openldap-technical

openldap-technical@openldap.org

1 participants
9898 discussions

PHP: issues managing the password, what is wrong?
by Alberto Moreno 30 Sep '09

30 Sep '09

Hi people, I doing a web interface that will request a username + password, like squirrelmail i will contact my ldap server, this app will run on Centos 5.3, php 5.3, this will be where my web pages will be, the ldap server is running on Gentoo with ldap 2.3.43. My current problem is with the password, I have found small app that wants to compare the input of the password vs the ldap password this will let us identify the user. Well searching aroun, I found the crypt function but there is a thing that I don't like it: "The standard DES-based encryption crypt() returns the salt as the first two characters of the output. It also only uses the first eight characters of str , so longer strings that start with the same eight characters will generate the same result (when the same salt is used)" How can I deal with this note: 8 characters only? Some users have more than that, this is my code: $cryptedpassword='{crypt}74boAULE9gF5.'; if( preg_match( "/{([^}]+)}(.*)/", $cryptedpassword, $cypher ) ) { $cryptedpassword = $cypher[2]; $_cypher = strtolower($cypher[1]); } else { $_cypher = NULL; } if( preg_match("/^\\$2+/",$cryptedpassword ) ) { // make sure that web server supports blowfish crypt if( ! defined( 'CRYPT_BLOWFISH' ) || CRYPT_BLOWFISH == 0 ) pla_error( _('Your system crypt library does not support blowfish encryption.') ); list(,$version,$rounds,$salt_hash) = explode('$',$cryptedpassword); if( crypt( $plainpassword, '$'. $version . '$' . $rounds . '$' .$salt_hash ) == $cryptedpassword ) return true; else return false; } elseif( strstr( $cryptedpassword, '$1$' ) ) { if( ! defined( 'CRYPT_MD5' ) || CRYPT_MD5 == 0 ) pla_error( _('Your system crypt library does not support md5crypt encryption.') ); list(,$type,$salt,$hash) = explode('$',$cryptedpassword); if( crypt( $plainpassword, '$1$' .$salt ) == $cryptedpassword ) return true; else return false; } elseif (strstr( $cryptedpassword, '_' ) ) { if ( ! defined( 'CRYPT_EXT_DES' ) || CRYPT_EXT_DES == 0 ) pla_error( _('Your system crypt library does not support extended DES encryption.') ); echo crypt($plainpassword, $cryptedpassword ); if( crypt($plainpassword, $cryptedpassword ) == $cryptedpassword ) return true; else return false; } else { if( crypt($plainpassword $cryptedpassword ) == $cryptedpassword) return true; else return false; } The issue is the 8 character limitation, even If i have a password of 10 characters, the function will just take 8, how can I deal with this issue? Thanks for your time my firiends!!! -- LIving the dream...

6 10

Transfer LDAP Database to an other Server
by Manfred werner 30 Sep '09

30 Sep '09

Hello List, I must transfer my Ldap Dirtetory to a new Server with an oher Main Domanin. At first I save LDAP at my Old-server with slapcat -l originaldata.ldif then I´ve copy the *.ldif to my new server next I edit the *.ldif an change all entres "OldDomain" to "NewDomain". alt last I want to restore the *.ldif with slapadd -l newdata.ldif now I get foe following Errorcode: Testserver:/dasi # slapadd -l newdatea.ldif bdb_db_open: Warning - No DB_CONFIG file found in directory /var/lib/ldap: (2) Expect poor performance for suffix dc=NewDomain,dc=de. the line 245 is an emty line ?? Thank you for your help Manfred

2 1

can i bind real entry by alias ?
by 何萍 30 Sep '09

30 Sep '09

i create two entry:dn: uid=real,o=test.com userPassword=xxxx .... dn:uid=alias,o=test.com objectClass: alias objectClass: extensibleObject aliasedObjectName: uid=real,o=test.com can i bind real entry by alias and real's userPassword ? if so, how to do?

4 4

Search filter for numbers
by Florian Götz 30 Sep '09

30 Sep '09

Hi everbody, I tried to create a dynamic group with dynlist and got a problem with a search filter. I searched the net for a solution, but found nothing that fits. I want to collect all people thet have a common attribute (attributA=X), but only people that have a uid that isn´t a number. We got people with uids similar to their last name (Meier, Müller, Schmidt) and Users that got a number as uid (123456). I tried a filter like: ldap:///ou=users,dc=example,dc=de?uid?sub?(&(attributeA=X)(!(uid=[0-9]*))) but that doesn´t work. A solution like: ldap:///ou=users,dc=example,dc=de?uid?sub?(&(attributeA=X)(!(uid=0*))(! (uid=1*))(!(uid=2*))(!(uid=3*)).....) works, but there must be a more elegant way to do this....right? Best regards, Florian Götz ---------------------------------------------------------------------------------------- Dipl.-Inf. (FH) Florian Götz Rechenzentrum Hochschule Mannheim Paul-Wittsack-Straße 10 68163 Mannheim Tel: 0621/292-6232 EMail: f.goetz(a)hs-mannheim.de Internet: http://www.rz.hs-mannheim.de -----

2 1

Unable to bind to active directory using TLS
by Harish Chakravarthy 29 Sep '09

29 Sep '09

Hello Everyone, Greetings. I am unable to bind to active directory using TLS. I get the following error while executing my script via the browser *PHP Warning: ldap_start_tls() [<a href='function.ldap-start-tls'>function.ldap-start-tls</a>]: Unable to start TLS: Connect error* The same script when executed from the command line works!. I have compiled PHP with flags --with-ldap --with-ldap-sasl --with-openssl . Can you help me further trouble shoot this problem?. Thanks Harish

2 6

slapo-rwm segfault
by Ralf Zimmermann 28 Sep '09

28 Sep '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, I have a problem with the slapo-rwm overlay. Here is my config: sizelimit=unlimited ... overlay rwm rwm-rewriteEngine on rwm-rewriteMap LDAP attr2dn "ldaps:///dc=domain,dc=local?dn?sub" rwm-rewriteContext bindDN rwm-rewriteRule "^(uid=(.*)+),(dc=dummy,dc=domain,dc=local)" "${attr2dn($1)}" ":@I" ... When I configure a fixed sizelimit < 9500 all runs fine. With a sizelimit=unlimited slapd crash with a segfault: Sep 28 14:31:44 ldap kernel: slapd[3734]: segfault at 0 ip b79a118a sp a1176d5c error 4 in libc-2.9.so[b792e000+155000] Is there a Problem with slapo-rwm and the number of fetched entries? The problem is replicable under SLES11 openldap 2.4.12 or a self compiled openldap 2.4.18 under Debian squeeze. Greets Ralf Zimmermann - -- .''`. Ralf Zimmermann : :' : Siegnetz.IT http://www.siegnetz.de `. `' Schneppenkauten 1a http://boardfreunde.de `- 57076 Siegen send no mail to garbage(a)siegnetz.de send no mail to garbage(a)boardfreunde.de Tel.: +49 271 68193 13 Fax.: +49 271 68193 29 Amtsgericht Siegen HRB4838 Geschaeftsfuehrer: Oliver Seitz Sitz der Gesellschaft ist Siegen -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkrAr4YACgkQqTAMJBAFqji9vQCfQWngaiz5L509wGwp+ftUcSzI RC4An2vBRqnm5JX/h7h7UmYc7XR0bcfZ =1Fdp -----END PGP SIGNATURE-----

1 0

Re: Unable to bind to active directory using TLS
by Zdenek Styblik 26 Sep '09

26 Sep '09

Harish Chakravarthy wrote: > Hello, > > Thanks for your response. > > "Can you please code I've attached?" - I don't see one in the email. > Secondly, my test script (command line & web) is not looking for ldap.conf. > > -Harish > Morning, I've checked the sent mail and it's there as an attachment. Well, here we go: --- SNIP --- <?php /* * [PHP] Code to test LDAP connection */ define('MYLDAP_HOST', 'ldap://localhost'); define('MYLDAP_PORT', 389); define('MYLDAP_BINDDN', 'cn=LDAPuser,dc=domain,dc=tld'); define('MYLDAP_PSWD', 'myPass'); define('MYLDAP_TLS', true); # buggy - don't use? # !-- some input var checks here --! $ldapConn = ldap_connect(MYLDAP_HOST, MYLDAP_PORT); if (!$ldapConn) { exit("Unable to connect to LDAP server"); } if (!ldap_set_option($ldapConn, LDAP_OPT_PROTOCOL_VERSION, 3)) { exit("Unable to set protocol version to v3"); } # buggy - don't use ? if (MYLDAP_TLS) { ldap_start_tls($ldapConn) or die("Can't start TLS"); } $ldapBind = ldap_bind($ldapConn, MYLDAP_BINDDN, MYLDAP_PSWD); if (!$ldapBind) { exit("LDAP Bind failed"); } echo "OK"; ldap_unbind($ldapConn); # aka ldap_close return 0; ?> --- SNIP --- Zdenek -- Zdenek Styblik Net/Linux admin OS TurnovFree.net email: stybla(a)turnovfree.net jabber: stybla(a)jabber.turnovfree.net > On Sat, Sep 26, 2009 at 12:33 AM, Zdenek Styblik <stybla(a)turnovfree.net > <mailto:stybla@turnovfree.net>> wrote: > > Harish Chakravarthy wrote: >> Here is more information >> 1. I am binding to Active Directory from Solaris 10 >> 2. My php_info gives configure options as './configure' >> '--prefix=/home/local/php-5.2.9' '--with-apxs2=/path/apache2/bin/apxs' >> '--with-ldap' '--with-ldap-sasl' '--with-openssl=/usr/local/ssl' >> '--with-mysql=/usr/local/mysql/' '--with-gd' >> 3. The PATH & LD_LIBRARY_PATH listed via php_info on the browser has >> exactly the same settings as my user account (that executes the script >> from command line) >> 4. I have a ldap.conf file inside /opt/csw/etc/openldap . However this >> file is not being used by the script (command line or web). I > rename the >> file and nothing changes!. >> 5. I have apache compiled for mod_ssl > >> Should I recompile Apache with mod_ldap or any additional modules - I >> using a PHP script on my webserver to gather login & password to >> authenticated against Active Directory?. > >> Thanks again for your time. > >> -Harish > > > > Hello, > > I'm sorry, I should have read better. I replied in haste and- > Can you please code I've attached? It should be sufficient just to > supply credentials. I've tested it and, although I can't make an LDAP > connection from console [I've messed something in PHP; ignore], it works > for me via WEB [I can see 'OK']. I'm not sure why I've put comments > about TLS being buggy [probably something in PHP documentation?], but > the code [PHP] works with LDAP TLS just fine. > > I don't think you need mod_ldap in Apache, as this one should serve for > direct interaction of httpd<-->LDAP [imao]. > > Let me know, > Zdenek >

1 0

Memberof overlay
by Kristian Berg 24 Sep '09

24 Sep '09

Hi I've shifted through the mailinglist archive in search of an answear to how one combines posixAccount with posixGroup for filtering, with the memberof overlay. The only answear I found, was that it wasn't possible. What I've tried was adding: overlay memberof memberof-group-oc posixGroup memberof-member-ad memberUid Which doesn't work. I get the following error message: /etc/openldap2.4/slapd.conf: line 173: member attribute="memberUid" must either have DN (1.3.6.1.4.1.1466.115.121.1.12) or nameUID (1.3.6.1.4.1.1466.115.121.1.34) syntax. According to earlier mailinglist posts, memberUid can't be used with memberof. The other solution that crossed my mind was adding a member-attribute in the posixGroup which is linked with the posixAccount dn, whenever I add a memberUid to the group. Although I haven't tested it yet, as my schema-fu is limited. This seems like the wrong approach though. What I want to do is using a ldap query filter to check if a posixAccount is member of a group with the same name as the server. Ie: retreiving all valid accounts for that particular server with (&(objectClass=posixAccount)(memberof=cn=servername,ou=group,dc=base)). This is with standard ldap on AIX as the client and openldap 2.4.18 as the server. Linux clients and hp-ux clients also connect to this ldap-server though, so the options regarding layout of the tree is limited. So may questions to you, dear internett mailinglist heroes, is: * Is there an easy way to combine posixAccount with posixGroup? * Is the hard way feasiable if not? * Are some of you using some better way of managing logins on aix with a ldap-server shared with operating system logins? -- Kristian Berg

1 0

Limiting finger lookup access on Linux
by Rex Roof 24 Sep '09

24 Sep '09

I have some linux machines that I have configured for student access. We are authenticating against our OpenLDAP tree and limiting which users have access via an LDAP groupOfNames. This is all working perfectly. This is the problem I am having. Any user with access to the system can run the /usr/bin/finger command and do a name search against our entire LDAP tree. I would like to limit the info available via finger to just the users that have access to any particular machine. How can this be controlled? -Rex

8 14

RE: LDAPCon slides
by Morteza Ansari 24 Sep '09

24 Sep '09

It indeed was a great conference, thanks for organizing it. On the embedded directory front, I will be even more impressed once you get your G1 to generate certs ;-) Cheers, Morteza -----Original Message----- From: openldap-technical-bounces+mansari=postpath.com(a)openldap.org [mailto:openldap-technical-bounces+mansari=postpath.com@openldap.org] On Behalf Of Howard Chu Sent: Wednesday, September 23, 2009 12:59 PM To: openldap-technical(a)openldap.org Subject: LDAPCon slides For those of you who weren't able to attend the conference, most of the submitted talks now have their slides/papers online on the web site. http://www.symas.com/ldapcon2009/papers.shtml You missed a lot of great discussions, and a live demo of probably the world's smallest LDAP server installation - OpenLDAP 2.4.18 running on my G1 phone, serving queries from Ludovic Poitou's iPhone address book. OpenLDAP doesn't just scale up to massive multi-processor deployments, it also works well at the smallest of scales. Even the "embedded directory" guys haven't gotten here yet... -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical