openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

Openldap client can't see users
by murat can tuna 01 Jul '10

01 Jul '10

Hi all, I have a running openldap server on ubuntu and as a client my localcomputer on Fedora. I have mounted /home directory from my client. Everything works fine so far but client can't solve user names but just Id numbers and I can't login with openldap users from my client computer. I can use ldapsearch and so on without any problem but somehow only users can' be resolved. Do you have any idea what could be the problem? Or do you need more information like smb.conf Thanks in advance Murat Can Tuna _________________________________________________________________ Your E-mail and More On-the-Go. Get Windows Live Hotmail Free. https://signup.live.com/signup.aspx?id=60969

3 2

Re: intent of pwdGraceAuthNLimit when using ppolicy overlay
by Buchan Milne 01 Jul '10

01 Jul '10

On Wednesday, 30 June 2010 20:15:50 Licause, Al wrote: > I have been attempting to use the ppolicy overlay on an openldap server > running on a Red Hat V5.4 platform with the following components: > > openldap-servers-2.3.43-3.el5 > checkpassword-ldap-0.01-1.2.el5.rf > mozldap-6.0.5-1.el5 > openldap-2.3.43-3.el5 > openldap-debuginfo-2.3.43-3.el5 > nss_ldap-253-22.el5_4 > openldap-clients-2.3.43-3.el5 > openldap-servers-overlays-2.3.43-3.el5 > > I was unable to get the users password to expire by simply setting a value > for pwdMaxAge without the use of the pwdReset parameter. > > I finally turned on all debugging in the slapd.conf file (value -1) and > noticed that the value of pwdGraceAuthNLimit in the default policy, was > set to 3, which allowed the ldap user access without changing the > password. Of course, after the grace authentications, binds would fail. > The disturbing thing about this was the fact that the user is not notifed > that their password has expired. I would have thought that if the intent > was to allow an expired password, then the user should be notified of not > only the fact that their password has expired but how many more grace > logins they would be allowed before either having to change the password > or having the account disabled. This is most likely as result of PAM misconfiguration. You didn't specify how you were testing. However, with almost identical software, my environment works correctly. Please include your full client-side configuration when posting to openldap- technical (e.g. all PAM files included by the service with which you were testing). Note that the openldap-bugs list is for tracking bugs logged on the ITS bug tracker. Questions should be posted to the openldap-technical list. Regards, Buchan

1 0

PASSMOD and slapo-chain
by Christian Manal 01 Jul '10

01 Jul '10

Hi list, I have noticed a problem regarding ExOp PASSMOD and chaining in my OpenLDAP environment. Maybe some of the other overlays are doing their part in this as well. Password changes stopped behaving weird at some point and after some experimenting, I have the following picture: When a slave runs for a few days and some user tries to change his password, the change is done in the local database only (no chaining done or referral returned), resulting in an inconsistent database between the slave and all the other servers. That way, logging in to services which connect to the LDAP servers in a round-robin fashion sometimes works with the "new" password and sometimes with the old one. After I restart the slapd on the slaves, everything works again for a few days, before it goes bad again. Every other write gets chained just fine when a slave is in this condition. It's only the PASSMOD operations that are stuck. I have one master and four slaves running on Solaris 10. One of them SPARC, the others x86. Software Versions are: OpenLDAP 2.4.21 BDB 4.8.26 Cyrus SASL 2.1.23 Heimdal Kerberos 1.3.3 All the configs and the sourcecode of my self-made pwdCheckModule for ppolicy can be found here: http://www.informatik.uni-bremen.de/~moenoel/ldap/ Has someone experienced this before and knows how to fix this? Maybe something wrong with my ppolicy stuff? Regards, Christian Manal

2 1

Adding Schema
by Alexander Erameh 01 Jul '10

01 Jul '10

Hi, Just joined this list, so please pardon me for any mistakes. I have been trying to add "CourierMailAccount" object class and "qmailUser" object class for days without success. I created a schema file and defined the Attributetypes and Object classes and added the file in the Include statement in slapd.conf but SLAPD does not seem to recognize the new object classes. When I try to add users to the Database using LDAPADD, I get the error message below: "ldap_add: Invalid syntax (21) additional info: objectClass:value #2 invalid per syntax" The #2 objectClass is "qmailuser". Suggestions and advice will be appreciated. Alexander <file:///C:\Program%20Files\Common%20Files\Microsoft%20Shared\Stationery\fie ruled.gif>

2 5

LDAP proxy with local database
by Tunguskin Petr 01 Jul '10

01 Jul '10

Hello. I have one program which can authenticate with LDAP server and Active Directory with read access. I need to authenticate extra users, but I can't add them to Active Directory for security reasons. Program can work with only one LDAP source. I have tryed to use openldap chain overlay to join local and remote LDAP databases with refferals. Search works fine, but bind operation doesn't work, openldap writes error: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) Is it possible to bind to remote LDAP records with chain overlay? ------------------------------------------ database bdb suffix "dc=local" rootdn "cn=ldapadmin,dc=local" rootpw 12345678 directory /var/lib/ldap overlay chain chain-uri "ldap://10.1.1.1/" chain-rebind-as-user TRUE chain-cache-uri true chain-chaining resolve=chainingRequired continuation=chainingRequired chain-idassert-bind bindmethod="simple" binddn="cn=ldapuser,cn=Users,dc=test,dc=local" credentials="123" mode="none" ---------------------------------------- Could you recommend another solution? Thank you --

3 2

SASL auth not working
by Diego Lima 01 Jul '10

01 Jul '10

Hello all, I'm trying to set up openldap to authenticate using my kerberos service, but I'm not having success so far. I've already set up MIT Kerberos V and I can successfully get tickets from it: root@filesystem:~# kinit diego.lima Password for diego.lima@USERS: root@filesystem:~# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: diego.lima@USERS Valid starting Expires Service principal 06/23/10 09:44:49 06/23/10 19:44:49 krbtgt/USERS@USERS renew until 06/24/10 09:44:46 I've also set up SASL to use the kerberos5 auth mechanism and it seems to work: root@filesystem:~# testsaslauthd -u diego.lima@USERS -p 123456 0: OK "Success." The saslauthd output looks like this: saslauthd[28383] :rel_accept_lock : released accept lock saslauthd[28385] :get_accept_lock : acquired accept lock saslauthd[28383] :do_auth : auth success: [user=diego.lima@USERS] [service=imap] [realm=] [mech=kerberos5] saslauthd[28383] :do_request : response: OK I've set up my user account on LDAP like this: dn: krbPrincipalName=diego.lima@USERS,cn=USERS,dc=domain,dc=com,dc=br krbPrincipalName: diego.lima@USERS krbPrincipalKey:: (big key) krbLastPwdChange: 20100622215607Z objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux objectClass: posixAccount structuralObjectClass: krbPrincipal entryUUID: b4d16a7a-1294-102f-8f9b-2759be64cd18 creatorsName: cn=admin,dc=domain,dc=com,dc=br createTimestamp: 20100622215607Z uid: diego.lima uidNumber: 10001 gidNumber: 10001 cn: diego.lima homeDirectory: /home/diego.lima loginShell: /bin/bash userPassword:: e1NBU0x9ZGllZ28ubGltYUBVU0VSUw== krbLastSuccessfulAuth: 20100623124649Z krbLoginFailedCount: 0 krbExtraData:: (data) krbExtraData:: (data) entryCSN: 20100623124649.354631Z#000000#000#000000 modifiersName: cn=admin,dc=domain,dc=com,dc=br modifyTimestamp: 20100623124649Z The userPassword value translates to {SASL}diego.lima@USERS When I try to do an authenticated search on LDAP I see the following: # ldapsearch -D krbPrincipalName=diego.lima@USERS,cn=USERS,dc=domain,dc=com,dc=br -b dc=domain,dc=com,dc=br '(objectClass=*)' -W Enter LDAP Password: ldap_bind: Invalid credentials (49) And on the slapd output: daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(7): daemon: epoll: listen=7 busy daemon: epoll: listen=8 active_threads=0 tvp=zero >>> slap_listener(ldap:///) daemon: listen=7, new connection on 18 daemon: added 18r (active) listener=(nil) conn=35 fd=18 ACCEPT from IP=127.0.1.1:51089 (IP=0.0.0.0:389) daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: activity on 1 descriptor daemon: activity on: 18r daemon: read active on 18 daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero connection_get(18) connection_get(18): got connid=35 connection_read(18): checking for input on id=35 ber_get_next ldap_read: want=8, got=8 0000: 30 53 02 01 01 60 4e 02 0S...`N. ldap_read: want=77, got=77 0000: 01 03 04 41 6b 72 62 50 72 69 6e 63 69 70 61 6c ...AkrbPrincipal 0010: 4e 61 6d 65 3d 64 69 65 67 6f 2e 6c 69 6d 61 40 Name=diego.lima@ 0020: 55 53 45 52 53 2c 63 6e 3d 55 53 45 52 53 2c 64 USERS,cn=USERS,d 0030: 63 3d 34 6c 69 6e 75 78 2c 64 63 3d 63 6f 6d 2c c=domain,dc=com, 0040: 64 63 3d 62 72 80 06 31 32 33 34 35 36 dc=br..123456 ber_get_next: tag 0x30 len 83 contents: ber_dump: buf=0x1cc73d0 ptr=0x1cc73d0 end=0x1cc7423 len=83 0000: 02 01 01 60 4e 02 01 03 04 41 6b 72 62 50 72 69 ...`N....AkrbPri 0010: 6e 63 69 70 61 6c 4e 61 6d 65 3d 64 69 65 67 6f ncipalName=diego 0020: 2e 6c 69 6d 61 40 55 53 45 52 53 2c 63 6e 3d 55 .lima@USERS,cn=U 0030: 53 45 52 53 2c 64 63 3d 34 6c 69 6e 75 78 2c 64 SERS,dc=domain,d 0040: 63 3d 63 6f 6d 2c 64 63 3d 62 72 80 06 31 32 33 c=com,dc=br..123 0050: 34 35 36 456 op tag 0x60, time 1277298275 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=35 op=0 do_bind ber_scanf fmt ({imt) ber: ber_dump: buf=0x1cc73d0 ptr=0x1cc73d3 end=0x1cc7423 len=80 0000: 60 4e 02 01 03 04 41 6b 72 62 50 72 69 6e 63 69 `N....AkrbPrinci 0010: 70 61 6c 4e 61 6d 65 3d 64 69 65 67 6f 2e 6c 69 palName=diego.li 0020: 6d 61 40 55 53 45 52 53 2c 63 6e 3d 55 53 45 52 ma@USERS,cn=USER 0030: 53 2c 64 63 3d 34 6c 69 6e 75 78 2c 64 63 3d 63 S,dc=domain,dc=c 0040: 6f 6d 2c 64 63 3d 62 72 80 06 31 32 33 34 35 36 om,dc=br..123456 ber_scanf fmt (m}) ber: ber_dump: buf=0x1cc73d0 ptr=0x1cc741b end=0x1cc7423 len=8 0000: 00 06 31 32 33 34 35 36 ..123456 >>> dnPrettyNormal: <krbPrincipalName=diego.lima@USERS,cn=USERS,dc=domain,dc=com,dc=br> => ldap_bv2dn(krbPrincipalName=diego.lima@USERS,cn=USERS,dc=domain,dc=com,dc=br,0) <= ldap_bv2dn(krbPrincipalName=diego.lima@USERS,cn=USERS,dc=domain,dc=com,dc=br)=0 => ldap_dn2bv(272) <= ldap_dn2bv(krbPrincipalName=diego.lima@USERS,cn=USERS,dc=domain,dc=com,dc=br)=0 => ldap_dn2bv(272) <= ldap_dn2bv(krbPrincipalName=diego.lima@USERS,cn=users,dc=domain,dc=com,dc=br)=0 <<< dnPrettyNormal: <krbPrincipalName=diego.lima@USERS,cn=USERS,dc=domain,dc=com,dc=br>, <krbPrincipalName=diego.lima@USERS,cn=users,dc=domain,dc=com,dc=br> conn=35 op=0 BIND dn="krbPrincipalName=diego.lima@USERS,cn=USERS,dc=domain,dc=com,dc=br" method=128 do_bind: version=3 dn="krbPrincipalName=diego.lima@USERS,cn=USERS,dc=domain,dc=com,dc=br" method=128 ==> hdb_bind: dn: krbPrincipalName=diego.lima@USERS,cn=USERS,dc=domain,dc=com,dc=br bdb_dn2entry("krbPrincipalName=diego.lima@USERS,cn=users,dc=domain,dc=com,dc=br") => access_allowed: auth access to "krbPrincipalName=diego.lima@USERS,cn=USERS,dc=domain,dc=com,dc=br" "userPassword" requested => acl_get: [1] attr userPassword => slap_access_allowed: result not in cache (userPassword) => acl_mask: access to entry "krbPrincipalName=diego.lima@USERS,cn=USERS,dc=domain,dc=com,dc=br", attr "userPassword" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: cn=admin,dc=domain,dc=com,dc=br <= check a_dn_pat: anonymous <= acl_mask: [2] applying auth(=xd) (stop) <= acl_mask: [2] mask: auth(=xd) => slap_access_allowed: auth access granted by auth(=xd) => access_allowed: auth access granted by auth(=xd) SASL Canonicalize [conn=35]: authcid="diego.lima@USERS" SASL Canonicalize [conn=35]: authcid="diego.lima@USERS" send_ldap_result: conn=35 op=0 p=3 send_ldap_result: err=49 matched="" text="" send_ldap_response: msgid=1 tag=97 err=49 ber_flush2: 14 bytes to sd 18 0000: 30 0c 02 01 01 61 07 0a 01 31 04 00 04 00 0....a...1.... ldap_write: want=14, written=14 0000: 30 0c 02 01 01 61 07 0a 01 31 04 00 04 00 0....a...1.... conn=35 op=0 RESULT tag=97 err=49 text= daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: activity on 1 descriptor daemon: activity on: 18r daemon: read active on 18 daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero connection_get(18) connection_get(18): got connid=35 connection_read(18): checking for input on id=35 ber_get_next ldap_read: want=8, got=0 ber_get_next on fd 18 failed errno=0 (Success) connection_read(18): input error=-2 id=35, closing. connection_closing: readying conn=35 sd=18 for close connection_close: conn=35 sd=18 daemon: removing 18 conn=35 fd=18 closed (connection lost) daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero I see nothing on the saslauthd output when I try to log in. Did I miss anything? Please note that I'm trying to use the same kerberos principal as my user, and this is intended. I did try adding another user (account and posixAccount objectClasses) with a separate kerberos principal and that did not work either. Lastly, here is my slapd.conf: include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/kerberos.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel none modulepath /usr/lib/ldap moduleload back_hdb sizelimit 500 tool-threads 1 backend hdb database hdb suffix "dc=domain,dc=com,dc=br" rootdn "cn=admin,dc=domain,dc=com,dc=br" directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass eq lastmod on checkpoint 512 30 access to attrs=userPassword,shadowLastChange,krbPrincipalKey,krbLastPwdChange by dn="cn=admin,dc=domain,dc=com,dc=br" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=domain,dc=com,dc=br" write by * read Thanks for the help! -- Diego Lima

3 5

Textual LDIF backup strategies for busy LDAP clusters
by Nick Urbanik 30 Jun '10

30 Jun '10

Dear Folks, our old backup system for our LDAP clusters using slurpd is as follows: 1. A dedicated slave (we call it a "sync") has a replogfile configured. 2. A cron job moves the replog file to a backup directory every 15 minutes. 3. Another cron job runs every 24 hours, which: a. Stops slapd. b. slapcats to a file which is compressed with gzip. c. starts slapd. 4. Another system backs up the backup directory. Now we like text formatted backups, and I need to implement a similar or better system with syncrepl. Here are my questions: 1. Would the auditlog overlay be an appropriate replacement for the replogfile? 2. Can we run this on the master without stopping slapd? 3. Would we be able to accurately reconstruct the data using the slapcat and periodic copies of auditlog files? I will write software to fully automate whatever scheme we determine to be the most appropriate. -- Nick Urbanik http://nicku.org 808-71011 nick.urbanik(a)optusnet.com.au GPG: 7FFA CDC7 5A77 0558 DC7A 790A 16DF EC5B BB9D 2C24 ID: BB9D2C24 I disclaim, therefore I am.

2 7

fails to start ldaps://
by owen nirvana 30 Jun '10

30 Jun '10

it's openldap-2.4.17 in debian testing I try to config slapd.conf to use ldap ssl. TLSCACertificateFile cacert.pem TLSCertificateFile ldapclient.pem TLSCertificateKeyFile ldapclientkey.pem TLSVerifyClient never I could not start slapd after I config TLS in slapd.conf, error info is "Main: TLS init def ctx failed: -69" the OpenLDAP Admin Guide only mentions CipherSuite in OpenSSL, not GnuTLS. Steve Langasek advice leave TLSCipherSuite blank( http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=462588), and I do config so. But if I config some specific CipherSuite or just "ALL", error info will be "TLS: could not set cipher list ALL. Main: TLS init def ctx failed: -1" gtalk:freeespeech@gmail.com <gtalk%3Afreeespeech(a)gmail.com>

1 0

Question about openldap and RFC documents
by Bryan Boone 30 Jun '10

30 Jun '10

Hi everyone, I have a question about openldap and RFC documents. I see online the list of RFC documents that openldap conforms too. RFC documents are difficult to read and follow. I am working on a project that requires me to use. organizationalUnit groupOfNames inetOrgPerson Also I need to use the attributes. uid userpassword I need to document my work so that someone can setup their own LDAP server (maybe non-OpenLDAP) if they wish. I see that RFC2307 referes to the hashing of userpassword. Can anyone list to me the RFC documents that encompass the 3 object classes and the 2 attributes so that I can put that in my documentation? I know I just just list all of the RFC documents on the website for openldap, but I think that is a little redundant. Plus I would like to know exactly which RFC's I am using. thanks

1 0

Recover LDAP contents from binary files
by Pelle Nilsson 29 Jun '10

29 Jun '10

Hi! I need to recover the contents of my LDAP database from a crashed computer. I have all the configuration files and binary files, and the passwords of the LDAP users, but no working LDAP installation. Can this be done? /Pelle

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical