openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

Re: Transparent proxy, (objectClass=user) not being relayed. Schema issue?
by masarati＠aero.polimi.it 02 Feb '11

02 Feb '11

>> 2.3.43 included with CentOS. I'll try the latest package. Thanks! > > Ah. Actually, I only tried an undefined objectClass, which works. In > fact, in the case you're considering, (objectClass=user) contains an > invalid value of a valid attribute, while (sAMAccountName=user01) contains > an invalid attribute, so the two cases are different. Right now, with > HEAD's back-meta for "(&(objectClass=user)(sAMAccountName=user01))" I get > "(&(?objectClass=user)(!(objectClass=*)))". Let me check a bit more. I have provided another round of fixes. One of them affects back-meta (map.c, ITS#6818); another affects filter handling (ava.c); finally, another affects slapo-rwm when used in conjunction with back-ldap (rwmmap.c). Now the issue should be definitely fixed. Please test. p.

2 1

authz-regexp and uid's
by Derek Bodner 02 Feb '11

02 Feb '11

Hello, I'm running an ldap 2.3 server, with users setup under cn=<first name> <last name>,ou=People,dc=org,dc=com. I have an application that is trying to access the dn's directly, via uid=<username>,ou=People,dc=org,dc=com I've setup an authz-regexp rule to try to rewrite the request: authz-regexp uid=([^,]*),ou=People,dc=org,dc=com ldap:///ou=People,dc=org,dc=com??one?(uid=$1) But my query still seems to be failing [dbodner@nagios01 ~]$ ldapsearch -h <ldap server> -x -b "uid=dbodner,ou=People,dc=org,dc=com" # extended LDIF # # LDAPv3 # base <uid=dbodner,ou=People,dc=org,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 Any ideas on what I'm doing wrong ? -- Derek Bodner subscribedlists(a)derekbodner.com

2 2

using slapindex on a running instance of openldap
by François Périchon 02 Feb '11

02 Feb '11

Hi, I am using the gentoo build of openldap 2.4.23 with db-4.8 on a 64bit gentoo linux system. I am trying to reindex a database after switching this database on readonly mode (by editing the bdb backend entry in th cn=config). The slapindex manpage read: Your slapd(8) should not be running (at least, not in read-write mode) when you do this to ensure consistency of the database. But I get this error: sudo -u ldap slapindex -q member bdb_db_open: database "dc=univ-lille2,dc=fr": database already in use. backend_startup_one (type=bdb, suffix="dc=univ-lille2,dc=fr"): bi_db_open failed! (-1) slap_startup failed Regards, -- François Périchon Gestion des identités numériques Université Lille 2 - Droit & Santé Centre de Ressources Informatiques http://cri.univ-lille2.fr tel: +33 3 20 96 52 28 - A: Yes. > Q: Are you sure ? >> A: Because it reverses the logical flow of conversation. >>> Q: Why is top posting annoying in email ?

1 0

same objects in multiple ou?
by Joe Comeaux 01 Feb '11

01 Feb '11

I'm trying to design an environment that does not allow anonymous binds, and the users that require authentication reside across multiple OU's. It seems common practice among authentication modules to take a cn, bind anonymously to scan for the full dn, and then check password with full dn to authenticate. What I'd like to avoid is the anonymous bind, or storing a name and password with read access to bind, to increase security. I think what would be ideal is to somehow map all objects across multiple ou's to a single ou. Something along the lines of : all objects in ou=Department1,dc=example,dc=com + ou=Department2,dc=example,dc=com + ou=Department3,dc=example,dc=com to be linked to ou=Everyone,dc=example,dc=com. If something like that were in place, new users created in Department3 could be authenticated with cn=username,ou=Everyone,dc=example,dc=com. All modules designed to check authentication would not need to bind first to search the directory for the full dn. I've seen references to aliasing, but that applies only to a single object, and also mentions of mapping, but I can't tell if that would do what I expect it to do. Has anyone else built something similar? Can what I explain even be done with OpenLDAP? What should I be looking in to for direction on setting this up? Thanks in advance -Joe Comeaux

3 7

autonumbering
by Molenda, Mark 01 Feb '11

01 Feb '11

I know you can create a sequence for auto numbering in records, I was wondering if this is still the preferred method? What is the best way?

1 0

User managed groups - ACLs
by Christian Manal 01 Feb '11

01 Feb '11

Hi list, I am currently trying to make it possible for ordinary users to manage their own groups in the following way: 1 Any user can create new groups ("groupOfNames"). 1.1 On creation, the creator is set to be the first member and manager of the group (the latter is defined as a single-value attribute (UDBgrpAdmin) for a self defined auxiliary objectClass "UDBgrp"). 1.2 Some names should be prohibited from being used for new groups. 2 Group managers can invite any user to the group by adding their DN to the invited list of the group (UDBgrpInvited) and revoke invitations by removing DNs from said list. 2.1 Group managers can kick members from the group. 2.2 Group managers can delete the group. 2.3 Group managers can assign a new manager who has to be a member of the group. 2.4 Group managers can (re)set a description for the group. 3 Invited users can accept or decline the invitation, i.e. remove themselves from the invite list and add themselves to the member list. 4 Group members can leave the group permanently or temporarily. The latter is achieved by moving themselves from the member list to a suspended list (UDBgrpSuspended) which allows them to rejoin the group later (i.e. move themselves back to the member list) without a new invitation. I have most of the above covered, but I'm struggling with the points 1.1, 2.3 and to some extend 1.2. 1.1 and 2.3: I have no idea if this is even possible, let alone how to achieve it. 1.2: By extending the 'filter' rule that limits the objectClasses for new entries in "ou=Group" I can make a blacklist for 'cn' values, but I'd rather have something in the DIT itself, so I can modify the list without meddling with the server config. This is optional, though, since I don't except the list to change very often. This is what I've got so far: <http://openldap.pastebin.com/n8P4eKvU> Any help would be appreciated. Regards, Christian Manal

1 1

meta directory backend and rewriting option '|'
by Lehnert, Hartmut 01 Feb '11

01 Feb '11

Hello! I have a question concerning the pipe option '|' when using the meta directory backend and rewriting. In the manual pages the '|' option is marked as "not implemented". Does this reflect the actual state of the software or has somebody just forgotten to update the man page? Regards, Hartmut

2 2

Access control
by Thomas Schweikle 31 Jan '11

31 Jan '11

Hi! I am trying to set up access control for an OpenLDAP server. I'd like to use a Group to set up users allowed to access and write to entries inside my tree: I've created the group: dn: cn=administrators,dc=example,dc=com cn: administrators objectclass: groupOfNames (important for the group acl feature) member: cn=user1,ou=Users,dc=example,dc=com member: cn=user2,ou=Users,dc=example,dc=com in dn: olcDatabase=hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=example,dc=com olcRootDN: cn=adm,dc=example,dc=com olcRootPW: ${admpw} olcAccess: to attrs=userPassword,shadowLastChange,krbPrincipalKey by group.exact="cn=administrators,dc=example,dc=com" write by dn="cn=adm,dc=example,dc=com" write by anonymous auth by self write by * none olcAccess: to dn.base="" by * read olcAccess: to * by group.exact="cn=administrators,dc=example,dc=com" write by dn="cn=adm,dc=example,dc=com" write by * read Now trying to access "userPassword" from any user inside the tree "ou=Users,dc=example,dc=com". 1. The password field is empty -- it should hold a value 2. Entering a value, then pressing apply: "Error modifying 'cn=user3,ou=Users,dc=xompu,dc=de': Insufficient access I'd expected to have access to "userPassword" and I am allowed to write this value. Why does it not work if I log in with user1? -- Thomas

3 5

cn=config how to grant read rights
by John Espiro 31 Jan '11

31 Jan '11

I am new to the whole cn=config thing... Having just started with it, I have a question. I have an existing user for which I need to give read rights to the tree: "This user must have the Read right to the LDAP service.". How do I go about modifying the ACL so that he has this? John

1 0

Transparent proxy, (objectClass=user) not being relayed. Schema issue?
by Christopher Cprek 31 Jan '11

31 Jan '11

Hello, I'm attempting to configure a slapd server in a very simple transparent proxy configuration. I'm having a problem where clients for this proxy have a (objectClass=user) filter defined. This filter is being replaced with (!(objectClass=*)) when the searchRequest is relayed to the backend LDAP server. I believe this is something missing in the schema, though I'm very new to LDAP. I've already included an AD schema in my slapd.conf to resolve some AD specific filters I had trouble with. I've attempted to uncomment and modify the core.schema's definition of attributetype NAME objectClass, and commented out what I suspected was the conflicting duplicate attributeType NAME supportedApplicationContext. But I can't get slapd to start. I keep getting a duplicate attribute type error in the config. hdb_back_initialize: Sleepycat Software: Berkeley DB 4.4.20: (January 10, 2006) /etc/openldap/schema/core.schema: line 66: Duplicate attributeType: "2.5.4.0" slapd-ldap destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. I would appreciate any guidance to help resolve my problem. All I want is the filter (objectClass=user) to be relayed correctly from the slapd service to the LDAP proxy backend. Thanks in advance! /Chris

3 6

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical