openldap-technical

openldap-technical@openldap.org

9897 discussions

OpenLDAP 2.6 installation on RHEL 7.9
by sumanbadra＠gmail.com 23 Nov '21

23 Nov '21

Hi, I have been trying to install OpenLDAP 2.6 in RHEL 7.9. At my first attempt it was failed as it requires openssl version 1.1.1 or greater. I had installed 1.1.1l as earlier version was openssl 1.0.2k. (installed with "./config --prefix=/usr --openssldir=/etc/ssl --libdir=lib shared" from the directory /usr/local/src/openssl-1.1.1l as root account and export LD_LIBRARY_PATH=/usr/local/lib:/usr/local/lib64 echo "export LD_LIBRARY_PATH=/usr/local/lib:/usr/local/lib64" >> ~/.bashrc) Verified openssl vesrion # openssl version OpenSSL 1.1.1l 24 Aug 2021 # which openssl /bin/openssl # openssl version -d OPENSSLDIR: "/usr/local/ssl" Now when I tried openldap 2.6 again I am getting below error ------ checking for sys/un.h... yes checking openssl/ssl.h usability... yes checking openssl/ssl.h presence... yes checking for openssl/ssl.h... yes checking for SSL_export_keying_material_early in -lssl... no configure: error: Could not locate TLS/SSL package ------ I am trying to run below config vi /root/.ldap-env -------- export PATH=/opt/orsus/openldap-2.6/bin:/opt/orsus/openldap-2.6/sbin:/opt/orsus/openldap-2.6/libexec:$PATH export OWNER=ldap:ldap export CONFIG=/opt/orsus/openldap-2.6/etc/openldap/slapd.d -------- source /root/.ldap-env ./configure --with-cyrus-sasl --with-argon2 --with-systemd --with-tls=openssl --enable-overlays=mod --enable-backends=mod --disable-perl --disable-ndb --enable-crypt --enable-modules --enable-dynamic --enable-syslog --enable-debug --enable-local --enable-spasswd --disable-sql --disable-hdb --disable-bdb --prefix=/opt/orsus/openldap-2.6.0 I have tried below but still no luck. LDFLAGS="-L/usr/lib64/openssl -Wl,-rpath,/usr/include/openssl" CPPFLAGS="-I/usr/include/openssl" export CPPFLAGS export LDFLAGS Kindly help me. Thank you!!

1 0

contextCSN value
by bourguijl＠gmail.com 16 Nov '21

16 Nov '21

Dears, In context of a 4 MMR mirrored, if I do a ldapsearch for contextCSN of cn=config, I get following output : contextCSN: 20210720121843.555301Z#000000#000#000000 contextCSN: 20211001095511.729248Z#000000#001#000000 contextCSN: 20211021090559.554997Z#000000#002#000000 contextCSN: 20211025120556.001311Z#000000#003#000000 contextCSN: 20211021090202.909879Z#000000#004#000000 which is correct as I've 4 servers, but if I do same request for my own dn DB o=xxxx.be, I get following output : contextCSN: 20211116155042.534901Z#000000#001#000000 contextCSN: 20211116153150.449895Z#000000#002#000000 for me I should receive 003 & 004 ones too as they are in mirrored mode, no ? Can you advice ? Thx, Jean-Luc.

3 2

global vs. frontend config in slapd.conf
by Michael Ströder 16 Nov '21

16 Nov '21

HI! Since the fix for ITS#9575 there is this misleading message even when invoking slapcat: /opt/openldap-ms/etc/openldap/slapd.conf: line 126: setting password scheme in the global entry is deprecated. The server may refuse to start if it is provided by a loadable module, please move it to the frontend database instead As you can see I'm using static config (aka slapd.conf). Can I avoid this warning by rearraging something in slapd.conf? Ciao, Michael.

2 2

Re: Referrals on glued databases
by Nick Folino 16 Nov '21

16 Nov '21

nvm. I found the updatedn option. On Tue, Nov 16, 2021 at 9:24 AM Nick Folino <nick(a)folino.us> wrote: > > > ---------- Forwarded message --------- > From: Nick Folino <nick(a)folino.us> > Date: Tue, Nov 16, 2021 at 9:12 AM > Subject: Referrals on glued databases > To: OpenLDAP Technical Discussion List <openldap-technical(a)openldap.org> > > > Can anyone provide guidance on using referrals on consumers with glued > directories? > > For example if I have a root of dc=bar, with a separate database glued as > o=foo,dc=bar. Replication works fine in o=foo by configuring it on dc=bar. > > Configuring an updateref on dc=bar also works for updates to dc=bar, but > does not work for updates to o=foo. > > I can't add an updateref to o=foo as there is no replication defined on > that database. > > How can I configure this to provide referrals from all glued directories? > > Nick >

1 0

Referrals on glued databases
by Nick Folino 16 Nov '21

16 Nov '21

Can anyone provide guidance on using referrals on consumers with glued directories? For example if I have a root of dc=bar, with a separate database glued as o=foo,dc=bar. Replication works fine in o=foo by configuring it on dc=bar. Configuring an updateref on dc=bar also works for updates to dc=bar, but does not work for updates to o=foo. I can't add an updateref to o=foo as there is no replication defined on that database. How can I configure this to provide referrals from all glued directories? Nick

1 0

RE: [EXT]:Re: OpenLDAP SSLV3 disable
by Quanah Gibson-Mount 15 Nov '21

15 Nov '21

--On Sunday, November 14, 2021 9:36 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > I modified the file as per the base but no luck with that. > When I look TLS library which slapd program it's looks like it's using > gnutls . Do I need to configure in different way for GNUTLS for TLS > version in slapd. Yes. You will need to consult the GnuTLS documentation. The slapd man page clearly states that the TLSProtocolMin option is ignored when linked to GnuTLS. I generally advise linking to OpenSSL for a number of different reasons. I believe with GnuTLS you do this via the TLSCipherSuite option to slapd. See also <https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/ht…>. One example from Exim sets the cipher suites to: NORMAL:!VERS-SSL3.0 so that may be of help. See also the slapd.conf(5) man page section on TLSCipherSuite for the GnuTLS command line to print out relevant information. This ticket may also be helpful: <https://mod.gnutls.org/ticket/29> --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

OpenLDAP client build/compilation steps on Windows platform
by c.venugopal521＠gmail.com 11 Nov '21

11 Nov '21

Hi Team, I am planning to migrate the NSLDAP C SDK to OpenLDAP (2.5/2.6) client SDK of the latest version. For this, I need to build OpenLDAP libraries/dlls to use them for our source code compilation and to run our application. Can someone please provide detailed steps to compile OpenLDAP on Windows platform with Microsoft Visual Studio 2019 as C compiler. - How to prepare a build environment (like any Cygwin installation required?) - What are the prerequisites for building OpenLDAP on Windows? - How to pass prerequisites while building OpenLDAP - What are the ENV variables that need to be set before building OpenLDAP code? - What are the options that we should pass to ./configure to generate .libs and .dlls (shared libs and static) along with TLS (say: OpenSSL as SSL provider) - What are the changes required in OpenLDAP source code to compile successfully on Windows with MSVC compiler if any? I am expecting .libs and .dll files (ex: libldap.lib, libldap.dll, liblber.lib, liblber.dll etc) from the compilation of OpenLDAP along with client utilities (.exe s) Once I successfully build, I will try to build OpenLDAP on the RHEL platform with gcc C compiler as my next step. Please help me here to build OpenLDAP successfully.

2 3

compare operation behaves differently under 2.5
by Paul B. Henson 10 Nov '21

10 Nov '21

I've run into another quirk during my 2.5 upgrade process. We use the Apache ldap authnz module with a configuration such as: AuthLDAPURL ldaps://ldap.cpp.edu:636/DC=cpp,DC=edu?uid Require ldap-group uid=unxadmin,ou=group,dc=cpp,dc=edu This stopped working when accessing a server updated to 2.5. On the 2.4 server, the Apache logs look like: [Wed Nov 10 15:07:52.056237 2021] [authnz_ldap:debug] [pid 29887] mod_authnz_ldap.c(926): [client 10.104.223.117:51050] AH01714: auth_ldap authorize: require group: testing for member: uid=henson,ou=user,dc=cpp,dc=edu (uid=unxadmin,ou=group,dc=cpp,dc=edu) [Wed Nov 10 15:07:52.056264 2021] [authnz_ldap:debug] [pid 29887] mod_authnz_ldap.c(935): [client 10.104.223.117:51050] AH01715: auth_ldap authorize: require group: authorization successful (attribute member) [Comparison true (cached)][6 - Compare True] and the slapd logs look like: Nov 10 15:07:52 ldap-01 slapd[1233]: conn=224154 op=4 CMP dn="uid=unxadmin,ou=group,dc=cpp,dc=edu" attr="member" Nov 10 15:07:52 ldap-01 slapd[1233]: conn=224154 op=4 RESULT tag=111 err=6 text= Nov 10 15:08:42 ldap-01 slapd[1233]: conn=224154 fd=138 closed (connection lost) whereas on the 2.5 server, the Apache logs look like: [Wed Nov 10 15:03:52.375004 2021] [authnz_ldap:debug] [pid 29088] mod_authnz_ldap.c(926): [client 10.104.223.117:51022] AH01714: auth_ldap authorize: require group: testing for member: uid=henson,ou=user,dc=cpp,dc=edu (uid=unxadmin,ou=group,dc=cpp,dc=edu) [Wed Nov 10 15:03:52.375887 2021] [authnz_ldap:debug] [pid 29088] mod_authnz_ldap.c(945): [client 10.104.223.117:51022] AH01719: auth_ldap authorize: require group "uid=unxadmin,ou=group,dc=cpp,dc=edu": didn't match with attr member [Comparison false (adding to cache)][5 - Compare False] and the slapd logs look like: Nov 10 15:03:52 ldap-03 slapd[1197]: conn=208924 op=4 CMP dn="uid=unxadmin,ou=group,dc=cpp,dc=edu" attr="member" Nov 10 15:03:52 ldap-03 slapd[1197]: conn=208924 op=4 RESULT tag=111 err=5 qtime=0.000011 etime=0.000139 text= If I understand correctly, Apache is making a compare call to check to see if my DN (uid=henson,ou=user,dc=cpp,dc=edu) exists as a value of the member attribute in the group uid=unxadmin,ou=group,dc=cpp,dc=edu. It certainly does, on both the server running 2.4 and 2.5: dn: uid=unxadmin,ou=group,dc=cpp,dc=edu objectClass: groupOfNames objectClass: cppGroup objectClass: posixGroup uid: unxadmin cn: Unix Administrators gidNumber: 17730 member: member: uid=gkuri,ou=user,dc=cpp,dc=edu member: uid=henson,ou=user,dc=cpp,dc=edu memberUid: gkuri memberUid: henson Any thoughts on why this is behaving differently? The configuration should be pretty much identical, modulo required path changes and updating the memberOf handling. I was able to work around it by sitting a couple of additional parameters: AuthLDAPGroupAttribute memberUid AuthLDAPGroupAttributeIsDN off This now compares just my uid (henson) to the group memberUid attribute: Nov 10 15:24:54 ldap-03 slapd[1197]: conn=210708 op=4 CMP dn="uid=unxadmin,ou=group,dc=cpp,dc=edu" attr="memberUid" Nov 10 15:24:54 ldap-03 slapd[1197]: conn=210708 op=4 RESULT tag=111 err=6 qtime=0.000016 etime=0.000108 text= Apparently "err=6" is good and "err=5" is not :)? I was able to replicate this difference in behavior using the CLI tools: # ldapcompare -x -H ldaps://ldap-01.ldap.cpp.edu/ uid=unxadmin,ou=group,dc=cpp,dc=edu member:uid=henson,ou=user,dc=cpp,dc=edu TRUE # ldapcompare -x -H ldaps://ldap-03.ldap.cpp.edu/ uid=unxadmin,ou=group,dc=cpp,dc=edu member:uid=henson,ou=user,dc=cpp,dc=edu FALSE ldapsearch confirms that attribute exists for that group in both locations: ldapsearch -x -H ldaps://ldap-01.ldap.cpp.edu/ member=uid=henson,ou=user,dc=cpp,dc=edu dn | grep unxadmin # unxadmin, group, cpp.edu dn: uid=unxadmin,ou=group,dc=cpp,dc=edu # ldapsearch -x -H ldaps://ldap-03.ldap.cpp.edu/ member=uid=henson,ou=user,dc=cpp,dc=edu dn | grep unxadmin # unxadmin, group, cpp.edu dn: uid=unxadmin,ou=group,dc=cpp,dc=edu Help :)? Thanks much…

2 4

DirSync support in OpenLDAP
by shekhar.shrinivasan＠gmail.com 10 Nov '21

10 Nov '21

Hi Team, We have a OpenLDAP Proxy in front of Active Directory servers and all client applications perform ldap operations via the Proxy. One of the applications seems to be not working as expected and when we checked the logs we see this error SEARCH RESULT tag=101 err=12 nentries=0 text=critical extension is not recognized After discussing with the app owner we understand that we need to enable support for dirsync. Can you please let us know if OpenLDAP supports DirSync and what exactly needs to be done on the OpenLDAP proxy. Thanks you for your help !

3 3

RE: [EXT]:Re: OpenLDAP SSLV3 disable
by Quanah Gibson-Mount 09 Nov '21

09 Nov '21

--On Tuesday, November 9, 2021 5:41 AM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > Is this possible to give slapd.conf reference file . > I did updated config section and restart the slapd but that did not > helped. This would be an extremely basic slapd.conf file: include /usr/local/etc/openldap/schema/core.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args loglevel stats TLSCACertificateFile /path/to/ca/cert TLSCertificateFile /path/to/server/cert TLSCertificateKeyFile /path/to/server/private/key TLSProtocolMin 3.3 modulepath /usr/local/lib/openldap moduleload back_mdb.la database config rootpw secret database mdb maxsize 1073741824 suffix "dc=my-domain,dc=com" rootdn "cn=Manager,dc=my-domain,dc=com" rootpw secret directory /usr/local/var/openldap-data index objectClass eq database monitor If you are still unable to set the minimum protocol, I would advise confirming what TLS library your slapd build is linked to. For example, the TLSProtocolMin parameter has no effect when slapd is linked to GnuTLS. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical