openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

Re: Windows ldp.exe kills openldap 2.4.23
by masarati＠aero.polimi.it 03 Jan '11

03 Jan '11

> On Sun, Jan 2, 2011 at 3:45 AM, <masarati(a)aero.polimi.it> wrote: >> >> >>>> Is this a know bug (see ITS#6570) or something new? Is there a >>>> workaround >>>> it? >>> >>> AFAIK it is not known. I am able to reproduce it (Linux, HEAD code), >>> so I >>> suggest you file an ITS. With respect to a workaround, it is not clear >>> what's the purpose of the operation you're trying to accomplish. In >>> general, a modrdn on the empty DN should be meaningless (although it >>> should not crash the server). >> >> A fix is in HEAD (slapd/modrdn.c); please test. p. Please keep replies on the thread. > Thanks, I'll give it a try. And sorry for the confusion, by "work > around" a meant securing server from a such easy DOS attack, > i.e.preventing a crush. > > Do you know when 2.4.24 is scheduled to come out? Do you still want me > to create an ITS? Yes, please, so we can track the issue. Thanks, p.

2 2

Re: Kerberos/GSSAPI issues
by Brian Candler 02 Jan '11

02 Jan '11

On Thu, Dec 30, 2010 at 11:49:23AM -0800, Russ Allbery wrote: > > Have you got the one-line patch? > > Included below. Thank you Russ. Discussed further on kerberos(a)mit.edu list, and ticket raised as http://bugzilla.cyrusimap.org/show_bug.cgi?id=3380 Regards, Brian.

1 0

SASL proxy auth problem
by Jaap Winius 02 Jan '11

02 Jan '11

Hi folks, Thanks to Pierangelo's last reply, I now know what I suspected: that my consumer servers are configured to authenticate to their providers using SASL/GSSAPI, but that sometimes they don't do this, especially with proxy authorization. I've documented the entire install process: * OpenLDAP provider with MIT Kerberos V on Debian squeeze http://www.rjsystems.nl/en/2100-d6-openldap-provider-kerberos.php * OpenLDAP consumer with MIT Kerberos V on Debian squeeze http://www.rjsystems.nl/en/2100-d6-openldap-consumer-kerberos.php The last time I followed these instructions to the letter, proxy authorization worked. Now I've booted up the same machines again a few days later and it no longer works: the consumer still uses SASL to bind with the provider for replication, but it uses a SIMPLE bind for proxy authorization. Of course that results in an error. Yet, the configuration seems unchanged. Has anyone else experienced this problem? Thanks, Jaap PS -- If anyone is interested, I can supply plenty of details. See also my post of 12/24/2010 03:25:51 AM CET with subject "No ProxyAuthz with SASL-GSSAPI?"

2 6

Re: Windows ldp.exe kills openldap 2.4.23
by masarati＠aero.polimi.it 02 Jan '11

02 Jan '11

>> Is this a know bug (see ITS#6570) or something new? Is there a >> workaround >> it? > > AFAIK it is not known. I am able to reproduce it (Linux, HEAD code), so I > suggest you file an ITS. With respect to a workaround, it is not clear > what's the purpose of the operation you're trying to accomplish. In > general, a modrdn on the empty DN should be meaningless (although it > should not crash the server). A fix is in HEAD (slapd/modrdn.c); please test. p.

1 0

Windows ldp.exe kills openldap 2.4.23
by Serge Dubrouski 01 Jan '11

01 Jan '11

Hello - I just found that ldp.exe tool that comes with Windows is able to successfully kill OpenLDAP 2.4.23 when one tries tp modify DN and submits an empty old DN. Log files on openldap show this: Dec 29 15:19:32 ottawa slapd[11818]: conn=1000 op=2 do_modrdn Dec 29 15:19:32 ottawa slapd[11818]: do_modrdn: dn () newrdn (C=US) newsuperior () Dec 29 15:19:32 ottawa slapd[11818]: >>> dnPrettyNormal: <> Dec 29 15:19:32 ottawa slapd[11818]: <<< dnPrettyNormal: <>, <> Dec 29 15:19:32 ottawa slapd[11818]: >>> dnPrettyNormal: <C=US> Dec 29 15:19:32 ottawa slapd[11818]: <<< dnPrettyNormal: <c=US>, <c=us> Dec 29 15:19:32 ottawa slapd[11818]: conn=1000 op=2 MODRDN dn="" Is this a know bug (see ITS#6570) or something new? Is there a workaround it? -- Serge Dubrouski.

2 1

slapd bind method codes
by Jaap Winius 01 Jan '11

01 Jan '11

Hi folks, When clients bind with a provider and the provider's loglevel is set to stats, bind events show up frequently in the log. Often, some logged bind events have only a blank dn along with a "method" code. Here are two separate examples: slapd[903]: conn=1021 op=0 BIND dn="" method=128 slapd[903]: conn=1020 op=0 BIND dn="" method=163 Two questions: 1.) What do these method codes mean? Perhaps there list somewhere that explains all possible method codes. 2.) When a method code is shown, as in the examples above, why is the value for the dn empty? Thanks, Jaap

2 1

ber_flatten() of incomplete ber
by masarati＠aero.polimi.it 31 Dec '10

31 Dec '10

I was encoding a ber of the form "{{something}" (note the missing "}") using HEAD's liblber. ber_flatten() was (correctly?) returning an empty value; perhaps it should return an error code, indicating that the ber is incomplete? Am I missing some function to test the validity of a ber? p.

2 3

How Indexes work?
by Steeg Carson 30 Dec '10

30 Dec '10

Hello, I try to understand, how the LDAP-Indexes work. If I configure a Index for a Attribute like: index myAttribute eq the index file myAttribute.bdb is build in the data directory. When I search then ldapsearch -x -h localhost -D".." -b"<baseDN>" "(myAttribute=<searched key>)" how will the LDAP-Server process this request? Is there anywhere a good documentation? My assumption is: * At first, a the Index is looked up. The result are only the matched IDs. * The LDAP-Server now can quick give back all entries form id2enty.bdb If I use Indexes, are all other entries are examined too after give back the result from indexes? I have a database, and my search is like shown above. The search takes long. The cache is configured, the size is enough (approx. dn2id.bdb + id2entry.bdb). But what I see, is that the write IO from LDAP is enormously (seen with iotop). During the whole search, the write IO is higher than the read IO. Why? Thanks for help. Steeg

3 6

Kerberos/GSSAPI issues
by Brian Candler 30 Dec '10

30 Dec '10

Hello, I'm setting up an openldap server for Kerberos (GSSAPI) authentication only. I'm using slapd-2.4.21 from Ubuntu 10.04.1. It's basically working, and I had to do very little other than change export KRB5_KTNAME in /etc/default/slapd to point to the service keytab. However, there are a couple of strange things which I wonder if someone could help me with. (1) According to the documentation at http://www.openldap.org/doc/admin24/sasl.html#GSSAPI then the authentication DN should be uid=<primary[/instance]>,cn=<realm>,cn=gssapi,cn=auth However, running slapd in debug mode I see the cn=<realm> is missing. Here I have a ticket for inst/admin(a)WS.NSRC.ORG and run slapd -d 255: ... do_bind: dn () SASL mech GSSAPI ==> sasl_bind: dn="" mech=<continuing> datalen=32 SASL Canonicalize [conn=1000]: authcid="inst/admin" slap_sasl_getdn: conn 1000 id=inst/admin [len=10] => ldap_dn2bv(16) <= ldap_dn2bv(uid=inst/admin,cn=GSSAPI,cn=auth)=0 slap_sasl_getdn: u:id converted to uid=inst/admin,cn=GSSAPI,cn=auth >>> dnNormalize: <uid=inst/admin,cn=GSSAPI,cn=auth> => ldap_bv2dn(uid=inst/admin,cn=GSSAPI,cn=auth,0) <= ldap_bv2dn(uid=inst/admin,cn=GSSAPI,cn=auth)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=inst/admin,cn=gssapi,cn=auth)=0 <<< dnNormalize: <uid=inst/admin,cn=gssapi,cn=auth> ==>slap_sasl2dn: converting SASL name uid=inst/admin,cn=gssapi,cn=auth to a DN <==slap_sasl2dn: Converted SASL name to <nothing> SASL Canonicalize [conn=1000]: slapAuthcDN="uid=inst/admin,cn=gssapi,cn=auth" SASL proxy authorize [conn=1000]: authcid="inst/admin" authzid="inst/admin" SASL Authorize [conn=1000]: proxy authorization allowed authzDN="" send_ldap_sasl: err=0 len=-1 do_bind: SASL/GSSAPI bind: dn="uid=inst/admin,cn=gssapi,cn=auth" sasl_ssf=56 ... ==> limits_get: conn=1000 op=3 self="uid=inst/admin,cn=gssapi,cn=auth" this="dc=ws,dc=nsrc,dc=org" ... Now this works, if I change my ACL to olcAccess: {0}to * by dn.regex="^uid=([^,]+)/admin,cn=gssapi,cn=auth$" manage by users read However, I wonder why the realm is missing, and whether it can be included (because in future, if I end up with a cross-realm setup, I'll want to see the realm for authorization) Is this a documentation error, or is there some configuration option which needs setting to preserve the realm? (2) I would like to be able to do ldapsearch without specifying -Y GSSAPI explicitly. However if I omit it, the client picks DIGEST-MD5 instead (which isn't much use, since I have no passwords in the database) # ldapsearch -b "ds=ws,dc=nsrc,dc=org" SASL/DIGEST-MD5 authentication started Please enter your password: Adding -d 255 I see that the server is offering these: ... ldap_sasl_interactive_bind_s: server supports: NTLM DIGEST-MD5 GSSAPI CRAM-MD5 ldap_int_sasl_bind: NTLM DIGEST-MD5 GSSAPI CRAM-MD5 ... How can I configure the server not to offer the other authentication mechanisms, or else to put GSSAPI at the front of the list? Thanks, Brian.

4 13

Re: invalid credentials (49) for normal user
by rui 30 Dec '10

30 Dec '10

Hi, After running slapd with "-d 128" i have found lot of messages like this. Can somebody point me to standard acl for users, i want to authenticate for every user using ldap browser or c ldap api with ldap_simple_bind with binddn bindn=uid=rui,ou=People,o=m1,c=GB ############################### Dec 29 14:13:53 m4mrh01 slapd: => acl_mask: access to entry "cn=rui,ou=Group,o=m1,c=GB", attr "objectClass" requested Dec 29 14:13:53 m4mrh01 slapd: => acl_mask: to value by "", (=n) Dec 29 14:13:54 m4mrh01 slapd: <= acl_mask: no more <who> clauses, returning =n (stop) Dec 29 14:13:54 m4mrh01 slapd: => access_allowed: search access denied by =n Dec 29 14:13:54 m4mrh01 slapd: => access_allowed: search access to "cn=m4musers,ou=Group,o=m1,c=GB" "memberUid" requested Dec 29 14:13:54 m4mrh01 slapd: => acl_get: [2] attr memberUid Dec 29 14:13:54 m4mrh01 slapd: => acl_mask: access to entry "cn=m4musers,ou=Group,o=m1,c=GB", attr "memberUid" requested Dec 29 14:13:54 m4mrh01 slapd: => acl_mask: to value by "", (=n) Dec 29 14:13:54 m4mrh01 slapd: <= acl_mask: no more <who> clauses, returning =n (stop) Dec 29 14:13:54 m4mrh01 slapd: => access_allowed: search access denied by =n Dec 29 14:18:04 m4mrh01 slapd: => access_allowed: auth access to "uid=rui,ou=People,o=m1,c=GB" "userPassword" requested Dec 29 14:18:04 m4mrh01 slapd: => acl_get: [1] attr userPassword Dec 29 14:18:04 m4mrh01 slapd: => acl_mask: access to entry "uid=rui,ou=People,o=m1,c=GB", attr "userPassword" requested Dec 29 14:18:04 m4mrh01 slapd: => acl_mask: to all values by "", (=n) Dec 29 14:18:04 m4mrh01 slapd: <= acl_mask: no more <who> clauses, returning =n (stop) Dec 29 14:18:04 m4mrh01 slapd: => access_allowed: auth access denied by =n ############################### I have also changed slapd.conf slightly ############################# access to attr=userPassword by self write by dn="uid=root,ou=People,o=M1,c=GB" write by * read access to * by self write by users read by anonymous auth ############################### Regards, rui > 1. invalid credentials (49) for normal user (rui) > 2. Re: invalid credentials (49) for normal user (Dieter Kluenter) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 24 Dec 2010 10:32:03 +0000 > From: rui <guideveloper(a)gmail.com> > To: openldap-technical(a)openldap.org > Subject: invalid credentials (49) for normal user > Message-ID: > <AANLkTikbS2LTj4D-0WMBdJXzMeBMpb3qO2=Y4wzPLv0G(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Hi, > > I have imported my passwd and groups file in ldap using > migrate_all_online.sh script. > > I am able to simple bind to ldap using > binddn= uid=root,ou=People,o=M1,c=GB but i can't seem to bind with any > other user like rui etc with their linux password. Its says invalid > credentials. > > I need to bind for authentication and then get all the primary and > secondary groups of a user(how can i do that). Why am i having this > problem - do i have to do something extra? > > When bound as root, if i do "memberUid=root" i get all the secondary > groups but i want to do it for any user. > > I am using c ldap api at the moment. > > > Here is my slapd.conf file: > ################################################## > # # See slapd.conf(5) for details on configuration options. > # This file should NOT be world readable. # > include /etc/openldap/schema/core.schema > include /etc/openldap/schema/cosine.schema > include /etc/openldap/schema/dyngroup.schema > include /etc/openldap/schema/inetorgperson.schema > include /etc/openldap/schema/misc.schema > include /etc/openldap/schema/nis.schema > include /etc/openldap/schema/openldap.schema > > ####################################################################### > # ldbm database definitions > ####################################################################### > database ldbm > suffix "o=M1,c=GB" > rootdn "uid=root,ou=People,o=M1,c=GB" > rootpw abc123 > directory /var/lib/ldap > > # Indices to maintain > index objectClass,uid,uidNumber,gidNumber eq > index cn,mail,surname,givenname eq,subinitial > > # # ACLs # > #access to dn="ou=People,o=M1,c=GB" > #attr=userPassword > #by self write > #by dn="uid=root,ou=People,o=M1,c=GB" write > #by * auth access to dn=".*,o=M1,c=GB" by self write > #by dn="uid=root,ou=People,o=M1,c=GB" write > #by * read access to dn=".*,o= M1,c=GB" > #by * read defaultaccess read > > access to attr=userpassword > by self write > by dn="uid=root,ou=People,o=M1,c=GB" write > by * read > > access to * > by self write > by dn=".+" read > by * read > > ############################################### > > Regards, > rui > > > ------------------------------ > > Message: 2 > Date: Sat, 25 Dec 2010 22:58:14 +0100 > From: "Dieter Kluenter" <dieter(a)dkluenter.de> > To: openldap-technical(a)openldap.org > Subject: Re: invalid credentials (49) for normal user > Message-ID: <87d3op1pmx.fsf(a)rubin.avci.de> > Content-Type: text/plain; charset=utf-8 > > rui <guideveloper(a)gmail.com> writes: > >> Hi, >> >> I have imported my passwd and groups file in ldap using >> migrate_all_online.sh script. >> >> I am able to simple bind to ldap using >> binddn= uid=root,ou=People,o=M1,c=GB but i can't seem to bind with any >> other user like rui etc with their linux password. Its says invalid >> credentials. > [...] > > run slapd in debugging mode, i.e. -d acl > > > ############ >> # ldbm database definitions >> ####################################################################### >> database ldbm > > ldbm is historic and not supported. > > -Dieter > > -- > Dieter Kl?nter | Systemberatung > http://dkluenter.de > GPG Key ID:DA147B05 > 53?37'09,95"N > 10?08'02,42"E > > > ------------------------------ > > _______________________________________________ > openldap-technical mailing list > openldap-technical(a)openldap.org > http://www.openldap.org/lists/mm/listinfo/openldap-technical > > > End of openldap-technical Digest, Vol 37, Issue 22 > ************************************************** >

3 6

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical