openldap-technical

openldap-technical@openldap.org

13 participants
9906 discussions

Re: OpenLDAP session authentication
by Dan White 07 Oct '10

07 Oct '10

On 29/09/10 10:19 -0500, Erik Lotspeich wrote: >Hi Dan, > >I hope that I don't mind if I ask a follow-up question: > >root@starfish:/usr/local/etc/openldap# testsaslauthd -u erik -p XXX -s >slapd >0: OK "Success." > >That works, but when I run ldapwhami, it doesn't: > >root@starfish:/usr/local/etc/openldap# ldapwhoami -Y login -U erik -H >ldap://localhost >ldap_sasl_interactive_bind_s: Unknown authentication method (-6) > additional info: SASL(-4): no mechanism available: No worthy >mechs found > >I did a search on the internet, and I ran this command: > >root@starfish:/usr/local/etc/openldap# ldapsearch -x -ZZ -s base -b "" ># extended LDIF ># ># LDAPv3 ># base <> with scope baseObject ># filter: (objectclass=*) ># requesting: ALL ># > ># >dn: >objectClass: top >objectClass: OpenLDAProotDSE > ># search result >search: 3 >result: 0 Success > >In other examples I've seen, mechanisms such as PLAIN or LOGIN or listed >here. Make sure you have the appropriate sasl shared libraries installed on both your server and your client (which appears to be the same according to your examples from above). Use plugingview/saslpluginviewer to see which server/client mechanisms you do have installed. For instance, on a Debian system you'd need to have the libsasl2-modules package. If you do have those mechanisms installed but are still not seeing them in the '-s base -b ""' search, make sure you've added 'sasl-secprops none' to your openldap slapd.conf. -- Dan White

3 4

best practice and account management (passwd)
by tangonights＠yahoo.it 06 Oct '10

06 Oct '10

Hi everybody! I'm a openldab absolute beginner so.. I started my training with user management, and was wondering if it was a good practice to move the whole /etc/passwd to ldap and let nsswitch jusst to 'ldap' the passwd,group,shadow items passwd: ldap group: ldap shadow: ldap I tried and I faced some obvious issues like client's boot errors etc. It worked but at the cost of a looong timeout.. - Is there any point in moving the whole /etc/passwd and groups, or is maybe better to move the root and other 'human' accounts, leaving local just the system users and groups? - was it better to keep the user's home directories (including /root) locally on the client, or better to move them on the ldap server, letting them be net- mounted on the client fs? Is it theoretically (and practically :-) ) possible to use ldap and remove from clients all the account management related binaries (useradd etc.) and /etc/passwd and /etc/groups? maybe naive questions..sorry :-) bye, Stefano.

2 1

High memory usage in provider server
by Claudio Cuqui 05 Oct '10

05 Oct '10

Hi there ! We are using two LDAP servers providers (openldap 2.4.23) in mirror mode: one just to receive modifies and the other, just to be "consumed" by 11 consumer servers. Both servers have almost 1MM objects with 10kb in size each. Id2entry.bdb has 21Gb and dn2id.bdb has 286Mb in size. When checking the first server we note that slapd is using ~4.0Gb of memory (RES). The problem is the second server, where all 11 consumers points to. Slapd in this server is using ~18.0Gb of memory (RES). We are using syncrepl to synchronize the 11 consumers with the 2nd server (RefreshandPersist). Openldap´s compile options are identical in both servers. Same for OS (Fedora 13 - x86_64 fully updated) and packages. Any ideas to reduce memory usage in the second server ? Regards, Claudio Cuqui

2 2

Checking compile options
by Bryan Payne 05 Oct '10

05 Oct '10

I compiled two ldap servers quite some time ago and I can't remember what options I compiled in. I need to compile a new server and was wondering if there is a way to see what options I used previously?

2 1

What attributes to authenticate (or) How to block the ldap tree for anonymous users
by Holger Schier 05 Oct '10

05 Oct '10

Hey guys, I am working with the LSEE 11 and trying to run a LDAP server. From scratch on everything went fine. With the standard configuration I can login, but if I use the LDAP Browser and hit anonymous access, I can see my whole LDAP tree. User name, mailaddresses and so on. And I am not happy with it. So I tried to change the access control from access to * by * read to access to * by * auth or access to * by * search The user password is already in auth mode. But with every other configuration instead of read, I cannot login anymore. Insufficient access. After the first try with auth I read the log files and saw that there is a search operation. So i switched to search. Now the server denies some read operations. So, my questions are: Is it just normal that anyone can see the LDAP tree? Is there any other option to hide my tree? And what attributes have to be readable to login? Thanks a lot. Holger

2 5

How can I monitore a mirror mode?
by Tiago Cruz 05 Oct '10

05 Oct '10

Hello folks, I have 2 OpenLDAP 2.4.11 running as Mirror Mode very well. But I would like to make sure that everything was replicated how should be forever :) so I would like to write some script to monitor it. I've searched around web, but I only found some about LDAP 2.2 and 2.3 (syncrep). Can you give me some tip about how I can do this? Many thanks! -- -- Tiago Cruz

2 2

openldap vs. 389
by Matt Juszczak 05 Oct '10

05 Oct '10

Hi all, We are currently evaluating which directory server to use for our authentication implementation, pdns backend, and puppet backend. We have a proof of concept working with openldap but have recently begun looking into 389. For those who have worked with these two, which do you find to be better for your needs? Which has better replication options? What about community and active development? Any major features in one that isn't in the other that are important to you? Thanks, Matt

1 0

memberOf module install on ubuntu 10.04 slapd package gives: "Insufficient access"
by Jon Skarpeteig 05 Oct '10

05 Oct '10

Attempting to enable memberOf module, following http://dimaj.net:1784/blog/2010/07/howto-verify-that-a-member-is-part-of -a-secondary-group-in-openldap/ gives me: ldap_modify: Insufficient access (50) - I am root on Ubuntu 10.04 using slapd package. What am I doing wrong?

1 0

Fine Grained Permission System
by AdaXi 04 Oct '10

04 Oct '10

Hi everyone, I am kind of a newbie in OpenLDAP and LDAP in general, and I really need your help, I have been looking for a fine grained permission system to a project that I am in now, but could not find anything that satifies me. I have multiple applications that will authenticate using LDAP, but I also want to control user access in each application. I want to be able to allow specific acces to an element in one application. Examples : For database, I would like to assign read permissions to one or more database for one user. For a bulletin board, users can only post in some specifec boards. For a FTP server, users can only access specific directories. In first place is it realistic ? Do you know a way to do this only with LDAP ? (if yes, could you show me a manual or guide) Do you know some piece of software that could help me ? Thanks in advance, AdaXi

2 2

How to retrieve monitoring information
by Simon Gao 04 Oct '10

04 Oct '10

Hi, I am trying to retrieve information from monitoring database. However, the command like below does not return actual number for total connections. ldapsearch -x -D 'cn=admin,dc=xzy,dc=com' -W -b 'cn=Total,cn=Connections,cn=Monitor' Did I miss anything? or the command syntax is not right? Simon

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical