openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

user authentication on attributes
by sim123 30 Mar '11

30 Mar '11

I have openLDAP server up and running and trying to integrate it with Confluence. My LDAP structure looks like DN :: uid=123, ou=users, dc=example, dc=com uid :: 123 mail :: bjason(a)example.com cn :: barbara sn :: jason userPassword :: test (plain test for now) I have another similar entry in another branch (su) for "confluence admin", I did LDAP configuration in confluence and tested the bind with confluence user. Now for every user authentication I am assuming LDAP should be able to bind on any attribute other than DN. however I can not do that. when I try to login from confluence using mail & password, this is what I see in my slapd.d logs : connection_get(12): got connid=1000 connection_read(12): checking for input on id=1000 ber_get_next ber_get_next: tag 0x30 len 48 contents: op tag 0x60, time 1301434489 ber_get_next conn=1000 op=0 do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: >>> dnPrettyNormal: <uid=234,ou=su,dc=example,dc=com> <<< dnPrettyNormal: <uid=234,ou=su,dc=example,dc=com>, <uid=234,ou=su,dc=example,dc=com> do_bind: version=3 dn="uid=234,ou=su,dc=example,dc=com" method=128 bdb_dn2entry("uid=234,ou=su,dc=example,dc=com") => bdb_dn2id("dc=example,dc=com") <= bdb_dn2id: got id=0x1 => bdb_dn2id("ou=su,dc=example,dc=com") <= bdb_dn2id: got id=0x4 => bdb_dn2id("uid=234,ou=su,dc=example,dc=com") <= bdb_dn2id: got id=0x7 entry_decode: "uid=234,ou=su,dc=example,dc=com" <= entry_decode(uid=234,ou=su,dc=example,dc=com) do_bind: v3 bind: "uid=234,ou=su,dc=example,dc=com" to "uid=234,ou=su,dc=example,dc=com" send_ldap_result: conn=1000 op=0 p=3 send_ldap_response: msgid=1 tag=97 err=0 ber_flush2: 14 bytes to sd 12 connection_get(12): got connid=1000 connection_read(12): checking for input on id=1000 ber_get_next ber_get_next: tag 0x30 len 144 contents: op tag 0x63, time 1301434489 ber_get_next conn=1000 op=1 do_search ber_scanf fmt ({miiiib) ber: >>> dnPrettyNormal: <ou=user,dc=example,dc=com> <<< dnPrettyNormal: <ou=user,dc=example,dc=com>, <ou=user,dc=example,dc=com> ber_scanf fmt ({mm}) ber: ber_scanf fmt ({mm}) ber: ber_scanf fmt ({M}}) ber: => get_ctrls ber_scanf fmt ({m) ber: => get_ctrls: oid="2.16.840.1.113730.3.4.2" (noncritical) <= get_ctrls: n=1 rc=0 err="" ==> limits_get: conn=1000 op=1 self="uid=234,ou=su,dc=example,dc=com" this="ou=user,dc=example,dc=com" => bdb_search bdb_dn2entry("ou=user,dc=example,dc=com") => bdb_dn2id("ou=user,dc=example,dc=com") <= bdb_dn2id: got id=0x3 entry_decode: "ou=user,dc=example,dc=com" <= entry_decode(ou=user,dc=example,dc=com) search_candidates: base="ou=user,dc=example,dc=com" (0x00000003) scope=2 => bdb_equality_candidates (objectClass) => key_read <= bdb_index_read: failed (-30988) <= bdb_equality_candidates: id=0, first=0, last=0 => bdb_dn2idl("ou=user,dc=example,dc=com") <= bdb_dn2idl: id=2 first=3 last=6 => bdb_equality_candidates (objectClass) => key_read <= bdb_index_read 2 candidates <= bdb_equality_candidates: id=2, first=6, last=7 => bdb_equality_candidates (cn) => key_read <= bdb_index_read: failed (-30988) <= bdb_equality_candidates: id=0, first=0, last=0 bdb_search_candidates: id=0 first=3 last=0 bdb_search: no candidates send_ldap_result: conn=1000 op=1 p=3 send_ldap_response: msgid=2 tag=101 err=0 ber_flush2: 14 bytes to sd 12 I guess I should be able to do LDAP_BIND with any attribute and LDAP should be able to search user's DN based on the attribute and authenticate him as I have laready provided valid DN and password (for confluence user), am I right here? Please let me know if its doable (should be) and what am I missing here ? I tried searching for this but couldn't find it on the web. Thanks for the help and support. -simon

3 6

syncrepl binds always fail the first time
by Tyler Gates 30 Mar '11

30 Mar '11

Hello, Using version 2.4.24 I have a replication server that periodically queries the provider for updates via refreshOnly. I've noticed that once slapd is started, the bind to the replicator DN on the provider always failed but subsequent do_syncrepl retries succeed. Ideally I'd like the first bind to succeed so it pulls in all the data instead of having to wait <retry> seconds. Is this normal behavior or do I have something mis-configured? slapd.conf: include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/openldap.schema include /etc/ldap/schema/qmail.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_hdb loglevel config allow bind_anon_dn database hdb directory /var/lib/ldap suffix "dc=domain,dc=com" rootdn "cn=Manager,dc=domain,dc=com" index objectclass,entryCSN,entryUUID eq index uid,memberUid,uidNumber,gidNumber eq cachesize 200 idlcachesize 600 checkpoint 50 5 syncrepl rid=001 provider=ldaps://directory-master.domain.com type=refreshOnly interval=00:00:10:00 retry="60 5 600 +" searchbase="dc=domain,dc=com" filter="(|(&(objectClass=posixAccount)(uid=username))(&(objectClass=posixGroup)(memberUid=username)))" scope=sub attrs="cn,sn,givenName,homeDirectory,loginShell,ou,uid,uidNumber,userPassword,memberUid,gidNumber" schemachecking=off bindmethod=simple binddn="cn=replicator,dc=domain,dc=com" credentials=secret

2 1

meta and AD disabled accounts
by Fred 30 Mar '11

30 Mar '11

Okay, new to OpenLDAP, have managed to setup a meta backend/proxy to multiple Active Directory systems that is doing everything I need with one exception. I can't figure out a reliable way to filter out disabled accounts on the AD side. I know how to query this directly against AD of course (NOT UserAccountControl:1.2.840.113556.1.4.803:=2), but after a lot of searching and head scratching I'm not sure how to implement this in my slapd.conf - or even just allow the filter (if specified by a client) to pass through: My original filter: "(&(objectclass=inetOrgPerson)(!(objectclass=Computer))(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))" >From slapd debug output, after passing through the parser: "(objectClass=user)(!(!(objectClass=*)))(?=error)" As you can see, objectClass inetOrgPerson is mapped to User (and I've got some work to do on the Computer objectClass too) but the UserAccountControl bitwise flag is the part I'm hung up on right now.

2 2

entry format
by Omer Faruk SEN 30 Mar '11

30 Mar '11

Hi, I have a dump of Sun LDAP Directory server (6.3.1) I see dn: cn=me,ou=groups,dc=me,dc=com nsUniqueId: 1255060a-46e511dd-803ce5f5-385faa0b objectClass;vucsn-4869456e0009002d0000: top objectClass;vucsn-4869456e0009002d0000: groupOfUniqueNames cn;vucsn-4869456e0009002d0000;mdcsn-4869456e0009002d0000: everyone description;vucsn-4869456e0009002d0000: everyone lines what is the meaning of vucsn,mdcsn and adcsn? Regards.

2 2

slapd segfaults in one node of master-master
by Dave Smith 29 Mar '11

29 Mar '11

We run version 2.4.16 on two RHEL4 platforms in master-master configuration. One of our nodes regularly reports a segfault and exits. The log is shown below. This is a production platform so we run minimal logging for performance reasons. We have been running openldap in this configuration for 2 years without a problem. The issues started after we applied as schema change and added more users accounts to the system. The schema changes we straight-forward. We added a few optional attributes to existing objects and added one new object to our schema. Nothing that required data fixes. Our schema provides an auxiliary user account object that we use with the standard "account" object. We have a number of additional objects that are related user authentication and authorization. We applied these same changes in various development and testing environments without problem. The other thing we did was add a lot of users accounts. Prior to this release we had some 6000 users accounts. Now we have over 15000 user accounts. We are concerned that our problem may be related to the additional load from these users. We are planning further grow in the user-base. One thing I should mention is that our system is more write-heavy that the NIS replacement system. We change attributes on the account record on every authentication request. We suspect this might be replication related because when we dump (using slapcat) and compare the two nodes, one user account record is missing from the node with the segfaults. This weekend we plan to rebuild this node from the slapcat output of the other. We hope this will resolve our problem. Mar 21 00:59:02 msgeuroha slapd: slapd startup succeeded Mar 21 01:47:29 msgeuroha kernel: slapd[19367]: segfault at 0000000000000048 rip 0000003e67507c3c rsp 0000000040e7f318 error 4 Mar 21 01:53:58 msgeuroha slapd: slapd startup succeeded Mar 21 03:46:54 msgeuroha kernel: slapd[14167]: segfault at 0000000000000048 rip 0000003e67507c3c rsp 0000000040e7f318 error 4 Mar 21 03:51:34 msgeuroha slapd: slapd startup succeeded Mar 21 09:10:34 msgeuroha kernel: slapd[6834]: segfault at 0000000000000048 rip 0000003e67507c3c rsp 0000000040e7f318 error 4 --DS

2 1

YubiKey authentication
by Francis Swasey 28 Mar '11

28 Mar '11

My boss dropped by and asked me if it would be possible to have our OpenLDAP servers (2.4) which are currently using the {SASL} password form to authenticate against saslauthd which goes to Kerberos be configured (on a per entry basis) to authenticate against the YubiKey or Kerberos. Has anyone set up an OpenLDAP server to authenticate against YubiKey? Or hooked YubiKey's authenication into SASL? (google hasn't found anything for me yet) Thanks, -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

2 1

replication possibilities
by denethorr＠o2.pl 28 Mar '11

28 Mar '11

Dear OpenLDAPs users, i want to integrate CMS with working OpenLDAP 2.3.30 tree to authorize CMS users. I use OpenLDAP for postfix maps, samba domain, posix accounts and VPN users. Because my CMS is in location which is not controlled by IT departament, i dont want to replicate whole tree, but about 30 accounts. I will need cn, userPassword or/and sambaNTPassword. Is it possible to do it with ldap builtin replication mechanism or should i write some scripts? Any examples? Best Regards, Jan

1 0

8 principal limitation in openldap
by Srivatsav M 28 Mar '11

28 Mar '11

Hi, We are using OpenLDAP for authenticating users registered in a LDAP server (Open LDAP, Active Directory). After adding 8 principals (/etc/ldap.conf), none of the users registered in the /etc/ldap.conf file are able to login. nss_base_passwd OU=engg,DC=mycompany,DC=region,DC=someplace,DC=myarea,DC=compname,DC=parentcompname nss_base_shadow OU=engg,DC=mycompany,DC=region,DC=someplace,DC=myarea,DC=compname,DC=parentcompname nss_base_group OU=engg,DC=mycompany,DC=region,DC=someplace,DC=myarea,DC=compname,DC=parentcompname Can you please share the reason for this 7 limitation in the open ldap library. or how I can fix this issue. I am looking i for the header file in the source files whhich has this constant or limitation defined. Tried googling, but it appears that no one has encountered this issue. Some customers are running into this issue and it has become a severity 1 issue to fix. Thanks Ramakanth

5 4

Internal (implementation specific) error (80) and cannot allocate memory
by Hendrik van der Ploeg 28 Mar '11

28 Mar '11

Hello People, I'm importing a ldif file in a ldapserver which has 200 different databases on it. The max is 256 by the way. I import the ldif in every database only with a different DN per database of course. I can import the ldif file in about 30 databases and then the server gives the error message: "ldapadd: Internal (implementation specific) error (80)" And in de slapd.log: bdb_locker_id: err Cannot allocate memory(12) The ldif file consist of about 8000 lines. Is there some kind of maximum entries per database and can I expand the maximum. I just can't imagine that there is a maximum of 8000 * 30 = 240000 Hope someone can help me. Regards, Hendrik

3 8

slapo-dds and data decoding error
by Michael Ströder 27 Mar '11

27 Mar '11

HI! For the fun of it I'm implementing a small Python script which sends a Refresh Request (RFC 2589). But slapo-dds (OpenLDAP 2.4.24) returns a protocol error due to a decoding error: Mar 24 20:48:38 nb2 slapd[8202]: conn=1015 op=1 EXT oid=1.3.6.1.4.1.1466.101.119.1 Mar 24 20:48:38 nb2 slapd[8202]: conn=1015 op=1 RESULT oid= err=2 text=data decoding error But what's wrong with the request value (BER file attached)? dumpasn1 output seems right to me: 0 51: SEQUENCE { 2 45: OCTET STRING : 'cn=DDS Test Raum,ou=Testing,dc=stroeder,dc=de' 49 2: INTEGER 332 : } Ciao, Michael.

2 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical