openldap-technical

openldap-technical@openldap.org

11 participants
9876 discussions

ldap design
by Hendrik van der Ploeg 16 Feb '11

16 Feb '11

Hello People, I'm in doubt what design I need to use for openldap This is the situation; We have 1200+ customers using LDAP. We want to replicate all these ldap server to 1 big ldapserver in a datacentre with a multi-master config. So all the customers are a master-ldap who replicate to the datacentre. My idea was to build in the datacentre a ldapcluster of about 4 server My question is: Will this be stable, because there will be 1200+ ldapservers replicating to 4 ldapserver in the datacentre. I know this depends on the number of write actions at the customers. All I can say is that write actions at the customers isn't THAT much. I really hope somebody can give me an answer or maybe there's somebody else with the same config Best Regards -- Hendrik van der Ploeg

4 3

ldap not respoding
by Prathyush 16 Feb '11

16 Feb '11

HI, Will huge size of slapd.log cause slapd service to hang -- *Regards, Prathyush*

1 0

search LDAP back-sql entry with two objectclasses (structural and auxiliary)
by Andreas Härtel 16 Feb '11

16 Feb '11

Hello, I am running a LDAP server on a debian system with a mySQL database as backend. slapd-version: $OpenLDAP: slapd 2.4.11 (Jul 24 2010 08:14:20) $@murphy:/build/buildd-openldap_2.4.11-1+lenny2-i386-H5BDjb/openldap-2.4.11/debian/build/servers/slapd mysql-version: mysql Ver 14.12 Distrib 5.0.51a, for debian-linux-gnu (i486) using readline 5.2 Everything is running fine if I am searching the LDAP tree for data containing only one objectClass (inetOrgPerson). Now I have add a second auxiliary objectClass (mozillaAbPersonAlpha) to my data via ldap_entry_objclasses table in the mySQL database, but a search only results in the three inetOrgPerson fields I have set: ldapsearch -LLL -s sub -b 'ou=contacts,ou=contacts,dc=...' 'objectclass=*' -D 'cn=USER' -w unsafe-password -x dn: ou=contacts,ou=contacts,dc=... objectClass: organizationalUnit objectClass: inetOrgPerson objectClass: mozillaAbPersonAlpha ou: contacts dn: cn=Name Firstname,ou=contacts,ou=contacts,dc=... objectClass: inetOrgPerson cn: Name Firstname sn: Name givenName: Firstname If I switch the dependency in the ldap_entries table from inetOrgPerson to the mozilla scheme, I get the mozilla fields but - e.g. in phpldapadmin - I can not see any data (also in my thunderbird addressbook). My opinion: mozilla scheme is not structural. Perhaps this old mailing-list entry gives an answer but - for me myself - no solution: http://www.openldap.org/lists/openldap-software/200403/msg00303.html Hope, someone has any idea about this problem ... !? Tanks a lot, Andreas My /etc/ldap/slapd.conf file (parts of it): ################################################################# include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/extension.schema include /etc/ldap/schema/mozillaAbPersonAlpha.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 256 modulepath /usr/lib/ldap moduleload back_hdb moduleload back_sql sizelimit 500 tool-threads 1 backend hdb backend sql database sql suffix "ou=contacts,ou=contacts,dc=... dbname contacts dbhost localhost dbuser myuser dbpasswd mypassword lastmod off has_ldapinfo_dn_ru no upper_func "upper" access to dn.subtree="ou=contacts,ou=contacts,dc=... by dn="cn=admin,dc=..." peername.ip=127.0.0.1 write by dn="cn=user" read by * none ################################################################# I thought about ataching my database entries but this could be too long. If there should be questions about it, please let me know.

1 1

Re: ldap auth does not works after openldap upgrade
by Andrew Findlay 15 Feb '11

15 Feb '11

On Tue, Feb 15, 2011 at 02:13:40PM -0200, Leonardo Carneiro wrote: > To: Andrew Findlay <andrew.findlay(a)skills-1st.co.uk> Please keep replies on the list so that other people can benefit from the discussion in future. > > Aha! How many entries did that search return? Was is about the same > > number that you would expect given your users and groups? > yep. they are all there. > > Did you previously have the LDAP server set up to refuse data to > > anonymous users? > No, it could bind as anonymous and read any data. In that case leave the database alone: the problem is in the configuration. Please post the slapd config. We need to see all of it except for any passwords. Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

2 3

Autogroup strange behaviour
by Luca Scamoni 15 Feb '11

15 Feb '11

Hi, I'm using autogroup overlay (OpenLDAP 2.4.23, autogroup v. 1.2.2.11 but the behaviour was the same with 1.2.2.6) and I'm facing a strange situation. Operations performed using openldap client tools work as expected. The same operations performed using a java client do not. I've restricted the problematic operations to modifications of existing entries. Using attached slapd.conf and ldap.ldif it's quite simple to reproduce it. Using openldap ldapmodify client: cn=user2,ou=people,dc=example,dc=com add: description description: test modifies the entry AND triggers autogroup modify operation on group cn=description adding user2 as a member of the group (see slapd.log.ok.add) The same operation performed with JExplorer modifies the entry but does NOT triggers autogroup modification (see slapd.log.java.add) I've compared the two logs and overlay related modifications are completely skipped in the java client test. Anyone has an explanation? Note: adding a new entry or deleting an existing one (if it matches any of the criteria in memberUrl) works even with Jexplorer. thanks -- /Luca Scamoni / *Gruppo Partners Associates* Tel. Milano +39 02 67380435**- Udine +39 0432 689815 - Roma +39 06 54832300 Fax Milano +39 02 67386214 - Udine +39 0432 570120 - Roma +39 06 91659273 Cell. +39 348 0471710 Email: Luca.Scamoni(a)GruppoPA.it <mailto:Luca.Scamoni@GruppoPA.it> Sito: _www.GruppoPA.it_ <http://www.GruppoPA.it> Prima di stampare, pensa all'ambiente ** Think about the environment before printing

2 2

slapd.conf for proxy to AD
by Del 15 Feb '11

15 Feb '11

Hi, Like a lot of people I guess, I'm having trouble configuring slapd to work as a proxy server in front of Microsoft's Active Directory. AD in this case is configured to refuse to allow anonymous searches but I want to allow anonymous searches on the proxy. Therefore the configuration I'm hoping for is: * Anonymous binds to slapd get translated into an authenticated bind to AD. * Authenticated binds to slapd have their credentials (DN and password) passed through to AD. Here's what I have so far, based on the documentation. I'm using slapd.conf rather than the new conf.d directory based config, and I'm currently running openldap 2.4.19: -- database ldap chase-referrals no suffix "MY-AD-SUFFIX-HERE" uri "ldaps://MY-AD-SERVER-HERE/" cancel abandon acl-bind bindmethod=simple binddn="VALID-BIND-DN" credentials="VALID-PASSWORD" idassert-bind bindmethod=simple binddn="VALID-BIND-DN credentials="VALID-PASSWORD" mode=legacy flags=non-prescriptive idassert-authzFrom "dn.regex:.*" access to * by * read -- You can assume I've used valid bind DNs, suffixes, server names and passwords in the places where I've resorted to capitals above. I've tested these binds from the command line directly against the AD server and they all work. I have tested the above on OpenLDAP 2.3, it works for anonymous binds if and only if a successful authenticated bind is done first. The same was reported in this post: http://www.openldap.org/lists/openldap-technical/200907/msg00043.html In OpenLDAP 2.4 it fails to recognise the idassert-bind completely, all attempts at anonymous bind seem to fail. A similar problem was reported while upgrading to 2.3.11 to 2.3.27, here: http://www.openldap.org/lists/openldap-software/200701/msg00055.html Am I using the correct configuration directives to achieve what I want, and if not what should I be using? Thanx, -- Del

6 6

ldap auth does not works after openldap upgrade
by Leonardo Carneiro 15 Feb '11

15 Feb '11

Hello everyone, I upgraded my debian machine from lenny to squeeze (the new stable) that comes with samba 3.5.6 and openldap 2.4.23. this machines works primarily as a PDC. i have 3 services authenticating on ldap: samba, apache and redmine. samba is acting very weird, but it's kinda working, but redmine and apache aren't working at all. these services do bind to the server, but it cannot find the users. also, i cannot execute ldapsearchs via CLI. plus, in the bash, when i try to change to some user other than root (eg: lscarneiro), the system does not recognize the user: fileserver:~# su - lscarneiro I have no name!@fileserver:~$ whoami whoami: cannot find name for user ID 1130 i'm very VERY noob on ldap and don't know exactly what kind of info i should give to you guys to get some help. any help is very welcome

3 7

big company with different affiliates, how to integrate?
by Pieter Baele 15 Feb '11

15 Feb '11

How would you integrate several companies with one mother company? (where our Linux team and IT is part of) We need to implement different OpenLDAP servers because of policies...yeaha... ;-) But I'm not sure how to do this. My opinion: Each company needs his own pair of multi-master LDAP servers. (for HA) Each LDAP server pair belongs to one of the affiliates and there has to be a 'chinese wall' between those (if possible) Off course it should not be possible for employees from company A to authenticate through the LDAP server of company B. Except for esx, kvm and other virtualization hosts each server belongs also to only 1 of these subcompanies. But for me and other admins it should be possible to access and manage all servers using the same password and tooling (like puppet with LDAP...) My idea was some combination of chaining, proxy... (or other overlays). We could use the LDAP server of the mother company as the last part of some chain. The DIT / right structure is also still an issue for me (I'm not an LDAP expert) Other nice to haves are some AD integration and kerberos, but this has nothing to do with my question :-) -- Sincerely, Pieter Baele www.pieterb.be

2 1

How to use LDAP_OPT_CONNECT_ASYNC?
by Ian Puleston 14 Feb '11

14 Feb '11

Hi, I'm trying to use the new LDAP_OPT_CONNECT_ASYNC with OpenLDAP 2.4.23 client and I can't see how it can be done. After creating the connection structure via ldap_initialize() I then call ldap_sasl_bind() to do the bind. That calls down to ldap_new_connection() (ldap_sasl_bind -> ldap_send_initial_request -> ldap_open_defconn -> ldap_new_connection) and that implements the asynchronous connect, setting the lconn_status to LDAP_CONNST_CONNECTING and not calling ldap_int_poll() in ldap_pvt_connect(). So far so good. But ldap_send_initial_request() then gets a good return code from ldap_open_defconn(), and so it goes on to call ldap_send_server_request() to send the bind, and that then calls ldap_int_poll() which waits for the connect to complete, making the whole operation synchronous. It seems to me that for this to work asynchronously, either: 1. ldap_send_initial_request() should check for lconn_status to LDAP_CONNST_CONNECTING on return from ldap_open_defconn(), and if it is then return, probably with error LDAP_X_CONNECTING. It should then be possible to re-call ldap_sasl_bind() when the connect has completed. 2. Establish the connection via ldap_new_connection() before calling ldap_sasl_bind(). But the functions to do that don't appear to be available on the API. ldap_open() could have probably done it, but it is now deprecated. So this would appear to require a new API function that would simply call ldap_open_defconn() and return LDAP_X_CONNECTING. Or is there some other way to achieve this? Ian

3 8

ACL peername
by Natalia 13 Feb '11

13 Feb '11

Hi, i have a problem with ACLs. I will to grant access to IP. my ACL: olcAccess: to dn.subtree="ou=people,dc=example,dc=de" by group.exact="cn=lda,ou=Endsysteme,dc=example,dc=de" write by group.exact="cn=kon,ou=Endsysteme,dc=example,dc=de" read by peername.ip=127.0.0.1 read by * none But i become error: ldap_modify: Other (e.g., implementation specific) error (80) additional info: <olcAccess> handler exited with 1 in logs: conn=1034 op=4 MOD attr=olcAccess olcAccess Feb 11 13:33:07 ldap slapd2.4[21279]: slapd: line 0: expecting <access> got "writeby". Feb 11 13:33:07 ldap slapd2.4[21279]: <access clause> ::= access to <what> [ by <who> [ <access> ] [ <control> ] ]+ <what> ::= * | dn[.<dnstyle>=<DN>] [filter=<filter>] [attrs=<attrspec>] <attrspec> ::= <attrname> [val[/<matchingRule>][.<attrstyle>]=<value>] | <attrlist> <attrlist> ::= <attr> [ , <attrlist> ] <attr> ::= <attrname> | @<objectClass> | !<objectClass> | entry | children <who> ::= [ * | anonymous | users | self | dn[.<dnstyle>]=<DN> ] [ realanonymous | realusers | realself | realdn[.<dnstyle>]=<DN> ] [dnattr=<attrname>] [realdnattr=<attrname>] [group[/<objectclass>[/<attrname>]][.<style>]=<group>] [peername[.<peernamestyle>]=<peer>] [sockname[.<style>]=<name>] [domain[.<domainstyle>]=<domain>] [sockurl[.<style>]=<url>] [dynacl/<name>[/<options>][.<dynstyle>][=<pattern>]] [ssf=<n>] [transport_ssf=<n>] [tls_ssf=<n>] [sasl_ssf=<n>] <style> ::= exact | regex | base(Object) <dnstyle> ::= base(Object) | one(level) | sub(tree) | children | exact | regex <attrstyle> ::= exact | regex | base(Obj Feb 11 13:33:07 ldap slapd2.4[21279]: conn=1034 op=4 RESULT tag=103 err=80 text=<olcAccess> handler exited with 1 I have OpenLDAP 2.4.22. If i remove "by peername.ip=127.0.0.1 read" it works. Thanks for help! Kind regards Natalia

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical