openldap-technical

openldap-technical@openldap.org

11 participants
9876 discussions

PAM Filtering Not working with CRYPT Passwds
by Anton Chu 15 Dec '10

15 Dec '10

I have installed the ldapns.schema in my ubuntu 10.04 ldap server to enable host based authentication/filtering. I have some ubuntu 10.10 ldap clients that requires filtering. All my ldap users have passwords in crypt format that I have converted to an ldif file using the PADL migration.pl scripts. After importing them into my ldap server, the pam filtering wasn't working; however, when I changed the passwords from crypt to clear or md5 or sha1, filtering worked fine. The question is how can I get filtering to work with {CRYPT} password hashing? cat /etc/ldap.conf | grep -v ^# | grep -v ^$ > base dc=web,dc=net > uri ldap://10.112.18.2 > ldap_version 3 > rootbinddn cn=admin,dc=web,dc=net > bind_policy soft > pam_filter |(host=webdev120)(host=\*) > nss_initgroups_ignoreusers > backup,bin,daemon,games,gnats,irc,libuuid,list,lp,mail,man,news,proxy,root,sshd,sync,sys,syslog,uucp,www-data > > cat common-auth | grep -v ^# | grep -v ^$ > auth [success=2 default=ignore] pam_unix.so nullok_secure > auth [success=1 default=ignore] pam_ldap.so use_first_pass > auth requisite pam_deny.so > auth required pam_permit.so > cat common-account | grep -v ^# | grep -v ^$ > account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so > account [success=1 default=ignore] pam_ldap.so > account requisite pam_deny.so > account required pam_permit.so > cat common-password | grep -v ^# | grep -v ^$ > password [success=2 default=ignore] pam_unix.so obscure sha512 > password [success=1 user_unknown=ignore default=die] pam_ldap.so > use_authtok try_first_pass > password requisite pam_deny.so > password required pam_permit.so >

1 0

How Indexes work?
by Steeg Carson 15 Dec '10

15 Dec '10

Hello, I try to understand, how the LDAP-Indexes work. If I configure a Index for a Attribute like: index myAttribute eq the index file myAttribute.bdb is build in the data directory. When I search then ldapsearch -x -h localhost -D".." -b"<baseDN>" "(myAttribute=<searched key>)" how will the LDAP-Server process this request? Is there anywhere a good documentation? My assumption is: * At first, a the Index is looked up. The result are only the matched IDs. * The LDAP-Server now can quick give back all entires form id2enty.bdb If I use Indexes, are all other entires are examined too after give back the result from indexes? I have a database, and my search is like shown above. The search takes long. The cache is configured, the size is enough (approx. dn2id.bdb + id2entry.bdb). But what I see, is that the write IO from LDAP is enormously (seen with iotop). During the whole search, the write IO is higher than the read IO. Why? Thanks for help. Steeg

1 0

Debugging syncrepl
by Angel L. Mateo 15 Dec '10

15 Dec '10

Hello, I've configured 2 ldap servers (2.4.21, from ubuntu 10.04 package) in a master-master configuration. The configuration I have is: {0}rid=004 provider=ldap://ldap1.mydomain.com binddn="<replicauser>" bindmethod=simple credentials=<replicapass> searchbase="<dc=mydomain>" type=refreshOnly interval=00:00:00:10 retry="5 5 300 +" timeout=1 {1}rid=005 provider=ldap://ldap2.mydomain.com binddn="<relicauser>" bindmethod=simple credentials=<replicapass> searchbase="<dc=mydomain>" type=refreshOnly interval=00:00:00:10 retry="5 5 300 +" timeout=1 I have an oclAccess like: {3}to dn.subtree=<dc=mydomain> by group.exact=<admingroup> manage ... by * none break Replica user belongs to group <admingroup>, so it has complete access to the directory. I have also a limit like: {1}group=<admingroup> time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited so it has no limits. The problem is that I'm loading the directory with a lot of entries (about 109000). After all the load process (I've done it in ldap2, with ldapadd commands) I have all the entries in ldap2, but I have a few less in ldap1 (about 107000). How could I debug the problem? I have tried later to remove from ldap2 an entry that it isn't at ldap1, and then add it again and the replication is done, so I don't know why it hasn't been replicated the first time. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

1 0

Syncrepl attrs selection
by Raphael Ordinas 15 Dec '10

15 Dec '10

Hi everyone, I'm facing a minor problem with syncrepl. I'd like to tell syncrepl to sync all attributs but the one specified. Is this possible ? Thanks Raphael

2 2

Using dynlist overlay like dynlist and dyngroup (extend dyngroup schema?)
by c0re 15 Dec '10

15 Dec '10

Hello openldap users! slapd.conf: overlay dynlist dynlist-attrset groupOfUrls labeledURI member ldif: dn: cn=testgroup,ou=servers,dc=domain,dc=local objectclass: groupOfNames cn: testgroup member: cn=test,ou=users,dc=domain,dc=local dn: cn=maingroup,ou=servers,dc=domain,dc=local objectclass: groupOfNames cn: maingroup member: cn=testgroup,ou=servers,dc=domain,dc=local dn: cn=testgroup,ou=servers,dc=domain,dc=local objectClass: top objectClass: labeledURIObject objectClass: groupOfURLs cn: testgroup labeledURI: ldap:///ou=users,dc=domain,dc=local??one?(objectClass=inetOrgPerson) dn: cn=maingroup,ou=serversGroups,dc=domain,dc=local objectClass: top objectClass: labeledURIObject objectClass: groupOfURLs cn: maingroup labeledURI: ldap:///ou=servers,dc=domain,dc=local?member?one?(objectClass=groupOfUrls) With this configuration when ldapsearching for contents of "cn=testgroup,ou=servers,dc=domain,dc=local" I got "member: cn=testgroup,ou=servers,dc=domain,dc=local". Cool! It's working. Then I want to have dynlist that contains members of group of dyngroups. And here I stuck. In slapd.conf I can say that some objectClass can be dyngroup or dynlist, but not together. That's right. Then I though that I can extend dyngroup.schema and add groupOfUrls2, then add "dynlist-attrset groupOfUrls2 labeledURI" to slapd.conf and groupOfUrls2 will behave like dynlist, and groupOfUrls will still be dyngroup. That's would be very good for me! I looked in dyngroup.schema and copy groupOfUrls definition to groupOfUrls2. objectClass ( NetscapeLDAPobjectClass:33 NAME 'groupOfURLs2' SUP top STRUCTURAL MUST cn MAY ( memberURL $ businessCategory $ description $ o $ ou $ owner $ seeAlso ) ) But there was error: /usr/local/etc/openldap/schema/dyngroup.schema: line 89 objectClass: Inconsistent duplicate objectClass: "2.16.840.1.113730.3.2.33" /usr/local/etc/openldap/slapd.conf: line 11: <include> handler exited with 1! slapd destroy: freeing system resources. slapd stopped. So... I changed 33 to 34 in chema. Error gone, slapd started. I added to ldap: dn: cn=maingroup2,ou=serversGroups,dc=domain,dc=local objectClass: top objectClass: labeledURIObject objectClass: groupOfURLs2 cn: maingroup labeledURI: ldap:///ou=servers,dc=domain,dc=local?member?one?(objectClass=groupOfUrls) and my slapd.conf not looking like this: overlay dynlist dynlist-attrset groupOfUrls labeledURI member dynlist-attrset groupOfUrls2 labeledURI So groupOfUrls must be dyngroup, and groupOfUrls2 must be dynlist. And now when I ldapsearch for member attr in maingroup2 I wanted to get all members of groups that are under ou=servers,dc=domain,dc=local, but I got no members... Logic was - testgroup (and others groupOfURLs) work as dyngroup and generate member attr in it depending on specified labeledURI. Then maingroup2 (and others) will ldapsearch in ou=servers and make member: attr depending on member attr of groups in ou=servers (and some filters, that I will use later). But maingroup2 not working... It not generate member: attr in it. I think I was wrong changing 33 to 34, because I need some more thing to do, but I do not know what I should do. Can anoyone suggest what to do?

1 0

ldap personal addressbook
by Umarzuki Mochlis 14 Dec '10

14 Dec '10

i already setup squirrelmail and roundcubemail to read ldap global addressbook on RHEL 5 but how can i make both be able to: 1. store personal addressbook in openldap 2. import addressbooks from squirrelmail database into openldap so both webmail can view the same addressbook any hints and links are welcomed. -- Regards, Umarzuki Mochlis http://debmal.my

1 0

Re: backend issue
by Friedrich Locke 14 Dec '10

14 Dec '10

Hi, Here are the location of some files related to db-4.6.21 installed in my box. sioux@lion$ pkg_info -L db-4.6.21 | grep include /usr/local/include/db4/db.h /usr/local/include/db4/db_185.h /usr/local/include/db4/db_cxx.h sioux@lion$ pkg_info -L db-4.6.21 | grep lib /usr/local/lib/db4/libdb.a /usr/local/lib/db4/libdb.la /usr/local/lib/db4/libdb_cxx.a /usr/local/lib/db4/libdb_cxx.la /usr/local/share/doc/db4/ref/build_unix/shlib.html /usr/local/share/doc/db4/ref/refs/libtp_usenix.ps /usr/local/lib/db4/libdb.so.5.0 /usr/local/lib/db4/libdb_cxx.so.6.0 /usr/local/lib/libdb.so.5.0 /usr/local/lib/libdb_cxx.so.6.0 sioux@lion$ I setted CPPFLAGS as the following (and it worked when i ran ./configure): sioux@lion$ export CPPFLAGS="-I/usr/local/include/db4" But for LDFLAGS, how should i set it? On Tue, Dec 14, 2010 at 4:25 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, December 14, 2010 5:51 AM -0200 Friedrich Locke > <friedrich.locke(a)gmail.com> wrote: > >> Ok! >> >> I looked at /usr/include/db.h. How could i solve this problem ? > > Set the appropriate variables, specifically: > CPPFLAGS > and > LDFLAGS > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

backend issue
by Friedrich Locke 14 Dec '10

14 Dec '10

Hi folks, i run openbsd as my OS of choice and would like to install openldap and BDB. i am forced to use openldap 2.3.43 with Berkeley DB v3. Is there anything i should be aware about this combination? Has anyone in this list faced the same scenario ? What is your experience? best regards, Fried.

3 6

rwm overlay missing
by Josh Spranger 14 Dec '10

14 Dec '10

I have OpenLDAP 2.4.23 on OpenSUSE 11. When I compiled the binaries I used the flags -enable-ldap and -enable-rewrite so I could use it as a Proxy to AD. I also want to use the rwm overlay to remap the AD attributes. My problem is when I configure 'overlay rwm' and use slaptest it returns with "overlay 'rwm' not found" and I do not have any rwm.la files anywhere to load in the 'moduleload' section. I presume I am missing a configure flag, but for this version which one? Thanks!

2 1

OpenLDAP and third party authentication integration
by Any Joe 14 Dec '10

14 Dec '10

Dear LDAP tech gurus, Newbie here.. I need some pointers on how to integrate a third party web-based auth system and OpenLDAP. Our reqs are as follows 1. We dont store passwords (or hashes) in LDAP and they are dont-care for us; for backward compatibility we may still have some admin/admin-password credentials on LDAP). In other words, reg-users are not authenticated against LDAP, but we use LDAP for directories and corp-info repository purposes. 2. Third party app will authenticate and may access user info in LDAP depending on the applications 3. Users will be created, deleted and modified on LDAP directories, but again passwords are dont-cares What is the best way to achieve this? Any lit/pointers highly appreciated. Many thanks in anticipation -JM

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical