openldap-technical

openldap-technical@openldap.org

1 participants
9989 discussions

RE: MemberOf attribute not being returned
by Mark Cairney 27 Jan '11

27 Jan '11

Nevermind, I think I know what's happening. My user account was updated on our current live server running OpenLDAP 2.3 which doesn't have the MemberOf overlay. When this change was applied using syncrepl the memberOf field must have been removed. I'll take the old server out of the syncrepl but in the meantime is there any way to ensure this field is preserved when provisioning accounts in LDAP? Kind regards, Mark /********************************* Mark Cairney ITI UNIX Section Information Services University of Edinburgh Tel: 0131 650 6565 Email: mark.cairney(a)ed.ac.uk *********************************/ -- The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

1 0

openldap memberof attribute
by Vincent Li 27 Jan '11

27 Jan '11

Hi, I am doing remote authentication using OpenLDAP to login BIGIP, BIGIP has a feature called remoterole to search attribute 'memberof' from LDAP server and once found the attribute, assign the remote user a role defined in various groups like admin, operator... the feature works for Active Directory, but I am unable to make it work for OpenLDAP, I couldn't find 'memberof' attribute in OpenLDAP schema, so I created the 'memberof' attribute in core.schema as below: [root@centos-vli schema]# diff -u core.schema core.schema.orig --- core.schema 2011-01-24 23:54:42.000000000 -0800 +++ core.schema.orig 2011-01-24 23:46:11.000000000 -0800 @@ -345,10 +345,6 @@ DESC 'X.520(4th): pseudonym for the object' SUP name ) -attributetype ( 2.5.4.66 NAME 'memberof' - DESC 'RFC2256: member of a group' - SUP distinguishedName ) - # Standard object classes from RFC2256 # system schema @@ -425,7 +421,7 @@ objectclass ( 2.5.6.9 NAME 'groupOfNames' DESC 'RFC2256: a group of names (DNs)' SUP top STRUCTURAL - MUST ( member $ memberof $ cn ) + MUST ( member $ cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description ) ) objectclass ( 2.5.6.10 NAME 'residentialPerson' and here is my sample ldif file: dn: ou=groups,dc=example,dc=com objectclass:organizationalunit ou: groups description: generic groups branch # create the itpeople entry under groups dn: cn=administrator,ou=groups,dc=example,dc=com objectclass: groupofnames cn: administrator description: bigip admin group member: uid=user5,ou=people,dc=example,dc=com dn: uid=user5,ou=People,dc=example,dc=com uid: user5 cn: user5 objectClass: top objectClass: posixaccount objectClass: shadowaccount objectClass: groupOfNames userPassword: secret shadowLastChange: 14997 shadowMin: 0 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 505 gidNumber: 505 homeDirectory: /home/user5 member: cn=administrator,ou=groups,dc=example,dc=com memberof: cn=administrator,ou=groups,dc=example,dc=com I can login BIGIP fine with user5, but I can't get the administrator role defined in BIGIP, is it something I configured wrong in OpenLDAP or the problem is on BIGIP Thanks Vincent

2 1

constraint overlay question
by jarek 27 Jan '11

27 Jan '11

Hello! I'd like to configure constraint for email attribute, where email is constructed from DN in the following way: DN: uid=user, ou=emails, ou=domain.name, ou=domaingroup, ROOT_DN => email: user(a)dmain.name Is it possible ? best regards JT.

1 0

slapd logging in chroot() environment
by Peter Palmreuther 26 Jan '11

26 Jan '11

Hello, I'm running OpenLDAP 2.4.20 in a chroot()-ed environment on Solaris 10. I somehow don't get logging working. I don't see any logging making it's way through syslog. Nor do I get messages to an explicitly configured "logfile". "loglevel" is set to "stat". As soon as I start slapd using "-d ..." I see the messages in the "logfile" configured. Using "truss" I see unsuccessful tries to open "/var/run/syslog_door" until I mount -F lofs /var/run /var/openldap/var/run (with "/var/openldap" being my chroot-directory). Unluckily still no syslog logging. using "pfiles <PID>" I see slapd has got a file handle to "logfile" open. But there's not "write" to this handle in truss output either. Anybody with any idea about if and how chroot-slapd and syslog (or logfile) works? Thanks in advance. -- Best regards, Peter

3 4

deleting schema elements from cn=config
by Tim Gustafson 26 Jan '11

26 Jan '11

Hi, I'm trying to understand how to delete a schema element. I'm running slapd 2.4.23 on FreeBSD 8.1. When I try to run ldapdelete: ldapdelete -H ldap://localhost -D uid=tjg,cn=config -W -x 'cn={7}java,cn=schema,cn=config' I get the following in the log file: ---------- daemon: read activity on 18 daemon: select: listen=6 active_threads=0 tvp=zero connection_get(18) connection_get(18): got connid=1068 connection_read(18): checking for input on id=1068 op tag 0x4a, time 1296090324 conn=1068 op=1 do_delete >>> dnPrettyNormal: <cn={7}java,cn=schema,cn=config> daemon: activity on 1 descriptor <<< dnPrettyNormal: <cn={7}java,cn=schema,cn=config>, <cn={7}java,cn=schema,cn=config> conn=1068 op=1 DEL dn="cn={7}java,cn=schema,cn=config" send_ldap_result: conn=1068 op=1 p=3 send_ldap_result: err=53 matched="" text="" send_ldap_response: msgid=2 tag=107 err=53 daemon: waked daemon: select: listen=6 active_threads=0 tvp=zero conn=1068 op=1 RESULT tag=107 err=53 text= daemon: activity on 1 descriptor daemon: activity on: 18r ---------- cn={7}java,cn=schema,cn=config is empty; I've already deleted all the objectClass and attribute definitions from it, but now it seems I can't delete the schema entry itself. What am I doing wrong? Tim Gustafson Baskin School of Engineering UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

1 0

problem with limits configuration
by Dan Pritts 26 Jan '11

26 Jan '11

Hi all, I'm having trouble with the limits configuration in slapd.conf. I've searched the mailing list, read and re-read man pages, but I just cannot make it work properly. i've got openldap 2.4.23 built from source on RHEL5, 64-bit I'm trying to set "unlimited" size for for my syncrepl user. however, it is not directly related to syncrepl, I've tried with ldapsearch too, similar results. Here is the ldapsearch command i'm trying: ldapsearch -z 19 -x -w PASSWORDHERE -D cn=ldap_repl,ou=srvaccts,dc=internet2,dc=edu -H ldaps://ldap3.internet2.edu/ -b dc=internet2,dc=edu '(cn=*)' With this, query is limited to 19 entries as expected but when i omit the -z option, or tell it anything above 500, and i get, of course, 500 entries. Here is the limits statement from my slapd.conf: limits dn.exact="cn=ldap_repl,ou=srvaccts,dc=internet2,dc=edu" size=unlimited time=unlimited I also tried these: limits dn.exact="cn=ldap_repl,ou=srvaccts,dc=internet2,dc=edu" size=999999999 limits dn.exact="cn=ldap_repl,ou=srvaccts,dc=internet2,dc=edu" size=10000 If I instead use sizelimit size=unlimited my ldapsearch command of course gives me full results. Please help, I am clearly a knuckle-dragger. thanks, danno Dan Pritts, Sr. Systems Engineer Internet2 office: +1-734-352-4953 | mobile: +1-734-834-7224

2 2

OpenLDAP server as a proxy to AD and local auth db
by L.B. 25 Jan '11

25 Jan '11

Hi all - Thanks in advance. I know this topic has been discussed at length but I'm fairly new to it and haven't been able to find enough information to get my implementation working. I've been piecing together bits and pieces of what seems like the correct parameters, but I've had no luck... and now that I've resorted to guessing, I'd like to ask for help. So here's what I'm trying to achieve: One OpenLDAP server that will A) proxy for a backend AD server and B) maintain a local database for users that are not in AD. The AD system will be used for internal/corp users while the local db will be used for external/3rd party people. The AD system has _some_ of the unix schema attributes, but not all so I will be doing some rewriting on the openldap server. The linux workstations will use the single openldap server and will only be used by internal users and we also have some websites that are for internal/external users. For the time being, I'm just working on part A - proxy requests for these linux workstations to the backend AD server and get the proper mapping figured out. My present problem is that my openldap server is connecting anonymously to the AD server and that's no good because that's not allowed. I have a AD service account defined for the openldap server connections, and have configured the correct values for the 'idassert-bind' directive (see below). Performing a manual ldapsearch works fine when I define the same parameters on the command line, but slapd isn't using the correct parameters it seems. Below are the config files, etc for each component... I hope this helps. ./ldapsearch -vvv -H ldap://corp-ad.mascorp.com -b "dc=mascorp,dc=com" -s sub -D "cn=agis-ldap,ou=service accounts,ou=administrators,dc=mascorp,dc=com" -W I've compiled and installed bdb v4.8 and openldap v2.4.23 from source. Here's how I configured openldap: LD_LIBRARY_PATH="/usr/lib:/usr/local/lib:/cluster/centauth/BerkeleyDB.4.8/lib:/usr/local/ssl/lib" CPPFLAGS="-I/cluster/centauth/BerkeleyDB.4.8/include" LDFLAGS="-L/cluster/centauth/BerkeleyDB.4.8/lib" ./configure --prefix=/cluster/centauth/openldap2.4 --enable-shared --enable-crypt=yes --enable-rewrite=yes --enable-bdb=yes --enable-hdb=yes --enable-ldap=mod --enable-meta=mod --enable-monitor=yes --enable-relay=mod --enable-overlays=yes --with-cyrus-sasl --with-threads=posix --with-tls=openssl This is the client configuration on the linux workstation: # /etc/ldap.conf base dc=mascorp,dc=com scope sub timelimit 120 bind_timelimit 120 idle_timelimit 3600 uri ldap://sso.mascorp.com ssl no pam_password ad #eof This is the server config on the openldap server: # /cluster/centauth/etc/slapd.conf include /usr/share/openldap2.4/schema/core.schema include /usr/share/openldap2.4/schema/cosine.schema include /usr/share/openldap2.4/schema/inetorgperson.schema include /usr/share/openldap2.4/schema/nis.schema include /usr/share/openldap2.4/schema/misc.schema include /usr/share/openldap2.4/schema/corba.schema include /usr/share/openldap2.4/schema/openldap.schema include /usr/share/openldap2.4/schema/ppolicy.schema include /usr/share/openldap2.4/schema/ldapns.schema include /cluster/centauth/etc/schema/microsoft.minimal.schema pidfile /cluster/centauth/var/run/slapd.pid argsfile /cluster/centauth/var/run/slapd.args loglevel -1 monitoring on defaultsearchbase "dc=mascorp,dc=com" database ldap suffix "dc=mascorp,dc=com" uri "ldap://corp-ad.mascorp.com" acl-bind bindmethod=simple binddn="cn=agis-ldap,ou=service accounts,ou=administrators,dc=mascorp,dc=com" credentials="mofosecret" idassert-bind bindmethod=simple binddn="cn=agis-ldap,ou=service accounts,ou=administrators,dc=mascorp,dc=com" credentials="mofosecret" overlay rwm rwm-map attribute uid sAMAccountName rwm-map attribute homeDirectory unixHomeDirectory rwm-map attribute cn cn rwm-map attribute displayName displayName rwm-map attribute givenName givenName rwm-map attribute sn sn rwm-map attribute mail mail rwm-map attribute userPassword objectGUID rwm-map attribute * rwm-map objectclass posixAccount organizationalPerson rwm-map objectclass inetOrgPerson user access to dn.subtree="dc=mascorp,dc=com" by * read #eof # Pertinent logs from ldap2.4.log Jan 20 00:13:57 sso slapd[30527]: do_bind: v3 anonymous bind Jan 20 00:13:57 sso slapd[30527]: ==> limits_get: conn=1000 op=1 self="[anonymous]" this="dc=mascorp,dc=com" Jan 20 00:13:57 sso slapd[30527]: send_ldap_result: err=1 matched="" text="00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece" Thanks! Rafa

2 1

slapd : segmentation violation with Mingw/MSYS
by Jean-François Berne 25 Jan '11

25 Jan '11

Hello * I need help from experienced users concerning openLDAP under Mingw : I get a SIGSEGV upon slapd invocation. Please take a look at what I did and tell what I do wrong. Perhaps someone already had this problem. The SIGSEGV is at the end. ----- SETUP and build openLDAP ----- 0. GCC 4.5.2, GNU Make 3.81, Mingw/MSYS on WinXP Home/SP3 1. openLDAP config is small: with TLS, no Cyrus-SASL, no Berkeley DB, none overlay. $ configure \ --disable-bdb --disable-hdb \ --disable-overlays \ --with-tls \ --prefix=/mingw/openldap-2.4.23 --build=i686-pc-mingw32 $ make > make_all.log 2>&1 $ make install > make_install.log 2>&1 Nothing fancy here. 2. For the sake of completion, here are the warnings of 'make all' - tls_o.c:666:4: warning: assignment discards qualifiers from pointer target type - threads.c:110:2: warning: '_sleep' is deprecated (declared at c:\mingw\bin\../lib/gcc/mingw32/4.5.2/../../../../include/stdlib.h:408) - In file included from passwd.c:85:0: ../../include/ldap_pvt.h:355:30: attention : 'struct timeval' declared inside parameter list ../../include/ldap_pvt.h:355:30: attention : visible uniquement depuis cette définition ou déclaration, ce qui n'est probablement pas ce que vous désirez Let me know if you detect something here. 3. for the time being I config'd slapd like this: .../etc/slapd.conf include C:\\MinGW\\openldap-2.4.23\\etc\\openldap/schema/core.schema pidfile C:\\MinGW\\openldap-2.4.23\\var/run/slapd.pid argsfile C:\\MinGW\\openldap-2.4.23\\var/run/slapd.args database "ldif" suffix "dc=(deleted),dc=org" rootdn "cn=Manager,dc=(deleted),dc=org" rootpw secret directory C:\\MinGW\\openldap-2.4.23\\var/openldap-data/ldif --- RUN --- 0. PATH = /mingw/openldap-2.4.23/libexec:/mingw/openldap-2.4.23/bin:.:/usr/local/bin:/mingw/bin:/bin:/c/WINDOWS/system32:/c/WINDOWS:/c/WINDOWS/System32/Wbem:/c/Programme/OpenSSH/bin:/c/Programme/GnuTLS-2.10.1/bin 1. gdb slapd 2. result: you can spot SIGSEGV right at the beginning. GNU gdb (GDB) 7.2 [...] This GDB was configured as "mingw32". [...] Reading symbols from C:\MinGW\openldap-2.4.23\libexec/slapd.exe...(no debugging symbols found)...done. (gdb) start Function "main" not defined. Make breakpoint pending on future shared library load? (y or [n]) n Starting program: C:\MinGW\openldap-2.4.23\libexec/slapd.exe [New Thread 3572.0xbbc] Program received signal SIGSEGV, Segmentation fault. 0x6086ec49 in msys-1!getuid () from C:\MinGW\msys\1.0\bin\msys-1.0.dll (gdb) quit Fazit : I am not experienced enough to know where to start looking. Any help will be appreciated. Thank you, JF

2 1

Starttls and SSL
by ldap＠mm.st 24 Jan '11

24 Jan '11

I am in the process of moving our older existing openldap server infrastructure that we use to authenticate multiple users to our Linux infrastructure to use RH5 openldap 2.3 server. The current ldap servers support starttls and listen on 389 and 636. We want to continue with this setup. While sniffing traffic using tcpdump and using various ldapsearch options I noticed that if the client doesn't request starttls or connect on 636 is is possible to grab a users ldap record and the transmission is in clear text. If I authenticate to the server using the -W option to ldapsearch the record is sent with the SSHA encrypted password. Also in the in the tcpdump stream my password I use to authenticate to the server is sent in clear text. I guess this behavior is expected since the server is listening on 389 and it is up to the client to initialize the starttls session, but I was wondering if there was a way to force the server to only use starttls on 398 and not rely on the the client to set up starttls? One option would be to only have the server start on 636 and not have it listen on 389, but we would like to keep the same functionality if possible. Am I missing something obvious? The only option that I see as a possiblity is the TLSVerifyClient { never | allow | try | demand } in slapd.conf. But, it's unclear to me if this will provide the desired effect.

2 1

how to compile openldap with database ldbm module?
by Olivier PAVILLA 24 Jan '11

24 Jan '11

Hi everyone. I'm on Debian Lenny 64bit. So I want to LDAP with database ldbm. But it appears there is no way on debian. I got openldap 2.4.23. I did ./configure --help It gave me this SLAPD Backend Options: --enable-backends enable all available backends no|yes|mod --enable-bdb enable Berkeley DB backend no|yes|mod [yes] --enable-dnssrv enable dnssrv backend no|yes|mod [no] --enable-hdb enable Hierarchical DB backend no|yes|mod There is no ldbm module anymore or what? -- Olivier Pavilla << 仕事を探しています。求職中です。>> S.C.I.R.C. Orléans (Bourgogne) - I.U.F.M. Centre-Val de Loire 72 Rue du Faubourg Bourgogne -45044 ORLEANS Cedex 1 Tel : 02-38-49-26-20 , mailto:olivier.pavilla@univ-orleans.fr http://blog.linux-squad.com - 僕の傑作です。 "Acheté un Iphone c'est cautionné l'esclavage humain..."

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical