openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

Re: Q: status of component matching?
by Lehnert, Hartmut 17 Jun '10

17 Jun '10

Hi all! I have debugged a little bit more and discovered that the decoding of the ANY type of the Algorithm parameter (that in fact is the Null) fails; in the BDecComponentAny function (file "contrib/slapd-modules/comp_match/componentlib.c") the pointer result->cai is the NULL pointer, so no function to decode the parameter is defined. Can anybody help? Regards, Hartmut

2 1

Re: Pam_ldap group access
by Aaron Richton 17 Jun '10

17 Jun '10

Please keep replies on the list. On Thu, 17 Jun 2010, Indexer wrote: > On 17/06/2010, at 10:34 PM, Aaron Richton wrote: > >> On Thu, 17 Jun 2010, Indexer wrote: >> >>> membership logins a notice appears that says "You must be a memberUid >>> of cn=login,ou=Nemo,ou=Group,dc=chocolate,dc=lan to login.", but the >>> user is still able to continue and login, and it is not enforcing the >>> group >> [...] >>> account optional /usr/local/lib/pam_ldap.so >> >> Of course they're able to continue; that check is optional in a stack >> that contains other results. See pam.conf(5) man page. >> > Yes, i have been told that this is the case, and im not to concerned > about it right now. What concerns me more, is that Groups aren't being > enforced the way i would like them to be. Has anyone got a working > configuration or hints? google was not especially helpful, as its a hard > problem to "quantify". I'm totally confused. If you're not "concerned about it right now" why is it your original question, as well as causing "me more" concern in the next sentence? My hint remains that the check you want to enforce without option has been configured as optional. Read the whole pam.conf(5) man page, then reread the section regarding alternatives to "optional," and determine what you need to configure to enforce the behavior you want.

2 2

do_extended: unsupported operation
by Gianluigi Nigro 17 Jun '10

17 Jun '10

I'am writing an extended operation with slapi plugin, successfully registered through the initialization function: ... char** oids = (char**) slapi_ch_malloc( 2 * sizeof( char * ) ); oids[0] = 1.3.6.1.4.1.35746.2.11.1"; oids[1] = NULL; ... i_ret = slapi_pblock_set(pb, SLAPI_PLUGIN_EXT_OP_OIDLIST, oids ); if( i_ret == 0 ) i_ret = slapi_pblock_set(pb, SLAPI_PLUGIN_EXT_OP_FN, (void*) extop1_start ); if( i_ret != 0 ) slapi_log_error( SLAPI_LOG_PLUGIN, "extop1_init", "[ERROR] registrazione %s\n", pluginDescription.spd_description ); slapd.conf look like this: ... pluginlog /var/log/caronte/plugin.log plugin extendedop /opt/ldap/slapi/libextop1-plugin.so extop1_init ... The log file plugin.log tell me that the plugin was successfully registered: ... 06/17/10 10:43:53 plugin_pblock_new: Registered plugin my-plugin 0.1 [mycompany] (description plugin) ... After server restart, the rootDSE object contains information about my extended operation, an 'ldapsearch -x -s base -b "" "(objectclass=*)" +' output like this: ... supportedControl: 1.3.6.1.1.12 supportedExtension: 1.3.6.1.4.1.35746.2.11.1 supportedExtension: 1.3.6.1.4.1.4203.1.11.1 supportedExtension: 1.3.6.1.4.1.4203.1.11.3 supportedExtension: 1.3.6.1.1.8 But, when i perform the extended operation then i get the error code 2 and the slapd log file look like this: Jun 17 09:53:03 linux-setup slapd[11969]: conn=1000 op=1 EXT oid=1.3.6.1.4.1.35746.2.11.1 Jun 17 09:57:33 linux-setup slapd[11969]: conn=1000 op=1 do_extended: unsupported operation "1.3.6.1.4.1.35746.2.11.1" Jun 17 09:57:33 linux-setup slapd[11969]: conn=1000 op=1 RESULT tag=120 err=2 text=unsupported extended operation Is it a bug or a lack of implementation? Any helps is appreciated. Gianluigi nigro -------------------------------------------------------------------- Il contenuto di questo messaggio di posta elettronica e ogni eventuale documento a quest'ultimo allegato puo contenere informazioni la cui riservatezza e' tutelata ed e' rivolto unicamente agli effettivi destinatari i quali prendono atto del carattere non strettamente personale dei messaggi di risposta, che potranno essere noti all'organizzazione aziendale. Sono vietati la riproduzione e l'uso di questo messaggio in mancanza di autorizzazione del destinatario. Se avete ricevuto questo messaggio per errore, vogliate cortesemente chiamarci immediatamente per telefono o fax e distruggere quanto ricevuto (compresi i file allegati) senza farne copia. Qualsivoglia utilizzo non autorizzato del contenuto di questo messaggio costituisce violazione dell'obbligo di non prendere cognizione della corrispondenza tra altri soggetti.

1 0

Pam_ldap group access
by Indexer 17 Jun '10

17 Jun '10

I have recently been using openLDAP on a server for authentication. I have user auth working happily, but when i try and enable group_membership, it is not enforced. When a user with the correct group membership logs in, everything is happy, but when a user without the membership logins a notice appears that says "You must be a memberUid of cn=login,ou=Nemo,ou=Group,dc=chocolate,dc=lan to login.", but the user is still able to continue and login, and it is not enforcing the group membership. Many thanks, for your help (again) Here is my nss_ldap.conf (/etc/ldap.conf) base dc=chocolate,dc=lan suffix dc=chocolate,dc=lan uri ldap://ldap.chocolate.lan ldap_version 3 scope sub timelimit 3 bind_timelimit 3 bind_policy soft pam_filter objectclass=posixAccount pam_login_attribute uid pam_groupdn cn=login,ou=Nemo,ou=Group,dc=chocolate,dc=lan pam_member_attribute memberUid pam_password clear pam_password exop nss_base_passwd ou=Users,dc=chocolate,dc=lan?sub nss_base_passwd ou=Computers,dc=chocolate,dc=lan?sub nss_base_shadow ou=Users,dc=chocolate,dc=lan?sub nss_base_group ou=Nemo,ou=Group,dc=chocolate,dc=lan?sub ssl on ssl start_tls tls_cacert /usr/local/etc/openldap/keys/cacert.crt tls_checkpeer no And my pam.d/sshd auth sufficient pam_opie.so no_warn no_fake_prompts auth requisite pam_opieaccess.so no_warn allow_local auth sufficient /usr/local/lib/pam_ldap.so no_warn auth required pam_unix.so no_warn use_first_pass account required pam_nologin.so account required pam_login_access.so account optional pam_unix.so account optional /usr/local/lib/pam_ldap.so session required pam_permit.so session optional /usr/local/lib/pam_ldap.so password sufficient pam_unix.so no_warn use_first_pass

4 3

I can't login linux (console) using after configurate openldap
by Bruno Steven 17 Jun '10

17 Jun '10

HI, I have started openldap more Samba but I can't do logon via console on my linux, only access my system using ssh or telnet . When I am on console I put login and password and press "enter" , again show me screen login linux . If change /etc/nsswitch.conf fields passwd , shadow , group for files only, the login work normally , Thre is problem between openldap and pam ? I paste my /etc/nsswitch.conf passwd: files ldap shadow: files ldap group: files ldap #hosts: db files nisplus nis dns hosts: files dns wins and /etc/pam.d/login n#%PAM-1.0 auth required pam_securetty.so auth required pam_nologin.so auth sufficient pam_ldap.so auth required pam_unix2.so nullok try_first_pass #set_secrpc account sufficient pam_ldap.so account required pam_unix2.so password required pam_pwcheck.so nullok password required pam_ldap.so use_first_pass use_authtok password required pam_unix2.so nullok use_first_pass use_authtok session required pam_unix2.so none # debug or trace session required pam_limits.so session required pam_env.so session optional pam_mail.so #auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so #auth include system-auth #account required pam_nologin.so #account include system-auth #password include system-auth # pam_selinux.so close should be the first session rule #session required pam_selinux.so close #session include system-auth #session required pam_loginuid.so #session optional pam_console.so # pam_selinux.so open should only be followed by sessions to be executed in the user context #session required pam_selinux.so open #session optional pam_keyinit.so force revoke Thanks. -- Bruno Steven - Administrador de sistemas. LPIC-1 - LPI ID: lpi000119659 / Code: p2e4wz47e4 https://www.lpi.org/caf/Xamman/certification MCP-Windows 2003 - TranscriptID: 793804 / Access Code: 080089100 https://mcp.microsoft.com/authenticate/validatemcp.aspx P Antes de imprimir pense em sua responsabilidade e comprometimento com o Meio Ambiente. Before printing this message, think about your ecologic responsability and environment commitment.

2 1

Re: I can't login linux (console) using after configurate openldap
by Chris Jacobs 17 Jun '10

17 Jun '10

Compare your login and ssh pam configs (ssh works, login doesn't). They'll be under /etc/pam.d/. - chris Chris Jacobs, Systems Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA 98121 phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 email: chris.jacobs(a)apollogrp.edu ________________________________ From: openldap-technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org To: openldap-technical(a)openldap.org Sent: Wed Jun 16 14:26:19 2010 Subject: I can't login linux (console) using after configurate openldap HI, I have started openldap more Samba but I can't do logon via console on my linux, only access my system using ssh or telnet . When I am on console I put login and password and press "enter" , again show me screen login linux . If change /etc/nsswitch.conf fields passwd , shadow , group for files only, the login work normally , Thre is problem between openldap and pam ? I paste my /etc/nsswitch.conf passwd: files ldap shadow: files ldap group: files ldap #hosts: db files nisplus nis dns hosts: files dns wins and /etc/pam.d/login n#%PAM-1.0 auth required pam_securetty.so auth required pam_nologin.so auth sufficient pam_ldap.so auth required pam_unix2.so nullok try_first_pass #set_secrpc account sufficient pam_ldap.so account required pam_unix2.so password required pam_pwcheck.so nullok password required pam_ldap.so use_first_pass use_authtok password required pam_unix2.so nullok use_first_pass use_authtok session required pam_unix2.so none # debug or trace session required pam_limits.so session required pam_env.so session optional pam_mail.so #auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so #auth include system-auth #account required pam_nologin.so #account include system-auth #password include system-auth # pam_selinux.so close should be the first session rule #session required pam_selinux.so close #session include system-auth #session required pam_loginuid.so #session optional pam_console.so # pam_selinux.so open should only be followed by sessions to be executed in the user context #session required pam_selinux.so open #session optional pam_keyinit.so force revoke Thanks. -- Bruno Steven - Administrador de sistemas. LPIC-1 - LPI ID: lpi000119659 / Code: p2e4wz47e4 https://www.lpi.org/caf/Xamman/certification MCP-Windows 2003 - TranscriptID: 793804 / Access Code: 080089100 https://mcp.microsoft.com/authenticate/validatemcp.aspx P Antes de imprimir pense em sua responsabilidade e comprometimento com o Meio Ambiente. Before printing this message, think about your ecologic responsability and environment commitment. ________________________________ This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

1 0

syncrepl vs is_entry_objectclass "2.5.17.0" no objectClass attribute
by Guy.Baconniere＠swisscom.com 16 Jun '10

16 Jun '10

Hello, A syncrepl with a searchbase of "dc=foo,dc=bar" is working fine but not with a empty/null "" searchbase. On the provider side I have the following error "is_entry_objectclass("", "2.5.17.0") no objectClass attribute" and on the consumer I have "do_syncrep2: rid=002 (32) No such object". ldapsearch -LLL -h foo.bar -p 389 -x -D 'cn=syncrepl,dc=foo,dc=bar' -w '*****' -b '' -s sub '(objectclass=*)' '*' '+' Do not have any issue to retrieve the full DIT(s) and is able to find the sub of root object. Is it possible to replicate an null/empty searchbase with syncrepl ? If not how can I replicate part of a null/empty searchbase setup on a provider ? Best Regards, Guy Baconniere I am running OpenLDAP slapd 2.4.11 on Debian Lenny. # syncrepl directives syncrepl rid=002 provider=ldap://foo.bar:389/ searchbase="" filter="(objectClass=*)" scope=sub attrs="*,+" type=refreshAndPersist schemachecking=off retry="60 30 300 +" bindmethod=simple binddn="cn=syncrepl,dc=foo,dc=bar" credentials="*****" SYNCREPL OF SEARCHBASE="" NOT WORKING conn=1443 fd=33 ACCEPT from IP=172.16.8.204:44128 (IP=0.0.0.0:389) conn=1443 op=0 BIND dn="cn=syncrepl,dc=foo,dc=bar" method=128 conn=1443 op=0 BIND dn="cn=syncrepl,dc=foo,dc=bar" mech=SIMPLE ssf=0 conn=1443 op=0 RESULT tag=97 err=0 text= conn=1442 op=1 SRCH base="" scope=2 deref=0 filter="(objectClass=*)" conn=1442 op=1 SRCH attr=* + is_entry_objectclass("", "2.5.17.0") no objectClass attribute conn=1442 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text= conn=1443 op=1 SRCH base="dc=foo,dc=bar" scope=2 deref=0 filter="(objectClass=*)" conn=1443 op=1 SRCH attr=* + conn=1442 op=2 UNBIND conn=1442 fd=24 closed do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT do_syncrep2: rid=002 (32) No such object do_syncrepl: rid=002 retrying (29 retries left) LDAPSEARCH IS ABLE TO RETRIEVE SEARCHBASE "" ldapsearch -LLL -h foo.bar -p 389 -x -D 'cn=syncrepl,dc=foo,dc=bar' -w '*****' -b '' -s sub '(objectclass=*)' '*' '+' conn=1441 fd=24 ACCEPT from IP=127.0.0.1:47269 (IP=0.0.0.0:389) conn=1441 op=0 BIND dn="cn=syncrepl,dc=foo,dc=bar" method=128 conn=1441 op=0 BIND dn="cn=syncrepl,dc=foo,dc=bar" mech=SIMPLE ssf=0 conn=1441 op=0 RESULT tag=97 err=0 text= conn=1441 op=1 SRCH base="" scope=2 deref=0 filter="(objectClass=*)" conn=1441 op=1 SRCH attr=* +

3 3

LDAP clients
by Foo Bar 16 Jun '10

16 Jun '10

hi i search for a stable openldap client. Can you recommend a client who works with openldap very good? thx -- Mit freundlichen Grüßen / Best Regards fooCCfoo

3 2

overlay unique in cn=config
by Nick Urbanik 16 Jun '10

16 Jun '10

Dear Folks, 1. Can I use the unique overlay with the dynamic cn=config configuration? 2. If so, what is the LDIF syntax for the configuration? 3. Would this work with OpenLDAP 2.3.43? -- Nick Urbanik http://nicku.org 808-71011 nick.urbanik(a)optusnet.com.au GPG: 7FFA CDC7 5A77 0558 DC7A 790A 16DF EC5B BB9D 2C24 ID: BB9D2C24 I disclaim, therefore I am.

3 4

Re: LDAP clients
by Chris Jacobs 16 Jun '10

16 Jun '10

I totally agree. One gotcha though: to see the system attributes (like pwdpolicy settings on an acct) you have to right click the acct and select show system attributes. That confused me for a while. - chris Chris Jacobs, Systems Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA 98121 phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 email: chris.jacobs(a)apollogrp.edu ________________________________ From: openldap-technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org To: Foo Bar Cc: openldap-technical(a)openldap.org Sent: Wed Jun 16 02:42:47 2010 Subject: Re: LDAP clients http://directory.apache.org/studio/ On Wed, Jun 16, 2010 at 11:29, Foo Bar <fooccfoo(a)googlemail.com<mailto:fooccfoo@googlemail.com>> wrote: hi i search for a stable openldap client. Can you recommend a client who works with openldap very good? thx -- Mit freundlichen Grüßen / Best Regards fooCCfoo -- To be or not to be -- Shakespeare | To do is to be -- Nietzsche | To be is to do -- Sartre | Do be do be do -- Sinatra ________________________________ This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical