openldap-technical

openldap-technical@openldap.org

9989 discussions

DN failed to copy
by Stuart Cherrington 13 Jul '10

13 Jul '10

Hi, Not sure if this is an issue with phpLDAPadmin 1.0.1 or Openldap2.4 (on rhel 5.3). I've created posixGroup's within my openLDAP and can see these within phpLDAPadmin, I was trying to copy the objects within my 'dc' prior to some invasive work, but I cannot copy the posixGroups. I have done copies of all other objects but posixGroup copy errors with: 'Failed to copy DN: cn=copydba,ou=group,dc=ldn,dc=sw,dc=com LDAP said: Object class violation Error number: 0x41 (LDAP_OBJECT_CLASS_VIOLATION) Description: You tried to perform an operation that would cause an undefined attribute to exist or that would remove a required attribute, given the current list of ObjectClasses. This can also occur if you do not specify a structural objectClass when creating an entry, or if you specify more than one structural objectClass.' Having looked through countless web pages it suggests that the posixGroup definition in the rfc2037bis.schema should have a MUST clause but it already has this: objectclass ( 1.3.6.1.1.1.2.2 NAME 'posixGroup' SUP top AUXILIARY DESC 'Abstraction of a group of accounts' MUST gidNumber MAY ( userPassword $ memberUid $ description ) ) Any advice would be great. Thanks, Stuart. _________________________________________________________________ http://clk.atdmt.com/UKM/go/197222280/direct/01/ We want to hear all your funny, exciting and crazy Hotmail stories. Tell us now

1 0

Re: Another question about LDAP over SSL
by Chris Jacobs 12 Jul '10

12 Jul '10

Bryan, Please reply-to-all. :) Moving on: I'm NOT a dev (I'm a sysadmin), but my take is: 1) Use OpenSSL libraries to see if the cert is 'trusted' by the local OS (signed by a trusted CA - whether by an internal CA or an external CA). If a non-linux based client, then you'll need to explore other options (Windows has it's own mechanism for example). 2) If not, and user responds with 'trust this cert' then you'll need to add the cert to the whatever your app uses (whether a cert file it manages, or the local OS - it's up to how you write it). My take: if it's not already trusted by the local cert library (managed per OS install) then use a single file managed by your app. Or, add it to the list of locally trusted CA's, but I don't think that's a great idea. Perhaps it's not trusted by design? Perhaps your app won't have permission? That can turn into a support nightmare... As for OpenSUSE, perhaps it's ldap.conf doesn't specify to require a trusted cert... I don't know - never used it. I do not believe there is an OpenLDAP library/API/etc to handle untrusted certs and make them trusted. I recommend you play around with getting an OS to trust a CA you create to see how this works. Then see what it takes to get that OS to use the OpenLDAP server for auth. You'll learn quite a bit... Course, the source code may be more enlightening - but I'm not a dev. Bash or PERL is more my style :p. Warning: there are two ldap.conf files in most linux distros: /etc/ldap.conf : used by PAM /etc/openldap/ldap.conf : used by OpenLDAP tools. Primarily on OpenLDAP servers (whether masters or slaves - now referred to as providers and consumers). - chris Chris Jacobs, Systems Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA 98121 phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 email: chris.jacobs(a)apollogrp.edu ________________________________ From: Bryan Boone <v_1bboon(a)yahoo.com> To: Chris Jacobs Sent: Mon Jul 12 20:23:18 2010 Subject: Re: Another question about LDAP over SSL Hi Chris thanks for the reply. Here is my problem. I have two LDAP browsers that I am testing on a PC. One is called JXplorer and the other is called LDAPEditor. You probably heard of jxplorer but LDAPEditor is old and probably out of support. Anyway JXplorer you have to manually transfer the SSL cert and load it into the program before you can connect to LDAP over SSL. When I use LDAPEditor to connect to my openLDAP server via SSL. The program prompts me to accept the server cert. I do not have to manually upload the cert into the program. So my question is... How do I accomplish this in the client I am writting? How can I use the openLDAP library to prompt a customer that asks them if they want to accept the server cert or not? Does this make sense? Also built into OpenSUSE is an LDAP browser. It gives the option to connect to LDAP over SSL as well. On this one you do not have to manually load the cert before hand. thanks ________________________________ From: Chris Jacobs <Chris.Jacobs(a)apollogrp.edu> To: "v_1bboon(a)yahoo.com" <v_1bboon(a)yahoo.com>; "openldap-technical(a)openldap.org" <openldap-technical(a)openldap.org> Sent: Mon, July 12, 2010 7:26:54 PM Subject: Re: Another question about LDAP over SSL This really is a basic 'cert' issue. There's a ton of non-openldap coverage of this topic (self-signed and CA purchased certs). In a nutshell, you'll need to provide a way for your customer's to use a cert of their choosing, and let them sort out how to get their clients to trust the signer of that cert. - chris Chris Jacobs, Systems Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA 98121 phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 email: chris.jacobs(a)apollogrp.edu ________________________________ From: openldap-technical-bounces(a)OpenLDAP.org <openldap-technical-bounces(a)OpenLDAP.org> To: openldap-technical(a)openldap.org <openldap-technical(a)openldap.org> Sent: Mon Jul 12 19:20:58 2010 Subject: Another question about LDAP over SSL Hi everyone. I have another "duh" question. I am writing software for a proprietary piece of hardware. I will be using the C libraries for openldap. I need to write some functions for LDAP so that the UI of the software has the option to authenticate a user via LDAP and LDAP over SSL. Basically it will just act like a client that will Simple Bind to the LDAP server for authentication. I read the document here. http://www.openldap.org/faq/data/cache/185.html I followed the instructions on the website to generate the SSL certs. My question is, on the website above it says.... "You must also install a copy of the CA certificate on all of your client machines. Configuration is done in /usr/local/etc/openldap/ldap.conf:" Does this mean I need to provide a way to the customer to manually transfer his/her CA cert the proprietary hardware, if they want to use LDAP over SSL??? Or when I use the Start TLS function, do the certs automatically get transfered behind the scene? thanks ________________________________ This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system. ________________________________ This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

1 0

Another question about LDAP over SSL
by Bryan Boone 12 Jul '10

12 Jul '10

Hi everyone. I have another "duh" question. I am writing software for a proprietary piece of hardware. I will be using the C libraries for openldap. I need to write some functions for LDAP so that the UI of the software has the option to authenticate a user via LDAP and LDAP over SSL. Basically it will just act like a client that will Simple Bind to the LDAP server for authentication. I read the document here. http://www.openldap.org/faq/data/cache/185.html I followed the instructions on the website to generate the SSL certs. My question is, on the website above it says.... "You must also install a copy of the CA certificate on all of your client machines. Configuration is done in /usr/local/etc/openldap/ldap.conf:" Does this mean I need to provide a way to the customer to manually transfer his/her CA cert the proprietary hardware, if they want to use LDAP over SSL??? Or when I use the Start TLS function, do the certs automatically get transfered behind the scene? thanks

2 1

Cannot authenticate with user/password
by Nicholas Syrotiuk 12 Jul '10

12 Jul '10

Dear OpenLDAP users, We have downloaded OpenLDAP 2.4.22 from Sunfreeware.com and installed it. We have successfully imported the LDAP data from another server. We are using the *simple* authentication method. I can authenticate as rootdn but not as a user. Is there something wrong with my access control list: ----------------------- access to * by self write by users read by anonymous none ------------------------- I have tried running slapd with debugging switched on but could not diagnose the problem. Any ideas on how to troubleshoot this? Cheers, Nick -- N Syrotiuk | Mimas | University of Manchester | Manchester M13 9PL

4 4

Adding replicant with ppolicy after the fact
by G.Pitman 12 Jul '10

12 Jul '10

Hi, I have a openldap installation that we recently implemented ppolicy and we have come to the point of using it in production. I am in the process of putting in a dedicated ldap replicant(punching bag) and I am having trouble importing the directory due to the ppolicy extended attributes not being modifiable. Is there a way to preserve the password ages and other pwd related history to the new replicant? I reckon I could copy the entire contents of /var/lib/ldap/ from an old replicant to the new, and cross my fingers but that doesn't seem like the correct path. Redhat EL 5.5 openldap-servers-2.3.43-12.el5 Thanks for listening,

2 1

How to best handle DN+String and DN+Binary in OL?
by Andrew Bartlett 12 Jul '10

12 Jul '10

I'm back on my occasional task of trying to get the OpenLDAP backend to Samba4 going again, and was hoping to simply test out the fine work done on the vernum module. (which I should have tested at the time it was developed). Anyway, Samba has moved on, and things have broken. Part of the changes relate to these additional DN types (found in AD), of: #define DSDB_SYNTAX_BINARY_DN "1.2.840.113556.1.4.903" http://msdn.microsoft.com/en-us/library/ms684429%28VS.85%29.aspx #define DSDB_SYNTAX_STRING_DN "1.2.840.113556.1.4.904" http://msdn.microsoft.com/en-us/library/ms684430%28VS.85%29.aspx #define DSDB_SYNTAX_OR_NAME "1.2.840.113556.1.4.1221" http://archives.free.net.ph/message/20091211.162430.74b43d9e.en.html These are quite odd in their behaivour, but in short they are both a string or binary blob and a DN, all in one. Only the DN portion is relevant for attribute matching rules. Currently, I map these to strings, but they are not strings - and need proper DN match rules, as I need to be able to use the 'deref' module on them (and to correctly handle the case sensitive/insensitive nature of DNs). What is the best way to get OpenLDAP to understand it needs to match on and follow references to the DN part of these values? (Additionally, even when just use deref with normal DNs, I'm not getting a the control response, but I need to get more info before I can pin the details down) Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Cisco Inc.

4 11

Attribute type is operational
by Stuart Cherrington 12 Jul '10

12 Jul '10

Hi, I'm running Openldap 2.4 on Rhel5. I've got the basics working, user accounts etc, but have tried adding some new schemas which I'm getting problems with. I followed a VERY helpful Blog at http://oracle-cookies.blogspot.com/2007/01/get-tnsnamesora-from-openldap.ht… which allowed me to install some Oracle OID schema's so we can move away from Oracle OID. This Blog is a little out of date and I have some attributetypes which I need to add-in to the schema. I've added the following 2 lines: attributetypes ( 2.16.840.1.113894.1.1.37 NAME 'orclGuid' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) attributetypes ( 2.16.840.1.113894.1.1.1000 NAME 'orclnormdn' EQUALITY distinguishedNameMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) I took these from the current 10.2.0 OID installation so wasn't 100% sure they were correct but they are similar in construct the others found on the blog. When I restart ldap2.4 I get error: service ldap2.4 restart Checking config file /etc/openldap2.4/slapd.conf: [FAILED] /etc/openldap2.4/schema/oidbase.schema: line 27 attributetypes: "2.16.840.1.113894.1.1.37" is operational slaptest2.4: bad configuration file! Having Googled it, I found this to mean that the attributetype had already been declared but I cannot find where, I checked in my current schemas and the defaults under /usr/share/openldap2.4/schema but found nothing. Anyone help here? Thanks, Stuart Cherrington. _________________________________________________________________ http://clk.atdmt.com/UKM/go/197222280/direct/01/ Do you have a story that started on Hotmail? Tell us now

3 2

Access control for multiple admins
by Luiz Marcelo 10 Jul '10

10 Jul '10

Hello everyone! Good, I have a scenario where two directors write on the same basis, eg "cn=admin1,dc=domain,dc=com" and "cn=admin2,dc =domain,dc=com" In a general scope, both have written permission from the base. However, assuming the user admin1 adds the entry: "uid=john,ou=people,dc=domain,dc=com", only the admin1 user can modify this entry, so each admin should only modify their own entries created in any part of the base. Someone would have any idea how I could create an access control list for this Thanks!

4 3

Re: LDAP Master hangs from time to time
by Cloud Strife 09 Jul '10

09 Jul '10

Hi Sir Edward, It does not have a pattern when it will hang, no specific time or day. The solution we always do is just restart the application and then its ok. We're still investigating the cause of this hanging. We'll look up at your suggestions. Thanks for your help On Fri, Jul 9, 2010 at 10:15 PM, Edward Capriolo <edlinuxguru(a)gmail.com>wrote: > On Fri, Jul 9, 2010 at 2:16 AM, Cloud Strife <tipidpc.ataman(a)gmail.com> > wrote: > > Hello, > > > > We have noticed that our Master LDAP hangs every month; i.e. it stopped > > processing requests. We're using openldap-2.3.43-3.el5 for LDAP master > and > > slave machines. Does this version have a known bug? Unfortunately, > upgrading > > the version in not an option right now, though we're considering it for > the > > future. Do you have any suggestion/recommendations besides upgrading? > > > > Thanks! > > > > As a guy who played FF7 for 99:99:60 hours and then some, I feel I am > obligated to help. It is rather strange for a piece of software to > fail once a month. Is it always on the same day or the same time. If > so look in /etc/cron.d and see if any process could be causing this > (faulty log roll-over, something that uses a lot of resources). > > You have not included any information that can let people help you. > Are you logging? Are there any messages in your slapd log? How about > /var/log/messages or /var/log/dmesg? Is there a memory leak? Are you > trending CPU/MEMORY/DISK activity over time using a monitor or SAR. > Have you tried capturing network traffic with tcpdump to try and > determine if there is a burst of traffic at that time? >

1 0

Segmentation Fault
by Paul Harvey 09 Jul '10

09 Jul '10

On 07/09/2010 05:48 PM, Quanah Gibson-Mount wrote: > --On Thursday, July 08, 2010 1:32 PM +0200 Paul Harvey > <pharvey(a)cern.ch> wrote: > >> Does anyone have any suggestions, and what more information do i need to >> provide. > > Well, the version of OpenLDAP you are using would be useful. Given > that without that, we can't even tell you of any fix(es) that may have > occurred since what you are running. Also, whether or not you built > OpenLDAP yourself, or if it is provided by an OS distribution, and if > it is from an OS distribution, what that is as well. > > --Quanah > > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration Hi, You may have guessed that i am new to this... @(#) $OpenLDAP: slapd 2.4.21 (Apr 26 2010 11:07:14) $ buildd@rothera:/build/buildd/openldap-2.4.21/debian/build/servers/slapd Think that this says it all, simply got it from the repo at wget http://staff.telkomsa.net/packages/OpenLDAP.repo -O /etc/yum.repos.d/OpenLDAP.repo

3 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical