openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

Clients can't authenticate via consumer server
by Jaap Winius 30 Dec '09

30 Dec '09

Hi all, On my test system, which uses OpenLDAP simple authentication, I'm unable to get clients to authenticate to a consumer server, although they can authenticate to its provider server without a problem. Here's a snippet of the consumer's syslog, for which I've set the slapd.conf loglevel to "acl": ================== Dec 30 02:13:28 ldapc2 slapd[3031]: => acl_mask: access to entry "uid=ccolumbus,ou=People,dc=example,dc=com", attr "userPassword" requested Dec 30 02:13:28 ldapc2 slapd[3031]: => acl_mask: to value by "", (=0) Dec 30 02:13:28 ldapc2 slapd[3031]: <= check a_dn_pat: cn=admin,dc=example,dc=com Dec 30 02:13:28 ldapc2 slapd[3031]: <= check a_dn_pat: anonymous Dec 30 02:13:28 ldapc2 slapd[3031]: <= acl_mask: [2] applying auth(=xd) (stop) Dec 30 02:13:28 ldapc2 slapd[3031]: <= acl_mask: [2] mask: auth(=xd) ================== Judging from this, I suspect that I've misconfigured the account on the consumer server that the client machines must use to access password values in the database to authenticate clients. Currently, the consumer's ACLs look like this: ================== access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=example,dc=com" read by anonymous auth by * none access to dn.base="" by * read access to * by * read ================== This is the same admin account that I use on the provider. If I set the client's libnss-ldap configuration to use this account and its matching password to authenticate users via the consumer server, it doesn't work. Any idea about what I'm doing wrong? Thanks, Jaap

1 0

Renaming of attributes in ldap schema
by Thilko Richter 29 Dec '09

29 Dec '09

Hello, I have a general ldap question: I would like to use ldap as configuration store for my applications. Each application gets his own object schema, since then the number properties is deterministic. Since a number of developers are involved, I try to generate the schema definition from a ruby DSL. I am now thinking about what happens to existing entries in the dit if the oids or names of the attribute definitons has changed? Are they invalid after ldap server restart? Would you recommend not to renaming any elements in the schema? I have seen that the attributes on existing entries disappeared if I change the name in the schema. Regards, Thilko

2 1

LDAP programming book
by Murray S. Kucherawy 28 Dec '09

28 Dec '09

Is the 1997 book "LDAP: Programming Directory-Enabled Applications" by Smith & Howes reasonably current to the latest OpenLDAP releases, or has enough changed in the intervening 12 years that it's not worth getting?

2 1

Chain overlay not available in Debian lenny?
by Jaap Winius 26 Dec '09

26 Dec '09

Hi all, Can anyone confirm that the chain overlay is not available in the version of OpenLDAP (2.4.11-1) that comes with Debian lenny? Although the man page for it still exists, loading it as a module result in an error (lt_dlopenext failed: (chain) chain.so: cannot open shared object file: No such file or directory), as does activating it (overlay "chain" not found) as well as attempts to use any of the "chain-" options in slapd.conf. Also, there's a Debian bug report (#502769, 19 Oct. 2008) with the subject "when adding overlay chain to the slapd.conf slapd crashes with overlay chain not found." No mention is made of a solution, but could it be that the chain overlay was simply removed from the slapd package as result? Thanks, Jaap

2 1

ACL problem
by Il Neofita 24 Dec '09

24 Dec '09

Hi I am new and probably I am facing a very basic error I am tring to create an admin for a subset I create this ldif dn: cn=mmmm,dc=test,dc=xx cn: mmmm sn: mmmm objectClass: person objectClass: top userPassword: test then on sladp.conf ... access to dn.subtree="ou=people,dc=test,dc=xx" by dn="cn=mmmm,dc=test,dc=xx" write by * read ... Restarted ldap ldapsearch -x -D "cn=mmmm,dc=test,dc=xx" -W '(objectclass=*)' ldap_bind: Invalid credentials (49) What am I do wrong?

2 5

deprecated function ldap_sort_entries, ldap_sort_values, ldap_sort_strcasecmp
by DT Piotr Wadas 24 Dec '09

24 Dec '09

Hello, using openldap 2.4.17 I'm fixing obsolete things in my old application, e.g. removed some extern statements. When building I got xxx.c:790: error: 'ldap_sort_strcasecmp' undeclared (first use in this function) After further investigation I discovered this http://www.mail-archive.com/openldap-devel@openldap.org/msg01517.html quote: " ldap_sort_entries ldap_sort_values ldap_sort_strcasecmp of which Net::LDAPapi only uses ldap_sort_entries. Is there a replacement function for this? If not, any thoughts on what the steps are to duplicate that functionality? So no one else knows what these functions do either? ;) Well, functions tend to get deprecated due to neglect. If nobody has ever used them thus far..... -- Howard Chu" Well, seems I know what these function do, I used it to sort set of values of the retrieved attribute ( char ** ), specifying function, which is to be used for sorting. The form of call was (is) ldap_sort_values( LDAP * ldc, char ** vals, ( fn & ) ldap_sort_strcasecmp); The idea was, that when I got attribute values set like attrName: /abc/xyz attrName: /abc/x/nnnn attrName: /abc attrName: /abc/xyz/u/m numericAttrName: 10 numericAttrName: 5 numericAttrName: 123 I need to process it in some resonable order, according to application needs, it was easier to use library functions than create my own's. I denoted these with ' //LDAP_SORT_AV_CMP_PROC *cmp ', but don't remember was I meant, must have been about 3 years ago. Any suggestions? Shall I create my own function to sort retrieved values, or use some server control? AFAIR one has no influence on the order, in which attribute values are PUT into the entry, but when it comes to use it, it is important to be sure, that there's NO variable of value "7" processed before value "10" ldap_sort (3) - LDAP sorting routines (deprecated) ldap_sort_entries (3) - LDAP sorting routines (deprecated) ldap_sort_strcasecmp (3) - LDAP sorting routines (deprecated) ldap_sort_values (3) - LDAP sorting routines (deprecated) Regards, DT -- http://dtpw.pl/buell [ 25th anniversary of Buell - American Motorcycles ] Linux aleft 2.6.27.29-0.1_lustre.1.8.1.1-default #1 SMP drbd 8.3.6-(api:88/proto:86-91) pacemaker 1.0.6-cebe2b6ff49b36b29a3bd7ada1c4701c7470febe

1 1

Is there any accounting software using ldap for customers and suppliers?
by Damiano Venturin 24 Dec '09

24 Dec '09

Hi, that's my first post here. I realize that this is not exactly the kind of message that I should post here but I'm really going mad trying to find an accounting software which uses natively ldap as a backend. I'm not looking for something that can synchronize, import or export into ldap. Are you aware of some good software? It doesn't matter if it's for free or not. It would be cool if it's open. Thank you -- Damiano Venturin http://www.squadrainformatica.com

3 4

Developer's cookbook for adding LDAP support
by Murray S. Kucherawy 24 Dec '09

24 Dec '09

Are there any good documentation sites or books out there for adding LDAP support to a program? The ldap(3) man page is pretty sparse. I've been told that basically studying the OpenLDAP source itself is the best way to figure it out, but I'm hoping there's something better. I have only very rudimentary knowledge of LDAP in general. Almost all of my exposure to OpenLDAP was through a helper library that did a lot of work for me, but that was at a previous job. This is for an open source project. The application to be updated already has support to get key-value pairs from SQL/ODBC and Sleepycat DB sources, and I have a request to include support for LDAP. Essentially in the application I am given an email recipient and I need to get from the database a piece of detail I need to append to that outgoing mail. There's no standard schema for this (yet; it's been suggested we create one through the IETF), so I will need to allow administrators to specify which attributes to request. Any helpful pointers would be appreciated. Happy holidays, -MSK

2 1

LDAPS queries in C/C++ - conceptual question
by Robert Welz 23 Dec '09

23 Dec '09

Hello, I was asked to expand some C++ software to do ldap queries with TLS on a server with SSL certificate. We want the server to authenticate by its certificate so our software is protected from fake servers. Before I dig too deep into the API, I would like to know: - Is it possible with LDAP API to extract the servers certificate data to verify its integrity? - or should I program it directly with openSSL API? Thank you for sharing your wisdom, kind regards, --- Robert Welz

2 1

slapd socket file name and location
by DT Piotr Wadas 23 Dec '09

23 Dec '09

Hello, I'm using openldap 2.4.17 on debian, command line for testing purposes is --- root@host:~# slapd -d16384 -f slapd-1.conf -u openldap -g openldap \ -h "ldapi:///var/run/slapd/foobar/x-mod=-rw-------" @(#) $OpenLDAP: slapd 2.4.17 (Nov 10 2009 18:29:26) $ root@SD6-Casa:/tmp/buildd/openldap-2.4.17/debian/build/servers/slapd slapd starting -- result: root@host:~# lsof -U |grep slapd slapd 2971 openldap 3u unix 0xf65cab80 0t0 967834 socket slapd 2971 openldap 7u unix 0xf65ca380 0t0 967836 /var/run/slapd/ldapi root@lena:~# --- Filesystem directory permissions are fine, well, no matter about x-mod, the problem is I cannot force different file name (location) for socket file, default location seems to be build-dependent, shall I guess it's debian related issue? I expect the socket file to be created where I specify within "ldapi" URI. I tried a few variants of this uri, assuming I misunderstood the triple slash construction, anyway I still have socket file created in the same place. Isn't it supposed to create socket file where specified? What I want, actually, is to start two or more independent slapd servers (completely searated databases), listening on IPC only, on two different IPC sockets on the same machine. Regards, DT -- http://dtpw.pl/buell [ 25th anniversary of Buell - American Motorcycles ] Linux aleft 2.6.27.29-0.1_lustre.1.8.1.1-default #1 SMP drbd 8.3.6-(api:88/proto:86-91) pacemaker 1.0.6-cebe2b6ff49b36b29a3bd7ada1c4701c7470febe

4 8

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical