openldap-technical

openldap-technical@openldap.org

1 participants
9989 discussions

Unix authentication in corporate AD
by Edsall, William (WJ) 02 Sep '10

02 Sep '10

Hello, Just a few questions regarding authenticating OpenLDAP (centos 5.4) to windows active directory. I'm able to bind, I've confirmed this by changing the bind password, and then the bind attempt fails. However I'm unable to authenticate. My attempt is always as follows: su: user blabla does not exist No errors end up in the messages log. My question is .. could this be because the active directory I'm trying to authenticate against doesn't have any windows services for unix installed? Should that even matter if I can bind? _______________________________________ William J. Edsall

3 2

About Installation
by Murat Can Tuna 02 Sep '10

02 Sep '10

Hi, On every ubuntu introduction there is written "The installation process will prompt you for the LDAP directory admin password and confirmation." But I don't get such a prompt. What am I missing? I logged in over ssh, could it be the reason? Is there any way to give my password manually? Also dpkg-reconfigure slapd doesn't bring something, it asks just 3 questions about ldapv2 protocol and so. But on my own computer at home there isn't such a problem, I installed and configured everything without any problem. this is the version: DISTRIB_ID=Ubuntu DISTRIB_RELEASE=9.10 DISTRIB_CODENAME=karmic DISTRIB_DESCRIPTION="Ubuntu 9.10" Thanks in Advance Murat Can Tuna

1 1

custom hostname for openldap/sasl is not working
by Zaar Hai 01 Sep '10

01 Sep '10

Good day, dear list! I'm trying to setup SASL GSSAPI authentication for openldap that listens on hostname different from the machine hostname it runs on. openldap runs on server inka.example.com. ldap/inka/example.com principal is added to ldap's keytab file. This command works just fine: ldapsearch -Y GSSAPI -H 'ldap://inka.example.com' Now: * I've added second IP to the inka.example.com * Added A record for ldap.example.com to point to that IP and setup corresponding PTR record. * Created ldap/ldap.example.com principal and added it ldap's keytab. * Even set openldap to listen only on ldap.example.com IP. But the command ldapsearch -Y GSSAPI -H 'ldap://ldap.example.com' fails with the following error in ldap log: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Wrong principal in request) I see that client successfully obtains ticket for ldap/ldap.example.com(a)EXAMPLE.COM I've tried to set sasl-host to ldap.example.com and sasl-realm to EXAMPLE.COM in slapd.conf - did not help. I've even tried to do "hostname ldap" on inka.example.com and restart slapd - same error. >From what I understand, the slapd daemon will try, before connecting the KDC server, to read the keytab file and get the key of the principal ldap/<sasl-host>#<sasl-realm>, so it looks like I'm doing the right thing, but it does not work. System: Debian testing. slapd-2.4.17-2.1 sasl-2.1.23.dfsg1-5 MIT kerberos 1.8.3+dfsg~beta1-1 Thank you in advance for help, -- Zaar -- Zaar

2 1

TLS fails
by Frederik Bosch 01 Sep '10

01 Sep '10

After getting my ACL right (thanks Dieter!), I have problems installing an official certificate. I bought a certificate at RapidSSL. Starting slapd gives me the following error. TLS init def ctx failed: -69 This error is thrown in openldap 2.4.17. Since I am on debian, slapd is compiled against GnuTLS. When I was using 2.4.11 I had another error: TLS init def ctx failed: -207 When I had a self-signed certificate I had no trouble. What could be wrong?

4 7

RE: Getting Solaris to use Openldap
by Stuart Cherrington 01 Sep '10

01 Sep '10

> Date: Fri, 27 Aug 2010 21:33:42 +1200 > From: ian(a)ianshome.com > To: stuart_cherrington(a)hotmail.co.uk > Subject: Re: Getting Solaris to use Openldap > > On 08/27/10 08:48 PM, Stuart Cherrington wrote: > > Hi, > > > > I Have an OpenLDAP 2.4.18 server on RHEL 5.3. I can get Linux clients > > to use the master by use of the /etc/ldap.conf file. I'm now trying to > > get a SOlaris 10 client to use the master by initialising with the > > default profileName. If I run: > > > > ldapclient -v init -a proxypassword=xxxxx -a > > proxydn=cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -a > > domainname=ldn.sw.com 10.2.250.15 > > > I also add a -a profileName=default Shouldn't need to add this as ldapclient takes 'default' as the default profilename if not specified. I did try it with this anyway but got same error. > > > So the 2 errors are the *NOTFOUND nisDomainObject *which is there when > > I check on the master: > > > > [root@msldap01 openldap2.4]# ldapsearch2.4 -h 10.2.250.15 -D > > cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -w xxxxx-b > > dc=ldn,dc=sw,dc=com -s base > > # extended LDIF > > # > > # LDAPv3 > > # base <dc=ldn,dc=sw,dc=com> with scope baseObject > > # filter: (objectclass=*) > > # requesting: ALL > > # > > > > # ldn.sw.com > > dn: dc=ldn,dc=sw,dc=com > > dc: ldn > > o: ldn > > associatedDomain: ldn.sw.com > > nisDomain: ldn.sw.com > > objectClass: dcObject > > objectClass: organization > > objectClass: domainRelatedObject > > *objectClass: nisDomainObject* > > objectClass: top > > > That looks OK. > > > > The other error is 'Failed to find defaultSearchBase for domain > > ldn.sw.com' > > > > [root@msldap01 openldap2.4]# ldapsearch2.4 -h 10.2.250.15 -D > > cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -w 5wap5proxy -b > > cn=default,ou=profile,dc=ldn,dc=sw,dc=com -s base > > # extended LDIF > > # > > # LDAPv3 > > # base <cn=default,ou=profile,dc=ldn,dc=sw,dc=com> with scope baseObject > > # filter: (objectclass=*) > > # requesting: ALL > > # > > Do you have a cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com entry? Yeh [root@msldap01 openldap2.4]# ldapsearch2.4 -h 10.2.250.15 -D cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -w xxxxx -b cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -s base # extended LDIF # # LDAPv3 # base <cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com> with scope baseObject # filter: (objectclass=*) # requesting: ALL # # proxyagent, profile, ldn.sw.com dn: cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com cn: proxyagent sn: proxyagent objectClass: top objectClass: person userPassword:: e0NSWVBUfXYuTWpqUDJEb3lpMXc= # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 > > > # default, profile, ldn.sw.com > > dn: cn=default,ou=profile,dc=ldn,dc=sw,dc=com > > *defaultSearchBase: dc=ldn,dc=sw,dc=com* > > authenticationMethod: simple > > followReferrals: TRUE > > profileTTL: 43200 > > searchTimeLimit: 30 > > objectClass: DUAConfigProfile > > defaultServerList: 10.2.250.15 > > credentialLevel: proxy > > cn: default > > defaultSearchScope: one > > You should add > > serviceSearchDescriptor: passwd:<people base> > serviceSearchDescriptor: group:<group base> I initially had these (and one for shadow) but they didn't make any difference the error, but I expect I'll need them when its in operation. > > -- > Ian. >

3 7

Re: TLS fails
by Marc Patermann 01 Sep '10

01 Sep '10

Frederik, no TOFU, please. :) Frederik Bosch schrieb am 01.09.2010 10:23 Uhr: > Compiling 2.4.17 with OpenSSL was more succesful than on 2.4.11. I think > that's a Debian issue. Anyway, I have my server up and running! Thanks a > lot Dieter for answering all my questions. > > But I have a minor question left. Each time I restart slapd I have to > enter the PEM pass phrase. Is there a way to remember or not prompt for > the passphrase? You have to remove the passphrase from the PEM file. i.e.: http://www.openssl.org/docs/apps/rsa.html EXAMPLES To remove the pass phrase on an RSA private key: openssl rsa -in key.pem -out keyout.pem Marc

1 0

Re: OpenLDAP to replace Oracle Internet Directory
by Matheus Morais 30 Aug '10

30 Aug '10

Hi Gavin, Sorry for the late reply, I need to organize my mail box, I just not seen this email! On Mon, Jul 26, 2010 at 2:24 PM, Gavin Henry <ghenry(a)openldap.org> wrote: > > I want thank every one responsible to keep OpenLDAP project with that > high > > level of quality and I am really proud about that kind of quality has > been > > produced by a free software project (free as in freedom). > > Excellent news! How is it going now? Did you use our docs to help you? > We're doing really well at this time. Right now we're waiting for the dev team to correct one of our LDAP API which was using substring search for distinguishedName attributes and that works on Oracle Internet Directory but as RFC 2256 say, section 5.50 more precisely, the 'client must not assume that LDAP servers are capable of performing attribute subtyping'. They are testing and after put on production we will be ready to change the last systems which still using Oralce Internet Directory. I most used the Administrator's Guide for version 2.4 and all the manuals available. I think the documentation is very complete in general but could be improved in some points, like the session of Monitor backend for example. I also would be happy if we had a portuguese version of Admin's Guide. Since I'm not a developer I could help on the documention at my spare time. I would be glad if I could help in some aspect. > Do you have any suggestions for improvements to the docs? > > Thanks. > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ > Thanks, Matheus Morais!

2 1

I can't see my /etc/ldap/slapd.conf file after reinstall
by Eric KOM 28 Aug '10

28 Aug '10

Hi Dear Team! Please, I got problem with my OpenLDAP server on Debian Testing. I try to purge slapd package with aptitude purge slapd and remove all files and directories with rm on /etc/ldap/. after reinstall slapd, I can't see the main configuration file /etc/ldap/slapd.conf? but the server is running. Thank you in advance. -- Yours truly, Eric KOM 110 LAWN STREET ROSETTENVILLE 2190 JOHANNESBURG SOUTH AFRICA Phone: +27 (0) 788 791 334 Fax: +27 (0) 865 563 009 E-mail: erickom(a)namekom.co.za Websites: www.erickom.co.za | www.namekom.co.za/erickom | www.namekom.co.za

5 11

to much archive logs
by isso2＠gmx.de 27 Aug '10

27 Aug '10

Hello team, our openldap-server (OS: Redhat 5) was succesfully installed and it works. But sometimes it gets out of control, that means: every 3 minutes it generates an archive-log. Shutdown and start is not successfully. We have do to a db_recover. Any idea ? Thanks a lot. -- GRATIS für alle GMX-Mitglieder: Die maxdome Movie-FLAT! Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome01

2 3

syncrepl help
by Adam Cassar 27 Aug '10

27 Aug '10

Hi All, I would appreciate some insight with a syncrepl issue that I have. The scenario is as follows: (1) LDAP master running debian slapd v2.3.30 replicating using syncrepl to (2) LDAP master running debian slapd v2.4.11 The initial data for this node was seeded using slapcat/slapadd due to the db size. This is replicating via syncrepl to (3) LDAP slave running debian slapd v2.4.11 On (3) the slave I am receiving the error: do_syncrep2: cookie=rid=001,csn=20100825064231Z#000000#00#000000 do_syncrep2: rid=001 CSN too old, ignoring 20100825064231Z#000000#00#000000 for all replication events that are being received. What I am trying to achieve is to deprecate server (1) with as little downtime as possible, server (2) becomes the new master and (3) the new slave Replication between 1 & 2 works correctly but not between 2 & 3. The time is correct on the servers. Server (3) database is seeded using syncrepl. Configurations for 1, 2 & 3 are attached.

2 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical