openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

help with indices - what to index depending on server role
by vgrig_us＠hotmail.com 05 Oct '09

05 Oct '09

Hello We're switching our college to openldap and I'm struggling a bit with decisions on indexing (all other parts - base functionality, replication, ACLs - are setup and working fine) . Maybe this list will help? What to index and why? Our setup is as follows: ----------------------------------------- a) 4 incoming MX servers running portfix. /etc/postfix/ldap-aliases.cf file is as follows: server_host = ldap://localhost ldap://mailhub3 bind = no search_base = dc=college, dc=edu query_filter = mail=%s(a)college.edu result_attribute = maildrop ----------------------------------------- b) 2 outgoing smtp servers purring postfix and sasl. /etc/saslauthd.conf: ldap_servers: ldaps://localhost/ ldap_auth_method: fastbind ldap_filter: uid=%u,dc=college,dc=edu ldap_tls_check_peer: no ------------------------------------------- c) 2 radius servers for wifi authentication: basedn = "dc=college,dc=edu" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" password_attribute = userPassword ------------------------------------------- d) IMAP servers - real unix users, using LDAP for system authentication - pretty standard setup. pam_filter objectclass=posixAccount --------------------------------------------- On all of these I have following indices: index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub I suspect I don't need some (or most) of them. Thank you - Vadim

1 0

Importing user defined Object Classes from a file
by Parag Kalra 05 Oct '09

05 Oct '09

Hello Folks, Note: This question is on SunOne LDAP server. I apologize for posting it here but I thought someone might know the solution hence sharing with you all. I have a file which contains the schema related settings where in user defined object classes are defined. I know SunOne directory server provides a way to create user defined object classes but is there a way where I can import my entire file which will create & define all the user defined settings mentioned in that file. I am using Sun One Server Console 5.2 Thanks in advance. Cheers, Parag

1 0

syncrepl between 2.3.30 and 2.4.11
by Marc Cuypers 05 Oct '09

05 Oct '09

Hi, I'm using debian etch with slapd 2.3.30 as the master and debian lenny with slapd 2.4.11 as a consumer. I also have a debian etch consumer (slapd 2.3.30). When doing syncrepl with 2.3.30 consumer everything works fine. When syncrepl with 2.4.11 i get an error: slapd[19567]: slap_client_connect: URI=ldaps://xxx.xxx.xxx.xxx:8636 DN="cn=xxxxxxx,dc=xxxxxxx,dc=xxx" ldap_sasl_bind_s failed (-1) Is there a compatibility issue between 2.3.30 and 2.4.11? -- best regards, marc

3 2

Search Filter ...
by Remi Ferrand 05 Oct '09

05 Oct '09

Hi, I've the following configuration in my OpenLDAP : 1. dn: cn=stats.mysite.fr,ou=Group,dc=mysite,dc=fr 2. cn: stats.mysite.fr 3. objectClass: top 4. objectClass: groupOfNames 5. description: VirtualHost stats.mysite.fr 6. member: uid=user_authorized,ou=People,dc=mysite,dc=fr 7. member: uid=USER,ou=People,dc=mysite,dc=fr 8. 9. 10. dn: uid=USER,ou=People,dc=mysite,dc=fr 11. objectClass: top 12. objectClass: person 13. objectClass: inetOrgPerson 14. objectClass: organizationalPerson 15. objectClass: posixAccount 16. objectClass: shadowAccount 17. uid: USER 18. cn: USER P. 19. sn: USER P. 20. shadowMax: 99999 21. shadowWarning: 7 22. mail: USER(a)google.eu 23. loginShell: /bin/bash 24. uidNumber: 10007 25. gidNumber: 10007 26. homeDirectory: /home/ldap_users/USER 27. gecos: ,,, and I'm wondering how to create a filter to match only members of a given Group in order to use it with Apache2 or others ... The difficulty for me is to obtain the posixAccount object and not the Group one. Thanks in advance Rémi

5 8

Account Usable Request Control (1.3.6.1.4.1.42.2.27.9.5.8)
by Charls 02 Oct '09

02 Oct '09

Hello, At the moment I'm working with the Sun Java System Directory Server. I would like to migrate to Openldap but of course without losing functionality. I enabled pam_ldap account management on all my Linux and Solaris computers and everything worked fine. Everyone could do nonpassword-based logins using tools such as rsh or ssh. This feature was provided by the "Account Usable Request Control" (1.3.6.1.4.1.42.2.27.9.5.8) from the Directory Server which is needed by the ldap_pam module from Solaris. After the installation from openldap on my Solaris server I recognized that nonpassword-based logins on the Solaris computers are not possible anymore. This problem [1] was discussed 2 years ago on "openldap-software(a)openldap.org" but there was no solution described. I would like to know if there is a way to get this feature enabled with openldap? If not what can i do else? More technically: If a ssh client connects with public key authentication to a Solaris computer the pam module is sending a query to the ldap server if the account policies are handled by ldap to get all supportedControls and to check if the "Account Usable Request Control" exists to retrieve the policy data without the explicit login from the user. Thanks in advance! Charls [1] http://www.openldap.org/lists/openldap-software/200710/msg00041.html

2 1

Fwd: syncrepl inseard of back-perl ?
by Brett ＠Google 02 Oct '09

02 Oct '09

Hello, I was wondering if there are any concrete examples of using syncrepl to monitor a slapd for changes, and perform some scripted operation if the monitored data changes. I can think of several cases where this might be very handy, where you want to run a script or custom business logic, on receipt of some data being changed. I have seen some examples in the 2.3.x days, where slurpd was used to push changes to a back-perl script, which then did some custom business logic and it did fill an very useful niche. I imagine these post-slurp syncrepl days you could use the syncrepl protocol in a push mode via a proxy to push changes at a back-perl instance to the same sort of thing. But perhaps using syncrepl directly might seem like a better option, as this has been touted as a benefit of syncrepl, although i have not seen any specific examples.. To this end, i am wondering are the syncrepl client parts of slapd usable outside the context of the slapd binary? Has anyone tried this and has any examle code they are willing to share ? Cheers Brett

5 7

Segmentation fault using logpurge option in slapd.conf
by Julian Thomé 01 Oct '09

01 Oct '09

Hello mailing list, We have a problem using OpenLdap V. 2.4.11 with Debian Lenny. If we use the option logpurge in our slapd.conf, slapd can't start anymore. Our slapd.conf: >8-----------------------------------------------/etc/ldap/slapd.conf # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/misc.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/hdb.schema include /etc/ldap/schema/nis.schema # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values loglevel 4 #sasl-secprops minssf=0 # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_hdb moduleload smbk5pwd moduleload accesslog # The maximum number of entries that is returned for a search operation sizelimit unlimited # TLS Stuff TLSCACertificateFile /etc/ssl/certs/ca.pem TLSCertificateKeyFile /etc/ldap/openldap.key TLSCertificateFile /etc/ldap/openldap.crt # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 2 # Specific Backend Directives for hdb: backend hdb # Specific Directives for database: accesslog database hdb directory "/var/lib/accesslog" suffix "cn=accesslog" checkpoint 512 30 rootdn "cn=accesslog" rootpw ... index default eq index reqStart eq index reqType eq dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 # Specific Directives for database: data database hdb directory "/var/lib/ldap" overlay smbk5pwd overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logold (objectClass=posixAccount) logpurge 07+00:00 01+00:00 suffix ... rootdn ... rootpw ... dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 # Indexing options for database #1 index default eq index objectClass eq index uidNumber pres,eq index uid eq smbk5pwd-enable krb5 smbk5pwd-enable samba smbk5pwd-must-change 2592000 password-hash {K5KEY} # lastmod on # The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the # admin entry below # These access lines apply to database #1 only access to attrs=userPassword,shadowLastChange filter="(memberOf=Archiv)" by peername.ip=192.168.222.17 auth stop by peername.regex=.* none break access to dn.base="..." by * read access to attrs=userPassword,shadowLastChange filter="(!(memberOf=Archiv))" by peername.ip=192.168.222.17 none stop by peername.regex=.* none break # this rule is more specific than the admin rule below access to attrs=userPassword,shadowLastChange by set="user/memberOf & [Administratoren]" write by dn="cn=admin,..." write by anonymous auth by self write by * none # Ensure read access to the base for things like # supportedSASLMechanisms. Without this you may # have problems with SASL not knowing what # mechanisms are available and the like. # Note that this is covered by the 'access to *' # ACL below too but if you change that as people # are wont to do you'll still need this if you # want SASL (and possible other things) to work # happily. access to dn.base="" by * read # The admin dn has full write access, everyone else # can read everything. # be sure to include the admins in the previous, more specific rule access to * by set="user/memberOf & [Administratoren]" write by dn="cn=admin,..." write by * read access to dn.subtree="ou=Benutzer,..." by sockurl="ldapi:///" write authz-regexp "gidNumber=0\\\+uidNumber=0,cn=peercred,cn=external,cn=auth" "cn=admin,..." ----------------------------------------------------8< Starting slapd with the command: slapd -d 16383 produces the following output: >8--------------------------------------------------- ... ... >>> dnPrettyNormal: <cn=accesslog> => ldap_bv2dn(cn=accesslog,0) <= ldap_bv2dn(cn=accesslog)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=accesslog)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=accesslog)=0 <<< dnPrettyNormal: <cn=accesslog>, <cn=accesslog> line 65 (rootpw ***) line 66 (index default eq) line 67 (index reqStart eq) index reqStart 0x0004 line 68 (index reqType eq) index reqType 0x0004 line 69 (dbconfig set_cachesize 0 2097152 0) line 70 (dbconfig set_lk_max_objects 1500) line 71 (dbconfig set_lk_max_locks 1500) line 72 (dbconfig set_lk_max_lockers 1500) line 75 (database hdb) hdb_db_init: Initializing HDB database line 76 (directory "/var/lib/ldap") line 78 (overlay smbk5pwd) line 80 (overlay accesslog) line 81 (logdb cn=accesslog) >>> dnPrettyNormal: <cn=accesslog> => ldap_bv2dn(cn=accesslog,0) <= ldap_bv2dn(cn=accesslog)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=accesslog)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=accesslog)=0 <<< dnPrettyNormal: <cn=accesslog>, <cn=accesslog> line 82 (logops writes) line 83 (logsuccess TRUE) line 85 (logpurge 07+00:00 01+00:00) Speicherzugriffsfehler ----------------------------------------------------8< If the logpurge-option is uncommented, slapd starts without any problems. It would be very nice if someone could help us ! Greetings Julian ___________________________________________________________ Telefonate ohne weitere Kosten vom PC zum PC: http://messenger.yahoo.de

3 3

Kerberos and LDAP
by Howard Chu 30 Sep '09

30 Sep '09

For those interested, I've been invited to speak at the Kerberos Conference at MIT on October 21. I'll be giving a talk on using Kerberos with LDAP, showing walkthroughs of the schema and using an LDAP backend for the KDC. http://www.kerberos.org/events/2009conf/ -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

PHP: issues managing the password, what is wrong?
by Alberto Moreno 30 Sep '09

30 Sep '09

Hi people, I doing a web interface that will request a username + password, like squirrelmail i will contact my ldap server, this app will run on Centos 5.3, php 5.3, this will be where my web pages will be, the ldap server is running on Gentoo with ldap 2.3.43. My current problem is with the password, I have found small app that wants to compare the input of the password vs the ldap password this will let us identify the user. Well searching aroun, I found the crypt function but there is a thing that I don't like it: "The standard DES-based encryption crypt() returns the salt as the first two characters of the output. It also only uses the first eight characters of str , so longer strings that start with the same eight characters will generate the same result (when the same salt is used)" How can I deal with this note: 8 characters only? Some users have more than that, this is my code: $cryptedpassword='{crypt}74boAULE9gF5.'; if( preg_match( "/{([^}]+)}(.*)/", $cryptedpassword, $cypher ) ) { $cryptedpassword = $cypher[2]; $_cypher = strtolower($cypher[1]); } else { $_cypher = NULL; } if( preg_match("/^\\$2+/",$cryptedpassword ) ) { // make sure that web server supports blowfish crypt if( ! defined( 'CRYPT_BLOWFISH' ) || CRYPT_BLOWFISH == 0 ) pla_error( _('Your system crypt library does not support blowfish encryption.') ); list(,$version,$rounds,$salt_hash) = explode('$',$cryptedpassword); if( crypt( $plainpassword, '$'. $version . '$' . $rounds . '$' .$salt_hash ) == $cryptedpassword ) return true; else return false; } elseif( strstr( $cryptedpassword, '$1$' ) ) { if( ! defined( 'CRYPT_MD5' ) || CRYPT_MD5 == 0 ) pla_error( _('Your system crypt library does not support md5crypt encryption.') ); list(,$type,$salt,$hash) = explode('$',$cryptedpassword); if( crypt( $plainpassword, '$1$' .$salt ) == $cryptedpassword ) return true; else return false; } elseif (strstr( $cryptedpassword, '_' ) ) { if ( ! defined( 'CRYPT_EXT_DES' ) || CRYPT_EXT_DES == 0 ) pla_error( _('Your system crypt library does not support extended DES encryption.') ); echo crypt($plainpassword, $cryptedpassword ); if( crypt($plainpassword, $cryptedpassword ) == $cryptedpassword ) return true; else return false; } else { if( crypt($plainpassword $cryptedpassword ) == $cryptedpassword) return true; else return false; } The issue is the 8 character limitation, even If i have a password of 10 characters, the function will just take 8, how can I deal with this issue? Thanks for your time my firiends!!! -- LIving the dream...

6 10

Transfer LDAP Database to an other Server
by Manfred werner 30 Sep '09

30 Sep '09

Hello List, I must transfer my Ldap Dirtetory to a new Server with an oher Main Domanin. At first I save LDAP at my Old-server with slapcat -l originaldata.ldif then I´ve copy the *.ldif to my new server next I edit the *.ldif an change all entres "OldDomain" to "NewDomain". alt last I want to restore the *.ldif with slapadd -l newdata.ldif now I get foe following Errorcode: Testserver:/dasi # slapadd -l newdatea.ldif bdb_db_open: Warning - No DB_CONFIG file found in directory /var/lib/ldap: (2) Expect poor performance for suffix dc=NewDomain,dc=de. the line 245 is an emty line ?? Thank you for your help Manfred

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical