. Or, you can read RFC4511 and find out how to do things right the first time. p. > Hi thanks for the helo I have being tryinn a few things with ldapmodify, > > I need to modify the user from > dn: uid=user1,ou=People,dc=mydomain,dc=com, > to > dn: uid=user1,ou=Group1,ou=People,dc=mydomain,dc=com, > > I have try some of the following attempts > > dn: uid=user1,ou=People,dc=mydomain,dc=com > changetype: modify > replace: dn > dn: uid=user1,ou=Group1,ou=People,dc=mydomain,dc=com > > that according to what i have read it doesnt have work, because dn is not > exactly like an attribute > > dn: uid=user1,ou=People,dc=mydomain,dc=com > changeType: modrdn > newRDN: uid=user1,ou=Group1,ou=People,dc=mydomain,dc=com > deleteOldRDN: 1 > > and this ones gives me > > modifying rdn of entry "uid=user1,ou=People,dc=mydomain,dc=com" > rename completed > ldapmodify: Invalid DN syntax (34) > additional info: invalid new RDN > > I dont know how to add an ou to the dn. > > Thanks > > > > > > ----- Original Message ----- > From: "Andrey A. Konovalov" <mudraia(a)list.ru> > To: openldap-technical(a)openldap.org > Sent: Friday, September 9, 2011 12:43:01 PM GMT -05:00 Colombia > Subject: Re: Change a user dn > >> Hi >> >> I have Openldap with samba, and some users. >> My users are part of ou=People,dc=mydomain,dc=com, >> like this, >> dn: uid=user1,ou=People,dc=mydomain,dc=com, >> >> So i wanted some of my users to be able to administer a group of users >> and be able to create users, so a friend of mine recommended me to do >> the following, create a group like this >> >> dn: cn=Admin Group1,cn=Admins,ou=People,dc=mydomain,dc=com, >> objectClass: groupOfNames >> objectClass: top >> cn: Admin Group1 >> member: uid=adming1,ou=People,dc=mydomain,dc=com, >> >> and >> >> dn: ou=Group1,ou=People,dc=mydomain,dc=com >> objectClass: organizationalUnit >> objectClass: top >> ou: U.A.A. Group1 >> >> the users of this "group" whould have to be >> >> dn: uid=user1,ou=Group1,ou=People,dc=mydomain,dc=com, >> >> >> And with and acl I give Admin Group1 users complete control over that >> ou. >> >> >> So this seems to work. But I already have users that use my ldap, is it >> possible to change their dn, I am not clear on how to do this. >> >> Thanks, >> >> Juan Diego >> > > > Maybe, > (do it with ldapmodify, fex.) > dn: uid=user1,dc=tratata,dc=com > changeType: modrdn > newRDN: user2 > deleteOldRDN: 1 > > ??? > -- > Andrey A. Konovalov <mudraia(a)list.ru> > > >

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical