openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

Authentication failed with ldaps configuration
by smainklh＠free.fr 04 Dec '09

04 Dec '09

Hi everyone, I configured my ldap server (debian lenny) to listen on port 636 (ldaps) but it doesn't seems to work when issuing a remote connexion. Perhaps i did a mistake when generating the certificates ?.... When i try to browse the ldap server from a remote server i get the following message : ---------- root@vmtest:~# ldapsearch -d 1 -Wx -H ldaps://ldapserver.domain.tld -D cn=admin,dc=domain,dc=tld ldap_url_parse_ext(ldaps://ldapserver.domain.tld) ldap_create ldap_url_parse_ext(ldaps://ldapserver.domain.tld:636/??base) Enter LDAP Password: ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP ldapserver.domain.tld:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.10.48.40:636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 TLS: peer cert untrusted or revoked (0x42) ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) ----------- I generated the certificates with the following command : # openssl req -newkey rsa:1024 -x509 -nodes -out server.pem -keyout server.pem -days 3650 ----------- Then i tried the connexion : openssl s_client -connect ldapserver.domain.tld:636 -showcerts CONNECTED(00000003) depth=0 /C=FR/ST=Some-State/L=Paris/O=firm/CN=ldapserver.domain.tld verify error:num=18:self signed certificate verify return:1 depth=0 /C=FR/ST=Some-State/L=Paris/O=firm/CN=ldapserver.domain.tld verify return:1 --- Certificate chain 0 s:/C=FR/ST=Some-State/L=Paris/O=firm/CN=ldapserver.domain.tld i:/C=FR/ST=Some-State/L=Paris/O=firm/CN=ldapserver.domain.tld -----BEGIN CERTIFICATE----- MIIDDTCCAnagAwIBAgIJAM7IwuTIzhwqMA0GCSqGSIb3DQEBBQUAMGMxCzAJBgNV BAYTAkZSMRMwEQYDVQQIEwpTb21lLVN0YXRlMQ4wDAYDVQQHEwVQYXJpczELMAkG A1UEChMCQlQxIjAgBgNVBAMTGWlwb2MwMS5pcG9jLmJ0c2VydmljZXMuZnIwHhcN MDkxMTI0MTUwMTUxWhcNMTkxMTIyMTUwMTUxWjBjMQswCQYDVQQGEwJGUjETMBEG A1UECBMKU29tZS1TdGF0ZTEOMAwGA1UEBxMFUGFyaXMxCzAJBgNVBAoTAkJUMSIw IAYDVQQDExlpcG9jMDEuaXBvYy5idHNlcnZpY2VzLmZyMIGfMA0GCSqGSIb3DQEB AQUAA4GNADCBiQKBgQCm5FrQ3dN1Jkxj2SZsPr+vkYDlwVnvqDCxnAs3O5NJ/1uY F9/mwsCVdAnp04Eywo3BCbvP6tlzsF3JbAlqMLTb85ZTHOqRQncXGfVZ7bMnR071 tQ70/b3vF/TuMYiOU7vXf2h863aRi11tT9xHD17wFfFaXBtRIIOioc3UpJWWPwID AQABo4HIMIHFMB0GA1UdDgQWBBREqX/HQEzU5TCDrBsbttUxa44fnDCBlQYDVR0j BIGNMIGKgBREqX/HQEzU5TCDrBsbttUxa44fnKFnpGUwYzELMAkGA1UEBhMCRlIx EzARBgNVBAgTClNvbWUtU3RhdGUxDjAMBgNVBAcTBVBhcmlzMQswCQYDVQQKEwJC VDEiMCAGA1UEAxMZaXBvYzAxLmlwb2MuYnRzZXJ2aWNlcy5mcoIJAM7IwuTIzhwq MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAd0Le1JyJF8zBs0RYvEn7 c1nhVbsdD8FDBTa4IaNvkbIt8al6G7bBpfyDxcMVtgFc8zHt/+sYfTxWuHh7m+b1 yjJtD9vMjIigbaZq4VJOz11JEWsQHc8wo3So+G+CelTz4HXPoGh5vqRtTkupjedz 0DDsA1jd9F4KpYSOkzxosdc= -----END CERTIFICATE----- --- Server certificate subject=/C=FR/ST=Some-State/L=Paris/O=firm/CN=ldapserver.domain.tld issuer=/C=FR/ST=Some-State/L=Paris/O=firm/CN=ldapserver.domain.tld --- No client certificate CA names sent --- SSL handshake has read 1107 bytes and written 316 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 1024 bit Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : AES256-SHA Session-ID: 9EF5F2D4FD72A0D1161C8334537F1ADF60C8B790A3F699B6DC52557E3C95D427 Session-ID-ctx: Master-Key: 015D50D6D93F502E37EDB577691F05D157E80A439A2B129B370EEA24E651E828A172E43B3F6D29174BF33B96193202F0 Key-Arg : None Start Time: 1259761586 Timeout : 300 (sec) Verify return code: 18 (self signed certificate) --- ------------------ My ldap.conf ----------------- BASE dc=domain,dc=tld URI ldaps://ldapserver.domain.tld/ TLS_REQCERT allow My slapd.conf : ---------------- ... TLSCACertificateFile /etc/ldap/ssl/server.pem TLSCertificateFile /etc/ldap/ssl/server.pem TLSCertificateKeyFile /etc/ldap/ssl/server.pem ... ------------------ My /etc/default/slapd.conf ... SLAPD_SERVICES="ldaps://ldapserver.domain.tld" ... Could you please help me ?

4 6

bootstrapping mirrormode
by Peter Mogensen 04 Dec '09

04 Dec '09

Previously I described problems when using this procedure to bootstrap a mirrormode pair with a large LDIF. I've reproduced it with a much smaller subset of the database, and there must be something wrong with the procedure or a bug. What I do is: 1) Took an slapcat generated LDIF from a 2.3.x setup 2) Removed all entryCSN and contextCSN lines. 3) Ran "slapadd -S 1 -q -w -l ~/load_noCSN.ldif" on server-1 4) Did a "slapcat > toserver2.ldif" on server-1 5) Started server-1 and let applications create and modify objects. 6) Moved toserver2.ldif to server-2. 7) Ran slapadd -q -l toserver2.ldif on server-2 8) Started server-2 Now - I would expect the objects created on step 5 to appear after a while on server-2. They are not. However, objects created on server-1 after both servers has been started are replicated. I would suspect a problem with the index created with slapadd, (olcLinearIndex is FALSE), so syncrepl only finds entries created via LDAP. But I see no reason why. ldapsearch can read the entries. /Peter

2 8

OpenLDAP with SSL
by Chamith Kumarage 04 Dec '09

04 Dec '09

Hi Folks, I have setup openldap with SSL and i'm using self signed certs. I have included the following in my slapd.conf. TLSCipherSuite HIGH:MEDIUM:-SSLv2 TLSCACertificateFile /etc/ldap/ssl/server.pem TLSCertificateFile /etc/ldap/ssl/server.pem TLSCertificateKeyFile /etc/ldap/ssl/server.pem TLSVerifyClient demand and in my ldap.conf I have; HOST <my_ip> PORT 636 TLS_REQCERT /etc/ldap/ssl/server.pem When I start the service, I see port 636 is up and I can even telnet to it. But I cannot perform any ldap operations there. Any help would be appreciated! Thanks, ~Chamith

4 4

OpenLDAP 2.4.16 hanging - ideas welcome
by J. Landamore 03 Dec '09

03 Dec '09

We run 4 2.4.16 servers as 2 provider/consumer pairs, one pair for our staff systems and one pair for our teaching facilities. They are all on Solaris10u7 xen virtual hosts. The staff pair run fine The consumer on the teaching pair runs fine The provider on the teaching pair runs fine until it gets hit by a heavy load, eg start of a lab when ~100 PCs try and authenticate their user. At this point it refuses to serve LDAP requests. Traffic is still coming in to the box and existing connections seem OK. The break point is about 35PCs, below that there isn't a problem. Restarting slapd cures the problem and off we go until the start of the next big lab. I've run at various log levels but not been able to see any obvious messages. All I see, even when everything is fine, are messages of the form send_search_entry: conn 11639 ber write failed. connection_read(38): no connection! The slapd.conf (minux the syncprov bit) is: include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/duaconf.schema include /usr/local/etc/openldap/schema/local.schema pidfile /var/openldap/run/slapd.pid argsfile /var/openldap/run/slapd.args conn_max_pending 200 idletimeout 60 sizelimit 2000 loglevel 256 database bdb suffix "dc=my,dc=domain" rootdn "cn=me,dc=my,dc=domain" rootpw {SSHA}guess directory /var/openldap/openldap-data index cn,entryCSN,entryUUID,gidNumber,ipHostNumber,memberUid eq index objectclass,uid,uidNumber,uniqueMember eq cachefree 16 cachesize 1500 checkpoint 0 60 dncachesize 1500 idlcachesize 3000 access to attrs=userPassword by self write by anonymous auth by dn.base="cn=fred,ou=Profile,dc=my,dc=domain" read by * none access to * by self write by users read by * read The only entry in DB_CONFIG is set_cachesize 0 26214400 0 cache hits are at 99% I'm stumped for a cause/solution, can anyone either give me a pointer as to what to look for in the logs or suggest a possible cause. Could it be hitting the 256 open file limit? Thanks -- John Landamore Department of Computer Science University of Leicester University Road, LEICESTER, LE1 7RH J.Landamore(a)mcs.le.ac.uk Phone: +44 (0)116 2523410 Fax: +44 (0)116 2523604

2 1

Re: How to Clone / move an OpenLDAP instance?
by Michael March 03 Dec '09

03 Dec '09

> --On Thursday, December 03, 2009 10:49 AM -0700 Michael March > <mmarch(a)gmail.com> wrote: > > >> ... also from the slapadd man page: >> >> "As slapadd is designed to accept LDIF in database order, as produced >> by slapcat(8), it does not verify that superior entries exist before >> adding an entry, does not perform all user and system schema checks, >> and does not maintain operational attributes (such as createTimeStamp >> and modifiersName). " > > That statement is incorrect, and has been corrected in modern releases > (2.4.x). Old 2.3.x man pages have the statement, but were not correct. > > <http://www.openldap.org/software/man.cgi?query=slapadd&apropos=0&sektion=0&…> Yup.. I confirmed this and you are correct.. I'm good now. thanks!

1 0

How to Clone / move an OpenLDAP instance?
by Michael March 03 Dec '09

03 Dec '09

I need to move all the data from one OpenLDAP instance to another (including operational attributes). What is the best way to do that? My first thought was to tar up all the file in /var/lib/openldap (on Centos) and move that data over but that doesn't seem to be working. Specifically, slapd will not start and no errors are spitting out. Any ideas? Thanks!

8 10

Re: How to Clone / move an OpenLDAP instance?
by Michael March 03 Dec '09

03 Dec '09

On Thu, Dec 3, 2009 at 10:43 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, December 03, 2009 9:36 AM -0700 Michael March > <mmarch(a)gmail.com> wrote: > >> Thanks for the response. >> >>> On Thursday, 3 December 2009 11:06:54 Michael March wrote: >>>> >>>> I need to move all the data from one OpenLDAP instance to another >>>> (including operational attributes). What is the best way to do that? >>> >>> slapcat;scp;slapadd >> >> Unfortunately slapadd doesn't maintain operational attributes. > > What in the world are you talking about? slapcat and slapadd maintain all > the attributes in the entry... Every time I import the output from slapcat I have to run the stream through this sed script to strip out operational attributes: /^creatorsName: /d /^createTimestamp: /d /^modifiersName: /d /^modifyTimestamp: /d /^structuralObjectClass: /d /^entryUUID: /d /^entryCSN: /d /^pwdHistory: /,+1d /^pwdChangedTime: /d /^pwdFailureTime: /d ... also from the slapadd man page: "As slapadd is designed to accept LDIF in database order, as produced by slapcat(8), it does not verify that superior entries exist before adding an entry, does not perform all user and system schema checks, and does not maintain operational attributes (such as createTimeStamp and modifiersName). "

2 1

Chaining problem
by Joe Friedeggs 03 Dec '09

03 Dec '09

I have a master-slave configuration, sync'ed with syncrepl. Most of my LDAP clients connect directly to the slave servers. Some of my client can handle referrals, but others cannot. For this reason, I use the 'chain' overlay. The configuration works fine when I have 'pam_password clear' in my clients' ldap.conf. But with 'pam_password md5', the clients are not sending the control messaging for ppolicy. This seems to be a pam_ldap issue, but I cannot seem to track it down and correct it. It has been suggested that I use the 'pam_password exop' option on the clients as a work-around for the pam_ldap issue. Doing this, I get hashed passwords, as well as correct ppolicy control messaging, and everything works fine doing this in my other (lab) scenario where I am not required to use chaining. BUT, in my chaining config, when the user makes a password change, instead of the user's password being changed, the chain's bind password is changed. NOTE: I do not employ SASL. Is this configuration supported? Anyone know why the chain's bind password would be getting changed, instead of the user's? Thanks, Joe _________________________________________________________________ Windows Live Hotmail gives you a free,exclusive gift. http://www.microsoft.com/windows/windowslive/hotmail_bl1/hotmail_bl1.aspx?o…

5 6

Re: changing samba and ldap password at the same time
by Luca Scamoni 02 Dec '09

02 Dec '09

you could use smbk5pwd overlay it's in contrib check out the source >----- Original Message ----- >From: mertes(a)uni-bonn.de >To: openldap-technical(a)openldap.org >Data: Wed, 02 Dec 2009 11:09:55 +0100 >Subject: changing samba and ldap password at the same time >Hi everybody, >I have a small question. > >I have here a samba domain authenticating with ldap. >If I now change the password for the regular LDAP user, it would be fine >if the samba password would be changed at the same time. Can I do that >with ldappasswd as well, and if yes, which parameters I need? >Or do I still need smbpasswd to change it? > >It would be great to do that 2in1 like.. > >Thx and regards Marc > > -- Luca Scamoni Gruppo Partners Associates Tel. Milano +39 02 67380435 - Udine +39 0432 689815 - Roma +39 06 54832300 Fax Milano +39 02 67386214 - Udine +39 0432 570120 - Roma +39 06 91659273 Cell. +39 348 0471710 Email: Luca.Scamoni(a)GruppoPA.it Sito: www.GruppoPA.it Prima di stampare, pensa all'ambiente ** Think about the environment before printing

1 0

Re: Search responses with incorrect msgId
by Eduardo Ramos Testillano 02 Dec '09

02 Dec '09

>Hi all, > >My application is an ldap client based on openLdap suite. I'm having >problems when receiving search responses with incorrect msgId. >The problem is: always returns error -1 being impossible to discriminate >other situations like remote server close. >The application always detach the connection fd when -1 is received (99% >is broken connection). >But we don't want to do close this when "receive a search response with >out-of-context msgId" (usually "out-of-time search result entries" after >sending AbandonRequest from client). > >I can't use ldap_msgid, because 'LDAPMessage*' is NULL and causes abort() >(anyway, no special result code is specified for this situation at >ldap_msgid API description). > >My code: > LDAP* handle = (LDAP*) a_ldap; > LDAPMessage* hmessage (NULL); > resultCode = ldap_result (handle, LDAP_RES_ANY, LDAP_MSG_ONE, NULL, >&hmessage); > >// I test the following, hoping result is not -1 with >LDAP_RES_UNSOLICITED, but it returned -1 again... > if (resultCode.getValue () == -1) > resultCode = ldap_result (handle, LDAP_RES_UNSOLICITED, >LDAP_MSG_ONE, NULL, &hmessage); > >?do you know any other way to identify responses with incorrect msgid? > >thnks >Regard, >Edu Hi, When we use: resultCode = ldap_result (handle, LDAP_RES_ANY, LDAP_MSG_ONE, -->NULL<--, &hmessage); I would like to clarify that -1 value was returned due to a signal on our process which interrupt the ldap_int_select within the ldap_result (where penultimate parameter (timeout) was NULL). We removed that signal and test again 'ldap_result' with zeroed-timeout (0 secs and 0 usecs): resultCode = ldap_result (handle, LDAP_RES_ANY, LDAP_MSG_ONE, &zeroed_tv, &hmessage); (even we have test 50 milisecs) Now, received response with out-of-context msgId, abort the application (due to assert over NULL hmessage when openLdap invokes 'ldap_msgid()'). We test this, changing msgId on response with TCP Test Tool, but actually, this could happen, as i said at former post, when expired context send AbandonRequest and then the ldap server sends the search result entry out of time. (The caller can expect that the result of an abandoned operation will not be returned from a future call to ldap_result()). Solutions? ---- 1 - Our ldap server, don't support LDAP_OPT_TIMELIMIT (it is optional), and then could answer out of time after an AbandonRequest received from client (or not) (RFC-compliant). ---- 2 - If we use 'LDAP_RES_ANY' we reach abort() when receive INcorrect message responses. If we use 'LDAP_RES_UNSOLICITED' we reach abort() when receive correct message responses. We can't combine these extract methods: not possible to mask values with OR, they are defined in this way: #define LDAP_RES_ANY (-1) #define LDAP_RES_UNSOLICITED (0) Perhaps it's possible to add a new #define like 'LDAP_RES_ALL=-2' which causes different special value returns on ldap_result() to make a distinction about which kind of message we receive: solicited or unsolicited. Or perhaps it's possible to get a not NULL hmessage on last ldap_result parameter, when something incorrect is received (only would be NULL on break connection event). We reach openldap debug output like this: ../../../libraries/liblber/io.c:516: ber_get_next: Assertion `ber->ber_buf == ((void *)0)' failed. ---- 3 - Avoid sending AbandonRequest in order to keep all (good/bad) contexts, perhaps solve the problem (we suppose ldap_abandon() clears internal openLdap memory resource (*)). We could send the AbandonRequest sometime later (configurable delay), or never send including any "garbage collector" mechanism (not sure if exist any openLdap primitive to do this without ldap_abandon()). We don't like any idea like this. What do you think? (*) anyone could confirm this ? ---- 4 - We are testing the following code now, but think it couldn't be such complex to afford the problem: (the application is single thread and must keep connection all the time even if incorrect msgId is received) ualarm (100000, 0); resultCode = ldap_result (handle, LDAP_RES_ANY, LDAP_MSG_ONE, NULL, &hmessage); // If we receive an unexpected message, ldap_result gets blocked on ldap_int_select due to the extract // method (LDAP_RES_ANY), and the penultimate parameter (NULL is infinite timeout). But this situation // is interrupted with former 'ualarm' signal (100 ms delay) int xerrno = errno; ualarm (0, 0); if (resultCode == -1) { int result = -1; bool disconnect (false); if (ldap_get_option (handle, LDAP_OPT_RESULT_CODE, &result) != LDAP_OPT_SUCCESS) disconnect = true; else if (result == LDAP_SERVER_DOWN) disconnect = true; else if (result == LDAP_CONNECT_ERROR) disconnect = true; if (disconnect == true && xerrno == EINTR) disconnect = false; } Indeed, we don't like this method, because we are not sure if fd stream is corrupted after an unexpected message, and probably could affect the next normal ones. We think it must be any simple way to manage this. We can't found a good point to manage the problem. any idea? Thanks Eduardo Regards Edu

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical