openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

memberOf overlay
by Chris Alavoine 06 Apr '10

06 Apr '10

Hi all, Am trying to get the memberOf overlay attribute working with openLDAP. I need to authenticate to a Cisco ASA 5510 and set up group mapping policy. I've been round the houses quite a few times and got pretty close but no Marlboro Light (let alone a cigar). My slapd.conf looks like this: # /etc/ldap/slapd.conf # # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/misc.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_bdb #syncprov added by PT 2009-01-19 moduleload syncprov # cja/ess/2010.03.29 - added memberOf overlay moduleload memberof.la overlay memberof sizelimit 500 tool-threads 1 backend bdb database bdb suffix "dc=essence" rootdn "cn=admin,dc=essence" rootpw xxxxxxxxxxxxxxxxxxxxxxx directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass,entryCSN,entryUUID eq lastmod on checkpoint 512 30 replogfile /var/lib/ldap/replog #syncprov added by PT 2009-01-19 overlay syncprov syncprov-checkpoint 10 5 syncprov-sessionlog 100 access to attrs=userPassword,sambaNTPassword,sambaLMPassword by dn="cn=admin,dc=essence" write by dn="cn=samba,dc=essence" write by dn="cn=guest,dc=essence" read by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=essence" write by dn="cn=samba,dc=essence" write by * read # end I've added an LDIF as follows: dn: cn=vpnusers,ou=Groups,dc=essence objectclass: groupOfNames cn: vpnusers member: userid=chris.alavoine,ou=Users,dc=essence Which seems to enter ok. I'm using phpldapadmin to look at my directory. The new group "vpnusers" shows up ok and if I do a: ldapsearch -x -b "dc=essence" '(uid=chris.alavoine)' memberOf I get: # chris.alavoine, Users, essence dn: uid=chris.alavoine,ou=Users,dc=essence memberOf: cn=vpnusers,ou=Groups,dc=essence Unfortunately, when I try and query this information from the Cisco it's not picking up on the memberOf attribute. I've set up attribute mapping on the Cisco which allows me to convert the memberOf attribute into something readable by the Cisco but it's not getting that far. I'm using Ubuntu 8.04 and openLDAP 2.4.9 Any help much appreciated. c:) -- ACS (Alavoine Computer Services) Chris Alavoine mob +44 (0)7724 710 730 www.alavoinecs.co.uk

1 0

forgotten rootdn psw
by Francis, Steve (IHG) 06 Apr '10

06 Apr '10

ok...So i'm an ID10T!! LOL. But seriously, I setup an OpenLdap server and migrated /etc/passwd to it, and all is well: however, I did that months ago, and you guessed it, somehow I'm having a "senior" moment, and can't remember the psw for the rootdn, so that I can add another user to the Ldap server. I'm sure there is probably a way to decode the "hashed/encrypted" password. Any help would be greatly appreciated. I really don't want to have to delete everything and start again, but if that's what I must do, then so be it. Thanks in advance, Steve Francis Technical Advisor - zSeries, zLinux, z/OS IHG Alpharetta Data Center Ph: 770-442-7157 Cell: 770-906-3122 IM: francisihg

6 6

Sample Large ldiff file to support 1K users
by Meena Ram 06 Apr '10

06 Apr '10

Dear folks: If anyone has sample large ldiff file which supports around 1000 users please let me know. Require it for some particular purpose so that it saves some time.Really appreciate your help on this. Send me the link or the ldif file itself Cheers!!!!!!!!!!! RAM

3 2

too many open files and over 1K xinetd running
by Seger, Mark 06 Apr '10

06 Apr '10

I'm using xinetd forwarding to allow a number of compute nodes that don't have a direct path to our ldap server to get forward on by a host that does. When running a highly parallel job that starts over 1K instances at the same time, I see all these xinetd instances also start up on my forwarding server and in fact they don't seem to go away, at not any time soon. Meanwhile back on my ldap server I see number of 'too many open files' errors in /var/log/messages and if I try to "su user" on one of the nodes I'll see it hang for awhile. I have bumped the number of open files very high on the ldap server and in fact: [root@aicgateway ~]# cat /proc/sys/fs/file-nr 5610 0 201116 So out of a pool of 200K we're only using 5K. Anyhow, I'm wondering if there are any special tricks to configuring the environment to handling this type of load on ldap OR should it be able to handle it the way I'm currently configured? Any special tuning hints? Any more info I can supply? -mark

3 4

failure to connect ldap
by m.anis 05 Apr '10

05 Apr '10

Hi all, i just install open-ldap server, and i'm following this steps: i'm installing it on FreeBSD 8.0 #*cd /usr/local/etc/openldap* #*sed -I .old 's/rootpw/# rootpw/' slapd.conf* #*echo -n "rootpw ">> slapd.conf* #*slappasswd>> slapd.conf *#*ee /usr/local/etc/openldap/slapd.conf* suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" here what i confused about, i'm running this on localhost, so what should i use? suffix "dc=localhost,dc=localdomain" or my host name ( i got it from nslookup from windows) is 11.<unit name>.<institute name>.ac.id suffix "dc=11.<unit name>.<institute name> ,dc=ac.id" or anything else? then when i tried to do this #*ldapadd -x -D "cn=Manager,dc=*example*,dc=*com*" -W -f domainmgr.ldif -c it asks for my password, then i insert my password and then and error messages occured ldap bind: can't contact LDAP server (-1) i had search through google but i don't get the answer, thanks for your help, * -- -- Best Regards Muhammad Anis

2 1

uri="" bug
by DT Piotr Wadas 04 Apr '10

04 Apr '10

Hello, http://www.openldap.org/lists/openldap-technical/201001/msg00181.html Is it in progress or fixed in repository, or should I try to create a patch? P. -- http://dtpw.pl/buell [ 25th anniversary of Buell - American Motorcycles ] Linux aleft 2.6.27.29-0.1_lustre.1.8.1.1-default #1 SMP drbd version: 8.3.7 (api:88/proto:86-91) pacemaker 1.0.6-cebe2b6ff49b36b29a3bd7ada1c4701c7470febe

1 2

Sample Large ldiff file to support 1K users
by Meena Ram 03 Apr '10

03 Apr '10

1 0

handshake failure / SSL3_GET_CLIENT_HELLO:no shared cipher s3_srvr
by Götz Reinicke - IT-Koordinator 01 Apr '10

01 Apr '10

Hi, this drives my crazy for about two days: I do have two virtual Red Hat El 5.4 servers in a test environment. One should be an openldap master, the second should be a openldap slave. openssl-0.9.8e-12.el5_4.1, openldap-2.3.43-3.el5 (RH EL original rpms) I followed some instructions to set up TLS: Set up a CA, generate/sign certificates and keys, install tham on the servers and configure openldap, restart. My problem is: tls works on the master (which also is my CA for the test), but not on the slave. I've "openssl verify"ed and "openssl x509 -text"ed the certs - everything seams o.k. I've checked ip addresses, name resolving, locations, pathes, permissions, fileversions - anything I can think of. I've regenerated the key and cert for the slave following an other documentation (at least with the same steps), but alway do get the same error: from the ldap server debug: TLS trace: SSL3 alert write:fatal:handshake failure TLS trace: SSL_accept:error in SSLv3 read client hello B TLS trace: SSL_accept:error in SSLv3 read client hello B TLS: can't accept. TLS: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher s3_srvr.c:975 connection_read(13): TLS accept failure error=-1 id=0, closing from the ldap client debug: TLS trace: SSL3 alert read:fatal:handshake failure TLS trace: SSL_connect:error in SSLv2/v3 read server hello A TLS: can't connect. ldap_perror ldap_start_tls: Connect error (-11) additional info: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure May be I missed a step or still skiped something ... A thousand kowtows for any helping hint...!! Best regards, Götz -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzende des Aufsichtsrats: Prof. Dr. Claudia Hübner Geschäftsführer: Prof. Thomas Schadt

1 0

remote connections cannot write to LDAP
by Ray Carrender 01 Apr '10

01 Apr '10

Not sure what's going on here, but when I try making a non TLS connection to the LDAP Repository and it's local (say using ldapmodify) I can write to it, but when trying to connect to remotely (on the internal network) it doesn't throw an error but it ignores the write command. Am I missing something here? Maybe it's because I'm using JNDI instead of the written ldapmodify. Also, remotely I can read information, just not write it. Thanks!

2 1

New LDAP Appliances
by Howard Chu 01 Apr '10

01 Apr '10

No, not the VMware kind... http://www.symas.com/blog/ -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical