openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

TLS replication/SALS bindmethod
by Darouichi, Aziz 23 May '11

23 May '11

Hi, I configured Muti-master replication, everything worked fine till I hashed rootpw to confirm to a hardcoded password in Oracle. I configured OpenLDAP servers to us SALS. This is my configuration. provider=ldap://xxx.xxx.xxx:389 bindmethod=sasl saslmech=external starttls=yes tls_cert=/etc/pki/tls/certs/slapd.pem tls_key=/etc/pki/tls/private/ldap.pem tls_cacert=/etc/pki/tls/certs/ca-bundle.crt tls_reqcert=demand binddn="cn=ldap,dc=establishment,dc=edu" credentials={SSHA}2vNffW+5hEolqIykgH9tCpxq9jTTVSSu searchbase="dc=establishment,dc=edu" schemachecking=on type=refreshAndPersist retry="60 +" when I run ldapsearch against servers I get response from both machines. ldapsearch -H ldap://server.establishment.edu -D "cn=ldap,dc=establishment,dc=edu" -w "PASSWORD" -x -b "dc=establishment ,dc=edu" "(objectclass=*)" uid. This what I get in the logs: May 23 09:37:01 ldap1 slapd[1559]: slap_client_connect: URI=ldap://xxx.xxx.edu:389 ldap_sasl_interactive_bind_s failed (-6) May 23 09:37:01 ldap1 slapd[1559]: do_syncrepl: rid=002 rc -6 retrying May 23 09:37:58 ldap1 slapd[1559]: conn=5220 op=0 do_extended: unsupported operation "1.3.6.1.4.1.1466.20037" May 23 09:38:01 ldap1 slapd[1559]: slap_client_connect: URI=ldap://xxx.xxx.edu:389 Warning, ldap_start_tls failed (2) May 23 09:38:01 ldap1 slapd[1559]: slap_client_connect: URI=ldap://xxx.xxx.edu:389 ldap_sasl_interactive_bind_s failed (-6) May 23 09:38:01 ldap1 slapd[1559]: do_syncrepl: rid=002 rc -6 retrying Thanks

2 2

OpenLDAP Windows Compilation Failed
by mammar 23 May '11

23 May '11

Hi All, I am trying to compile the stable openldap-2.4.23 using the instructions mentioned in INSTALL file in the package. ./configure make depend The above two commands completed successfully make gives the following error Entering subdirectory libldap make[2]: Entering directory `/cygdrive/c/Documents and Settings/ma/Desktop/openldap-2.4.23/libraries/libldap' cc -g -O2 -I../../include -I../../include -c -o apitest.o apitest.c /bin/sh ../../libtool --mode=link cc -static -g -O2 -o apitest apitest.o libldap.la ../../libraries/liblber/liblber.la../../libraries/liblutil/liblutil.a -lsasl2 -lssl -lcrypto libtool: link: cannot find the library `Settings/ma/Desktop/openldap-2.4.23/libraries/liblber/liblber.la' or unhandled argument `Settings/ma/Desktop/openldap-2.4.23/libraries/liblber/ liblber.la' make[2]: *** [apitest] Error 1 make[2]: Leaving directory `/cygdrive/c/Documents and Settings/ma/Desktop/openldap-2.4.23/libraries/libldap' make[1]: *** [all-common] Error 1 make[1]: Leaving directory `/cygdrive/c/Documents and Settings/ma/Desktop/openldap-2.4.23/libraries' make: *** [all-common] Error 1 Can anyone suggest a solution/workaround? Regards,

1 0

Issue while Centralizing SUDO with OpenLDAP
by pradyumna dash 23 May '11

23 May '11

Hi, I am trying to acheive centralizing SUDO, but facing an issue,i suspect its something to do with sudoers.schema, May be am wrong. I think somehow the slapd process is not able to read it. Please suggest how to fix the issue. My LDAP structure is like : dc=example,dc=com Under this I have OU=People and i have created a OU called SUDOers. Then i have used the sudoers2ldif to generate the LDIF file for me. I have setted the env variable SUDOERS_BASE=ou=SUDOers,dc=example,dc=com. Then when am trying to add the ldif file it shows me below error. t710x02-6:/etc/openldap/schema # ldapadd -f /opt/newsudo.ldif -h 127.0.0.1 -D cn=Manager,dc=example,dc=com -W -x Enter LDAP Password: adding new entry "cn=defaults,ou=SUDOers,dc=example,dc=com" ldap_add: Invalid syntax (21) additional info: objectClass: value #0 invalid per syntax sudoers.ldif dn: cn=defaults,ou=SUDOers,dc=example,dc=com #objectClass: top objectClass: sudoRole cn: defaults description: Default sudoOption's go here sudoOption: always_set_home sudoOption: env_reset sudoOption: env_keep = "LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS XDG_SESSION_COOKIE" sudoOption: targetpw dn: cn=ALL,ou=SUDOers,dc=example,dc=com objectClass: top objectClass: sudoRole cn: ALL sudoUser: ALL sudoHost: ALL sudoRunas: ALL sudoCommand: ALL dn: cn=root,ou=SUDOers,dc=example,dc=com objectClass: top objectClass: sudoRole cn: root sudoUser: root sudoHost: ALL sudoRunas: ALL sudoCommand: ALL dn: cn=prad,ou=SUDOers,dc=example,dc=com objectClass: top objectClass: sudoRole cn: prad sudoUser: prad sudoHost: ALL sudoRunas: ALL sudoCommand: ALL sudoers.schema # # OpenLDAP schema file for Sudo # Save as /etc/openldap/schema/sudo.schema # attributetype ( 1.3.6.1.4.1.15953.9.1.1 NAME 'sudoUser' DESC 'User(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 1.3.6.1.4.1.15953.9.1.2 NAME 'sudoHost' DESC 'Host(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 1.3.6.1.4.1.15953.9.1.3 NAME 'sudoCommand' DESC 'Command(s) to be executed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 1.3.6.1.4.1.15953.9.1.4 NAME 'sudoRunAs' DESC 'User(s) impersonated by sudo (deprecated)' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 1.3.6.1.4.1.15953.9.1.5 NAME 'sudoOption' DESC 'Options(s) followed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 1.3.6.1.4.1.15953.9.1.6 NAME 'sudoRunAsUser' DESC 'User(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 1.3.6.1.4.1.15953.9.1.7 NAME 'sudoRunAsGroup' DESC 'Group(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) objectclass ( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' SUP top STRUCTURAL DESC 'Sudoer Entries' MUST ( cn ) MAY ( sudoUser $ sudoHost $ sudoCommand $ sudoRunAs $ sudoRunAsUser $ sudoRunAsGroup $ sudoOption $ description ) ) Please help me to solve this issue. I am using SLES 11 and SUDO 1.6.9p17 Regards, Neo

3 3

Slapd, GNUTLS on Debian/Squeeze
by David Dumortier 23 May '11

23 May '11

Hi everybody, I try to setup a slapd with TLS. ldd /usr/sbin/slapd returns gnutls.so as waited. I generated a self-signed certificate with these options : certtool --generate-privkey --outfile /etc/ldap/ssl/mykey.key certtool --generate-request --load-privkey /etc/ldap/ssl/mykey.key --outfile /etc/ldap/ssl/mycsr.csr Basic Constraints (critical): Certificate Authority (CA): TRUE Key Purpose (not critical): TLS WWW Client. TLS WWW Server. Code signing. OCSP signing. Time stamping. Key Usage (critical): Digital signature. Key encipherment. Certificate signing. CRL signing. My slapd start but when I try a debug I have : # gnutls-cli-debug -p 636 myip Checking for TLS 1.1 support... no Checking fallback from TLS 1.1 to... failed Checking for TLS 1.0 support... no Checking for SSL 3.0 support... no Server does not support any of SSL 3.0, TLS 1.0 and TLS 1.1 Here is my slapd conf : olcTLSVerifyClient: demand olcTLSCertificateFile: /etc/ldap/ssl/mycsr.csr olcTLSCertificateKeyFile: /etc/ldap/ssl/mykey.key Any help would be appreciate -- David Dumortier

5 12

smbk5pwd tries to load krb when not configured
by Mike Noordermeer 22 May '11

22 May '11

Hi, I'm running slapd v2.4.23 with a cn=config configuration format. The LDAP tree both has the Kerberos as well as the Samba scheme loaded. I'm trying to setup smbk5pwd to sync Samba passwords with the LDAP passwords. Note that I do not want to do anything with the Kerberos passwords. I use the following configuration snippet: dn: olcOverlay={2}smbk5pwd objectClass: olcOverlayConfig objectClass: olcSmbK5PwdConfig olcOverlay: {2}smbk5pwd olcSmbK5PwdEnable: samba olcSmbK5PwdMustChange: 0 This leads to an error in the logs and the module not loading: May 22 11:02:55 host slapd[3160]: smbk5pwd: unable to initialize krb5 admin context: failed to open /var/lib/heimdal-kdc/m-key: Permission denied (13). Seems like smbk5pwd still wants to load the Kerberos stuff... Any ideas? -- tia, Mike Noordermeer mike(a)normi.net

1 0

SSL Connect Error message?
by Eric Nichols (DirWiz) 21 May '11

21 May '11

I checked through the archives and couldn't find a real mention of this. When a failed connection happens over SSL (OpenSSL) the most information I can get back is what ldap_err2string returns. The problem is I don't know if it's a true connection failure or a SSL session error or even a certificate error. Is there a way to get more useful information out of a failed SSL connection. I do know about LDAP_OPT_X_TLS_SSL_CTX but can't figure out if that points to an error message somewhere. -- Many thanks Eric

1 0

Can a Shadow Server "Proxy" UpdateRef?
by Ben Rockwood 20 May '11

20 May '11

I want to shadow my directory into multiple locations. I'd like to use updateref to provide a way to make writes back to the master. The problem is that updateref hands a new LDAP URI back to the client who then tries to connect to the appropriate server... this is a problem if the client does not have access to connect directly to the referred server. In my case the shadow server has access to the master but the clients do not (private subnet). Is there a way for the shadow server to send the write operation to the master itself, as though its proxying it, rather than returning a referral to the client? benr.

2 2

Objects that have no objectClass ?
by Torsten Schlabach (Tascel eG) 20 May '11

20 May '11

Hi all! I am querying an Active Directory, using the ldapsearch utility provided by OpenLDAP. Normally, for each entry that ldapsearch returns, I am used to finding at least one line which starts with dn: and one (or more) which start with objectClass:. This is the case for the majority of the objects which I can find in the given AD tree, but I can spot at least one which does have a dn: and a couple of other attributed (in other words: the entry exists) but just no objectClass. Any idea how this is possible? Regards, Torsten

2 1

Re: MirrorMode vs MultiMaster Questions
by Ben Rockwood 19 May '11

19 May '11

Looking even more at the code and the commit history, it turns out that in 2006 when MirrorMode was added it was in fact called "multimaster"... the name was simply changed to mirrormode later with no major changes to the code. So, it really looks like MirrorMode is MultiMaster, the only difference being a 2 node multimaster shadows only its peer, whereas a 3+ node multimaster shadows multiple. This is perhaps best seen in the modify code, where if the configuration is not SINGLE_SHADOW (ie: MultiMaster) it passes a referral instead of accepting the operation. Therefore, the language in the docs is more specific than I realized. "Active/Active MirrorMode" and "N-Way MultiMaster" are accurate and if you omit them you miss the point. The real point here is that in MirrorMode you're told to only send writes to a single node. I want a 2-Way Multimaster in which I can send writes to either. And it in practice you can, but you're not (according to the docs) supposed to. Its like the authors didn't trust their own synchronization code. I can only infer that there might be problems in high write environments to 2 nodes... from which I further infer that for environments using LDAP for NIS-Replacement where writes are very rare its not a practical problem. In this type of setup I just want basic HA, I don't want load balancers and multiple shadows, just 2 slapds in A/A config. benr. On 5/16/11 2:32 AM, Marcel van Dorp wrote: > Hi, > > I'm investigating the same thing. I found some interesting docs on > www.zytrax.com/books/ldap > > On 05/16/2011 10:24 AM, Ben Rockwood wrote: > > I'm having some problems understanding the subtleties of MirrorMode vs > > MultiMaster configurations. Any help with the following questions would > > be helpful: > > > 1) It looks like the only real difference between a MirrorMode and > > Multimaster configuration is whether or not the RIDs are different. In > > MirrorMode both sides have the same rid, in Multimaster they are > > different. Is that so? > > - From what I understand, with mirrormode=FALSE the consumers are > readonly, and updates are referred back to the provider. > > with mirrormode=TRUE, the consumers are mirrors of the provider, and > updates can be processed locally. The multimaster config (using > syncrepl) then updates all other masters. > > > > 2) Passing through the code, "MirrorMode" is really "Single Master" and > > MultiMaster is just "not Single Master". But the code path to determine > > whether it is single master or not confuses me. How does slapd actually > > determine this? > > > During startup, the deamon is provided with the URI to listen on. I'm on > Debian, where this is configured in /etc/default/slapd. Doing a 'ps ax > |grep slapd' shows this: > > 7741 ? Ssl 0:00 /usr/sbin/slapd -h ldap://127.0.0.1:389/ > ldap://hostname.domain.com/ ldaps://hostname.domain.com/ ldapi:/// -g > openldap -u openldap -F /etc/ldap/slapd.d/ > > The serverID also refers to this URI, to determine the local process > (after all, serverIDs will also be syncrepl'd): > > olcServerID: 11 ldaps://hostname.domain.com/ > olcServerID: 12 ldaps://another.domain.com/ > olcServerID: 13 ldaps://thirdhost.domain.com/ > > > > > 3) For MultiMaster, the docs show using syncrepl to replicate cn=config > > and the directory (or directories if you have more than one) > > independently. Is it really necessary to replicate cn=config if the > > configuration isn't changing? (What I'm really looking for here is to > > find out if there is state information in cn=config thats being used or > > if its simply a good idea to ensure the configs are the same by using > > syncrepl.) > > > The main issue for me, is that I need to have the ACLs in sync, and > those are in cn=config. I'm still working on this, so please bear with > me if above info is not completely correct. > > Regards, > > Marcel > > > > Thanks, > > > benr. > > >

3 2

one-to-many rwm objectclass map
by Ron Peterson 19 May '11

19 May '11

I'm trying to map a single objectclass to more than one objectclass using the rwm overlay. e.g. myclass -> inetOrgPerson -> eduPerson ...because 'myclass' contains some attributes I want to rewrite to attributes belonging to inetOrgPerson, and some attributes I want to rewrite to attributes belonging to eduPerson. The attribute rewriting seems to happen OK even if the resultant object presented by back-ldap doesn't include an objectclass that includes the relevant attributes, but I'd prefer to present something that appears more strictly correct. Is there another overlay I should use instead? I control the source directory, so one workaround would be to simple add some dummy objectclasses to my original objects. Then I could do something like: rwm-map objectClass inetOrgPerson myclass rwm-map objectClass eduPerson dummyclass Is there a better way? TIA -- Ron Peterson Network & Systems Administrator Mount Holyoke College http://www.mtholyoke.edu/~rpeterso

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical