openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

Re: DynList + posixGroup and permission to Dir
by masarati＠aero.polimi.it 05 Jan '11

05 Jan '11

> I read manual for slapo-dynlist and I tried found sth. about autogroup. > > Can you show my some example to this? > > Or this is possible to make that dyngroup and posixGroup in linux? Please keep replies on the list. Dyngroup works exactly like dynlist, as far as I remember. I know little about autogroup; perhaps someone else can help. Did you read the README? p.

1 0

Re: problem enabling ssl on openldap 2.2.13
by rui 05 Jan '11

05 Jan '11

Hi, The "is not readable by "ldap"" error happens when i start ldap using /etc/rc.d/init.d/ldap restart These three lines are the source of the problem, if i remove them then no warning message on restart. TLSCACertificateFile server.pem TLSCertificateFile server.pem TLSCertificateKeyFile server.pem I have moved this file to /etc/openldap/cacerts and changed the above three path accordingly. I have also modified ldap.conf to have TLS_CACERT which allows me to do ldapsearch(before it was giving ssl verify problem)now with ldaps://localhost on the same sytem. I still get this when i restart the ldap server using /etc/rc.d/init.d/ldap restart, notice the er.pem after ldap - is it not picking up the path. correctly or its a harmless warning now that ldaps is working i think it is harmless. is not readable by "ldap"er.pem [WARNING] is not readable by "ldap"er.pem [WARNING] is not readable by "ldap"er.pem [WARNING] Checking configuration files for slapd: [ OK ] Starting slapd: [ OK ] ------------------------------------------------ Problem on windows: pLdapConnection = ldap_sslinit(pHost,LDAP_SSL_PORT, 1); // fine - connecting to 636 iRtn = ldap_set_option(pLdapConnection, LDAP_OPT_PROTOCOL_VERSION, (void*)&version); //fine long option; printf("Checking if SSL is enabled\n"); iRtn = ldap_get_option(pLdapConnection,LDAP_OPT_SSL,(void*)&option); Here i get returned 0 in option meaning ssl is disabled. Also if i connect afterwards, i get 0x51(Cannot contact the LDAP server) connectSuccess = ldap_connect(pLdapConnection, NULL); How can i use ssl based openldap authentication on windows client? Do i have to move the self signed server.pem to windows, i tried to add it to certificate store by changing server.pem to server.cer? Regards, rui > On Wed, Jan 5, 2011 at 8:12 AM, Dieter Kluenter <dieter(a)dkluenter.de> wrote: >> Am Tue, 4 Jan 2011 16:52:06 +0000 >> schrieb rui <guideveloper(a)gmail.com>: >> >>> Hi >>> >>> I am trying to enable tls based session with openldap from a client. I >>> created a self signed certificate based on command from >>> http://www.openldap.org/pub/ksoper/OpenLDAP_TLS.html#4.1 >>> My server.pem file is in /etc/openldap directory where slapd.conf is >>> located. >> >> This document is not recommended >>> >>> Here are further settings in my slapd.conf >>> TLSCACertificateFile server.pem >>> TLSCertificateFile server.pem >>> TLSCertificateKeyFile server.pem >>> >>> TLSVerifyClient never >>> >>> >>> When I restart the ldap, it gives me the following warnings. >>> is not readable by "ldap" [WARNING] >>> is not readable by "ldap" [WARNING] >>> is not readable by "ldap" [WARNING] >>> Checking configuration files for slapd: [ OK ] >>> Starting slapd: [ OK ] >> >> This are not slapd warnings, what is the sosurce of this result report? >> >>> >>> I have checked the ps output and it is started as: >>> ldap 6883 1 0 16:18 ? 00:00:00 /usr/sbin/slapd -u >>> ldap -h ldap:/// ldaps:/// >>> >>> AND >>> netstat -anp | grep slapd >>> tcp 0 0 0.0.0.0:389 0.0.0.0:* >>> LISTEN 7850/slapd >>> tcp 0 0 0.0.0.0:636 0.0.0.0:* >>> LISTEN 7850/slapd >>> tcp 0 0 ip:389 ip:43165 >>> ESTABLISHED 7850/slapd >>> tcp 0 0 :::389 :::* >>> LISTEN 7850/slapd >>> tcp 0 0 :::636 :::* >>> LISTEN 7850/slapd >>> unix 2 [ ] DGRAM 302231743 7850/slapd >>> >> And what is your problem? slapd is listening on ports 389 and 636 >> >> -Dieter >> >> -- >> Dieter Klünter | Systemberatung >> http://dkluenter.de >> GPG Key ID:DA147B05 >> 53°37'09,95"N >> 10°08'02,42"E >> >

2 1

DynList + posixGroup and permission to Dir
by Rafal Kaminski 05 Jan '11

05 Jan '11

Hi, I have problem with OpenLdap and permission to file. --- First - I set this in my slapd.conf: overlay dynlist dynlist-attrset labeledURIObject labeledURI --- Second - I make cn=test,ou=Projects,dc=example,dc=com with: dn: cn=test,ou=Projects,dc=example,dc=com gidNumber: 6789 objectClass: posixGroup objectClass: top objectClass: labeledURIObject labeledURI: ldap:///cn=testgroup,ou=Groups,dc=example,dc=com?memberUid?sub?(objectClass=posixGroup) memberUid: user1 (dynamic) memberUid: user2 (dynamic) in cn=testgroup,ou=Groups,dc=example,dc=com i have memberuid: user1 and memberUid: user2 --- Third - when i made getent group test I have: test:*:6789:user1,user2 But when i try id user1 i didn't see this group :( And next i set chmod 770 dir and chown root.test dir and try access to this dir. But of course it is not possible because the user is not in this group (that said "id"). Somebody know the resolve? Because i spent a lot of hours and i can't find the problem. Very thanks for help! BR, Rafal

2 2

Re: slapo-accesslog on remote ldap server
by masarati＠aero.polimi.it 05 Jan '11

05 Jan '11

> Hi all, > I would like to know if is it possibile to have accesslog overlay to > write > to a remote ldap server. > > I have 2 OL instances and I would like to aggregate accesslog data on 1 > server dedicated to serve accesslog query. In principle, yes (not tested). Log to an "ldap" database pointing to the real log database. Identity assertion may be needed. p.

1 0

Re: DynList + posixGroup and permission to Dir
by Rafal Kaminski 05 Jan '11

05 Jan '11

Hi, Please help me or tell - if this is possible to make this one? I fight with this 2 days and I can't found resolve. Thanks! BR, Rafal

2 1

slapo-accesslog on remote ldap server
by Marco Pizzoli 05 Jan '11

05 Jan '11

Hi all, I would like to know if is it possibile to have accesslog overlay to write to a remote ldap server. I have 2 OL instances and I would like to aggregate accesslog data on 1 server dedicated to serve accesslog query. Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

1 0

Re: dynlist and group membership (libnss-ldap, posixGroup, samba)
by Rafal Kaminski 05 Jan '11

05 Jan '11

Hi, I have the same problem. Did you find resolve for this? Thanks for help. BR, Rafal Kaminski

1 0

How does LDAP_OPT_RESTART work?
by Khaled Blah 05 Jan '11

05 Jan '11

Hello, I'd like to know what the meaning of LDAP_OPT_RESTART is and how it works? Is there someone here who could shed some light on this for me? First of all: next to the description in the manual is a "FIXME" and it doesn't say what needs to be fixed exactly. Second of all: I've tried my OpenLDAP based client with this option set to LDAP_OPT_ON when my client was still running and already had done one successfull bind and then stopped (with another bind while the server was stopped) and restarted my LDAP server. However, when the LDAP server was back online the connection was not restarted and the bind did not work. Did I miss something or do I misunderstand the purpose of this option? Thanks in avance to anyone who can tell me more about this. Regards, Khaled

1 0

problem enabling ssl on openldap 2.2.13
by rui 05 Jan '11

05 Jan '11

Hi I am trying to enable tls based session with openldap from a client. I created a self signed certificate based on command from http://www.openldap.org/pub/ksoper/OpenLDAP_TLS.html#4.1 My server.pem file is in /etc/openldap directory where slapd.conf is located. Here are further settings in my slapd.conf TLSCACertificateFile server.pem TLSCertificateFile server.pem TLSCertificateKeyFile server.pem TLSVerifyClient never When I restart the ldap, it gives me the following warnings. is not readable by "ldap" [WARNING] is not readable by "ldap" [WARNING] is not readable by "ldap" [WARNING] Checking configuration files for slapd: [ OK ] Starting slapd: [ OK ] I have checked the ps output and it is started as: ldap 6883 1 0 16:18 ? 00:00:00 /usr/sbin/slapd -u ldap -h ldap:/// ldaps:/// AND netstat -anp | grep slapd tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 7850/slapd tcp 0 0 0.0.0.0:636 0.0.0.0:* LISTEN 7850/slapd tcp 0 0 ip:389 ip:43165 ESTABLISHED 7850/slapd tcp 0 0 :::389 :::* LISTEN 7850/slapd tcp 0 0 :::636 :::* LISTEN 7850/slapd unix 2 [ ] DGRAM 302231743 7850/slapd Regards, rui

2 1

a problem of authentication fail in Ubuntu 10.04,slapd 2.4.21
by cn_gd＠126.com 05 Jan '11

05 Jan '11

hi all, I 'm install slapd follow bellow steps in ubuntu 10.04 lucid strictly: 1. apt-get install slapd * slapd -V @(#) $OpenLDAP: slapd 2.4.21 (Aug 10 2010 17:08:36) $ buildd@yellow:/build/buildd/openldap-2.4.21/debian/build/servers/slapd* 2. dpkg-reconfigure slapd 3.edit /etc/ldap/slapd.d/cn\=config.ldif 4. cat /etc/ldap/slapd.d/cn\=config.ldif dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcLogLevel: none olcPidFile: /var/run/slapd/slapd.pid structuralObjectClass: olcGlobal dn: olcDatabase=bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: bdb olcSuffix: "dc=cg,dc=scsio,dc=ac,dc=cn" olcDbDirectory: /home/az/openldap-data olcRootDN: "cn=Manager,dc=cg,dc=scsio,dc=ac,dc=cn" olcRootPW: secret 4. /etc/init.d/slapd restart All step're OK,then I run bellow to test it: 5. ldapsearch -x -D "cn=Manager,dc=cg,dc=scsio,dc=ac,dc=cn" -w "secret" -H ldap://cg.scsio.ac.cn and it show that error: *ldap_bind: Invalid credentials (49) **I try again and again,but it'still the same.( using slappasswd to change it also turn to same problem). I wonder what's go wrong.any help would be greatly appreciated.Thank you in advance! ** *

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical