openldap-technical

openldap-technical@openldap.org

1 participants
9868 discussions

Query: simple authenticated bind request
by Vinay Kalkoti 03 Aug '10

03 Aug '10

Hi, I am trying to setup OpenLDAP client with user/password authenticated bind to authenticate against an OpenLDAP server. This is how my /etc/ldap.conf look like host xx.xx.xx.xx base dc=my_comp,dc=com bind_policy soft pam_lookup_policy yes pam_password exop nss_initgroups_ignoreusers root,ldap nss_schema rfc2307bis nss_map_attribute uniqueMember member ldap_version 3 pam_filter objectClass=posixAccount tls_checkpeer no #ssl on ssl no binddn cn=Administrator,dc=my_comp,dc=com <============ I am giving the root DN bindpw Administrator scope sub If I give the root DN, it works, But, if I give a non-root DN in binddn, I get "invalid credentials (49)" error. Does OpenLDAP server always require root DN for binding ?. Is there a way to provide non-root DN for binddn ? Thanks, Vinay

1 0

How to properly initialize the LDAP client library
by Ian Anderson 03 Aug '10

03 Aug '10

I'm using both libldap and libsasl2 in my application on Mac OS X. libldap itself uses libsasl2 internally on that platform, and it changes some of the libsasl2 globals (namely the mutex functions) during its initialization. My app uses libldap only in response to user actions, so libldap initialization happens at a fairly random time. This means the libsasl2 globals end up changing on me after I've been using libsasl2 for awhile in my app's lifecycle, and I end up getting random crashes because the mutex functions are all different from when I initially created the sasl client connection. So, my solution to this was to initialize libldap myself on app launch so that it can set up the libsasl2 environment as it wants to. I looked at the manual page for ldap(3) and ldap_initialize(3), and they seemed to suggest that I should use ldap_get_option to initialize OpenLDAP. Which option should I ask for though? I tried LDAP_OPT_API_INFO, but that ends up doing a DNS query which can really balloon my launch time depending on my network configuration. Is there a better option I could do that basically does nothing but initialize a few innocuous OpenLDAP globals without doing a significant amount of work? Ian

1 0

ldap_start_tls: Connect error (-11)
by Russell Knighton 02 Aug '10

02 Aug '10

Hi Everyone, I'm trying to set-up an new openldap service utilising TLS. At the moment, it all appears to work fine with out TLS, but unfortunately it always fails with it. The service is running on neptune.mps.lan (with a CNAME for ldap), and my client desktop box is called blacktip. The server is Ubuntu 10.04 LTS server, and the desktop is also Ubuntu 10.04; both with latest updates. I have created a Self signed CA and, after setting up the server keys, I have installed this onto the client. I then added the following line to the client /etc/ldap.conf: TLS_CACERT /etc/ssl/certs/slapd-ca-cert.pem This is the command I am running to test the connection: root@blacktip:~# ldapsearch -d 16383 -x -h ldap.mps.lan -ZZ -b dc=mps,dc=lan ldap_create ldap_url_parse_ext(ldap://ldap.mps.lan) ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP ldap.mps.lan:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.0.0.203:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x7f1965937630 ptr=0x7f1965937630 end=0x7f196593764f len=31 0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ber_scanf fmt ({) ber: ber_dump: buf=0x7f1965937630 ptr=0x7f1965937635 end=0x7f196593764f len=26 0000: 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e w...1.3.6.1.4.1. 0010: 31 34 36 36 2e 32 30 30 33 37 1466.20037 ber_flush2: 31 bytes to sd 3 0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ldap_write: want=31, written=31 0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ldap_result ld 0x7f196592f3a0 msgid 1 wait4msg ld 0x7f196592f3a0 msgid 1 (infinite timeout) wait4msg continue ld 0x7f196592f3a0 msgid 1 all 1 ** ld 0x7f196592f3a0 Connections: * host: ldap.mps.lan port: 389 (default) refcnt: 2 status: Connected last used: Mon Aug 2 16:48:35 2010 ** ld 0x7f196592f3a0 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x7f196592f3a0 request count 1 (abandoned 0) ** ld 0x7f196592f3a0 Response Queue: Empty ld 0x7f196592f3a0 response count 0 ldap_chkResponseList ld 0x7f196592f3a0 msgid 1 all 1 ldap_chkResponseList returns ld 0x7f196592f3a0 NULL ldap_int_select read1msg: ld 0x7f196592f3a0 msgid 1 all 1 ber_get_next ldap_read: want=8, got=8 0000: 30 0c 02 01 01 78 07 0a 0....x.. ldap_read: want=6, got=6 0000: 01 00 04 00 04 00 ...... ber_get_next: tag 0x30 len 12 contents: ber_dump: buf=0x7f1965938e50 ptr=0x7f1965938e50 end=0x7f1965938e5c len=12 0000: 02 01 01 78 07 0a 01 00 04 00 04 00 ...x........ read1msg: ld 0x7f196592f3a0 msgid 1 message type extended-result ber_scanf fmt ({eAA) ber: ber_dump: buf=0x7f1965938e50 ptr=0x7f1965938e53 end=0x7f1965938e5c len=9 0000: 78 07 0a 01 00 04 00 04 00 x........ read1msg: ld 0x7f196592f3a0 0 new referrals read1msg: mark request completed, ld 0x7f196592f3a0 msgid 1 request done: ld 0x7f196592f3a0 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_parse_extended_result ber_scanf fmt ({eAA) ber: ber_dump: buf=0x7f1965938e50 ptr=0x7f1965938e53 end=0x7f1965938e5c len=9 0000: 78 07 0a 01 00 04 00 04 00 x........ ldap_parse_result ber_scanf fmt ({iAA) ber: ber_dump: buf=0x7f1965938e50 ptr=0x7f1965938e53 end=0x7f1965938e5c len=9 0000: 78 07 0a 01 00 04 00 04 00 x........ ber_scanf fmt (}) ber: ber_dump: buf=0x7f1965938e50 ptr=0x7f1965938e5c end=0x7f1965938e5c len=0 ldap_msgfree tls_write: want=93, written=93 0000: 16 03 02 00 58 01 00 00 54 03 02 4c 56 e8 d3 01 ....X...T..LV... 0010: 2e bb 5d b7 71 7e ec ab 4c e0 6a 32 63 85 76 88 ..].q~..L.j2c.v. 0020: b9 12 b3 fc e3 56 fe 2a db 9a 0d 00 00 24 00 33 .....V.*.....$.3 0030: 00 45 00 39 00 88 00 16 00 32 00 44 00 38 00 87 .E.9.....2.D.8.. 0040: 00 13 00 66 00 2f 00 41 00 35 00 84 00 0a 00 05 ...f./.A.5...... 0050: 00 04 01 00 00 07 00 09 00 03 02 00 01 ............. tls_read: want=5, got=0 TLS: can't connect: A TLS packet with unexpected length was received.. ldap_err2string ldap_start_tls: Connect error (-11) additional info: A TLS packet with unexpected length was received. As you can see, the TLS connection fails to negotiate. I have extensively googled this error but have not yet found a cause nor a solution. OpenLDAP server version: root@neptune:~# slapd -V @(#) $OpenLDAP: slapd 2.4.21 (Apr 26 2010 11:08:43) $ buildd@yellow:/build/buildd/openldap-2.4.21/debian/build/servers/slapd Gnutls Library Version: root@neptune:~# aptitude show libgnutls26 | grep ^Ver Version: 2.8.5-2 Many thanks in advance for any help/advice given. Kind Regards, Russell Knighton --

2 3

Replication and uniqueness overlay
by Ondrej Kuznik 02 Aug '10

02 Aug '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, is there a way to disable uniqueness checking for replicated content? Our problem is that we have a database with no uniqueness checking and when trying to replicate to an enforcing one, it rejects the first offending entry and makes both nodes trying to restart the replication again and again, eating both traffic and cpu capacity. Thanks, Ondra Kuznik -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkxWsI8ACgkQ9GWxeeH+cXszhQCgpKo28Yas1/LEJ8vWqFl8SzB/ VzAAn1IwVwZQdY0bommYNa2LesqkZa7N =Ing2 -----END PGP SIGNATURE----- This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

1 0

back-sql mysql innodb
by Frederik Bosch 31 Jul '10

31 Jul '10

Hi all, Two weeks ago I also wrote to this mailinglist, but now my problem is much more clear. I succesfully installed slapd and managed to start it with back-sql. However, I have one problem. Once slapd has retrieved childs from a certain entry, it is not able to refresh it. A slapd restart is needed for that. The problem is due to the MySQL engine used: InnoDB. I discovered that when I converted my database to MyISAM, which had no problems at all. Upgrading myodbc to version 5.1.6 (I as on 3.51 before) did not help. Converting to MyISAM is not an option and was just for testing. Restarting the server each 5 minutes looks like a ugly solution to me. What could be wrong? Thank you. Frederik Bosch

2 4

Hmm. No one seems to be able to answer my question about SSL connections
by Bryan Boone 30 Jul '10

30 Jul '10

So I will try once more. I have successfully setup an openldap server using TLS. I generated self sign certs using http://www.openldap.org/faq/data/cache/185.html I have succussfully setup a client computer on a different computer than the server. I copied the cacert.pem to my client computer I can successfully run ldapsearch with the -ZZ option on the client PC. Now I want to write a client program in C that I can put on any PC, that will automatically download cacert.pem from the openldap server, and prompt a user to accept or reject the cacert.pem. If they accept it, I want to store the cert in the /etc/ssl/certs directory. If they do not accept the cert, I want to stop the connection. How do I accomplish this? I don't see any openldap functions that help me do this.

3 2

understanding referrals
by Khaled Blah 29 Jul '10

29 Jul '10

Hello all, I'm writing an LDAP application using OpenLDAP. First of all, thanks to the many contributors to this project! It's highly appreciated! Now, I'm trying to understand how I can implement an application that knows how to deal with referrals. I've implemented a function which I assign via ldap_set_rebind_proc, however I am not entirely sure what to do within this function that I assign to ldap_set_rebind_proc. What I've done so far is to parse the url parameter using ldap_url_parse and then assign the data from the LDAPURLDesc structure to my own data structure. Then I call ldap_init and ldap_bind_s in order to bind to the referral. However, it seems I am doing something wrong. Can anyone here give me any hints as to what to within that function that is assigned to ldap_set_rebind_proc? Thanks in advance! Regards, Khaled

1 0

DIT entry layout - multiple mail fields, mutiple mailboxes.
by Lauro Costa G. Borges 28 Jul '10

28 Jul '10

Is it possible to have an user entry with multiple "mail" fields mapping to multiple mailboxes (or mailroutingaddress, or something similar)? What I want is to group together "mail" field and "mailroutingaddress"(or maildrop) below an user entry (by "user entry" I mean a DN with obj. classes like inetorgperson, eduperson, postfixuser, etc): - "userdn" -- attr foo -- attr bar -- obj class xyz -- obj class abc -- "some sort of container" --- mail field --- "mail destination" field -- "another container" --- mail field 2 --- "mail destination" field 2 Note that lines with 3 "-"'s are children of lines with 2 "-"'s. However, if there is another way to accomplish this without "child" entries or "containers", please tell me. Thanks ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

1 0

Finiky old OpenLDAP Server: To be or not to be...
by Kendall Gifford 28 Jul '10

28 Jul '10

Sorry for the somewhat vague email title but it is actually somewhat descriptive of a problem I'm having. I also apologize if this is the incorrect list for this question (I first subscribed to openldap-software@... but upon subscription the "welcome" message said it had been shut down and to use this list instead). I'm pretty new to the whole OpenLDAP (and LDAP in general) thing. I'm running an old OpenLDAP server (2.2.29) in a production environment. I recently needed to add some extra schema definitions for my postfix email server (attached as postfix.schema). I edited my slapd.conf file and included my schema file, then restarted the server. All is good so far... Skipping ahead in my story, to test things out I created the following LDIF below: dn: mailDomain=example.com,ou=Email,dc=EXAMPLE,dc=COM mailDomain: example.com objectClass: top objectClass: mailDomainEntry mailDomainVirtual: FALSE The "organization unit" named "Email" already existed. I then ran sladadd: $ sudo slapadd -v -l data.ldif added: "mailDomain=example.com,ou=Email,dc=EXAMPLE,dc=COM" (0000023e) I then ran ldapsearch to dump everything at or under my "Email" ou: $ ldapsearch -x -b "ou=Email,dc=EXAMPLE,dc=COM" This dumped the Email organization unit entry and nothing else. So, on a whim I re-ran the above slapadd command to retry adding a sub-entry beneath my "Email" entry. This time I got the following error: slapadd: could not add entry dn="mailDomain=example.com,ou=Email,dc=EXAMPLE,dc=COM" (line=6): txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) So, apparently it DID get added as this says it "already exists". Hmm, so I'll try to delete it: $ sudo ldapdelete -vx -D "cn=root,dc=EXAMPLE,dc=COM" \ -W "mailDomain=example.com,dc=EXAMPLE,dc=COM" ldap_initialize( <DEFAULT> ) Enter LDAP Password: ******** deleting entry "mailDomain=example.com,dc=EXAMPLE,dc=COM" Delete Result: No such object (32) Matched DN: dc=EXAMPLE,dc=COM So, now it doesn't exist? "To be or not to be?" Hmm. Anyhow, I've tried many search queries and used tools like phpLDAPadmin and JXplorer and cannot find this entry I've created/added. The only command/tool that claims it exists is slapadd when I try to add the same entry again. I know my server version is very very old (2005-ish?) but does anyone have any ideas or recommendations (besides the obvious "save/export your data and upgrade your server" kind which isn't an immediate option). Thanks in advance. I'm hoping I'm just doing something obviously stupid. -- Kendall Gifford

2 1

rebinding and following referrals on bind
by Arthur de Jong 27 Jul '10

27 Jul '10

Hello list, Is there a way to follow a referral on bind? I'm trying to get the PAM module in nss-pam-ldapd to follow referrals while binding. Background is available here [1]. If ldapserver1 refers a subtree to another server (server2) searches for a user are correctly continued on server2 (using ldap_set_rebind_proc()) but when I try to call ldap_simple_bind_s() on the connection that just returned the user from server2 I get "Invalid credentials". Is there a way to find out which LDAP server returned a specific entry or is there some other way to solve this? Thanks for any pointes. [1] http://lists.arthurdejong.org/nss-pam-ldapd-users/2010/msg00097.html -- -- arthur - arthur(a)arthurdejong.org - http://arthurdejong.org --

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical