openldap-technical

openldap-technical@openldap.org

1 participants
9898 discussions

Is ldap_bind() mandatory before each ldap_search() call?
by Shankar Anand R 09 Nov '10

09 Nov '10

Hi all, I see that most LDAP utilities (openldap included) do a ldap_bind() before every ldap_search(). Is this mandatory? If LDAP descriptor (ld) is valid and can be used for multiple ldap_search() calls, when does it become invalid? Is it time based, say ld becomes invalid after 10 minutes? I have an application which needs to search the LDAP server for some specific attributes of users. The user name is taken as input from the command line. Is it necessary to do a ldap_bind() before each ldap_search() call? Doesn't this make it costly? Can I do ldap_bind() once and call ldap_search() many times? When does my "bind" become invalid? Can my application do this: #1 - bind to a LDAP server during initialization #2- then do an ldap_search() whenever required #3- then invalidate the ld after 10 minutes #4- do a ldap_bind() again and repeat from #2? Can someone kindly clarify? Thanks, Shankar

3 7

pam services under LDAP
by bluethundr 09 Nov '10

09 Nov '10

Hello List I am attempting to setup various pam modules to consult our new LDAP services in order to do what it needs to do. My LDAP server is FreeBSD but the clients are CentOS... I have setup my /etc/pam.d sudo file on the client (for example) this way in the attempt to accomplish this via LDAP: [root@VIRCENT03:~]#cat /etc/pam.d/sudo #%PAM-1.0 auth include system-auth auth required pam_ldap.so account include system-auth account required pam_ldap.so password include system-auth password required pam_ldap.so session optional pam_keyinit.so revoke session required pam_limits.so session required pam_ldap.so but even tho the user is part of the %wheel group under LDAP it is unable to sudo to any other account (including root). If I try to sudo this is what happens: [bluethundr@VIRCENT03:~]#sudo bash [sudo] password for bluethundr: bluethundr is not in the sudoers file. This incident will be reported. It would appear that sudo support for ldap is compiled in: [root@VIRCENT03:~]#ldd $(which sudo)| grep -i ldap libldap-2.3.so.0 => /usr/lib/libldap-2.3.so.0 (0x00552000) This is how I setup my ldap.conf file [root@VIRCENT03:~]#cat /etc/openldap/ldap.conf # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example, dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never URI ldap://ldap.acadaca.net/ BASE dc=acadaca,dc=net TLS_CACERTDIR /etc/openldap/cacerts sudoers_base ou=sudoers,ou=Services,dc=acadaca,dc=net In my openldap logs on the LDAP server there appears to be no activity when I sudo. however in the secure logs on the client I do.. Nov 8 16:05:34 VIRCENT03 su: pam_unix(su-l:session): session opened for user root by bluethundr(uid=500) Nov 8 16:05:37 VIRCENT03 su: pam_unix(su-l:session): session opened for user bluethundr by bluethundr(uid=0) Nov 8 16:05:44 VIRCENT03 sudo: bluethundr : user NOT in sudoers ; TTY=pts/5 ; PWD=/home/bluethundr ; USER=root ; COMMAND=/bin/bash Conversely when I sudo via LDAP on my FreeBSD ldap server this is what I see... Nov 8 19:44:25 LBSD2 sudo: bluethundr : TTY=pts/11 ; PWD=/usr/home/bluethundr ; USER=root ; COMMAND=/bin/bash Nov 8 19:44:51 LBSD2 sudo: bluethundr : TTY=pts/10 ; PWD=/usr/home/bluethundr ; USER=root ; COMMAND=/bin/bash Works there! I do see other events in secure.log that appear to be pam successes however. am i interpreting this correctly that at least part of the system is communicating with pam on the ldap server? thanks -- Here's my RSA Public key: gpg --keyserver pgp.mit.edu --recv-keys 5A4873A9 Share and enjoy!!

6 7

Openladp is very very slow with log activated
by Couturier Jean-Louis 09 Nov '10

09 Nov '10

2 2

Re: unable to perform authenticated binds
by Tim Dunphy 08 Nov '10

08 Nov '10

Hey List, I found the cause of the failure to import ldif entries with references to the suDoers object class: include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/misc.schema inlcude /etc/openldap/schema/sudoers.schema include /etc/openldap/schema/openldap.schema If you look closely there is a type-o for the /etc/openldap/sudoers.schema include directive. It's spelled 'inlcude'. Sorry about that and sorry for all the grief! Fixing that and restarting ldap I was able to import the ldifs I wanted. Thanks again for your help!

1 0

reordering email aliases ?
by Frank Bonnet 08 Nov '10

08 Nov '10

Hello I'm facing a cosmetic problem with email aliases. Some users has aliases for their email adresses some has not. For example a professor named Jean Dupont has two valid email adresses : dupontj(a)domain.tld ( which is unixlogin(a)domain.tld ) j.dupont(a)domain.tld ( which is the alias that point to duponj(a)domain.tld ) Students have only one email adress of the form : unixlogin(a)domain.tld In many applications we use LDAP to fetch the user's email address and other data. The problem is sometime we get unixlogin(a)domain.tld and sometime we get emailalias(a)domain.tld I would like to do the following : if a user has an alias of the form emailalias(a)domain.tld then display it first Is it possible to reorder my LDAP database to do so ? Thanks a lot !

3 4

Abou 'make test'
by su heng 07 Nov '10

07 Nov '10

Hi All, I encountered an error when I was installing openLDAP. I mean 'make test' It gave me a message at the end of the output message: ... ... No race errors found after 10 iterations Found 2 errors >>>>>> Exiting with a false success status for now >>>>> ./scripts/test058-syncrepl-asymmetric completed OK for hdb. make[2]: Leaving directory `/home/suheng/Downloads/openldap-2.4.23/tests' make[1]: Leaving directory `/home/suheng/Downloads/openldap-2.4.23/tests' He said I had 2 errors encountered, however, I couldn't locate where the error is. Although I can install it, I worried about if it works fine. So, How can I locate the error location when I do 'make test'? Thanks & Best Regards, Su Heng

2 2

Configuring the chain overlay with cn=config
by Jaap Winius 07 Nov '10

07 Nov '10

Hi folks, My old chain configuration in slapd.conf works fine and looks like this: ################################################# moduleload back_ldap overlay chain chain-uri ldap://ldaps.example.com:389/ chain-rebind-as-user TRUE chain-idassert-bind bindmethod=simple binddn="cn=ldaps2,dc=example,dc=com" credentials=bilineatus mode=self chain-return-error TRUE ################################################# (Debian lenny, slapd v2.4.11-1) Some research has led me to believe that the proper cn=config equivalent in LDIF format would start like this: ################################################# dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: {1}back_ldap dn: olcOverlay={0}chain,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: {0}chain ################################################# (Debian squeeze, slapd v2.4.23-6) Does that look correct? If so, could someone please explain how to translate the other chain overlay directives I've used as well? I've tried translating the old configuration with slaptest, but it seems to ignore the existing chain configuration completely -- not even the back_ldap module gets loaded as a result. I've also tried searching the schema for them with this command: ~# ldapsearch -LLQY EXTERNAL -H ldapi:/// -b cn=schema,cn=config \ -s base | grep -A 2 -i chain However, the list of candidates that I've found with it seems incomplete: slapd.conf chain overlay directive => cn=config equivalent attribute ---------------------------------------------------------------------- chain-cache-uri => olcChainCacheURI chain-chaining => olcChainingBehavior chain-idassert-bind => ?? chain-max-depth => olcChainMaxReferralDepth chain-rebind-as-user => ?? chain-return-error => olcChainReturnError chain-uri => ?? ?? => olcChainConfig ?? => olcChainDatabase Can anyone fill in what's missing? Thanks, Jaap

1 1

Syncprov checkpoint and sessionlog with cn=config
by Jaap Winius 06 Nov '10

06 Nov '10

Hi folks, When configuring a sync provider with cn=config, it was not too difficult to figure out how to load the syncprov module and create the entry for its overlay, but it is unclear how to configure two associated statements that appear as follows when using slapd.conf: syncprov-checkpoint 100 10 syncprov-sessionlog 100 Can anyone say how this might be accomplished? Thanks, Jaap

4 8

Syncrepl filtering
by Bram Cymet 06 Nov '10

06 Nov '10

Hi, I would like to control what gets replicated to my ldap slaves. How would I specify what I don't want to be replicated? Is this even possible or do I have to create a filter that finds everything that I want to send down? Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. Cell: 613-608-9752

2 2

Accesslog overlay to get IP from user connection
by Alberto Frontera 06 Nov '10

06 Nov '10

Hello this is my scenario: - Centos 5.2 - ldap 2.420 - Mysql 5.07 Ldap is used to authenticate users from Ubuntu systems. We want to storage some info from the connections: - date - IP I can see this info on ldap logs, but i want to save this info on a ldap DB (mysql backend if possible). Actually i have configured accesslog overlay, but i think this info is not registered or i can not see it. :p The question is: is access overlay the tool to register this info? (i think the answer is no) ... and if it is not, how can i do this? I need some advice on this. Thx

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical