openldap-technical

openldap-technical@openldap.org

9 participants
9876 discussions

The difference between the meta and ldap backends
by Lars Kellogg-Stedman 07 Aug '11

07 Aug '11

Hello all, I'm been working with OpenLDAP in a metadirectory configuration -- I'm using it to provide a merged view of two organization LDAP servers, along with a local database to support "external collaborators" (that is, people not otherwise affiliated with our organization). In my limited testing it seems to be working reasonably well, but I'm not sure I completely understand all the components. For example, I'm unsure of the difference between this: database meta uri ldap://serverA.example.com/ou=A,o=organization uri ldap://serverB.example.com/ou=B,o=organization # ...necessary suffix massaging... database hdb suffix o=organization And this: database ldap subordinate suffix ou=A,o=organization uri ldap://serverA.example.com # ...rewriting... database ldap subordinate suffix ou=B,o=organization uri ldap://serverB.example.com # ...rewriting... database hdb suffix o=organization Both seem to provide the same behavior; a search against o=organization will search all three directories. Is either configuration preferable? Is one backend considered more stable than the other? is there some subtle difference in behavior that I'm missing? I'd appreciate your input. Thanks, -- Lars

2 2

custom password attribute
by Janez Barbič 06 Aug '11

06 Aug '11

Hi, I started with LDAP just recently and I successfully built and implemented a custom schema. However there is one problem. I am required to add "userPasswordAtt" attribute to my custom schema which is similar to "userPassword" attribute in "inetOrgPerson" schema. This is what I tried so far: attributetype ( 1.28.7.2011.13.1 NAME 'userPasswordAtt' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40) It is basically a copy/paste of "userPassword" attribute. objectclass ( 1.28.7.2011.1.1 NAME 'eOskrbaPerson' DESC 'e-oskrba participant' SUP top STRUCTURAL MUST ( bidAtt $ uidAtt $ cnPatient $ userPasswordAtt ) MAY ( patientCoopFlagAtt $ patientsDoctorAtt $ eMailAtt $ dateOfBirthAtt $ sexAtt $ healthcareInstitutionAtt $ memberAtt $ mobilePhoneAtt $ experimentalGroupAtt ) ) But with this attribute I can not log in to phpLDAPadmin for example. It also doesn't cover password with dots on creation as it does with "userPassword". As far as I know "userPassword" is never defined as password in any schema, I am suspecting that it has to be somehow hardcoded (I also checked inheritance which goes all the way from core.schema). So far I also tried to avoid inheriting attributes from defined schemas. How can I use my custom attribute in the same way as "inetOrgPerson->userPassword"? Some pointers for future research would be greatly appreciated. Regards, Janez Barbic

2 1

Re: Customizing organizationalUnit
by Erwann ABALEA 06 Aug '11

06 Aug '11

Le 6 août 2011 15:49, "Michael Ströder" <michael(a)stroeder.com> a écrit : > > harry.jede(a)arcor.de wrote: > > The cleanest approach is to modify your OU entries: > > > > objectClass: top > > objectClass: organizationalUnit > > objectClass: extensibleObject > > > > Now, all attributes which are defined in any schema are allowed :-) . > > That's what I consider bad advice and definitely not the cleanest approach. This is equivalent to your solutions 1 and 2, described 3 days ago.

2 2

Customizing organizationalUnit
by Derek Chen-Becker 06 Aug '11

06 Aug '11

Hello all, I'm migrating a server from an older OpenLDAP 2.1 install to 2.4.21 and I've run into a (hopefully) small issue. On our old install we had added some attributes to organizationalUnit ("mail" is really the important one) just by editing the schema files, but I can't figure out how to do the same on 2.4.21 using the LDAP interface. I found this email on the list: http://www.openldap.org/lists/openldap-technical/201106/msg00182.html But it doesn't seem to have any replies. I've been fiddling with ldapmodify but I keep on getting strange errors: root@lsmail:/etc/ldap/schema# ldapmodify -x -D cn=admin,dc=cpicorp,dc=com -W -f CPI-core.ldif Enter LDAP Password: modifying entry "cn=core,cn=schema,cn=config" ldap_modify: No such object (32) matched DN: cn=schema,cn=config Is this possible with 2.4.21, or do I need to stick with an older version of OpenLDAP? Thanks, Derek

4 6

copying a multi-master node to a standalone node
by Patrick H. 05 Aug '11

05 Aug '11

I am trying to create a duplicate of a production node that is in a multi-master replication setup to a standalone node for testing purposes. However whenever I try to make any changes to the testing database, I get the "shadow context; no update referral" error. I have removed all olcServerID attributes, set olcMirrorMode to false, removed the syncprov module and its overlay entries, and removed the olcSyncrepl attributes. But after all this its still giving the error. What am I missing here?

1 0

RE: TLS issue
by Naga Chaitanya Palle 05 Aug '11

05 Aug '11

Thanks Rosenberg for your suggestions. The issue was with wrong path mentioned for certificate files. Without commenting the TLSCipherSuite HIGH:MEDIUM:+SSLv2 line, also I could start slapd -----Original Message----- From: E.S. Rosenberg [mailto:esr@g.jct.ac.il] Sent: Thursday, August 04, 2011 10:06 PM To: Naga Chaitanya Palle Cc: openldap-technical(a)openldap.org Subject: Re: TLS issue 2011/8/4 Naga Chaitanya Palle <Naga.Chaitanya(a)aricent.com>: > Hi, > > > > I am trying to configure tls for my ldap server. > > After successfully creating the below files, I try to start the ldap server > and it fails. > > > > /etc/openldap/cacerts/cacert.pem > > /etc/openldap/cacerts/slapd-cert.pem > > /etc/openldap/cacerts/slapd-key.pem > > > > The log shows the below messages > > > > main: TLS init def ctx failed: -1 > > slapd stopped. > > connections_destroy: nothing to destry. > > > > Slapd.conf > > > > TLSCipherSuite HIGH:MEDIUM:+SSLv2 Try removing this line, if I'm not mistaken it's according to openssl syntax while openldap is (usually) compiled against gnu-tls which uses a different syntax. Also SSLv2 is generally not considered secure so unless you have some apps that cant do SSLv3 or better (TLSv1 == SSLv3.1) you should turn SSLv2 of. > > TLSCACertificateFile /etc/openldap/cacerts/cacert.pem > > TLSCertificateFile /etc/openldap/cacerts/slapd-cert.pem > > TLSCertificateKeyFile /etc/openldap/cacerts/slapd-key.pem Are your certs self-signed or from a CA? Did you make sure that the private key cert (and the other certs too?) are not stored encrypted (-nodes switch in openssl). > > > > database bdb > > suffix "dc=comverse-in,dc=com" > > rootdn "cn=Manager,dc=comverse-in,dc=com" > > rootpw {SSHA}hBlwVEbzHMzm1Wof9Lb1dA/fcuJDt6pr You may want to change your password since you have posted the hash (and also your domain) it is now possible to start brute forcing (or use rainbow tables) the hash and since the domain where this hash was used is known (and at least the LDAP username) that is a big security leak. Other than that version info and debug info (as Dan asks) is always good to provide when you have a question. Regards, Eli > > > > /etc/openldap/ldap.conf > > BASE dc=comverse-in,dc=com > > URI ldaps://devonly144.comverse-in.com > > > > TLS_CACERT /etc/openldap/cacerts/cacert.pem > > TLS_CACERTDIR /etc/openldap/cacerts > > TLS_REQCERT allow > > > > /etc/ldap.conf > > base dc=comverse-in,dc=com > > uri ldaps://devonly144.comverse-in.com > > ssl on > > > > Thanks and Regards, > > Naga chaitanya > > =============================================================================== > Please refer to http://www.aricent.com/legal/email_disclaimer.html > for important disclosures regarding this electronic communication. > =============================================================================== > =============================================================================== Please refer to http://www.aricent.com/legal/email_disclaimer.html for important disclosures regarding this electronic communication. ===============================================================================

1 0

TLS issue
by Naga Chaitanya Palle 05 Aug '11

05 Aug '11

Hi, I am trying to configure tls for my ldap server. After successfully creating the below files, I try to start the ldap server and it fails. /etc/openldap/cacerts/cacert.pem /etc/openldap/cacerts/slapd-cert.pem /etc/openldap/cacerts/slapd-key.pem The log shows the below messages main: TLS init def ctx failed: -1 slapd stopped. connections_destroy: nothing to destry. Slapd.conf TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /etc/openldap/cacerts/cacert.pem TLSCertificateFile /etc/openldap/cacerts/slapd-cert.pem TLSCertificateKeyFile /etc/openldap/cacerts/slapd-key.pem database bdb suffix "dc=comverse-in,dc=com" rootdn "cn=Manager,dc=comverse-in,dc=com" rootpw {SSHA}hBlwVEbzHMzm1Wof9Lb1dA/fcuJDt6pr /etc/openldap/ldap.conf BASE dc=comverse-in,dc=com URI ldaps://devonly144.comverse-in.com TLS_CACERT /etc/openldap/cacerts/cacert.pem TLS_CACERTDIR /etc/openldap/cacerts TLS_REQCERT allow /etc/ldap.conf base dc=comverse-in,dc=com uri ldaps://devonly144.comverse-in.com ssl on Thanks and Regards, Naga chaitanya =============================================================================== Please refer to http://www.aricent.com/legal/email_disclaimer.html for important disclosures regarding this electronic communication. ===============================================================================

4 4

ldap.conf search order problem
by Michel Gruau 04 Aug '11

04 Aug '11

Hello, I have a proxy configuration with severall backend directories and one of them in TLS. I thus added the following line in ldap.conf in order to let it know the remote server server CA certificate TLS_CACERT /opt/openldap/etc/openldap/cacert.pem This is working when this line is inserted in $HOME/ldaprc or $HOME/.ldaprc but never working when inserted in the system-wide ldap configuration file (/usr/local/etc/openldap/ldap.conf). Not working neither when inserted in /opt/openldap/etc/openldap/ldap.conf (my proxy is installed in /opt/openldap). Is this a bug ? if not, what is the real ldap.conf search order ? Thanks, Michel Une messagerie gratuite, garantie à vie et des services en plus, ça vous tente ? Je crée ma boîte mail www.laposte.net

3 3

Ldap issue
by renu abraham 03 Aug '11

03 Aug '11

*Ldap issue* I tried to search using below commnad and I am getting following error ldapsearch -x -H ldap://127.0.0.1:389/ -D "cn=manager,ou=system,o=example" -w secret *error:* ldap_bind: Invalid credentials (49) *My slapd.conf contents is as below:* database bdb suffix o=example.com rootdn cn=manager,ou=system,o=example.com # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret #rootpw {SSHA}JvA5Ovk302pb39afL2yVk9VeAeMNCZAm # rootpw {crypt}ijFYNcSNctBYg #access to * # by * write access to dn.subtree="o=example.com" by dn="cn=ldaproot,ou=system,o=example.com" write by * auth allow update_anon access to * by anonymous read # This allows the ldaproot to extract as much info as possible from the DB limits dn.exact="cn=ldaproot,ou=system,o=example.com" size=unlimited time=unlimited # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # logging setting loglevel none # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM

3 2

Re: Ldap issue
by Erwann ABALEA 03 Aug '11

03 Aug '11

Le 3 août 2011 19:08, "renu abraham" <ace.renu(a)gmail.com> a écrit : > ldapsearch -x -H ldap://127.0.0.1:389/ -D "cn=manager,ou=system,o=example" -w secret Is that the real command? There's a mismatch between "o=example" here, and the declared "o=example.com" below. > suffix o=example.com > rootdn cn=manager,ou=system,o=example.com

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical