openldap-technical

openldap-technical@openldap.org

9 participants
9876 discussions

LDAP user cannot login
by Richard Gillman 01 Jul '09

01 Jul '09

Hi, I'm moving an LDAP server from one system to another. Data I copied using slapcat -l ldapdata; slapadd -c -q -l ldapdata on new system, then start ldap. But I can't log in as an ordinary user. I've tried resetting the user password using JXplorer, but no luck. Can anyone spot something wrong in what I'm trying to do? Suggestions appreciated. thanks in advance, Dick slapd.conf contains access to dn.subtree="dc=nerc-sf,dc=ac,dc=uk" attrs=userPassword by anonymous auth by self write by dn.exact="cn=replica,ou=admins,dc=nerc-sf,dc=ac,dc=uk" read by dn.exact="cn=proxyagent,ou=profile,dc=nerc-sf,dc=ac,dc=uk" read slapd -d acl gives at startup (#) $OpenLDAP: slapd 2.3.43 (Jan 21 2009 03:59:37) $ mockbuild@builder10.centos.org:/builddir/build/BUILD/openldap-2.3.43/openldap-2.3.43/build-servers/servers/slapd Backend ACL: access to attrs=SambaLMPassword,SambaNTPassword by dn.base="cn=manager,dc=nerc-sf,dc=ac,dc=uk" write by * none Backend ACL: access to dn.base="" by * read Backend ACL: access to dn.base="cn=subschema" by * read Backend ACL: access to dn.subtree="dc=nerc-sf,dc=ac,dc=uk" attrs=userPassword by anonymous auth by self write by dn.base="cn=replica,ou=admins,dc=nerc-sf,dc=ac,dc=uk" read by dn.base="cn=proxyagent,ou=profile,dc=nerc-sf,dc=ac,dc=uk" read Backend ACL: access to dn.subtree="dc=nerc-sf,dc=ac,dc=uk" attrs=userPassword,sambaLMPassword,sambaNTPassword by anonymous auth by self write by dn.base="cn=replica,ou=admins,dc=nerc-sf,dc=ac,dc=uk" read by dn.base="cn=proxyagent,ou=profile,dc=nerc-sf,dc=ac,dc=uk" read Backend ACL: access to dn.subtree="ou=admins,dc=nerc-sf,dc=ac,dc=uk" by dn.regex="cn=[^,]+,ou=admins,dc=nerc-sf,dc=ac,dc=uk" read by anonymous auth Backend ACL: access to dn.subtree="dc=nerc-sf,dc=ac,dc=uk" by peername.ip="192.171.172.0%255.255.255.0" read by peername.ip="192.171.159.192%255.255.255.192" read by peername.ip="127.0.0.1" read => bdb_entry_get: found entry: "dc=nerc-sf,dc=ac,dc=uk" => access_allowed: search access to "uid=susa,ou=people,dc=nerc-sf,dc=ac,dc=uk" "entryCSN" requested <= root access granted slapd starting When I try to login, slapd gives => access_allowed: read access to "uid=susa,ou=people,dc=nerc-sf,dc=ac,dc=uk" "userPassword" requested => dn: [1] dc=nerc-sf,dc=ac,dc=uk => acl_get: [1] matched => acl_get: [1] attr userPassword access_allowed: no res from state (userPassword) => acl_mask: access to entry "uid=susa,ou=people,dc=nerc-sf,dc=ac,dc=uk", attr "userPassword" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: anonymous <= acl_mask: [1] applying auth(=xd) (stop) <= acl_mask: [1] mask: auth(=xd) => access_allowed: read access denied by auth(=xd) send_search_entry: conn 1 access to attribute userPassword, value #0 not allowed -- Richard Gillman ITC UNIX Systems Group, Maclean Building, Wallingford OX10 8BB Tel: 01491 - 692 339 Fax: 01491 - 692 424

1 0

RE: MirrorMode VS load balancing
by Brett Maxfield 30 Jun '09

30 Jun '09

Yes simple is a good thing, but you have to decide for yourself what risk and downtime is acceptable, how long to recover and how many writes is acceptable to lose. E.g. Is a one daily backup acceptable for recovery (and you lose changes since then), or do you need every single write to the hour/minute ? The more continously/frequently you write to both nodes, the more likely are sync errors, and also less recoverability of your bdb logs in the event of catastrophic power failure or inproper shutdown. I dont think anyone can decide this for you.. You need to evaluate your level of risk and what loss / downtime is acceptable to you / your employer / your customers etc., Cheers Brett -----Original Message----- From: Hideo NAKAMITSU <nomo(a)bluecoara.net> Sent: Monday, 29 June 2009 11:51 AM To: openldap-technical(a)openldap.org Subject: Re: MirrorMode VS load balancing and how about 1write/sec, 10writes/sec, 50writes/sec, 100writes/sec... I want to know this threshold like, - if writes happen 0-5/sec, it's 99% safe (at the worst unlucky case, only 2writes at the same time may break something) - 6-50/sec, may safe or not. - more than 50/sec, danger.

5 4

ppolicy and syncrepl aclaration
by Jordi Espasa Clofent 30 Jun '09

30 Jun '09

Hi, According to http://www.openldap.org/lists/openldap-software/200701/msg00149.html, the "In general, ppolicy related state values are not replicated; each replica is on its own as far as state-related attributes in enforcing password policy." ¿Is it means that of I've one provider and two consumers, the changes made in ppolicy statements in provider are not sync againt the consumers as other kind entries/attributes are? I need to know because of I've change my userPassword in provider and: * I can use without problems the new password using the provider * I cannot use the new password against the two consumers. I use LVS balancer in front of the 3 openldap servers (one provider and two consumers), so it's important that ANY change made in provider will be always synced. -- Thanks, Jordi Espasa Clofent

3 5

openldap+sasl confusion
by Seau Yeen Su 29 Jun '09

29 Jun '09

Hi, I am trying to install OpenLdap with SASL. The version of openldap i installed is openldap-2.4.16 whereas the cyrus-sasl version installed is cyrus-sasl-2.1.23. The BerkeleyDB version installed is 4.4. I followed the guidance in this link to do the installation : http://tldp.org/HOWTO/LDAP-HOWTO/sasl.html However, when i tried to add users defined in ldif file, I received ldap_sasl_interactive_bind_s: Invalid credentials (49) error when i keyed in the password generated for admin using saslpasswd2 command. I have a few questions: 1. After using saslpasswd2 to create the username and password in sasl database, do i need to add the entry into ldap database with slappasswd command? When i used slapadd command and it prompts for password, does it authenticate against sasl database or ldap database? 2. Do i need to issue saslpasswd2 for each and every user that i want to add into ldap database and to be authenticated via ldap? 3. In the slapd.conf file, under rootpw, am i supposed to use the word "secret" or the cleartext password that i keyed in using saslpasswd2 or some encrypted password? 4. What is the difference between sasl-regexp and authz-regexp? 5. Let's say i issued saslpasswd2 -c admin to create admin as the LDAP administrator. Does this mean in the slapd.conf, the rootdn should be admin or can it be another name, that will be mapped via sasl-regexp/authz-regexp? (Which does it use anyway between these 2 : sasl-regexp & authz-regexp?) 6. Previously I set up without sasl and it was rather straightforward, merely using slappasswd and save the encyrpted pasword into slapd.conf. Now, i am totally lost with its concept. I do know that names in ldap database has to be mapped to the names in sasl database. Hopefully you can enlighten me on the whole concept and how the configuration should be done. Thank you. Hope to receive some advice and guidance. -- Warmest Regards, Seau Yeen

3 5

MirrorMode VS load balancing
by Hideo NAKAMITSU 29 Jun '09

29 Jun '09

Guys, I've already read this, and understand the difference between MirrorMode and Multi Master. http://www.openldap.org/doc/admin24/replication.html Actually, when I setup 2-nodes MirrorMode and add too much entries to both nodes, at the same time, sometimes both databases weren't syncrhonized correctly. (I made a script to add 10,000 entries, and run it on both nodes at the same time.) In this case, we shouldn't update both nodes at the same time. and of course this is already discribed in the document as following. -------------------------------------------------------- MirrorMode is not what is termed as a Multi-Master solution. This is because writes have to go to just one of the mirror nodes at a time -------------------------------------------------------- but on some cases(including my environment), UPDATE happens 3-10 times in a day. it's much less than SEARCH. in this case, I think we can just put loadbalancer, and enable "load balancing" and "redundancy" (I understand UPDATE isn't load balanced.) -------------------------------------------------------- CLIENT | SLB(RoundRobin) | +-----+ SRV1 SRV2 * MirrorMode is enabled on SRV1 and SRV2 -------------------------------------------------------- My question is, MirrorMode document says "writes have to go to just one of the mirror nodes at a time." but if the writes don't happen very often, I think "writes can be done on every nodes at a time." When I did some tests, it could be done. but I'm not sure developer's thoughts. How do you think guys ?

5 9

Re: Case Ignore Ordering matching rule for IA5 String sysntax ?
by masarati＠aero.polimi.it 29 Jun '09

29 Jun '09

> Hi ! > > We are trying to define (in our own ldap schema) an IA5String attribute > type that > is required to be managed (from our ldap clients) as "case insensitive" > > "greaterOrEqual" and "lessOrEqual" filters are required to be managed > over this > attribute, so we wanted to assigne (in its attribute type definition) an > ORDERING > matching requesting "case insensitive" behaviour > > According to RFC4517 (http://tools.ietf.org/html/rfc4517) there is NO > any > ordering Matching Rule for IA5String syntax AND case insensitive support. > We > tried with the "caseIgnoreOrderingMatch" .. but slapd returns and error > (at schema > loading) as attribute type syntax (IA5String) is not allowed for this > "ordering match rule" Correct. > We checked that defining the attribute as "PrintableString" works (as > "caseIgnoreOrderingMatch" > is a valid matching rule for that sysntax according to RFC4517) ... but we > are really interested in > IA5String syntax .... > > Does openLDAP server technolgy provide a "case insensitive ordering > match" method > for IA5String syntax ? No. It doesn't because there's no standard track definition for it. However, there's nothing preventing OpenLDAP software from supporting this non-standard track feature. Adding custom matching rules is relatively "trivial". p.

2 2

ldappasswd use for admin
by Gustavo Mendes de Carvalho 28 Jun '09

28 Jun '09

Hi there, Does anybody know which parameters to use in ldappasswd command when admin user (cn=admin,dc=domain,dc=com) has to reset user's password ? The situation is: LDAP user forgot his/her password and LDAP Admin has to reset it, allowing his/her to login and then to change his/her password. Thanks in advance --- Gustvo Mendes de Carvalho email: gmcarvalho(a)gmail.com

3 2

monitor mirror mode
by François Mehault 26 Jun '09

26 Jun '09

Hi all I use 2 openldap with mirror mode replication. And in fact I want to monitor both with Nagios. I want to be sure that replication works, So I ask myself if there is some numerous version on each OpenLDAP that I could check if they are equal. This value would be update after each replication. Something like that exist ? Or, how can I monitor the replication ? If you have some lead, I am interested. Thanks for your help Have a good week end. François

2 1

RE: Case Ignore Ordering matching rule for IA5 String sysntax ?
by masarati＠aero.polimi.it 26 Jun '09

26 Jun '09

> Hi ! > > OK ... we will check that approach. > > Do you know if it was something forgotten in the RFC4517 ?... it > sounds > really odd (to me) that PrintableString (that is a subset of IA5String) > and DirectoryString (that is a superset) are allowed syntaxis for > "caseIgnoreOrderingMatch" ... but IA5String is not allowed to use it > (maybe I am missunderstanding/mixing things ....???) I do not recall in detail, but this or something related should have already been discussed (I'd let others step in if they know the story in more detail). Basically, it should be something like the caseIgnore stuff for IA5 was absent in the RFC 225* series, and it was not added to the RFC 451* series because IA5 is essentially obsolete, directoryString should be used instead. p.

5 4

ldap auth from external application
by Zdenek Styblik 26 Jun '09

26 Jun '09

Hi, I'd like to ask why is auth from external applications like eg. ftp server done via proxy user, and not straight with user provided credentials. The only thing I came up with is that there is possible risk with hi-jacking session due to flaw in application, still- I'm missing the big picture here. Or return code 49 is not enough for failed auth? Could somebody, please, clarify this for me? I'm sure there are really good reasons no to so (straight auth), still I've "found" pros in not having additional user which is capable to read others (even hashed) passwords, and probably no need to be password hash dependent as whole auth would be LDAPs domain. Thanks, Zdenek -- Zdenek Styblik Net/Linux admin OS TurnovFree.net email: stybla(a)turnovfree.net jabber: stybla(a)jabber.turnovfree.net

2 6

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical