openldap-technical

openldap-technical@openldap.org

18 participants
9801 discussions

Re: custom hostname for openldap/sasl is not working
by Zaar Hai 02 Sep '10

02 Sep '10

On Thu, Sep 2, 2010 at 1:22 AM, Bill MacAllister <whm(a)stanford.edu> wrote: > > Simon Wilkinson discussed the problem on the Heimdal list. > > The problem is that both the client and the server must have a > matching idea of the service principal to use in establishing the > GSSAPI connection. > > The client will use ldap/ldap.uvm.edu, as that's the only name it > knows the server by. However, the server will end up using > ldap/hostname() and therefore the two won't match, and you'll get > these errors. So what sasl-host directive is good for? It does something in fact - if I enable it and set it to ldap.example.com, GSSAPI auth stop working with the same error. Also, I've tried to set server hostname to "ldap", and hostname --fqdn returned ldap.example.com, but this did not help either. -- Zaar

2 1

Re: Unix authentication in corporate AD
by Dan White 02 Sep '10

02 Sep '10

On 1/09/10 5:12 -0500, Dan White wrote: >On 01/09/10 12:05 -0400, Edsall, William (WJ) wrote: >>Hello, Just a few questions regarding authenticating OpenLDAP (centos >>5.4) to windows active directory. >> >>I'm able to bind, I've confirmed this by changing the bind password, and >>then the bind attempt fails. However I'm unable to authenticate. > >Could you clarify a few items? > >Are you binding directly to an OpenLDAP server or an Active Directory >Server? > >Which password are you changing, the user's password in Active Directory? > >>My attempt is always as follows: su: user blabla does not exist > >With regards to OpenLDAP, a successful bind is a success authentication. > >With something like su, your trouble may be related to a 3rd party PAM or >NSS module. How does su authenticate in your environment? On 02/09/10 10:25 -0400, Edsall, William (WJ) wrote: >Hello, > I am binding to an Active Directory server. > >When I say I change the password for testing, I'm changing the bind >password in the ldap.conf file. > >I believe PAM is using the ldap module: >passwd: files ldap >shadow: files ldap >group: files ldap > >The reason I used the binddn and bind password is because I know our >active directory setup does not allow anonymous binding. So as I understand it, you are not using the OpenLDAP server, but the OpenLDAP libraries in conjunction with a PAM ldap module. Do you know which PAM module you are using? The PADL one? If so, you may want to pose this problem on the pamldap(a)padl.com mailing list, or you could post a sanitized copy of your ldap configuration here to see if someone might recognize a problem. A general trouble shooting tip would be to find out what query your PAM ldap module is submitting to the Active Directory server, and attempting to reproduce it with an ldapwhoami command, and playing with the base/scope/filter settings until you get the expected response. -- Dan White

1 0

Unix authentication in corporate AD
by Edsall, William (WJ) 02 Sep '10

02 Sep '10

Hello, Just a few questions regarding authenticating OpenLDAP (centos 5.4) to windows active directory. I'm able to bind, I've confirmed this by changing the bind password, and then the bind attempt fails. However I'm unable to authenticate. My attempt is always as follows: su: user blabla does not exist No errors end up in the messages log. My question is .. could this be because the active directory I'm trying to authenticate against doesn't have any windows services for unix installed? Should that even matter if I can bind? _______________________________________ William J. Edsall

3 2

About Installation
by Murat Can Tuna 02 Sep '10

02 Sep '10

Hi, On every ubuntu introduction there is written "The installation process will prompt you for the LDAP directory admin password and confirmation." But I don't get such a prompt. What am I missing? I logged in over ssh, could it be the reason? Is there any way to give my password manually? Also dpkg-reconfigure slapd doesn't bring something, it asks just 3 questions about ldapv2 protocol and so. But on my own computer at home there isn't such a problem, I installed and configured everything without any problem. this is the version: DISTRIB_ID=Ubuntu DISTRIB_RELEASE=9.10 DISTRIB_CODENAME=karmic DISTRIB_DESCRIPTION="Ubuntu 9.10" Thanks in Advance Murat Can Tuna

1 1

custom hostname for openldap/sasl is not working
by Zaar Hai 01 Sep '10

01 Sep '10

Good day, dear list! I'm trying to setup SASL GSSAPI authentication for openldap that listens on hostname different from the machine hostname it runs on. openldap runs on server inka.example.com. ldap/inka/example.com principal is added to ldap's keytab file. This command works just fine: ldapsearch -Y GSSAPI -H 'ldap://inka.example.com' Now: * I've added second IP to the inka.example.com * Added A record for ldap.example.com to point to that IP and setup corresponding PTR record. * Created ldap/ldap.example.com principal and added it ldap's keytab. * Even set openldap to listen only on ldap.example.com IP. But the command ldapsearch -Y GSSAPI -H 'ldap://ldap.example.com' fails with the following error in ldap log: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Wrong principal in request) I see that client successfully obtains ticket for ldap/ldap.example.com(a)EXAMPLE.COM I've tried to set sasl-host to ldap.example.com and sasl-realm to EXAMPLE.COM in slapd.conf - did not help. I've even tried to do "hostname ldap" on inka.example.com and restart slapd - same error. >From what I understand, the slapd daemon will try, before connecting the KDC server, to read the keytab file and get the key of the principal ldap/<sasl-host>#<sasl-realm>, so it looks like I'm doing the right thing, but it does not work. System: Debian testing. slapd-2.4.17-2.1 sasl-2.1.23.dfsg1-5 MIT kerberos 1.8.3+dfsg~beta1-1 Thank you in advance for help, -- Zaar -- Zaar

2 1

TLS fails
by Frederik Bosch 01 Sep '10

01 Sep '10

After getting my ACL right (thanks Dieter!), I have problems installing an official certificate. I bought a certificate at RapidSSL. Starting slapd gives me the following error. TLS init def ctx failed: -69 This error is thrown in openldap 2.4.17. Since I am on debian, slapd is compiled against GnuTLS. When I was using 2.4.11 I had another error: TLS init def ctx failed: -207 When I had a self-signed certificate I had no trouble. What could be wrong?

4 7

RE: Getting Solaris to use Openldap
by Stuart Cherrington 01 Sep '10

01 Sep '10

> Date: Fri, 27 Aug 2010 21:33:42 +1200 > From: ian(a)ianshome.com > To: stuart_cherrington(a)hotmail.co.uk > Subject: Re: Getting Solaris to use Openldap > > On 08/27/10 08:48 PM, Stuart Cherrington wrote: > > Hi, > > > > I Have an OpenLDAP 2.4.18 server on RHEL 5.3. I can get Linux clients > > to use the master by use of the /etc/ldap.conf file. I'm now trying to > > get a SOlaris 10 client to use the master by initialising with the > > default profileName. If I run: > > > > ldapclient -v init -a proxypassword=xxxxx -a > > proxydn=cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -a > > domainname=ldn.sw.com 10.2.250.15 > > > I also add a -a profileName=default Shouldn't need to add this as ldapclient takes 'default' as the default profilename if not specified. I did try it with this anyway but got same error. > > > So the 2 errors are the *NOTFOUND nisDomainObject *which is there when > > I check on the master: > > > > [root@msldap01 openldap2.4]# ldapsearch2.4 -h 10.2.250.15 -D > > cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -w xxxxx-b > > dc=ldn,dc=sw,dc=com -s base > > # extended LDIF > > # > > # LDAPv3 > > # base <dc=ldn,dc=sw,dc=com> with scope baseObject > > # filter: (objectclass=*) > > # requesting: ALL > > # > > > > # ldn.sw.com > > dn: dc=ldn,dc=sw,dc=com > > dc: ldn > > o: ldn > > associatedDomain: ldn.sw.com > > nisDomain: ldn.sw.com > > objectClass: dcObject > > objectClass: organization > > objectClass: domainRelatedObject > > *objectClass: nisDomainObject* > > objectClass: top > > > That looks OK. > > > > The other error is 'Failed to find defaultSearchBase for domain > > ldn.sw.com' > > > > [root@msldap01 openldap2.4]# ldapsearch2.4 -h 10.2.250.15 -D > > cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -w 5wap5proxy -b > > cn=default,ou=profile,dc=ldn,dc=sw,dc=com -s base > > # extended LDIF > > # > > # LDAPv3 > > # base <cn=default,ou=profile,dc=ldn,dc=sw,dc=com> with scope baseObject > > # filter: (objectclass=*) > > # requesting: ALL > > # > > Do you have a cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com entry? Yeh [root@msldap01 openldap2.4]# ldapsearch2.4 -h 10.2.250.15 -D cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -w xxxxx -b cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -s base # extended LDIF # # LDAPv3 # base <cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com> with scope baseObject # filter: (objectclass=*) # requesting: ALL # # proxyagent, profile, ldn.sw.com dn: cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com cn: proxyagent sn: proxyagent objectClass: top objectClass: person userPassword:: e0NSWVBUfXYuTWpqUDJEb3lpMXc= # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 > > > # default, profile, ldn.sw.com > > dn: cn=default,ou=profile,dc=ldn,dc=sw,dc=com > > *defaultSearchBase: dc=ldn,dc=sw,dc=com* > > authenticationMethod: simple > > followReferrals: TRUE > > profileTTL: 43200 > > searchTimeLimit: 30 > > objectClass: DUAConfigProfile > > defaultServerList: 10.2.250.15 > > credentialLevel: proxy > > cn: default > > defaultSearchScope: one > > You should add > > serviceSearchDescriptor: passwd:<people base> > serviceSearchDescriptor: group:<group base> I initially had these (and one for shadow) but they didn't make any difference the error, but I expect I'll need them when its in operation. > > -- > Ian. >

3 7

Re: TLS fails
by Marc Patermann 01 Sep '10

01 Sep '10

Frederik, no TOFU, please. :) Frederik Bosch schrieb am 01.09.2010 10:23 Uhr: > Compiling 2.4.17 with OpenSSL was more succesful than on 2.4.11. I think > that's a Debian issue. Anyway, I have my server up and running! Thanks a > lot Dieter for answering all my questions. > > But I have a minor question left. Each time I restart slapd I have to > enter the PEM pass phrase. Is there a way to remember or not prompt for > the passphrase? You have to remove the passphrase from the PEM file. i.e.: http://www.openssl.org/docs/apps/rsa.html EXAMPLES To remove the pass phrase on an RSA private key: openssl rsa -in key.pem -out keyout.pem Marc

1 0

Re: OpenLDAP to replace Oracle Internet Directory
by Matheus Morais 30 Aug '10

30 Aug '10

Hi Gavin, Sorry for the late reply, I need to organize my mail box, I just not seen this email! On Mon, Jul 26, 2010 at 2:24 PM, Gavin Henry <ghenry(a)openldap.org> wrote: > > I want thank every one responsible to keep OpenLDAP project with that > high > > level of quality and I am really proud about that kind of quality has > been > > produced by a free software project (free as in freedom). > > Excellent news! How is it going now? Did you use our docs to help you? > We're doing really well at this time. Right now we're waiting for the dev team to correct one of our LDAP API which was using substring search for distinguishedName attributes and that works on Oracle Internet Directory but as RFC 2256 say, section 5.50 more precisely, the 'client must not assume that LDAP servers are capable of performing attribute subtyping'. They are testing and after put on production we will be ready to change the last systems which still using Oralce Internet Directory. I most used the Administrator's Guide for version 2.4 and all the manuals available. I think the documentation is very complete in general but could be improved in some points, like the session of Monitor backend for example. I also would be happy if we had a portuguese version of Admin's Guide. Since I'm not a developer I could help on the documention at my spare time. I would be glad if I could help in some aspect. > Do you have any suggestions for improvements to the docs? > > Thanks. > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ > Thanks, Matheus Morais!

2 1

I can't see my /etc/ldap/slapd.conf file after reinstall
by Eric KOM 28 Aug '10

28 Aug '10

Hi Dear Team! Please, I got problem with my OpenLDAP server on Debian Testing. I try to purge slapd package with aptitude purge slapd and remove all files and directories with rm on /etc/ldap/. after reinstall slapd, I can't see the main configuration file /etc/ldap/slapd.conf? but the server is running. Thank you in advance. -- Yours truly, Eric KOM 110 LAWN STREET ROSETTENVILLE 2190 JOHANNESBURG SOUTH AFRICA Phone: +27 (0) 788 791 334 Fax: +27 (0) 865 563 009 E-mail: erickom(a)namekom.co.za Websites: www.erickom.co.za | www.namekom.co.za/erickom | www.namekom.co.za

5 11

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical