openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

defining own attributes/class
by Zdenek Styblik 27 Oct '09

27 Oct '09

Hello, I would like to ask, if somebody knows a really good how-to about $subj. I've read couple books, let's say I'm able to define my own attribute, even extend some existing object - I think these are no problem, as they are based on trying right-wrong. My biggest concern is about numbering [OID/PEN ?]. I've requested PEN from IANA, no problem here. But how should I divide numbers to attributes? Does it matter? Can I run out of space? Do something [utterly] wrong? I just haven't seen this [numbering] explained to the last bit anywhere. Or may be, I've just read wrong. I mean, should it be like tree structure and eg. class1 = prefix.PEN.1.X; class2 = prefix.PEN.2.X; ...; classN = prefix.PEN.N.X; ? But may be there is no "bigger" sense I'm looking for and incremental numbering (+1 per attribute) is just enough. PS: for example, I would like to add JID [jabber ID]/IM [which would hold whatever Instant Messaging string] attribute and extend InetOrgPerson with this attribute. Thanks in advance for explanation/pointing me to the right direction. Regards, Zdenek -- Zdenek Styblik Net/Linux admin OS TurnovFree.net email: stybla(a)turnovfree.net jabber: stybla(a)jabber.turnovfree.net

2 1

samba ldap
by Kaushal Shriyan 27 Oct '09

27 Oct '09

Hi, I am following https://help.ubuntu.com/8.10/serverguide/C/samba-ldap.html and ldap works perfectly fine. I have issues with connecting to ldap from samba. I get [2009/10/27 12:37:28, 1] lib/smbldap.c:another_ldap_try(1153) Connection to LDAP server failed for the 9 try! [2009/10/27 12:37:29, 2] lib/smbldap.c:smbldap_open_connection(786) smbldap_open_connection: connection opened [2009/10/27 12:37:29, 2] lib/smbldap.c:smbldap_connect_system(982) failed to bind to server ldap://localhost/ with dn="cn=admin,dc=mt,dc=webaroo,dc=com" Error: Can't contact LDAP server (unknown) I have ldapserver running on the same server as samba server is running. when i run ldapsearch -x -H ldaps://localhost. I am able to see the user details. Please let me know if anyone needs configs and additional information. Also when i run smbldap-populate, i get http://paste.ubuntu.com/302630/ Thanks, Kaushal

2 1

Openldap + GroupOffice
by Bruno Steven 27 Oct '09

27 Oct '09

Hi I trying integrate openldap more group-office, somebody have documentation or how to for this ? Thanks.... -- Bruno Steven - Administrador de sistemas. LPIC-1 - LPI ID: lpi000119659 / Code: p2e4wz47e4 https://www.lpi.org/caf/Xamman/certification MCP-Windows 2003 - TranscriptID: 793804 / Access Code: 080089100 https://mcp.microsoft.com/authenticate/validatemcp.aspx P Antes de imprimir pense em sua responsabilidade e comprometimento com o Meio Ambiente. Before printing this message, think about your ecologic responsability and environment commitment.

1 0

Making copies of attribute values
by Ravi Verma 27 Oct '09

27 Oct '09

Dear Friends, I have a need to extend an LDAP schema by adding an attribute and copy the value from an existing attribute to it. We need to keep the two copies of the attribute values in synch. It is a kind of replication where it is replicating one attribute into another in the same record. I appreciate your help. -- Kind regards. Ravi Verma Chief Executive Officer Telecommand Software and Services 3175 Sunset Blvd, Suite 104-B Rocklin, CA 95677 Phone:9167053261 Fax:9169142008 www.telecommand.com

3 3

RE: ppolicy and Red Hat Linux
by Joe Friedeggs 26 Oct '09

26 Oct '09

Re-posting minus the garbage.... >> Debugging this issue has caused me a bit of confusion. In the LDAP logs, when logging into other equipment that 'binds as user', I see warnings, etc. returned: >> >> ppolicy_bind: Setting warning for password expiry for uid=test_user,ou=people,o=theorg,dc=example,dc=net = 1251 secds >> >> BUT, since the Linux LDAP client has a separate 'binddn', I don't see these warnings when the Linux LDAP client does the ldapsearch to validate the user. How does the policy work in this situation? >> >> Am I missing something here? >> > > Hello, > > have a look at 'man pam_ldap': > > <snip> >> pam_lookup_policy <yes|no> >> Specifies whether to search the root DSE for password policy. The default is "no". > <snap> > > Did you set that to yes on your clients in /etc/ldap.conf or what ever > it is called on RHEL5? > > > Regards, > Christian Manal Thanks for the response, Christian. Yes, I have the following in my clients' /etc/ldap.conf: host ldap_svc binddn cn=simpleBind,o=theorg,dc=example,dc=net bindpw simpleBind bind_timelimit 3 base o=theorg,dc=example,dc=net sudoers_base ou=sudoers,o=theorg,dc=example,dc=net timelimit 7 idle_timelimit 3600 nss_base_passwd ou=people,o=theorg,dc=example,dc=net?one nss_base_shadow ou=people,o=theorg,dc=example,dc=net?one nss_base_group ou=groups,o=theorg,dc=example,dc=net?one nss_reconnect_tries 3 nss_initgroups_ignoreusers root,ldap,named,haldaemon,radiusd,linux_admin pam_password md5 pam_groupdn cn=level_3,ou=host_ssh_access,o=theorg,dc=example,dc=net pam_member_attribute uniqueMember pam_lookup_policy yes Thanks, Joe  _________________________________________________________________ Windows 7: Simplify your PC. Learn more. http://www.microsoft.com/Windows/windows-7/default.aspx?ocid=PID24727::T:WL…

1 0

ppolicy and Red Hat Linux
by Joe Friedeggs 26 Oct '09

26 Oct '09

I need help/advise on ppolicy against Linux servers. I am running OpenLDAP 2.3.43-3.el5 (Red Hat rpm) on RHEL5. I am using the ppolicy overlay. The overlay seems to work to all of the tools, etc., that use this LDAP, except for the Linux servers. With these servers, we get no expiry warning, and users can log in after the password has expired (unlimited). We are using PAM/LDAP on these servers. Debugging this issue has caused me a bit of confusion. In the LDAP logs, when logging into other equipment that 'binds as user', I see warnings, etc. returned: ppolicy_bind: Setting warning for password expiry for uid=test_user,ou=people,o=theorg,dc=example,dc=net = 1251 secds BUT, since the Linux LDAP client has a separate 'binddn', I don't see these warnings when the Linux LDAP client does the ldapsearch to validate the user. How does the policy work in this situation? Am I missing something here? Here's what I see when I log in as a users (second login, pwdGraceAuthNLimit=2): login as: test_user test_user@linux_box's password: Last login: Fri Oct 23 19:39:03 2009 from 10.50.1.135 [test_user@linux_box ~]$ [test_user@linux_box ~]$ ldapwhoami -x -D "uid=test_user,ou=people,o=theorg,dc=example,dc=net" -W -e ppolicy Enter LDAP Password: ldap_bind: Success (0) (Password expired, 1 grace logins remain) dn:uid=test_user,ou=people,o=theorg,dc=example,dc=net Result: Success (0) [test_user@linux_box ~]$ [test_user@linux_box ~]$exit Then on the next login: login as: test_user test_user@linux_box's password: Last login: Fri Oct 23 19:39:26 2009 from 10.50.1.135 [test_user@linux_box ~]$ [test_user@linux_box ~]$ ldapwhoami -x -D "uid=test_user,ou=people,o=theorg,dc=example,dc=net" -W -e ppolicy Enter LDAP Password: ldap_bind: Invalid credentials (49); Password expired [test_user@linux_box ~]$ [test_user@linux_box ~]$exit Yet again: login as: test_user test_user@linux_box's password: Last login: Fri Oct 23 19:40:12 2009 from 10.50.1.135 [test_user@linux_box ~]$ [test_user@linux_box ~]$ ldapwhoami -x -D "uid=test_user,ou=people,o=theorg,dc=example,dc=net" -W -e ppolicy Enter LDAP Password: ldap_bind: Invalid credentials (49); Password expired [test_user@linux_box ~]$ [test_user@linux_box ~]$ [test_user@linux_box ~]$ [test_user@linux_box ~]$ ldapsearch -x -D 'cn=ldapmanager,o=theorg,dc=example,dc=net' -b 'uid=test_user,ou=people,o=theorg,dc=example,dc=net' -w ldapspwd + # extended LDIF # # LDAPv3 # base <uid=test_user,ou=people,o=theorg,dc=example,dc=net> with scope subtree # filter: (objectclass=*) # requesting: + # # test_user, people, theorg, example.net dn: uid=test_user,ou=people,o=theorg,dc=example,dc=net structuralObjectClass: person entryUUID: d45aa296-a3e4-102d-8c8e-0b16af70e85f creatorsName: cn=ldapmanager,o=theorg,dc=example,dc=net createTimestamp: 20090313063503Z pwdHistory: 20091023185344Z#1.3.6.1.4.1.1466.115.121.1.40#41#{crypt}$1$RCW90SL v$8PfQ99gzlJd.7TH2HnhOS0 pwdHistory: 20091023190836Z#1.3.6.1.4.1.1466.115.121.1.40#41#{crypt}$1$RM6V/En e$0oGsI47SUaIDFap9Nft3z1 pwdHistory: 20091023191529Z#1.3.6.1.4.1.1466.115.121.1.40#41#{crypt}$1$18vC.s9 3$cT38cSrrF/PXMhWqV.P.r/ pwdPolicySubentry: cn=ppdefault_test,ou=policies,o=theorg,dc=example, dc=net pwdChangedTime: 20091023191529Z pwdGraceUseTime: 20091023193816Z pwdGraceUseTime: 20091023193905Z entryCSN: 20091023193905Z#000000#00#000000 modifiersName: cn=ldapmanager,o=theorg,dc=example,dc=net modifyTimestamp: 20091023193905Z entryDN: uid=test_user,ou=people,o=theorg,dc=example,dc=net subschemaSubentry: cn=Subschema hasSubordinates: FALSE # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 [test_user@linux_box ~]$ [test_user@linux_box ~]$ ldapsearch -x -D 'cn=ldapmanager,o=theorg,dc=example,dc=net' -b 'cn=ppdefault_test,ou=policies,o=theorg,dc=example,dc=net' -w ldapspwd # extended LDIF # # LDAPv3 # base <cn=ppdefault_test,ou=policies,o=theorg,dc=example,dc=net> with scope subtree # filter: (objectclass=*) # requesting: ALL # # ppdefault_test, policies, theorg, example.net dn: cn=ppdefault_test,ou=policies,o=theorg,dc=example,dc=net cn: ppdefault_test objectClass: person objectClass: pwdPolicy objectClass: pwdPolicyChecker pwdAttribute: userPassword pwdLockout: TRUE pwdMustChange: TRUE pwdAllowUserChange: TRUE pwdGraceAuthNLimit: 2 pwdCheckQuality: 1 pwdInHistory: 3 pwdLockoutDuration: 60 pwdMaxFailure: 5 pwdFailureCountInterval: 603 sn: ppdefault_test pwdMaxAge: 120 pwdExpireWarning: 100 description: test pwdMinAge: 1 pwdSafeModify: FALSE # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 [test_user@linux_box ~]$ [test_user@linux_box ~]$ cat /etc/pam.d/passwd #%PAM-1.0 auth include system-auth account include system-auth password include system-auth [test_user@linux_box ~]$ [test_user@linux_box ~]$ cat /etc/pam.d/system-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required /lib/security/$ISA/pam_env.so auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass auth required /lib/security/$ISA/pam_deny.so account required /lib/security/$ISA/pam_unix.so broken_shadow account sufficient /lib/security/$ISA/pam_succeed_if.so uid < 100 quiet account [default=bad success=ok user_unknown=ignore] /lib/security/$ISA/pam_ldap.so account required /lib/security/$ISA/pam_permit.so password requisite /lib/security/$ISA/pam_cracklib.so retry=3 lcredit=-1 ucredit=-1 dcredit=-1 ocredit=-1 type=LDAP password sufficient /lib/security/$ISA/pam_unix.so nullok md5 use_authtok shadow password sufficient /lib/security/$ISA/pam_ldap.so use_authtok password required /lib/security/$ISA/pam_deny.so session required /lib/security/$ISA/pam_limits.so session required /lib/security/$ISA/pam_unix.so session optional /lib/security/$ISA/pam_ldap.so Any advise would be much appreciated (I swear this worked when I tested it last March). Thanks, Joe _________________________________________________________________ Windows 7: Simplify your PC. Learn more. http://www.microsoft.com/Windows/windows-7/default.aspx?ocid=PID24727::T:WL…

2 2

Using Arbitrary X509 certificates for LDAPS authentication
by Stephen Cartwright 24 Oct '09

24 Oct '09

Hi there, Are there any restrictions on the DN or other attributes of credentials used for LDAP authentication? We are using grid credentials (X509 format) with DNs like this: issuer= /C=CA/O=Grid/CN=Grid Canada Certificate Authority subject= /C=CA/O=Grid/CN=host/somehost.somedomain.ca When I use some grid certs (X509 format) I see this message in the debug output from slapd: connection_read(10): unable to get TLS client DN error=49 id=3 When I try to connect, I get this: ldap_initialize( ldaps://somehost.somedomain.ca ) ldap_bind: Can't contact LDAP server The openssl command to create a connection works OK: CONNECTED(00000003) --- Certificate chain 0 s:/C=CA/O=Grid/CN=host/somehost.somedomain.ca i:/C=CA/O=Grid/CN=Grid Canada Certificate Authority 1 s:/C=CA/O=Grid/CN=Grid Canada Certificate Authority i:/C=CA/O=Grid/CN=Grid Canada Certificate Authority --- Server certificate -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- subject=/C=CA/O=Grid/CN=host/somehost.somedomain.ca issuer=/C=CA/O=Grid/CN=Grid Canada Certificate Authority --- No client certificate CA names sent --- SSL handshake has read 2083 bytes and written 320 bytes --- New, TLSv1/SSLv3, Cipher is DES-CBC3-SHA Server public key is 1024 bit SSL-Session: Protocol : TLSv1 Cipher : DES-CBC3-SHA Session-ID: 43B46528E848663E7C8E9CAAEA4E6DB5E4A9675C05C3066DBD826CD1CF59A566 Session-ID-ctx: Master-Key: A8245A0731BA98F0D88821346432868C392FEE3F23EAFB9F356A34CB6BB663FC0892374118F280D6284C8E2ACAC3 Key-Arg : None Start Time: 1251330160 Timeout : 300 (sec) Verify return code: 0 (ok) When I use certs created by us with another DN format such as this: subject= /C=CA/ST=Province/L=Town/O=Organization/OU=Unit/CN=somehost.somedomain.ca/emailAddress=email(a)somewhere.ca issuer= /C=CA/ST=Province/O=Organization/OU=Town/CN=Our CA/emailAddress=email(a)somewhere.ca And then make no other changes to the config other than pointing everything to the new commands I can make a connection. Any suggestions? Please advise. Steve

3 6

ldapsearch vs AD output
by Cherubini Enrico 24 Oct '09

24 Oct '09

Good day, hope to be not OT. I have to get members of a group in AD, so here is what I do and what I get: ldapsearch -x -D "pippo(a)dominio.com" -w pippopw "cn=groupname" member:: W049X1MgVmlhPPAaXTDoCxPVT1fQSBNYW51dGOOOemlvbmUgZSBHZXN0aW9uZSBQYX= Rya W1vbmlvLERDPXByb3ZpbmNpYSxEQz12cixEQz1pdA=3D=3D member: CN=_SubGroup2,OU=_SubGroupArea,DC=dominio,DC=com If I do a search whith phpldapadmin I get both name (_SubGroup1 and _SubGroup2), so I guess the problem is how ldapsearch handles the output from AD server or in config file, but can't find a solution. Any hint ? TIA

2 1

2.3.43 master to 2.4.18 slave problem
by Bill MacAllister 23 Oct '09

23 Oct '09

I have hit a replication problem that I am scratching my head over. We are in the midst of migrating from OpenLDAP from 2.3 to 2.4. In our test environment we have a 2.3.43 master with 2.4.18 and 2.3.35 slaves. Replication to the 2.4 slave stopped this morning. When I look at the log I see: Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: cookie=csn=20091022031949Z#000000#00#000000,rid=000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: rid=000 CSN too old, ignoring 20091022031949.000000Z#000000#000#000000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: cookie=csn=20091022031949Z#000001#00#000000,rid=000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: rid=000 CSN too old, ignoring 20091022031949.000000Z#000001#000#000000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: cookie=csn=20091022031949Z#000002#00#000000,rid=000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: rid=000 CSN too old, ignoring 20091022031949.000000Z#000002#000#000000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: cookie=csn=20091022031949Z#000003#00#000000,rid=000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: rid=000 CSN too old, ignoring 20091022031949.000000Z#000003#000#000000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: cookie=csn=20091022031949Z#000004#00#000000,rid=000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: rid=000 CSN too old, ignoring 20091022031949.000000Z#000004#000#000000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: cookie=csn=20091022031949Z#000005#00#000000,rid=000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: slap_queue_csn: queing 0x7f09c283b075 20091022031949Z#000005#00#000000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: syncrepl_message_to_op: rid=000 mods check (homePostalAddress: value #0 invalid per syntax) Oct 22 09:38:28 ldap-uat1 slapd[15032]: slap_graduate_commit_csn: removing 0x7f09c1621438 20091022031949Z#000005#00#000000 So, I slapcat'ed the master's database and looked for that contextCSN. The entry that appears to be the problem has a homePostalAddress of: homePostalAddress: c\o Bain & Company, Two Copley Place, Boston, Massachusetts We had hit this problem before when loading a 2.4 server using slapcat output from a 2.3 server and wrote a simple filter to correctly quote the backslash. This is a problem for us because we expect to have a mixed 2.3/2.4 during the transistion to 2.4 on our production servers. The really nasty bit is that the only way I know for sure to fix this problem is to reload the slave. Is there an alterntive way? Bill -- Bill MacAllister, System Software Programmer Unix Systems Group, Stanford University

3 2

shadow context; no update referral
by Venish Khant 23 Oct '09

23 Oct '09

I had configured openldap in master/slave for replication. It's work perfectly. It's replicated entries but one entry not replicated. I try to add that entry using ldapadd command in my slave server. That time I got the below error. adding new entry "uid=test,ou=people,dc=example,dc=com" ldap_add: Server is unwilling to perform (53) additional info: shadow context; no update referral -- Venish Khant www.deeproot.co.in

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical