openldap-technical

openldap-technical@openldap.org

1 participants
9989 discussions

rwm rewrite
by Mark Coetser 09 Sep '10

09 Sep '10

Hi I have googled and read over slapo-rwm man page, some great examples there BUT I cant seem too grasp the rewrite rule. Basically I have merged a couple of individual openldap directories under a meta database which works fine. Some of the individual directories have clashing posix uidnumber attributes ie uid=joe,dc=subdomain1,dc=test uidnumber: 1023 uid=soap,dc=subdomain2,dc=test uidnumber: 1023 uid=user2,dc=sudomain2,dc=test uidnumber: 1024 what I am trying too do is create a rwm overlay that would rewrite the uidnumber attribute for subdomain2 so add a 10 in front of each uidnumber for each user in the subdomain database. ie uid=soap,dc=subdomain2,dc=test uidnumber: 101023 uid=user2,dc=sudomain2,dc=test uidnumber: 101024 -- Thank you, Mark Adrian Coetser mark(a)tux-edo.co.za http://www.tux-edo.co.za http://www.tux-voip.co.za cel: +27 76 527 8789 fax: +27 86 677 4117

2 2

Authenticate to ldap using Kerberos
by Wouter van Marle 08 Sep '10

08 Sep '10

Hi group, I have been fighting the whole day already for something that I think is quite simple but I just can't get it to work: have slapd authenticate users against kerberos. Following many tutorials, trying many things, I give up on that and ask for your help. System: Debian Lenny. Situation: - workstation logins over the network authenticate against kerberos - credentials from LDAP - postfix has its alias database etc in LDAP, as are the groups and userIDs and everything - helps keeping uids the same on the workstations. Essential for NFS. - anything using pam will be authenticated against kerberos, including imap, postfix, etc. Except LDAP. Then slapd authenticates by itself against the password stored there. And that's not what I want. There should be no passwords in LDAP any more, everything against kerberos. Then at least when a user changes their kerberos password, the same password is used everywhere. I just can't get this to work for some reason. I have followed many tutorials, so many that I forgot what I did, and it still doesn't work. Slapd should use pam to authenticate, or directly talk to the kerberos server, whatever. saslauthd has the gssapi module installed. I have created an ldap/acorn.squirrel@SQUIRREL key, and added this keytab in /etc/defaults/slapd. acorn.squirrel is the fqdn of the server, SQUIRREL is its kerberos realm. My clients all run Ubuntu 10.04 LTS (a nice desktop but shitty to get kerberos/ldap authentication work on amongst other griefs). Current situation after all the hacking: $ ldapwhoami -x -D 'uid=wouter,ou=people,dc=squirrel' -W -h acorn.squirrel Enter LDAP Password: ldap_bind: Invalid credentials (49) when entering my Kerberos password; it accepts my credentials when I enter the LDAP stored password (a different password). Then I just did: ======================= wouter@acorn:~$ ldapsearch -LLL -s base -b '' '(objectClass=*)' + SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80) wouter@acorn:~$ klist Ticket cache: FILE:/tmp/krb5cc_1000_5lYS4w Default principal: wouter@SQUIRREL Valid starting Expires Service principal 09/08/10 22:42:07 09/09/10 08:42:07 krbtgt/SQUIRREL@SQUIRREL renew until 09/09/10 22:42:07 09/08/10 22:46:39 09/09/10 08:42:07 ldap/acorn.squirrel@SQUIRREL renew until 09/09/10 22:42:07 Kerberos 4 ticket cache: /tmp/tkt1000 klist: You have no tickets cached ======================= OK it seems ldap gets it's ticket. Issued the moment I ran the above command. Still I get the bind error. But for some reason I do not have a ticket myself, interesting. Running kinit doesn't solve this strangely enough, on the workstations it does give me a ticket. And running kinit kills the ldap ticket. Appears strange to me. Any ideas? I probably miss something very simple... it shouldn't be that hard to have slapd get its credentials from kerberos! Thanks! Wouter.

3 5

back-sql disconnects
by Frederik Bosch 08 Sep '10

08 Sep '10

While I have my slapd-server completely up and running, I do have one obstacle. The sql connection disconnects after some time of idling (MySQL server has gone away). Probably because the maximum seconds of idling has been reached. This means I have to restart slapd to fix the connection. I could open a cronjob to do that, but that's more a last-resort-solution. Is there a config option for reconnection or is there another possible solution? I could imagine that slapd would try to reconnect in case it loses sql connection because this could happen for all sort of reaons. Server information: I am on Debian Squeeze using openldap 2.4.17, recompiled with back-sql and openssl. The sql server is MySQL 5/InnoDB. I do not have full control over the sql server. So I cannot add a user without idling limit.

2 5

Re: slapd-meta idassert with SASL EXTERNAL not working correctly
by masarati＠aero.polimi.it 08 Sep '10

08 Sep '10

>> Hi, >> >> I'm trying to set up OpenLDAP as a Proxy for multiple LDAP servers >> using slapd-meta. >> The remote servers require SASL EXTERNAL authentication, so I have to >> configure TLS client auth. >> >> The relevant part of my slapd.conf looks like this: >> ------------------------------------------------- >> database meta >> suffix "dc=example" >> >> uri "ldaps://server2:636/cn=server2,dc=example" >> idassert-authzFrom "dn:*" >> idassert-bind bindmethod=sasl >> saslmech=EXTERNAL >> tls_cert=mycert.crt >> tls_key=mycert.key >> tls_cacert=trusted-ca.pem >> mode=none Add tls start here to request TLS to be established on connections (see slapd-meta(5) for details). I think this should be implicitly enabled by idassert-bind when it requires TLS (or at least its need should be documented). p.

1 0

slapd-meta idassert with SASL EXTERNAL not working correctly
by Manuel Gaupp 08 Sep '10

08 Sep '10

Hi, I'm trying to set up OpenLDAP as a Proxy for multiple LDAP servers using slapd-meta. The remote servers require SASL EXTERNAL authentication, so I have to configure TLS client auth. The relevant part of my slapd.conf looks like this: ------------------------------------------------- database meta suffix "dc=example" uri "ldaps://server2:636/cn=server2,dc=example" idassert-authzFrom "dn:*" idassert-bind bindmethod=sasl saslmech=EXTERNAL tls_cert=mycert.crt tls_key=mycert.key tls_cacert=trusted-ca.pem mode=none ------------------------------------------------- Starting slapd with this config results in anonymous authentication against "server2", even though I configured the idassert-bind to use SASL EXTERNAL with the given keys/certs. The strange thing is: When I'm starting slapd with the environment variables LDAPTLS_CERT,LDAPTLS_KEY,LDAPTLS_CACERT (same values as the options in idassert-bind), everything works (the meta backend authenticates with the given keys/certs). Why do I have to set those environment variables to get the meta backend working? And respectively, why do the tls_* options in idassert-bind have no effect (in that case)? Thanks in advance, Manuel

3 3

cannot bind to ldap other user as root
by Sandor Szalina 08 Sep '10

08 Sep '10

Hi! I have installed the openldap 2.2.13 with rpm on Red Hat Enterprise Linux ES release 4 (Nahant Update 8) I have set the TLS setting too. With the user root I can start the ldapsearch and I receive the result successfully, the ldap client can connect to the ldap server. However if I login with another user I receive the following message: ldap_bind: Can't contact LDAP server (-1) What can be the problem? Thanks for the help in advance, Sandor

3 3

ldap filter order
by DT Piotr Wadas 08 Sep '10

08 Sep '10

Hello, I have 10 000 objects with attributeA=john and 100 of these objects has also attributeB=mary both attributes are indexed. Does it make any difference between (&(attributeA=john)(attributeB=mary)) vs. (&(attributeB=mary)(attributeA=john)) I bet it is better to exclude john-matched objects from the set of 100 mary-matched objects, than exclude 100 mary-matched objects from the set of 10 000 john-matched objects, is that right? In other words - does it make sens to order complicated filters to match possible low-volume results from the left, and high-volume sets on the right? This, of course, apply to AND filters only. Regards, DT -- http://dtpw.pl/buell [ 25th anniversary of Buell - American Motorcycles ] Linux aleft 2.6.27.29-0.1_lustre.1.8.1.1-default #1 SMP drbd version: 8.3.7 (api:88/proto:86-91) pacemaker 1.0.6-cebe2b6ff49b36b29a3bd7ada1c4701c7470febe

2 1

CRL refresh
by Gianluigi Nigro 08 Sep '10

08 Sep '10

Hi, Using version 2.4.23 with TLS. In slapd.conf the TLSCACertificatePath directive specifies the directory containing the certificate for the CA and the CRL. The content of this directory is hashed with c_rehash utilities. Everything works fine, but when a client certificate is revoked (ad a new CRL is created) i must restart the server to make it upgraded with the new CRL. Is there a way to do this, without having to reboot (a hot refresh of the CRL)? Thanks. gnigro -------------------------------------------------------------------- Il contenuto di questo messaggio di posta elettronica e ogni eventuale documento a quest'ultimo allegato puo contenere informazioni la cui riservatezza e' tutelata ed e' rivolto unicamente agli effettivi destinatari i quali prendono atto del carattere non strettamente personale dei messaggi di risposta, che potranno essere noti all'organizzazione aziendale. Sono vietati la riproduzione e l'uso di questo messaggio in mancanza di autorizzazione del destinatario. Se avete ricevuto questo messaggio per errore, vogliate cortesemente chiamarci immediatamente per telefono o fax e distruggere quanto ricevuto (compresi i file allegati) senza farne copia. Qualsivoglia utilizzo non autorizzato del contenuto di questo messaggio costituisce violazione dell'obbligo di non prendere cognizione della corrispondenza tra altri soggetti.

3 2

Sunone 5.2 to openldap migration
by Arya, Manish Kumar 07 Sep '10

07 Sep '10

Hi, I have a sunone 5.2 with custom schema and acis. can you please point me to some migration guide for schema,aci, data migration from sunone to openldap ? -- Manish www.mka.in +91-(0)-9871184321 xmpp manish(a)linuxlabs.biz Public Key http://www.mka.in/keys/public.asc

2 1

search with (uidNumber>=1900) got "text: inappropriate matching request"
by Zhang Weiwu 07 Sep '10

07 Sep '10

Hello. I am not quiet sure why a search with (uidNumber>=1900) got "text: inappropriate matching request". I've checked that uidNumber is mentioned and commented in nis.schema on my openldap-2.4.10 on Debian. Thus it should be a built-in attribute. It is of integerMatch Can you give some hint how to search for all users with uid greater than 1900? Thanks! Test case: $ ldapsearch -xD uid=supertuxadmin,ou=contacts,ou=china,dc=ahk,dc=de -b ou=contacts,ou=china,dc=ahk,dc=de '(uidNumber>=1900)' o uidNumber # extended LDIF # # LDAPv3 # base <ou=contacts,ou=china,dc=ahk,dc=de> with scope subtree # filter: (uidNumber>=1900) # requesting: o uidNumber # # search result search: 2 result: 0 Success text: inappropriate matching request # numResponses: 1

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical