openldap-technical

openldap-technical@openldap.org

13 participants
9906 discussions

ldappasswd -T
by David Dumortier 22 Sep '11

22 Sep '11

Hello, I tried to set a password with the -T option. It failed so I tried -d 11 to see the dump in hexa. I discovered that a 0xa is append to the password. Is it a bug ? if so please confirm I will open a bugreport. Version : squeeze/debian -- David Dumortier

3 4

slapo-pcache and multiple hits won't cache
by turbo＠bayour.com 21 Sep '11

21 Sep '11

I'm using slapd-meta to merge a proxied AD (proxy is OL running on 'hidden' port) with a external OL server (running on separate host). The meta seems to work, using '(uid=kpxb140)' (which is my UNIX account name at work) gives me two results, one from the AD and one from the external OL server. This is verified, because the objects look different (and comparing them with the 'original' source verifies this as well). But on top (tail) of that, I'm using pcache... The afformentioned search gives: QUERY NOT ANSWERABLE QUERY CACHEABLE each time (i.e., it doesn't actually write to the cache). A modified search '(&(objectClass=account)(uid=kpxb140))' or '(&(objectClass=person)(uid=kpxb140))' gives only ONE hit (the first from the OL server, the second from AD). This time I get the correct behaviour - it is cached into BDB... Is this expected behaviour or a bug? If the latter, ITS# and expected fix?

2 2

ldap && rwm && pcache && transparent
by Turbo Fredriksson 20 Sep '11

20 Sep '11

I'm trying to proxy an AD and an OpenLDAP server on a separate machine to get a 'combined' view. First problem (or the primary one?) is that the DN doesn't match. AD: cn=turbo,ou=Office,ou=Users,ou=org1,dc=org2,dc=company,dc=tld OL: uid=turbo,ou=People,dc=org3,dc=company,dc=tld We have absolutely no write/modify access to the AD (we barely got search/compare access to parts of the AD! And the OL server... There's way to much work to modify (as in massaging the DB and reload it) that (at the moment). It's also running 2.3 at the moment, and we don't want to upgrade that any time soon. The theory is/was to: 1. Setup a LDAP/META proxy to the AD to act as the 'local' DB. 2. Rewrite the AD DNs to match the OL DB 3. Cache some common queries 4. Glue the OL DB with the AD DB, the OL acting as the 'remote' DB. Unfortunately, I can't get step four to work. Any queries seem to loop to the localhost. I guess I could use rwm on the OL server to massage the DN (before it's presented to clients and the proxy), but I much rather do any rewrite etc on my new proxy server if possible. OR Setup a second OL server on the current OL server, but on a different port (hidden), which proxies the main OL and rewrites the DN to match the AD. This hidden server could then be proxied by the new LDAP proxy, cached etc... But either of the alternative solution isn't pretty :). I'll have to maintain and support THREE LDAP servers (one DB and two proxies), which seems a little to much work. And besides, the OL have all the UNIX (posixAccount etc) stuff (only), with very few users (most of the organization don't need UNIX accounts) and most of the clients is configured to use that when searching etc. There's also other reasons why we would like to keep the OL server layout... Parts of my slapd.conf: ####################################################################### database ldap suffix "dc=company,dc=tld" rootdn "cn=Manager,dc=company,dc=tld" rootpw "secret" # --------------------------------------------------------------------- ##### Active Directory Server (will act as LOCAL DB) uri ldap://ad.company.tld idassert-bind bindmethod=simple binddn ="cn=unixldap,ou=service,ou=users,ou=selud,dc=rd,dc=company,dc=tld" credentials="Secret1" mode=none idassert-authzFrom "*" # --------------------------------------------------------------------- #### Rewrite/Remap # http://www.openldap.org/its/index.cgi/Software%20Bugs?id=5941#followup7 overlay rwm rwm-rewriteEngine yes rwm-normalize-mapped-attrs yes rwm-map attribute uid sAMAccountName rwm-map attribute gecos displayName rwm-map attribute workPhone telephoneNumber rwm-map attribute address1 streetAddress rwm-map attribute city l rwm-map attribute state st rwm-map attribute zip postalCode rwm-map attribute country co rwm-map attribute c country rwm-map attribute distinguishedName entryDN rwm-map objectclass inetOrgPerson user rwm-map objectclass groupOfNames group rwm-rewriteContext searchEntryDN rwm-rewriteRule "cn=(.*)?ou=Office,ou=Users,ou=ORG1,dc=ORG2,(.*)" "uid=$1ou=People,dc=ORG3,$2" ":@" rwm-rewriteContext searchAttrDN alias searchEntryDN rwm-rewriteContext matchedDN alias searchEntryDN # --------------------------------------------------------------------- #### Proxy Cache overlay pcache pcache hdb 2500 3 1 300 pcacheAttrset 0 uid uidNumber gidNumber cn sn givenName distinguishedName pcacheAttrset 1 c physicalDeliveryOfficeName streetAddress mail pcacheAttrset 2 uid uidNumber gidNumber cn sn givenName distinguishedName c physicalDeliveryOfficeName streetAddress mail pcacheTemplate (uid=) 0 3600 pcacheTemplate (cn=) 0 3600 pcacheTemplate (|(uid=)(cn=)) 0 3600 pcacheTemplate (|(cn=)(uid=)) 0 3600 pcacheTemplate (objectClass=) 2 3600 pcacheTemplate (|(objectClass=)(cn=)) 2 3600 pcacheTemplate (gecos=) 1 3600 pcacheTemplate (&(sn=)(givenName=)) 1 3600 cachesize 20 directory /usr/local/turbo/var/openldap-data index objectClass eq index cn,sn,uid,mail pres,eq,sub # --------------------------------------------------------------------- #### Translucent Proxy overlay translucent translucent_strict yes #translucent_local uid,uidNumber,gidNumber,cn,sn,givenName,distinguishedName,mail #translucent_remote uid,uidNumber,gidNumber,cn,sn,givenName,distinguishedName,mail ### OpenLDAP Server (will act as REMOTE DB) uri "ldap://ol.company.tld/" network-timeout 3 chase-referrals no acl-bind binddn="cn=Manager,dc=company,dc=tld" credentials="secret" idassert-bind bindmethod=simple binddn="cn=Manager,dc=company,dc=tld" credentials="Secret2" mode=none idassert-authzFrom "*" ####################################################################### Disclaimer: Much of this haven't been optimized yet. I'll fine tune and tweak stuff once I could get it to work... -- Life sucks and then you die

2 2

slapindex with translucent overlay
by Hugo Monteiro 20 Sep '11

20 Sep '11

Hello, I have recently discovered that i'm not using the indexes i should, in one translucent overlay database, for the locally stored attributes. This being a production server, i would like to know if changing index configuration and running slapindex on that database is enough to reindex the data. Regards, Hugo Monteiro. -- fct.unl.pt:~# cat .signature Hugo Monteiro Email : hugo.monteiro(a)fct.unl.pt Telefone : +351 212948300 Ext.15307 Web : http://hmonteiro.net Divisão de Informática Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa Quinta da Torre 2829-516 Caparica Portugal Telefone: +351 212948596 Fax: +351 212948548 www.fct.unl.pt apoio(a)fct.unl.pt fct.unl.pt:~# _

2 3

slapd crash on bad indexed translucent
by Hugo Monteiro 20 Sep '11

20 Sep '11

Hello, I would like to report that i have been able to replicate a crash on slapd. Problem was noticed when performing a substring query on a translucent overlay database attribute, locally stored, which only had equality index. slapd version is 2.4.23 (debian squeeze slapd-2.4.23-7.2) on an amd64 xen vm. Should i file an ITS for this one? Regards, Hugo Monteiro. -- fct.unl.pt:~# cat .signature Hugo Monteiro Email : hugo.monteiro(a)fct.unl.pt Telefone : +351 212948300 Ext.15307 Web : http://hmonteiro.net Divisão de Informática Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa Quinta da Torre 2829-516 Caparica Portugal Telefone: +351 212948596 Fax: +351 212948548 www.fct.unl.pt apoio(a)fct.unl.pt fct.unl.pt:~# _

2 1

Double passwords in accounts
by Nick Milas 20 Sep '11

20 Sep '11

Hello, Based on the fact that the userPassword attribute is NOT single-valued in the schema definition, I was wondering whether there are cases where we could use a double-password approach or if doing that would just cause a mess. For example, could we store both a clear-text password (to be used e.g. in DIGEST authentication) AND an encrypted (SSHA or MD5) one for standard use? If that could work, (I assume that) openldap would know which one to use based on the negotiation with the client application, which would normally try different authentication methods in a particular order. Openldap would then use the right password automatically (ideally), depending on the authentication method used each time. Any info would be appreciated. Thanks, Nick

2 2

What expect to log at info level?
by Nick Urbanik 20 Sep '11

20 Sep '11

Dear Team, I'm using CentOS 5, some machines with OpenLDAP 2.3.43-12, some with 2.4.23-15, on both 32 and 64-bit architectures. I am puzzled by the lack of logging I see. In all cases, I am using slapd.conf OpenLDAP configuration. I am running slapd with the option -l local0: # ps auxwww | grep slap[d] ldap 17866 0.0 1.7 242104 9000 ? Ssl 15:54 0:00 /usr/sbin/slapd -h ldap:/// -u ldap -l local0 With this in /etc/syslog.conf: local0.info -/var/log/ldap and this: # grep loglevel /etc/openldap/slapd.conf loglevel -1 I get nothing logged when I restart OpenLDAP, nor when I search (and get output). However, if I change the /etc/syslog.conf entry to: local0.* -/var/log/ldap I get plenty of output into /var/log/ldap. QUESTIONS: 1. What should I expect to be logged at info priority with loglevel -1? 2. Does anyone have any suggestions of what I may be missing here? -- Nick Urbanik http://nicku.org 808-71011 nick.urbanik(a)optusnet.com.au GPG: 7FFA CDC7 5A77 0558 DC7A 790A 16DF EC5B BB9D 2C24 ID: BB9D2C24 I disclaim, therefore I am.

5 12

open LDAP + TLS/SSL mini draft howto
by Olivier 19 Sep '11

19 Sep '11

Vijay, This may help. Check that each file is properly readable Best --- Olivier ---------- Forwarded message ---------- From: Olivier <ldap(a)guillard.nom.fr> Date: Thu, Aug 11, 2011 at 2:23 PM Subject: tls extra mini howto To: openldap-technical(a)openldap.org Having spent quite some time to make a TLS work I thought this may be usefull to some : 1/ Create a self CA certificate : a/ create the CA.key private key : $ openssl genrsa -des3 -out CA.key 1024 b/ create the CA.crt certificate : $ openssl req -new -key CA.key -x509 -days 1095 -out CA.crt 2/ for each ldap server (if you have more than one) create a certificat : a/ create the server.key private key : openssl genrsa -out server.key b/ create a server.csr certificate request: openssl req -new -key server.key -out server.csr c/ create the server.crt certificate signed by your own CA : openssl x509 -req -days 2000 -in server.csr -CA CA.crt -CAkey CA.key -CAcreateserial -out server.crt 3/ configure slapd.conf ( the correct "server.key" and "server.crt" files must be copied on each server): TLSCACertificateFile /etc/openldap/cacerts/CA.crt TLSCertificateFile /etc/openldap/cacerts/server.crt TLSCertificateKeyFile /etc/openldap/cacerts/server.key TLSCipherSuite HIGH:MEDIUM:+SSLv2 # personnally, I only check servers from client. # If you do, add this : TLSVerifyClient never 4/ on clients : copy CA.crt to the right place ( normally should be somewhere in /etc/pki..), and add this in ldap.conf : TLS_CACERT /etc/openldap/cacerts/CA.crt If you use sssd, add this in /etc/sssd/sssd.conf : lldap_tls_cacert = /etc/openldap/cacerts/CA.crt ldap_tls_reqcert = demand Then you can test using ldapsearch with -Z Best --- Olivier NOTE : I have'nt been able to make it work with mozilla certutil

1 0

Re: open LDAP + TLS/SSL bind Failed.
by vijay s sheelavantar 19 Sep '11

19 Sep '11

Thank you very much Buchan. I have changed the certificate creation method. Now I created the certificates using CA.sh of openssl.I followed the instruction given in the below link to create the certificates. http://octaldream.com/~scottm/talks/ssl/opensslca.html 1. At the server side now i am able to do ldapsearch and ldapadd, as i have chenged the /usr/local/etc/openldap/ldap.conf on server to remove IP address. I have made necessary changes in /etc/hosts file also. BASE    dc=samsung,dc=comURI     ldaps://localhost.localdomain/TLS_CACERT      /etc/pki/CA/cacert.pemTLS_CACERTDIR   /etc/pki/CA/ 2.slapd.conf details for TLS are as follows TLSCipherSuite          HIGH:MEDIUM:+SSLv2:+SSLv3:RSATLSCACertificatePath    /etc/pki/CA/TLSCACertificateFile    /etc/pki/CA/cacert.pemTLSCertificateFile      /etc/pki/tls/misc/newcert.pemTLSCertificateKeyFile   /etc/pki/tls/misc/newkey.pemTLSVerifyClient         allow 3. I have copied the "cacert.pem" which is CA and "newcert.pem" which my server certificate to the client machine. I have copied these files to /etc/openldap/cacerts directory on client machine. and I have made the following configuration changes to "/etc/ldap.conf" file at the client side. base dc=samsung,dc=comuri ldaps://localhost.localdomain/tls_cacertfile  /etc/openldap/cacerts/cacert.pemtls_cert /etc/openldap/cacerts/newcert.pempam_password md5nss_map_attribute gecos description When the "TLSVerifyClient  allow" is specified in slapd.conf, I am able to login to the client machine properly, authentication is succesful. but when "TLSVerifyClient  demand" and when I try to login to the client machine the authentication is failing. I am getting the following error at the server side. TLS trace: SSL3 alert write:fatal:handshake failureTLS trace: SSL_accept:error in SSLv3 read client certificate BTLS: can't accept: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate.connection_read(12): TLS accept failure error=-1 id=1005, closingconnection_closing: readying conn=1005 sd=12 for closeconnection_close: conn=1005 sd=12daemon: activity on 1 descriptordaemon: activity on:daemon: removing 12conn=1005 fd=12 closed (TLS negotiation failure) please let me know where i am making mistake? how can i correct this and make it work properly? Thanks & Regards,Vijay S.

1 0

Re: LDAP Dynamic Library Creation Failed.
by vijay s sheelavantar 19 Sep '11

19 Sep '11

I checked in the config.log file it's really a huge file. I found few errors. which are as below. configure:10558: checking for shl_load in -ldldconfigure:10583: /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -o conftest -g -O2 -I/product/wibro/premium/src/APP/Protocols/ASNGW/vijay/db-4.8.26/build_unix -Bshareable conftest.c -ldld   >&5/opt/montavista/pro/devkit/mips/fp_be/bin/../lib/gcc-lib/mips-hardhat-linux/3.3.1/../../../../mips-hardhat-linux/bin/ld: cannot find -ldldcollect2: ld returned 1 exit status configure:15013: /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -o conftest -g -O2 -I/product/wibro/premium/src/APP/Protocols/ASNGW/vijay/db-4.8.26/build_unix -Bshareable conftest.c  -lrpcrt4 >&5conftest.c:88: error: parse error before "UuidCreate"conftest.c:88: warning: data definition has no type or storage classconftest.c:89: error: parse error before "UuidToStringA"conftest.c:89: warning: data definition has no type or storage classconfigure:15013: $? = 1 configure:19146: /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -o conftest -g -O2 -I/product/wibro/premium/src/APP/Protocols/ASNGW/vijay/db-4.8.26/build_unix -Bshareable conftest.c  -pthread -lresolv  >&5conftest.c:106: error: parse error before "rwlock"conftest.c:106: warning: data definition has no type or storage class conftest.c:125: error: too many arguments to function `ctime_r'conftest.c:133: error: too few arguments to function `gethostbyname_r'conftest.c:136: error: too few arguments to function `gethostbyaddr_r' onfigure:22645: /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -c -g -O2 -I/product/wibro/premium/src/APP/Protocols/ASNGW/vijay/db-4.8.26/build_unix conftest.c >&5conftest.c: In function `main':conftest.c:170: error: parse error before ')' token conftest.c:173: error: size of array `test_array' is negative conftest.c:247: error: structure has no member named `msg_accrightslen' Is there any problem with the libtool? I am not quite familiar with libtool.  

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical