openldap-technical

openldap-technical@openldap.org

1 participants
9868 discussions

acls help
by Juliano Rodrigues 23 Jul '10

23 Jul '10

Hello, Im using Phamm, its an php-web front-end to manage ldap postfix virtual hosting mail env. at my Fedora 11 box (openldap 2.4.15-7). Its designed to manage multi roles access: Admin/Manager (full access) postmaster (manage accounts under own domain) account/user (manage own account only) Install instructions from Phamm autor, recommends to do an include at end of slapd.conf to phamm.acl file. But its not working here, only Admin or Manager (rootdn) can write changes. User postmaster cannot write and account users have read only access as well. Below I post phamm.acl, Please, Can anyone help me with this acls issue? Thanks! Juliano. --- phamm.acl --- access to dn.regex=".+,vd=([^,]+),o=hosting,dc=example,dc=tld$" attrs=userPassword by dn="cn=admin,dc=example,dc=tld" write by self write by anonymous auth by dn.exact,expand="cn=postmaster,vd=$1,o=hosting,dc=example,dc=tld" write by set.expand="user/vd & [$1]" write access to dn.regex=".+,vd=([^,]+),o=hosting,dc=example,dc=tld$" attrs=amavisBypassVirusChecks,quota,smtpAuth,accountActive by dn="cn=admin,dc=example,dc=tld" write by self read by dn.exact="cn=phamm,o=hosting,dc=example,dc=tld" read by set.expand="user/editAccounts & [TRUE]" write by dn.exact,expand="cn=postmaster,vd=$1,o=hosting,dc=example,dc=tld" read by set.expand="user/vd & [$1]" write access to dn.regex=".+,vd=([^,]+),o=hosting,dc=example,dc=tld$" attrs=cn,sn,uid,forwardActive,vacationActive,vacationInfo,vacationStart,vacationEnd,vacationForward,amavisSpamTagLevel,amavisSpamTag2Level,amavisSpamKillLevel by dn="cn=admin,dc=example,dc=tld" write by self write by dn.exact="cn=phamm,o=hosting,dc=example,dc=tld" read by dn.exact,expand="cn=postmaster,vd=$1,o=hosting,dc=example,dc=tld" write by set.expand="user/vd & [$1]" write access to dn.regex="^.*,vd=([^,]+),o=hosting,dc=example,dc=tld$" attrs=editAccounts by dn="cn=admin,dc=example,dc=tld" write by self read by set.expand="user/editAccounts & [TRUE]" write by dn.exact="cn=phamm,o=hosting,dc=example,dc=tld" read by * none access to dn.regex=".+,vd=([^,]+),o=hosting,dc=example,dc=tld$" attrs=objectClass,entry by dn="cn=admin,dc=example,dc=tld" write by self write by anonymous read by dn.exact="cn=phamm,o=hosting,dc=example,dc=tld" read by set.expand="user/editAccounts & [TRUE]" write by dn.exact,expand="cn=postmaster,vd=$1,o=hosting,dc=example,dc=tld" read access to dn.regex=".+,vd=([^,]+),o=hosting,dc=example,dc=tld$" attrs=amavisBypassSpamChecks,accountActive,delete by dn="cn=admin,dc=example,dc=tld" write by self read by dn.exact="cn=phamm,o=hosting,dc=example,dc=tld" read by dn.exact,expand="cn=postmaster,vd=$1,o=hosting,dc=example,dc=tld" write by set.expand="user/vd & [$1]" write access to dn.regex=".+,vd=([^,]+),o=hosting,dc=example,dc=tld$" attrs=otherPath by dn="cn=admin,dc=example,dc=tld" write by anonymous read by self read by dn.exact="cn=phamm,o=hosting,dc=example,dc=tld" read by dn.exact,expand="cn=postmaster,vd=$1,o=hosting,dc=example,dc=tld" read by set.expand="user/vd & [$1]" write access to dn.regex=".+,vd=([^,]+),o=hosting,dc=example,dc=tld$" attrs=createMaildir,vdHome,mailbox,otherTransport by dn="cn=admin,dc=example,dc=tld" write by self read by dn.exact="cn=phamm,o=hosting,dc=example,dc=tld" read by set.expand="user/vd & [$1]" read access to dn.regex="^(.+,)?vd=([^,]+),o=hosting,dc=example,dc=tld$" attrs=vd by dn="cn=admin,dc=example,dc=tld" write by self write by dn.exact="cn=phamm,o=hosting,dc=example,dc=tld" read by dn.exact,expand="cn=postmaster,vd=$2,o=hosting,dc=example,dc=tld" write by set.expand="user/vd & [$2]" write access to dn.regex="^(.+,)?vd=([^,]+),o=hosting,dc=example,dc=tld$" by dn="cn=admin,dc=example,dc=tld" write by self write by dn.exact="cn=phamm,o=hosting,dc=example,dc=tld" read by set.expand="user/editAccounts & [FALSE]" read by dn.exact,expand="cn=postmaster,vd=$2,o=hosting,dc=example,dc=tld" write by set.expand="user/vd & [$2]" write access to dn.regex=".+,o=hosting,dc=example,dc=tld$" by dn="cn=admin,dc=example,dc=tld" write by self write by dn.exact="cn=phamm,o=hosting,dc=example,dc=tld" read by anonymous auth access to dn.regex=".+,dc=tld$" by dn="cn=admin,dc=example,dc=tld" write by dn.exact="cn=phamm,o=hosting,dc=example,dc=tld" read by anonymous auth access to dn.regex=".+,ou=admin,dc=example,dc=tld$" attrs=userPassword by dn="cn=admin,dc=example,dc=tld" write by self write by anonymous auth access to dn.regex=".+,ou=admin,dc=example,dc=tld$" attrs=vd by dn="cn=admin,dc=example,dc=tld" write by self read access to dn.regex="ou=admin,dc=example,dc=tld$" by dn="cn=admin,dc=example,dc=tld" write by self read --- end ---

2 5

Global shadowMax and shadowMin
by mj romero 23 Jul '10

23 Jul '10

Hello everyone, I have a doubt. Sorry if a silly question...Is it possible to define the attributes shadowMax and shadowMin globally? ie, is it possible that all entries in the LDAP inherit those attributes of a particular entry? Thank you very much. _________________________________________________________________ Prepárate para la multitud de novedades que Hotmail tiene para ti http://explore.live.com/windows-live-hotmail

1 0

OpenLDAP, MS AD and SASLauthd
by OSHIM 23 Jul '10

23 Jul '10

hi all, i configured two systems for OpenLDAP authentication with MS AD, I have used SASLauthd between them. one is on debian and another one is on centos. But I am getting a strange problem. If I change my user password on MS AD then OpenLDAP on debian can authenticate the old passwd and the new passwd, after 1 hr the old passwd does npt get valid. and on centos Openldap can recognize the new passwd of MS AD if I change the user passwd twice at a time then the old passwd does not get valid. Anyone have got this problem? Any solution? Please help. Thanks Oshim

2 1

Design question
by Isaac Hailperin 23 Jul '10

23 Jul '10

Hi, currently I am redesigning the ldap server for a site which has about 700 users, with approximatly 200 new user per year, and maybe a little less dropping out every year. The information about the lifetime of an account is kept in a different database(mysql). Thus, in order to check if an account is expired, I need to check with that database. While this might not be the happiest situation, it is partly due to historical rereasons, partly due to other restrictions beyond my reach. In any case, there is nothing I can do about it. Now I would like to have a way to make shure that usernames and numerical uids will never get reused. Also, I would like to keep trac of who had an account, sort of a history. Two ideas came to my mind: 1. Have an "expired" flag in the schema. Records with the expired flag would be blocked from login with an appropriate acl. 2. Have an archive subtree, where expired records get moved to. The beauty of the first idea seems to me that it is very simple. The downside is that there would be two places where the expired flag would live, the ldap server and the other database (see above). Also, over the years, the number of records in the people subtree would grow and grow (not shure if this is an disadvantage though). The beauty of the second idea is that the people subtree would be "clean", containing only active accounts. The downside seems to me that it looks a bit more involved. Now I was wondering how other people have solved this, or if anyone would favor on of the solution. thank you, Isaac

3 4

How to check LDAP replication status?
by Proskurin Kirill 22 Jul '10

22 Jul '10

Hello all. I have one master LDAP and many slaves. I want to check what replication to slaves are ok - how can I do it? -- Best regards, Proskurin Kirill

5 9

Able to delete olcDbIndex config attribute, but not add it.
by Ian Collins 22 Jul '10

22 Jul '10

Hello, While attempting to add an extra index to an existing config, I was able to (accidentally!) delete the attribute, but not add it back: dn: olcDatabase={1}hdb,cn=config changetype: modify delete: olcDbIndex modifying entry "olcDatabase={1}hdb,cn=config" dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcDbIndex olcDbIndex: objectClass eq - ldapmodify: wrong attributeType at line 8, entry "olcDatabase={1}hdb,cn=config" Is this a bug, or have I done something stupid? -- Ian.

2 2

OpenLDAP authenticate the username/password with MS-AD?
by OSHIM 20 Jul '10

20 Jul '10

Hi, I need a help from you guys. Anyone know how to customize Squid, Dansguardian, Postfix, Samba to use OpenLDAP and let OpenLDAP authenticate the username/password with MS-AD? Thanks Oshim

3 26

So I finally upgraded from slurpd...
by Kolbjørn Barmen 20 Jul '10

20 Jul '10

Hello Let me start by introducing myself briefly: * I'm a sysadm at the Norwegian NREN (UNINETT) * As sysadm here, I end up doing a heck lot of things at once, and our LDAP servers are really just tiny (but important) pieces in our huge puzzle that is our network infrastructure. Point being, I dont have the capasity to "know it all", or RTFM (and comprehend) everything I'm involved with, things just tend to drop into my lap. * I'm not paricularly interested or fond of LDAP as such :) * I have also no particular interest in diving into LDAP and become some sort of LDAP-wizzard in the future I just felt mentioning the above before anyone throw me an RTFM ;) Anyways... I have at last upgraded a system from using slurpd (debian etch, slapd 2.3.30) to using replsync, at least that was the intention. Let me start with the scenario: * one master LDAP-server with a web frontend (old modified GOsa) * 30ish slave LDAP-servers spread around on various institutions * on the master LDAP-server, each institution has its own branch, like dc=foo,dc=no ; dc=bar,dc=no etc. * each slave is supposed to replacicate only its own branch, for exmple server.foo.no only has dc=foo,dc=no replicated from the master * for each dc=foo,dc=no there is an admin user, eg. cn=admin,dc=foo,dc=no that has all rights granted to the according subtree dc=foo,dc=no That in all its simplity i the scenario. With slurpd I had in masters slapd.conf entries like this: replica host="server.foo.no" suffix="dc=foo,dc=no" binddn="cn=admin,dc=foo,dc=no" credentials="f00bAr123" bindmethod="simple" tls="critical" and on the slaves, (running 2.4.23, they were upgraded some time ago): updatedn "cn=admin,dc=foo,dc=no" updateref ldap://masterserver.uninett.no/ This worked fine, apart from occations of out-of-sync every now and then. Now, with upgraded master - I have yet to get any replication working. Which sync method is most likely the best for my scenario? On master I have added: =================== ... moduleload syncprov.la moduleload back_ldap.la ... # and under database, it looks like this: database bdb suffix "dc=no" directory "/var/lib/ldap" rootdn "cn=root,dc=no" rootpw {SMD5}XXXXXXXXXXXXXXXXXXXXXXXXXXX= index objectClass eq index uid,gidNumber,uidNumber,memberUid pres,eq index mail,gosaMailAlternateAddress pres,eq,sub index gosaUser,gosaObject pres,eq,sub index zoneName,relativeDomaiNname pres,eq lastmod on sizelimit 4000 overlay syncprov syncprov-checkpoint 1000 60 syncprov-sessionlog 100 # and some access lists access to dn.regex="dc=([^,]+),dc=no$" attrs=userPassword,sambaLMPassword,sambaNTPassword,goImapPassword by dn.regex="^cn=admin,dc=$1,dc=no$" write by anonymous auth by self write by * none access to dn.base="" by * read access to dn.regex="dc=([^,]+),dc=no$" by dn.regex="^cn=admin,dc=$1,dc=no$" write by * read =================== And on slave: =================== ... ... database bdb suffix "dc=foo,dc=no" directory "/var/lib/ldap" rootdn "cn=admin,dc=foo,dc=no" rootpw {SMD5}XXXXXXXXXXXXXXXXXXXXXXXXXXX= index objectclass,entryCSN,entryUUID eq index uid,gidNumber,uidNumber,memberUid pres,eq index mail,gosaMailAlternateAddress pres,eq,sub lastmod on sizelimit 4000 # updatedn "cn=admin,dc=foo,dc=no" # updateref ldap://masterserver.uninett.no/ syncrepl rid=123 provider=ldaps://masterserver.uninett.no:636/ type=refreshOnly interval=00:00:00:10 retry="60 +" searchbase="dc=foo,dc=no" scope=sub schemachecking=off bindmethod=simple binddn="cn=admin,dc=foo,dc=no" credentials="f00bAr123" access to attrs=userPassword,sambaLMPassword,sambaNTPassword,goImapPassword by anonymous auth by self write by * none access to dn.base="" by * read access to * by * read =================== I have (in good tradition) done a slapcat of the subtree dc=foo,dc=no on the master and copied over the ldif to the slave, and there used slapadd to create the entire database from scratch, so the content is identical. When I start slapd on the slave I get on the slave: =================== 18:37:50 server.foo.no slapd[7971]: @(#) $OpenLDAP: slapd 2.4.23 (Jul 5 2010 18:35:50) $ ^Iroot@localhost:/home/kolla/openldap/openldap-2.4.23/debian/build/servers/slapd 18:37:50 server.foo.no slapd[7972]: slapd starting 18:37:50 server.foo.no slapd[7972]: syncrepl_message_to_entry: rid=123 mods check (objectClass: value #0 provided more than once) 18:37:50 server.foo.no slapd[7972]: do_syncrepl: rid=123 rc 20 retrying 18:38:50 server.foo.no slapd[7972]: syncrepl_message_to_entry: rid=123 mods check (objectClass: value #0 provided more than once) 18:38:50 server.foo.no slapd[7972]: do_syncrepl: rid=123 rc 20 retrying =================== And on the master: =================== 18:37:50 ratatosk slapd[9162]: conn=1069 fd=16 ACCEPT from IP=NNN.NN.NN.NN:43227 (IP=0.0.0.0:636) 18:37:50 ratatosk slapd[9162]: conn=1069 fd=16 TLS established tls_ssf=256 ssf=256 18:37:50 ratatosk slapd[9162]: conn=1069 op=0 BIND dn="cn=admin,dc=foo,dc=no" method=128 18:37:50 ratatosk slapd[9162]: conn=1069 op=0 BIND dn="cn=admin,dc=foo,dc=no" mech=SIMPLE ssf=0 18:37:50 ratatosk slapd[9162]: conn=1069 op=0 RESULT tag=97 err=0 text= 18:37:50 ratatosk slapd[9162]: conn=1069 op=1 SRCH base="dc=foo,dc=no" scope=2 deref=0 filter="(objectClass=*)" 18:37:50 ratatosk slapd[9162]: conn=1069 op=1 SRCH attr=* + 18:37:50 ratatosk slapd[9162]: conn=1069 op=2 UNBIND 18:37:50 ratatosk slapd[9162]: conn=1069 fd=16 closed 18:38:50 ratatosk slapd[9162]: conn=1070 fd=16 ACCEPT from IP=NNN.NN.NN.NN:43239 (IP=0.0.0.0:636) 18:38:50 ratatosk slapd[9162]: conn=1070 fd=16 TLS established tls_ssf=256 ssf=256 18:38:50 ratatosk slapd[9162]: conn=1070 op=0 BIND dn="cn=admin,dc=foo,dc=no" method=128 18:38:50 ratatosk slapd[9162]: conn=1070 op=0 BIND dn="cn=admin,dc=foo,dc=no" mech=SIMPLE ssf=0 18:38:50 ratatosk slapd[9162]: conn=1070 op=0 RESULT tag=97 err=0 text= 18:38:50 ratatosk slapd[9162]: conn=1070 op=1 SRCH base="dc=foo,dc=no" scope=2 deref=0 filter="(objectClass=*)" 18:38:50 ratatosk slapd[9162]: conn=1070 op=1 SRCH attr=* + 18:38:50 ratatosk slapd[9162]: conn=1070 op=2 UNBIND 18:38:50 ratatosk slapd[9162]: conn=1070 fd=16 closed =================== and so it goes, but no sync is done whatsoever. What am I doing wrong here? And what could cause this message to appear on the slave: "syncrepl_message_to_entry: rid=123 mods check (objectClass: valu e #0 provided more than once)" Any help is very welcome, especially examplified configs that I can use as "template" for my scenario. Thanks a bunch! :) -- Kolbjørn Barmen UNINETT Driftsenter

3 7

Re: ***UNCHECKED*** Re: slapd goes down
by Quanah Gibson-Mount 20 Jul '10

20 Jul '10

--On Tuesday, July 20, 2010 1:27 PM +0300 Khalid Maslak <maslak(a)ihlas.net.tr> wrote: > Hello > > My ldap server crashed and it gave core.file > I attached it to this mail as zipped. I cannot do anything with your core file. It has to be loaded and examined on your system with your compiled version of slapd. I suggest you use gdb or your favorite debugger to load it with your slapd executable, and get a backtrace from it. <http://www.openldap.org/faq/index.cgi?_highlightWords=gdb&file=59> --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

need an overlay for rewriting attribute values
by Thomas Wunder 20 Jul '10

20 Jul '10

Hi, I need some kind of overlay which allows me to rewrite attribute values. I.e. if there's an object "cn=a,ou=src,dc=my,dc=com" which has attributes like memberUid="uid=usrA,ou=rest,ou=of,dc=the,dc=dn" and memberUid="uid=usrB,ou=rest,ou=of,dc=the,dc=dn" I want that overlay to suffixmassage (or whatever) it to an object like "cn=b,ou=dst,dc=my,dc=com" where for example memberUid="usrA" memberUid="usrB" but the rest (i.e. other Attributes like 'gidNumber', 'userPassword', 'description',...) of the object should be identical to the 'source'-object. The whole thing is needed because slapo-autogroup puts in full DNs as attribute values but my client programs (e.g. nss-ldapd) expect only a plain username to be there. In practical this means that I need to have that overlay to split the values of a particular type of attribute (like 'memberUid') and extract a particular part of it. It would be very nice if it was possible to use regular expressions with backreferences for matching/rewriting the values or if there was a chance to 'plug in' an external program which accomplishes that job. (As far as i know slapo-rwm is only capable of rewriting dn's and attribute names etc. but no values, isn't it? So i need something else...) Thanks in advance! Tom

4 5

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical