openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

Not able to run OpenLDAP in SLES11
by pradyumna dash 24 Sep '11

24 Sep '11

Hi, I am not able to run OpenLDAP, if am trying to configure it from slapd.conf file. Please find the configuration files as attached. When i run the below command i get the output ldapsearch -x -h 192.168,0.1 -D "cn=Manager,dc=example,dc=com" -b "dc=example,dc=com" -W but when i try either ldapsearch -x or ldapsearch -x -h 192.168.0.1 -b "cn=Manager,dc=example,dc=com" it shows : base <cn=Manager,dc=example,dc=com> with scope subtree filter: (objectclass=*) requesting: ALL #search result search: 2 result: 32 No such object #numResponse: 1 OS : SLES 11 SP1 LDAP : 2.4.20-0.4.29 What i have changed is insted of dynamic backend i am trying to use slapd.conf file so i have changed in /etc/sysconfig/openldap file OPENLDAP_CONFIG_BACKEND="files". Please suggest how to solve this. Regards, Neo

3 3

Unable to start slapd, syncrepl error
by William S. 23 Sep '11

23 Sep '11

Oh the wise and mighty of the openLDAP community, I have an issue that I have not been able to understand. Partially because Im an enthusitis, not an expert in the domain. That being said, I've used an openLDAP RPM compiled by one of the fellow *nix admins: http://staff.telkomsa.net/packages - Yes, besides the security reasons I'm desparate enough to try this. I'll eventually use the spec to compile my own RPM. I'm running CentOS 5.7 x86_64 with the latest packages. I was able to successfully install and configure openLDAP but when I attempt to start it with MIrrorMode, it will not start. I ran slaptest to figure out where it's hanging up on: [root@ldap1 ~]# slaptest2.4 -f /etc/openldap2.4/slapd.conf /etc/openldap2.4/slapd.conf: line 207: rootDN must be defined before syncrepl may be used slaptest2.4: bad configuration file! Any suggestions why it continues to complain about rootDN? I have it specified and if slapd is going through the lines, it should have picked up the rootdn before syncrepl. Thoughts? Here is my slapd.conf: include /usr/share/openldap2.4/schema/core.schema include /usr/share/openldap2.4/schema/cosine.schema include /usr/share/openldap2.4/schema/corba.schema include /usr/share/openldap2.4/schema/inetorgperson.schema include /usr/share/openldap2.4/schema/java.schema include /usr/share/openldap2.4/schema/krb5-kdc.schema include /usr/share/openldap2.4/schema/kerberosobject.schema include /usr/share/openldap2.4/schema/misc.schema include /usr/share/openldap2.4/schema/nis.schema include /usr/share/openldap2.4/schema/openldap.schema include /usr/share/openldap2.4/schema/autofs.schema include /usr/share/openldap2.4/schema/samba.schema include /usr/share/openldap2.4/schema/kolab.schema include /usr/share/openldap2.4/schema/evolutionperson.schema include /usr/share/openldap2.4/schema/calendar.schema include /usr/share/openldap2.4/schema/sudo.schema include /usr/share/openldap2.4/schema/dnszone.schema include /usr/share/openldap2.4/schema/dhcp.schema #include /usr/share/openldap2.4/schema/rfc822-MailMember.schema #include /usr/share/openldap2.4/schema/pilot.schema #include /usr/share/openldap2.4/schema/qmail.schema #include /usr/share/openldap2.4/schema/mull.schema #include /usr/share/openldap2.4/schema/netscape-profile.schema #include /usr/share/openldap2.4/schema/trust.schema include /etc/openldap2.4/schema/local.schema include /etc/openldap2.4/slapd.access.conf access to dn.subtree="dc=domain,dc=pvt" by group="cn=Replicator,ou=Group,dc=domain,dc=pvt" by users read by anonymous read pidfile /var/run/ldap2.4/slapd.pid argsfile /var/run/ldap2.4/slapd.args modulepath /usr/lib64/openldap2.4 # database backend modules available: #moduleload back_dnssrv.la #moduleload back_ldap.la #moduleload back_meta.la moduleload back_monitor.la #moduleload back_passwd.la #moduleload back_sql.la # overlay modules available: #moduleload accesslog.la #moduleload denyop.la #moduleload dyngroup.la #moduleload dynlist.la #moduleload glue.la #moduleload lastmod.la #moduleload pcache.la #moduleload ppolicy.la #moduleload refint.la #moduleload retcode.la #moduleload rwm.la moduleload syncprov.la #moduleload translucent.la #moduleload unique.la #contrib overlays #moduleload smbk5pwd.so # SASL config #sasl-host ldap.domain.com # To allow TLS-enabled connections, create /etc/ssl/openldap2.4/ldap.pem # and uncomment the following lines. #TLSRandFile /dev/random #TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCertificateFile /etc/pki/tls/private/ldap.pem TLSCertificateKeyFile /etc/pki/tls/private/ldap.pem #TLSCACertificatePath /etc/ssl/openldap2.4/ #TLSCACertificateFile /etc/ssl/cacert.pem TLSCACertificateFile /etc/pki/tls/private/ldap.pem #TLSVerifyClient never # ([never]|allow|try|demand) # logging #loglevel 256 ####################################################################### # database definitions ####################################################################### database bdb suffix "dc=domain,dc=pvt" #suffix "o=My Organization Name,c=US" rootdn "cn=Manager,dc=domain,dc=pvt" #rootdn "cn=Manager,o=My Organization Name,c=US" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg rootpw {SSHA}[NeeeNer NeeeNer NeeeNer] # The database directory MUST exist prior to running slapd AND # should only be accessable by the slapd/tools. Mode 700 recommended. directory /var/lib/ldap2.4 # Tuning settings, please see the man page for slapd-bdb for more information # as well as the DB_CONFIG file in the database directory # commented entries are at their defaults # In-memory cache size in entries #cachesize 1000 # Checkpoint the bdb database after 256kb of writes or 5 minutes have passed # since the last checkpoint checkpoint 256 5 # Indices to maintain index objectClass eq # persion-type searches index cn,mail,surname,givenname eq,subinitial # nss_ldap exact searches: index uidNumber,gidNumber,memberuid,member,uniqueMember eq # username completion via nss_ldap needs uid indexed sub: index uid eq,subinitial # samba: index sambaSID,sambaDomainName,displayName eq # autofs: #index nisMapName eq # bind sdb_ldap: #index zoneName,relativeDomainName eq # sudo index sudoUser eq # syncprov #index entryCSN,entryUUID eq limits group="cn=Replicator,ou=Group,dc=domain,dc=pvt" size=unlimited time=unlimited database monitor overlay syncprov syncprov-checkpoint 10 1 syncprov-sessionlog 100 syncrepl rid=000 provider=ldap://ldap1.oak.domain.pvt type=refreshAndPersist interval=01:00:00:00 retry="5 5 300 +" rootdn="dc=domain,dc=pvt" attrs="*,+" bindmethod=simple binddn="cn=Manager,dc=domain,dc=pvt" credentials=domain1 syncrepl rid=001 provider=ldap://ldap2.oak.domain.pvt type=refreshAndPersist interval=01:00:00:00 retry="5 5 300 +" rootdn="dc=domain,dc=pvt" attrs="*,+" bindmethod=simple binddn="cn=Manager,dc=domain,dc=pvt" credentials=domain1 mirrormode TRUE serverID 1

2 1

Schema question... userPassword doesn't work
by John Tobin 23 Sep '11

23 Sep '11

To the ldap forum: I have loaded suse 12.1 m5. I have setup an openldap server, which was the main mission of this machine, and it works. It has ssl /tls, certificates are loaded, that works. I used ldap client to setup the ldap browser and that works also. This is the new 2.4.26 server, which has some rather major changes in how ldap is setup. After about 2 weeks I have that under control. My little domain is setup on dark.net [dc=dark,dc=net]. I used ldapadd to put in the administrator, and I have used ldapsearch to list the subschema. I took the default schema. The list of the subschema includes everything I would like to use. Now I want to go about the real business of defining users. I have reviewed a number of pages to ensure I am doing what appears to be the correct procedure, for instance : http://www.yolinux.com/TUTORIALS/LinuxTutorialLDAP-BindPW.html Which lists: File: fratbrother.ldif dn: cn=fratbrother,o=delta cn: fratbrother sn: fratbrother objectclass: top objectclass: person userPassword: fratsecret ldapadd -f fratbrother.ldif -cxv -D "cn=DeanWormer,o=delta" -w secret2 And other similar updates. But on my machine I create something simple like: File : dark.ldif dn: cn=jctobin,dc=dark,dc=net cn: jctobin userPassword: Hello1$ Ldapadd -x -D ³cn=admin,dc=dark,dc=net² -W -f dark.ldif Enter LDAP Password: Adding new entry ³cn=jctobin,dc=dark,dc=net² Ldap_add: Object class violation (65) Additional info: no objectClass attribute Obviously my ldap server does not like the ³userPassword² class. I have not been able to use any of the other classes I would like to either [ou: (organizational Unit), uid (unix term for a number corresponding to the user id), etc.] What have I not setup correctly? I need to get these users up and running. What can you do for me? Sincerely, Tob

2 1

Tutorial to make an overlay‏?
by Johan Jakus 23 Sep '11

23 Sep '11

Hello everyone, I'm Johan and I am in the final year of my studies in industrial engineering. For my stage, I've been asked to make an overlay for an OpenLDAP server. But, I can't find any documentation on how to make an overlay, could someone please redirect me to a tutorial or something likewise? I would really appreciate it! Thanks! Best regards, Johan

2 1

rwm + cn=config
by Frava 23 Sep '11

23 Sep '11

Hello, I use the rwm overlay to forward the authentication of some users to the general ldap replicas of my corp. Part of slapd.conf : ########################### ... overlay rwm rwm-rewriteEngine on rwm-rewriteContext bindDN rwm-rewriteMap ldap mysearch "ldap:// ldap.example.com:389/ou=users,dc=example,dc=com?dn?sub" rwm-rewriteRule "^uid=([^,]+),ou=people,dc=[^,]+,dc=example,dc=com$" "${mysearch((&(objectClass=posixAccount)(uid=$1)))}" ":@I" database ldap suffix "ou=users,dc=example,dc=com" uri "ldap://ldap.example.com:389/" restrict read write extended database bdb suffix "dc=example,dc=com" rootdn "cn=admin,dc=example,dc=com" rootpw mypassword directory /var/db/openldap-data/mydb ... ############################ Now I converted the 'slapd.conf' to 'cn=config' with slaptest, the remote authentication stopped working; and looking at cn=config, all the rules are there... Any Ideas ? Rafael NAVAZA.

2 2

schema question
by John Tobin 23 Sep '11

23 Sep '11

To the ldap forum: I have loaded suse 12.1 m5. I have setup an openldap server, which was the main mission of this machine, and it works. It has ssl /tls, certificates are loaded, that works. I used ldap client to setup the ldap browser and that works also. This is the new 2.4.26 server, which has some rather major changes in how ldap is setup. After about 2 weeks I have that under control. My little domain is setup on dark.net [dc=dark,dc=net]. I used ldapadd to put in the administrator, and I have used ldapsearch to list the subschema. I took the default schema. The list of the subschema includes everything I would like to use. Now I want to go about the real business of defining users. I have reviewed a number of pages to ensure I am doing what appears to be the correct procedure, for instance : http://www.yolinux.com/TUTORIALS/LinuxTutorialLDAP-BindPW.html Which lists: File: fratbrother.ldif dn: cn=fratbrother,o=delta cn: fratbrother sn: fratbrother objectclass: top objectclass: person userPassword: fratsecret ldapadd -f fratbrother.ldif -cxv -D "cn=DeanWormer,o=delta" -w secret2 And other similar updates. But on my machine I create something simple like: File : dark.ldif dn: cn=jctobin,dc=dark,dc=net cn: jctobin userPassword: Hello1$ Ldapadd -x -D “cn=admin,dc=dark,dc=net” -W -f dark.ldif Enter LDAP Password: Adding new entry “cn=jctobin,dc=dark,dc=net” Ldap_add: Object class violation (65) Additional info: no objectClass attribute Obviously my ldap server does not like the “userPassword” class. I have not been able to use any of the other classes I would like to either [ou: (organizational Unit), uid (unix term for a number corresponding to the user id), etc.] What have I not setup correctly? I need to get these users up and running. tob

2 1

migrating from (old) /etc/shadow to LDAP
by Gerardo Herzig 23 Sep '11

23 Sep '11

Hi all. Im migrating the /etc/shadow accounts to an LDAP enviroment. As the /etc/shadow containing server has suffered several upgrades, there is more than one crypto mechanism applied. Some entries are in the form $2a$10$..... this is an {CRYPT} entry, and have no problems with that. Others (the oldest ones) doesn't seem to have a prefix at all. There are "short" strings like bHwTgdCTnfpco lJvWLr8sfW.Hg and so on... I tried with {MD5}, {SHA} + encrypted password with no luck. Any one knows which crypto mechanism is applied here? I think they are from an old Suse 9.1 (not the Enterprise Server Edition, the realy old SuSE 9.1) Thanks! Gerardo

5 12

Re: migrating from (old) /etc/shadow to LDAP
by Juergen.Sprenger＠swisscom.com 23 Sep '11

23 Sep '11

Hi Gerardo, the 'short strings' You mentioned are 13-character DES password hashes. For security reasons they should not be used anymore if possible. Putting {crypt} in front of them should be sufficient for conversion. Normalizing the passwords might become difficult if only their DES hashes are available. Especially in a heterogenous environment using simple authentication together with ssl/tls will prevent some trouble. In that case OpenLDAP will take care of the crypto algorithm, creation of password hashes and so on while clients just send plaintext passwords over an encrypted ssl/tls connection to the LDAP server. This will also prevent trouble if there is no common algorithm supported by all OS flavors and releases in Your environment which use LDAP for authentication. Regards Juergen

2 1

MirrorMode sync only happening in one direction
by Daniel Qian 22 Sep '11

22 Sep '11

The problem direction has the same syncrepl configuration as the working one except for the rid and provider name: olcSyncrepl: {0} rid=102 provider="ldap://server2.prod:389/" type=refreshAndPersist retry="60 30 300 +" keepalive=1200:10:3 searchbase="dc=mydomain,dc=com" bindmethod=simple binddn="cn=replica,dc=mydomain,dc=com" credentials=xxxxxx starttls=critical tls_cacert="/etc/pki/CA/cacert.pem" On the consumer side I am seeing these messages: Sep 22 22:02:02 ldaprov1 slapd[15466]: do_syncrep2: rid=102 got search entry without Sync State control Sep 22 22:02:02 ldaprov1 slapd[15466]: do_syncrepl: rid=102 rc -1 retrying (29 retries left) and on the provider side I am seeing these: Sep 22 18:02:36 localhost slapd[20718]: conn=1071 fd=21 ACCEPT from IP=10.10.2.103:35671 (IP=0.0.0.0:389) Sep 22 18:02:36 localhost slapd[20718]: conn=1071 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Sep 22 18:02:36 localhost slapd[20718]: conn=1071 op=0 STARTTLS Sep 22 18:02:36 localhost slapd[20718]: conn=1071 op=0 RESULT oid= err=0 text= Sep 22 18:02:36 localhost slapd[20718]: conn=1071 fd=21 TLS established tls_ssf=256 ssf=256 Sep 22 18:02:36 localhost slapd[20718]: conn=1071 op=1 BIND dn="cn=replica,dc=mydomain,dc=com" method=128 Sep 22 18:02:36 localhost slapd[20718]: conn=1071 op=1 BIND dn="cn=replica,dc=mydomain,dc=com" mech=SIMPLE ssf=0 Sep 22 18:02:36 localhost slapd[20718]: conn=1071 op=1 RESULT tag=97 err=0 text= Sep 22 18:02:36 localhost slapd[20718]: conn=1071 op=2 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(objectClass=*)" Sep 22 18:02:36 localhost slapd[20718]: conn=1071 op=2 SRCH attr=* + Sep 22 18:02:36 localhost slapd[20718]: conn=1071 op=2 SEARCH RESULT tag=101 err=0 nentries=22 text= Sep 22 18:02:36 localhost slapd[20718]: conn=1071 op=3 UNBIND Sep 22 18:02:36 localhost slapd[20718]: conn=1071 fd=21 closed Sep 22 18:02:36 localhost slapd[20718]: connection_read(21): no connection! Sep 22 18:02:36 localhost slapd[20718]: connection_read(21): no connection! Sep 22 18:03:37 localhost slapd[20718]: conn=1072 fd=21 ACCEPT from IP=10.10.2.103:35672 (IP=0.0.0.0:389) Sep 22 18:03:37 localhost slapd[20718]: conn=1072 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Sep 22 18:03:37 localhost slapd[20718]: conn=1072 op=0 STARTTLS Sep 22 18:03:37 localhost slapd[20718]: conn=1072 op=0 RESULT oid= err=0 text= Sep 22 18:03:37 localhost slapd[20718]: conn=1072 fd=21 TLS established tls_ssf=256 ssf=256 Sep 22 18:03:37 localhost slapd[20718]: conn=1072 op=1 BIND dn="cn=replica,dc=mydomain,dc=com" method=128 Sep 22 18:03:37 localhost slapd[20718]: conn=1072 op=1 BIND dn="cn=replica,dc=mydomain,dc=com" mech=SIMPLE ssf=0 Sep 22 18:03:37 localhost slapd[20718]: conn=1072 op=1 RESULT tag=97 err=0 text= Sep 22 18:03:37 localhost slapd[20718]: conn=1072 op=2 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(objectClass=*)" Sep 22 18:03:37 localhost slapd[20718]: conn=1072 op=2 SRCH attr=* + Sep 22 18:03:37 localhost slapd[20718]: conn=1072 op=2 SEARCH RESULT tag=101 err=0 nentries=22 text= Sep 22 18:03:37 localhost slapd[20718]: conn=1072 op=3 UNBIND Sep 22 18:03:37 localhost slapd[20718]: conn=1072 fd=21 closed Sep 22 18:03:37 localhost slapd[20718]: connection_read(21): no connection! Sep 22 18:03:37 localhost slapd[20718]: connection_read(21): no connection! The sync connection is supposed to be persistent but it keeps closing down and reconnecting. Anyone know what could be the reason? Thanks, Daniel

3 5

Newbie here
by brown wrap 22 Sep '11

22 Sep '11

I have downloaded and installed OpenLDAP from www.sunfreeware.com. I have also installed the required supporting software. I know nothing about OpenLDAP. This is my first exposure. It will be on a test setup, running on old SPARCstations. I have settup the conf file, started slapd and it returns to the the prompt. Adding the debug flag shows its complaining about Berkley DB. Has someone here made a similar setup? I don't have access to the machine at this point. Its not connected to the net. I was just wondering if someone else had a like install. Thanks.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical