openldap-technical

openldap-technical@openldap.org

9897 discussions

debugging memberOf overlay
by c0re 13 Dec '10

13 Dec '10

Hello all! Trying to get memberOf overlay working. Added to slapd.conf "overlay memberof" Restarted slapd. Checked that overlay loaded # slaptest -d 1 ............. config_build_entry: "olcOverlay={1}memberof" ............. Then added 1 user and 2 groups via ldif: dn: cn=test,ou=users,dc=domain,dc=local sn: test cn: test uid: test objectClass: inetOrgPerson objectClass: top objectClass: person objectClass: posixAccount objectClass: shadowAccount objectClass: radiusprofile uidNumber: 5555 gidNumber: 5555 homeDirectory: /home/test givenName: test loginShell: /bin/sh shadowMin: 0 shadowMax: 999 shadowWarning: 7 shadowInactive: -1 shadowExpire: 0 shadowFlag: 0 dialupAccess: yes dn: cn=testgroup,ou=servers,dc=domain,dc=local objectclass: groupOfNames cn: testgroup member: cn=test,ou=users,dc=domain,dc=local dn: cn=maingroup,ou=servers,dc=domain,dc=local objectclass: groupOfNames cn: maingroup member: cn=testgroup,ou=servers,dc=domain,dc=local And made # ldapsearch -x -D "cn=admin,dc=domain,dc=local" -b "dc=domain,dc=local" -W "(cn=test)" memberOf # extended LDIF # # LDAPv3 # base <dc=domain,dc=local> with scope subtree # filter: (cn=test) # requesting: memberOf # # test, users, domain.local dn: cn=test,ou=users,dc=domain,dc=local # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 As you see - no memberOf in users attrs. I got no ideas why... By that I wanted to test output of ldapsearch to check will there be two or one memberOf attrs. Thanks!

1 2

Oddities with searching for a specific value of an attribute
by Sebastian Urbanneck 12 Dec '10

12 Dec '10

Sorry for this weird topic, but I didn't know how to name this one. These are the facts: we're using the phamm.schema from the PHAMM Project for saving virtual domain entries in our Ldap database. Searching for them is mostly no pronblem, but one specific circumstance is bothering me to death: when I try to search for a specific value of the attribute "vd", the corresponding entry is not always found. Any other attribute does the trick, but vd does'nt. For example: the search for (using the root_dn) ldapsearch -x -W -D "cn=admin,dc=uebergebuehr,dc=de" -b "ou=domains,dc=uebergebuehr,dc=de" "(vd=*) -s"one" produces following output: ---------output------------- # extended LDIF # # LDAPv3 # base <vd=lak-hessen.de,ou=domains,dc=uebergebuehr,dc=de> with scope baseObject # filter: (vd=*) # requesting: ALL # # lak-hessen.de, domains, uebergebuehr.de dn: vd=lak-hessen.de,ou=domains,dc=uebergebuehr,dc=de vd: lak-hessen.de lastChange: 1291723263 maxMail: 100 maxAlias: 100 maxQuota: 100 accountActive: TRUE editAV: TRUE delete: FALSE postfixTransport: dovecot objectClass: top objectClass: VirtualDomain description: lak-hessen.de # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 ------------------------------------- This is true for everytime I put a Wildcard (*) into the search pattern, and with scope "sub" there's also no matter in which part of the tree above this entry I am. But when I'm searching specificly for the value (lak-hessen.de) nothin is found, no matter in which entry I am and which scope use. Strangely this pattern _is_ found when you go into the entry of the domain itself (vd=lak-hessen.de,ou=domains,...) and search with scobe 'base'. Any idea what I'm doing wrong? Or is this a bug? I think ACLs are ruled out because of using the root_dn. I didn't want to file a Bug before being reallly sure that this is one regards Sebastian

2 2

slapcat, PROXIED attributeDescription inserted, and cron jobs
by btb＠bitrate.net 09 Dec '10

09 Dec '10

hi- i'm running slapcat from a daily cron job to back up cn=config and other databases. i've recently updated from 2.4.21 to 2.4.23, and notice now in the output of slapcat, messages such as >slapcat -b 'cn=config' -l 'config.ldif' > /dev/null PROXIED attributeDescription "OU" inserted. PROXIED attributeDescription "DC" inserted. a bit of searching seems to indicate that these shouldn't be cause for concern, and are just informative messages. since these messages are written to stderr, cron sends email every time it runs slapcat. if they're not errors, do they maybe belong in stdout rather than stderr? alternatively, can these messages be suppressed? according to the man page, there doesn't appear a way to do so. thanks -ben

4 4

x500UniqueIdentifier
by Juan Gonzalez 09 Dec '10

09 Dec '10

Hi, I'm trying to insert userCertificate values containing x500UniqueIdentifiers. When the value appears at the SubjectNames, it inserts correctly. By this I assume there is a validation for the field formatting. When I have a x500UniqueIdentifier at the IssuerNames it fails to insert. Is there a specific place where valid attributes and syntaxes for IssuerNames should be declared? Thanks Jgcardoso.

3 3

slapd 2.4.23 SASL/GSSAPI problem
by Matej Zagiba 09 Dec '10

09 Dec '10

Hello everybody, I'm running debian squeeze (testing) with openldap 2.4.23 and MIT kerberos 1.8.3 KDC. I had functinal SASL/GSSAPI authentication configured, but recently it stopped working. I cannot be realy sure, but I suspect upgrade from openldap 2.4.22 is the cause. In logs I see lots of this: SASL [conn=1003] Failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Configuration file does not specify default realm) I added sasl-realm option but it did not helped. All other kerberos applications works without problem. Is there any (new) SASL option I missed? Or it's a bug in 2.4.23? Thanks for any help. Matej Zagiba

2 5

Re: Drives me crazy .. openLDAP 2.4 - migrate config from 2.3
by Götz Reinicke - IT-Koordinator 09 Dec '10

09 Dec '10

Hey Victor, thanks four your long helpful answer. Yes, it is the Redhat provided openldap-servers-2.4.22-7.el6.i386, because compiling from source (on RH 5!) did not work for me :-( (s. other discussion) For me I'd like to stay with the RH Packages, as compiling is not yet part of my daily business ;-) But things may change.... Before I started to try your suggestions, I restarted my testsystem and 'just' launched slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d and adjusted the file permissions. And voila, my slapd config is build and the server starts without errors. All I did was restarting the system, no change to the config. So something had a hick-up. Regards . Götz Am 08.12.10 18:30, schrieb Gattegno, Victor (GCC - Software): > Hello Götz, > > Which OpenLDAP 2.4 version do you use? > The one of RHEL 6? > > Or the one (OpenLDAP 2.4.23) from http://www.openldap.org? > Then slapd.conf is : /usr/local/etc/openldap/slapd.conf > > I would recommend you OpenLDAP 2.4.23 from http://www.openldap.org > associated with BDB recommended-version: > http://www.openldap.org/doc/admin24/appendix-recommended-versions.html > > Check with: > locate slapd > slapd -V > >> db_open(/var/lib/ldap/id2entry.bdb) failed: No such file or directory (2). > It seems that slaptest saw that your configuration expects a LDAP database in /var/lib/ldap, which doesn't exist... I guess that you have "directory /var/lib/ldap" in your slapd.conf, then you should have a database associated... > > So, first, check your slapd.conf content. > > After that, test it through: > slaptest -f /etc/openldap/slapd.conf > > Once your slapd.conf is ok, you can convert it through: > slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d > Or (if OpenLDAP 2.4.23) through: > slaptest -f /usr/local/etc/openldap/slapd.conf -F /usr/local/etc/openldap/slapd.d > > Rgds, > Victor > > -----Original Message----- > From: openldap-technical-bounces(a)OpenLDAP.org [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Götz Reinicke - IT-Koordinator > Sent: mercredi 8 décembre 2010 16:53 > To: openldap-technical(a)openldap.org > Subject: Drives me crazy .. openLDAP 2.4 - migrate config from 2.3 > > Hey, > > I recently started to get used to Red Hat Enterprise 6 with openldap 2.4 > and the main migration point is the 'new' config style. > > I removed my test-database (I have a ldif-backup) files and the default > config from my testsystem. > > I followed the RH guide [1], but now get an error with my testsystem > while lauching this command: > > slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d > > bdb_db_open: database "dc=filmakademie,dc=de": > db_open(/var/lib/ldap/id2entry.bdb) failed: No such file or directory (2). > > backend_startup_one (type=bdb, suffix="dc=filmakademie,dc=de"): > bi_db_open failed! (2) > > > > What may I have missed? Any suggestions? Thanks a lot for pointing me > into the right direction! > > /Götz > > > [1] > http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html-single/Mi… -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzende des Aufsichtsrats: Prof. Dr. Claudia Hübner Geschäftsführer: Prof. Thomas Schadt

1 1

Host Best Authentication
by Anton Chu 08 Dec '10

08 Dec '10

Anyone have a great solution on setting up host base filtering? I've tried the ldapns.schema and then setup pam using this site: https://help.ubuntu.com/community/LDAPClientAuthentication Ddin't work. Regards

1 0

Drives me crazy .. openLDAP 2.4 - migrate config from 2.3
by Götz Reinicke - IT-Koordinator 08 Dec '10

08 Dec '10

Hey, I recently started to get used to Red Hat Enterprise 6 with openldap 2.4 and the main migration point is the 'new' config style. I removed my test-database (I have a ldif-backup) files and the default config from my testsystem. I followed the RH guide [1], but now get an error with my testsystem while lauching this command: slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d bdb_db_open: database "dc=filmakademie,dc=de": db_open(/var/lib/ldap/id2entry.bdb) failed: No such file or directory (2). backend_startup_one (type=bdb, suffix="dc=filmakademie,dc=de"): bi_db_open failed! (2) What may I have missed? Any suggestions? Thanks a lot for pointing me into the right direction! /Götz [1] http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html-single/Mi… -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzende des Aufsichtsrats: Prof. Dr. Claudia Hübner Geschäftsführer: Prof. Thomas Schadt

1 0

how to compile recent openldap on Centos 5.5
by Götz Reinicke - IT-Koordinator 06 Dec '10

06 Dec '10

Hello, I tried to compile the Release 2.4.23 of openldap on my centos 5.5 server. It fails with: checking db.h usability... yes checking db.h presence... yes checking for db.h... yes checking for Berkeley DB major version in db.h... 4 checking for Berkeley DB minor version in db.h... 3 checking if Berkeley DB version supported by BDB/HDB backends... no configure: error: BerkeleyDB version incompatible with BDB/HDB backends I do have db4 installed: db4-4.3.29-10.el5_5.2 db4-devel-4.3.29-10.el5_5.2 db4-utils-4.3.29-10.el5_5.2 What may I do wrong? Any sugesstions? Thanks and regards . Götz -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzende des Aufsichtsrats: Prof. Dr. Claudia Hübner Geschäftsführer: Prof. Thomas Schadt

8 12

Re: Want interesting restrictions to ldap auth on different servers to different users
by c0re 06 Dec '10

06 Dec '10

2010/12/6 Dan White <dwhite(a)olp.net>: > On 06/12/10 15:34 +0300, c0re wrote: >> >> 2010/12/1 Dan White <dwhite(a)olp.net>: >> Thanks for example! >> >> But it still requires to edit clients.conf when adding device. And not >> restricts by groups. > > That's true, unless you have some of your clients coming from behind > one NAT address. I'm not aware of any way around that. > >> As per http://wiki.freeradius.org/Rlm_ldap I can use >> >> groupmembership_filter = >> >> "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" >> >> If there any other variables that can be used? I mean not only >> Ldap-userDn, but something like Ldap-clientIP, or Ldap-clientHostname >> or anything else to unique identify remote device. So I can use >> dynamic groups in OpenLdap and restrict access to device by group >> membership. > > As for the client IP, or other identifying information of the > authenticating device, I've always tried to use huntgroups to identify the > device rather than trying to perform a match in the LDAP filter, but that > approach might work just fine. > > Keep in mind that different types of devices will send more or less > information in its RADIUS request. Running freeradius in '-X' mode, and > sending a sample request will show you the information that you might be > able to match on. > > -- > Dan White > Thanks for tip about -X mode, will do it if get troubles. Found very interesting message in mailists here: http://lists.freeradius.org/pipermail/freeradius-users/2010-October/msg0005… Even more interesting - storing NAS secret in ldap! And using variable Packet-Src-IP-Address to differ source devices. Will try to get it work at this week.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical