openldap-technical

openldap-technical@openldap.org

11 participants
9876 discussions

n-way syncrepl issues
by Marcel van Dorp 29 Jun '11

29 Jun '11

Hi list, I tried to read all information about the subject, both in the mail archives and on the website (admin guide and faq-o-matic), but somehow things are not working as expected. I have 3 servers, Debian 6 with the distro-version of openldap (2.4.23-7). I use phpldapadmin (PLA for short), version 1.2.0.5. I also use ldapvi and the standard ldap-tools (ldapadd/ldapmodify etc). I use the slapd.d/ config backend. My userdata DIT is empty at the moment, until the issues are resolved. *) When using n-way multimaster, I understand that the whole DIT is identical on all servers (assuming full read access for the replication DN, which is the case). Because of this, I used a generic name for the certificates, while on each server the content of the files are server-specific. This works as expected. The other difference between the servers is the slapd startup command line: in it is each server's own FQDN. On debian, this is specified in /etc/default/slapd. On server1 this file has: SLAPD_SERVICES=ldap://127.0.0.1 ldaps://server1.domain.tld ldapi:///" On server2 the URI changes in ldaps://server2.domain.tld and on server3 it changes likewise. This is al per the admin guide. For some reason, replication is not working as expected. Some updates go through, others are ignored and stay local on a server. The servers are on different subnets with a firewall in-between, but I can access each server from the other servers using eg 'ldapsearch'. Question: With n-way multimaster, I understand the DIT should be identical on all servers. Can I just do tar -czf slapd.conf.tgz /etc/ldap/slapd.d on one server, and copy and untar this on the other servers (with slapd stopped) and start slapd? My (anonymized) slapd.d is at the end of this message (I deleted the (default) schema definitions for readability). Question: Is the above-mentioned method a valid way to add/restore an extra n-way multimaster node in the setup? If so, Do I do the export AFTER adding the extra node to the config, or BEFORE? Question: I also want to replicate the dc=domain,dc=tld DIT. Can I use the same rid values in de replication statements as for the cn=config DIT, or do they need to be unique within the total config? Question: I do not like to use the cn=admin,cn=config identity as the replication ID. Yet I do not have content in the dc=domain,dc=tld DIT, and thus no way to specifiy another identity. Can this be solved? Once the DIT has the identity, I assume I can change the replication ID (as long as ACLs are not blocking things). Can anyone answer my questions, or point me in the right direction? I tried numerous things with all kind of different results, but I feel I miss some fundamental insight. Thanks for any help! Marcel -------------------------------------------------------------------- Anonymized slapd.d config of server1 (exported using PLA) -------------------------------------------------------------------- # Server: Server1 (ldap://localhost) # Search Scope: sub # Search Filter: (objectClass=*) # Total Entries: 13 # # Generated by phpLDAPadmin (http://phpldapadmin.sourceforge.net) on June 29, 2011 8:19 am # Version: 1.2.0.5 version: 1 # Entry 1: cn=config dn: cn=config cn: config contextcsn: 20110621205759.540662Z#000000#000#000000 createtimestamp: 20110429201711Z creatorsname: cn=config entrycsn: 20110621205759.540662Z#000000#000#000000 entrydn: cn=config entryuuid: 690a54f4-06e9-1030-9aec-e9c45301ace2 modifiersname: cn=admin,cn=config modifytimestamp: 20110621205759Z objectclass: olcGlobal olcargsfile: /var/run/slapd/slapd.args olcloglevel: sync olcloglevel: stats olcloglevel: args olcpidfile: /var/run/slapd/slapd.pid olcserverid: 11 ldaps://server1.domain.tld olcserverid: 12 ldaps://server2.domain.tld olcserverid: 13 ldaps://server3.domain.tld olctlscacertificatefile: /etc/ssl/certs/cacert.org.pem olctlscertificatefile: /etc/ssl/certs/thishost.crt olctlscertificatekeyfile: /etc/ssl/private/thishost.key olctlsverifyclient: NEVER olctoolthreads: 1 structuralobjectclass: olcGlobal subschemasubentry: cn=Subschema # Entry 2: cn=module{0},cn=config dn: cn=module{0},cn=config cn: module{0} createtimestamp: 20110429201711Z creatorsname: cn=admin,cn=config entrycsn: 20110429201711.660046Z#000000#000#000000 entrydn: cn=module{0},cn=config entryuuid: 690b3608-06e9-1030-9af4-e9c45301ace2 modifiersname: cn=admin,cn=config modifytimestamp: 20110429201711Z objectclass: olcModuleList olcmoduleload: {0}back_hdb olcmoduleload: {1}syncprov.la olcmodulepath: /usr/lib/ldap structuralobjectclass: olcModuleList subschemasubentry: cn=Subschema # Entry 3: cn=schema,cn=config ### DELETED default schema definitions for readability # Entry 4: cn={0}core,cn=schema,cn=config ### DELETED default schema definitions for readability # Entry 5: cn={1}cosine,cn=schema,cn=config ### DELETED default schema definitions for readability # Entry 6: cn={2}nis,cn=schema,cn=config ### DELETED default schema definitions for readability # Entry 7: cn={3}inetorgperson,cn=schema,cn=config ### DELETED default schema definitions for readability # Entry 8: olcBackend={0}hdb,cn=config dn: olcBackend={0}hdb,cn=config createtimestamp: 20110429201711Z creatorsname: cn=admin,cn=config entrycsn: 20110429201711.707740Z#000000#000#000000 entrydn: olcBackend={0}hdb,cn=config entryuuid: 69127d0a-06e9-1030-9af5-e9c45301ace2 modifiersname: cn=admin,cn=config modifytimestamp: 20110429201711Z objectclass: olcBackendConfig olcbackend: {0}hdb structuralobjectclass: olcBackendConfig subschemasubentry: cn=Subschema # Entry 9: olcDatabase={-1}frontend,cn=config dn: olcDatabase={-1}frontend,cn=config createtimestamp: 20110429201711Z creatorsname: cn=config entrycsn: 20110429201711.654507Z#000000#000#000000 entrydn: olcDatabase={-1}frontend,cn=config entryuuid: 690a5da0-06e9-1030-9aed-e9c45301ace2 modifiersname: cn=config modifytimestamp: 20110429201711Z objectclass: olcDatabaseConfig objectclass: olcFrontendConfig olcaccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=extern al,cn=auth manage by * break olcaccess: {1}to dn.exact="" by * read olcaccess: {2}to dn.base="cn=Subschema" by * read olcdatabase: {-1}frontend olcsizelimit: 500 structuralobjectclass: olcDatabaseConfig subschemasubentry: cn=Subschema # Entry 10: olcDatabase={0}config,cn=config dn: olcDatabase={0}config,cn=config createtimestamp: 20110429201711Z creatorsname: cn=config entrycsn: 20110619065612.945749Z#000000#000#000000 entrydn: olcDatabase={0}config,cn=config entryuuid: 690a693a-06e9-1030-9aee-e9c45301ace2 modifiersname: cn=admin,cn=config modifytimestamp: 20110619065612Z objectclass: olcDatabaseConfig olcaccess: {0}to * by dn.exact=cn=admin,cn=config read by dn.exact=gidNumber=0+uidNumber=0,cn=pe ercred,cn=external,cn=auth manage by * break olcdatabase: {0}config olcmirrormode: TRUE olcrootdn: cn=admin,cn=config olcrootpw: {SSHA}deletedforsecurityreasons olcsyncrepl: {0}rid=011 provider=ldaps://server1.domain.tld binddn="cn=admin,cn=config" credentials="mysecretpassword" bindmethod=simple starttls=no searchbase="cn=config" type=refreshAndPersist retry="5 5 300 +" timeout=0 network-timeout=0 filter="(objectclass=*)" attrs="*,+" scope=sub olcsyncrepl: {1}rid=012 provider=ldaps://server2.domain.tld binddn="cn=admin,cn=config" credentials="mysecretpassword" bindmethod=simple starttls=no searchbase="cn=config" type=refreshAndPersist retry="5 5 300 +" timeout=0 network-timeout=0 filter="(objectclass=*)" attrs="*,+" scope=sub olcsyncrepl: {2}rid=013 provider=ldaps://server3.domain.tld binddn="cn=admin,cn=config" credentials="mysecretpassword" bindmethod=simple starttls=no searchbase="cn=config" type=refreshAndPersist retry="5 5 300 +" timeout=0 network-timeout=0 filter="(objectclass=*)" attrs="*,+" scope=sub structuralobjectclass: olcDatabaseConfig subschemasubentry: cn=Subschema # Entry 11: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config createtimestamp: 20110512150606Z creatorsname: cn=admin,cn=config entrycsn: 20110522201415.682681Z#000000#000#000000 entrydn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config entryuuid: 1ae3191c-10f5-1030-9102-e14c7638455a modifiersname: cn=admin,cn=config modifytimestamp: 20110522201415Z objectclass: olcOverlayConfig objectclass: olcSyncProvConfig objectclass: top olcoverlay: {0}syncprov olcspcheckpoint: 100 10 structuralobjectclass: olcSyncProvConfig subschemasubentry: cn=Subschema # Entry 12: olcDatabase={1}hdb,cn=config dn: olcDatabase={1}hdb,cn=config createtimestamp: 20110512144416Z creatorsname: cn=admin,cn=config entrycsn: 20110619123128.846982Z#000000#000#000000 entrydn: olcDatabase={1}hdb,cn=config entryuuid: 0e60d5a6-10f2-1030-9d9b-35ce2d01c34c modifiersname: cn=admin,cn=config modifytimestamp: 20110619123128Z objectclass: olcDatabaseConfig objectclass: olcHdbConfig olcaccess: {0}to attrs=userPassword,shadowLastChange by self write by anonym ous auth by dn="cn=admin,cn=config" write by * none olcaccess: {1}to dn.base="" by * read olcaccess: {2}to * by self write by dn="cn=admin,cn=config" write by * read olcdatabase: {1}hdb olcdbcheckpoint: 512 30 olcdbconfig: {0}set_cachesize 0 2097152 0 olcdbconfig: {1}set_lk_max_objects 1500 olcdbconfig: {2}set_lk_max_locks 1500 olcdbconfig: {3}set_lk_max_lockers 1500 olcdbdirectory: /var/lib/ldap/ olcdbindex: objectClass eq olcdbindex: entryCSN eq olcdbindex: entryUUID eq olclastmod: TRUE olcmirrormode: TRUE olcrootdn: cn=admin,cn=config olcrootpw: {SSHA}s1C7GBjdeletedforsecurityreasons olcsuffix: dc=domain,dc=tld olcsyncrepl: {0}rid=011 provider=ldaps://server1.domain.tld binddn="cn=admin,cn=config" credentials="mysecretpassword" bindmethod=simple starttls=no searchbase="dc=domain,dc=tld" type=refreshAndPersist retry="5 5 300 +" timeout=0 network-timeout=0 filter="(objectclass=*)" attrs="*,+" scope=sub olcsyncrepl: {1}rid=012 provider=ldaps://server2.domain.tld binddn="cn=admin,cn=config" credentials="mysecretpassword" bindmethod=simple starttls=no searchbase="dc=domain,dc=tld" type=refreshAndPersist retry="5 5 300 +" timeout=0 network-timeout=0 filter="(objectclass=*)" attrs="*,+" scope=sub olcsyncrepl: {2}rid=013 provider=ldaps://server3.domain.tld binddn="cn=admin,cn=config" credentials="mysecretpassword" bindmethod=simple starttls=no searchbase="dc=domain,dc=tld" type=refreshAndPersist retry="5 5 300 +" timeout=0 network-timeout=0 filter="(objectclass=*)" attrs="*,+" scope=sub structuralobjectclass: olcHdbConfig subschemasubentry: cn=Subschema # Entry 13: olcOverlay={0}syncprov,olcDatabase={1}hdb,cn=config dn: olcOverlay={0}syncprov,olcDatabase={1}hdb,cn=config createtimestamp: 20110522163658Z creatorsname: cn=admin,cn=config entrycsn: 20110522201502.521704Z#000000#000#000000 entrydn: olcOverlay={0}syncprov,olcDatabase={1}hdb,cn=config entryuuid: 74b70896-18dd-1030-94f4-2183161cb5d6 modifiersname: cn=admin,cn=config modifytimestamp: 20110522201502Z objectclass: olcOverlayConfig objectclass: olcSyncProvConfig objectclass: top olcoverlay: {0}syncprov olcspcheckpoint: 100 10 structuralobjectclass: olcSyncProvConfig subschemasubentry: cn=Subschema

1 0

Sendmail + LDAP
by Vasily Yakovlev 29 Jun '11

29 Jun '11

Hi, I experince some problems with setting up Sendmail with the LDAP database for virtual mail accounts. I believe, that the reason of my problem is in configuring dovecot-deliver, but nobody answers me in the dovecot-mailing list, so i've decided to post a message here What i have: - FreeBSD 8.2-RELEASE - sendmail (Version 8.14.4 with LDAP support installed from ports) - Dovecot LDA + dovecot (as pop3/imap) - 1.2.16 - openldap - 2.4.23 1. Following http://wiki.dovecot.org/LDA/Sendmail i've set up deliver as LDA. Everything worked fine. 2. Following http://wiki.dovecot.org/HowTo/DovecotOpenLdap i've set up Dovecot to work with tha ldap. Now i can authorize through the client or web interface and get to my maildir. 3. Now, i want my sendmail to accept mail for the account in LDAP database. sendmail.mc: ++++++++++++++++++++++ FEATURE(`local_procmail', `/usr/local/libexec/dovecot/deliver',`/usr/local/libexec/dovecot/deliver -d $u') MODIFY_MAILER_FLAGS(`LOCAL', `-f') ...................................... define(`confLDAP_DEFAULT_SPEC', `-h "localhost" -b "dc=mydomain,dc=ru" -d "cn=dovecot,ou=accounts,dc=mydomain,dc=ru" -MLDAP_AUTH_SIMPLE -P /etc/mail/ldap_pass')dnl LDAPROUTE_DOMAIN(`mydomain.ru')dnl FEATURE(`ldap_routing', `null -T<TMPF>', `ldap -1 -T<TMPF> -v mail -k (&(objectclass=posixaccount)(mail=%0))', `passthru')dnl ...................................... MAILER(procmail) ++++++++++++++++++++++ After re-making the sendmail: ++++++++++++++++++++++ [root@test2 /etc/mail]# sendmail -bv -d60.1 test_user(a)mydomain.ru map_lookup(dequote, test) => NOT FOUND (0) map_lookup(host, mydomain.ru) => mydomain.ru. (0) map_lookup(dequote, test_user) => NOT FOUND (0) map_lookup(ldapmra, test_user(a)mydomain.ru) => test_user(a)mydomain.ru (0) map_lookup(ldapmh, test_user(a)mydomain.ru) => NOT FOUND (68) map_lookup(host, mydomain.ru) => mydomain.ru. (0) map_lookup(dequote, test_user) => NOT FOUND (0) map_lookup(virtuser, test_user(a)mydomain.ru) => NOT FOUND (0) map_lookup(virtuser, @mydomain.ru) => NOT FOUND (0) test_user(a)mydomain.ru... User unknown ++++++++++++++++++++++ It's the problem of the local delivery, i believe. Why? Because after sendmail getting an email it passes it to the LDA, which must check the LDAP (not the passwd!) database for the user, to which this email is send to. Are there some possibilities to solve this problem? Or, maybe there might be a problem in cofiguring the OpenLDAP? I appreciate any help... ----------------------- Best regards, Vasily Yakovlev

1 0

SASL working but kerberos DOMAIN is not set
by Friedrich Locke 28 Jun '11

28 Jun '11

I have setted openldap+sasl+kerberos. It is working but the keberos realm is not seted in the bind dn, why? Here is my session: sioux@gustav$ ldapsearch -Y GSSAPI -b "" -s base -LLL supportedSASLMechanisms SASL/GSSAPI authentication started SASL username: sioux(a)UFV.BR SASL SSF: 56 SASL data security layer installed. dn: supportedSASLMechanisms: OTP supportedSASLMechanisms: NTLM supportedSASLMechanisms: GSSAPI supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: CRAM-MD5 sioux@gustav$ Here is what i got from slapd err output : ... ... ... do_bind: dn () SASL mech GSSAPI slap_sasl_getdn: u:id converted to uid=sioux,cn=GSSAPI,cn=auth >>> dnNormalize: <uid=sioux,cn=GSSAPI,cn=auth> <<< dnNormalize: <uid=sioux,cn=gssapi,cn=auth> ==>slap_sasl2dn: converting SASL name uid=sioux,cn=gssapi,cn=auth to a DN <==slap_sasl2dn: Converted SASL name to <nothing> SASL Authorize [conn=1001]: proxy authorization allowed authzDN="" send_ldap_sasl: err=0 len=-1 do_bind: SASL/GSSAPI bind: dn="uid=sioux,cn=gssapi,cn=auth" sasl_ssf=56 send_ldap_response: msgid=3 tag=97 err=0 ber_flush2: 14 bytes to sd 13 ... ... ... Any ideia about what is going on ?

2 1

Re: access
by Friedrich Locke 28 Jun '11

28 Jun '11

Sorry folks, please forgive me, i forgot to let you know i am using kerberos (SASL); so i bind via sasl mechanism not as the dn owned by me. Thanks once more for your help. On Tue, Jun 28, 2011 at 2:05 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, June 28, 2011 10:05 AM -0300 Friedrich Locke > <friedrich.locke(a)gmail.com> wrote: > >> Dear list members, >> >> i would like to use openldap for unix users and group of my local >> network. I started studying openldap access mechanism yesterday; and i >> am a little confused. >> >> I am writing in order to get some help for a single scenario i would >> like to share with you. >> >> My users will be below ou=users,dc=ufv,dc=br. >> >> I would like to write an access rule for the following. >> >> User X had complete access to his/her entry: >> >> cn=X,dc=ufv,dc=br > > by self write > by users read > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

access
by Friedrich Locke 28 Jun '11

28 Jun '11

Dear list members, i would like to use openldap for unix users and group of my local network. I started studying openldap access mechanism yesterday; and i am a little confused. I am writing in order to get some help for a single scenario i would like to share with you. My users will be below ou=users,dc=ufv,dc=br. I would like to write an access rule for the following. User X had complete access to his/her entry: cn=X,dc=ufv,dc=br but only read access for the others entry below dc=ufv,dc=br. How could this access be implemente? Is it possible? Thanks a lot for your time and support. Fried.

2 1

LDAP-Proxy: backend inaccessible via ldaps (w/o proxy no errors)
by Jahnke-Zumbusch, Dirk 27 Jun '11

27 Jun '11

Hi all, I would like to use the proxy features (and as soon as this works for me also some kind of rewriting / mapping) with openldap 2.4.25: ./configure --prefix=/scratch/openldap \ --with-tls=openssl \ --enable-meta \ --enable-ldap \ --enable-rewrite \ --enable-rwm \ --enable-bdb \ --enable-overlays \ --enable-perl \ --enable-shell make install... I may access one LDAP backend via ldap: but not the other (Active Directory) via ldaps: What works fine is 1. ldapsearch for LDAP-Tree-1 / Server-1: ========================================= Direct access to LDAP server: ----------------------------- ldapsearch -x -H ldap://ldap-server-1 -b 'ou=OU1,o=desy,c=de' '(mail=*)' | fgrep num # numResponses: 7 # numEntries: 6 and using the proxy: ----------------------------- ldapsearch -x -H ldap://ldap-proxy -b 'ou=OU1,o=desy,c=de' '(mail=*)' | fgrep num # numResponses: 7 # numEntries: 6 (This tree is rather small.) what is not working is 2. ldapsearch for Active-Directory / Server-2: ============================================== Direct Access to AD-Server ----------------------------- ldapsearch -x -H ldaps://domain-controller \ -D CN=accountname,OU=...,OU=...,OU=...,DC=desy,DC=de \ -W \ -b 'ou=ou1,...,dc=desy,dc=de' \ '(samaccountname=testuser)' | fgrep num Enter LDAP Password: # numResponses: 2 # numEntries: 1 Doing the same via the proxy fails: ----------------------------------- ldapsearch -x -H ldap://ldap-proxy -b 'ou=...,...,dc=desy,dc=de' # extended LDIF # # LDAPv3 # base <ou=...,...,dc=desy,dc=de> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 48 Inappropriate authentication # numResponses: 1 I would like to understand why this fails. slapd.conf is like this ---------- include /scratch/openldap/etc/openldap/schema/core.schema include /scratch/openldap/etc/openldap/schema/cosine.schema include /scratch/openldap/etc/openldap/schema/inetorgperson.schema idletimeout 120 pidfile /scratch/openldap/var/run/slapd.pid argsfile /scratch/openldap/var/run/slapd.args # -- 1st LDAP-backend, the one which works, see 1. above database ldap uri ldap://ldap-server-1:portnumber/ suffix "ou=ouA,o=desy,c=de" # -- 2nd LDAP-/Active-Driectory-backend, that one, which fails database ldap suffix "ou=OU1,...,dc=desy,dc=de" uri ldaps://domain-controller/ acl-bind bindmethod=simple binddn="CN=...,DC=desy,DC=de" credentials=TopSecret idassert-bind bindmethod=simple binddn="CN=...,DC=desy,DC=de" credentials=TopSecret mode=none tls_cacertdir=/etc/pki/tls/certs tls_reqcert=never tls_crlcheck=none idle-timeout 1800 rebind-as-user yes # -- just to make sure for now that I will see everything access to * by * read # === END OF SLAPD.CONF === When I am strace'ing slapd with "-e trace=file -f" I cannot see that any file in tls_cacertdir is read. But I would have expected that. Any directions what I should looking for, now? Kind regards, Dirk -- Dirk Jahnke-Zumbusch Deutsches Elektronen-Synchrotron DESY IT Information Fabrics Member of the Helmholtz Association D-22603 Hamburg Notkestrasse 85 / 22607 Hamburg T: +49-40-899.81760 F: +49-40-899.41760 dirk.jahnke-zumbusch(a)desy.de

1 0

How to perform windows domain authentication with openldap
by Jintao Fang 27 Jun '11

27 Jun '11

I am trying to develop a ldap client with openldap and cyrus-sasl, there is one feature that user can directly sign to the ldap server if he is in a domain. Does anyone have used openldap like this? Thanks a lot.

5 4

back-sql modified queries
by Mark Nienberg 24 Jun '11

24 Jun '11

1 0

ACL caused uidNumber=4294967295 ?
by niko 24 Jun '11

24 Jun '11

Hi,I got weird problem with ldap & samba &sssd。 pdbedit -L showed all users having the same uid (4294967295) ACL : [root@rhel6 slapd.d]# grep -ir "olcAccess" . ./cn=config/olcDatabase={2}monitor.ldif:olcAccess: {0}to * by dn.base="cn=manager,dc=my-domain,dc=com" read by * none ./cn=config/olcDatabase={0}config.ldif:olcAccess: {0}to * by * none ./cn=config/olcDatabase={1}bdb.ldif:olcAccess: to * by * read by self write More specification below： -------------------------------------------------------------------------------------------------------------------------------------------------------- [root@rhel6 cn=config]# pdbedit -L testsmb:4294967295:testsmb *<sometimes, the user testsmb has correct uid 503, I don't know why> *test2:4294967295:test2 test3:4294967295:test3 [root@rhel6 ~]# getent -s sss passwd example:*:9999:9999::/home/example:/bin/sh *<sometimes,we can get user testsmb here>* [root@rhel6 cn=config]# ldapsearch -x -D "cn=root,dc=rhel6,dc=ldaptest,dc=com" -W ........ # testsmb, rhel6.ldaptest.com dn: uid=testsmb,dc=rhel6,dc=ldaptest,dc=com cn: testsmb uid: testsmb uidNumber: 503 loginShell: /bin/bash homeDirectory: /home/testsmb gidNumber: 500 userPassword:: e2NyeXB0fUFPblQvYkJsbEJTWFk= objectClass: posixAccount objectClass: shadowAccount objectClass: person objectClass: sambaSamAccount sambaPwdLastSet: 1308553125 sambaPwdCanChange: 1308553125 sambaNTPassword: 1D82374AB98BB16761B9A4F90441E201 sambaLMPassword: 67E272A0267766A117306D272A9441BB sambaPrimaryGroupSID: 2001 sambaAcctFlags: [U ] shadowLastChange: 15145 gecos: testsmb sn: testsmb sambaSID: S-1-5-21-423381952-115127825-699677302-1004 # test2, rhel6.ldaptest.com Dn: uid=test2,dc=rhel6,dc=ldaptest,dc=com cn: test2 uid: test2 uidNumber: 504 loginShell: /bin/bash homeDirectory: /home/test2 gidNumber: 500 userPassword:: e2NyeXB0fVhSbXVGQUd2cHMublE= objectClass: posixAccount objectClass: shadowAccount objectClass: person objectClass: sambaSamAccount sambaPwdLastSet: 1308557836 sambaPwdCanChange: 1308557836 sambaNTPassword: 1D82374AB98BB16761B9A4F90441E201 sambaLMPassword: 67E272A0267766A117306D272A9441BB sambaPrimaryGroupSID: 2001 sambaAcctFlags: [U ] shadowLastChange: 15145 gecos: test2 sn: test2 sambaSID: S-1-5-21-423381952-115127825-699677302-1005 # example, rhel6.ldaptest.com dn: uid=example,dc=rhel6,dc=ldaptest,dc=com cn: Example user sn: Example user uid: example uidNumber: 9999 gidNumber: 9999 loginShell: /bin/sh homeDirectory: /home/example objectClass: posixAccount objectClass: person userPassword:: KkxLKg== smb.conf security = user passdb backend = ldapsam:ldap://rhel6.ldaptest.com ldap admin dn = "cn=root,dc=rhel6,dc=ldaptest,dc=com" ldap suffix = dc=rhel6,dc=ldaptest,dc=com ldap group suffix = ou=Groups ldap machine suffix = ou=Computers ldap idmap suffix = ou=Idmap ldap ssl = start tls ldap passwd sync = yes Debug info show below slapd debug acl ------------------------------------------------------------------------------------------------------------------------------------ [root@rhel6 ~]# service slapd start Starting slapd: @(#) $OpenLDAP: slapd 2.4.19 (Jun 30 2010 03:56:07) $ mockbuild@x86-003.build.bos.redhat.com:/builddir/build/BUILD/openldap-2.4.19/openldap-2.4.19/build-servers/servers/slapd => access_allowed: search access to "cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={0}corba,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={1}core,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={2}cosine,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={3}duaconf,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={4}dyngroup,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={5}inetorgperson,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={6}java,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={7}misc,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={8}nis,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={9}openldap,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={10}ppolicy,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={11}collective,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={12}samba,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "olcDatabase={-1}frontend,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "olcDatabase={0}config,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) Backend ACL: access to * by * none /etc/openldap/slapd.d: line 1: warning: cannot assess the validity of the ACL scope within backend naming context => access_allowed: search access to "olcDatabase={1}bdb,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) Backend ACL: access to * by * read by self write /etc/openldap/slapd.d: line 1: warning: cannot assess the validity of the ACL scope within backend naming context => access_allowed: search access to "olcDatabase={2}monitor,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) Backend ACL: access to * by dn.base="cn=manager,dc=my-domain,dc=com" read by * none /etc/openldap/slapd.d: line 1: warning: cannot assess the validity of the ACL scope within backend naming context slapd starting * * *debug info for " su - test2"* sssd debug info ------------------------------------------------------------------------------------------------------------------------------------------------------------- (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_parse_entry] (9): OriginalDN: [uid=test2,dc=rhel6,dc=ldaptest,dc=com]. (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_process_result] (8): Trace: sh[0x9e08488], connected[1], ops[0x9ea1b10], ldap[0x9e08540] (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_get_generic_done] (6): Search result: Success(0), (null) (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_get_users_process] (6): Search for users, returned 1 results. (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_process_result] (8): Trace: sh[0x9e08488], connected[1], ops[(nil)], ldap[0x9e08540] (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_process_result] (8): Trace: ldap_result found nothing! (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [ldb] (9): start ldb transaction (nesting: 0) (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_save_user_send] (9): Save user (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_save_user_send] (2): User [test2] filtered out! (id out of range) (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_save_users_process] (2): Failed to store user 0. Ignoring. (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [ldb] (9): commit ldb transaction (nesting: 0) (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_get_users_done] (9): Saving 1 Users - Done (Tue Jun 21 11:02:48 2011) [sssd[nss]] [sbus_remove_timeout] (8): 0x9dcde28 (Tue Jun 21 11:02:48 2011) [sssd[nss]] [sbus_dispatch] (9): dbus conn: 9DCDF38 (Tue Jun 21 11:02:48 2011) [sssd[nss]] [sbus_dispatch] (9): Dispatching. (Tue Jun 21 11:02:48 2011) [sssd[nss]] [sss_dp_get_reply] (4): Got reply (0, 0, Success) from Data Provider (Tue Jun 21 11:02:48 2011) [sssd[nss]] [nss_cmd_getpwnam_callback] (2): No matching domain found for [test2], fail! (Tue Jun 21 11:02:48 2011) [sssd[nss]] [nss_cmd_getpwnam_callback] (2): No results for getpwnam call (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [acctinfo_callback] (4): Request processed. Returned 0,0,Success slapd debug info ----------------------------------------------------------------------------------------------------------------------------------------------------------------- => acl_mask: access to entry "dc=rhel6,dc=ldaptest,dc=com", attr "entry" requested => acl_mask: to all values by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: search access granted by read(=rscxd) => access_allowed: search access granted by read(=rscxd) => access_allowed: search access to "dc=rhel6,dc=ldaptest,dc=com" "entry" requested => acl_get: [1] attr entry => acl_mask: access to entry "dc=rhel6,dc=ldaptest,dc=com", attr "entry" requested => acl_mask: to all values by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: search access granted by read(=rscxd) => access_allowed: search access granted by read(=rscxd) => access_allowed: search access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "uid" requested => acl_get: [1] attr uid => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "uid" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: search access granted by read(=rscxd) => access_allowed: search access granted by read(=rscxd) => access_allowed: search access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "objectClass" requested => acl_get: [1] attr objectClass => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "objectClass" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: search access granted by read(=rscxd) => access_allowed: search access granted by read(=rscxd) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "entry" requested => acl_get: [1] attr entry => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "entry" requested => acl_mask: to all values by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (cn) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "cn" requested => acl_get: [1] attr cn => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "cn" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (uid) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "uid" requested => acl_get: [1] attr uid => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "uid" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (uidNumber) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "uidNumber" requested => acl_get: [1] attr uidNumber => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "uidNumber" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (loginShell) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "loginShell" requested => acl_get: [1] attr loginShell => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "loginShell" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (homeDirectory) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "homeDirectory" requested => acl_get: [1] attr homeDirectory => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "homeDirectory" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (gidNumber) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "gidNumber" requested => acl_get: [1] attr gidNumber => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "gidNumber" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (userPassword) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "userPassword" requested => acl_get: [1] attr userPassword => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "userPassword" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (objectClass) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "objectClass" requested => acl_get: [1] attr objectClass => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "objectClass" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result was in cache (objectClass) => access_allowed: result was in cache (objectClass) => access_allowed: result was in cache (objectClass) => access_allowed: result not in cache (shadowLastChange) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "shadowLastChange" requested => acl_get: [1] attr shadowLastChange => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "shadowLastChange" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (gecos) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "gecos" requested => acl_get: [1] attr gecos => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "gecos" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (modifyTimestamp) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "modifyTimestamp" requested => acl_get: [1] attr modifyTimestamp => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "modifyTimestamp" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd)

1 0

ppolicy overlay and pwdreset attribute question
by Cyril GROSJEAN 24 Jun '11

24 Jun '11

I use OpenLDAP 2.4.24 with the following default password policy, because I want my users to change their password at first connection, or after a password reset by an administrator: dn: cn=default,ou=policies,dc=company cn: default description: Strategie de gestion des mots de passe par defaut objectClass: top objectClass: person objectClass: pwdPolicy pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 2 pwdExpireWarning: 0 pwdFailureCountInterval: 0 pwdGraceAuthNLimit: 0 pwdInHistory: 0 pwdMaxAge: 0 pwdMaxFailure: 0 pwdMinAge: 0 pwdMinLength: 8 pwdMustChange: TRUE pwdSafeModify: FALSE sn: policy When creating a user account (either as administrator or any user with sufficient rights), the pwdReset attribute is not set automatically, and thus, the newly created user can bind and search without being forced to change his password. I have to manually set the pwdReset attribute to TRUE in the user entry at creation time or after creation to force a password change. Is this normal behaviour ? I would have expected to see the pwdReset attribute automatically set (by the ppolicy overlay). Otherwise, setting pwdMustChange to TRUE in the password policy definition looks unuseful. On the contrary, when the user changes his password, the pwdReset attribute is automatically removed, which tends to mean the password policy overlay is called and does something in this case ..

3 5

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical