openldap-technical

openldap-technical@openldap.org

15 participants
9797 discussions

Proxycache overlay to back-ldap with cn=config
by Nicolas Brisac 05 Aug '10

05 Aug '10

Hi, I'm trying to set up a proxy-cache to a couple of OpenLDAP servers configured in mirror mode. The back-ldap part is working fine and I can query the underlying slapd instances through the proxy. However, I'm still struggling with the caching bit. I couldn't find any documentation or posts related to setting this up using the new cn=config way of configuring LDAP. So after some reading and a bit of guessing, I came up with the following config: # {1}ldap, config dn: olcDatabase={1}ldap,cn=config objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {1}ldap olcSuffix: dc=sol1,dc=net olcAccess: {0}to dn.base="" by * read olcAccess: {1}to dn.base="cn=Subschema" by * read olcAccess: {2}to * by self write by users read by anonymous auth olcRootDN: uid=ldapadmin,dc=sol1,dc=net olcRootPW: secret olcDbURI: "ldap://192.168.200.12 ldap://192.168.200.14" olcDbACLBind: bindmethod=simple binddn="uid=ldapadmin,dc=sol1,dc=net" credentials="secret" starttls=no # {0}pcache, {1}ldap, config dn: olcOverlay={0}pcache,olcDatabase={1}ldap,cn=config objectClass: olcOverlayConfig objectClass: olcPcacheConfig olcOverlay: {0}pcache olcPcache: bdb 10000 3 1000 100 olcPcacheAttrset: 0 uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass olcPcacheAttrset: 1 sudoCommand sudoHost olcPcacheAttrset: 2 gidNumber olcPcacheTemplate: (&(objectClass=)(uid=)) 0 300 olcPcacheTemplate: (sudoUser=) 1 300 olcPcacheTemplate: (&(objectClass=)(memberUid=)) 2 300 # {2}bdb, config dn: olcDatabase={2}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcDbDirectory: /var/lib/ldap/cache olcSuffix: cn=proxy olcRootDN: uid=ldapadmin,dc=sol1,dc=net olcDbCacheSize: 5000 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: uid eq olcDbIndex: cn eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: memberUid eq olcDbIndex: uniqueMember eq olcDbIndex: mail eq olcDbIndex: surname eq olcDbIndex: givenname eq olcDbIndex: sambaSID eq olcDbIndex: sambaPrimaryGroupSID eq olcDbIndex: sambaDomainName eq olcDbIndex: sudoUser eq But running ldapsearch keeps returning: # search result search: 2 result: 52 Server is unavailable text: pcachePrivDB: cacheDB not available I didn't find any way to specify which database to use when declaring the overlay, apart from the 'bdb' part of olcPcache, but that seems to be interpreted as the database type, not its name (I've tried replacing it with cn=proxy, but that throws an error). Looking at the pcache overlay source (I'm running 2.4.21 from Ubuntu Lucid and also checked the latest 2.4.23 stable source), I can see this bit: { "pcache-", "private database args", 1, 0, STRLENOF("pcache-"), ARG_MAGIC|PC_PRIVATE_DB, pc_cf_gen, NULL, NULL, NULL }, That seems to be for the private DB options, but the other equivalent "pcacheXXXX" in this file have the corresponding attribute declaration for the schema instead of 'NULL, NULL, NULL'. Anyway, I'm obviously missing something :) If someone who's got this working or a developer could point me in the right direction, that would be greatly appreciated! Thanks, Nico

1 1

using ldap to control access to other services
by William Cai 04 Aug '10

04 Aug '10

Hi List, I have been using LDAP for some time. The LDAP server is mainly used to store user information. Today I heard that LDAP can be used to control access to other services. More specific, "The way it works is that your (or any other) app calls LDAP with like "I am user A, here is my ticket, so what I can do?" and then LDAP responds: "User A has a type X and can access B, C and D function, but can not access X, Y and Z function". So your app realizes that "Type X can access today and tomorrow, but not day after tomorrow" etc." I went through OpenLDAP document http://www.openldap.org/doc/admin24/access-control.html. But seems it focuses on how to control the access to LDAP server itself. Could anybody show me how to implement this? 1. Do I need to model the business environment in LDAP? e.g. create a node for each function point. 2. What is the programming model? Can I use Java interface to retrieve these permission information? 3. Is it OpenLDAP specific function or LDAP common function? Thanks, William

3 2

Webmin LDAP User Module Don't Wor
by Andrea Minardi 04 Aug '10

04 Aug '10

Webmin's LDAP Users and Groups module stopped working after upgrading from Webmin 1.400 to webmin 1.510 I have been using Webmin's LDAP Users and Groups module on my company's server to administer users. It was working fine on Webmin 1.400, but after upgrading I get the error: "Webmin has connected to the LDAP server, but failed to fetch the schema. Make sure that access has not been denied in the LDAP Server module." I work with OpenLDAP 2.3.27 on Red Hat 5. Thanks. Andrea Minardi

3 2

Re: Unclear attribute: entry
by Dieter Kluenter 04 Aug '10

04 Aug '10

Klaus Ethgen <klaus+usenet(a)ethgen.de> writes: > Hello, > > I have to admit that I do not know what exactly the entry attribute (and > partly the children attribute too) is for. I know that it is needed to > give access to any other attribute but that is not enough for me as I > want to _know_ what it is for. > > Unfortunately I did not find a more clear description of this attribute > than "scope limited to this entry" which is somewhat meaningless for me. > > So my question is what is the rights that are needed for which entry > attribute (in tree) to allow read, write, search or other access to > other attributes? > > Please excuse that I did crosspost this question to three groups as > there is no user group and g.n.o.general is very empty so it was not > clear if it is read at all. entry and children are so called pseudo attributes. They are mainly used to allow access to children of an entry. As example you have an entry ou=users,dc=example,dc=com and want to allow access to children of this entry but no read or write access to the entry itself, a rule set could be access to dn.onelevel=ou=users,dc=example,dc=com by users write by anonymous auth access to dn.base=ou=users,dc=example,dc=com attrs=entry,children by users write by anonymous auth -Dieter -- Dieter Klünter | Systemberatung sip: 7770535(a)sipgate.de http://www.dpunkt.de/buecher/2104.html GPG Key ID:8EF7B6C6

1 0

about LDIF operation by API
by owen nirvana 04 Aug '10

04 Aug '10

It seems nothing is provided for operating LDIF. How to implement ldif export and import with C/C++ in OpenLDAP. gtalk:freeespeech@gmail.com <gtalk%3Afreeespeech(a)gmail.com>

2 1

Kerberos userpassword storage
by Indexer 04 Aug '10

04 Aug '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, Im attempting to use Kerberos as a password storage backend in my ldap server. I have the server setup with its own principal of the form ldap/domainname@REALM , and this keytab is in the KRB5_KTNAME environment variable as slapd starts. I have put olcSaslRealm=REALM and olcSaslHost=kdc.domain into my cn=config. Then, i have uid=user, where the userPassword attribute is {KERBEROS}user@REALM When attempting to bind to this user, it seems to fail. When i reset the password to a standard SSHA hash, it authenticates correctly. I can authenticate with kerberos to the host that the ldap enabled client, but i just cannot use ldap with the kerberos password backend. Any help in solving what else i need to do in this would be greatly appreciated William Brown pgp.mit.edu -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.14 (Darwin) iQIcBAEBAgAGBQJMWSI4AAoJEHF16AnLoz6JYt0P/0GzaH8jSYxiFLkjuh+XnXKI E1Io0H9a0U3Z2GWnkpGwfYmZpPSPHhCV7qs18y2AFHyekvxW9Io3sraKWbsHqLOh yygbVeZXvhdp29fpvvDfUoSXE6VN20pYtNdRUGQ+aMFCTwGjikBQoMZJjzjYZQOG cN3HF/TDHLVKQHKsmkVJr5qHKoWEjG2duD/vQ1vd1PS1Lv+QtQxjuSLFZFU5Fmwd L0ujNLExlyosR0CyvuIQ+wzZldPDy0yrCHlfD69GYNyfYp1l6+9o4bR9glFVdzIP C6JBciipPuq+PmHfi8YuWI0pO5XCS0n0S2K1Jtp5iMgCeInUiAMKw1oPnrygTXBi K8SaiO9jjleA6GFeql4Tzf9swIYVXxtOrUkTS+lRmEX4hl8ZkyRC+2lMDcKk5O5m 4OmW6B5k0NFQ+oEkGnmW+6UzfdhXuDC/I42XHGMfAMf3aW3f671JjTllxS/1aQJE A2v1VgjHAVLHx0qRj0aucJGQveGK8wmpA9odZIokxu4KJPn42THFa2ITvWAk/hux dpYuh4d8PFU8ikHVu4rmXsvPFfpVUrFl389+P9jAziS41dCpqC5doo3TP+W+pz93 7d0gkSCPGPnPp7f/tXAcnISwQMeKvzqi0XzJN3xmCRXVdfsJNk8yxFF+KZ1JoZKW r+qQcwwXTkogq/+tBeNq =0f+g -----END PGP SIGNATURE-----

3 2

what makes client use mech=SIMPLE?
by Klavs Klavsen 04 Aug '10

04 Aug '10

Hi, I have many ubuntu 8.04 clients which all work fine with my ldap server. I am now trying to connect a 10.04 client to the server - but login fails - and the only difference in output (in the debug file on the server) is the mech=SIMPLE line in the client that works. The one that works: Aug 4 10:21:36 ldap01 slapd[3077]: conn=1439319 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 4 10:21:36 ldap01 slapd[3077]: conn=1439319 op=2 BIND anonymous mech=implicit ssf=0 Aug 4 10:21:36 ldap01 slapd[3077]: conn=1439319 op=2 BIND dn="cn=Klavs Klavsen,ou=People,dc=example,dc=net" method=128 Aug 4 10:21:36 ldap01 slapd[3077]: conn=1439319 op=2 BIND dn="cn=Klavs Klavsen,ou=People,dc=example,dc=net" mech=SIMPLE ssf=0 Aug 4 10:21:36 ldap01 slapd[3077]: conn=1439319 op=2 RESULT tag=97 err=0 text= The one that fails: Aug 4 10:19:20 ldap01 slapd[3077]: conn=1439273 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 4 10:19:20 ldap01 slapd[3077]: conn=1439273 op=2 BIND anonymous mech=implicit ssf=0 Aug 4 10:19:20 ldap01 slapd[3077]: conn=1439273 op=2 BIND dn="cn=Klavs Klavsen,ou=People,dc=example,dc=net" method=128 Aug 4 10:19:20 ldap01 slapd[3077]: conn=1439273 op=2 RESULT tag=97 err=49 text= Any idea what makes the client try binding with mech=SIMPLE? or perhaps a hint as to why the first "method=128" doesn't work? I hope you have ideas :) Thank you in advance -- Regards, Klavs Klavsen, GSEC - kl(a)vsen.dk - http://www.vsen.dk "Those who do not understand Unix are condemned to reinvent it, poorly." --Henry Spencer

1 0

trying to understand referrals
by Khaled Blah 04 Aug '10

04 Aug '10

Hello all, I'm writing an LDAP application using OpenLDAP. First of all, thanks to the many contributors to this project! It's highly appreciated! Now, I'm trying to understand how I can implement an application that knows how to deal with referrals. I've implemented a function which I assign via ldap_set_rebind_proc, however I am not entirely sure what to do within this function that I assign to ldap_set_rebind_proc. What I've done so far is to parse the url parameter using ldap_url_parse and then assign the data from the LDAPURLDesc structure to my own data structure. Then I call ldap_init and ldap_bind_s in order to bind to the referral. However, it seems I am doing something wrong. Can anyone here give me any hints as to what to within that function that is assigned to ldap_set_rebind_proc? Thanks in advance! Regards, Khaled

2 4

ldapadd Naming Violation error 64
by Raymond Norton 03 Aug '10

03 Aug '10

Ubuntu server 10.0.4, ldap 2.4.21 I am getting the following error when attempting to use the ldapadd command: sudo ldapadd -Y EXTERNAL -H ldapi:/// -f db.ldif (error) adding new entry "cn=module{0},cn=config" ldap_add: Naming violation (64) db.ldif: # Load modules for database type dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb # Create directory database dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=2190-db,dc=org olcRootDN: cn=admin,dc=isd2190-db,dc=org olcRootPW: 1234 olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=isd2190-db,dc=org" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=admin,dc=isd2190-db,dc=org" write by * read olcLastMod: TRUE olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: uid pres,eq olcDbIndex: cn,sn,mail pres,eq,approx,sub olcDbIndex: objectClass eq ################################################## ######### # DEFAULTS MODIFICATION ################################################## ######### # Some of the defaults need to be modified in order to allow # remote access to the LDAP config. Otherwise only root # will have administrative access. dn: cn=config changetype: modify delete: olcAuthzRegexp dn: olcDatabase={-1}frontend,cn=config changetype: modify delete: olcAccess dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW olcRootPW: {CRYPT}7hzU8RaZxaGi2 dn: olcDatabase={0}config,cn=config changetype: modify delete: olcAccess

3 4

Query: simple authenticated bind request
by Vinay Kalkoti 03 Aug '10

03 Aug '10

Hi, I am trying to setup OpenLDAP client with user/password authenticated bind to authenticate against an OpenLDAP server. This is how my /etc/ldap.conf look like host xx.xx.xx.xx base dc=my_comp,dc=com bind_policy soft pam_lookup_policy yes pam_password exop nss_initgroups_ignoreusers root,ldap nss_schema rfc2307bis nss_map_attribute uniqueMember member ldap_version 3 pam_filter objectClass=posixAccount tls_checkpeer no #ssl on ssl no binddn cn=Administrator,dc=my_comp,dc=com <============ I am giving the root DN bindpw Administrator scope sub If I give the root DN, it works, But, if I give a non-root DN in binddn, I get "invalid credentials (49)" error. Does OpenLDAP server always require root DN for binding ?. Is there a way to provide non-root DN for binddn ? Thanks, Vinay

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical