openldap-technical

openldap-technical@openldap.org

1 participants
9898 discussions

OpenLDAP Scaling
by Brian Zuromski 13 Oct '09

13 Oct '09

HI, I'm trying to scale out a openldap server deployment to serve around 100K users. I plan on having a master server and using syncrepl to create slaves that sit behind a load-balancer. Is there a good rule of thumb to abide by when creating a scenario like this? How many authentications/sec can a server typically handle? I've seen the benchmark comparisons ( http://www.usenix.org/event/lisa07/htgr_files/chu.pdf) that have been posted by Howard, but it doesn't say what the system specs were that the tests were performed on? I will have pretty beefy systems to use (lots of RAM and CPU)... Thanks!!

2 4

Question about using openLDAP with TLS
by Bryan Boone 13 Oct '09

13 Oct '09

Hi everyone, I had a question about the TLS/SSL side of openLDAP. I would like to create a C program that runs on a computer that uses LDAP as one of its login methods. Of course I would need to use SSL or Kerberos for secure login. My knowledge of SSL is small so forgive me. My question is, when I have an administrator login to this program just after installation and he/she sets up the LDAP parameters along with the option for TLS LDAP, he/she should obtain an SSL ticket from the LDAP server right? The admin should be prompted by the program once to accept or reject the SSL ticket right? Where is this ticket stored on the client computer? Can I keep this ticket so that the user logging in doesn't have to accept the ticket every single time they log in? Only when the administrator changes LDAP servers is when he/she would need to accept a new SSL ticket. Am I on the right track? Or do I completely have the wrong idea on how LDAP with TLS works? thanks

1 0

posible problema pam_group openldap pendrive -flash USB-
by Guillermo Lengemann 13 Oct '09

13 Oct '09

Greetings Comrades, I installed an environment where customers (Debian GNU/Linux lenny) authenticate against a data directory (openldap 2.4.x on Debian GNU/Linux lenny). But there is a problem trying to mount the pendrive It configure the /etc/pam.d/common-auth as follows: auth required pam_group.so auth sufficient pam_unix.so nullok_secure auth required pam_ldap.so try_first_pass and the configuration file /etc/security/group.conf: *;*;*;Al0000-2359;netdev,plugdev,powerdev,scanner,video,audio,floppy,cdrom,dialout The problem is when you try to mount a pendrive from the graphical environment (gnome) and results in the following error. /***************** No se Puede montar el volumen Error org.freedesktop.DBus.Error.AccessDenied Rejected send message, 3 matched rules; type="method_call", sender=":1.33"(uid=100055 pid=3578) comm="/usr/bin/gnome-mount --hal-udi=/org/freedesktop/Ha" interface="org.freedesktop.Hal.Device.Volume" menber="Mount" error name"(unset)" requested_reply=0 destination="org.freedesktop.Hal" (uid=0 pid=3044 comm="/usr/sbin/hald")) ***********************/ I checked the log and not succeeded in finding the error, pam_group may be causing the problem?. Thanks for your help. -- -------------------- Guillermo Lengemann FSF miembro # 7510 --------------------

1 0

Re: TLS CA Chain Problem
by Iruwen 13 Oct '09

13 Oct '09

Brett @Google schrieb: > Have a look at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=517188 > Openldap in Lenny is linked against GNUtls instead of openssl. GNUtls doesn't support the > > TLS_CACERTDIR configuration option, so we have to use TLS_CACERT to specify a file with > trusted CA certificates. > > GNUtls is not the same as openssl, if you are affected by this bug > then it will only load the first cert. > > Cheers > Brett I just noticed that I can remove the CA related directives and copy alle required intermediate certificates and the root certificate directly into the key file to build the trust chain. Problem solved. Thanks for pushing my research into the right direction!

1 0

Re: TLS CA Chain Problem
by Iruwen 13 Oct '09

13 Oct '09

Brett @Google schrieb: > Have a look at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=517188 > Openldap in Lenny is linked against GNUtls instead of openssl. GNUtls doesn't support the > > TLS_CACERTDIR configuration option, so we have to use TLS_CACERT to specify a file with > trusted CA certificates. > > GNUtls is not the same as openssl, if you are affected by this bug > then it will only load the first cert. > > Cheers > Brett Yes this seems to affect me too. So I'll have to recompile against openssl I guess. I can live with that. Thanks!

1 0

Re: TLS CA Chain Problem
by Iruwen 13 Oct '09

13 Oct '09

Brett Maxfield schrieb: > >> I just got an SSL certificate issued by Comodo which doesn't work as >> expected with slapd. >> Which means I get an untrusted certificate warning in Thunderbird. >> Probably I just missed something. > > I'll ask the question, why would the trust chain in slapd affect > thunderbird? > > What thunderbird considers trusted will be up to thunderbird itself, > or the underlying OS. > > Cheers > Brett Isn't that what the certificate chain in TLSCACertificateFile (or the corresponding directives in Apache, Postfix and so on) is good for? To build the trust chain from the issued certificate up to the trusted root certificate via intermediate certificates? If it was a problem of the underlying OS, shouldn't openssl s_client -connect localhost:<port> show exactly the same results for all services?

1 0

TLS CA Chain Problem
by Iruwen 13 Oct '09

13 Oct '09

Hello, I just got an SSL certificate issued by Comodo which doesn't work as expected with slapd. Which means I get an untrusted certificate warning in Thunderbird. Probably I just missed something. For Apache2 for example, I just configured SSLCACertificateFile mycert.ca-bundle SSLCertificateFile mycert.crt SSLCertificateKeyFile mycert.key and I don't get any warnings in Firefox. Also if I test the connection using openssl s_client it looks fine: office:~# openssl s_client -connect localhost:443 CONNECTED(00000003) depth=3 /C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root verify error:num=19:self signed certificate in certificate chain verify return:0 --- Certificate chain 0 s:/OU=Domain Control Validated/OU=PositiveSSL/CN=mydomain.de i:/C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=PositiveSSL CA 1 s:/C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=PositiveSSL CA i:/C=US/ST=UT/L=Salt Lake City/O=The USERTRUST Network/OU=http://www.usertrust.com/CN=UTN-USERFirst-Hardware 2 s:/C=US/ST=UT/L=Salt Lake City/O=The USERTRUST Network/OU=http://www.usertrust.com/CN=UTN-USERFirst-Hardware i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root 3 s:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root To achieve the same with OpenLDAP, I tried: TLSCACertificateFile mycert.ca-bundle TLSCertificateFile mycert.crt TLSCertificateKeyFile mycert.key But the result is different, Thunderbird doesn't trust the certificate and throws a corresponding warning and the output of openssl s_client looks like this: office:~# openssl s_client -connect localhost:636 CONNECTED(00000003) depth=0 /OU=Domain Control Validated/OU=PositiveSSL/CN=mydomain.de verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 /OU=Domain Control Validated/OU=PositiveSSL/CN=mydomain.de verify error:num=27:certificate not trusted verify return:1 depth=0 /OU=Domain Control Validated/OU=PositiveSSL/CN=mydomain.de verify error:num=21:unable to verify the first certificate verify return:1 --- Certificate chain 0 s:/OU=Domain Control Validated/OU=PositiveSSL/CN=mydomain.de i:/C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=PositiveSSL CA Seems like the ca-bundle wouldn't be used at all, does slapd expect a different format or something? Maybe someone could shed some light on this for me, thanks a lot in advance. Regards, Iruwen

3 6

ACL construction : by group
by Florian Götz 08 Oct '09

08 Oct '09

Hi everybody, I´m trying to write some admintool for my ldap in php. Changes to entries of other people should only be possible by members of the group "Domain Admins" So I wrote some phpcode which checks if the provided username (via Webbrowser) is a member of "Domain Admins" "Domain Admins" is created by samba and a normal posixGroup/sambaGroupMapping. All members of the group are listed via "memberUid". But at the same time there is a LDAP ACL used like this: access to dn.subtree="ou=Groups,dc=example,dc=de" by group="cn=Domain Admins,ou=groups,dc=example,dc=de" write by dn="uid=backup,ou=users,dc=example,dc=de" read by users none by * none A internal policy prohibits normal users access to the Groups subtree. I added the "by group" line, but then realised that it can not work this way. A usersearch like "search if memberUid=x is member of "Domain Admins" needs the rights for a search in ou=groups. But the only stored attribute per users is the memberUid, not the complete DN. The DN of a possible user is something like "uid=x,ou=users,dc=example,dc=de" Is there a possibility to use the existing "Domain Admins" group for user authentication, even if there are only memberUids stored and not complete dn? I don´t want to add all Domain Admins to the ACL above one by one. A change in the members would also lead to a change in the ACl if it would be done this way. Best regards, Florian Götz ---------------------------------------------------------------------------------------- Dipl.-Inf. (FH) Florian Götz Rechenzentrum Hochschule Mannheim Paul-Wittsack-Straße 10 68163 Mannheim Tel: 0621/292-6232 EMail: f.goetz(a)hs-mannheim.de Internet: http://www.rz.hs-mannheim.de -----

2 1

Validation of data in OpenLDAP
by David Horat 07 Oct '09

07 Oct '09

Dear OpenLDAP experts, I would like to know if there is any possibility of plug in a script before any transaction is commited into LDAP in order to validate and sanitise the input, giving an error and not letting the data get into OpenLDAP if the scripts decides the data is not valid. I have already taking a look at the Overlays presented in the documentation, but they won't solve what I am looking for exactly. Best Regards, David Horat -- David Horat Software Engineer – IT/GD – Grid Deployment Group CERN – European Organization for Nuclear Research » Where the web was born Address: 1211 Geneva - Switzerland, Office: 28/R-003 Phone +41 22 76 77996 Fax +41 22 76 68178 (fax to email service) Web: http://cern.ch/horat Web: http://davidhorat.com/ Profile: http://linkedin.com/in/davidhorat

2 1

Re: Importing user defined Object Classes from a file
by Parag Kalra 06 Oct '09

06 Oct '09

Hi Bharath, Thanks for the info you shared. Using that I have successfully imported the user defined object classes from a ldif file. Thanks once again... Cheers, Parag On Mon, Oct 5, 2009 at 5:20 PM, Kantrapati, Bharath < bharath.kantrapati(a)gs.com> wrote: > Hi Parag, > > > > You can import user defined object class using ldif file. > > The below link might be helpful > > > > http://docs.sun.com/source/816-6699-10/schemaov.html > > > > if you check the 99user.ldif it will show you how the current schema is > holding the object class. You can build the ldif file the same way and > import into sun one directory server. > > > > Note : I have taken off the open ldap mailing list, not sure if they would > be OK . > > > > Regards > > Bharath > > > > > > *From:* openldap-technical-bounces+bharath.kantrapati=gs.com(a)OpenLDAP.org > [mailto:openldap-technical-bounces+bharath.kantrapati<openldap-technical-bounces%2Bbharath.kantrapati> > =gs.com(a)OpenLDAP.org] *On Behalf Of *Parag Kalra > *Sent:* Monday, October 05, 2009 5:13 PM > *To:* openldap-technical(a)openldap.org > *Subject:* Importing user defined Object Classes from a file > > > > Hello Folks, > > Note: This question is on SunOne LDAP server. I apologize for posting it > here but I thought someone might know the solution hence sharing with you > all. > > I have a file which contains the schema related settings where in user > defined object classes are defined. > > I know SunOne directory server provides a way to create user defined object > classes but is there a way where I can import my entire file which will > create & define all the user defined settings mentioned in that file. > > I am using Sun One Server Console 5.2 > > Thanks in advance. > > Cheers, > Parag > >

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical