openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

Linking Clients - which Crypto API ?
by Massimiliano Pala 14 Jun '11

14 Jun '11

Hi all, I have a little problem. I am implementing an application that uses the OpenLDAP libraries. Until not too much time ago, linking with OpenSSL was sufficiently safe (on almost every Linux distros) and providing my own verification function through the SSL_CTX (by using the ldap_set_option(m_ldap, LDAP_OPT_SERVER_CERTIFICATE, _my_verify)) was easy. Now, Linux distros started to use GnuTLS, NSS, and OpenSSL as the crypto API. My question is: how do I develop an application that when deployed on different systems might need to use functions and data structures from different crypto-api (e.g., when I distribute the binaries of my app) ? How can I retrieve that info *at runtime* (I'd like my binaries to be compatible) ? At least, is there a function that allows me to know which crypto APIs are expected by libldap_r (so that I don't pass in the wrong data structure since it is a (void *)) ? Or at least, is there a way to set/get options so that I would know which API is in use ? Thanks, -- http://member.acm.org/~openca/ Massimiliano Pala, Ph.D. Director, OpenCA Labs Professor, NYU Poly

2 5

OpenLDAp + OpenSSL: decrypt error
by Nguyen, Quoc Khanh 14 Jun '11

14 Jun '11

Hi all, I'm confusing about this problem. Please help... I installed OpenLDAP (2.4.25) with Cyrus SASL (2.1.23) and OpenSSL (0.9.8r). I started LDAP with SSL port: #./slapd -h 'ldaps:///' Everything OK, but when i test uid of OpenLDAP with SASL, i have a problem: root@ftp:/usr/local/sasl2/sbin# ./testsaslauthd -u khanhnq -p 123456 0: NO "authentication failed" I check log and have a message: ldap_simple_bind_s ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost:636 ldap_new_socket: 10 ldap_prepare_socket: 10 ldap_connect_to_host: Trying 127.0.0.1:636 ldap_pvt_connect: fd: 10 tm: 5 async: 0 ldap_ndelay_on: 10 ldap_int_poll: fd: 10 tm: 5 ldap_is_sock_ready: 10 ldap_ndelay_off: 10 ldap_pvt_connect: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 1, err: 0, subject: /C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com, issuer: /C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com TLS certificate verification: depth: 0, err: 7, subject: /C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com, issuer: /C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com TLS certificate verification: Error, certificate signature failure TLS trace: SSL3 alert write:fatal:decrypt error TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:14090086:SSL routines:func(144):reason(134) (certificate signature failure). ldap_err2string ldap_unbind ldap_create ldap_url_parse_ext(ldaps://localhost) ldap_simple_bind_s ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost:636 ldap_new_socket: 10 ldap_prepare_socket: 10 ldap_connect_to_host: Trying 127.0.0.1:636 ldap_pvt_connect: fd: 10 tm: 5 async: 0 ldap_ndelay_on: 10 ldap_int_poll: fd: 10 tm: 5 ldap_is_sock_ready: 10 ldap_ndelay_off: 10 ldap_pvt_connect: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 1, err: 0, subject: /C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com, issuer: /C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com TLS certificate verification: depth: 0, err: 7, subject: /C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com, issuer: /C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com TLS certificate verification: Error, certificate signature failure TLS trace: SSL3 alert write:fatal:decrypt error TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:14090086:SSL routines:func(144):reason(134) (certificate signature failure). ldap_err2string saslauthd[766] :do_auth : auth failure: [user=khanhnq] [service=imap] [realm=] [mech=ldap] [reason=Unknown] saslauthd[766] :do_request : response: NO What i'm doing wrong? I test OpenSSL using client authenticate and it's work OK. # openssl s_client -connect localhost:636 -state -CAfile /var/myCA/demoCA/cacert.pem -cert /var/myCA/clientcrt.pem -key /var/myCA/clientkey.pem CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv2/v3 write client hello A SSL_connect:SSLv3 read server hello A depth=1 /C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com verify return:1 depth=0 /C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com verify return:1 SSL_connect:SSLv3 read server certificate A SSL_connect:SSLv3 read server certificate request A SSL_connect:SSLv3 read server done A SSL_connect:SSLv3 write client certificate A SSL_connect:SSLv3 write client key exchange A SSL_connect:SSLv3 write certificate verify A SSL_connect:SSLv3 write change cipher spec A SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data SSL_connect:SSLv3 read server session ticket A SSL_connect:SSLv3 read finished A --- Certificate chain 0 s:/C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com i:/C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com 1 s:/C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com i:/C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com --- Server certificate -----BEGIN CERTIFICATE----- MIICiTCCAfKgAwIBAgIJAMmeK8RVIEWgMA0GCSqGSIb3DQEBBQUAMEgxCzAJBgNV BAYTAlZOMQwwCgYDVQQIEwNIQ00xDDAKBgNVBAoTA1NHVDELMAkGA1UECxMCTlcx EDAOBgNVBAMTB2FiYy5jb20wHhcNMTEwNjEzMDYzMDQ3WhcNMTIwNjEyMDYzMDQ3 WjBIMQswCQYDVQQGEwJWTjEMMAoGA1UECBMDSENNMQwwCgYDVQQKEwNTR1QxCzAJ BgNVBAsTAk5XMRAwDgYDVQQDEwdhYmMuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GN ADCBiQKBgQDEW/sP8n2M7y0LT7ONPZQSnWdOC+E2qyngXaouoKEZauyLkTwWJyQY MkCeGKwQo1KMGd1O04sw5uD2IWgYBfGuynSalyfGfwETGc4Y/xPHV+FpOY5KRssn qzmL5Gso276vIOR4KnjZdm5Msp3WQ2z4aNUkLbMspyBugKP9GgjfAwIDAQABo3sw eTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBD ZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUD7QVqUbn35Jgi1yQdumsHRBdAkswHwYDVR0j BBgwFoAUAdNX4GIDCCQpSpUEfLXJPW74L2IwDQYJKoZIhvcNAQEFBQADgYEAMf8i zRpqasBFf6acpRvGG/AkLU+Cz10ffH6zE3DsoKngxP6zEDFOb1quX+E7RE98W/0T iQPLqS5XLIuLX6BNRjnv79DdyynpwsFVip6pHvDZafWBXrzWVn7WEXy5+VpfjBxe CADHvgvp4LXh7EtvppO1vPyvphCCexsmCIzoxyA= -----END CERTIFICATE----- subject=/C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com issuer=/C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com --- Acceptable client certificate CA names /C=VN/ST=HCM/O=SGT/OU=NW/CN=abc.com --- SSL handshake has read 2431 bytes and written 1804 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 1024 bit Secure Renegotiation IS supported Compression: zlib compression Expansion: zlib compression SSL-Session: Protocol : TLSv1 Cipher : AES256-SHA Session-ID: B79630EC32BF14F01931D1EAB3DC0CF7DA29B42E012C8BD8171EEF46D993BB96 Session-ID-ctx: Master-Key: 230F7D9D0736A40EB148CA9091BA0105E6949721E55FD9F84AD057C1CBA38F0A1B2269CAB07E7E71E3310954DDF260BF Key-Arg : None TLS session ticket: 0000 - 07 19 41 07 ec 4c 66 10-24 a0 dd be 02 ff 05 90 ..A..Lf.$....... 0010 - a0 f8 64 d3 08 77 a0 bf-24 81 ad 04 b8 d9 e6 9a ..d..w..$....... 0020 - 04 5a df 4a d5 a1 65 2b-52 4c d4 a2 c2 d6 8b 7f .Z.J..e+RL...... 0030 - fa 66 c7 05 54 58 fa 5d-9a a3 75 82 d0 e8 76 dd .f..TX.]..u...v. 0040 - 4f da 54 ac 8e 40 95 68-7c da 6f 08 7f 52 a3 f6 O.T..@.h|.o..R.. 0050 - c2 bd 44 ff dd 95 b3 0c-e5 9e 16 95 7c c8 6d ee ..D.........|.m. 0060 - 96 03 6b db ae 8c 34 8e-a3 29 87 16 f0 a6 0e 8c ..k...4..)...... 0070 - ac fa c2 76 4a 2d 75 f5-fc b7 1e 83 ec a7 47 0a ...vJ-u.......G. 0080 - 72 50 e8 24 e2 22 34 5f-ff 6a b1 ea f0 cc 2e 55 rP.$."4_.j.....U 0090 - 9f ec ea 1b b5 da 12 70-f4 0c ee 10 5b d0 4e 7a .......p....[.Nz 00a0 - 0d 60 06 70 02 f7 eb a3-f3 79 a7 69 5d c3 61 d3 .`.p.....y.i].a. 00b0 - 51 2a 8a 82 c2 11 70 c9-8b 4f 19 58 50 83 6b 0e Q*....p..O.XP.k. 00c0 - bf 9e aa 6a 8f 72 59 9c-10 da cc 8f 90 05 db e2 ...j.rY......... 00d0 - 08 31 d8 62 1a 24 0d 50-a4 e1 75 e6 ee 49 19 32 .1.b.$.P..u..I.2 00e0 - 1f b6 0e 77 11 42 ce 3a-7e 7e 9c 2b be 59 d4 b4 ...w.B.:~~.+.Y.. 00f0 - 24 36 b0 a5 39 30 9f 3a-49 f7 19 10 73 f1 3e 06 $6..90.:I...s.>. 0100 - b4 04 58 3a 5f 4c 02 29-54 b1 25 c7 2f 06 4a 62 ..X:_L.)T.%./.Jb 0110 - fb 4b 52 82 ea 50 7e 12-0e 8b 5a eb a4 34 77 3c .KR..P~...Z..4w< 0120 - 9f f4 0d 85 0f 43 9a 5d-f1 ba 3e 28 ab 86 98 17 .....C.]..>(.... 0130 - d1 10 49 d2 a6 f3 e7 32-72 62 41 ac 4c 51 4b 05 ..I....2rbA.LQK. 0140 - bd e7 a3 30 cd 47 37 95-f9 76 1d 4a f1 a2 58 b0 ...0.G7..v.J..X. 0150 - 0b a8 ca 4e 4f a1 67 ff-01 3e 11 29 a9 db f1 3e ...NO.g..>.)...> 0160 - 43 64 f8 58 4e d3 44 6f-ee cc 61 6d b3 82 ab 77 Cd.XN.Do..am...w 0170 - e7 3b 6b 83 af b7 42 76-89 e2 e0 d6 8e 66 61 fe .;k...Bv.....fa. 0180 - df 7c d8 28 63 04 22 06-cd 41 28 46 d4 08 00 b4 .|.(c."..A(F.... 0190 - 2b 9e 90 ec ee 9f 8e 34-9b 15 5c 71 e8 29 88 c8 +......4..q.).. 01a0 - 35 4d 88 aa c3 05 53 0a-b8 bd 90 38 68 cf 8b 0b 5M....S....8h... 01b0 - b0 f3 48 c0 02 8a 9f be-05 1b 13 4a 49 67 32 8f ..H........JIg2. 01c0 - 66 f2 41 18 11 f1 eb ed-2a d0 a4 de d9 10 83 95 f.A.....*....... 01d0 - c6 aa 1a 74 83 36 31 db-68 b1 88 37 2b 18 da 6b ...t.61.h..7+..k 01e0 - b9 be 87 36 64 5c a0 b1-23 eb df d9 8f 96 10 ae ...6d..#....... 01f0 - 4e db 3b c2 77 65 a4 11-df 65 a8 26 98 4f df 69 N.;.we...e....... 0210 - f6 93 93 b1 c0 89 65 3a-0d bc 16 e8 f0 5f 9f 5c ......e:....._. 0220 - 8a bc ea 56 b7 e7 d4 75-4c 19 6d 18 73 64 3c 95 ...V...uL.m.sd. 0260 - 78 0d 94 f1 3a 1a 64 35-b5 54 b5 84 76 44 62 b1 x...:.d5.T..vDb. 0270 - 36 5c 1d d6 79 27 6d 1c-3c df bb d2 bf 2c 06 40 6..y'm.

2 2

issue regarding ldap apache authentication in public_html/*
by VIKAS MARWAHA 13 Jun '11

13 Jun '11

hi I need a little help. I am implementing LDAP services in my college. The apache LDAP authentication works fine with any directory viz. /var/www/*/* /home/username/ but it doesn't works with /home/username/public_html/anyfolder/ i.e with a subfolder in public_html. The issue is whenever i write the lines in http.conf the folder stops appearing in the browser. i dont see the folder when i browse http://localhost/~username/foldername i don't see the folder in browser. lines in http.conf file <Directory /home/vikasmarwaha/public_html/private/> Authtype Basic AuthName "Secured Area : Vikas Marwaha's Page : Secured with LDAP : Authorized personal only" AuthBasicProvider ldap AuthzLDAPAuthoritative on AuthLDAPURL "ldap://127.0.0.1:389/ou=People,dc=example,dc=com?uid?" require ldap-user vikasmarwaha </Directory> Please tell me where am i wrong.! this one works perfect.. <Directory /home/vikasmarwaha/> Authtype Basic AuthName "Secured Area : Vikas Marwaha's Page : Secured with LDAP : Authorized personal only" AuthBasicProvider ldap AuthzLDAPAuthoritative on AuthLDAPURL "ldap://127.0.0.1:389/ou=People,dc=example,dc=com?uid?" require ldap-user vikasmarwaha </Directory> but it doesn't satisfies my requirements. Need to secure the subfolder(under public_html -- user's web space.) not the whole user directory. -- Vikas Marwaha http://vikasmarwaha.co.cc Sent via HP Touchsmart powered by Backtrack 5 Linux Technology of Future.

2 1

passwords disappear
by Bidwell, Matt 11 Jun '11

11 Jun '11

If a user changes passwords on and ldap client machine, the shadow entry disappears. This is true for all hash methods except for {CRYPT}. Clearly I would like {SSHA} or {MD5} over {CRYPT}. The client machines are pretty standard RHEL 5 machines. I have exop in the config on the client. Setting the password on the LDAP server works correctly. Running the server in debug didn't make anything jump out at me. Anyone have any ideas? Perhaps I'm missing an ACL I don't know about. Matt

2 1

Client App and STARTLS auth
by Massimiliano Pala 10 Jun '11

10 Jun '11

Hi all, are there examples on how to use STARTLS without requiring that the server's certificate is trusted ? If the crypto api used in the ldap library is OpenSSL, that is easy: - create a new ssl_ctx() with SSL_CTX_new() - set my function as the verify function with SSL_CTX_set_verify() - use the LDAP_OPT_X_TLS_CTX option to point to my new ssl_ctx My problem is: when GnuTLS or NSS crypto libraries are used instead, how do I force the same behavior ? Or, if providing my own function is not possible, how do I force the STARTLS to go on also if it finds non-trusted server/CA certificates ? Thanks, Max -- http://member.acm.org/~openca/ Massimiliano Pala, Ph.D. Director, OpenCA Labs Professor, NYU Poly

4 6

Scaling Syncrepl
by Duncan Idaho 10 Jun '11

10 Jun '11

In my environment I have a need to synchronize from a single master to 125 globally distributed read-only consumers. I've attempted this in two ways and run into problems in either direction. First, I attempted a multi-tier replication strategy where the master would sync to a regional consumer which would in-turn act as a producer for around 20 slaves each. It seems that a server should be able to act as both a producer and a consumer, but in my experience with 2.4.25 this will cause a repeatable segfault within a days time. (test_filter() is passed a NULL filter in syncrepl.c) I think this would probably be the best solution if I could resolve the segfault issue. The other option I've tried is pointing all 125 slaves at a single master. This works if I bring the slaves up gradually, but if they all attempt to connect at once (like after a master restart) the initial sync process seems to monopolize a thread per replica which causes any other searches to fail for a period of greater than 30 seconds. Bumping the threads up to over 125 seems to solve the issue on a test machine but I'm hesitant to do this on the production master which is used heavily for a variety of other purposes. Can anyone offer advice on how I could go about resolving these issues or other methods for successfully replicating to this many slaves? Thanks, Duncan.

2 1

Migrating from RHDS to openldap
by Allgood, John 10 Jun '11

10 Jun '11

Hey Guys We are looking to migrate off our current RHDS environment to openldap. I have searched the internet and have found documentation that migrates to RHDS. RHDS is pretty expensive and we will like to move away from that platform. Has anyone had any experience with doing this type of migration? Any suggestions are welcome. Best Regards John Allgood Sr. Systems Engineer OHL - North American Transportation 2419 West Park Drive SW, Suite 100 Gainesville, GA 30504 Office (800) 532-2239 Ext. 2051 jallgood(a)ohl.com<mailto:jallgood@ohl.com> www.ohl.com<http://www.ohl.com> ______________________________________________________ This e-mail transmission may contain information that is proprietary, privileged and/or confidential and is intended exclusively for the person(s) to whom it is addressed. Any use, copying, retention or disclosure by any person other than the intended recipient or the intended recipient's designees is strictly prohibited. If you are not the intended recipient or their designee, please notify the sender immediately by return e-mail and delete all copies.

2 2

phpldapadmin and openldap
by Juan Diego Calle 09 Jun '11

09 Jun '11

Hi, I have being trying to solve this for more than a month. I installed Openldap, Samba, smbldap-tools, and phpmyadmin in a Red Hat 5.6 server. I have many users created with smbldap-tools. Almost everything works, there are 2 things that I need help with. One is with phpldapadmin. I can log with the user administrator, but can not change anything, this is the error in phpldapadmin Could not perform ldap_modify operation. LDAP said: Insufficient access Error number: 0x32 (LDAP_INSUFFICIENT_ACCESS) Description: You do not have sufficient permissions to perform that operation. This error on the log Jun 7 17:43:58 pruebas03 slapd[11983]: conn=10 fd=11 ACCEPT from IP=127.0.0.1:59487 (IP=0.0.0.0:389) Jun 7 17:43:58 pruebas03 slapd[11983]: conn=10 op=0 BIND dn="uid=Administrator,ou=People,dc=mydomain,dc=com,dc=ec" method=128 Jun 7 17:43:58 pruebas03 slapd[11983]: conn=10 op=0 BIND dn="uid=Administrator,ou=People,dc=mydomain,dc=com,dc=ec" mech=SIMPLE ssf=0 Jun 7 17:43:58 pruebas03 slapd[11983]: conn=10 op=0 RESULT tag=97 err=0 text= Jun 7 17:43:58 pruebas03 slapd[11983]: conn=10 op=1 MOD dn="uid=Administrator,ou=People,dc=mydomain,dc=com,dc=ec" Jun 7 17:43:58 pruebas03 slapd[11983]: conn=10 op=1 MOD attr=loginShell Jun 7 17:43:58 pruebas03 slapd[11983]: conn=10 op=1 RESULT tag=103 err=50 text= Jun 7 17:43:58 pruebas03 slapd[11983]: conn=10 op=2 UNBIND Jun 7 17:43:58 pruebas03 slapd[11983]: conn=10 fd=11 closed This is my slapd.conf ############################################ # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: # modulepath /usr/lib64/openldap # Modules available in openldap-servers-overlays RPM package # Module syncprov.la is now statically linked with slapd and there # is no need to load it here # moduleload accesslog.la # moduleload auditlog.la # moduleload denyop.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload lastmod.la # moduleload pcache.la # moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # moduleload rwm.la # moduleload smbk5pwd.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la # modules available in openldap-servers-sql RPM package: # moduleload back_sql.la # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCertificateFile /etc/pki/tls/certs/slapd.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! #access to * # by self write # by users read # by anonymous auth #access to attrs=userpassword # by self =xw # by anonymous auth by anonymous auth #access to * # by self write # by users read #access to attrs=userpassword by self write by anonymous auth by * none #access to * by self write by users read by anonymous read by * none #access to * by uid=Administrator,ou=People,dc=mydomain,dc=com,dc=ec write #access to dn.regex = "ou = personal_addressbook or =(.+),, dc = korrigan, dc = org" #by dn.regex="cn=$1,ou=Users,dc=korrigan,dc=org" write by dn.regex = "cn = $ 1, ou = Users, dc = korrigan, dc = org" write #by dn="cn=admin,dc=korrigan,dc=org" write by dn = "cn = admin, dc = korrigan, dc = org" write #by * none by * none ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=mydomain,dc=com,dc=ec" rootdn "cn=Manager,dc=mydomain,dc=com,dc=ec" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXXXXX # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM # Extras para ser servidor master de ldap loglevel 256 (I already posted this once) ##########################################3 When i add this line access to * by self write by users read by anonymous read by * none Users are allowed to change their info. I just want a group of users that can change the info of other users, users that have more privileges . I also tried adding a group called miniadmins, it didnt work. dn: cn=MiniAdmins,ou=People,dc=mydomain,dc=com,dc=ec objectClass: groupOfNames objectClass: top cn: MiniAdmins member: uid=jdc,ou=People,dc=mydomain,dc=com,dc=ec member: uid=user2,ou=People,dc=mydomain,dc=com,dc=ec structuralObjectClass: groupOfNames entryUUID: a3e66d90-19b0-1030-9c61-73ebddf12515 creatorsName: cn=Manager,dc=mydomain,dc=com,dc=ec modifiersName: cn=Manager,dc=mydomain,dc=com,dc=ec createTimestamp: 20110523174841Z modifyTimestamp: 20110523174841Z entryCSN: 20110523174841Z#000012#00#000000 with the following acl access to * by group/groupOfNames/member="cn=MiniAdmins,ou=People,dc=iess,dc=gob,dc=ec" write Also for the second part I dont know if you are able to do this with openldap: All users are part of dn: cn=Domain Users,ou=Group,dc=mydomain,dc=com,dc=ec. Also this users belong to others groups like city1, city2, city3. In each city there is and admin that has control over that group, example admincity1, admincity2,etc. They can manage users in their respective cities, but they can not change anything on another city. I need help with the slapd.conf, I have a basic understanding, but my logic here is failing. I have found people with similar problems but no answers. Thanks, Juan Diego

2 3

cannot restore db
by Bidwell, Matt 08 Jun '11

08 Jun '11

I'm using both openldap-2.4.24 and db-5.1.25 from source. I was experiencing corrupted entries from the running database. I tried moving the openldap-data folder, created a new one, and tried running slapadd with the -f and -l flags with my conf file and backup ldif. I get back an error that tells me id2entry.bdb can't be opened because it is missing. Isn't slapadd supposed to create id2entry.bdb? The flags I used to configure BDB are --enable-cxx -C, did I miss something? Matt

2 3

retrieving dn via proxy ldap
by Ron Peterson 08 Jun '11

08 Jun '11

Hi, I'm having trouble retrieving the DN, and only the DN, when using the 'ldap' back end to proxy my master directory database. 2656$ ldapsearch -LLL -x -w apass -D "uid=test,ou=admin" -b "ou=test" '(uid=auser)' dn: yDirectoryID=442E65DA-678E-BEB5-3378-56331AEE1AA0,ou=test eduPersonPrimaryAffiliation: staff sn: Peterson ... 2657$ ldapsearch -LLL -x -w apass -D "uid=test,ou=admin" -b "ou=test" '(uid=auser)' 1.1 Why would I not see the DN when asking for just 1.1? TIA -- Ron Peterson Network & Systems Administrator Mount Holyoke College http://www.mtholyoke.edu/~rpeterso

1 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical