openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

nss_ldap: failed to bind to LDAP server ldap://127.0.0.1: Can't contact LDAP server
by Mingyur Koblensky 01 Mar '10

01 Mar '10

Hi all, I'm playing with a redhat enterprise 4 that uses ldap, since a few days i've notice that the slapd daemon is not able to bind to the default port 389, i'm very new to this server so i could being doing something of very stupid! [root@ myserver etc]# netstat -tuan | grep 389 [root@ myserver etc]# i was wondering if a run time file of the server hasn't been properly removed due to a brutal restart, and now the process isn't able to bind to any port, does that make sense? which files should i look for? [root@ myserver etc]# ls /var/run/openldap/ [root@ myserver etc]# ls /var/lock/ dmraid lvm rpm subsys [root@ myserver etc]# i've tried to reinstall/downgrade various packages but nothing: [root@ myserver etc]# rpm -q openldap openldap-2.2.13-12.el4_8.2 [root@ myserver etc]# rpm -q openldap-servers openldap-servers-2.2.13-12.el4_8.2 [root@ myserver etc]# rpm -q openldap-clients openldap-clients-2.2.13-12.el4_8.2 [root@ myserver etc]# rpm -q nss_ldap nss_ldap-253-7.el4 [root@ myserver etc]# Mar 1 08:03:24 myserver su[5988]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1: Can't contact LDAP server Mar 1 08:03:24 myserver su[5988]: nss_ldap: could not search LDAP server - Server is unavailable Mar 1 08:03:24 myserver su[5988]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1: Can't contact LDAP server Mar 1 08:03:24 myserver su[5988]: nss_ldap: could not search LDAP server - Server is unavailable Mar 1 08:03:46 myserver netstat: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1: Can't contact LDAP server Mar 1 08:03:46 myserver netstat: nss_ldap: could not search LDAP server - Server is unavailable Mar 1 08:03:46 myserver netstat: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1: Can't contact LDAP server Mar 1 08:03:46 myserver netstat: nss_ldap: could not search LDAP server - Server is unavailable Mar 1 08:11:32 myserver runuser: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1: Can't contact LDAP server Mar 1 08:11:32 myserver runuser: nss_ldap: could not search LDAP server - Server is unavailable Mar 1 08:11:32 myserver runuser: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1: Can't contact LDAP server Mar 1 08:11:32 myserver runuser: nss_ldap: could not search LDAP server - Server is unavailable Mar 1 08:11:32 myserver runuser: config file testing succeeded Mar 1 08:11:32 myserver slapd[6476]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1: Can't contact LDAP server Mar 1 08:11:32 myserver slapd[6476]: nss_ldap: could not search LDAP server - Server is unavailable Mar 1 08:11:32 myserver slapd[6476]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1: Can't contact LDAP server Mar 1 08:11:32 myserver slapd[6476]: nss_ldap: could not search LDAP server - Server is unavailable Mar 1 08:13:23 myserver saslauthd[5038]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1: Can't contact LDAP server Mar 1 08:13:23 myserver saslauthd[5038]: nss_ldap: could not search LDAP server - Server is unavailable Mar 1 08:13:23 myserver saslauthd[5038]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1: Can't contact LDAP server Mar 1 08:13:23 myserver saslauthd[5038]: nss_ldap: could not search LDAP server - Server is unavailable Mar 1 08:13:23 myserver smtp(pam_unix)[5038]: check pass; user unknown Mar 1 08:13:23 myserver smtp(pam_unix)[5038]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= Mar 1 08:13:23 myserver saslauthd[5038]: pam_ldap: ldap_simple_bind Can't contact LDAP server Mar 1 08:13:26 myserver saslauthd[5038]: do_auth : auth failure: [user=user] [service=smtp] [realm=] [mech=pam] [reason=PAM auth error] Mar 1 08:13:29 myserver netstat: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1: Can't contact LDAP server Mar 1 08:13:29 myserver netstat: nss_ldap: could not search LDAP server - Server is unavailable Mar 1 08:13:29 myserver netstat: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1: Can't contact LDAP server Mar 1 08:13:29 myserver netstat: nss_ldap: could not search LDAP server - Server is unavailable configuration files: /etc/ldap.conf # @(#)$Id: ldap.conf,v 1.34 2004/09/16 23:32:02 lukeh Exp $ # # This is the configuration file for the LDAP nameservice # switch library and the LDAP PAM module. # # host 127.0.0.1 dc=tfis,dc=domain,dc=org # The port. # Optional: default is 389. port 389 timelimit 20 bind_timelimit 20 bind_policy soft idle_timelimit 3600 ssl no tls_cacertdir /etc/openldap/cacerts pam_password md5 base dc=tfis,dc=domain,dc=org /etc/openldap/ldap.conf # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. BASE dc=tfis,dc=domain,dc=org HOST 127.0.0.1 TLS_CACERTDIR /etc/openldap/cacerts #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never /etc/openldap/slapd.conf # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args database bdb suffix "dc=tfis, dc=domain, dc=org" rootdn "cn=Manager,dc=tfis,dc=domain,dc=org" directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub thank you very much for some help!! i don't know where too look anymore, i've installed the same package on another redhat enterprise 4 and it correctly binds the default port, i'm thinking to move temporarily the ldap database on the other server which should be: 1) cp /usr/lib/ldap 2) cp configuration files 3) configure web application to use the new slapd server am i missing something ? thanks ! kocisky p.s. i've been googling around and there is something but no results : (

2 1

Re: overlay chain and TLS/SSL
by Ralf Zimmermann 01 Mar '10

01 Mar '10

Hi Dieter, >> Hi all, >> >> I think I have a problem with the overlay chain and tls. We have one physical >> master and two slaves in VMware Vsphere4. Our configuration runs normally fine, >> but sometimes we can't modify entries like passwords to the master. Then we >> must restart the slapd at the slaves. After restarting slapd all works fine. >> Then slapd works fine the wholy day. We can change entries or set passwords on >> the slaves. Next morning we must restart the slapd again, because we can't >> modify entries from the slaves. But we can query the slapd and syncrepl works >> fine. Only things over the overlay chains doesn't work. I have the problem not >> only with Version 2.4.20. I tested more Versions and actually 2.4.21 from >> pysically hardware. >> >> If I can't set entries on the slave I don't see any tcp packets from the slave >> to the master. DNS, time and so on looks fine and everything else is working. >> And if we restart slapd everything is working. Does anybody know what is going >> wrong and if there exits a workaround. I read some things abount /dev/random, >> /dev/urandom and kernel 2.6 in VMware. Can this be the problem? >> >> Here the overlay chain configuration. >> >> <snip slapd.conf> >> overlay chain >> chain-uri "ldap://eisenherz.camelot.de/"; >> chain-idassert-bind bindmethod=simple >> binddn="cn=ldapadmin,dc=camelot,dc=de" >> credentials="xxxxxx" >> mode="self" >> chain-rebind-as-user TRUE >> chain-return-error TRUE >> chain-tls start >> </snip slapd.conf> >> >> Any help is appreciated. > >What version is this? >I found that with 2.4.21 a tls_cacert option solved my problem. I have the problem in 2.4.12, 2.4.18, 2.4.19, 2.4.20 and 2.4.21. >chain-tls start > tls_cacert="/opt/openldap/etc/openldap/certs/avciCA.pem > tls_reqcert="demand" > >slapd-ldap(5) provides more TLS options. > I know and I have configured some of them. But the problem still exists. I can't see any packets on the network device from the slave to the master. If I restart the slave slapd then all works fine for a time. But I will read the man page again. Today have sent a mail to the list with two traces. One with a successfull passmod and one with nonworking passmod. Here the link: http://www.openldap.org/lists/openldap-technical/201003/msg00019.html The differences in the traces are hdb_dn2id entries. When the passmod over the slave is ok then I can see entries like: bdb_dn2entry("cn=ldapadmin,dc=camelot,dc=de") => hdb_dn2id("cn=ldapadmin,dc=camelot,dc=de") <= hdb_dn2id: got id=0x5 entry_decode: "" <= entry_decode() or => hdb_dn2id("ou=policies,dc=camelot,dc=de") <= hdb_dn2id: got id=0x9 => hdb_dn2id("cn=default,ou=policies,dc=camelot,dc=de") <= hdb_dn2id: got id=0xa entry_decode: "" <= entry_decode() When the passmod failed these entries are not in the trace. After restarting the slapd I can change passwords over the slaves and I can see the hdb_dn2id entries in the trace. Regards Ralf Zimmermann -- .''`. Ralf Zimmermann : :' : SIEGNETZ.IT GmbH `. `' Schneppenkauten 1a `- 57076 Siegen Tel.: +49 271 68193 13 Fax.: +49 271 68193 29 Amtsgericht Siegen HRB4838 Geschaeftsfuehrer: Oliver Seitz Sitz der Gesellschaft ist Siegen

1 0

OpenLDAP client configuration with CentOS 5.3
by Cool The Breezer 01 Mar '10

01 Mar '10

Hi All, We have a dedicated LDAP server and I would like to configure OpenLDAP client in our linux boxes running on centOS 5.3. I have installed openldap client and changed /etc/openldap/ldap.conf with folllowing info BASE dc=my, dc=net URI ldap://10.122.12.13 But when I try to run ldapsearch, I get following error SASL/EXTERNAL authentication started ldap_sasl_interactive_bind_s: Unknown authentication method (-6) additional info: SASL(-4): no mechanism available: The objective is anybody having ldap id can login to linux box. At present, I am manually creating individual ids which we want to integrate with LDAP authentication. I would appreciate your help - RB

6 19

Nssov Problem Since 2.4.19
by Chris Breneman 01 Mar '10

01 Mar '10

Hi, For the last few days, I've been trying to get nssov to work. I've mainly been working with OpenLDAP 2.4.21, but this issue is present in all releases since and including 2.4.19. It works fine in 2.4.18. Everything compiles fine as expected, and the module loads (it seems), but when I try to add configuration for the module with ldapadd, I get this error: ldap_add: Other (e.g., implementation specific) error (80) additional info: <olcOverlay> handler exited with 1 Using the same build instructions, configuration, and everything, 2.4.18 works without this error. Some more details are below. I'd try to fix it myself, but I don't really know where to start. I'd appreciate it if someone could point me in the right direction. Thanks, Chris Breneman More details: Process for building OpenLDAP (done as root): cd openldap-2.4.21 ./configure --enable-modules --enable-overlays make depend make -j2 make install cd contrib/slapd-modules/nssov/nss-ldapd ./configure # Make complains about missing something unless ./configure is executed in nss-ldapd first cd .. make make install libtool --finish /usr/local/lib # As per instructions from the make output Relevant slapd configuration: dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/local/libexec/openldap olcModuleLoad: /usr/local/libexec/openldap/nssov.la Listing of modules: $ ls /usr/local/libexec/openldap/ nssov.a nssov.la nssov.so nssov.so.0 nssov.so.0.0.0 Command to add nssov configuration: ldapadd -H ldap://localhost -x -D 'cn=config' -w <password> LDIF for nssov configuration: dn: olcOverlay={0}nssov,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcNssOvConfig olcOverlay: {0}nssov olcNssSsd: passwd ldap:///ou=people,dc=cluenet,dc=org??one ldapadd output: adding new entry "olcOverlay={0}nssov,olcDatabase={1}bdb,cn=config" ldap_add: Other (e.g., implementation specific) error (80) additional info: <olcOverlay> handler exited with 1 Relevant output from running slapd with -d -1 on startup: loaded module /usr/local/libexec/openldap/nssov.la module /usr/local/libexec/openldap/nssov.la: null module registered Relevant output from running slapd with -d -1 on ldapadd command: >>> dnPrettyNormal: <olcOverlay={0}nssov,olcDatabase={1}bdb,cn=config> => ldap_bv2dn(olcOverlay={0}nssov,olcDatabase={1}bdb,cn=config,0) <= ldap_bv2dn(olcOverlay={0}nssov,olcDatabase={1}bdb,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcOverlay={0}nssov,olcDatabase={1}bdb,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcOverlay={0}nssov,olcDatabase={1}bdb,cn=config)=0 <<< dnPrettyNormal: <olcOverlay={0}nssov,olcDatabase={1}bdb,cn=config>, <olcOverlay={0}nssov,olcDatabase={1}bdb,cn=config> conn=1000 op=1 ADD dn="olcOverlay={0}nssov,olcDatabase={1}bdb,cn=config" => access_allowed: add access to "olcOverlay={0}nssov,olcDatabase={1}bdb,cn=config" "entry" requested <= root access granted => access_allowed: add access granted by manage(=mwrscxd) <= acl_access_allowed: granted to database root oc_check_required entry (olcOverlay={0}nssov,olcDatabase={1}bdb,cn=config), objectClass "olcNssOvConfig" oc_check_allowed type "objectClass" oc_check_allowed type "olcOverlay" oc_check_allowed type "olcNssSsd" oc_check_allowed type "structuralObjectClass" slap_queue_csn: queing 0xb5d52ab2 20100228195617.582000Z#000000#000#000000 => access_allowed: add access to "olcDatabase={1}bdb,cn=config" "children" requested <= root access granted => access_allowed: add access granted by manage(=mwrscxd) olcOverlay: value #0: <olcOverlay> handler exited with 1! send_ldap_result: conn=1000 op=1 p=3 send_ldap_result: err=80 matched="" text="<olcOverlay> handler exited with 1" send_ldap_response: msgid=2 tag=105 err=80

2 2

RE: Trouble with memberOf Overlay
by masarati＠aero.polimi.it 28 Feb '10

28 Feb '10

> > I thank you for your response, but I'm not exactly certian I understand. > This is a new LDAP install and a everything is fresh. I am not working > with an existing database. Are you saying I should move the > configurations that is specific to the memberOf overlay to the top of my > db.ldif config file? Please reply to the mailing list, not to me directly. No, I'm not saying anything like that. Since yours is a fresh setup, then your error (or the bug) must be somewhere else. I have no clue at the moment; replying to the list might allow someone not as clueless to provide support. p.

1 0

Trouble with memberOf Overlay
by Bill Keirskie 28 Feb '10

28 Feb '10

I was looking through list archives and a few weeks ago, someone posted some configurations for the memberOf overlay. I modified the configurations slightly and it looks like everything is installed (with no errors) and working, but when run an ldapsearch, it does not return the memberOf. Below is the install and configuration method. Any guidance on what to change or error logs to look at? Thx Bill ##MY RESULTS## server-1# ldapsearch -LL -Y EXTERNAL -H ldapi:/// "(uid=test1)" -b dc=example,dc=com memberOf SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 version: 1 dn: uid=test1,ou=People,dc=example,dc=com ##INSTALL AND CONFIG## sudo apt-get -y install slapd ldap-utils cd /etc/ldap sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetorgperson.ldif sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif sudo vi db.ldif # Load dynamic backend modules dn: cn=module{0},cn=config objectClass: olcModuleList cn: module {0} olcModulepath: /usr/lib/ldap olcModuleload: {0}back_hdb olcModuleload: {1}memberof.la # Create the database dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=example,dc=com olcRootDN: cn=admin,dc=example,dc=com olcRootPW: password olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcLastMod: TRUE olcDbCheckpoint: 512 30 olcDbIndex: uid pres,eq olcDbIndex: cn,sn,mail pres,eq,approx,sub olcDbIndex: objectClass eq dn: olcOverlay={1}memberof,olcDatabase={1}hdb,cn=config objectClass: olcMemberOf objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {1}memberof structuralObjectClass: olcMemberOf :wq! sudo ldapadd -Y EXTERNAL -H ldapi:/// -f db.ldif sudo slappasswd -h {MD5} ##note: 1234 = {MD5}gdyb21LQTcIANtvYMT7QVQ== sudo vi base.ldif dn: dc=example,dc=com objectClass: dcObject objectclass: organization o: example.com dc: example description: My LDAP Root dn: cn=admin,dc=example,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin userPassword: {MD5}gdyb21LQTcIANtvYMT7QVQ== description: LDAP administrator :wq! sudo ldapadd -Y EXTERNAL -H ldapi:/// -f base.ldif sudo vi config.ldif dn: cn=config changetype: modify delete: olcAuthzRegexp dn: olcDatabase={-1}frontend,cn=config changetype: modify delete: olcAccess dn: olcDatabase={0}config,cn=config changetype: modify delete: olcRootDN dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootDN olcRootDN: cn=admin,cn=config dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW olcRootPW: {MD5}gdyb21LQTcIANtvYMT7QVQ== dn: olcDatabase={0}config,cn=config changetype: modify delete: olcAccess :wq! sudo ldapadd -Y EXTERNAL -H ldapi:/// -f config.ldif sudo vi acl.ldif dn: olcDatabase={1}hdb,cn=config add: olcAccess olcAccess: to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=example,dc=com" write by anonymous auth by self write by * none olcAccess: to dn.base="" by * read olcAccess: to * by dn="cn=admin,dc=example,dc=com" write by * read :wq! sudo ldapmodify -x -D cn=admin,cn=config -W -f acl.ldif #Add one group, add two users, place one user in group ldapsearch -LL -Y EXTERNAL -H ldapi:/// "(uid=test1)" -b dc=example,dc=com memberOf _________________________________________________________________ Your E-mail and More On-the-Go. Get Windows Live Hotmail Free. http://clk.atdmt.com/GBL/go/201469229/direct/01/

2 1

Read Waiters growing
by Peter Mogensen 26 Feb '10

26 Feb '10

Hi, I see a strange thing in cn=Monitor. Suggestions needed. I have a huge database, and performance is great as long as olcReadOnly is TRUE. But a soon as I enable writes, the number of Read Waiters are growing, even though there's no or very few Write waiters. # Read, Waiters, Monitor dn: cn=Read,cn=Waiters,cn=Monitor monitorCounter: 311 # Write, Waiters, Monitor dn: cn=Write,cn=Waiters,cn=Monitor monitorCounter: 0 # Current, Connections, Monitor dn: cn=Current,cn=Connections,cn=Monitor monitorCounter: 210 I have idletime=120 and connections do around 30 reads each before they are retired, but not many writes. Like this: # Connection 5389, Connections, Monitor dn: cn=Connection 5389,cn=Connections,cn=Monitor monitorConnectionNumber: 5389 monitorConnectionOpsReceived: 32 monitorConnectionOpsExecuting: 0 monitorConnectionOpsPending: 0 monitorConnectionOpsCompleted: 32 monitorConnectionGet: 32 monitorConnectionRead: 32 monitorConnectionWrite: 0 It's slapd 2.4.21, BDB 4.8.26 and back_bdb. Any hint to what could cause that many read-waiters, but only while writing is enabled and even though there's not that many writes? /Peter

2 3

overlay chain and TLS/SSL
by Ralf Zimmermann 26 Feb '10

26 Feb '10

Hi all, I think I have a problem with the overlay chain and tls. We have one physical master and two slaves in VMware Vsphere4. Our configuration runs normally fine, but sometimes we can't modify entries like passwords to the master. Then we must restart the slapd at the slaves. After restarting slapd all works fine. Then slapd works fine the wholy day. We can change entries or set passwords on the slaves. Next morning we must restart the slapd again, because we can't modify entries from the slaves. But we can query the slapd and syncrepl works fine. Only things over the overlay chains doesn't work. I have the problem not only with Version 2.4.20. I tested more Versions and actually 2.4.21 from pysically hardware. If I can't set entries on the slave I don't see any tcp packets from the slave to the master. DNS, time and so on looks fine and everything else is working. And if we restart slapd everything is working. Does anybody know what is going wrong and if there exits a workaround. I read some things abount /dev/random, /dev/urandom and kernel 2.6 in VMware. Can this be the problem? Here the overlay chain configuration. <snip slapd.conf> overlay chain chain-uri "ldap://eisenherz.camelot.de/" chain-idassert-bind bindmethod=simple binddn="cn=ldapadmin,dc=camelot,dc=de" credentials="xxxxxx" mode="self" chain-rebind-as-user TRUE chain-return-error TRUE chain-tls start </snip slapd.conf> Any help is appreciated. Regards Ralf Zimmermann -- .''`. Ralf Zimmermann : :' : SIEGNETZ.IT GmbH `. `' Schneppenkauten 1a `- 57076 Siegen Tel.: +49 271 68193 13 Fax.: +49 271 68193 29 Amtsgericht Siegen HRB4838 Geschaeftsfuehrer: Oliver Seitz Sitz der Gesellschaft ist Siegen

2 1

posixGroup and groupofNames
by Siddhartha Jain 26 Feb '10

26 Feb '10

Hi, Running CentOS 5.4 with stock OpenLDAP distro 2.3.43. Both classes, posixgroup and groupofnames are structural causing conflicts if one wants to use both. And while RFC2307bis is deleted by IETF, RFC2307 doesn't seem to have the same traction (or, does it)? So, what's a good option? Simply switch posixgroup to AUX in /etc/openldap/schema/nis.schema? Thanks, Siddhartha

3 2

Re: Check password module/ppolicy problem on Solaris 10 (2.4.21 OL sources)
by Jose G. Torres 25 Feb '10

25 Feb '10

Hello again, Well I tried the following. Added the full path of the check_password.so in my slapd.conf under "moduleload". moduleload /opt/openldap/etc/openldap/modules/check_password.so Added the full path to my check_password.so module in my ldif pwdCheckModule: /opt/openldap/etc/openldap/modules/check_password.so Recompiled the sources again using the configure used to build the openSUSE package. CC=/usr/sfw/bin/gcc CPPFLAGS=-I/opt/openldap/include \ LDFLAGS="-L/opt/openldap/lib -R/opt/openldap/lib" \ ./configure --prefix=/opt/openldap --with-tls \ --enable-spasswd --enable-crypt --with-gnu-ld \ --enable-ppolicy --enable-modules --enable-dynamic --enable-aci --enable-bdb --enable-hdb \ --enable-rewrite --enable-ldap=yes --enable-meta=mod \ --enable-monitor=yes --enable-slp --enable-overlays=yes \ Still no luck. At least within my ldap logs I see the "Password fails quality checking policy" so at least it is hitting the ldap server for password checking. Any ideas????? Thanks!!!! Jose > I am trying to get my solaris 10 openldap 2.4.21 server to use my check_password.so module using the ppolicy overlay. When I try to change a user's > password from a linux client, I get the following error message. > > passwd ldapuser > Changing password for ldapuser. > Enter login(LDAP) password: > New Password: > Reenter New Password: > LDAP password information update failed: Constraint violation > Password fails quality checking policy > passwd: Permission denied > > > Within > my logs, I do not see any error messages from my check_password.so > module. I created the directory /opt/openldap/etc/openldap/modules and > placed my module in that directory and I added the modulepath in my > slapd.conf. > > Is there something I missed? Is this a PAM thing? I know this setup works on a OpenSUSE 11.2 openldap server. Help. > > I included part of my slapd.conf, openldap configure, check_password.c source, makefile and ldd of my check_password.so. > > Thanks!!!! > > Jose Torres > > > openldap configure > ****************** > > CC=/usr/sfw/bin/gcc CPPFLAGS=-I/opt/openldap/include \ > LDFLAGS="-L/opt/openldap/lib -R/opt/openldap/lib" \ > ./configure --prefix=/opt/openldap --with-tls \ > --enable-spasswd --enable-crypt --with-gnu-ld \ > --enable-ppolicy --enable-modules --enable-dynamic > > > slapd.conf: > ********** > > include /opt/openldap/etc/openldap/schema/ppolicy.schema > > # Add password policies. > modulepath /opt/openldap/etc/openldap/modules > overlay ppolicy > ppolicy_default "cn=default,ou=policies,dc=caci,dc=ymp,dc=com" > ppolicy_use_lockout > > I tried ppolicy_clear_txt I still have the same problem. > > check_password.c: > **************** > > #include <stdio.h> > #include <stdlib.h> > #include <string.h> > #include <ctype.h> > #include "portable.h" > #include "slap.h" > > int init_module() > { > return 0; > } > > int check_password(char *pPasswd, char **ppErrStr, Entry *pEntry) > { > char error=0; > char retmsg[255]; > char *message,*buffer,*token; > const char special[] ="!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~"; > const char number[] ="1234567890"; > const char CAPS[] ="ABCDEFGHIJKLMNOPQRSTUVWXYZ"; > > error = 0; > > > if (strstr( pPasswd, " ") != NULL) > { > error = 1; > strcpy(retmsg , "******** CHECKPW: Password contains SPACES! ********"); > } > > buffer = strdup(pPasswd); > token = strtok(buffer,special); > if ( !(strcmp(token,pPasswd)) || (token == NULL) ) > { > error = 1; > strcpy(retmsg , "******** CHECKPW: Password does not contain any special c > haracters! ********"); > } > > buffer = strdup(pPasswd); > token = strtok(buffer,number); > > if ( !(strcmp(token,pPasswd)) || (token == NULL) ) > { > error = 1; > strcpy(retmsg , "******** CHECKPW: Password does not contain any numbers! > ********"); > } > > buffer = strdup(pPasswd); > token = strtok(buffer,number); > > if ( !(strcmp(token,pPasswd)) || (token == NULL) ) > { > error = 1; > strcpy(retmsg , "******** CHECKPW: Password does not contain any CAPITAL L > ETTERS! ********"); > } > > if (error) > { > /* Allocate */ > message = (char *)malloc(sizeof(char) * (strlen(retmsg)+1)); > /* Copy the contents of the string. */ > strcpy(message, retmsg); > *ppErrStr=message; > } > return error; > } > > Makefile: > ********* > > check_password.so: check_password.o > gcc -L/opt/openldap/lib -lldap -shared -o check_password.so check_passwo > rd.o > check_password.o: check_password.c > gcc -fpic -I../../include -I. -c check_password.c > clean: > rm check_password.so check_password.o > > > It seems to find the right libraries. > > $ ldd modules/check_password.so > libldap-2.4.so.2 => /opt/openldap/lib/libldap-2.4.so.2 > libgcc_s.so.1 => /usr/sfw/lib/libgcc_s.so.1 > liblber-2.4.so.2 => /opt/openldap/lib/liblber-2.4.so.2 > libresolv.so.2 => /usr/lib/libresolv.so.2 > libgen.so.1 => /usr/lib/libgen.so.1 > libnsl.so.1 => /usr/lib/libnsl.so.1 > libsocket.so.1 => /usr/lib/libsocket.so.1 > libsasl.so.1 => /usr/lib/libsasl.so.1 > libssl.so.0.9.7 => /usr/sfw/lib/libssl.so.0.9.7 > libcrypto.so.0.9.7 => /usr/sfw/lib/libcrypto.so.0.9.7 > libc.so.1 => /usr/lib/libc.so.1 > libmp.so.2 => /usr/lib/libmp.so.2 > libmd.so.1 => /usr/lib/libmd.so.1 > libscf.so.1 => /usr/lib/libscf.so.1 > libdoor.so.1 => /usr/lib/libdoor.so.1 > libuutil.so.1 => /usr/lib/libuutil.so.1 > libssl_extra.so.0.9.7 => /usr/sfw/lib/libssl_extra.so.0.9.7 > libcrypto_extra.so.0.9.7 => /usr/sfw/lib/libcrypto_extra.so.0.9.7 > libm.so.2 => /usr/lib/libm.so.2

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical