openldap-technical

openldap-technical@openldap.org

11 participants
9876 discussions

Re: simple binds
by Friedrich Locke 01 Jul '11

01 Jul '11

Quanah, thank you for your support and patience too; now i got it working as i wished. If you come to brasil, let me know and i'll pay you some beers. Fried. On Thu, Jun 30, 2011 at 7:38 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, June 30, 2011 7:22 PM -0300 Friedrich Locke > <friedrich.locke(a)gmail.com> wrote: > >> Is it possible to perform simple binds but looking up the entry's >> password in a kerberos server? > > Please spend some time reading the OpenLDAP documentation. Your question > here is clearly answered in the OpenLDAP Admin guide, section 14.5: > > <http://www.openldap.org/doc/admin24/security.html> > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

cn=config completely replacing slapd.conf
by David N. Blank-Edelman 01 Jul '11

01 Jul '11

(taking this to a new thread) Sorry for such a vague question, but my (perhaps failing) memory is once upon a time there were still certain backends or overlays that couldn't yet be configured via cn=config and had to be specified in slapd.conf. Has 2.4 has already cleared up all of those legacy configuration requirements or is that a 2.5 goal? Thanks! -- dNb

5 5

How to configure OpenLdap Client to work with Windows Active Directory
by yen nguyen 30 Jun '11

30 Jun '11

Hi, Can ldapsearch work with Windows AD via GSSAPI? Is there any special setting/software I need to do on the client side? On my Client system, I have Windows openldap client tools (ldapsearch ....etc). My Server system has Windows AD running. I was able to use Simple Authentication and it worked. ldapsearch.exe -H ldap://MPSD-EB01T3/ -b "dc=test,dc=com" -x I know Windows 2008 AD support GSSAPI. ldapsearch -H ldap://MPSD-EB01T3/ -xLLL -s base -b "" supportedSASLMechanisms dn: supportedSASLMechanisms: GSSAPI supportedSASLMechanisms: GSS-SPNEGO supportedSASLMechanisms: EXTERNAL supportedSASLMechanisms: DIGEST-MD5 Now I tried to use GSSAPI and it failed. Is there anything special setting I need to do on the client side to make it work? ldapsearch -H ldap://MPSD-EB01T3/ -b "cn=user1,dc=test,dc=com" -W -U user1 -Y GSSAPI -d 3 ldap_url_parse_ext(ldap://MPSD-EB01T3/) ldap_create ldap_url_parse_ext(ldap://MPSD-EB01T3:389/??base) ldap_sasl_interactive_bind_s: user selected: GSSAPI ldap_int_sasl_bind: GSSAPI ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP MPSD-EB01T3:389 ldap_new_socket: 392 ldap_prepare_socket: 392 ldap_connect_to_host: Trying 192.168.1.30:389 ldap_pvt_connect: fd: 392 tm: -1 async: 0 ldap_int_sasl_open: host=MPSD-EB01T3 ldap_err2string ldap_sasl_interactive_bind_s: Unknown authentication method (-6) additional info: SASL(-4): no mechanism available: Unable to find a calback: 2

3 3

simple binds
by Friedrich Locke 30 Jun '11

30 Jun '11

Is it possible to perform simple binds but looking up the entry's password in a kerberos server? Thanks in advance.

2 1

userPassword
by Friedrich Locke 30 Jun '11

30 Jun '11

What does userPassword: {SASL}xxx(a)MY.DOMAIN mean? Thanks a lot.

2 1

I cannot auth against SASL
by Friedrich Locke 30 Jun '11

30 Jun '11

Hi! i am trying to authenticate binding the DN below and it works nicely. dn: uid=grios,ou=people,dc=ufv,dc=br uid: grios objectclass: organizationalrole objectclass: posixaccount cn: Gustavo Rios uidnumber: 2000 gidnumber: 2000 homedirectory: /home/grios userpassword: {SSHA}dWhcPjgDn4EGb/FwGMYbxx7fIqAuXCN7 loginshell: /bin/sh gecos: Gustavo V G C Rios,,, But if i change userpassword attribute to {SASL}grios(a)UFV.BR it does not work when i bind the same DN above. Does anybody have an ideia about my mistaken ? Thanks in advance.

3 2

i am desperated: authentication without success
by Friedrich Locke 30 Jun '11

30 Jun '11

Hi folks, i am trying to search my base tree but i am not able to connect due to "invalid credentials (49)". It seems very confusing because i am sure i am using the correct password. sioux@gustav$ ldapsearch -w $my_pass -D uid=grios,ou=people,dc=ufv,dc=br -b 'dc=ufv,dc=br' -s one ldap_bind: Invalid credentials (49) sioux@gustav$ The entry's ldif whose rdn is uid=grios is: dn: uid=grios,ou=people,dc=ufv,dc=br uid: grios objectclass: organizationalrole objectclass: posixaccount cn: Gustavo Rios uidnumber: 2000 gidnumber: 2000 homedirectory: /home/grios userpassword: {SASL}grios(a)ufv.br loginshell: /bin/sh gecos: Gustavo V G C Rios,,, I am monitoring heimdal kerberos log file and cyrus-sasl log file too. Nothing is shown there. I DON'T really have any ideia on my mistaken. May you please help me? Kind regards. Fried.

2 1

slaptest returns "index attribute "reqStart" undefined
by Mike Greene 30 Jun '11

30 Jun '11

Hello list members, I am trying to setup ldap 2.4.23 on new FreeBSD 8.2 "consumer" server to replace a current system that is quite old. I have copied over the slapd.conf file and associated certs, etc from the production system and I'm able to get the server working using the sample slapd.conf and examples in the quick setup guide. When I run slaptest -f slapd.conf.artemis on the configuration file I copied over I get the error: slapd.conf.artemis: line 86: index attribute "reqStart" undefined slaptest: bad configuration file! Running the same test on the production server's slapd.conf produces no error at all. I've googled, RTFM and read man pages trying to get a clue as to what might be causing this, but I'm unable to unearth any leads that have helped so far. What I have tried is to copy the production *.bdb files over to the new server thinking that was the problem, I didn't try re-indexing those files (just read about slapindex late last night, so haven't tried that yet) I was also thinking that I might need to run slapcat on the production db's and then import the ldif file using slapadd (which I'm setting up to test shortly). Clearly I'm missing something, I'm hoping that someone here who is much more adept at LDAP can suggest some additional things to try. Below is what I think are the relevant portions of the slapd.conf file, which shows the section the slaptest complains about, the second section is our replication area which I believe is directly related to the replication process. database bdb suffix cn=accesslog directory /usr/local/var/db/openldap-accesslog rootdn cn=accesslog index default eq index entryCSN,objectClass,reqStart,reqResult,reqEnd overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logpurge 07+00:00 01+00:00 I'm trying to bootstrap my Sys Admin skills (after a 12 year absence) due to the sudden loss of my long time admin, with mixed results! Time will tell, appreciate any suggestions you might have to get me past this particular issue. Mike Greene Rock Island Technology Solutions, Inc. San Juan Islands, WA. 360-378-5884 x201

2 2

slapo-memberof across proxy
by Hugo Monteiro 30 Jun '11

30 Jun '11

Hello list, With this type of setup, Client (A) <-----> back_ldap Proxy (B) <-----> syncrepl Slave (C) <-----> Master (D) I have configured the memberof overlay on both (C) and (D). I am able to query both (C) and (D), either to specifically retrieve the memberof attribute or to perform a query which filter is based on the memberof attribute. All works fine with (C) and (D) If i issue the same type of queries from (A) to (B), i'm able to retrieve the memberof attribute alright *BUT* i cannot perform searches which contain the memberof attribute on the query filter. Does (B) need any special configuration so that back_ldap can cope with the memberof overlay available on the backend servers? Thanks in advance, Hugo Monteiro. -- fct.unl.pt:~# cat .signature Hugo Monteiro Email : hugo.monteiro(a)fct.unl.pt Telefone : +351 212948300 Ext.15307 Web : http://hmonteiro.net Divisão de Informática Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa Quinta da Torre 2829-516 Caparica Portugal Telefone: +351 212948596 Fax: +351 212948548 www.fct.unl.pt apoio(a)fct.unl.pt fct.unl.pt:~# _

2 2

Re: protected entry
by Friedrich Locke 30 Jun '11

30 Jun '11

To which objectclass should the entry belongs to ? What about access rules ? Thanks On Wed, Jun 29, 2011 at 8:14 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, June 29, 2011 8:00 PM -0300 Friedrich Locke > <friedrich.locke(a)gmail.com> wrote: > >> Dear list users, >> >> i would like to have an entry in my openldap server thats needs to >> have a password so that it would be able to permit clients to bind as >> it providing its password. >> For instance: cn=x,ou=y,dc=a,dc=b >> So anyone knowing "cn=x,ou=y,dc=a,dc=b" 's password could bind as it. > > Add a userPassword value to that entry. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical