openldap-technical

openldap-technical@openldap.org

7 participants
9871 discussions

Syncrepl: Reliable method to ask a server for its own URL
by Torsten Schlabach (Tascel eG) 20 Aug '10

20 Aug '10

Hi all! I do have a multi-master replication setup. So I do have an olcServerID attribute with multiple values, for example: dn: cn=config olcServerID: 1 ldap://ldapserver1.some.tld/ olcServerID: 2 ldap://ldapserver2.some.tld/ olcServerID: 3 ldap://ldapserver3.some.tld/ I understand that the meaning of this is: Each server will pick the attribute value which matches its own URL to determine the actual ServerID to be used in contextCSN generation, right? So if the server listening to ldap://ldapserver2.some.tld/ will come up, it will pick the attribute value "2 ldap://ldapserver2.some.tld/" and thus decide that its serverID is 2 in this case. I also understand that this mechanism has been created to allow the cn=config database to be replicated across all servers which are part of the cluster. Now obviously, if I made a mistake here, for example I make a typo: dn: cn=config olcServerID: 1 ldap://ldapserver1.some.tld/ olcServerID: 2 ldap://ldapsrever2.some.tld/ olcServerID: 3 ldap://ldapserver3.some.tld/ the server ldap://ldapserver2.some.tld/ will not find its entry and thus its serverID will default to 0, right? And I guess this will lead to results of the sychronization which are not what I expect. Of course I can carefully watch the config to guess what the effective ServerID *should* be. But would there be any way to actually query the server for what it thinks its ID is? I tried ldapsearch -x -D 'cn=admin,cn=config' -w XXXX -b '' -s base olcServerID but this also just gives me: # config dn: cn=config olcServerID: 1 ldap://192.168.5.11:389/ olcServerID: 2 ldap://192.168.5.12:389/ olcServerID: 3 ldap://192.168.9.2:389/ in my case. I guess I may have to query -b "", right? Any hints are welcome. I hope I was able to make my question clear. Regards, Torsten

2 1

pass-through authentication
by Brent Bice 20 Aug '10

20 Aug '10

I tried to send this yesterday but didn't see it come back from the list (and didn't see any replies). So I'll try once more. Apologies if anyone gets this twice. I've been trying to get Pass-Through authentication to work using a userPassword attribute of the form {SASL}username@realm. Is there a way to tell slapd what pathspec to use to talk to saslauthd? (I'm guessing maybe it's using one path but saslauthd is using a different one for the socket file) I've got saslauthd running ok and can authenticate using testsaslauthd so I'm fairly sure saslauthd is configured right and working. And I've got openldap compiled with --enable-spasswd option so it ought to support the SASL pass-through option, right? I ran saslauthd with debugging on so I can see every auth request and whether it succeeds or fails and I can see it when testsaslauth connects and succeeds. But when I try to bind to slapd using the DN whose userPassword is {SASL}bbice@ldap the authentication to slapd fails and saslauthd doesn't show any authentication attempt at all. It's as if it's not even trying (or can't find) saslauthd. I ran slapd with the -d 255 option and saved the output to a file. Here's all the lines containing the string sasl: >>> dnPretty: <cn=SASL> => ldap_bv2dn(cn=SASL,0) <= ldap_bv2dn(cn=SASL)=0 <= ldap_dn2bv(cn=SASL)=0 <<< dnPretty: <cn=SASL> >>> dnNormalize: <cn=SASL> <<< dnNormalize: <cn=sasl> ldap_sasl_bind_s ldap_sasl_bind SASL Canonicalize [conn=1000]: authcid="bbice@ldap" SASL Canonicalize [conn=1000]: authcid="bbice@ldap" SASL Canonicalize [conn=1001]: authcid="bbice@ldap" SASL Canonicalize [conn=1001]: authcid="bbice@ldap" So if I'm reading that right, slapd does see that it's supposed to hand off the authentication to saslauthd and it has picked out the username and realm. But it doesn't seem to be connecting to or using saslauthd. Any ideas? What am I missing here? Brent Bice bbice(a)sgi.com

2 1

OpenLDAP as a proxy for Active Directory (missing attributes)
by Marius Flage 20 Aug '10

20 Aug '10

I've been banging my head against the wall with this project for the last months and still haven't found a decent solution for my problem. I'm trying to set up OpenLDAP to act as a proxy for Active Directory. OpenLDAP should be the internet-facing interface for all external queries for the AD catalog. I've gotten the connection set up and I'm able to retrieve and search for most important values. However, when I try to get out the group membership of the different objects, I've encountered some problems. When doing a search directly towards Active Directory I can see the memberOf attributes for the objects [1], but when I perform the very same search through the proxy, those attributes have been ignored/stripped away from the result [2]. I've tried including schemas for Active Directory found on the internet (like http://www.grotan.com/ldap/microsoft.schema), but if I try to include this in OpenLDAP I get lots and lots of errors and I have to start commenting out different attributes and objecttypes to get OpenLDAP to start. Example of errors are stuff like: /etc/ldap/schema/microsoft2.schema: line 30 objectclass: AttributeType not found: "remoteSource" And then I comment out the objectclass and retry. And this basically goes on and on forever. I've also tried just including the attribute I'm looking for, namely memberOf, like so: attributetype ( 1.2.840.113556.1.2.102 NAME 'memberOf' SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' NO-USER-MODIFICATION ) And then I get the following error when I try to start slapd: /etc/ldap/schema/activedirectory.schema: line 60 attributetype: AttributeType inappropriate USAGE: "memberOf" /etc/ldap/slapd.conf: line 15: <include> handler exited with 1! So my question is basically; how can I get the memberOf attribute included in my searches through OpenLDAP? Do I need to include the schema or am I approaching this from the wrong angle? What needs to be done to set up OpenLDAP as a complete transparent proxy towards Active Directory - basically having it behave as it was the AD itself answering whenever you query the proxy? I'd be very grateful for whatever question or feedback I can get, since this has been bothering me for a very long time now. I've also included my slapd.conf file [3] and the schema [4] I've tried including. - Marius [1] http://pastebin.com/E6GVViGE [2] http://pastebin.com/W28KPSky [3] http://pastebin.com/T5Wd4JEB [4] http://pastebin.com/8AGtnj2Q

2 1

Dynamic posixGroup, dynlist overlay
by Wiktor Warmus 19 Aug '10

19 Aug '10

Hi, I'm trying to use dynlist overlay as dynamic group container. system config: OS: debian lenny slapd: 2.4.11-1 slapd.conf [...] moduleload dynlist overlay dynlist dynlist-attrset groupOfNames labeledURI member When I do a search like: ldapsearch -x cn=ssh_admin I get: # extended LDIF # # LDAPv3 # base <dc=domain,dc=com> (default) with scope subtree # filter: cn=ssh_admin # requesting: ALL # # ssh_admin, Server, domain.com dn: cn=ssh_admin,ou=Server,dc=domain,dc=com objectClass: groupOfNames objectClass: labeledURIObject objectClass: top objectClass: posixGroup cn: ssh_admin member: uid=user1,ou=People,dc=domain,dc=com member: uid=user2,ou=People,dc=domain,dc=com labeledURI:ldap:///ou=People,dc=domain,dc=com??sub?(&(objectClass=posixAccount)) gidNumber: 30000 user1 is added manually, since at least one member attribute is required by groupOfNames (posixGroup is an auxiliary type) And such a request: ldapsearch -x "(member=uid=user1,ou=People,dc=domain,dc=com)" results in: # extended LDIF # # LDAPv3 # base <dc=domain,dc=com> (default) with scope subtree # filter: (member=uid=user1,ou=People,dc=domain,dc=com) # requesting: ALL # # ssh_admin, Server, domain.com dn: cn=ssh_admin,ou=Server,dc=domain,dc=com objectClass: groupOfNames objectClass: labeledURIObject objectClass: top objectClass: posixGroup cn: ssh_admin member: uid=user1,ou=People,dc=domain,dc=com member: uid=user2,ou=People,dc=domain,dc=com labeledURI:ldap:///ou=People,dc=domain,dc=com??sub?(&(objectClass=posixAccount)) gidNumber: 30000 BUT with this one, which is a search done by a linux system when, e.g. doing id user2: ldapsearch -x "(member=uid=user2,ou=People,dc=domain,dc=com)" I get: # extended LDIF # # LDAPv3 # base <dc=domain,dc=com> (default) with scope subtree # filter: (member=uid=user2,ou=People,dc=domain,dc=com) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 My question is: how to make use of dynlist to get it working with a linux system, to automate group assignments. Or is there another way to do it? The goal is to have a dynamic posixGroups generated upon some specified filters, as shown in the example, to manage the authorization to a service (for instance sshd). Thanks for any suggestions and help. -- Wiktor Warmus

1 0

Notification of userPassword change in OpenLDAP?
by Tom Leach 19 Aug '10

19 Aug '10

I'm trying to work on a password sync scheme between OpenLDAP and some systems that use flat Unix passwd/shadow files. I have been able to update the LDAP server when someone changes their password on the standalone Unix systems, but I'm having problems trying to get any kind of notification from the LDAP server if someone from a system using the LDAP directory changes their password. So far, I'm looking at searching the LDAP directory every few minutes for any entries that have had their modifyTimestamp attribute change since the last time the search ran, then checking to see if the userPassword attribute in the LDAP directory is different then the shadow file on the Unix system. This seems like a real stupid scheme, especially when passwords are changed infrequently. I just don't want a long delay between syncing the directory and flat files in case someone changes their password on an LDAP client, then tries to log into the flat file system. Ideally, there could be some option in OpenLDAP that could call an external program when some attribute(s) have changed. That program could then perform the necessary searches and update the flat files if appropriate. So far, I've found nothing indicating that this is possible so I figured I'd ask and see if anyone else has tried this and what they found. Thanks! Tom Leach leach(a)coas.oregonstate.edu

3 2

Unable to start
by VANTASSLE, GEORDON M (ATTSI) 18 Aug '10

18 Aug '10

I finally got everything compiled, and the make test worked like a charm. However, when I try to manually start LDAP via the rc.openldap script, I get: $ ./test.rc.openldap start Starting test.rc.openldap service(s) --------------------------------- Tue-Aug-17-14.23.51-2010 --------------------------------- STATUS: LDAP start attempt logged to /opt/app/ivr/openldap/openldap-2.4.11/var/logs/SystemOut.log STATUS: Waiting for ldap to finish the start sequence STATUS: Waiting for ldap to finish the start sequence STATUS: Waiting for ldap to finish the start sequence STATUS: Waiting for ldap to finish the start sequence STATUS: Waiting for ldap to finish the start sequence STATUS: Waiting for ldap to finish the start sequence ERROR: Unable to successfully start ldap within time limit --------------------------------- Tue-Aug-17-14.24.54-2010 --------------------------------- Is there some way that I can see what is going on with this? I don't know anything about LDAP, but my client requires it for one of their apps, so I would appreciate the help. Thanks, Geordon

3 2

(no subject)
by VANTASSLE, GEORDON M (ATTSI) 18 Aug '10

18 Aug '10

I'm at a loss as to what to do next. I'm running on RHEL 5 and installing as a non-root user. I get the following message when trying to start a fresh install of openLdap: $ ./slapd ./slapd: error while loading shared libraries: libltdl.so.3: cannot open shared object file: No such file or directory $ locate libltdl.so.3 /usr/local/lib/libltdl.so.3 /usr/local/lib/libltdl.so.3.1.4 /usr/share/libtool/libltdl/.libs/libltdl.so.3 /usr/share/libtool/libltdl/.libs/libltdl.so.3.1.4 This is what I used to configure the install: CPPFLAGS="-DOPENLDAP_FD_SETSIZE=8192 -I /opt/app/ivr/openldap/tools /include -I/usr/local/opt/gnu/include -I/usr/include -I/usr/local/lib" \ CFLAGS="-g" \ LDFLAGS="-g -L${TOOLS_HOME}/lib -R /opt/app/ivr/openldap/tools /lib -L/usr/local/opt/gnu/lib -R/usr/local/opt/gnu/lib -I/usr/lib -R/usr/lib" \ LD_RUN_PATH /opt/app/ivr/openldap/tools /lib \ ./configure \ --without-subdir \ --with-tls \ --with-cyrus-sasl \ --enable-spasswd \ --enable-shared \ --enable-dynamic \ --enable-slapd \ --enable-modules \ --enable-rewrite \ --enable-rlookups \ --enable-wrappers \ --enable-backends=mod \ --disable-shell \ --disable-sql \ --enable-overlays=mod \ --disable-slurpd \ --enable-multimaster \ --enable-syslog \ --prefix= /opt/app/ivr/openldap/ openldap-2.4.11 Any suggestions on where I should go from here would be greatly appreciated. Thanks, Geordon

3 3

pwdMustChange and pwdExpireWarning
by Wei Gao 18 Aug '10

18 Aug '10

I have pwdMustChange set to true in my default ppolicy. I tried to change a user's password EITHER as Manager on LDAP server OR via the following command on my LDAP server ldappasswd -x -D "cn=Manager,dc=example,dc=company" -W -S "uid=user1,ou=People,dc=example,dc=company" Since I have pwdMustChange set to true, the user should be required to change his password when he tries to log in next time. But the system doesn't prompt the user to change his password. And when I ran slapcat -a '(uid=user1)', I saw most Operational Attributes except pwdReset. All my settings seem to be correct. I couldn't figure out what is wrong here. One other question I have is: In my default ppolicy, I have pwdExpireWarning set to 1209600 (14 days). My current password is going to expire in 12 days, how come I don't see a warning message when I ssh to my system? Thank you for your help. Regards Wei

3 5

Re: multi / standby master: incomplete replication after downtime (?)
by Elmar Marschke 18 Aug '10

18 Aug '10

Am 18.08.2010 17:16, schrieb Rein Tollevik: > On 08/18/2010 04:28 PM, Elmar Marschke wrote: > >> Here's the logfile of MASTER: >> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ >> ===_BEGIN_CHANGES_WHILE_BOTH_UP_=== >> Aug 18 15:30:04 ldapmaster slapd[8017]: slap_queue_csn: queing >> 0x7f00f317b580 20100818133004.663851Z#000000#000#000000 > > Your ServerID setting is incorrect, and you are using the default > ServerID=0 on both systems. The ServerID is included in the csn value, > the second to last number (#000# here). Ensure that the ServerID URL is > the exact hostname of the systems it runs on, or that slapd is able to > select the correct sid based on its -h listener argument. > > Start slapd with -d config and verify that both logs lines with > differing SID= values. > > Rein > hey folks, thanks a lot; hope is coming back ;) Unfortunately i'll be out of office from now on until 25th august, because of relocation. My testservers in the office are already switched off, and i'm at home already. So i can't check anything right now.. But /etc/hosts should be correct on both systems; i've written the names in there. I'd be glad to come back to you next wednesday ..:) best regards elmar

1 0

multi / standby master: incomplete replication after downtime (?)
by Elmar Marschke 18 Aug '10

18 Aug '10

Hi all, i set up a multi master scenario using 2.4.21 on two servers. Online config (slapd.d) and ldap content is replicated fine, as long as both servers are up (means: i can change objects using ANY of the servers; and changes are transferred immediately to the other one. (Later in production, there will just one server be used actively, the other one shall be used by the clients just in case of failure)). Then i shut down one of the servers, and do changes on the remaining one. I expect the switched-off server to get ALL the latest changes from the online-server as soon as it's up again. But this seems to happen only partially; for example: - deletion of a user object works ( = shows up on the former switched-off server immediately after coming up again) - adding of a user does not - changing just subordinate attributes of user objects, like telephone number, does not show up. It just gets replicated to the former switched-off machine, when something else of that object is changed while both servers are alive. So finally i end up with different content on every machine... Did i miss something about how that works ?? Or is my config wrong for that; example: syncrepl rid=001 provider="ldap://ldapmaster.local.site" type=refreshAndPersist retry="5 +" searchbase="dc=local,dc=site" bindmethod=simple binddn="cn=replicator,dc=local,dc=site" credentials="<secret>" Thanks for help... PS: my setup / slapd.conf is according to the book "openLDAP 2.4" by Oliver Liebel & John Martin Ungar. -- elmar

4 7

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical