openldap-technical

openldap-technical@openldap.org

1 participants
9989 discussions

Re: Windows ldp.exe kills openldap 2.4.23
by masarati＠aero.polimi.it 02 Jan '11

02 Jan '11

>> Is this a know bug (see ITS#6570) or something new? Is there a >> workaround >> it? > > AFAIK it is not known. I am able to reproduce it (Linux, HEAD code), so I > suggest you file an ITS. With respect to a workaround, it is not clear > what's the purpose of the operation you're trying to accomplish. In > general, a modrdn on the empty DN should be meaningless (although it > should not crash the server). A fix is in HEAD (slapd/modrdn.c); please test. p.

1 0

Windows ldp.exe kills openldap 2.4.23
by Serge Dubrouski 01 Jan '11

01 Jan '11

Hello - I just found that ldp.exe tool that comes with Windows is able to successfully kill OpenLDAP 2.4.23 when one tries tp modify DN and submits an empty old DN. Log files on openldap show this: Dec 29 15:19:32 ottawa slapd[11818]: conn=1000 op=2 do_modrdn Dec 29 15:19:32 ottawa slapd[11818]: do_modrdn: dn () newrdn (C=US) newsuperior () Dec 29 15:19:32 ottawa slapd[11818]: >>> dnPrettyNormal: <> Dec 29 15:19:32 ottawa slapd[11818]: <<< dnPrettyNormal: <>, <> Dec 29 15:19:32 ottawa slapd[11818]: >>> dnPrettyNormal: <C=US> Dec 29 15:19:32 ottawa slapd[11818]: <<< dnPrettyNormal: <c=US>, <c=us> Dec 29 15:19:32 ottawa slapd[11818]: conn=1000 op=2 MODRDN dn="" Is this a know bug (see ITS#6570) or something new? Is there a workaround it? -- Serge Dubrouski.

2 1

slapd bind method codes
by Jaap Winius 01 Jan '11

01 Jan '11

Hi folks, When clients bind with a provider and the provider's loglevel is set to stats, bind events show up frequently in the log. Often, some logged bind events have only a blank dn along with a "method" code. Here are two separate examples: slapd[903]: conn=1021 op=0 BIND dn="" method=128 slapd[903]: conn=1020 op=0 BIND dn="" method=163 Two questions: 1.) What do these method codes mean? Perhaps there list somewhere that explains all possible method codes. 2.) When a method code is shown, as in the examples above, why is the value for the dn empty? Thanks, Jaap

2 1

ber_flatten() of incomplete ber
by masarati＠aero.polimi.it 31 Dec '10

31 Dec '10

I was encoding a ber of the form "{{something}" (note the missing "}") using HEAD's liblber. ber_flatten() was (correctly?) returning an empty value; perhaps it should return an error code, indicating that the ber is incomplete? Am I missing some function to test the validity of a ber? p.

2 3

How Indexes work?
by Steeg Carson 30 Dec '10

30 Dec '10

Hello, I try to understand, how the LDAP-Indexes work. If I configure a Index for a Attribute like: index myAttribute eq the index file myAttribute.bdb is build in the data directory. When I search then ldapsearch -x -h localhost -D".." -b"<baseDN>" "(myAttribute=<searched key>)" how will the LDAP-Server process this request? Is there anywhere a good documentation? My assumption is: * At first, a the Index is looked up. The result are only the matched IDs. * The LDAP-Server now can quick give back all entries form id2enty.bdb If I use Indexes, are all other entries are examined too after give back the result from indexes? I have a database, and my search is like shown above. The search takes long. The cache is configured, the size is enough (approx. dn2id.bdb + id2entry.bdb). But what I see, is that the write IO from LDAP is enormously (seen with iotop). During the whole search, the write IO is higher than the read IO. Why? Thanks for help. Steeg

3 6

Kerberos/GSSAPI issues
by Brian Candler 30 Dec '10

30 Dec '10

Hello, I'm setting up an openldap server for Kerberos (GSSAPI) authentication only. I'm using slapd-2.4.21 from Ubuntu 10.04.1. It's basically working, and I had to do very little other than change export KRB5_KTNAME in /etc/default/slapd to point to the service keytab. However, there are a couple of strange things which I wonder if someone could help me with. (1) According to the documentation at http://www.openldap.org/doc/admin24/sasl.html#GSSAPI then the authentication DN should be uid=<primary[/instance]>,cn=<realm>,cn=gssapi,cn=auth However, running slapd in debug mode I see the cn=<realm> is missing. Here I have a ticket for inst/admin(a)WS.NSRC.ORG and run slapd -d 255: ... do_bind: dn () SASL mech GSSAPI ==> sasl_bind: dn="" mech=<continuing> datalen=32 SASL Canonicalize [conn=1000]: authcid="inst/admin" slap_sasl_getdn: conn 1000 id=inst/admin [len=10] => ldap_dn2bv(16) <= ldap_dn2bv(uid=inst/admin,cn=GSSAPI,cn=auth)=0 slap_sasl_getdn: u:id converted to uid=inst/admin,cn=GSSAPI,cn=auth >>> dnNormalize: <uid=inst/admin,cn=GSSAPI,cn=auth> => ldap_bv2dn(uid=inst/admin,cn=GSSAPI,cn=auth,0) <= ldap_bv2dn(uid=inst/admin,cn=GSSAPI,cn=auth)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=inst/admin,cn=gssapi,cn=auth)=0 <<< dnNormalize: <uid=inst/admin,cn=gssapi,cn=auth> ==>slap_sasl2dn: converting SASL name uid=inst/admin,cn=gssapi,cn=auth to a DN <==slap_sasl2dn: Converted SASL name to <nothing> SASL Canonicalize [conn=1000]: slapAuthcDN="uid=inst/admin,cn=gssapi,cn=auth" SASL proxy authorize [conn=1000]: authcid="inst/admin" authzid="inst/admin" SASL Authorize [conn=1000]: proxy authorization allowed authzDN="" send_ldap_sasl: err=0 len=-1 do_bind: SASL/GSSAPI bind: dn="uid=inst/admin,cn=gssapi,cn=auth" sasl_ssf=56 ... ==> limits_get: conn=1000 op=3 self="uid=inst/admin,cn=gssapi,cn=auth" this="dc=ws,dc=nsrc,dc=org" ... Now this works, if I change my ACL to olcAccess: {0}to * by dn.regex="^uid=([^,]+)/admin,cn=gssapi,cn=auth$" manage by users read However, I wonder why the realm is missing, and whether it can be included (because in future, if I end up with a cross-realm setup, I'll want to see the realm for authorization) Is this a documentation error, or is there some configuration option which needs setting to preserve the realm? (2) I would like to be able to do ldapsearch without specifying -Y GSSAPI explicitly. However if I omit it, the client picks DIGEST-MD5 instead (which isn't much use, since I have no passwords in the database) # ldapsearch -b "ds=ws,dc=nsrc,dc=org" SASL/DIGEST-MD5 authentication started Please enter your password: Adding -d 255 I see that the server is offering these: ... ldap_sasl_interactive_bind_s: server supports: NTLM DIGEST-MD5 GSSAPI CRAM-MD5 ldap_int_sasl_bind: NTLM DIGEST-MD5 GSSAPI CRAM-MD5 ... How can I configure the server not to offer the other authentication mechanisms, or else to put GSSAPI at the front of the list? Thanks, Brian.

4 13

Re: invalid credentials (49) for normal user
by rui 30 Dec '10

30 Dec '10

Hi, After running slapd with "-d 128" i have found lot of messages like this. Can somebody point me to standard acl for users, i want to authenticate for every user using ldap browser or c ldap api with ldap_simple_bind with binddn bindn=uid=rui,ou=People,o=m1,c=GB ############################### Dec 29 14:13:53 m4mrh01 slapd: => acl_mask: access to entry "cn=rui,ou=Group,o=m1,c=GB", attr "objectClass" requested Dec 29 14:13:53 m4mrh01 slapd: => acl_mask: to value by "", (=n) Dec 29 14:13:54 m4mrh01 slapd: <= acl_mask: no more <who> clauses, returning =n (stop) Dec 29 14:13:54 m4mrh01 slapd: => access_allowed: search access denied by =n Dec 29 14:13:54 m4mrh01 slapd: => access_allowed: search access to "cn=m4musers,ou=Group,o=m1,c=GB" "memberUid" requested Dec 29 14:13:54 m4mrh01 slapd: => acl_get: [2] attr memberUid Dec 29 14:13:54 m4mrh01 slapd: => acl_mask: access to entry "cn=m4musers,ou=Group,o=m1,c=GB", attr "memberUid" requested Dec 29 14:13:54 m4mrh01 slapd: => acl_mask: to value by "", (=n) Dec 29 14:13:54 m4mrh01 slapd: <= acl_mask: no more <who> clauses, returning =n (stop) Dec 29 14:13:54 m4mrh01 slapd: => access_allowed: search access denied by =n Dec 29 14:18:04 m4mrh01 slapd: => access_allowed: auth access to "uid=rui,ou=People,o=m1,c=GB" "userPassword" requested Dec 29 14:18:04 m4mrh01 slapd: => acl_get: [1] attr userPassword Dec 29 14:18:04 m4mrh01 slapd: => acl_mask: access to entry "uid=rui,ou=People,o=m1,c=GB", attr "userPassword" requested Dec 29 14:18:04 m4mrh01 slapd: => acl_mask: to all values by "", (=n) Dec 29 14:18:04 m4mrh01 slapd: <= acl_mask: no more <who> clauses, returning =n (stop) Dec 29 14:18:04 m4mrh01 slapd: => access_allowed: auth access denied by =n ############################### I have also changed slapd.conf slightly ############################# access to attr=userPassword by self write by dn="uid=root,ou=People,o=M1,c=GB" write by * read access to * by self write by users read by anonymous auth ############################### Regards, rui > 1. invalid credentials (49) for normal user (rui) > 2. Re: invalid credentials (49) for normal user (Dieter Kluenter) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 24 Dec 2010 10:32:03 +0000 > From: rui <guideveloper(a)gmail.com> > To: openldap-technical(a)openldap.org > Subject: invalid credentials (49) for normal user > Message-ID: > <AANLkTikbS2LTj4D-0WMBdJXzMeBMpb3qO2=Y4wzPLv0G(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Hi, > > I have imported my passwd and groups file in ldap using > migrate_all_online.sh script. > > I am able to simple bind to ldap using > binddn= uid=root,ou=People,o=M1,c=GB but i can't seem to bind with any > other user like rui etc with their linux password. Its says invalid > credentials. > > I need to bind for authentication and then get all the primary and > secondary groups of a user(how can i do that). Why am i having this > problem - do i have to do something extra? > > When bound as root, if i do "memberUid=root" i get all the secondary > groups but i want to do it for any user. > > I am using c ldap api at the moment. > > > Here is my slapd.conf file: > ################################################## > # # See slapd.conf(5) for details on configuration options. > # This file should NOT be world readable. # > include /etc/openldap/schema/core.schema > include /etc/openldap/schema/cosine.schema > include /etc/openldap/schema/dyngroup.schema > include /etc/openldap/schema/inetorgperson.schema > include /etc/openldap/schema/misc.schema > include /etc/openldap/schema/nis.schema > include /etc/openldap/schema/openldap.schema > > ####################################################################### > # ldbm database definitions > ####################################################################### > database ldbm > suffix "o=M1,c=GB" > rootdn "uid=root,ou=People,o=M1,c=GB" > rootpw abc123 > directory /var/lib/ldap > > # Indices to maintain > index objectClass,uid,uidNumber,gidNumber eq > index cn,mail,surname,givenname eq,subinitial > > # # ACLs # > #access to dn="ou=People,o=M1,c=GB" > #attr=userPassword > #by self write > #by dn="uid=root,ou=People,o=M1,c=GB" write > #by * auth access to dn=".*,o=M1,c=GB" by self write > #by dn="uid=root,ou=People,o=M1,c=GB" write > #by * read access to dn=".*,o= M1,c=GB" > #by * read defaultaccess read > > access to attr=userpassword > by self write > by dn="uid=root,ou=People,o=M1,c=GB" write > by * read > > access to * > by self write > by dn=".+" read > by * read > > ############################################### > > Regards, > rui > > > ------------------------------ > > Message: 2 > Date: Sat, 25 Dec 2010 22:58:14 +0100 > From: "Dieter Kluenter" <dieter(a)dkluenter.de> > To: openldap-technical(a)openldap.org > Subject: Re: invalid credentials (49) for normal user > Message-ID: <87d3op1pmx.fsf(a)rubin.avci.de> > Content-Type: text/plain; charset=utf-8 > > rui <guideveloper(a)gmail.com> writes: > >> Hi, >> >> I have imported my passwd and groups file in ldap using >> migrate_all_online.sh script. >> >> I am able to simple bind to ldap using >> binddn= uid=root,ou=People,o=M1,c=GB but i can't seem to bind with any >> other user like rui etc with their linux password. Its says invalid >> credentials. > [...] > > run slapd in debugging mode, i.e. -d acl > > > ############ >> # ldbm database definitions >> ####################################################################### >> database ldbm > > ldbm is historic and not supported. > > -Dieter > > -- > Dieter Kl?nter | Systemberatung > http://dkluenter.de > GPG Key ID:DA147B05 > 53?37'09,95"N > 10?08'02,42"E > > > ------------------------------ > > _______________________________________________ > openldap-technical mailing list > openldap-technical(a)openldap.org > http://www.openldap.org/lists/mm/listinfo/openldap-technical > > > End of openldap-technical Digest, Vol 37, Issue 22 > ************************************************** >

3 6

Is attribute options supported?
by Angel L. Mateo 30 Dec '10

30 Dec '10

Hello, Is attribute options supported in openldap (version 2.4.21)? In RFC 2251 (LDAPv3) the attributes in search could be specified as attribute_name;options, so you could indicate options in the return of the attributes. Specifically, what I want to do is: I have attributes wich value is a URN, so I want to get just a special part of the URN, that is: Traditional search: Ldap filter: (mail=user(a)mydomain.com) Atributos: mail, schacPersonalUniqueID Result: mail: user(a)mydomain.com schacPersonalUniqueID: urn:mace:terena.org:schac:personalUniqueID:es:12345678Q Search with options: Ldap filter: (mail=user(a)mydomain.com) Atributos: mail, schacPersonalUniqueID;x-urn-7 Result: mail: user(a)mydomain.com schacPersonalUniqueID: 12345678Q I have tried this with a standard configuration, but it isn't working: amateo@joshua:~$ /usr/bin/ldapsearch ... mail=user(a)mydomain.com schacPersonalUniqueID;x-urn-7 # extended LDIF # # LDAPv3 # base <dc=Telematica> with scope subtree # filter: uid=amateo # requesting: irisClassifCode # # amateo, Usuarios, telematica dn: uid=user,ou=People,dc=mydomain,dc=com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 x-urn-1: orden no encontrada Is it supported? Do I have to configure anything in the slapd server? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

3 2

ldapsearch from server does not work but works from client
by Seau Yeen Su 30 Dec '10

30 Dec '10

Hi all, I have managed to install OpenLdap 2.4 on a RHEL 5.2 workstation. The basic openldap without TLS/SSL works fine. On the server itself and from the client I was able to do ldapsearch. However, after I created a server.pem by going through this : [url= http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch31_:_Cent… : Ch31 : Centralized Logins Using LDAP and RADIUS - Linux Home Networking[/url] ldapsearch on the ldap server itself does not work anymore. The summary of the configuration is as below: server.pem is created in /usr/local/etc/openldalp/cacerts and client.pem is in /etc/openldap/cacerts. client.pem is also moved to clients and ldapsearch works fine from client workstation. However, in the ldap server itself it does not. THe output of /etc/ldap.conf looks like below: uri ldaps://syna-ldap-02.synamatix.com/ tls_cacertdir /etc/openldap/cacerts pam_password md5 My /usr/local/etc/openldap/slapd.conf TLS portion looks like below: TLSCipherSuite HIGH:MEDIUM:+SSLv2:+SSLv3:RSA TLSCACertificateFile /usr/local/etc/openldap/cacerts/server.pem TLSCertificateFile /usr/local/etc/openldap/cacerts/server.pem TLSCertificateKeyFile /usr/local/etc/openldap/cacerts/server.pem TLSVerifyClient allow The error from ldapsearch x -H ldaps://syna-ldap-02.synamatix.com -d127 in the server itself is as below: TLS ceritficate verification: depth: 0, err: 18, subject: /C=MY/ST=KL/L=MV/O=MGRC/OU=IT/CN= syna-ldap-02.synamatix.com/emailAddress=seauyeen@mgrc.com.my, issuer: /C=MY/ST=KL/L=MV/O=MGRC/OU=IT/CN= syna-ldap-02.synamatix.com/emailAddress=seauyeen@mgrc.com.my TLS certificate verification: Error, self signed certificate tls_write: want=7, write=7 0000: 15 03 01 00 02 02 30 TLS trace: SSL3 alert write:fata:unknown CA TLS trace: SSL connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (self signed certificate). ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) On the server end, as I started with debug mode, I get errors below: TLS trace: SSL3 alert read: fatal: unknown CA TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept: erro: 14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca. connection_read(13): TLS accept failure error=-1 id=1010,closing ..... Why is that ldapsearch from client workstation works fine but not in the ldap server itself? It is osoo baffling. It is fine without TLS activated. I have been working on this for 1 week! The information online does not seem to cater to this weird incident of mine. Hope to receive some assistance really soon. If you need files and attachments, please inform me. Thanks and Happy new year guys!!!! -- ------------------------------ MGRC - Accelerating Your Journey of Discovery *Su Seau Yeen Assistant Manager IT Operations * * * *Malaysian Genomics Resource Centre Berhad (MGRC)* T: +6 03 2283 1820 | F: +6 03 2282 8102 | M: +6 012 6784642 | www.mgrc.com.my ------------------------------ This e-mail is intended only for the use of the individual or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is strictly prohibited. If you receive this e-mail in error, please contact us immediately by return e-mail and delete the original message(s).

1 0

one system won't authenticate
by Christ Schlacta 28 Dec '10

28 Dec '10

I've got two systems authenticating against an openldap directory, and one that refuses. I'm attempting to debug why this system won't authenticate, but there's nothing useful in auth.log, and I can't decipher the voluminous output that -d 255 provides. Iv'e checkeced all my configs and my passwords repeatedly. can anyone suggest a next step from here? PS: the system that won't auth is also the system hosting the ldap directory. TIA!!

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical