openldap-technical

openldap-technical@openldap.org

9 participants
9873 discussions

solaris 10 as client to openldap
by Isaac Hailperin 03 Sep '10

03 Sep '10

Hi, I am trying to set up an solaris 10 ldap client to work with an openldap server. The server serves the following profile: dn: cn=solarisbox,ou=profile,dc=acme,dc=de bindTimeLimit: 10 credentialLevel: anonymous cn: solarisbox profileTTL: 43200 searchTimeLimit: 30 defaultSearchScope: sub followReferrals: TRUE authenticationMethod: simple defaultSearchBase: dc=acme,dc=de objectClass: top objectClass: DUAConfigProfile defaultServerList: 192.168.0.5 On the solaris box, I issue: ldapclient -v init -a profileName=solarisbox 192.168.0.5 Parsing profileName=solarisbox Arguments parsed: profileName: solarisbox defaultServerList: 192.168.0.5 Handling init option About to configure machine by downloading a profile findBaseDN: begins findBaseDN: ldap not running findBaseDN: calling __ns_ldap_default_config() found 1 namingcontexts findBaseDN: __ns_ldap_list(NULL, "(&(objectclass=nisDomainObject)(nisdomain=acme.de))" rootDN[0] dc=acme,dc=de found baseDN dc=acme,dc=de for domain acme.de Proxy DN: NULL Proxy password: NULL Credential level: 0 Authentication method: 1 No proxyDN/proxyPassword required Shadow Update is not enabled, no adminDN/adminPassword is required. About to modify this machines configuration by writing the files Stopping network services Stopping sendmail [...] restart: milestone/name-services:default... success Error resetting system. Recovering old system settings. Stopping network services Stopping sendmail stop: sleep 100000 microseconds [...] top: network/ldap/client:default... restoring from maintenance state stop: network/ldap/client:default... failed: required constraint not met Stopping ldap failed with (1) Error (1) while stopping services during reset recover: stat(/var/ldap/restore/defaultdomain)=0 [...] I am not very familiar with solaris, so I just drop a few other things that I found that seemed related: cat /var/ldap/cachemgr.log [...] Thu Sep 2 17:02:19.4557 Error: Unable to read '/var/ldap/ldap_client_file': Configuration Error: No entry for 'NS_LDAP_BINDDN' found Thu Sep 2 17:02:19.4601 detachfromtty(): child failed (rc = 255). Thu Sep 2 17:32:56.9181 Starting ldap_cachemgr, logfile /var/ldap/cachemgr.log [...] I can confirm that /var/ldap/ldap_client_file does not exist. grep ldap /var/svc/log/* /var/svc/log/network-ldap-client:default.log:[ Sep 2 17:02:19 Executing start m ethod ("/lib/svc/method/ldap-client start") ] /var/svc/log/network-ldap-client:default.log:/usr/lib/ldap/ldap_cachemgr: failed . Please see syslog for details. /var/svc/log/svc.startd.log:Sep 2 17:32:57/458 ERROR: svc:/network/ldap/client: default: Method "/lib/svc/method/ldap-client start" failed with exit status 1. /var/svc/log/svc.startd.log:Sep 2 17:32:57/458: network/ldap/client:default fai led: transitioned to maintenance (see 'svcs -xv' for details) cat /var/adm/messages [...] Sep 2 17:32:56 unknown ldap_cachemgr[1134]: [ID 293258 daemon.error] libsldap: Status: 0 Mesg: Configuration Error: No entry for 'NS_LDAP_BINDDN' found Sep 2 17:32:56 unknown ldap_cachemgr[1133]: [ID 703877 daemon.error] ldap_cachemgr: failed (rc = 255). Sep 2 17:32:57 unknown svc.startd[7]: [ID 652011 daemon.warning] svc:/network/ldap/client:default: Method "/lib/svc/method/ldap-client start" failed with exit status 1. [...] I had a look at another solaris 10 machine (which I did not set up). The file /var/ldap/ldap_client_file exists, but has no entry 'NS_LDAP_BINDDN'. Also, I can't find some sort of bindDN option to ldapclient, nor can I find an attribute of that kind for the profile. Any hints on how to get this working? Isaac

1 1

OID für caseExactIA5SubstringsMatch?
by Keutel, Jochen 02 Sep '10

02 Sep '10

Hello, there are 6 matching rules for IA5 strings: - caseExactIA5Match - caseIgnoreIA5Match - caseExactIA5SubstringsMatch - caseIgnoreIA5SubstringsMatch - caseExactIA5OrderingMatch - caseIgnoreIA5OrderingMatch Only three of them are defined in RFC4517: - caseExactIA5Match (1.3.6.1.4.1.1466.109.114.1) - caseIgnoreIA5Match (1.3.6.1.4.1.1466.109.114.2) - caseIgnoreIA5SubstringsMatch (1.3.6.1.4.1.1466.109.114.3) What are the OIDs for the other three matching rules? - in OpenLDAP - is there a standard? Regards, Jochen Keutel.

4 5

Re: custom hostname for openldap/sasl is not working
by Zaar Hai 02 Sep '10

02 Sep '10

On Thu, Sep 2, 2010 at 1:22 AM, Bill MacAllister <whm(a)stanford.edu> wrote: > > Simon Wilkinson discussed the problem on the Heimdal list. > > The problem is that both the client and the server must have a > matching idea of the service principal to use in establishing the > GSSAPI connection. > > The client will use ldap/ldap.uvm.edu, as that's the only name it > knows the server by. However, the server will end up using > ldap/hostname() and therefore the two won't match, and you'll get > these errors. So what sasl-host directive is good for? It does something in fact - if I enable it and set it to ldap.example.com, GSSAPI auth stop working with the same error. Also, I've tried to set server hostname to "ldap", and hostname --fqdn returned ldap.example.com, but this did not help either. -- Zaar

2 1

Re: Unix authentication in corporate AD
by Dan White 02 Sep '10

02 Sep '10

On 1/09/10 5:12 -0500, Dan White wrote: >On 01/09/10 12:05 -0400, Edsall, William (WJ) wrote: >>Hello, Just a few questions regarding authenticating OpenLDAP (centos >>5.4) to windows active directory. >> >>I'm able to bind, I've confirmed this by changing the bind password, and >>then the bind attempt fails. However I'm unable to authenticate. > >Could you clarify a few items? > >Are you binding directly to an OpenLDAP server or an Active Directory >Server? > >Which password are you changing, the user's password in Active Directory? > >>My attempt is always as follows: su: user blabla does not exist > >With regards to OpenLDAP, a successful bind is a success authentication. > >With something like su, your trouble may be related to a 3rd party PAM or >NSS module. How does su authenticate in your environment? On 02/09/10 10:25 -0400, Edsall, William (WJ) wrote: >Hello, > I am binding to an Active Directory server. > >When I say I change the password for testing, I'm changing the bind >password in the ldap.conf file. > >I believe PAM is using the ldap module: >passwd: files ldap >shadow: files ldap >group: files ldap > >The reason I used the binddn and bind password is because I know our >active directory setup does not allow anonymous binding. So as I understand it, you are not using the OpenLDAP server, but the OpenLDAP libraries in conjunction with a PAM ldap module. Do you know which PAM module you are using? The PADL one? If so, you may want to pose this problem on the pamldap(a)padl.com mailing list, or you could post a sanitized copy of your ldap configuration here to see if someone might recognize a problem. A general trouble shooting tip would be to find out what query your PAM ldap module is submitting to the Active Directory server, and attempting to reproduce it with an ldapwhoami command, and playing with the base/scope/filter settings until you get the expected response. -- Dan White

1 0

Unix authentication in corporate AD
by Edsall, William (WJ) 02 Sep '10

02 Sep '10

Hello, Just a few questions regarding authenticating OpenLDAP (centos 5.4) to windows active directory. I'm able to bind, I've confirmed this by changing the bind password, and then the bind attempt fails. However I'm unable to authenticate. My attempt is always as follows: su: user blabla does not exist No errors end up in the messages log. My question is .. could this be because the active directory I'm trying to authenticate against doesn't have any windows services for unix installed? Should that even matter if I can bind? _______________________________________ William J. Edsall

3 2

About Installation
by Murat Can Tuna 02 Sep '10

02 Sep '10

Hi, On every ubuntu introduction there is written "The installation process will prompt you for the LDAP directory admin password and confirmation." But I don't get such a prompt. What am I missing? I logged in over ssh, could it be the reason? Is there any way to give my password manually? Also dpkg-reconfigure slapd doesn't bring something, it asks just 3 questions about ldapv2 protocol and so. But on my own computer at home there isn't such a problem, I installed and configured everything without any problem. this is the version: DISTRIB_ID=Ubuntu DISTRIB_RELEASE=9.10 DISTRIB_CODENAME=karmic DISTRIB_DESCRIPTION="Ubuntu 9.10" Thanks in Advance Murat Can Tuna

1 1

custom hostname for openldap/sasl is not working
by Zaar Hai 01 Sep '10

01 Sep '10

Good day, dear list! I'm trying to setup SASL GSSAPI authentication for openldap that listens on hostname different from the machine hostname it runs on. openldap runs on server inka.example.com. ldap/inka/example.com principal is added to ldap's keytab file. This command works just fine: ldapsearch -Y GSSAPI -H 'ldap://inka.example.com' Now: * I've added second IP to the inka.example.com * Added A record for ldap.example.com to point to that IP and setup corresponding PTR record. * Created ldap/ldap.example.com principal and added it ldap's keytab. * Even set openldap to listen only on ldap.example.com IP. But the command ldapsearch -Y GSSAPI -H 'ldap://ldap.example.com' fails with the following error in ldap log: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Wrong principal in request) I see that client successfully obtains ticket for ldap/ldap.example.com(a)EXAMPLE.COM I've tried to set sasl-host to ldap.example.com and sasl-realm to EXAMPLE.COM in slapd.conf - did not help. I've even tried to do "hostname ldap" on inka.example.com and restart slapd - same error. >From what I understand, the slapd daemon will try, before connecting the KDC server, to read the keytab file and get the key of the principal ldap/<sasl-host>#<sasl-realm>, so it looks like I'm doing the right thing, but it does not work. System: Debian testing. slapd-2.4.17-2.1 sasl-2.1.23.dfsg1-5 MIT kerberos 1.8.3+dfsg~beta1-1 Thank you in advance for help, -- Zaar -- Zaar

2 1

TLS fails
by Frederik Bosch 01 Sep '10

01 Sep '10

After getting my ACL right (thanks Dieter!), I have problems installing an official certificate. I bought a certificate at RapidSSL. Starting slapd gives me the following error. TLS init def ctx failed: -69 This error is thrown in openldap 2.4.17. Since I am on debian, slapd is compiled against GnuTLS. When I was using 2.4.11 I had another error: TLS init def ctx failed: -207 When I had a self-signed certificate I had no trouble. What could be wrong?

4 7

RE: Getting Solaris to use Openldap
by Stuart Cherrington 01 Sep '10

01 Sep '10

> Date: Fri, 27 Aug 2010 21:33:42 +1200 > From: ian(a)ianshome.com > To: stuart_cherrington(a)hotmail.co.uk > Subject: Re: Getting Solaris to use Openldap > > On 08/27/10 08:48 PM, Stuart Cherrington wrote: > > Hi, > > > > I Have an OpenLDAP 2.4.18 server on RHEL 5.3. I can get Linux clients > > to use the master by use of the /etc/ldap.conf file. I'm now trying to > > get a SOlaris 10 client to use the master by initialising with the > > default profileName. If I run: > > > > ldapclient -v init -a proxypassword=xxxxx -a > > proxydn=cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -a > > domainname=ldn.sw.com 10.2.250.15 > > > I also add a -a profileName=default Shouldn't need to add this as ldapclient takes 'default' as the default profilename if not specified. I did try it with this anyway but got same error. > > > So the 2 errors are the *NOTFOUND nisDomainObject *which is there when > > I check on the master: > > > > [root@msldap01 openldap2.4]# ldapsearch2.4 -h 10.2.250.15 -D > > cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -w xxxxx-b > > dc=ldn,dc=sw,dc=com -s base > > # extended LDIF > > # > > # LDAPv3 > > # base <dc=ldn,dc=sw,dc=com> with scope baseObject > > # filter: (objectclass=*) > > # requesting: ALL > > # > > > > # ldn.sw.com > > dn: dc=ldn,dc=sw,dc=com > > dc: ldn > > o: ldn > > associatedDomain: ldn.sw.com > > nisDomain: ldn.sw.com > > objectClass: dcObject > > objectClass: organization > > objectClass: domainRelatedObject > > *objectClass: nisDomainObject* > > objectClass: top > > > That looks OK. > > > > The other error is 'Failed to find defaultSearchBase for domain > > ldn.sw.com' > > > > [root@msldap01 openldap2.4]# ldapsearch2.4 -h 10.2.250.15 -D > > cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -w 5wap5proxy -b > > cn=default,ou=profile,dc=ldn,dc=sw,dc=com -s base > > # extended LDIF > > # > > # LDAPv3 > > # base <cn=default,ou=profile,dc=ldn,dc=sw,dc=com> with scope baseObject > > # filter: (objectclass=*) > > # requesting: ALL > > # > > Do you have a cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com entry? Yeh [root@msldap01 openldap2.4]# ldapsearch2.4 -h 10.2.250.15 -D cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -w xxxxx -b cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -s base # extended LDIF # # LDAPv3 # base <cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com> with scope baseObject # filter: (objectclass=*) # requesting: ALL # # proxyagent, profile, ldn.sw.com dn: cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com cn: proxyagent sn: proxyagent objectClass: top objectClass: person userPassword:: e0NSWVBUfXYuTWpqUDJEb3lpMXc= # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 > > > # default, profile, ldn.sw.com > > dn: cn=default,ou=profile,dc=ldn,dc=sw,dc=com > > *defaultSearchBase: dc=ldn,dc=sw,dc=com* > > authenticationMethod: simple > > followReferrals: TRUE > > profileTTL: 43200 > > searchTimeLimit: 30 > > objectClass: DUAConfigProfile > > defaultServerList: 10.2.250.15 > > credentialLevel: proxy > > cn: default > > defaultSearchScope: one > > You should add > > serviceSearchDescriptor: passwd:<people base> > serviceSearchDescriptor: group:<group base> I initially had these (and one for shadow) but they didn't make any difference the error, but I expect I'll need them when its in operation. > > -- > Ian. >

3 7

Re: TLS fails
by Marc Patermann 01 Sep '10

01 Sep '10

Frederik, no TOFU, please. :) Frederik Bosch schrieb am 01.09.2010 10:23 Uhr: > Compiling 2.4.17 with OpenSSL was more succesful than on 2.4.11. I think > that's a Debian issue. Anyway, I have my server up and running! Thanks a > lot Dieter for answering all my questions. > > But I have a minor question left. Each time I restart slapd I have to > enter the PEM pass phrase. Is there a way to remember or not prompt for > the passphrase? You have to remove the passphrase from the PEM file. i.e.: http://www.openssl.org/docs/apps/rsa.html EXAMPLES To remove the pass phrase on an RSA private key: openssl rsa -in key.pem -out keyout.pem Marc

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical