openldap-technical

openldap-technical@openldap.org

18 participants
9897 discussions

slapd bind method codes
by Jaap Winius 01 Jan '11

01 Jan '11

Hi folks, When clients bind with a provider and the provider's loglevel is set to stats, bind events show up frequently in the log. Often, some logged bind events have only a blank dn along with a "method" code. Here are two separate examples: slapd[903]: conn=1021 op=0 BIND dn="" method=128 slapd[903]: conn=1020 op=0 BIND dn="" method=163 Two questions: 1.) What do these method codes mean? Perhaps there list somewhere that explains all possible method codes. 2.) When a method code is shown, as in the examples above, why is the value for the dn empty? Thanks, Jaap

2 1

ber_flatten() of incomplete ber
by masarati＠aero.polimi.it 31 Dec '10

31 Dec '10

I was encoding a ber of the form "{{something}" (note the missing "}") using HEAD's liblber. ber_flatten() was (correctly?) returning an empty value; perhaps it should return an error code, indicating that the ber is incomplete? Am I missing some function to test the validity of a ber? p.

2 3

How Indexes work?
by Steeg Carson 30 Dec '10

30 Dec '10

Hello, I try to understand, how the LDAP-Indexes work. If I configure a Index for a Attribute like: index myAttribute eq the index file myAttribute.bdb is build in the data directory. When I search then ldapsearch -x -h localhost -D".." -b"<baseDN>" "(myAttribute=<searched key>)" how will the LDAP-Server process this request? Is there anywhere a good documentation? My assumption is: * At first, a the Index is looked up. The result are only the matched IDs. * The LDAP-Server now can quick give back all entries form id2enty.bdb If I use Indexes, are all other entries are examined too after give back the result from indexes? I have a database, and my search is like shown above. The search takes long. The cache is configured, the size is enough (approx. dn2id.bdb + id2entry.bdb). But what I see, is that the write IO from LDAP is enormously (seen with iotop). During the whole search, the write IO is higher than the read IO. Why? Thanks for help. Steeg

3 6

Kerberos/GSSAPI issues
by Brian Candler 30 Dec '10

30 Dec '10

Hello, I'm setting up an openldap server for Kerberos (GSSAPI) authentication only. I'm using slapd-2.4.21 from Ubuntu 10.04.1. It's basically working, and I had to do very little other than change export KRB5_KTNAME in /etc/default/slapd to point to the service keytab. However, there are a couple of strange things which I wonder if someone could help me with. (1) According to the documentation at http://www.openldap.org/doc/admin24/sasl.html#GSSAPI then the authentication DN should be uid=<primary[/instance]>,cn=<realm>,cn=gssapi,cn=auth However, running slapd in debug mode I see the cn=<realm> is missing. Here I have a ticket for inst/admin(a)WS.NSRC.ORG and run slapd -d 255: ... do_bind: dn () SASL mech GSSAPI ==> sasl_bind: dn="" mech=<continuing> datalen=32 SASL Canonicalize [conn=1000]: authcid="inst/admin" slap_sasl_getdn: conn 1000 id=inst/admin [len=10] => ldap_dn2bv(16) <= ldap_dn2bv(uid=inst/admin,cn=GSSAPI,cn=auth)=0 slap_sasl_getdn: u:id converted to uid=inst/admin,cn=GSSAPI,cn=auth >>> dnNormalize: <uid=inst/admin,cn=GSSAPI,cn=auth> => ldap_bv2dn(uid=inst/admin,cn=GSSAPI,cn=auth,0) <= ldap_bv2dn(uid=inst/admin,cn=GSSAPI,cn=auth)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=inst/admin,cn=gssapi,cn=auth)=0 <<< dnNormalize: <uid=inst/admin,cn=gssapi,cn=auth> ==>slap_sasl2dn: converting SASL name uid=inst/admin,cn=gssapi,cn=auth to a DN <==slap_sasl2dn: Converted SASL name to <nothing> SASL Canonicalize [conn=1000]: slapAuthcDN="uid=inst/admin,cn=gssapi,cn=auth" SASL proxy authorize [conn=1000]: authcid="inst/admin" authzid="inst/admin" SASL Authorize [conn=1000]: proxy authorization allowed authzDN="" send_ldap_sasl: err=0 len=-1 do_bind: SASL/GSSAPI bind: dn="uid=inst/admin,cn=gssapi,cn=auth" sasl_ssf=56 ... ==> limits_get: conn=1000 op=3 self="uid=inst/admin,cn=gssapi,cn=auth" this="dc=ws,dc=nsrc,dc=org" ... Now this works, if I change my ACL to olcAccess: {0}to * by dn.regex="^uid=([^,]+)/admin,cn=gssapi,cn=auth$" manage by users read However, I wonder why the realm is missing, and whether it can be included (because in future, if I end up with a cross-realm setup, I'll want to see the realm for authorization) Is this a documentation error, or is there some configuration option which needs setting to preserve the realm? (2) I would like to be able to do ldapsearch without specifying -Y GSSAPI explicitly. However if I omit it, the client picks DIGEST-MD5 instead (which isn't much use, since I have no passwords in the database) # ldapsearch -b "ds=ws,dc=nsrc,dc=org" SASL/DIGEST-MD5 authentication started Please enter your password: Adding -d 255 I see that the server is offering these: ... ldap_sasl_interactive_bind_s: server supports: NTLM DIGEST-MD5 GSSAPI CRAM-MD5 ldap_int_sasl_bind: NTLM DIGEST-MD5 GSSAPI CRAM-MD5 ... How can I configure the server not to offer the other authentication mechanisms, or else to put GSSAPI at the front of the list? Thanks, Brian.

4 13

Re: invalid credentials (49) for normal user
by rui 30 Dec '10

30 Dec '10

Hi, After running slapd with "-d 128" i have found lot of messages like this. Can somebody point me to standard acl for users, i want to authenticate for every user using ldap browser or c ldap api with ldap_simple_bind with binddn bindn=uid=rui,ou=People,o=m1,c=GB ############################### Dec 29 14:13:53 m4mrh01 slapd: => acl_mask: access to entry "cn=rui,ou=Group,o=m1,c=GB", attr "objectClass" requested Dec 29 14:13:53 m4mrh01 slapd: => acl_mask: to value by "", (=n) Dec 29 14:13:54 m4mrh01 slapd: <= acl_mask: no more <who> clauses, returning =n (stop) Dec 29 14:13:54 m4mrh01 slapd: => access_allowed: search access denied by =n Dec 29 14:13:54 m4mrh01 slapd: => access_allowed: search access to "cn=m4musers,ou=Group,o=m1,c=GB" "memberUid" requested Dec 29 14:13:54 m4mrh01 slapd: => acl_get: [2] attr memberUid Dec 29 14:13:54 m4mrh01 slapd: => acl_mask: access to entry "cn=m4musers,ou=Group,o=m1,c=GB", attr "memberUid" requested Dec 29 14:13:54 m4mrh01 slapd: => acl_mask: to value by "", (=n) Dec 29 14:13:54 m4mrh01 slapd: <= acl_mask: no more <who> clauses, returning =n (stop) Dec 29 14:13:54 m4mrh01 slapd: => access_allowed: search access denied by =n Dec 29 14:18:04 m4mrh01 slapd: => access_allowed: auth access to "uid=rui,ou=People,o=m1,c=GB" "userPassword" requested Dec 29 14:18:04 m4mrh01 slapd: => acl_get: [1] attr userPassword Dec 29 14:18:04 m4mrh01 slapd: => acl_mask: access to entry "uid=rui,ou=People,o=m1,c=GB", attr "userPassword" requested Dec 29 14:18:04 m4mrh01 slapd: => acl_mask: to all values by "", (=n) Dec 29 14:18:04 m4mrh01 slapd: <= acl_mask: no more <who> clauses, returning =n (stop) Dec 29 14:18:04 m4mrh01 slapd: => access_allowed: auth access denied by =n ############################### I have also changed slapd.conf slightly ############################# access to attr=userPassword by self write by dn="uid=root,ou=People,o=M1,c=GB" write by * read access to * by self write by users read by anonymous auth ############################### Regards, rui > 1. invalid credentials (49) for normal user (rui) > 2. Re: invalid credentials (49) for normal user (Dieter Kluenter) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 24 Dec 2010 10:32:03 +0000 > From: rui <guideveloper(a)gmail.com> > To: openldap-technical(a)openldap.org > Subject: invalid credentials (49) for normal user > Message-ID: > <AANLkTikbS2LTj4D-0WMBdJXzMeBMpb3qO2=Y4wzPLv0G(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Hi, > > I have imported my passwd and groups file in ldap using > migrate_all_online.sh script. > > I am able to simple bind to ldap using > binddn= uid=root,ou=People,o=M1,c=GB but i can't seem to bind with any > other user like rui etc with their linux password. Its says invalid > credentials. > > I need to bind for authentication and then get all the primary and > secondary groups of a user(how can i do that). Why am i having this > problem - do i have to do something extra? > > When bound as root, if i do "memberUid=root" i get all the secondary > groups but i want to do it for any user. > > I am using c ldap api at the moment. > > > Here is my slapd.conf file: > ################################################## > # # See slapd.conf(5) for details on configuration options. > # This file should NOT be world readable. # > include /etc/openldap/schema/core.schema > include /etc/openldap/schema/cosine.schema > include /etc/openldap/schema/dyngroup.schema > include /etc/openldap/schema/inetorgperson.schema > include /etc/openldap/schema/misc.schema > include /etc/openldap/schema/nis.schema > include /etc/openldap/schema/openldap.schema > > ####################################################################### > # ldbm database definitions > ####################################################################### > database ldbm > suffix "o=M1,c=GB" > rootdn "uid=root,ou=People,o=M1,c=GB" > rootpw abc123 > directory /var/lib/ldap > > # Indices to maintain > index objectClass,uid,uidNumber,gidNumber eq > index cn,mail,surname,givenname eq,subinitial > > # # ACLs # > #access to dn="ou=People,o=M1,c=GB" > #attr=userPassword > #by self write > #by dn="uid=root,ou=People,o=M1,c=GB" write > #by * auth access to dn=".*,o=M1,c=GB" by self write > #by dn="uid=root,ou=People,o=M1,c=GB" write > #by * read access to dn=".*,o= M1,c=GB" > #by * read defaultaccess read > > access to attr=userpassword > by self write > by dn="uid=root,ou=People,o=M1,c=GB" write > by * read > > access to * > by self write > by dn=".+" read > by * read > > ############################################### > > Regards, > rui > > > ------------------------------ > > Message: 2 > Date: Sat, 25 Dec 2010 22:58:14 +0100 > From: "Dieter Kluenter" <dieter(a)dkluenter.de> > To: openldap-technical(a)openldap.org > Subject: Re: invalid credentials (49) for normal user > Message-ID: <87d3op1pmx.fsf(a)rubin.avci.de> > Content-Type: text/plain; charset=utf-8 > > rui <guideveloper(a)gmail.com> writes: > >> Hi, >> >> I have imported my passwd and groups file in ldap using >> migrate_all_online.sh script. >> >> I am able to simple bind to ldap using >> binddn= uid=root,ou=People,o=M1,c=GB but i can't seem to bind with any >> other user like rui etc with their linux password. Its says invalid >> credentials. > [...] > > run slapd in debugging mode, i.e. -d acl > > > ############ >> # ldbm database definitions >> ####################################################################### >> database ldbm > > ldbm is historic and not supported. > > -Dieter > > -- > Dieter Kl?nter | Systemberatung > http://dkluenter.de > GPG Key ID:DA147B05 > 53?37'09,95"N > 10?08'02,42"E > > > ------------------------------ > > _______________________________________________ > openldap-technical mailing list > openldap-technical(a)openldap.org > http://www.openldap.org/lists/mm/listinfo/openldap-technical > > > End of openldap-technical Digest, Vol 37, Issue 22 > ************************************************** >

3 6

Is attribute options supported?
by Angel L. Mateo 30 Dec '10

30 Dec '10

Hello, Is attribute options supported in openldap (version 2.4.21)? In RFC 2251 (LDAPv3) the attributes in search could be specified as attribute_name;options, so you could indicate options in the return of the attributes. Specifically, what I want to do is: I have attributes wich value is a URN, so I want to get just a special part of the URN, that is: Traditional search: Ldap filter: (mail=user(a)mydomain.com) Atributos: mail, schacPersonalUniqueID Result: mail: user(a)mydomain.com schacPersonalUniqueID: urn:mace:terena.org:schac:personalUniqueID:es:12345678Q Search with options: Ldap filter: (mail=user(a)mydomain.com) Atributos: mail, schacPersonalUniqueID;x-urn-7 Result: mail: user(a)mydomain.com schacPersonalUniqueID: 12345678Q I have tried this with a standard configuration, but it isn't working: amateo@joshua:~$ /usr/bin/ldapsearch ... mail=user(a)mydomain.com schacPersonalUniqueID;x-urn-7 # extended LDIF # # LDAPv3 # base <dc=Telematica> with scope subtree # filter: uid=amateo # requesting: irisClassifCode # # amateo, Usuarios, telematica dn: uid=user,ou=People,dc=mydomain,dc=com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 x-urn-1: orden no encontrada Is it supported? Do I have to configure anything in the slapd server? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

3 2

ldapsearch from server does not work but works from client
by Seau Yeen Su 30 Dec '10

30 Dec '10

Hi all, I have managed to install OpenLdap 2.4 on a RHEL 5.2 workstation. The basic openldap without TLS/SSL works fine. On the server itself and from the client I was able to do ldapsearch. However, after I created a server.pem by going through this : [url= http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch31_:_Cent… : Ch31 : Centralized Logins Using LDAP and RADIUS - Linux Home Networking[/url] ldapsearch on the ldap server itself does not work anymore. The summary of the configuration is as below: server.pem is created in /usr/local/etc/openldalp/cacerts and client.pem is in /etc/openldap/cacerts. client.pem is also moved to clients and ldapsearch works fine from client workstation. However, in the ldap server itself it does not. THe output of /etc/ldap.conf looks like below: uri ldaps://syna-ldap-02.synamatix.com/ tls_cacertdir /etc/openldap/cacerts pam_password md5 My /usr/local/etc/openldap/slapd.conf TLS portion looks like below: TLSCipherSuite HIGH:MEDIUM:+SSLv2:+SSLv3:RSA TLSCACertificateFile /usr/local/etc/openldap/cacerts/server.pem TLSCertificateFile /usr/local/etc/openldap/cacerts/server.pem TLSCertificateKeyFile /usr/local/etc/openldap/cacerts/server.pem TLSVerifyClient allow The error from ldapsearch x -H ldaps://syna-ldap-02.synamatix.com -d127 in the server itself is as below: TLS ceritficate verification: depth: 0, err: 18, subject: /C=MY/ST=KL/L=MV/O=MGRC/OU=IT/CN= syna-ldap-02.synamatix.com/emailAddress=seauyeen@mgrc.com.my, issuer: /C=MY/ST=KL/L=MV/O=MGRC/OU=IT/CN= syna-ldap-02.synamatix.com/emailAddress=seauyeen@mgrc.com.my TLS certificate verification: Error, self signed certificate tls_write: want=7, write=7 0000: 15 03 01 00 02 02 30 TLS trace: SSL3 alert write:fata:unknown CA TLS trace: SSL connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (self signed certificate). ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) On the server end, as I started with debug mode, I get errors below: TLS trace: SSL3 alert read: fatal: unknown CA TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept: erro: 14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca. connection_read(13): TLS accept failure error=-1 id=1010,closing ..... Why is that ldapsearch from client workstation works fine but not in the ldap server itself? It is osoo baffling. It is fine without TLS activated. I have been working on this for 1 week! The information online does not seem to cater to this weird incident of mine. Hope to receive some assistance really soon. If you need files and attachments, please inform me. Thanks and Happy new year guys!!!! -- ------------------------------ MGRC - Accelerating Your Journey of Discovery *Su Seau Yeen Assistant Manager IT Operations * * * *Malaysian Genomics Resource Centre Berhad (MGRC)* T: +6 03 2283 1820 | F: +6 03 2282 8102 | M: +6 012 6784642 | www.mgrc.com.my ------------------------------ This e-mail is intended only for the use of the individual or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is strictly prohibited. If you receive this e-mail in error, please contact us immediately by return e-mail and delete the original message(s).

1 0

one system won't authenticate
by Christ Schlacta 28 Dec '10

28 Dec '10

I've got two systems authenticating against an openldap directory, and one that refuses. I'm attempting to debug why this system won't authenticate, but there's nothing useful in auth.log, and I can't decipher the voluminous output that -d 255 provides. Iv'e checkeced all my configs and my passwords repeatedly. can anyone suggest a next step from here? PS: the system that won't auth is also the system hosting the ldap directory. TIA!!

1 0

ldap server failover on Kerberos servers?
by Kevin Longfellow 28 Dec '10

28 Dec '10

Hi, Using LDAP as the back end for Kerberos principals and openldap 2.3.43 as the client on the Kerberos servers, I see it's possible to add some failover with ldap_servers in /etc/krb5.conf and URI in /etc/openldap/ldap.conf. For example: /etc/krb5.conf: ldap_servers = ldaps://hostname1:636 ldaps://hostname2:636 /etc/openldap/ldap.conf: URI ldaps://hostname1:636 ldaps://hostname2:636 In our situation, the ldap servers are behind a BigIP so only a single hostname can be entered. I'm curious if it makes any sense to add the BigIP hostname twice? Once the initial connection is made by the Kerberos server to the first ldap server are there any failure scenarios that the below would make any sense? /etc/krb5.conf: ldap_servers = ldaps://<bigip hostname>:636 ldaps://<bigip hostname>:636 /etc/openldap/ldap.conf: URI ldaps://<bigip hostname>:636 ldaps://<bigip hostname>:636 Hopefully it makes sense what I'm asking and thanks for your time. Regards, Kevin

2 1

Problem with ACL in 2.4.22
by Nick Milas 28 Dec '10

28 Dec '10

Hi, I have upgraded from 2.3.43 to 2.4.22 on CentOS 5.5. Everything works fine, except my ACLs don't work on the new version. Strange results occur. Has anything changed significantly in v2.4 ACLs in comparison to v2.3 ACLs? For example, the following piece of code works as expected in v2.3 but not in v2.4. If some user logs in and is a member of a GroupXAdmins (where X = 1-6), he can't see the branch at all. # Allow access to entries of the subtree # access to dn.sub="dc=12.11.10.in-addr.arpa,ou=dns1,dc=example,dc=com" attrs="children,entry" by group.exact="cn=Group1Admins,ou=Groups,dc=example,dc=com" write by group.exact="cn=Group2Admins,ou=Groups,dc=example,dc=com" read by group.exact="cn=Group3Admins,ou=Groups,dc=example,dc=com" read by group.exact="cn=Group4Admins,ou=Groups,dc=example,dc=com" write by group.exact="cn=Group5Admins,ou=Groups,dc=example,dc=com" read by group.exact="cn=Group6Admins,ou=Groups,dc=example,dc=com" read by dn.exact="uid=dnsauthusr,ou=System,dc=example,dc=gr" read by * break # Allow access to all attributes of the subtree # access to dn.sub="dc=12.11.10.in-addr.arpa,ou=dns1,dc=example,dc=com" by group.exact="cn=Group1Admins,ou=Groups,dc=example,dc=com" write by group.exact="cn=Group2Admins,ou=Groups,dc=example,dc=com" read by group.exact="cn=Group3Admins,ou=Groups,dc=example,dc=com" read by group.exact="cn=Group4Admins,ou=Groups,dc=example,dc=com" write by group.exact="cn=Group5Admins,ou=Groups,dc=example,dc=com" read by group.exact="cn=Group6Admins,ou=Groups,dc=example,dc=com" read by dn.exact="uid=dnsauthusr,ou=System,dc=example,dc=com" read where Groups are of the form: dn: cn=Group1Admins,ou=Groups,dc=example,dc=com objectClass: groupOfNames cn: Group1Admins member: uid=userx,ou=people,dc=example,dc=com Please, help. Nick

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical