openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

Question to smbldap-tools
by Andreas Rudat 02 Oct '11

02 Oct '11

Hi, does anyone knows a patch for the "Password" problem? I mean that's saved in cleartext, I tried to add some code to ask for the pass instead of "read it from file" but I got errors after my input. I dont have any perl skills. Andreas

2 1

tunning search with less tha filter
by CHIROSSEL, Olivier 30 Sep '11

30 Sep '11

Hi i have to found entry with this filter in my ldap : (&(statusprefix=free)(datefinjachere<=20110926)) i defined the datefinjachere attribut like this attributetype ( 1.3.6.1.4.1.11594.1.2.5.1.7 NAME 'datefinjachere' DESC 'datefinjachere' EQUALITY numericStringMatch SUBSTR numericStringSubstringsMatch ORDERING numericStringOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.36{8} SINGLE-VALUE ) and i declare in my slapd.conf : index datefinjachere eq index statusprefix eq in the base where i search there is 1024 entry which corresponding or not at the filter a search take 200 millisecondes for the moment, could someone tell me if there is some tunning configuration for better performances ? i see when i log with debug Sep 26 17:53:09 olivier slapd[3402]: => bdb_presence_candidates (datefinjachere) Sep 26 17:53:09 olivier slapd[3402]: <= bdb_presence_candidates: (datefinjachere) not indexed perhaps i have to put index datefinjachere pres,eq in my conf ? my *.bdb file take 2G on the disk and i declare 500M of cache berkeley in my myconf bdb4.8 openldap 2.4.23 in advance, thank you for your time Regards, Olivier

1 1

30 Sep '11

Hi,I am using openldap-2.4.26 on one machine, and pam_ldap-186 and nss_ldap-265 on another machine, both machines running Fedora-10. I am trying for a secure communication using TLS/SSL. when I try to connect to the LDAP client machine using SSH, after authentication success the shell prompt is returned after 3 min or 4 mins. I don't know why it is taking so much time. This is happening for the users which are present only in LDAP database i.e. this user is not created on the client machine. At the server side I am getting following errors. TLS: can't accept: (unknown).connection_read(18): TLS accept failure error=-1 id=1068, closingconnection_closing: readying conn=1068 sd=18 for closeconnection_close: conn=1068 sd=18daemon: removing 18conn=1068 fd=18 closed (TLS negotiation failure)daemon: epoll: listen=7 active_threads=0 tvp=NULLdaemon: activity on 1 descriptordaemon: activity on:daemon: epoll: listen=7 active_threads=0 tvp=NULL I have created the CA certificate with CA.sh script. I followed the procedure given below.http://octaldream.com/~scottm/talks/ssl/opensslca.html I copied the same cacert.pem file from server to the client machine afte running the above procedure on server machine. The configuration files are as follows.slapd.conf include         /usr/local/etc/openldap/schema/core.schemainclude         /usr/local/etc/openldap/schema/cosine.schemainclude         /usr/local/etc/openldap/schema/inetorgperson.schemainclude         /usr/local/etc/openldap/schema/nis.schema LSCipherSuite          HIGH:MEDIUM:+SSLv2:+SSLv3:RSATLSCACertificateFile    /etc/pki/CA/cacert.pemTLSCertificateFile      /etc/pki/tls/misc/newcert.pemTLSCertificateKeyFile   /etc/pki/tls/misc/newkey.pemTLSVerifyClient         allow pidfile         /usr/local/var/run/slapd.pidargsfile        /usr/local/var/run/slapd.args access to attrs=userPassword by self       write by anonymous  auth by *          none access to * by *         read######################################################################## BDB database definitions####################################################################### database        bdbsuffix          "dc=samsung,dc=com"rootdn          "cn=Manager,dc=samsung,dc=com"# Cleartext passwords, especially for the rootdn, should# be avoid.  See slappasswd(8) and slapd.conf(5) for details.# Use of strong authentication encouraged.rootpw          123qwe# The database directory MUST exist prior to running slapd AND# should only be accessible by the slapd and slap tools.# Mode 700 recommended.directory       /usr/local/var/openldap-data# Indices to maintain#unique id so equality match onlyindex   uid     eqindex   userPassword    eq#allows general searching on commonname,givenname and mailindex   cn,gn,sn,ou,o,mail eq,subindex   objectClass     eq and ldap.conf has the following configuration base dc=samsung,dc=comuri ldaps://localhost.localdomain/tls_cacertfile  /etc/pki/CA/cacert.pempam_password md5nss_map_attribute gecos description Please let me know where I am making mistake? how to fix this problem. Warm RegardsVijay S.

2 1

lastbind overlay issue
by Mudimbi, Satish (VDSS) 30 Sep '11

30 Sep '11

Hi, I have built the last bind overlay and followed the steps. I get an error line 63 (overlay lastbind) overlay "lastbind" not found /usr/local/etc/openldap/slapd.conf: line 63: <overlay> handler exited with 1! What did it do wrong? Here is the information of my LDAP Libexec/openldap has all the files [root@pacman openldap]# ls -l /usr/local/libexec/openldap total 28 -rwxr-xr-x 1 root root 808 Sep 29 09:18 lastbind.la -rwxr-xr-x 1 root root 324 Sep 29 09:18 lastbind.lo -rwxr-xr-x 1 root root 4440 Sep 29 09:18 lastbind.o slapd.conf file # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: [root@pacman openldap]# ls -l /usr/local/libexec/openldap total 28 -rwxr-xr-x 1 root root 808 Sep 29 09:18 lastbind.la -rwxr-xr-x 1 root root 324 Sep 29 09:18 lastbind.lo -rwxr-xr-x 1 root root 4440 Sep 29 09:18 lastbind.o modulepath /usr/local/libexec/openldap moduleload back_bdb.la moduleload back_hdb.la moduleload back_ldap.la moudleload lastbind.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to * by self write by users read by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "o=DSS,c=US" overlay lastbind lastbind-precision 604800 rootdn "cn=Manager,o=DSS,c=US" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND Thanks, Satish

1 0

Referral record presonse
by Roy Lam 30 Sep '11

30 Sep '11

Dear All, I have two ldap servers.sever a and server are two separate server. server a has a record refer to server b. After a search. server a indicate that b only have 1000 record which should more than that. How Can I fix it? Roy

1 0

How do you have LDAP Setup for Apps
by criderkevin＠aol.com 29 Sep '11

29 Sep '11

I'm learning and testing different ways of configure my LDAP to handle multiple apps. I gave up on groupofnames because I couldn't get searches to pull out the Users in a Group. I have probably 6 or so apps that will use the LDAP. I am leaning towards a simple structure, where each app has it's own branch in the LDAP. My reasoning is: it's easy to configure, may make ACL's easier to setup and manage, it will make searches easier to setup and test, and...why not...after all this isn't a database and duplicated "people" records don't matter. We may end up with 2 synching LDAPS, one for our network and email, and the other for our other apps, simply because the email system requires a very specific structure. Just curious to hear from the more experienced what they do in their structure to handle multiple apps, and how sound my thinking is.

6 6

pwcheck module for slapo-ppolicy
by Lukas Grässlin 29 Sep '11

29 Sep '11

Hi there, I wrote a new pwcheck module for the slapo-ppolicy overlay which is able to handle multiple different policies. My problem was: I have multiple password policies which are applied to different users. The policies differ in strength etc. The problem was that with the only pwcheck modul you can find on the net (https://ltb-project.org/svn/openldap-ppolicy-check-password/trunk/) you just define one 'policy-thing' which will be checked if check-password.so is run. I wanted to have something were you also can define multiple policies which also can differ, so I wrote my own module which reads two config files: $CONFDIR/ppolicies: There are the policies defined. Example: [Default] min_len = 8 min_digit = 1 min_lower = 1 min_special = 1 min_upper = 1 $CONFDIR/users: These file holds the relation between users and policies: uid=lukas,ou=People,dc=example,dc=com : Default Well, it would have been nicer if that policy definition & co would also be stored in ldap, but the config-file-way was the faster one as it had to be finished quick. Whatever, maybe some of you could need this or improve it: http://dl.dropbox.com/u/32193848/pwcheck.tar.bz2 You have to build it within ldap (like the old one). So put it there: $ldapsrcdir/contrib/slapd-modules -- Lukas Grässlin Software Developer Collax GmbH . Basler Str. 115a . 79115 Freiburg . Germany p: +49 (0) 89-990 157-23 Collax - Flexible IT. Geschäftsführer: Bernd Bönte, Boris Nalbach Amtsgericht München, HRB 173695 USt-ID: DE270819312

3 3

Pass-Through Authentication
by Tim Gustafson 28 Sep '11

28 Sep '11

How hard would it be to create a new pass-through authentication mechanism (something other than SASL) for OpenLDAP? Can this be done in an overlay? The reason I ask is that I'm investigating using two-factor authentication. If I understand the marketing materials correctly, both the RSA SecureID system and the WiKID system expose a RADIUS server that clients can authenticate with. The suggested set-up seems to be: OpenLDAP -> SASL -> pam -> RADIUS (on 3rd party token server) This seems like a lot of intermediaries, and a lot of potential "breaking" points. I wonder if there isn't any way to just cut the middle man out, so to speak, and have OpenLDAP talk directly to a RADIUS server, eliminating the other layers inbetween: OpenLDAP -> RADIUS (on 3rd party token server) Perhaps a password scheme like: {RADIUS}user@radius-server I've worked with RADIUS before, and it's not all that bad from a client implementation perspective, especially if you ignore the challenge/response part of the protocol (which most simple authentication services seem to do). Or should I just shut up and use the first method? :) -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Tim Gustafson tjg(a)soe.ucsc.edu Baskin School of Engineering 831-459-5354 UC Santa Cruz Baskin Engineering 317B -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

3 3

keep posixGroup, memberUID and groupOfNames with member synchronous
by andreas.moroder＠sb-brixen.it 28 Sep '11

28 Sep '11

Hello, for samba, pam on linux, squid and others we use the standard posixGroup with memberUID attributes for the groupmemebershios. Now we would like to user the LDAP autentication module in the checkpoint firewall. This expects the members of a group as groupOfNames member attributes with the full dn . Is there a way to configure openLDAP to keep keep the groupofNames automatically in sync with the posixGroup ? Thanks Andreas

2 1

OpenLDAP Proxy to Active Directory
by Allen, Dedrick 28 Sep '11

28 Sep '11

I am currently attempting to configure our OpenLDAP 2.4.26 (on SUSE Enterprise 10) server to act as an proxy to Active Directory as well as using a local database. The local database works fine but I cannot for the life of me get the ldap backend to authenticate/bind correctly to the AD ldap server. I can use ldapsearch to search AD just fine with the credentials passed as follows: ldapsearch -x -h ldap.mydomain.com -D 'myldapuser' -w 'myldappw' -b 'dc=mydomain,dc=com' '(sAMAccountName=myusername)' Returns all the associated data of "myusername" from AD. Here is the section of my slapd.conf for my databases and backends. I have read several different sites on how to configure this and they all use different methods and claim it works for them. None has worked for me. I continue to get bind errors. Any guidance would be much appreciated. database bdb suffix dc=zlinux,dc=mydomain,dc=com rootdn cn=admin,dc=zlinux,dc=mydomain,dc=com rootpw myrootdnpw directory /usr/local/openldap/var/openldap-data index objectClass,uidNumber,gidNumber eq index cn,sn,uid,displayName pres,sub,eq index memberUid,mail,givenname eq,subinitial # # database ldap suffix "dc=Company Users,dc=mydomain,dc=com" uri ldap://ldap.mydomain.com idassert-bind bindmethod=simple binddn="cn=myldapuser,dc=Company Service Accounts,dc=mydomain,dc=com" credentials=myldappw mode=none idassert-authzFrom "dn.exact:cn=cn=myldapuser,dc=Company Service Accounts,dc=mydomain,dc=com" chase-referrals no overlay rwm rwm-map objectclass account user rwm-map attribute uidNumber employeeID rwm-map attribute uid sAMAccountname rwm-map attribute cn name rwm-map attribute sn sn rwm-map attribute mail mail rwm-map attribute company company rwm-map attribute entry entry rwm-map attribute userPassword unicodePassword rwm-map attribute * Thanks Dedrick ----------------------------------------------------- Please see the following link for the BlueCross BlueShield of Tennessee E-mail disclaimer: http://www.bcbst.com/email_disclaimer.shtm

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical