openldap-technical

openldap-technical@openldap.org

12 participants
9794 discussions

OT: Net:LDAPapi / LDAPS-Support?
by A. Schulze 26 Aug '21

26 Aug '21

Hello, I took over a service using the Perl NET::LDAPapi. Now I fail to establish an LDAPS connection. Does anybody know if that's even supported and if so, how I've to setup that? Andreas

3 4

Re: /usr/local/etc/openldap/slapd.conf: line 39: <password-hash> scheme not available ({SHA512})
by kevin martin 26 Aug '21

26 Aug '21

ah, yes, I see. I made a bad assumption that, when doing a "make" in the password module, that it would make everything there and under it, including subdirectories. going into sha2 under password and doing a make works fine. my bad. --- Regards, Kevin Martin On Thu, Aug 26, 2021 at 11:41 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Thursday, August 26, 2021 12:38 PM -0500 kevin martin > <ktmdms(a)gmail.com> wrote: > > > > > > > so I sb able to take the pw-sha2 module that I compiled for RHEL7 and > > simply move it over to RHEL8? Ugh, so ugly that we can't remake the > > module on RHEL8 (is it unsupported?) due to missing dependencies... > > The pw-sha2 module has no dependencies on any radius libraries. > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Re: 2.5.7 for RHEL8 - Question
by Dave Macias 26 Aug '21

26 Aug '21

Thank you! On Wed, Aug 25, 2021 at 3:08 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Wednesday, August 25, 2021 3:57 PM -0400 Dave Macias > <davama(a)gmail.com> wrote: > > > > > Awesome! > > > > So then, if it's already shipped, why dont I see the schema files for > > ppolicy? > > Would have thought to find it here: /opt/symas/etc/openldap/schema > > I strongly advise reading the OpenLDAP 2.5 admin guide section on > upgrading, specifically: > > < > https://www.openldap.org/doc/admin25/appendix-upgrading.html#ppolicy%20over… > > > > which directly answers your question. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

4 6

Re: /usr/local/etc/openldap/slapd.conf: line 39: <password-hash> scheme not available ({SHA512})
by kevin martin 26 Aug '21

26 Aug '21

so I sb able to take the pw-sha2 module that I compiled for RHEL7 and simply move it over to RHEL8? Ugh, so ugly that we can't remake the module on RHEL8 (is it unsupported?) due to missing dependencies... --- Regards, Kevin Martin On Thu, Aug 26, 2021 at 11:35 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Thursday, August 26, 2021 12:32 PM -0500 kevin martin > <ktmdms(a)gmail.com> wrote: > > > > > > > pw-ssha? I had a pw-sha2 module loaded but not pw-ssha. and the > > password module won't compile at this time because there's no > > radius-devel package for RHEL 8 that I can find in any repos. > > Sorry, pw-sha2 module. ;) > > If you have it instantiated and things aren't working, it would appear > it's > not actually loading as desired. But it's worked fine for me with > existing > 2.4 -> 2.5 configuration migrations, so this would be something different > on your end. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 2

Re: /usr/local/etc/openldap/slapd.conf: line 39: <password-hash> scheme not available ({SHA512})
by kevin martin 26 Aug '21

26 Aug '21

pw-ssha? I had a pw-sha2 module loaded but not pw-ssha. and the password module won't compile at this time because there's no radius-devel package for RHEL 8 that I can find in any repos. --- Regards, Kevin Martin On Thu, Aug 26, 2021 at 11:09 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Thursday, August 26, 2021 11:55 AM -0500 kevin martin > <ktmdms(a)gmail.com> wrote: > > > > > > > while trying to convert from a slapd.conf file to a cn=config style, > > slaptest displays the error as shown in the subject line. openldap 2.4 > > supported "password-hash {SHA512}" in the slapd.conf, is this simply an > > issue of password-hash not being able to be converted or is that > > *particular* password-hash line unsupported in the latest 2.5 (building > > from source)? > > It has always required that the pw-ssha contrib module exist and be loaded > in the configuration. 2.5 is no different than 2.4 in this. > > Regards, > Quanah > > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

/usr/local/etc/openldap/slapd.conf: line 39: <password-hash> scheme not available ({SHA512})
by kevin martin 26 Aug '21

26 Aug '21

while trying to convert from a slapd.conf file to a cn=config style, slaptest displays the error as shown in the subject line. openldap 2.4 supported "password-hash {SHA512}" in the slapd.conf, is this simply an issue of password-hash not being able to be converted or is that *particular* password-hash line unsupported in the latest 2.5 (building from source)? --- Regards, Kevin Martin

2 1

Re: 2.5.7 for RHEL8 - Question
by Dave Macias 25 Aug '21

25 Aug '21

Awesome! So then, if it's already shipped, why dont I see the schema files for ppolicy? Would have thought to find it here: /opt/symas/etc/openldap/schema > find /opt/ -name *ppolicy* /opt/symas/lib/openldap/ppolicy.la /opt/symas/lib/openldap/ppolicy.so /opt/symas/lib/openldap/ppolicy-2.5.so.0 /opt/symas/lib/openldap/ppolicy-2.5.so.0.1.2 /opt/symas/share/man/man5/slapo-ppolicy.5 Thank you again for the quick responses! On Wed, Aug 25, 2021 at 2:07 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Wednesday, August 25, 2021 2:33 PM -0400 Dave Macias > <davama(a)gmail.com> wrote: > > > > > Thank you Quanah for the response! > > Makes sense. > > > > One more question: > > under: /opt/symas/etc/openldap/schema/README > > It says that ppolicy is > > ppolicy.schema Password Policy Schema (work in progress) > > > > > > > > If i'm not mistaken, this would be the new ppolicy10 , yes? > > > https://datatracker.ietf.org/doc/html/draft-behera-ldap-password-policy-10 > > Actually that should be deleted from the README, thanks. But yes, the > ppolicy shipped with OpenLDAP 2.5 is based on draft 10, as documented in > the man page. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Re: 2.5.7 for RHEL8 - Question
by Dave Macias 25 Aug '21

25 Aug '21

Thank you Quanah for the response! Makes sense. One more question: under: /opt/symas/etc/openldap/schema/README It says that ppolicy is ppolicy.schema Password Policy Schema (work in progress) If i'm not mistaken, this would be the new ppolicy10 , yes? https://datatracker.ietf.org/doc/html/draft-behera-ldap-password-policy-10 Thanks! On Wed, Aug 25, 2021 at 1:27 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Wednesday, August 25, 2021 2:17 PM -0400 Dave Macias > <davama(a)gmail.com> wrote: > > > Without doing any configuration, I attempted to start the slapd > > but /opt/symas/etc/openldap/slapd.conf did not exist, since it > > was /opt/symas/etc/openldap/slapd.conf.default . Which was an easy name > > change. After that the slapd service started without issues. > > > > My question is, why are the pkg files now under /opt? > > Two reasons: > > a) It preserves the installation paths of the Symas OpenLDAP Gold product > b) Installation paths are identical regardless of host OS. While RHEL8 > has > dropped OpenLDAP server support, other OSes have not. Additionally, > RedHat > has not stopped shipping the 2.4 libldap, so we still need isolation at > that level. > > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

2.5.7 for RHEL8 - Question
by Dave Macias 25 Aug '21

25 Aug '21

Hello, I am very excited about testing this new 2.5.X version. Thank you for the release! Just testing out the prepackaged versions on a clean rocky linux install Specifically: https://repo.symas.com/soldap/rhel8/ Without doing any configuration, I attempted to start the slapd but /opt/symas/etc/openldap/slapd.conf did not exist, since it was /opt/symas/etc/openldap/slapd.conf.default . Which was an easy name change. After that the slapd service started without issues. My question is, why are the pkg files now under /opt? Before, at least in the symas-openldap pkg for 2.4.X they were installed under /etc/, /var/lib/, /usr/bin, etc. I'm assuming this was because it was meant to replace the RedHat openldap pkg.. yes? But now there is no RedHad openldap pkg for rhel8 so there is nothing to replace... Thank you, Dave

2 1

Re: OpenLDAP 2.5.5 PPA for Ubuntu 20.04 LTS
by Saša-Stjepan Bakša 24 Aug '21

24 Aug '21

On Tue, 24 Aug 2021 at 19:39, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > We don't provide any i386 data, which is what that message is saying. > I.e., your local apt command looked for an i386 architecture and was > unable > to find one. For some reason, Ubuntu still configures to look for i386 by > default. > I see it now. *root@ldap-proxy:/etc/apt# dpkg --print-foreign-architecturesi386* Well, if they did it on purpose I will not change it but I am still puzzled. > Documentation error, thank you. I'll fix that right away. :) > > You are welcome! Br Saša

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical