openldap-technical

openldap-technical@openldap.org

9897 discussions

back-sql with thunderbird-frontend fails
by rpeschke＠peschke-it.de 12 Jun '10

12 Jun '10

Hi, I have an OpenLDAP running with the back-sql. On ldapsearch it runs quite good, but thunderbird refuses to use the LDAP addressbook. In the logged query, excerpts see below, it requests it's "secondary" attributes like custom1 etc.. These attributes are not part of any schema. What's the solution: 1. to modify all thunderbirds configuration, where the secondary attributes are configured. There are some th...!? 2. defining my own schema to extend the mozillaAbPersonAlpha-schema? 3. Looking for a schema in the net? Any suggestions what to do? Thank you Ralf PS: Here are some lines from the slapd-log: Jun 11 23:30:49 osicsd slapd[2652]: conn=1000 op=2 SRCH base="dc=address" scope=2 deref=0 filter="(|(mail=*.*)(cn=*.*)(givenName=*.*)(sn=*.*))" Jun 11 23:30:49 osicsd slapd[2652]: conn=1000 op=2 SRCH attr=o company mail mozillaCustom3 custom3 street streetaddress postOfficeBox mozillaUseHtmlMail xmozillausehtmlmail mozillaCustom2 custom2 mozillaHomeCountryName ou department departmentnumber orgunit mobile cellphone carphone telephoneNumber title mozillaCustom1 custom1 mozillaNickname xmozillanickname mozillaWorkUrl workurl fax facsimiletelephonenumber mozillaSecondEmail xmozillasecondemail mozillaCustom4 custom4 nsAIMid nscpaimscreenname givenName l locality homePhone mozillaHomeUrl homeurl mozillaHomeStreet st region mozillaHomePostalCode mozillaHomeLocalityName birthyear mozillaWorkStreet2 mozillaHomeStreet2 postalCode zip c countryname pager pagerphone sn surname mozillaHomeState description notes modifytimestamp cn commonname Jun 11 23:30:49 osicsd slapd[2652]: is_entry_objectclass("", "2.16.840.1.113730.3.2.6") no objectClass attribute Jun 11 23:30:49 osicsd slapd[2652]: is_entry_objectclass("", "2.16.840.1.113730.3.2.6") no objectClass attribute Jun 11 23:30:49 osicsd slapd[2652]: conn=1000 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text= Jun 11 23:34:31 osicsd slapd[2652]: conn=1000 op=3 UNBIND Jun 11 23:34:31 osicsd slapd[2652]: conn=1000 fd=13 closed

1 0

Re: Migratate Zimbra to Openldap
by Claudio Guzman 11 Jun '10

11 Jun '10

I need not upgrade, I require the zimbra ldap export and import it into a machine that only has ldap

2 1

Re: Migratate Zimbra to Openldap
by Claudio Guzman 11 Jun '10

11 Jun '10

when you place the export amount of zimbra and then only throw me different errors ldap Could not add object: cn=central,ou=people,dc=domainname,dc=org LDAP said: LDAP_UNDEFINED_TYPE The attribute type specified is invalid. would have to create the values to import the schema? best regard Claudio

2 1

Migratate Zimbra to Openldap
by Claudio Guzman 11 Jun '10

11 Jun '10

Exporting the data will place all of your LDAP Data into a single, movable .LDIF file. su – zimbra openldap/sbin/slapcat -f /opt/zimbra/conf/slapd.conf -l /tmp/ldap.ldif 6.0+: /opt/zimbra/libexec/zmslapcat /backup when you imported a number of mistakes and I pulled that scheme is another way, how could I make a proper import or apply some filter to get all of zimbra thanks.

2 1

Restricting client access using pam_groupdn with dynamic groups : Was[Re: restrict host login based on group]
by Shamika Joshi 11 Jun '10

11 Jun '10

Hi I've followed Adam's post below on 'using pam_groupdn to use dynlist' to my query posted couple of months back and after revisiting this configuration facing issue with doing ssh to client machine with dynamic member of the group. It works correctly for the static members of the same group.Could you figure out if I'm missing something here?? Currently using Ubuntu 9.10 which uses slapd.d configuration directory. dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb *olcModuleLoad: {1}dynlist.la* olcModuleLoad: {2}syncprov dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=testlab,dc=com olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=testla b,dc=com" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=admin,dc=testlab,dc=com" write by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=testlab,dc=com olcRootPW: 1234 olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: uid pres,eq olcDbIndex: cn,sn,mail pres,eq,approx,sub olcDbIndex: objectClass eq *dn: olcOverlay={0}dynlist,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcDynamicList olcOverlay: {0}dynlist olcDlAttrSet: {0}groupOfNames labeledURI member* *ldap.conf* on client machine contains # Group to enforce membership of *pam_groupdn cn=u910desk,ou=Machines,dc=testlab,dc=com* # Group member attribute *pam_member_attribute member** * I have added following group *dn: cn=u910desk,ou=Machines,dc=testlab,dc=com* cn: u910desk ipHostNumber: 172.17.5.232 objectClass: top objectClass: groupOfNames objectClass: labeledURIObject objectClass: ipHost* labeledURI: ldap://172.17.0.200/ou=Users,dc=testlab,dc=com??one?(host=cms3)* member: cn=placeholder,dc=testlab,dc=com member: uid=henry,ou=Users,dc=testlab,dc=com Also a user with host=cms3 entry, which should become dynamic member 'u910desk' after resolving labledURI above *dn: uid=jack,ou=Users,dc=testlab,dc=com* cn: jack sn: jack givenName: jack uid: jack uidNumber: 1002 gidNumber: 513 homeDirectory: /home/jack loginShell: /bin/bash gecos: System User host: cms3 objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: hostobj shadowMax: 45 However when I run search for member of group 'u910desk' it returns following : member list does not contain entry of user 'jack' here $ldapsearch -xLLL -b 'cn=u910desk,ou=Machines,dc=testlab,dc=com' member dn: cn=u910desk,ou=Machines,dc=testlab,dc=com member: cn=placeholder,dc=testlab,dc=com member: uid=henry,ou=Users,dc=testlab,dc=com For same reason(not sure tho) I think I'm not able to ssh to this client using 'jack', however ssh using 'henry' works it being a static member of 'u910desk'. admins@u910desk:~$ ssh jack@localhost jack@localhost's password: You must be a member of cn=u910desk,ou=Machines,dc=testlab,dc=com to login. Connection closed by ::1 admins@u910desk:~$ admins@u910desk:~$ admins@u910desk:~$ admins@u910desk:~$ ssh henry@localhost henry@localhost's password: Linux u910desk 2.6.31-17-generic #54-Ubuntu SMP Thu Dec 10 17:01:44 UTC 2009 x86_64 To access official Ubuntu documentation, please visit: http://help.ubuntu.com/ 164 packages can be updated. 90 updates are security updates. Last login: Wed Jun 2 17:10:19 2010 from localhost henry@u910desk:~$ Any help in this matter will be highly appreciated. Thanks in advance Shamika On Sat, Dec 12, 2009 at 4:53 AM, Adam Hough <adam(a)gradientzero.com> wrote: > I am guessing you are either using RHEL5, Centos5 or some other RHEL5 based > distro. I replaced the openldap that was on my centos5 machines with an > newer version at 2.4.16+patches. > > I have uploaded the rpms and srpms of what I used which you can do a drop > in replacement of the RHEL5 based openldap rpms. > http://www.gradientzero.com/openldap/ > > I do not remember for sure but I think I had to force one or 2 of the > packages it get it to install but once everyhting is installed then it ran > fine for me. I have 3 ldap servers using this version setup in a > multi-master setup. > > Since I am doing a multimastet setup, I do not use slapd.conf but rather > the slapd.d configuration directory though the dynlist overlay should work > with slapd.conf as well. > > > - Adam > >> >> >> On Fri, Dec 11, 2009 at 4:18 AM, Adam Hough <adam(a)gradientzero.com>wrote: >> >>> There are other ways to populate the pam_groupdn that you have associated >>> with each machine but those all correspond to some attribute in the user's >>> profile. >>> >>> I have pam_groupdn setup like this >>> >>> /etc/ldap.conf: >>> pam_groupdn cn=<GROUP_NAME>,ou=Systems,dc=domain,dc=com >>> pam_member_attribute member >>> >>> cn=<GROUP_NAME>,ou=Systems,dc=domain,dc=com >>> cn: <GROUP_NAME> >>> objectClass: top >>> objectClass: groupOfNames >>> objectClass: labeledURIObject >>> member: uid=nobody,ou=People, dc=domain,dc=com >>> labeledURI: ldap:///ou=People,dc=domain,dc=com??one?(host=<type of >>> system>) >>> labeledURI: ldap:///ou=People,dc=domain,dc=com??one?(gidNumber=XXXX) >>> >>> So as you can see you can have as many labeledURI attributes as you want >>> or need. I tend to use the host name function of what the host does. >>> >>> This is how my account profile would look: >>> uid=<MYUSERID>,ou=People,dc=domain,dc=com >>> host: "cluster" >>> host: sysadmin >>> >>> So "cluster" is a compute cluster that we have and thus for all those >>> machines the pam_groupdn cn="cluster",ou=Systems,dc=domain,dc=com, and for >>> machines where only the sysadmins login to then pam_groupdn >>> cn=sysadmin,ou=Systems,dc=domain,dc=com. >>> >>> As long as you can for a labeledURI: >>> ldap:///ou=People,dc=domain,dc=com??one?<attribute>=<value>) type search you >>> can use it to auto populate the group. >>> >>> Summary: >>> * Do to not think of the host attribute as host = hostname but as host = >>> type of machine and that you can have more then one labeledURI per group to >>> help populate the group. >>> * Use good gidNumbers for groups to help auto populate groupOfName style >>> groups. >>> >>> >>> >>> - Adam >>> >>> >>> >>> On Wed, Dec 9, 2009 at 4:01 AM, Shamika Joshi <shamika.joshi(a)gmail.com>wrote: >>> >>>> Hi Adam, >>>> I'm able to get host auth working by using host attribute.But the >>>> drawback of that is everytime there a new machine, I have to add that host >>>> to all the users I want to grant access to. If I decide to do it based on >>>> group membership, I can use pam_groupdn but then it does not allow multiple >>>> group entries there, plus it has to be managed on client side,which is even >>>> more undesirable by any administrator. >>>> >>>> I went through this article but I'm not sure if it will work if I have >>>> some members already associated with some groups. Like ldap1 & ldap2 members >>>> of qagroup & ldap3 & ldap4 members of sysadmin, would this method allow me >>>> to limit access based on their group membership?? if yes...could you briefly >>>> explain with an example? >>>> >>>> Thank for your time in advance >>>> Shamika >>>> >>>> >>>> >>>> On Wed, Dec 9, 2009 at 9:04 AM, Adam Hough <adam(a)gradientzero.com>wrote: >>>> >>>>> Here is is the write up that I read to figure out how to do setup to >>>>> auto-restrict users to certain hosts. >>>>> >>>>> >>>>> http://www.hurricanelabs.com/september2009_login_security_using_openldap_an… >>>>> >>>>> >>>>> >>>> >>> >> >

3 4

Communicate from php/apache to openLDAP over LDAPS
by Jérémy ESCOLANO 11 Jun '10

11 Jun '10

Hi I'm writing from france cuz i'm having a big problem with apache and ldap. let me explain : I would like to make an Apache server communicate in php with en openLDAP server (both servers are under win srv 2003), using LDAPS protocol. In order to activate LDAPS on my openLDAP srv (srvLDAP), I created self signed certificates with openSSL. I got 3 files: cacert.pem srvLDAP.pem srvLDAP.key I configured my slapd.con file and ldap.conf fil (openLDAP side) like this: slapd.conf TLSCertificateFile ./ssl/srvLDAP.pem TLSCertificateKeyFile ./ssl/srvLDAP.key TLSCACertificateFile ./ssl/cacert.pem ldap.conf BASE <ma branche> URI ldaps://srvLDAP/ TLS_CACERT ./ssl/cacert.pem TLS_REQCERT demand I launched my openLDAP service, and checked ldaps protocol was okay, using this command : C:\Program Files\OpenLDAP>ldapsearch -b o=exemple,dc=fr -s sub -x -w pass-D cn=admin,o=exemple,dc=fr -H ldaps://srvLDAP/ Now I would like, from the remote apache server, communicate with the openLDAP server using [b]LDAPS[/b] Protocol. Here is my simplified PHP code <h2>LDAP OPENLDAP LDAPS</h2> <?php $host="ldaps://srvldap"; $port="636"; $ds=ldap_connect($host,$port); ldap_set_option($ds,LDAP_OPT_PROTOCOL_VERSION,3); $r=ldap_bind($ds,"cn=admin,o=exemple,dc=fr","pass" ); $sr=ldap_search($ds,"o=exemplec,dc=fr",("objectClass=maclasse" )); $info=ldap_get_entries($ds,$sr); print $info["count"]." enregistrements trouvés."; ?> I get this errror: Unable to bind to server: Can't contact LDAP server I know i have to configure certificates in the Apache server configuration, I tried to to this according several internet ressources but didn't succeed. I also read this link [URL=" http://forum.hardware.fr/hfr/OSAlternatifs/Logiciels-2/certificats-securise…"]Here[/URL] which is a french link which speak about an ldap.con and ldaprc files to put in the apache server. I did it but nothing happened. Well, i'm lost in all this stuff, that is why i'm asking for help to configure my servers to use ldaps with php. Do you have information that could help me ? I thank you in advance

5 12

Delta-syncrepl and delay in replication
by MIKI Soichiro 11 Jun '10

11 Jun '10

Hi All, I am testing delta-syncrepl using OpenLDAP 2.3.43.7(actually as ZimbraLDAP on ZCS 5.0.16). It spends a lot of time to complete replication when adding 20,000 or 200,000 objects(accounts) to the master at a time. [Time for replication] User time(updates to master) replica1 replica2 ------------------------------------------- 20,000 0:19:03 0:58:51 1:19:29 200,000 2:38:03 4:33:39 13:33:38 [Setting value in LDAP] *checkpoint = 10240 *Thread numbers = 8 *Security = 0(zimbra_require_interprocess_security) *The following operation is actually executed by each user in a loop. 1.Add account 2.Add settings(filters,contacts,signatures) for an account 3.Update the setting of the created account There seems no performance problem with writing accesslog to the database, thus, updates to the master server was finished successfully in reasonable time. Also, it seems that there is no bottleneck such as resource of the servers, and we still have extra spaces on CPU, memory and network. I've attached the servers spec. I assume there will be a problem with the process of pushing data from LDAP master to multiple replicas, but is this process serialized ? How can we reduce the replication time on replica servers? I think updates could not be delayed on the replicas themselves because only the secondary replica took a lot of time to update data. And we don't have plan to execute export/import method. Here are the settings of the provider and the replicas: ######################################################## # BDB database definitions for provider # excluding Zimbra settings ######################################################## database bdb suffix "" rootdn "cn=config" # number of entries to keep in memory cachesize 10000 # number of search results to keep in memory idlcachesize 10000 # check point whenever 64k data bytes written or # 5 minutes has elapsed whichever occurs first checkpoint 64 5 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory "/opt/zimbra/openldap-data" # recommended for replication index entryUUID eq index entryCSN eq sizelimit unlimited timelimit unlimited overlay syncprov syncprov-checkpoint 20 10 syncprov-sessionlog 500 include /opt/zimbra/conf/master-accesslog-overlay.conf ################################################## # BDB database definitions for consumer ################################################## database bdb suffix "" rootdn "cn=config" # number of entries to keep in memory cachesize 10000 # number of search results to keep in memory idlcachesize 10000 # check point whenever 64k data bytes written or # 5 minutes has elapsed whichever occurs first checkpoint 64 5 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory "/opt/zimbra/openldap-data" index uid pres,eq # white pages index mail pres,eq,sub index cn pres,eq,sub index displayName pres,eq,sub index sn pres,eq,sub index gn pres,eq,sub # recommended for replication index entryUUID eq index entryCSN eq sizelimit unlimited timelimit unlimited ###include /opt/zimbra/conf/master-accesslog-overlay.conf syncrepl rid=100 provider=ldap://ldapm.XXX1.XXX-test.ne.jp:389 retry="60 +" type=refreshAndPersist schemachecking=off searchbase="" bindmethod=simple binddn=uid=zmreplica,cn=admins,cn=zimbra credentials=@@ldap_replication_password@@ starttls=critical logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" syncdata="accesslog" updateref ldap://ldapm.ngm1.XXX-test.ne.jp:389 overlay syncprov Please let us know if you need more information. Best Regards, Soichiro Miki ===== Soichiro Miki Hitachi Software Engineering Co,Ltd. s-miki(a)hitachisoft.jp

3 2

OU string representation in openldap
by rahul.manchanda＠bt.com 11 Jun '10

11 Jun '10

Hello, One of the our application functionality reads the hosts data from the ldap particularly dn - "ou=hosts, ou=hostdata,o=BT" and from application point this dn will be updated when we add any new hosts in administration tab. In application there is no restriction on the host name to be entered. It can be anything mean it can accept _ (underscore) , (comma) .(dot). But when this code snippet reads this DN and in case if the ou has characters like . or , or _ it will throw exception when it reads such dn(s). We tried changing putting string syntax to this particular attribute and tried but getting the same results. Is this the expected behavior? And is there a way we can change this behavior? Many Thanks in advance!! Regards Rahul

2 1

TLS Connection Failure
by Radomir Klacza 10 Jun '10

10 Jun '10

Hi all, I'm trying to establish TLS connection with my newly configured OpenLDAP server, but all the time I get the TLS Connection Failure error. I have the following configuration in slapd.conf: TLSCACertificateFile /etc/openldap/cacert.pem TLSCertificateFile /etc/openldap/servercrt.pem TLSCertificateKeyFile /etc/openldap/serverkey.pem TLSVerifyClient never The CA and certs where creating with accordance to this tutorial: http://www.openldap.org/faq/data/cache/185.html server error (with loglevel -1): connection_get(29) Jun 10 10:51:30 firma slapd[6203]: connection_get(29): got connid=190 Jun 10 10:51:30 firma slapd[6203]: connection_read(29): checking for input on id=190 Jun 10 10:51:30 firma slapd[6203]: connection_read(29): TLS accept failure error=-1 id=190, closing Jun 10 10:51:30 firma slapd[6203]: connection_closing: readying conn=190 sd=29 for close Jun 10 10:51:30 firma slapd[6203]: connection_close: conn=190 sd=29 Jun 10 10:51:30 firma slapd[6203]: daemon: removing 29 Jun 10 10:51:30 firma slapd[6203]: conn=190 fd=29 closed (TLS negotiation failure) the client error: # ldapsearch -d -1 -H ldap://192.168.2.49 -D 'cn=Manager,dc=melog,dc=com' -W -ZZ ldap_create ldap_url_parse_ext(ldap://192.168.2.49) ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 192.168.2.49:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 192.168.2.49:389 ldap_connect_timeout: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x978a418 ptr=0x978a418 end=0x978a437 len=31 0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ber_scanf fmt ({) ber: ber_dump: buf=0x978a418 ptr=0x978a41d end=0x978a437 len=26 0000: 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e w...1.3.6.1.4.1. 0010: 31 34 36 36 2e 32 30 30 33 37 1466.20037 ber_flush: 31 bytes to sd 3 0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ldap_write: want=31, written=31 0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ldap_result ld 0x9782218 msgid 1 ldap_chkResponseList ld 0x9782218 msgid 1 all 1 ldap_chkResponseList returns ld 0x9782218 NULL wait4msg ld 0x9782218 msgid 1 (infinite timeout) wait4msg continue ld 0x9782218 msgid 1 all 1 ** ld 0x9782218 Connections: * host: 192.168.2.49 port: 389 (default) refcnt: 2 status: Connected last used: Thu Jun 10 10:50:24 2010 ** ld 0x9782218 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 0x9782218 Response Queue: Empty ldap_chkResponseList ld 0x9782218 msgid 1 all 1 ldap_chkResponseList returns ld 0x9782218 NULL ldap_int_select read1msg: ld 0x9782218 msgid 1 all 1 ber_get_next ldap_read: want=8, got=8 0000: 30 84 00 00 00 10 02 01 0....... ldap_read: want=14, got=14 0000: 01 78 84 00 00 00 07 0a 01 00 04 00 04 00 .x............ ber_get_next: tag 0x30 len 16 contents: ber_dump: buf=0x978b550 ptr=0x978b550 end=0x978b560 len=16 0000: 02 01 01 78 84 00 00 00 07 0a 01 00 04 00 04 00 ...x............ read1msg: ld 0x9782218 msgid 1 message type extended-result ber_scanf fmt ({eaa) ber: ber_dump: buf=0x978b550 ptr=0x978b553 end=0x978b560 len=13 0000: 78 84 00 00 00 07 0a 01 00 04 00 04 00 x............ read1msg: ld 0x9782218 0 new referrals read1msg: mark request completed, ld 0x9782218 msgid 1 request done: ld 0x9782218 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ber_scanf fmt ({eaa) ber: ber_dump: buf=0x978b550 ptr=0x978b553 end=0x978b560 len=13 0000: 78 84 00 00 00 07 0a 01 00 04 00 04 00 x............ ldap_parse_result ber_scanf fmt ({iaa) ber: ber_dump: buf=0x978b550 ptr=0x978b553 end=0x978b560 len=13 0000: 78 84 00 00 00 07 0a 01 00 04 00 04 00 x............ ber_scanf fmt (}) ber: ber_dump: buf=0x978b550 ptr=0x978b560 end=0x978b560 len=0 ldap_msgfree TLS trace: SSL_connect:before/connect initialization tls_write: want=142, written=142 0000: 80 8c 01 03 01 00 63 00 00 00 20 00 00 39 00 00 ......c... ..9.. 0010: 38 00 00 35 00 00 88 00 00 87 00 00 84 00 00 16 8..5............ 0020: 00 00 13 00 00 0a 07 00 c0 00 00 33 00 00 32 00 ...........3..2. 0030: 00 2f 00 00 45 00 00 44 00 00 41 00 00 07 05 00 ./..E..D..A..... 0040: 80 03 00 80 00 00 05 00 00 04 01 00 80 00 00 15 ................ 0050: 00 00 12 00 00 09 06 00 40 00 00 14 00 00 11 00 ........@....... 0060: 00 08 00 00 06 04 00 80 00 00 03 02 00 80 9b 34 ...............4 0070: a3 18 95 67 ad a3 47 d0 89 9b 85 3f e2 e5 7a 44 ...g..G....?..zD 0080: e5 72 f1 07 82 06 51 45 f2 17 d9 a2 47 51 .r....QE....GQ TLS trace: SSL_connect:SSLv2/v3 write client hello A tls_read: want=7, got=0 TLS: can't connect. ldap_perror ldap_start_tls: Connect error (-11) client is configured: TLS_CACERT /etc/openldap/cacert.pem and cacert is the same like on the server. I'm using gentoo with openldap 2.4.19-r1 and openssl 0.9.8n I'm working on it for long time and currently I have no idea why it does not working...

2 1

User restriction
by Stuart Cherrington 10 Jun '10

10 Jun '10

Hi, I'm migrating from a Sun One DS service to Openldap 2.4. In our current setup, the ldap.conf on each client the nss_base_passwd line is configured as nss_base_passwd ou=people,dc=ldn,dc=sw,dc=com?sub?ismemberof=cn=access,ou=auth,dc=ldn,dc=sw,dc=com This ensures that only users within the CN 'access' can login to the servers. Have exported and imported the data and carried out necessary cleaning up work, the ldapsearch brings back identical output when examining 'cn=access,ou=auth,dc=ldn,dc=sw,dc=com' but on my client which talks to the Openldap server, I cannot login with any accounts is the above setting is in place. I'm presuming that the issue is about the config of the above line but try as I might I can't get it to work correctly. Any help would be appreciated. Thanks, Stuart Cherrington. _________________________________________________________________ http://clk.atdmt.com/UKM/go/197222280/direct/01/ Do you have a story that started on Hotmail? Tell us now

7 8

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical