openldap-technical

openldap-technical@openldap.org

13 participants
9906 discussions

Re: How to disable cn=config module in OpenLDAP
by pradyumna dash 17 Sep '11

17 Sep '11

Hi, Please find the configuration files as attached. When i run the below command i get the output ldapsearch -x -h 192.168,0.1 -D "cn=Manager,dc=example,dc=com" -b "dc=example,dc=com" -W but when i try either ldapsearch -x or ldapsearch -x -h 192.168.0.1 -b "cn=Manager,dc=example,dc=com" it shows : base <cn=Manager,dc=example,dc=com> with scope subtree filter: (objectclass=*) requesting: ALL #search result search: 2 result: 32 No such object #numResponse: 1 OS : SLES 11 SP1 LDAP : 2.4.20-0.4.29 What i have changed is insted of dynamic backend i am trying to use slapd.conf file so i have changed in /etc/sysconfig/openldap file OPENLDAP_CONFIG_BACKEND="files". Please suggest how to solve this. Regards, Neo On Wed, Sep 14, 2011 at 8:47 PM, Bill MacAllister <whm(a)stanford.edu> wrote: > > > --On Wednesday, September 14, 2011 07:46:17 PM +0200 pradyumna dash < > neomatrixgem(a)gmail.com> wrote: > > Hi, >> >> Yes i tried below >> >> ldapsearch -x -h l <http://somehost.com/>dap1.**example.com<http://dap1.example.com/>-b >> >> cn=Manager,dc=example,dc=com >> > > If that is the command line that you used no wonder you didn't get > the results you expected. > > > It asked me to provide the password i have provided that then it shows the >> same error, nothing came up. >> > > Why don't you provide exactly what you typed and and what the response > was? Just cut and paste it into a _text_ message. Sending HTML just > muddies the waters already murky waters. > > The -x requests a simple bind and since you have not provided a bind DN > or bind password it will attempt an anonymous bind. It is hard to believe > that you are seeing what you report. The host where the ldap server is > running is actually named 'ldap1.example.com'? > > > I have checked my ldap.conf as well it looks okay. >> > > Unless you were going to include the ldap.conf file this statement was > a waste of bytes. > > > Bill > > Regards, >> Neo >> >> On Wed, Sep 14, 2011 at 6:41 PM, Bill MacAllister <whm(a)stanford.edu> >> wrote: >> >> >>> >>> --On Wednesday, September 14, 2011 06:35:09 PM +0200 pradyumna dash < >>> neomatrixgem(a)gmail.com> wrote: >>> >>> Hi, >>> >>>> >>>> ldapsearch -x shows the content of LDAP database as well wothout any >>>> additional options. I can see the same in one of my servers,I took a >>>> dump >>>> of >>>> the running server by slapcat and restored the same in this server. >>>> >>>> I can see the data by slapcat but ldapsearch is not working. >>>> >>>> The box where ldap running fine its using slapd.d backend, but this >>>> server >>>> i >>>> have configured to run from slapd.conf file, can it be a issue with the >>>> DB >>>> backup and restore as they are both using different backend? >>>> >>>> Regards, >>>> Neo >>>> >>>> >>> Did you even try my suggestion? The error message that you got back, >>> i.e. >>> "32 no such object" is telling you that you have not supplied a baseDN >>> for the search. >>> >>> Bill >>> >>> P.S. Top posting to replies sucks. >>> >>> >>> On Wed, Sep 14, 2011 at 6:29 PM, Bill MacAllister <whm(a)stanford.edu> >>> >>>> wrote: >>>> >>>> >>>> >>>>> --On Wednesday, September 14, 2011 06:20:03 PM +0200 pradyumna dash < >>>>> neomatrixgem(a)gmail.com> wrote: >>>>> >>>>> I have fixed this by deleting the slapd.d and also changed the script >>>>> to >>>>> >>>>> read slapd.conf file but now >>>>>> >>>>>> when am trying ldapserach -x its showing 32 no such object >>>>>> >>>>>> but the below command works >>>>>> >>>>>> ldapsearch -LLL -Wx -D "cn=Manager,dc=mail,dc=domain,******dc=com >>>>>> >>>>>> why is that ? >>>>>> >>>>>> >>>>>> Because you did it wrong. There is not enough information in your >>>>> message to tell much more than you contacted an LDAP server and >>>>> got an error message. You might want to try using a fully specified >>>>> search and work back from there. For example: >>>>> >>>>> ldapsearch -x -h somehost.com -b cn=sometree,dc=domain,dc=com >>>>> >>>>> Bill >>>>> >>>>> >>>>> Regards, >>>>> >>>>> Neo >>>>>> On Wed, Sep 14, 2011 at 5:34 PM, pradyumna dash < >>>>>> neomatrixgem(a)gmail.com >>>>>> > wrote: >>>>>> >>>>>> Hi , >>>>>> >>>>>> >>>>>>> Can i disable cn=config module, I just want to use plain old >>>>>>> slapd.conf >>>>>>> file. How to disable that. So that LDAP wont use the directory. >>>>>>> >>>>>>> Am using SLES 11 SP1 and i tried deleteting the directory but if i am >>>>>>> unable to restart the service. >>>>>>> >>>>>>> Regards, >>>>>>> Neo >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>> -- >>>>> >>>>> Bill MacAllister >>>>> Infrastructure Delivery Group, Stanford University >>>>> >>>>> >>>>> >>>>> >>> >>> -- >>> >>> Bill MacAllister >>> Infrastructure Delivery Group, Stanford University >>> >>> >>> > > > -- > > Bill MacAllister > Infrastructure Delivery Group, Stanford University > >

1 1

Re: slapd does not creating pid file
by sim123 16 Sep '11

16 Sep '11

On Fri, Sep 16, 2011 at 12:01 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, September 16, 2011 11:46 AM -0700 sim123 <Sim3159(a)gmail.com> > wrote: > > Hi, >> >> >> I am using openldap 2.4.25 and configured location of pidfile and >> argsfile in slapd.conf. However, when running slapd its not creating pid >> file or args file. On searching for this issue I found the bug reported >> earlier stating similar problem. Is that fixed or do I need to do some >> other configuration. >> > > It works for me. Perhaps slapd can't write to the location you specified. > I am running it as root. And found out that if I CD into libexec directory and run slapd from there it all works. However if I run it like /opt/openldap-2.4.25/libexec/slapd no .pid or .args get created. And I am giving absolute path for pidFile and argsFile in slapd.conf Thanks > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

slapd does not creating pid file
by sim123 16 Sep '11

16 Sep '11

Hi, I am using openldap 2.4.25 and configured location of pidfile and argsfile in slapd.conf. However, when running slapd its not creating pid file or args file. On searching for this issue I found the bug reported earlier stating similar problem. Is that fixed or do I need to do some other configuration. Thanks

2 1

Re: secure passwords
by sim123 16 Sep '11

16 Sep '11

On Wed, Sep 14, 2011 at 3:28 PM, Jacobus brogly.decap < jacobusbogers(a)gmail.com> wrote: > > > I want to do the same thing, > > Best way is to do it via a module , there is an example in the src > distribution > > /openldap-2.4.23/contrib/slapd-modules/passwd/sha2 > > basicly you dont want cleartext password stored in the DIT, so you want to > hash it > > I tried ppolicy overlay with ppolicy_hash_cleartext on, looks like its doing SSHA with ldapadd or ldapmodify operations. However, just wondering if this is the best way. Thanks > Cheers, > > Jacob > 2011/9/14 sim123 <Sim3159(a)gmail.com> > >> >> >> On Wed, Sep 14, 2011 at 3:00 AM, Buchan Milne <bgmilne(a)staff.telkomsa.net >> > wrote: >> >>> On Tuesday, 13 September 2011 23:01:23 sim123 wrote: >>> > Hi All, >>> > >>> > I am trying to store SSHA passwords in openldap instead of plain text >>> via C >>> > code and wondering how this works. I tried exploring archives, FAQ etc >>> and >>> > what I gathered from there is openLDAP has built in support for various >>> > password encryption algorithm however it does not have any APIs for >>> > generating passwords >>> >>> Are you sure? >>> >>> > and password-has directive works with ldpapassword >>> > utility only. >>> >>> Really? It seems to work fine from pam_ldap (using 'pam_password exop'), >>> Net::LDAP and various other tools. >>> >>> > http://www.openldap.org/faq/data/cache/906.html >>> > >>> > If I use some tool like Apache DS and modify my userPassword attribute >>> to >>> > be SSHA instead of plain text it all works. I want to know how this >>> works >>> > under the hood? Who is responsible for generating hashed passwords? If >>> I >>> > generate it using some C routine how does LDAP Server retrieves it >>> during >>> > the bind operation? I would really appreciate if there is any related >>> > documentation available. >>> >>> Maybe you should read about the Password Modification extended operation >>> .... >>> >>> IMHO, you shouldn't be hashing passwords on the client-side, it is much >>> better >>> to let the DS hash the password in the format it is configured for (so >>> you >>> know it will actually be able to use the password, and allowing you to >>> use >>> newer/stronger hashes as and when the DS supports them, without coding >>> the >>> support yourself). >>> >> >> I agree that DS should hash the password, however I am not sure what >> password modification extended operation is, is it ldappasswd utility or >> does openLDAP offer some kind of API to do so? Also can how can I configure >> hashing in SLAPD? >> >> Basically my C program will call ldap_add_ext_s() operation, while doing >> that how can I make sure that userPassword attribute be treated differently >> (hashed)? I was looking into password policy and not sure if it suffice my >> needs. >> >>> >>> Regards, >>> Buchan >>> >> >> >

1 0

LDAP Dynamic Library Creation Failed.
by vijay s sheelavantar 16 Sep '11

16 Sep '11

Hi, I am trying to cross compile openldap-2.4.26 using the following command for MIPS. ./configure --host=mips CC=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc LD=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-ld LDFLAGS=-Bshareable CPPFLAGS="-I/product/wibro/premium/src/APP/Protocols/ASNGW/vijay/db-4.8.26/build_unix" AR=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-ar RANLIB=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-ranlib NM=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-nm STRIP=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-strip OBJDUMP=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-objdump --enable-dynamic=yes AS=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-as --enable-shared=yes --with-yielding_select=no The configuration and make is going well, but at the end it is not creating the required dynamic libraries.only static libraries are getting created.  I have observed the following points during configuration checking whether a program can dlopen itself... cross checking if libtool supports shared libraries... no checking whether to build shared libraries... no checking whether to build static libraries... yes I tried to enable dynamic library creation by giving option --enable-shared=yes. But it didn't work out. please help me how can i solve this problem. Thanks & Regards,Vijay S.

2 1

Moving LDAP DB directory
by Bram Cymet 16 Sep '11

16 Sep '11

Hi, I am wondering if I have an ldap tree with olcDbDirectory: /var/lib/ldap. Would I be able to move just that tree to a different directory. Say /var/lib/ldap/someotherdir? Or do I have to throw everything away and start over? -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. 613-608-9752

1 0

ldap proxy acl filter problem
by Ron Peterson 16 Sep '11

16 Sep '11

Hi, (OpenLDAP version 2.4.23) I have a filter expression in an ACL that is somehow affecting my ability to retrieve specific attributes. What's strange (to me) is that with or without the filter expression in place, I can retrieve all attributes, i.e. the full object. 4986# ldapsearch -LLL -Z -x -y ../../private/pwemail '(uid=rpeterso)' dn: yDirectoryID=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=email yDirectoryID: c44883ba-ac62-d28c-556f-99ccbf532da7 objectClass: yAccount objectClass: inetOrgPerson uid: rpeterso mail: rpeterso(a)mtholyoke.edu etc... But if I specify a particular attribute, then having the filter expression in place somehow inhibits my ability to retrieve the specific attribute(s). Without filter expression: 4987# ldapsearch -LLL -Z -x -y ../../private/pwemail '(uid=rpeterso)' mail dn: yDirectoryID=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=email mail: rpeterso(a)mtholyoke.edu With filter expression in place: 4990# ldapsearch -LLL -Z -x -y ../../private/pwemail '(uid=rpeterso)' mail dn: yDirectoryID=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=email The ACL in question looks like: access to dn.regex="(yDirectoryID=.*),ou=email" filter="(&(yInstitution=mtholyoke.edu)(yGlobalPermission=allow)(|(yApplicationPermission=email)(&(yDefaultApplicationPermission=allow)(!(yApplicationPermission=email)))))" by dn.regex=$1,ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu read by dn="uid=email,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu" read by * none I've turned my logging way up, and the hiccup seems to be that the DN I've authenticated as (uid=email,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu) needs read access to the attributes in the filter expression. But how do I give that account read access to those attributes, without then exposing the objects that I'm trying to hide with the filter expression? -- Ron Peterson Network & Systems Administrator Mount Holyoke College http://www.mtholyoke.edu/~rpeterso

2 3

Generating unique identifier
by sim123 15 Sep '11

15 Sep '11

Does openldap support generating unique identifier or guids, I need to generate it using a ldap C API and wondering if DS does that for me or do I need my own GUID generator in application. Thanks for the help and support.

2 1

authz-regexp in conf.d
by Bram Cymet 15 Sep '11

15 Sep '11

Hi, I would like to use authz-regexp so that I can map users DN's to the auth DN that sasl with GSSAPI expects. I have found lots of slapd.conf examples of how to do this but I am using conf.d for my configuration. Does anyone have an example ldif file that I can use to add authz-regexp? Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. 613-608-9752

2 2

OpenLDAP / PAM: No Username
by Denis Witt 15 Sep '11

15 Sep '11

Hi, I'm running OpenLDAP 2.4.23-7.2 (from Debian Squeeze). Most of the time everything works fine, the LDAP-Server is used by libpam/libnss, Samba, Dovecot and Postfix. Sometimes when I log into the Server via SSH the command prompt displays "Ich habe keinen Benutzernamen@servername" (which means "I don't have a username") instead of my username. The login itself works fine. The real problem is that if this happens the Mailserver isn't able to deliver mails: status=bounced (unknown user: "myusername") Using google I found some other users with the "don't have a username"-Problem, but most of the time they had a ACL-Problem. As the LDAP-Server usually is working it seems that this isn't the problem. Also the problem is gone when I restart the whole machine (just restarting slapd doesn't help). Any ideas? -- Regards, Denis Witt

2 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical