openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

LDAPCon 2011?
by xsun 10 Nov '10

10 Nov '10

Hi there, There is something planned to 2011 about an LDAP Conference? I couldn't attend at 2009 and I think is too late for the conference on this year. Thanks, Matheus Morais

2 2

pamL-dap configuration guide
by Tim Dunphy 10 Nov '10

10 Nov '10

Hey List, I was just wondering if anyone happened to know of a good guide to use for configuring centos clients to authenticate pam modules (such as su, sudoers, ssh, system authentication and the like) against openLDAP? I am running a FreeBSD openLDAP server, but I believe that shouldn't affect the clients ability to log in via pam/ldap. At the moment I am googling this to not much avail! Thanks! -- Here's my RSA Public key: gpg --keyserver pgp.mit.edu --recv-keys 5A4873A9 Share and enjoy!!

3 3

tls
by Christian Bösch 10 Nov '10

10 Nov '10

Hi Can someone tell me if it's possible to require strong encryption like TLS except from one IP address? /chris

3 5

uniqueMember attribute is not suffixmassaged if attribute is not mapped and changed
by Arvo Jari-Pekka 09 Nov '10

09 Nov '10

Hi. My configuration is like this: --------- database meta suffix "ou=a,dc=c,dc=b" uri "ldap://host:port/ou=a,dc=c,dc=b" suffixmassage "ou=a,dc=c,dc=b" "dc=a,dc=b" ... --------- This works fine in everything else but the uniqueMembers of groupOfUniqueNames gets not rewritten (they are still in dc=a,dc=b domain). If I however add a mapping --------- map objectClass groupOfNames groupOfUniqueNames map attribute member uniqueMember --------- then the "member" attributes are correctly rewritten. The problem of course is that I do not want to change the objectclass. Mapping the attribute to itself does not help either. So --------- map objectClass groupOfUniqueNames * map attribute uniqueMember * --------- does not have any effect. I must have missed something crucial on the documentation. Can someone please tell me what it is and how can I get uniqueMembers rewritten without changing the objectclass. OpenLDAP version is 2.4.11 for both the real and the meta server. BR, Jari-Pekka Arvo

3 2

Is ldap_bind() mandatory before each ldap_search() call?
by Shankar Anand R 09 Nov '10

09 Nov '10

Hi all, I see that most LDAP utilities (openldap included) do a ldap_bind() before every ldap_search(). Is this mandatory? If LDAP descriptor (ld) is valid and can be used for multiple ldap_search() calls, when does it become invalid? Is it time based, say ld becomes invalid after 10 minutes? I have an application which needs to search the LDAP server for some specific attributes of users. The user name is taken as input from the command line. Is it necessary to do a ldap_bind() before each ldap_search() call? Doesn't this make it costly? Can I do ldap_bind() once and call ldap_search() many times? When does my "bind" become invalid? Can my application do this: #1 - bind to a LDAP server during initialization #2- then do an ldap_search() whenever required #3- then invalidate the ld after 10 minutes #4- do a ldap_bind() again and repeat from #2? Can someone kindly clarify? Thanks, Shankar

3 7

pam services under LDAP
by bluethundr 09 Nov '10

09 Nov '10

Hello List I am attempting to setup various pam modules to consult our new LDAP services in order to do what it needs to do. My LDAP server is FreeBSD but the clients are CentOS... I have setup my /etc/pam.d sudo file on the client (for example) this way in the attempt to accomplish this via LDAP: [root@VIRCENT03:~]#cat /etc/pam.d/sudo #%PAM-1.0 auth include system-auth auth required pam_ldap.so account include system-auth account required pam_ldap.so password include system-auth password required pam_ldap.so session optional pam_keyinit.so revoke session required pam_limits.so session required pam_ldap.so but even tho the user is part of the %wheel group under LDAP it is unable to sudo to any other account (including root). If I try to sudo this is what happens: [bluethundr@VIRCENT03:~]#sudo bash [sudo] password for bluethundr: bluethundr is not in the sudoers file. This incident will be reported. It would appear that sudo support for ldap is compiled in: [root@VIRCENT03:~]#ldd $(which sudo)| grep -i ldap libldap-2.3.so.0 => /usr/lib/libldap-2.3.so.0 (0x00552000) This is how I setup my ldap.conf file [root@VIRCENT03:~]#cat /etc/openldap/ldap.conf # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example, dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never URI ldap://ldap.acadaca.net/ BASE dc=acadaca,dc=net TLS_CACERTDIR /etc/openldap/cacerts sudoers_base ou=sudoers,ou=Services,dc=acadaca,dc=net In my openldap logs on the LDAP server there appears to be no activity when I sudo. however in the secure logs on the client I do.. Nov 8 16:05:34 VIRCENT03 su: pam_unix(su-l:session): session opened for user root by bluethundr(uid=500) Nov 8 16:05:37 VIRCENT03 su: pam_unix(su-l:session): session opened for user bluethundr by bluethundr(uid=0) Nov 8 16:05:44 VIRCENT03 sudo: bluethundr : user NOT in sudoers ; TTY=pts/5 ; PWD=/home/bluethundr ; USER=root ; COMMAND=/bin/bash Conversely when I sudo via LDAP on my FreeBSD ldap server this is what I see... Nov 8 19:44:25 LBSD2 sudo: bluethundr : TTY=pts/11 ; PWD=/usr/home/bluethundr ; USER=root ; COMMAND=/bin/bash Nov 8 19:44:51 LBSD2 sudo: bluethundr : TTY=pts/10 ; PWD=/usr/home/bluethundr ; USER=root ; COMMAND=/bin/bash Works there! I do see other events in secure.log that appear to be pam successes however. am i interpreting this correctly that at least part of the system is communicating with pam on the ldap server? thanks -- Here's my RSA Public key: gpg --keyserver pgp.mit.edu --recv-keys 5A4873A9 Share and enjoy!!

6 7

Openladp is very very slow with log activated
by Couturier Jean-Louis 09 Nov '10

09 Nov '10

2 2

Re: unable to perform authenticated binds
by Tim Dunphy 08 Nov '10

08 Nov '10

Hey List, I found the cause of the failure to import ldif entries with references to the suDoers object class: include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/misc.schema inlcude /etc/openldap/schema/sudoers.schema include /etc/openldap/schema/openldap.schema If you look closely there is a type-o for the /etc/openldap/sudoers.schema include directive. It's spelled 'inlcude'. Sorry about that and sorry for all the grief! Fixing that and restarting ldap I was able to import the ldifs I wanted. Thanks again for your help!

1 0

reordering email aliases ?
by Frank Bonnet 08 Nov '10

08 Nov '10

Hello I'm facing a cosmetic problem with email aliases. Some users has aliases for their email adresses some has not. For example a professor named Jean Dupont has two valid email adresses : dupontj(a)domain.tld ( which is unixlogin(a)domain.tld ) j.dupont(a)domain.tld ( which is the alias that point to duponj(a)domain.tld ) Students have only one email adress of the form : unixlogin(a)domain.tld In many applications we use LDAP to fetch the user's email address and other data. The problem is sometime we get unixlogin(a)domain.tld and sometime we get emailalias(a)domain.tld I would like to do the following : if a user has an alias of the form emailalias(a)domain.tld then display it first Is it possible to reorder my LDAP database to do so ? Thanks a lot !

3 4

Abou 'make test'
by su heng 07 Nov '10

07 Nov '10

Hi All, I encountered an error when I was installing openLDAP. I mean 'make test' It gave me a message at the end of the output message: ... ... No race errors found after 10 iterations Found 2 errors >>>>>> Exiting with a false success status for now >>>>> ./scripts/test058-syncrepl-asymmetric completed OK for hdb. make[2]: Leaving directory `/home/suheng/Downloads/openldap-2.4.23/tests' make[1]: Leaving directory `/home/suheng/Downloads/openldap-2.4.23/tests' He said I had 2 errors encountered, however, I couldn't locate where the error is. Although I can install it, I worried about if it works fine. So, How can I locate the error location when I do 'make test'? Thanks & Best Regards, Su Heng

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical