openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

ppolicy : managing passwords by another user than root
by Smaïne Kahlouch 05 Feb '10

05 Feb '10

Hi everyone, I'm trying to allow a user to change the passwords of users in a specific subtree. For exemple : The user uid=admin-sales,o=Sales,dc=domain,dc=tld is allowed to change the passwords of users in the following directory : ou=Users,o=Sales,dc=domain,dc=tld. I figured it out by playing with the acl's but when enabling password policy the user uid=admin-sales can't change passwords anymore. The only user alloweded is the admin (root user). Is there a way to do so or is it impossible for another user than root to manage passwords with ppolicy enabled? Regards, Grifith

5 6

LDAP/Kerberos client config
by Jaap Winius 05 Feb '10

05 Feb '10

Hi all, Now that I'm satisfied with my OpenLDAP/Kerberos server configuration, I'm attempting to devise a suitable (Debian lenny) client setup for it. Although I hear that it may not be the best approach, I'm currently pursuing a client configuration that includes kstart, libnss-ldap, nscd and libpam-ldap. At the moment I'm happy with all of it except libnss-ldap. Kstart has no problem obtaining an initial Kerberos ticket, but I can't get libnss-ldap to use it to access the DIT. So far my libnss-ldap.conf looks like: base dc=example,dc=com uri ldap://ldapks1.example.com/ ldap_version 3 rootuse_sasl yes krb5_ccname FILE:/tmp/krb5cc_0 Any idea what I might be missing? Thanks, Jaap

2 1

>Proxy Just Binds/Authentications from another LDAP?
by Don Hoover 05 Feb '10

05 Feb '10

Well, I have been working on this question and have had an idea. Would a way to accomplish this is by using SASL? It took me about 10 minutes to figure out how to configure saslauthd to verify binds to the other LDAP server. Openldap can use SASL right? So I just need to get slapd to use SASL to verify the binds to the other external ldap server. So I would have: ldapclient bind request-> openldap slapd -> SASL-> external ldap server bind Is this a good idea? I don't see how to make slapd use the sasl server for this though, the only examples I can find are to use kerberos. Any ideas on how to get slapd to just use sasl like I have it setup?

3 6

Check for attributs modifications
by David LEROUX 04 Feb '10

04 Feb '10

Hi all, I'd like to know if there is an easy way to monitor attributes modification ? In fact I import my users accounts, automount maps and almost everything from nismaps every hour with padl scripts (a bit modified by me). So each time scripts imports entries, it don't care if the entry already exist or not, it try to create it, which results in a lot of errors (existing entries...). Furthermore, for now, if I want to modify an entry I have to do it myself... What I'd like to do, is to supervise created or updated entry, so that I can focus only on those one... I thought about something like replog but I'm not sure that's the good way to do it... Any help is welcome,

3 2

OpenLDAP Log files
by sgmayo＠mail.bloomfield.k12.mo.us 03 Feb '10

03 Feb '10

One of my teachers decided to move things around and plugged a network cable in the wrong place causing a network loop and it seems to have ended up corrupting my ldap database. Where are the log files from slapd at and/or how do I read them? I did a 'slapd -d -1' and the pages just keep flying by and never stop without a ctrl-c. I have run a slapd_db_recover on this Fedora 10 box, but that did not seem to fix the problem I guess. I did slapcat the directory to an ldif file yesterday, but I am wondering if it did not already contain some bad data. I may see if I can slapadd it back in if ldap does not have to be running. If it does then I will have to do something else. Thanks for any info. Took me 7 hours to track down the intermittent problems yesterday since it seemed to be server problems and now I am starting out again on the same track it seems. -- Scott Mayo - System Administrator Bloomfield Schools PH: 573-568-5669 FA: 573-568-4565 Question: Because it reverses the logical flow of conversation. Answer: Why is putting a reply at the top of the message frowned upon?

4 3

Problem with chain overlay
by Klaus Nagel 02 Feb '10

02 Feb '10

Hello, I have a little problem with the chain overlay and hope, someone can help me. I have a master and a slave server (both debian lenny with openldap 2.4.11) and a normal syncrepl replication between both, but I can't get the chain working. my slave slapd.conf entries: moduleload back_ldap overlay chain chain-uri "ldap://10.8.0.1:389/" chain-rebind-as-user TRUE chain-idassert-bind bindmethod=simple binddn="cn=admin,dc=test,dc=de" credentials=testpw mode=self chain-tls start chain-return-error TRUE if i try to delete an entry with ldapdelete on the slave server: ldapdelete -xD "cn=admin,dc=test,dc=de" -w testpw cn=abc,ou=Verteiler,dc=test,dc=de Log from slave server: conn=1 fd=13 ACCEPT from IP=127.0.0.1:48451 (IP=0.0.0.0:389) conn=1 op=0 BIND dn="cn=admin,dc=test,dc=de" method=128 conn=1 op=0 BIND dn="cn=admin,dc=test,dc=de" mech=SIMPLE ssf=0 conn=1 op=0 RESULT tag=97 err=0 text= conn=1 op=1 DEL dn="cn=abc,ou=Verteiler,dc=test,dc=de" conn=1 op=1 RESULT tag=107 err=8 text= conn=1 op=2 UNBIND conn=1 fd=13 closed Log from master server: conn=83 fd=15 ACCEPT from IP=10.8.0.2:44720 (IP=0.0.0.0:389) conn=83 op=0 BIND dn="" method=128 conn=83 op=0 RESULT tag=97 err=0 text= conn=83 op=1 DEL dn="cn=abc,ou=Verteiler,dc=test,dc=de" conn=83 op=1 RESULT tag=107 err=8 text=modifications require authentication conn=83 op=2 UNBIND conn=83 fd=15 closed ...it seems to me, that the bind-dn will not be transmitted and I don't see any start-tls entries. ...any hints for me? best regards: Klaus

3 2

Proxy Just Binds/Authentications from another LDAP?
by Don Hoover 02 Feb '10

02 Feb '10

I have been reading how to use slapd-ldap, and one thing that is not clear is if its possible just to proxy bind's. I have a LDAP directory that has all the unix posix accounts info in it for our users, but we have another LDAP server that has all the applications info and passwords for the users and is what should be doing all the actual authentication. What I would like to do is let the NIX systems get their unix account data from our LDAP server(/etc/passwd data etc), but proxy the bind requests generated from the user logins to the other LDAP server for authentication from the LDAP server that the system is pointed at for the posix account data. Is it possible just to force regular bind requests only to the other LDAP server and use that to authenticate our users? Most of the examples I have seen are all about using the proxy features of slapd-ldap to provide the actual data from the other LDAP server seamlessly, and not really for using that backed proxied LDAP server to just authenticate the binds. Any ideas? --- Don Hoover dxh(a)yahoo.com

1 0

do_syncrepl: ... rc 68 retrying
by Peter Mogensen 02 Feb '10

02 Feb '10

I have a mirror which has stopped replicating. (slapd 2.4.21) Somehow it has ended up in a situation where it looks like it is trying to replicate a modrdn operation, but the new RDN already exists on the consumer. Strangely, it doesn't exists on the producer. Like this: On Server1 (producer) I have: contextCSN: 20100202142811.287095Z#000000#001#000000 cn=A,dc=example,dc=com entryCSN: 20100127080339.261941Z#000000#001#000000 On Server2 (consumer) I have: contextCSN: 20100127075402.694373Z#000000#001#000000 cn=A,dc=example,dc=com entryCSN: 20100113084604.888851Z#000000#001#000000 cn=B,dc=example,dc=com entryCSN: 20100127075357.910468Z#000000#001#000000 I notice that the contextCSN of server2 is only a few seconds after the entryCSN for cn=B,dc=example,dc=com The log says: syncrepl_entry: rid=003 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) syncrepl_entry: rid=003 be_search (0) syncrepl_entry: rid=003 cn=A,dc=example,dc=com syncrepl_entry: rid=003 be_modrdn cn=B,dc=example,dc=com (68) do_syncrepl: rid=003 rc 68 retrying Any suggestion for how this could happen? regards, Peter

1 0

Mingw regex compile issue
by Rasmus Schram 02 Feb '10

02 Feb '10

Hello I am trying to compile the openldap v. 2.4.19 client api with MingW and Msys. It will successfully make the configure command, but when I try to make, it complains about not having a shared version of the regex library. I have tried to use both 'mingw-libgnurx-2.5.1' and 'regex-0.12' but with no luck. I am only interested in building the client api libraries, but the error results in only building a static version of the library and I really need the shared dll's instead. This is the Warning/issue I get trying to compile. --------------------------------------------------------------------- /bin/sh ../../libtool --mode=link gcc -g -O2 -no-undefined -avoid-version -rpath /usr/local/lib -o liblber.la assert.lo decode.lo encode.lo io.lo bprint.lo debug.lo memory.lo options.lo sockbuf.lo nt_err.lo version.lo -lregex -lws2_32 *** Warning: linker path does not have real file for library -lregex. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have *** because I did check the linker path looking for a file starting *** with libregex and none of the candidates passed a file format test *** using a file magic. Last file checked: /bin/libregex.a *** Warning: linker path does not have real file for library -lws2_32. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have *** because I did check the linker path looking for a file starting *** with libws2_32 and none of the candidates passed a file format test *** using a file magic. Last file checked: /mingw/lib/gcc/mingw32/3.4.5/../../..//libws2_32.a *** The inter-library dependencies that have been dropped here will be *** automatically added whenever a program is linked with this library *** or is declared to -dlopen it. *** Since this library must not contain undefined symbols, *** because either the platform does not support them or *** it was explicitly requested with -no-undefined, *** libtool will only create a static version of it. --------------------------------------------------------------------- I have tried various options but cannot find the cause of the problem. Any help would be appreciated. Regards Rasmus _________________________________________________________________ NY Windows Live Messenger med nye fede funktioner. Hent den her! http://download.live.com/messenger

1 1

refint overlay don't works as expected
by Sergei Butakov 01 Feb '10

01 Feb '10

Hi I'm using refint and memberof overlays. Refint overlay don't works as expected - it don't modifying one entry: uid=admin,ou=Users,dc=domain.local (which is a member of cn=webers,ou=Groups,dc=domain.local - see dump.ldif attachment). Changing the memberof-dangling option in the memberof overlay don't help. If I turn off the memberof overlay or move this entry to the end of dump.ldif file (after cn=webers,ou=Groups,dc=domain.local) then the refint overlay works as needed. Can somebody retest it or say where I'm wrong? Steps to reproduce: 1) stop slapd 2) copy the files (slapd.conf, bsl.schema, dump.ldif) from the attachment to the apropriate places. Correct the pathes (include, directory) in slapd.conf file. 3) rm -rf /path/to/openldap-data/* 4) slapadd -l dump.ldif 5) chown -R ldapd:ldapd openldap-data (use your own ldap user) 6) start slapd 7) test #1: $ ldapsearch -LLL -D cn=manager -w 1 -b "" '(cn=webers)' member dn: cn=webers,ou=Groups,dc=domain.local member: uid=admin,ou=Users,dc=domain.local member: uid=u1,ou=Users,dc=domain.local $ ldapsearch -LLL -D cn=manager -w 1 -b "" '(uid=*)' memberOf dn: uid=admin,ou=Users,dc=domain.local memberOf: cn=webers,ou=Groups,dc=domain.local dn: uid=u1,ou=Users,dc=domain.local memberOf: cn=webers,ou=Groups,dc=domain.local All OK. 8) now rename dc=domain.local: $ ldapmodrdn -r -D cn=manager -w 1 dc=domain.local dc=example.org -v ldap_initialize( <DEFAULT> ) Renaming "dc=domain.local" new rdn="dc=example.org" (delete old rdn) Rename Result: Success (0) 9) check #2: $ ldapsearch -LLL -D cn=manager -w 1 -b "" '(cn=webers)' member dn: cn=webers,ou=Groups,dc=example.org member: uid=admin,ou=Users,dc=example.org member: uid=u1,ou=Users,dc=example.org $ ldapsearch -LLL -D cn=manager -w 1 -b "" '(uid=*)' memberOf modifiersName dn: uid=admin,ou=Users,dc=example.org memberOf: cn=webers,ou=Groups,dc=domain.local memberOf: cn=webers,ou=Groups,dc=example.org modifiersName: cn=Manager dn: uid=u1,ou=Users,dc=example.org memberOf: cn=webers,ou=Groups,dc=example.org modifiersName: cn=Referential Integrity Overlay Error: refint overlay didn't change the uid=admin entry. -- Regards, Sergei Butakov

1 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical