openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

10 Feb '11

Hello! Is it possible to use email to login to LDAP ? I'm working on mail management panel where users are identified by emails. Now I'm searching tree for DN of particular email and then I'm logging with DN and password, but I'd like to avoid this search if possible... best regards JT.

2 1

stopping anonymous access to userPassword
by RAT 10 Feb '11

10 Feb '11

I'm unaccustomed to the new (non-slapd.conf) way of adding ACL/ACI's. I'm trying exclude anonymous access to the password. We've tried this to no affect: olcAccess: to dn.base="cn=users,dc=lib-mac,dc=local" by * read olcAccess: to dn.base="cn=Subschema" by * read olcAccess: to attrs=userPassword by self write by dn.exact="uid=diradmin,cn=users,dc=lib-mac,dc=local" read by * auth olcAccess: to dn.subtree="" by dn.exact="uid=diradmin,cn=users,dc=lib-mac,dc=local" write by users read by anonymous auth Robert Threet http://yesistilluseperl.blogspot.com/ ____________________________________________________________ $65/Hr Job - 25 Openings Part-Time job ($20-$65/hr). Requirements: Home Internet Access http://thirdpartyoffers.netzero.net/TGL3231/4d540f18d12d722e5best03duc

2 1

slapo-lastbind: warning in doing slapcat
by Marco Pizzoli 10 Feb '11

10 Feb '11

Hi list, I'm using overlay slapo-lastbind using openldap head. I receive a warning when invoking slapcat to do a full backup of my user database. This is the output of my job: [ldap@ldap03 tmp]$ /usr/local/openldap/sbin/slapcat -b "dc=lan,dc=mycorp.it" -l dump_db_user.ldif UNKNOWN attributeDescription "AUTHTIMESTAMP" inserted. The backup seems done correctly. This warning could be due to an error of mine? If not, being this a contrib overlay, should I file an ITS anyway? Thanks Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

1 0

The correct way of updating a schema
by E.S. Rosenberg 09 Feb '11

09 Feb '11

A package I use recently updated the schema files related to the package, what is the correct way to go about replacing the schemas that were already loaded into cn=schema? My bruteforce solution was most likely not the correct way. Thanks and best regards, Eli

1 0

DB_CONFIG - Auto remove logs
by ldap＠mm.st 09 Feb '11

09 Feb '11

This may have been discussed, but i can not seem to find out why the transaction logs are not getting removed when I use DB_LOG_AUTOREMOVE in DB_CONFIG. This is on a Redhat 5 openldap 2.3 server. DB_CONFIG has the following: set_lg_dir /var/lib/ldap/bdblogs set_flags DB_LOG_AUTOREMOVE Doing slapd_db_archive shows about 134 unused files. I then did the following (is this the correct procedure to use when updating DB_CONFIG?): > serivice ldap stop > Edited DB_CONFIG > slapd_db_recover > slapd_db_archive > service ldap start The files are still there. I also manually did a checkpoint with "slapd_db_checkpoint -1" and verified the transaction log time changed. Reran "slapd_db_archive" and it outputs the same files. I read that earlier versions required a patch for this to work, but I was not sure about this one. I'm unclear on when the removal is suppose to take place, but it doesn't seem to be working.

2 2

tls_checkpeer directive
by Michael Starling 08 Feb '11

08 Feb '11

I'm running openldap-2.3.43-12.el5 on a RHEL 5.5 system: I believe I have TLS encryption working but I'd like to be able to verify my client connections. On my LDAP server I have the following in slapd.conf TLSCipherSuite HIGH:MEDIUM:+TLSv1:!SSLv2:+SSLv3 TLSCertificateFile /etc/openldap/cacerts/slapdcert.pem TLSCertificateKeyFile /etc/openldap/cacerts/slapdkey.pem TLSCACertificateFile /etc/openldap/cacerts/slapdcert.pem On the client I have the following in /etc/ldap.conf uri ldaps://10.70.5.67/ ssl on tls_cacertfile /etc/openldap/cacerts/slapdcert.pem tls_checkpeer no On the client /etc/openldap/ldap.conf URI ldaps://10.70.5.67/ TLS_CACERT /etc/openldap/cacerts/slapdcert.pem TLS_REQCERT demand These commands work both from the client and server. openssl s_client -connect servername:636 -showcerts ldapsearch -x -H ldaps://servername -b dc=domain,dc=domain -D cn=root,dc=domain,dc=domain -W So my first question would be does this guarantee encrypted sessions? Second, if I change tls_checkpeer to yes then I can't contact the LDAP server. How can I verify my clients? -Mike

2 1

Handling slapd.d in OpenLDAP and Kerberos
by sarathkrishna89＠gmail.com 08 Feb '11

08 Feb '11

Hi, We are currently trying to use OpenLDAP as the database for Kerberos in our lab. We installed OpenLDAP in Ubuntu 10.04 and is working without any problem (i,e. queries are showing the correct results) But we are not able to get Kerberos authenticate via OpenLDAP. For authenticating via OpenLDAP, the principles needs to be rewritten (using authz-policy and authz-regexp). We know how to do that in older version of OpenLDAP which had (slapd.conf) but don't know how to do the same in new OpenLDAP which has slapd.d directory instead. The manuals also doesn't say anything on this issue. We did the following for testing authentication via Kerberos: kinit username; ldapsearch -H ldaps://server.example.com And we got this result: SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database We just want to perform this: authz-policy from authz-regexp uid=(.*),cn=example.com,cn=GSSAPI,cn=auth uid=$1,ou=people,dc=example,dc=com We think adding this in slapd.conf should serve the purpose. Any suggestions/help is highly appreciated. -- Sarath

5 5

Multimaster replication of cn=config working too well?!
by Mark Cairney 08 Feb '11

08 Feb '11

Hi, Has anyone experienced problems with the cn=config directory syncing the same change across all nodes and breaking the configuration? In the past I've had problems where the syncrepl parameters are synced across all nodes, including that node itself, which results in the servers then trying to sync with themselves. The most recent problem however was that the olcSaslHost value was synced to be one particular server on all 3 nodes. As I was using GSSAPI to do the replication this broke it completely and it meant that I could only bind via GSSAPI to one of the 3 servers. In the meantime I've set the servers not to syncrepl cn=config but this isn't ideal. Anyone else on the list had similar problems? Kind regards, Mark /********************************* Mark Cairney ITI UNIX Section Information Services University of Edinburgh Tel: 0131 650 6565 Email: mark.cairney(a)ed.ac.uk *********************************/ -- The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

2 1

slapd.d syntax help for ldap proxy server
by Anton Chu 07 Feb '11

07 Feb '11

I'm trying to setup a ldap proxy server for push based replication. I'm in need of help with providing the correct syntax on installing a ldap proxy using slapd.d instead of slapd.conf. The items in bold are the questionable syntax that can crossover to slapd.d. Here's my slapd.d configuration: Standalone LDAP Proxy: > > # load the schemas > ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif > > ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetorgperson.ldif > > ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif > > ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/misc.ldif > > ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/ldapns.ldif > > ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/openldap.ldif > > > # Load dynamic backend modules > > dn: cn=module,cn=config > > objectClass: olcModuleList > > cn: module > > olcModulepath: /usr/lib/ldap > > olcModuleload: back_hdb > > olcModuleload: syncprov > > > # Database settings > > dn: olcDatabase=hdb,cn=config > > objectClass: olcDatabaseConfig > > objectClass: olcHdbConfig > > olcDatabase: {1}hdb > > *olcHidden: TRUE* > > olcSuffix: dc=suretecsystems,dc=com > > olcDbDirectory: /var/lib/ldap > > olcRootDN: cn=admin,dc=suretecsystems,dc=com > > olcRootPW: secret > > *olcUri: ldap://localhost:9012/* > > > > # We don't need any access to this DSA > > *olcRestrict: ALL > > olcAcl-bind: bindmethod=simple > binddn="cn=replicator,dc=suretecsystems,dc=com" > credentials=testing* > > olcSyncrepl: rid=001 > provider=ldap://localhost:9011/ > binddn="cn=replicator,dc=suretecsystems,dc=com" > bindmethod=simple > credentials=testing > searchbase="dc=suretecsystems,dc=com" > type=refreshAndPersist > retry="5 5 300 5" > > Here's the slapd.conf provided at the site that I'm trying to convert: http://www.openldap.org/doc/admin24/replication.html The following configuration is an example of a standalone LDAP Proxy: > > include /usr/local/etc/openldap/schema/core.schema > include /usr/local/etc/openldap/schema/cosine.schema > include /usr/local/etc/openldap/schema/nis.schema > include /usr/local/etc/openldap/schema/inetorgperson.schema > > include /usr/local/etc/openldap/slapd.acl > > modulepath /usr/local/libexec/openldap > moduleload syncprov.la > moduleload back_ldap.la > > ############################################################################## > # Consumer Proxy that pulls in data via Syncrepl and pushes out via slapd-ldap > ############################################################################## > > database ldap > # ignore conflicts with other databases, as we need to push out to same suffix > hidden on > suffix "dc=suretecsystems,dc=com" > rootdn "cn=slapd-ldap" > uri ldap://localhost:9012/ > > lastmod on > > # We don't need any access to this DSA > restrict all > > acl-bind bindmethod=simple > binddn="cn=replicator,dc=suretecsystems,dc=com" > credentials=testing > > syncrepl rid=001 > provider=ldap://localhost:9011/ > binddn="cn=replicator,dc=suretecsystems,dc=com" > bindmethod=simple > credentials=testing > searchbase="dc=suretecsystems,dc=com" > type=refreshAndPersist > retry="5 5 300 5" > > overlay syncprov > >

4 4

Re: slapo-lastbind
by Marco Pizzoli 07 Feb '11

07 Feb '11

On 7 Feb 2011 22:31, "Marco Pizzoli" <marco.pizzoli(a)gmail.com> wrote: > Hi Jonathan, > I understand the "locality" of the attribute, but my question is motivated > by the ppolicy_forward_updates directive that addresses this identical > problem. > Do you think it would be possible to have a similar feature with this > overlay? > > Thanks > Marco > On 7 Feb 2011 20:49, "Jonathan CLARKE" <jonathan.clarke(a)normation.com> > wrote:

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical