openldap-technical

openldap-technical@openldap.org

11 participants
9876 discussions

ACLs to allow users to traverse DIT down to their own entry, lock down everything else
by Andreas Ntaflos 05 Jan '11

05 Jan '11

Hi list, I've been fighting with ACLs for quite a bit now and most things seems to work but I not quite everything I need. I am using OpenLDAP 2.4.21 (2.4.21-0ubuntu5.3) on Ubuntu 10.04. A DN for a typical user looks like this (horribly long): uid=foo(a)example.net,ou=users,domainName=example.net, ou=virtualDomains,dc=example,dc=com What works is users authenticating against the director and changing their own password (using ldappasswd, i.e. the LDAP extended password modify operation). I also have an authentication user that may read most of the directory. == What I want to achieve == a) Users such as just described should be able to: a.1) traverse the directory from the top (the base being "dc=example,dc=com") and a.2) see only their own entry along with the parent/ancestor entries leading to it. b) The directory should be as locked down as possible. Anonymous binds are not allowed, nor should users see any attributes other than their own. Essentially I want users to be able to use tools like phpLDAPadmin and traverse the tree down to their own entry. == What I have so far == Please comment if you find anything objectionable. {0}to attrs=userPassword by dn="uid=authenticator,ou=services,dc=example,dc=com" read by self write by users auth by anonymous auth by * none {1}to dn.subtree="ou=virtualDomains,dc=example,dc=com" by dn="uid=authenticator,ou=services,dc=example,dc=com" read by users =d break {2}to dn.regex="uid=[^,]+,ou=users,domainName=[^,]+, \ ou=virtualDomains,dc=example,dc=com" by self read This mostly works. == What doesn't work == Users can authenticate and change passwords and don't see anything except their own entry, *IF* they specify their own DN as search base in i.e. ldapsearch. Tools like phpLDAPadmin are not happy with this and say that the top entry (dc=example,dc=com) doesn't exist ("No such object"). Which is of course consistent with the ACLs as specified. So what do I need to do so users can specify "dc=example,dc=com" as search base and traverse the directory tree down to their own DN entry? I must admit that ACLs in LDAP are far more complex than I would ever have guessed. It also doesn't help that many examples on ACLs have a world-readable directory (by * read) that just gets locked down a bit. I on the other hand want the directory completely locked down and open up only specific parts to users (and later groups). Sorry for this long post. Any and all help is appreciated. Thanks, Andreas

2 1

viewing cn=config
by E.S. Rosenberg 05 Jan '11

05 Jan '11

Hi, I have a standard Debian install of slapd that was apparently automatically upgraded/updated from using slapd.conf to using olc. Now I would like to view settings before editing them so I tried some simple ldapsearch queries but all the things I try return empty results. How do I get to see the contents of cn=config? Things I have tried: ldapsearch -b cn=config -D cn=admin,dc=mydomain -W ldapsearch -x cn=config ldapsearch -D cn=admin,dc=mydomain -W cn=config Some help/pointers in the right direction would be greatly appreciated. Thanks, Eli

7 8

Granting write to ou
by Thomas D. Dahlmann 05 Jan '11

05 Jan '11

Hi I'm trying to add ordinary users write access to a specific ou. I've googled a lot and haven't really found any useful regarding to openldap 2.4 (slapd.d format). What would be the correct syntax for a ldapmodify command to accomplish this to the dn: ou=addressbook,dc=example,dc=net ? Thanks. /Thomas

4 7

Alejandro Leyva wants to stay in touch on LinkedIn
by Alejandro Leyva via LinkedIn 05 Jan '11

05 Jan '11

LinkedIn ------------Alejandro Leyva requested to add you as a connection on LinkedIn: ------------------------------------------ Edward, I'd like to add you to my professional network on LinkedIn. - Alejandro Leyva Accept invitation from Alejandro Leyva http://www.linkedin.com/e/-48cabe-gikmn8dl-6g/IxIpDd2wsdsod7c6kW2TzgvFvx58f… View invitation from Alejandro Leyva http://www.linkedin.com/e/-48cabe-gikmn8dl-6g/IxIpDd2wsdsod7c6kW2TzgvFvx58f… ------------------------------------------ DID YOU KNOW LinkedIn can help you find the right service providers using recommendations from your trusted network? Using LinkedIn Services, you can take the risky guesswork out of selecting service providers by reading the recommendations of credible, trustworthy members of your network. http://www.linkedin.com/e/-48cabe-gikmn8dl-6g/svp/inv-25/ -- (c) 2010, LinkedIn Corporation

2 1

Re: DynList + posixGroup and permission to Dir
by masarati＠aero.polimi.it 05 Jan '11

05 Jan '11

> I read manual for slapo-dynlist and I tried found sth. about autogroup. > > Can you show my some example to this? > > Or this is possible to make that dyngroup and posixGroup in linux? Please keep replies on the list. Dyngroup works exactly like dynlist, as far as I remember. I know little about autogroup; perhaps someone else can help. Did you read the README? p.

1 0

Re: problem enabling ssl on openldap 2.2.13
by rui 05 Jan '11

05 Jan '11

Hi, The "is not readable by "ldap"" error happens when i start ldap using /etc/rc.d/init.d/ldap restart These three lines are the source of the problem, if i remove them then no warning message on restart. TLSCACertificateFile server.pem TLSCertificateFile server.pem TLSCertificateKeyFile server.pem I have moved this file to /etc/openldap/cacerts and changed the above three path accordingly. I have also modified ldap.conf to have TLS_CACERT which allows me to do ldapsearch(before it was giving ssl verify problem)now with ldaps://localhost on the same sytem. I still get this when i restart the ldap server using /etc/rc.d/init.d/ldap restart, notice the er.pem after ldap - is it not picking up the path. correctly or its a harmless warning now that ldaps is working i think it is harmless. is not readable by "ldap"er.pem [WARNING] is not readable by "ldap"er.pem [WARNING] is not readable by "ldap"er.pem [WARNING] Checking configuration files for slapd: [ OK ] Starting slapd: [ OK ] ------------------------------------------------ Problem on windows: pLdapConnection = ldap_sslinit(pHost,LDAP_SSL_PORT, 1); // fine - connecting to 636 iRtn = ldap_set_option(pLdapConnection, LDAP_OPT_PROTOCOL_VERSION, (void*)&version); //fine long option; printf("Checking if SSL is enabled\n"); iRtn = ldap_get_option(pLdapConnection,LDAP_OPT_SSL,(void*)&option); Here i get returned 0 in option meaning ssl is disabled. Also if i connect afterwards, i get 0x51(Cannot contact the LDAP server) connectSuccess = ldap_connect(pLdapConnection, NULL); How can i use ssl based openldap authentication on windows client? Do i have to move the self signed server.pem to windows, i tried to add it to certificate store by changing server.pem to server.cer? Regards, rui > On Wed, Jan 5, 2011 at 8:12 AM, Dieter Kluenter <dieter(a)dkluenter.de> wrote: >> Am Tue, 4 Jan 2011 16:52:06 +0000 >> schrieb rui <guideveloper(a)gmail.com>: >> >>> Hi >>> >>> I am trying to enable tls based session with openldap from a client. I >>> created a self signed certificate based on command from >>> http://www.openldap.org/pub/ksoper/OpenLDAP_TLS.html#4.1 >>> My server.pem file is in /etc/openldap directory where slapd.conf is >>> located. >> >> This document is not recommended >>> >>> Here are further settings in my slapd.conf >>> TLSCACertificateFile server.pem >>> TLSCertificateFile server.pem >>> TLSCertificateKeyFile server.pem >>> >>> TLSVerifyClient never >>> >>> >>> When I restart the ldap, it gives me the following warnings. >>> is not readable by "ldap" [WARNING] >>> is not readable by "ldap" [WARNING] >>> is not readable by "ldap" [WARNING] >>> Checking configuration files for slapd: [ OK ] >>> Starting slapd: [ OK ] >> >> This are not slapd warnings, what is the sosurce of this result report? >> >>> >>> I have checked the ps output and it is started as: >>> ldap 6883 1 0 16:18 ? 00:00:00 /usr/sbin/slapd -u >>> ldap -h ldap:/// ldaps:/// >>> >>> AND >>> netstat -anp | grep slapd >>> tcp 0 0 0.0.0.0:389 0.0.0.0:* >>> LISTEN 7850/slapd >>> tcp 0 0 0.0.0.0:636 0.0.0.0:* >>> LISTEN 7850/slapd >>> tcp 0 0 ip:389 ip:43165 >>> ESTABLISHED 7850/slapd >>> tcp 0 0 :::389 :::* >>> LISTEN 7850/slapd >>> tcp 0 0 :::636 :::* >>> LISTEN 7850/slapd >>> unix 2 [ ] DGRAM 302231743 7850/slapd >>> >> And what is your problem? slapd is listening on ports 389 and 636 >> >> -Dieter >> >> -- >> Dieter Klünter | Systemberatung >> http://dkluenter.de >> GPG Key ID:DA147B05 >> 53°37'09,95"N >> 10°08'02,42"E >> >

2 1

DynList + posixGroup and permission to Dir
by Rafal Kaminski 05 Jan '11

05 Jan '11

Hi, I have problem with OpenLdap and permission to file. --- First - I set this in my slapd.conf: overlay dynlist dynlist-attrset labeledURIObject labeledURI --- Second - I make cn=test,ou=Projects,dc=example,dc=com with: dn: cn=test,ou=Projects,dc=example,dc=com gidNumber: 6789 objectClass: posixGroup objectClass: top objectClass: labeledURIObject labeledURI: ldap:///cn=testgroup,ou=Groups,dc=example,dc=com?memberUid?sub?(objectClass=posixGroup) memberUid: user1 (dynamic) memberUid: user2 (dynamic) in cn=testgroup,ou=Groups,dc=example,dc=com i have memberuid: user1 and memberUid: user2 --- Third - when i made getent group test I have: test:*:6789:user1,user2 But when i try id user1 i didn't see this group :( And next i set chmod 770 dir and chown root.test dir and try access to this dir. But of course it is not possible because the user is not in this group (that said "id"). Somebody know the resolve? Because i spent a lot of hours and i can't find the problem. Very thanks for help! BR, Rafal

2 2

Re: slapo-accesslog on remote ldap server
by masarati＠aero.polimi.it 05 Jan '11

05 Jan '11

> Hi all, > I would like to know if is it possibile to have accesslog overlay to > write > to a remote ldap server. > > I have 2 OL instances and I would like to aggregate accesslog data on 1 > server dedicated to serve accesslog query. In principle, yes (not tested). Log to an "ldap" database pointing to the real log database. Identity assertion may be needed. p.

1 0

Re: DynList + posixGroup and permission to Dir
by Rafal Kaminski 05 Jan '11

05 Jan '11

Hi, Please help me or tell - if this is possible to make this one? I fight with this 2 days and I can't found resolve. Thanks! BR, Rafal

2 1

slapo-accesslog on remote ldap server
by Marco Pizzoli 05 Jan '11

05 Jan '11

Hi all, I would like to know if is it possibile to have accesslog overlay to write to a remote ldap server. I have 2 OL instances and I would like to aggregate accesslog data on 1 server dedicated to serve accesslog query. Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical