openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

Best objectClass for an LDAP server?
by Jaap Winius 19 Jan '10

19 Jan '10

Hi folks, Busy again with the configuration of my OpenLDAP 2.4.11 test system, which includes Kerberos, SASL and GSSAPI, I now not only have replication working with Kerberos authentication and encryption), but also SASL proxy authorization, which makes chaining possible (chasing referrals on behalf of clients). For proxy authorization to work, I first had to create an LDAP object to represent the DN that the consumer server was authenticating with -- after the name of its Kerberos principal. Here it is in GSSAPI-format: uid=ldap/ldapks2.example.com,cn=gssapi,cn=auth Not wanting to use the person objectClass for this purpose, I used this instead: dn: cn=ldap/ldapks2.example.com,ou=consumers,dc=example,dc=com cn: ldap/ldapks2.example.com objectClass: simpleSecurityObject objectClass: organizationalRole description: LDAP server2 replicator saslAuthzTo: dn.regex:^uid=[^,]*,ou=users,dc=example,dc=com$ userPassword: {CRYPT}* Does this look like the best solution? It does force me to include a userPassword attribute, for which I use an invalid hash, but otherwise there are no other unnecessary attributes. Still, I wonder if I could do better. Any opinions? Thanks, Jaap

1 0

Verifying refint
by Peter Mogensen 19 Jan '10

19 Jan '10

Hi, I have a large database which I've migrated from slapd 2.3 (bdb) to slapd 2.4.20 (hdb) with: overlay refint refint_attributes member Unfortunately, after the migration I've experienced at least twice where a Group object had members referring to non-existent objects. The migration was done by stopping slapd 2.3, dumping with slapcat and then loading into 2.4.20. So the LDIF and DIT migrated should be ok. Do I have any way checking my database for other occurrences of refint violations, apart from writing a script to traverse an entire LDIF dump? /Peter

1 0

Some openldap 2.4 questions
by Radosław Antoniuk 19 Jan '10

19 Jan '10

Hi, Three quick issues about slapd 2.4. 1. I'm setting up a syncrepl replication. In the process of testing, I had added three syncprov overlays instead of one, and I ended up with: dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: 600b89e6-9317-102e-9872-8714c398f98b creatorsName: cn=admin,cn=config createTimestamp: 20100111160900Z entryCSN: 20100111160900.858973Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20100111160900Z dn: olcOverlay={1}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov olcSpCheckpoint: 20 10 structuralObjectClass: olcSyncProvConfig entryUUID: 600ba142-9317-102e-9873-8714c398f98b creatorsName: cn=admin,cn=config createTimestamp: 20100111160900Z entryCSN: 20100111160900.859584Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20100111160900Z dn: olcOverlay={2}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {2}syncprov olcSpSessionlog: 500 structuralObjectClass: olcSyncProvConfig entryUUID: 600badea-9317-102e-9874-8714c398f98b creatorsName: cn=admin,cn=config createTimestamp: 20100111160900Z entryCSN: 20100111160900.859909Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20100111160900Z The thing is, that I cannot delete any of them because cn=config does not support delete operation. Is this ok to leave it as is? or any workaround to get rid of the unwanted ones? 2. About N-Way replication... What's the best authentication to use? Because RootDN is the admin, and in simple authentication I would store cleartext password in the syncrepl configuration, I'm assuming that the best here would be to use some SASL mech? 3. Assuming a running normal replication(master-slave) with refreshAndPersist, is there any method of checking of the status of the replication? like show slave status in MySQL. I have tested it with cutting the transmission by iptables, and ok, it caught up after reconnection, but the master did not complain at all when the connection was not there... -- Best regards, Radosław Antoniuk

6 13

Auth access for search-based mappings?
by Jaap Winius 18 Jan '10

18 Jan '10

Hi folks, Today I've been using my OpenLDAP v2.4.11 lab setup, the config for which includes MIT Kerberos V, SASL and GSSAPI, to experiment with this feature: 15.2.6. Search-based mappings http://www.openldap.org/doc/admin24/sasl.html#Search-based mappings It doesn't seem to difficult, but it's not really working for me either. In particular, I can't get slapd to search beyond the first of several authz-regexp statements, as shown in the "more complex site" example. Then I noticed this statement at the very end of the section: "Note as well that authz-regexp internal search are subject to access controls. Specifically, the authentication identity must have auth access." It sounds important, but I'm not sure what to do with it. Does it mean all users need auth access to the entire DIT? I tried that, but to no avail. Can someone please explain? Thanks, Jaap

4 8

Translucent with syncrepl to Active Directory
by Pascal Lalonde 15 Jan '10

15 Jan '10

Hello, I'm trying to get syncrepl work from a provider that is configured as a back-ldap to an Active Directory with the translucent overlay. Although the master is also an OpenLDAP, since it uses the back-ldap backend to AD, the entryUUID and entryCSN fields are not present, thus preventing syncrepl from working. But I really only need to replicate the local modifications stored in my translucent (HDB). And doing a slapcat shows that the entryUUID and entryCSN are present in the translucent DB. So I'm wondering if there's a way to tell syncrepl to bother only with entries stored in my hdb, and ignore anything that doesn't have the entryUUID/CSN fields (the fields proxied from AD). I'm getting the following error on the slave: syncrepl_entry: rid=100 entry unchanged, ignored (dc=testdomain,dc=org) do_syncrep2: rid=100 got empty syncUUID with LDAP_SYNC_ADD Server in the example (using OpenLDAP 2.4.11 on Debian Lenny): tst-dc01.testdomain.org = Active Directory ldap.tst.testdomain.org = OpenLDAP master ldap-slave.tst.testdomain.org = OpenLDAP slave Master configuration: --------------------- include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/testdomain.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_ldap moduleload back_hdb moduleload translucent moduleload syncprov TLSCACertificateFile /etc/ssl/certs/testdomainca.pem TLSCertificateFile /etc/ldap/ssl/ldap.tst.testdomain.org.crt TLSCertificateKeyFile /etc/ldap/ssl/ldap.tst.testdomain.org.key TLSVerifyClient never defaultsearchbase "dc=testdomain,dc=org" sizelimit unlimited backend hdb backend ldap database hdb directory /var/lib/ldap suffix "dc=testdomain,dc=org" index objectclass,entryCSN,entryUUID eq rootdn cn=ldaproot,dc=testdomain,dc=org rootpw blah overlay translucent uri "ldap://tst-dc01.testdomain.org" idassert-bind bindmethod=simple binddn="CN=readonly,DC=testdomain,DC=org" credentials="pw" mode=none chase-referrals no rebind-as-user yes lastmod on translucent_strict overlay syncprov syncprov-checkpoint 64 30 syncprov-sessionlog 1024 access to dn.subtree="dc=testdomain,dc=org" by * read Slave configuration: -------------------- include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/testdomain.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_ldap moduleload back_hdb moduleload translucent TLSCACertificateFile /etc/ssl/certs/testdomainca.pem TLSCertificateFile /etc/ldap/ssl/ldap-slave.tst.testdomain.org.crt TLSCertificateKeyFile /etc/ldap/ssl/ldap-slave.tst.testdomain.org.key TLSVerifyClient never defaultsearchbase "dc=testdomain,dc=org" sizelimit unlimited backend hdb backend ldap database hdb directory /var/lib/ldap suffix "dc=testdomain,dc=org" index objectclass,entryCSN,entryUUID eq rootdn cn=ldaproot,dc=testdomain,dc=org rootpw blah syncrepl rid=100 provider=ldaps://ldap.tst.testdomain.org type=refreshAndPersist interval=00:00:15:00 retry="300 20 7200 +" searchbase="dc=testdomain,dc=org" attrs="gecos" schemachecking=off bindmethod=simple binddn="CN=repl,DC=testdomain,DC=org" credentials="pw" overlay translucent uri "ldap://tst-dc01.testdomain.org ldap://tst-dc02.testdomain.org" idassert-bind bindmethod=simple binddn="CN=readonly,DC=testdomain,DC=org" credentials="pw" mode=none chase-referrals no rebind-as-user yes lastmod on translucent_strict access to dn.subtree="dc=testdomain,dc=org" by * read Thanks for any info! -- Pascal

1 0

how to use ipv6 addresses in olcaccess statements
by Alex Samad 15 Jan '10

15 Jan '10

Hi I am trying to build a olcaccess statement and I am wondering how to implement a ipv6 network Currently I have 'to dn.sub="ou=SUDOers,dc=samad,dc=com,dc=au" '. 'by dn.exact="cn=libnss-ldap,ou=Roles,dc=samad,dc=com,dc=au" read '. 'by dn.exact="cn=libpam-ldap,ou=Roles,dc=samad,dc=com,dc=au" read '. 'by peername.ip=192.168.12.0%255.255.252.0 read '. 'by peername.ip=192.168.8.0%255.255.252.0 read '. 'by peername.ip=192.168.4.0%255.255.252.0 read '. 'by peername.ip=127.0.0.1 read '. 'by peername.ipv6=::1 read '. 'by peername.path=/var/run/slapd/ldapi read '. 'by * none ', I have a ipv6 network 2002:3cf1:f856::/48 but I can't seem to put in 'by peername.ipv6=2002:3cf1:f856::%48 read '. do I need to write out a complete mask 'by peername.ipv6=2002:3cf1:f856::%<mask> read '. I am not sure what that mask would look like 65535.65535.65535.0.0.0.0.0 ? Alex -- About the only thing we have left that actually discriminates in favor of the plain people is the stork.

2 2

Syncrepl reliability
by Marco Innocenti 15 Jan '10

15 Jan '10

Hi, we are testing a 2 way multimaster setup (debian 64bit, openldap 2.4.21). If a client that try to e.g. add a record to a node is stopped (killed, crashed, ...) the record hit the master but it is not replicated and that is for us a showstopper. I think that behavior is well known among the developer as I think I'm talking of ITS#6059. When that bug is expected to be solved? -- ********************************************************************** Marco Innocenti Dipartimento Sistemi E Tecnologie CINECA phone:+39 0516171553 / fax:+39 0516132198 Via Magnanelli 6/3 e-mail: innocenti(a)cineca.it 40033 Casalecchio di Reno Bologna (Italia) **********************************************************************

1 0

Openldap installation problem
by Murat Uğur Eminoğlu 15 Jan '10

15 Jan '10

Dear all, i 've problem openldap installation. i'm using debian lenny, openldap 2.4.19. Error's below. openldap-2.4.19# ./configure --prefix=/usr/local/mailserver/openldap --enable-crypt --enable-backends --enable-bdb --enable-ldbm --enable-perl=no checking for ndb_init in -lndbclient... no configure: error: could not locate ndbclient library config.log configure:30018: checking for ndb_init in -lndbclient configure:30053: cc -o conftest -g -O2 -L/usr/lib/mysql -lmysqlclient_r conftest.c -lndbclient -lstdc++ -lresolv >&5 /usr/lib/mysql/libndbclient.so: undefined reference to `base64_needed_decoded_length' /usr/lib/mysql/libndbclient.so: undefined reference to `base64_decode' /usr/lib/mysql/libndbclient.so: undefined reference to `decimal_bin_size' collect2: ld returned 1 exit status configure:30059: $? = 1 configure: failed program was: thanks for helps / regards. -- Murat Uğur Eminoğlu http://ipucu.murat.ws http://fotoblog.murat.ws

4 7

Need help setting up n-way + cn=config
by Alex Samad 15 Jan '10

15 Jan '10

Hi I am in the process of testing a new n-way setup, I have come across some problem's. when trying to setup unique I keep getting undefined attribute error dn: olcOverlay={2}unique,olcDatabase={1}hdb,cn=config changetype: modify add: olcunique_uri olcunique_uri: ldap:///?uid?sub but it fails ldap_modify: Undefined attribute type (17) additional info: olcunique_uri: AttributeDescription contains inappropriate characters also while trying to setting olcaccess parameter I can't find any information on how setup a ipv6 network Currently I have 'to dn.sub="ou=SUDOers,dc=samad,dc=com,dc=au" '. 'by dn.exact="cn=libnss-ldap,ou=Roles,dc=samad,dc=com,dc=au" read '. 'by dn.exact="cn=libpam-ldap,ou=Roles,dc=samad,dc=com,dc=au" read '. 'by peername.ip=192.168.12.0%255.255.252.0 read '. 'by peername.ip=192.168.8.0%255.255.252.0 read '. 'by peername.ip=192.168.4.0%255.255.252.0 read '. 'by peername.ip=127.0.0.1 read '. 'by peername.ipv6=::1 read '. 'by peername.path=/var/run/slapd/ldapi read '. 'by * none ', I have a ipv6 network 2002:3cf1:f856::/48 but I can't seem to put in 'by peername.ipv6=2002:3cf1:f856::%48 read '. do I need to write out a complete mask 'by peername.ipv6=2002:3cf1:f856::%<mask> read '. I am not sure what that mask would look like 65535.65535.65535.0.0.0.0.0 ? Thanks

1 0

Unable to Search/Authenticate Users
by Todd Reed 14 Jan '10

14 Jan '10

I'm trying to get a Web Application to authenticate to OpenLDAP. I have one user account that I am binding as (user: webldapauth). I have another user account that I am trying to log in via the application (user: webuser). The "webuser" is in a OU called "WebAppUsers". With an LDAP Browser, I can bind to LDAP as both users. But, when I try to log in to the web app, I'm binding with the user "webldapauth", but cannot log in with the "webuser" account. The web application calls are good because I can point it to an ActiveDirectory server and it works fine. This is my first attempt with OpenLDAP. I believe there is a configuration problem with OpenLDAP, but I'm not sure where to look or troubleshoot at. Would anyone be able to provide any guidance? I've looked at the manuals and other help files, but nothing has worked so far. --Todd

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical