openldap-technical

openldap-technical@openldap.org

7 participants
9864 discussions

olcLastBind default to true
by Erik de Waard 14 Mar '22

14 Mar '22

$OpenLDAP: slapd 2.5.11 Hi, i've a weird case where olcLastBind defaults to TRUE. When using convert (slaptest) method. and explicit lastbind to off/false has no effect. #Initialize slapd with convert method slaptest -f /etc/openldap/slapd.conf.init -F /etc/openldap/slapd.d/ slapcat -n0 | grep LastBind olcAttributeTypes: ( OLcfgDbAt:0.22 NAME 'olcLastBind' EQUALITY booleanMatch S olcLastMod $ olcLastBind $ olcLimits $ olcMaxDerefDepth $ olcPlugin $ olcRea olcLastBind: TRUE olcLastBind: TRUE olcLastBind: TRUE olcLastBind: TRUE Tested with minimal config: # stand-alone slapd config include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/nis.schema #include /etc/openldap/schema/test.schema # allow big PDUs from anonymous (for testing purposes) sockbuf_max_incoming 4194303 moduleload back_ldap ####################################################################### # database definitions ####################################################################### database config database mdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw secret directory /var/lib/ldap lastbind off database monitor Best regards,

2 1

syncprov-sessionlog-source cn=accesslog
by Michael Ströder 14 Mar '22

14 Mar '22

HI! I wonder what the operational requirements are when using syncprov-sessionlog-source cn=accesslog instead of the in-memory session log. E.g. what about configured logpurge? What happens if the accesslog DB is completely deleted? Ciao, Michael.

3 5

slapo-translucent and syncprov
by Christopher Paul 14 Mar '22

14 Mar '22

Hello openldap-technical, I am wondering about slapo-translucent and syncprov. I am using it to merge RFC2307bis data with an upstream Active Directory Service. It seems to work pretty well. But I notice that the entries added do not get entryuuid or entrycsn values. I guess this sort of makes sense, because the source of truth for (most of) this data is upstream. And so, this means then that syncprov overlay will not work for translucent entries. So I am wondering, what others are doing to replicate and synchronize their translucent data across an OpenLDAP service? I am guessing people probably use some dump and load schemes, which is about all I can think to do at the moment. many thanks, Chris Paul | Rex Consulting | https://www.rexconsulting.net

1 0

secrets storage: userPassword,TLS keys best practices
by Christopher Paul 12 Mar '22

12 Mar '22

Hello openldap-technical, I'm wondering what the OpenLDAP-technical World thinks about LDAP authentication secrets. A couple observations and questions: 1. RFC 4519 allows userPassword to be multi-valued and it gives some rationale which is logical, but it also seems to lack imagination. There seem to be more possibilities for abuse by defining attributeType this way than legitimate use cases. Is there any way to force userPassword to be single-valued? Has anyone attempted this? 2. Assuming you decide to ditch passwords, and use TLS EXTERNAL, you still have the problem of storing the key, and the risk that if the key is stolen, than someone other than you can authenticate as you. Of course store it on storage with permissions and ownership of files set correctly. That goes without being said, but storage is not always perfectly secure or private, so let's not trust it completely. Short lifetimes would be one mitigation. And CRLs of course. What else do people do? 3. Is there anyway to have ldap* commands read the key in from an environment variable or call to gpg/secrets store /etc? Funky alias / bash-wrapper yeah but I'm looking for something less clunky. many thanks, Chris Paul | Rex Consulting | https://www.rexconsulting.net

3 8

Accesslog and Ppolicy overlays
by Benjamin Renard 11 Mar '22

11 Mar '22

Hello, I try to enable accesslog overlay on a database with the overlay ppolicy enabled (with brute-force protection). My goal is to build an historic of users authentication fails and the effect of the ppolicy overlay on their account. I enabled accesslog on the database with logging of the "session" operations and in this case, all users authentication fails are stored as modification of the pwdFailureTime attribute. It's great but I also would also like to have an explicit trace of the bind operation failure (with the error message of ppolicy in reqMessage). I also tried to configure the accesslog overlay on frontend and in this case, I had an explicit trace of the bind failure but no trace of the pwdFailureTime attribute modification. Finally, I tried to configure the accesslog overlay on both frontend and database levels, but accesslog on database seems to take over the other and the result is identical with accesslog configured only on database level. Do you known how I could configure the accesslog overlay to log both bind failure and the pwdFailureTime attribute modification ? Regards, -- Benjamin Renard - Easter-eggs 44-46 rue de l'Ouest - 75014 Paris - France - Métro Gaité Phone: +33 (0) 1 43 35 00 37 - mailto:brenard@easter-eggs.com

1 0

Using logfile-format causes segfault
by Juergen.Sprenger＠swisscom.com 11 Mar '22

11 Mar '22

When using option 'logfile-format' in my config, slaptest, slapadd, slapcat, slapindex, ... will segfault and cause a coredump. This occurs with all available options for 'logfile-format'. slapd itself is running fine, logs are written as expected with any option for 'logfile-format'. I am using OpenLDAP 2.6.1, configure options: ./configure --enable-overlays=mod --enable-modules --with-tls=openssl

2 2

Re: Antw: [EXT] creatorsname not correctly updated
by Jean-Luc Bourguignon 11 Mar '22

11 Mar '22

hello Quanah, 2.5.7. Brgds, J-L. On Thu, Mar 10, 2022 at 11:08 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Thursday, March 10, 2022 3:44 PM +0100 Jean-Luc Bourguignon > <bourguijl(a)gmail.com> wrote: > > > > > Hello Ulrich, > > > > > > After a deep analyze of this "problem", it seems the chaining > > process doesn't work when I use rootdn user to add entries in the DB via > > the replicas. > > If I add them via providers, creatorsname takes the correct rootdn (as > > no chaining action here) but if I do it via replicas, I get replication > > user's DN. > > The chaining process works fine for normal users and gets proxied from > > replicas to providers as I've authzto (regex) rules in the configuration > > of my replication user. > > I've tried to add a second authzto rule to my replication user as > > authzto {1} dn.exact: cn="rootdn" but it didn't work. Besides that, I > > created a fake rootdn entry in my DB, but same result. > > > What OpenLDAP release are you using? > > --Quanah > > > >

1 0

creatorsname not correctly updated
by bourguijl＠gmail.com 10 Mar '22

10 Mar '22

Dears, I've a tricky issue with this attribute. I context of 4 MMR & 4 replicas, I've defined a rootdn and a replication user. When I create "ADD" a new entry in my DB with rootdn as user, the creatorsname is filled up with the replication username instead of rootdn one :-| I've another configuration with 2 MMR & 2 replicas, normally same config as above, but there, the ADD is correctly managed. In both configuration, replicas send their ADD request to masters VIP with olcUpdateRef attribut. and received update via masters VIP with olcSyncrepl attribut. Any idea of any parameter, acl, schema to check ? Thx, J-L.

4 5

syncprov olcSpNoPresent not being honoured
by lisa.parratt＠bjss.com 10 Mar '22

10 Mar '22

Hi, I have an OpenLDAP server I'm upgrading from 2.4.58 to 2.6.0. The server is configured with the syncprov plugin, with "olcSpNoPresent: TRUE". Previously, on 2.4.58, we would never see any Present phase data originating from the server. However, post upgrade, we are seeing this, and it's causing problems with the consumers. I've tried looking at the code, but I must admit I got lost trying to trace through the propagation of this flag. Are there undocumented circumstances where olcSpNoPresent will not be obeyed, or is this a regression? Thanks! Lisa

4 7

how to set LDAP ACL permissions on one subtree for a groups without modifying it for other users or groups?
by International Security Providers 04 Mar '22

04 Mar '22

I use commands like this to set permissions for some custom gorups/users.. now I want to set the permissions without overwriting them for all the other groups/users, what do I need to add to my ACL-Entrys?: ``` access to dn.subtree="cn=myContainer,dc=mydomain,dc=tld" by set="user & [cn=myGroup,cn=groups,dc=mydomain,dc=tld]/uniqueMember*" write by set="user & [cn=Domain Users,cn=groups,dc=mydomain,dc=tld]/uniqueMember*" read ```

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical