openldap-technical

openldap-technical@openldap.org

9897 discussions

TLS certificates
by Matthew Edlefsen 13 Jun '09

13 Jun '09

Hello, I'm trying to get TLS setup with openldap and am having some issues. I have a CA signed certificate (not self-signed) and have created a chain with my CA cert and the root CA cert. I've verified that it works with openssl verify -CAfile on both the client and server but then when I try to connect using ldaps I get the following error on the client: TLS certificate verification: depth: 2, err: 19, subject: /C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root, issuer: /C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root TLS certificate verification: Error, self signed certificate in certificate chain TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. I assume it's saying that the root CA is self signed, but if I don't include it in the chain it says it can't trust the CA. Anybody have any ideas? Thanks, Matt Edlefsen Earlham Computing Services

2 1

Re: OpenLDAP and AD integration
by Santosh Balan 12 Jun '09

12 Jun '09

Hi, I didn't mean "urgent" and "expecting a reply" as a demanding request. However I would like a voluntary reply at the earliest so that I can go ahead with my work. Sorry for a demanding request, however would like your support and reply in current and future issues. Thanks and Regards, Santosh Balan _+91-9819419509 ----- Original Message ----- From: "Michael Ströder" To: "Santosh Balan" Cc: openldap-technical(a)openldap.org Subject: Re: OpenLDAP and AD integration Date: Fri, 12 Jun 2009 13:33:40 +0200 Santosh Balan wrote: > > I am newbee to this community and want to know how I can integrate an > OpenLdap Server with MS Active Directory. Such that I create a user in > LDAP it reflects in AD as well and vice-a-versa. Similarly any changes > should effect on both AD and LDAP. Also I want to know how this can be > done with a technical documentation. This is not possible just by OpenLDAP and AD server configuration. You need a custom sync process for that. There might be already some implementations available but most times they won't fit exactly your requirements. So I'd recommend to write your own custom script to do it. > Also a user incase AD is not available gets authenticated using LDAP > and vice-a-versa. Authenticated at which client component? E.g. it does not make sense to authenticate the user during Windows logon directly against the OpenLDAP user account since there's a bit more done during a Windows domain logon. > Your urgent help on this issue will be highly appreciated. Expecting a > reply from you at the earliest. Well, "urgent" and "expecting a reply" is a little bit demanding on a mailing list where volunteers are answering in their spare time. You might wanna hire a consultancy company: http://www.openldap.org/support/ Ciao, Michael. -- Be Yourself @ mail.com! Choose From 200+ Email Addresses Get a Free Account at www.mail.com

1 0

installation query
by ashok kumar 12 Jun '09

12 Jun '09

Hi, I am trying to install openldap 2.4.16 and bdb 4.7.25 on my CentOS linux OS 64bit. I was wondering that the setups available on websites use 32bit libraries or 64 bit libraries. If they use 32bit libraries by default then how do i make them use 64 bit libraries. Regards, Ashok Kumar

1 0

Translucent Proxy & Schemas
by Stéphane Jeanjean 12 Jun '09

12 Jun '09

Hello, I would like to know if it's possible to add a schema in the local database which is not in the remote one with Translucent Proxy. Is it possible to add objects in local database without adding the schema to the remote db ? It looks ok when the attributes of the new class are added to the entries in the local db but when a search request is done, only atttributes from the classes declared in the remote db are returned :( Thanks for your help, Stéphane

2 2

count the number of registered users in ldap
by KALPANA ANANTH 11 Jun '09

11 Jun '09

Hi , Is there any specific command to count the number of registered entries/users in ldapserver todate? This will help with us with the statitistics of how many users are registered? Thanks! Kalpana _________________________________________________________________ Windows Live™: Keep your life in sync. http://windowslive.com/explore?ocid=TXT_TAGLM_WL_BR_life_in_synch_062009

3 2

Chain overlay and ACLs
by John Kane 11 Jun '09

11 Jun '09

Noob question: I've set up chaining from my slave LDAP to the master. It seemed everything was working fine, until I realize that ANY user can now make modifications in the LDAP DB if it is done from the slave. My ALCs allow full write access to the chain binddn. If I don't set this, chaining fails. But with it set, any valid, authenticated user can make DB changes (full write access). I am confused as to why this is happening. Info is below. Thanks in advance, John Version: openldap-2.3.43 ACLs on master (and slave): # Who has access to read or change the password attribute access to attrs=userPassword,shadowLastChange by self write by dn.base="cn=tooladmin,o=partner_x,dc=example,dc=net" write by group.exact="cn=admin_partner_x,o=partner_x,dc=example,dc=net" write by group.exact="cn=admin_partner_x_RO,o=partner_x,dc=example,dc=net" read by group.exact="cn=administrators,o=mycompany,dc=example,dc=net" write by group.exact="cn=administrators_RO,o=mycompany,dc=example,dc=net" read by anonymous auth by * none # Keep partners out of mycompany db access to dn.sub="o=mycompany,dc=example,dc=net" by group.exact="cn=administrators,o=mycompany,dc=example,dc=net" write by group.exact="cn=administrators_RO,o=mycompany,dc=example,dc=net" read by dn.sub="o=partner_x,dc=example,dc=net" none by anonymous none by * none # Allow the tool access to add and modify ToolAccessLevel, etc access to filter="(|(objectClass=DiagnosticsPerson)(objectClass=ToolsAccess))" by dn.base="cn=tooladmin,o=partner_x,dc=example,dc=net" write by group.exact="cn=admin_partner_x,o=partner_x,dc=example,dc=net" write by group.exact="cn=admin_partner_x_RO,o=partner_x,dc=example,dc=net" read by group.exact="cn=administrators,o=mycompany,dc=example,dc=net" write by group.exact="cn=administrators_RO,o=mycompany,dc=example,dc=net" read by anonymous none by * read # Finally, allow the main LDAP users access to everything else access to * by group.exact="cn=admin_partner_x,o=partner_x,dc=example,dc=net" write by group.exact="cn=admin_partner_x_RO,o=partner_x,dc=example,dc=net" read by group.exact="cn=administrators,o=mycompany,dc=example,dc=net" write by group.exact="cn=administrators_RO,o=mycompany,dc=example,dc=net" read by anonymous none by * read And the LDIFs: # admin_partner_x, partner_x, example.net dn: cn=admin_partner_x,o=partner_x,dc=example,dc=net cn: admin_partner_x objectClass: groupOfNames description: Group of Admins with full access member: cn=ldapChain,o=partner_x,dc=example,dc=net member: cn=ldapEditor,o=partner_x,dc=example,dc=net # admin_partner_x_RO, partner_x, example.net dn: cn=admin_partner_x_RO,o=partner_x,dc=example,dc=net cn: admin_partner_x_RO objectClass: groupOfNames description: Group of Admins with readonly access member: cn=simpleBind,o=partner_x,dc=example,dc=net member: cn=syncRepl,o=partner_x,dc=example,dc=net # tooladmin, partner_x, example.net dn: cn=tooladmin,o=partner_x,dc=example,dc=net sn: tooladmin cn: tooladmin userPassword:: dG9vbGFkbWlu description: To allow access for tools. Per ACLs, this guy has write access to passwords and tool levels objectClass: person # jkane2, people, partner_x, example.net dn: uid=jkane2,ou=people,o=partner_x,dc=example,dc=net objectClass: person objectClass: posixAccount objectClass: DiagnosticsPerson objectClass: ToolsAccess cn: jkane2 loginShell: /bin/bash uidNumber: 3805 uid: jkane2 homeDirectory: /jkane2 sn: jkane2 gidNumber: 950 ToolAccessLevel: subinfo ToolDomain: example.net DiagAccessLevel: DIAG_USER_T1 DiagGroup: partner_x userPassword:: xxxxxxxxxxx From the master, using some arbitrary user: [jkane2@master]$ ldapadd -x -D 'uid=jkane2,ou=people,o=partner_x,dc=example,dc=net' -W <<EOF > dn: uid=testauserC,ou=people,o=partner_x,dc=example,dc=net > uid: testauserC > description: asdf > objectClass: account > objectClass: simpleSecurityObject > userPassword: testauser > EOF Enter LDAP Password: adding new entry "uid=testauserC,ou=people,o=partner_x,dc=example,dc=net" ldapadd: Insufficient access (50) additional info: no write access to parent From the slave: [jkane2@slave]$ ldapadd -x -D 'uid=jkane2,ou=people,o=partner_x,dc=example,dc=net' -W <<EOF > dn: uid=testauserC,ou=people,o=partner_x,dc=example,dc=net > uid: testauserC > description: asdf > objectClass: account > objectClass: simpleSecurityObject > userPassword: testauser > EOF Enter LDAP Password: adding new entry "uid=testauserC,ou=people,o=partner_x,dc=example,dc=net" [jkane2@slave]$ ldapsearch -x -D 'uid=jkane2,ou=people,o=partner_x,dc=example,dc=net' uid=testauserC -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <> with scope subtree # filter: uid=testauserC # requesting: ALL # # testauserC, people, partner_x, example.net dn: uid=testauserC,ou=people,o=partner_x,dc=example,dc=net uid: testauserC description: asdf objectClass: account objectClass: simpleSecurityObject # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

2 4

slapadd speed
by ashok kumar 11 Jun '09

11 Jun '09

Hi, I am new to openldap and I am trying to use it for 50 million records. I am using slapadd to add this data but it is processing around 1 million records in 5 hour. So this will take days to stage properly. I will have to update database every 20 days with about 10 million records. I wish to know what enhancements I have to do in my setup considering following configurations. I am using openldap 2.4.16 with Berkley DB 4.5.20 on CentOS linux OS 32 bit machine with 4GB RAM. slapd.conf : include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/xyz.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args backend bdb database bdb suffix "o=sgi,c=us" rootdn "o=sgi,c=us" checkpoint 128 15 rootpw xyz directory /usr/local/var/openldap-data index objectClass eq index attribute1 eq index attribute2 eq DBCONFIG: set_cachesize 1 268435456 1 set_flags DB_LOG_AUTOREMOVE Regards, Ashok Kumar

4 5

Re: hardware requirement
by Quanah Gibson-Mount 11 Jun '09

11 Jun '09

--On Thursday, June 11, 2009 9:19 PM +0530 mukim pathan <mukim.iitkgp(a)gmail.com> wrote: > I will be using latest openldap release with Berkley database. If 32 bit > is not capable of it then please tell me the resource requirement for 64 > bit. Keep replies on the list if you want answers. The technical limitations of 32-bit OSes are well documented. Since I have no idea how large your database is when fully loaded, I can not say for certain that you'll hit (or have hit) those limits, but I find it *highly* likely. In any case, in this day and age, there is really no excuse to be running 32-bit OSes. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

hardware requirement
by mukim pathan 11 Jun '09

11 Jun '09

Hi, I have to setup a database for storing 100million entries, each entry with 4 columns. I will be using centOS linux OS for this. I checked previous queries regarding hardware, I found that with 32 bit machine, processing might get slow for 20million above records. I want to ask what should be the hardware configuration for this? Thank you in advance. Regards, Mukim Pathan

2 1

some thoughts about RDN
by Paweł Madej 11 Jun '09

11 Jun '09

Hello, I have such RDN cn=user1,dc=example,dc=com but my webmail software knows users only by emails (which is attribute to cn=user1,dc=example,dc=com) My question is how can i authenticate in LDAP using provided email? I tried sth like mail=test(a)example.com,dc=example,dc=com but ldap refuses such login. Thanks in advance for help Greets Pawel

4 9

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical