openldap-technical

openldap-technical@openldap.org

5 participants
9899 discussions

Chaining problem
by Joe Friedeggs 03 Dec '09

03 Dec '09

I have a master-slave configuration, sync'ed with syncrepl. Most of my LDAP clients connect directly to the slave servers. Some of my client can handle referrals, but others cannot. For this reason, I use the 'chain' overlay. The configuration works fine when I have 'pam_password clear' in my clients' ldap.conf. But with 'pam_password md5', the clients are not sending the control messaging for ppolicy. This seems to be a pam_ldap issue, but I cannot seem to track it down and correct it. It has been suggested that I use the 'pam_password exop' option on the clients as a work-around for the pam_ldap issue. Doing this, I get hashed passwords, as well as correct ppolicy control messaging, and everything works fine doing this in my other (lab) scenario where I am not required to use chaining. BUT, in my chaining config, when the user makes a password change, instead of the user's password being changed, the chain's bind password is changed. NOTE: I do not employ SASL. Is this configuration supported? Anyone know why the chain's bind password would be getting changed, instead of the user's? Thanks, Joe _________________________________________________________________ Windows Live Hotmail gives you a free,exclusive gift. http://www.microsoft.com/windows/windowslive/hotmail_bl1/hotmail_bl1.aspx?o…

5 6

Re: changing samba and ldap password at the same time
by Luca Scamoni 02 Dec '09

02 Dec '09

you could use smbk5pwd overlay it's in contrib check out the source >----- Original Message ----- >From: mertes(a)uni-bonn.de >To: openldap-technical(a)openldap.org >Data: Wed, 02 Dec 2009 11:09:55 +0100 >Subject: changing samba and ldap password at the same time >Hi everybody, >I have a small question. > >I have here a samba domain authenticating with ldap. >If I now change the password for the regular LDAP user, it would be fine >if the samba password would be changed at the same time. Can I do that >with ldappasswd as well, and if yes, which parameters I need? >Or do I still need smbpasswd to change it? > >It would be great to do that 2in1 like.. > >Thx and regards Marc > > -- Luca Scamoni Gruppo Partners Associates Tel. Milano +39 02 67380435 - Udine +39 0432 689815 - Roma +39 06 54832300 Fax Milano +39 02 67386214 - Udine +39 0432 570120 - Roma +39 06 91659273 Cell. +39 348 0471710 Email: Luca.Scamoni(a)GruppoPA.it Sito: www.GruppoPA.it Prima di stampare, pensa all'ambiente ** Think about the environment before printing

1 0

Re: Search responses with incorrect msgId
by Eduardo Ramos Testillano 02 Dec '09

02 Dec '09

>Hi all, > >My application is an ldap client based on openLdap suite. I'm having >problems when receiving search responses with incorrect msgId. >The problem is: always returns error -1 being impossible to discriminate >other situations like remote server close. >The application always detach the connection fd when -1 is received (99% >is broken connection). >But we don't want to do close this when "receive a search response with >out-of-context msgId" (usually "out-of-time search result entries" after >sending AbandonRequest from client). > >I can't use ldap_msgid, because 'LDAPMessage*' is NULL and causes abort() >(anyway, no special result code is specified for this situation at >ldap_msgid API description). > >My code: > LDAP* handle = (LDAP*) a_ldap; > LDAPMessage* hmessage (NULL); > resultCode = ldap_result (handle, LDAP_RES_ANY, LDAP_MSG_ONE, NULL, >&hmessage); > >// I test the following, hoping result is not -1 with >LDAP_RES_UNSOLICITED, but it returned -1 again... > if (resultCode.getValue () == -1) > resultCode = ldap_result (handle, LDAP_RES_UNSOLICITED, >LDAP_MSG_ONE, NULL, &hmessage); > >?do you know any other way to identify responses with incorrect msgid? > >thnks >Regard, >Edu Hi, When we use: resultCode = ldap_result (handle, LDAP_RES_ANY, LDAP_MSG_ONE, -->NULL<--, &hmessage); I would like to clarify that -1 value was returned due to a signal on our process which interrupt the ldap_int_select within the ldap_result (where penultimate parameter (timeout) was NULL). We removed that signal and test again 'ldap_result' with zeroed-timeout (0 secs and 0 usecs): resultCode = ldap_result (handle, LDAP_RES_ANY, LDAP_MSG_ONE, &zeroed_tv, &hmessage); (even we have test 50 milisecs) Now, received response with out-of-context msgId, abort the application (due to assert over NULL hmessage when openLdap invokes 'ldap_msgid()'). We test this, changing msgId on response with TCP Test Tool, but actually, this could happen, as i said at former post, when expired context send AbandonRequest and then the ldap server sends the search result entry out of time. (The caller can expect that the result of an abandoned operation will not be returned from a future call to ldap_result()). Solutions? ---- 1 - Our ldap server, don't support LDAP_OPT_TIMELIMIT (it is optional), and then could answer out of time after an AbandonRequest received from client (or not) (RFC-compliant). ---- 2 - If we use 'LDAP_RES_ANY' we reach abort() when receive INcorrect message responses. If we use 'LDAP_RES_UNSOLICITED' we reach abort() when receive correct message responses. We can't combine these extract methods: not possible to mask values with OR, they are defined in this way: #define LDAP_RES_ANY (-1) #define LDAP_RES_UNSOLICITED (0) Perhaps it's possible to add a new #define like 'LDAP_RES_ALL=-2' which causes different special value returns on ldap_result() to make a distinction about which kind of message we receive: solicited or unsolicited. Or perhaps it's possible to get a not NULL hmessage on last ldap_result parameter, when something incorrect is received (only would be NULL on break connection event). We reach openldap debug output like this: ../../../libraries/liblber/io.c:516: ber_get_next: Assertion `ber->ber_buf == ((void *)0)' failed. ---- 3 - Avoid sending AbandonRequest in order to keep all (good/bad) contexts, perhaps solve the problem (we suppose ldap_abandon() clears internal openLdap memory resource (*)). We could send the AbandonRequest sometime later (configurable delay), or never send including any "garbage collector" mechanism (not sure if exist any openLdap primitive to do this without ldap_abandon()). We don't like any idea like this. What do you think? (*) anyone could confirm this ? ---- 4 - We are testing the following code now, but think it couldn't be such complex to afford the problem: (the application is single thread and must keep connection all the time even if incorrect msgId is received) ualarm (100000, 0); resultCode = ldap_result (handle, LDAP_RES_ANY, LDAP_MSG_ONE, NULL, &hmessage); // If we receive an unexpected message, ldap_result gets blocked on ldap_int_select due to the extract // method (LDAP_RES_ANY), and the penultimate parameter (NULL is infinite timeout). But this situation // is interrupted with former 'ualarm' signal (100 ms delay) int xerrno = errno; ualarm (0, 0); if (resultCode == -1) { int result = -1; bool disconnect (false); if (ldap_get_option (handle, LDAP_OPT_RESULT_CODE, &result) != LDAP_OPT_SUCCESS) disconnect = true; else if (result == LDAP_SERVER_DOWN) disconnect = true; else if (result == LDAP_CONNECT_ERROR) disconnect = true; if (disconnect == true && xerrno == EINTR) disconnect = false; } Indeed, we don't like this method, because we are not sure if fd stream is corrupted after an unexpected message, and probably could affect the next normal ones. We think it must be any simple way to manage this. We can't found a good point to manage the problem. any idea? Thanks Eduardo Regards Edu

1 0

dynlist overlay feature request
by Alexander 'Leo' Bergolth 02 Dec '09

02 Dec '09

Are there any plans to extend the dynlist overlays dynamic group feature to return not the DNs of the matched entries but an attribute of the entries? This would be useful for defining dynamic groups based on posixGroup (which need only the username, not the full DN) and populating them with entries from posixAccounts. If the dynlist-attrset could be extended by one parameter like: dynlist-attrset <group-oc> <URL-ad> [<member-ad>] [<result-ad>] ... where the additional parameter specifies the attribute that should be returned from the search results, a dynamic posixGroup could be configured like that: dynlist-attrset myposixGroup memberURL memberUid uid with a search filter like that: ldap:///ou=users,dc=local,dc=site??sub?(&(objectClass=posixAccount)(<searchfilter>)) I.e. "take the uid attribute of the matched entries and add them as memberUid." Could this extension be easily implemented? Is there currently any workaround? E.g. a way to dynamically add a memberUid to each posixAccount that contains the same data as the uid attribute? If that works, a filter like ldap:///ou=users,dc=local,dc=site?memberUid?sub?(&(objectClass=posixAccount)(<searchfilter>)) ... could work. Thanks in advance, --leo -- e-mail ::: Leo.Bergolth (at) wu.ac.at fax ::: +43-1-31336-906050 location ::: IT-Services | Vienna University of Economics | Austria

3 6

PAM EXOP causes chain bind password to change
by Joe Friedeggs 01 Dec '09

01 Dec '09

I am having an issue with my 'chain' bind password getting changed instead of the user's password. In a Red Hat Linux environment, running OpenLDAP 2.3.43(-3.el5 RPM from RH), I am using a master-slave setup, with chaining (as opposed to referral) as a method to allow users to change passwords (most LDAP clients hit the slave). Because I have some other issues when I set (nss_ldap) 'pam_password md5'in ldap.conf, I tried setting it to 'pam_password exop' instead. But, with this setting, when a user attempts a password change from one of the Linux clients, the ldap chain BIND password is changed on the master, instead of the user's password. In my slave slapd.conf, I have: #################################################################### # Chain to Master for updates overlay chain chain-uri "ldap://10.10.1.191" chain-idassert-bind bindmethod="simple" binddn="cn=ldapChain,o=myorg,dc=myco,dc=net" credentials="ldapChain" mode="none" # mode="self" chain-max-depth 2 chain-return-error TRUE chain-rebind-as-user TRUE ####################################################################### # To sync with the LDAP Master database using syncrepl syncrepl rid=222 type=refreshAndPersist provider=ldap://10.10.1.191 retry="30 10 300 3" searchbase="dc=myco,dc=net" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="cn=syncRepl,o=myorg,dc=myco,dc=net" credentials="syncRepl" updateref ldap://10.10.1.191 #################################################################### SO, for example, when some user, say 'userbob' issues a 'passwd' and attempts to change his password from a Linux LDAP client (configured to hit the slave LDAP server), the password for "cn=ldapChain,o=myorg,dc=myco,dc=net" instead gets changed. The users password does not get changed. Anyone know what I could possibly have mis-configured that would cause this? Thanks in advance, Joe _________________________________________________________________ Chat with Messenger straight from your Hotmail inbox. http://www.microsoft.com/windows/windowslive/hotmail_bl1/hotmail_bl1.aspx?o…

1 0

ObjectClass for BDB databases
by Peter Mogensen 01 Dec '09

01 Dec '09

Hi, I was trying to manual change and HDB LDIF config to BDB and failed to guess the correct ObjectClass (instead of olcHdbConfig). Looking at the example in section 5.3: http://www.openldap.org/doc/admin24/slapdconf2.html#Configuration%20Example ...It seem the objectclass is olcBdbConfig, but slapd won't accept that and it isn't present in cn=config/cn=schema.ldif where the other objectclasses are defined. Is there a bug in the documentation? /Peter

1 1

Poor Performance on HP-UX 11v3
by 宋杨 30 Nov '09

30 Nov '09

Hi I install openldap(ixOpenLDAP_A.13.00-2.4.16.001_HP-UX_B.11.23_IA_PA.depot) on HP-UX 11v3 But I have a low performance when multi thread search, when one search thead about 0-1 ms, but when 10 search threads about 300+ms. By the way all conf files are default. Any suggestions? Thanks

2 1

/etc/nsswitch cause delay in start
by vishesh kumar 27 Nov '09

27 Nov '09

Dear friends I am facing a unique problem in openldap 2.3.43 on rhel 5. 2. If i specify ldap in /etc/nsswitch.conf like passwd files ldap shadow files ldap group files ldap And then start my ldap server, it takes lots of time to start ldap server. If i remove ldap from /etc/nsswitch.conf , it start immediately. Can anyone suggest be any solution for this problem. Thanks -- http://linuxinterviews.blogspot.com

4 4

Syncrepl : Authentication issue
by smainklh＠free.fr 27 Nov '09

27 Nov '09

Hello guys, I'm meeting an issue when configuring ldap replication. The synchronisation account doesn't authenticate with the provider. Here are my configuration files : /etc/ldap/slapd.conf (provider): ----------------------- moduleload syncprov database bdb overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 index objectClass,entryCSN,entryUUID eq /etc/ldap/slapd.conf (consumer): -------------------------- Syncrepl rid=666 provider=ldaps://provider.domain.tld:636/ type=refreshOnly retry="60 10 600 +" interval=00:00:30:00 searchbase="dc=domain,dc=tld" scope=sub schemachecking=on bindmethod=simple binddn="cn=syncrepluser,dc=domain,dc=tld" credentials=secret Errors below : >From consumer ------------ slap_client_connect: URI=ldaps://provider.domain.tld:636/ DN="cn=syncrepluser,dc=domain,dc=tld" ldap_sasl_bind_s failed (49) do_syncrepl: rid=666 retrying (9 retries left) >From provider ------------ Nov 26 15:28:47 provider slapd[2514]: do_bind: version=3 dn="cn=syncrepluser,dc=domain,dc=tld" method=128 Nov 26 15:28:47 provider slapd[2514]: bdb_dn2entry("cn=syncrepluser,dc=domain,dc=tld") Nov 26 15:28:47 provider slapd[2514]: => bdb_dn2id("cn=syncrepluser,dc=domain,dc=tld") Nov 26 15:28:47 provider slapd[2514]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30990) Nov 26 15:28:47 provider slapd[2514]: send_ldap_result: conn=3 op=0 p=3 Nov 26 15:28:47 provider slapd[2514]: send_ldap_response: msgid=1 tag=97 err=49 Nov 26 15:28:47 provider slapd[2514]: connection_get(14): got connid=3 Nov 26 15:28:47 provider slapd[2514]: connection_read(14): checking for input on id=3 Nov 26 15:28:47 provider slapd[2514]: ber_get_next on fd 14 failed errno=0 (Success) Nov 26 15:28:47 provider slapd[2514]: connection_closing: readying conn=3 sd=14 for close Nov 26 15:28:47 provider slapd[2514]: connection_close: deferring conn=3 sd=14 Nov 26 15:28:47 provider slapd[2514]: conn=3 op=1 do_unbind Nov 26 15:28:47 provider slapd[2514]: connection_resched: attempting closing conn=3 sd=14 Nov 26 15:28:47 provider slapd[2514]: connection_close: conn=3 sd=14 Do i have to create an account in the ldap tree? Is there a problem using SSL? Thank you for your help. Regards, Grifith

2 2

LDAP + squid
by Bruno Steven 27 Nov '09

27 Nov '09

Hello ... My squid work fine with Openldap, but I need change method authentication of user for groups , so I made the configuration follow . # As linhas abaixo se referem a autenticaÃ§ de usuÃ¡os no AD auth_param basic program /usr/local/squid/libexec/squid_ldap_auth -R -b "dc=amblivre,dc=com" -D "cn=proxy_user,ou=Internet,dc=amblivre,dc=com" -w "password" -f sAMAccountName=%s -h 192.168.4.55 auth_param basic realm Input your password auth_param basic children 5 auth_param basic credentialsttl 15 minutes #acl senha proxy_auth REQUIRED #http_access allow senha # ACL externa para autenticaÃ§ nas bases LDAP do PDC external_acl_type ldap_group %LOGIN /usr/local/squid/libexec/squid_ldap_group -R -b "dc=amblivre,dc=com" -D "cn=proxy_user,ou=Internet,dc=amblivre,dc=co m" -w "password" -f "(&(objectclass=person)(sAMAccountName=%v)(memberof=cn=%a,ou=Internet,dc=amblivre,dc=com))" -h 192.168.4.55 acl AcessoLivre external ldap_group AcessoLivre http_access AcessoLivre When the I input user and passord for auth the Squid doesn´t recognize the credentials . There are some problem in my configuration ? Thanks. -- Bruno Steven - Administrador de sistemas. LPIC-1 - LPI ID: lpi000119659 / Code: p2e4wz47e4 https://www.lpi.org/caf/Xamman/certification MCP-Windows 2003 - TranscriptID: 793804 / Access Code: 080089100 https://mcp.microsoft.com/authenticate/validatemcp.aspx P Antes de imprimir pense em sua responsabilidade e comprometimento com o Meio Ambiente. Before printing this message, think about your ecologic responsability and environment commitment.

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical