openldap-technical

openldap-technical@openldap.org

13 participants
9795 discussions

mirroring problem (unwilling to perform error)
by Hegedus Gabor 19 Mar '09

19 Mar '09

Hi all! I have a serious problem! I try to configure the ldap server mirroring mode, but something problem with this. Fist of all: I tested the mirroring on two openldap 2.4.11-0ubuntu6.1. and it worked fine. I just configured slapd.conf file like this: # Global section serverID 1 (another ldap is 2) moduleload syncprov overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncrepl rid=001 provider=ldap://192.168.1.2 type=refreshAndPersist interval=00:00:00:10 searchbase="dc=test,dc=hu" filter="(objectClass=*)" attrs="*" scope=sub schemachecking=off bindmethod=simple binddn="cn=admin,dc=test,dc=hu" credentials="test" retry="60 +" mirrormode on It was okay, when I modified the db1, the db2 modified too. BUT! I try to set up on version 2.3.30, I use the same configuration, the ldap starts good, but when i try to modify the db, the phpldapadmin shows this error: Could not perform ldap_modify operation. LDAP said: Server is unwilling to perform Error number: 0x35 (LDAP_UNWILLING_TO_PERFORM) Description: The LDAP server refused to perform the operation. What is the problem, what is missconfigured? please help, thank you! br Gabor

2 2

pam_ldap, libnss-ldap and different fields for authentication
by Florian MAURY 18 Mar '09

18 Mar '09

Hi, I'm currently working on an authentication system for my company and facing a problem using pam_ldap, and libnss_ldap. I want to configure pam to authenticate againt a field (let's call it AField) (e.g. a ssh session's authentication) and libnss to provide the content of another field (BField) if I run e.g. ls -l. I mean : # ssh AField-value(a)192.168.1.1 [...] # ls -l /tmp/test -rwx------ 1 BField-value root 1305 2009-03-18 14:11 test #whoami BField-value The goal is to permit login via AField, which will be a quite long name, and BField will ease the reading in my linux-box. Everything is working perfectly fine if I use the same field. (i.e. pam_login_attribute BField and nss_map_attribute uid BField) but if I try to set pam_login_attribute to AField and nss_map_attribute to "uid BField" the authentication process failed in an "Invalid credentials" error. Libnss works correctly since when I list (ls) a file created by an ldap user after logging in via a local user, the resolution works fine. Ls answers me the file is owned by {BField-value} user. Pam_ldap seems to understand it needs to look up to the AField since it bind anonymously, request the rdn of the user having AField equal to the login submitted, but when the binding is done with the rdn of the user, I've got the error. I tcpdump-ed the ldap trafic and discovered pam_ldap is requesting the binding without providing the password. In the packets, where the password (in clear for tests) should be, I can read "INCORRECT". Which is not my password at all =) Then, it's perfectly logical that openldap returns me "Invalid credentials". My question is : what can this INCORRECT mean ? A configuration error ? Is it just possible to do what I want to do ? When my authentication fails, I can rean in openldap log files : slap_global_control: unrecognized control: 1.3.6.1.4.1.42.2.27.8.5.1 When I'm using only the AField (or the BField) for the two options, I don't get this error :o/ I'm using Openldap 2.3.30-5+etch2, libpam-ldap 180-1.7 and libnss-ldap 251-7.5etch1 on Debian. Thank you in advance for your support. Regards, -- Florian MAURY

1 0

dbconfig
by Oliver Henriot 18 Mar '09

18 Mar '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear list members, I have a bdb database in openldap 2.3.27 on centos 5.2 in which I have defined, in the database section : dbconfig set_cachesize 0 268435456 1 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 dbconfig set_lg_regionmax 262144 dbconfig set_lg_bsize 2097152 I stop my server, clear /var/lib/ldap/*, slapadd my basic ldif entries (replication account, people and groups ou), chown everything to ldap:ldap and start openldap but I still get a warning : bdb_db_open: Warning - No DB_CONFIG file found in directory /var/lib/ldap - From what I read, I understood that the dbconfig directives created the DB_CONFIG file at startup if it wasn't present in the database directory. This doesn't seem to be working and I can't figure out why. Is there something obvious I'm missing out here? Thanks. - -- Oliver Henriot B.Sc. Ph.D. | Technicien de Maintenance Moyens Informatiques et Multimédia | UMS MI2S | http://mi2s.imag.fr/ Domaine universitaire BP53 | 38041 Grenoble cedex 9 | France tel.: +33 4 76 51 43 48 | fax: +33 4 76 51 47 15 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkm/wc0ACgkQSWuBJnHIHdLvJQCeJKiqBxahNvb65kPI91yTgmVS 1z4An2YprXc5nDcdyw6mm7UWf5yoN7Hp =QFKr -----END PGP SIGNATURE-----

1 1

PROBLEM SSL
by mario ramirez cervera 17 Mar '09

17 Mar '09

Hello again: I copied the certificates in slapd.con: TLSCipherSuite HIGH: MEDIUM: + sslv2: RSA TLSCACertificateFile / etc / ldap / slapd-certs / cacert.pem TLSCertificateFile / etc / ldap / slapd-certs / servercrt.pem TLSCertificateKeyFile / etc / ldap / slapd-certs / serverkey.pem and also writes: SLAPD_SERVICES = "ldap: / / / LDAPS :///" And start giving me the following error: root @ mario-desktop: / etc / gulCA # / etc / init.d / slapd start Starting OpenLDAP: slapd - failed. The operation failed but no output was produced. For hints on what went wrong please refer to the system's logfiles (eg / var / log / syslog) or try running the daemon in Debug mode like via "slapd-d 16383" (warning: this will create copious output). Below, you can find the command line options used by this script to run slapd. Do not forget to specify those options if you want to look to debugging output: slapd-g openldap-u openldap-f / etc / ldap / slapd.conf Deputy my folder Thank you very much it is very important

2 1

Initial setup confusion
by Luke Biddell 17 Mar '09

17 Mar '09

I'm attempting to run openldap on intrepid ibex and am encountering some problems which are most likely down to my understanding. So any newbie help is much appreciated. The first confusion is slapd.conf versus slapd.d. I don't have a slapd.conf file to start with and /etc/ldap/slapd.d is empty. So should I hand-craft a slapd.conf (despite the docs saying this is the old way) and convert it to slapd.d format or do I create an ldif file and put it somewhere (presumably in slapd.d or ldapmodify it)? I've also got a schema I wish to import and currently I'm ldapmodify-ing it in, it's of this form. dn: cn=schema,cn=config changeType: modify add: olcAttributeTypes olcAttributeTypes: ... dn: cn=schema,cn=config changeType: modify add: olcObjectClasses olcObjectClasses: .... ... As you can see I'm adding custom attribute types and object classes into cn=schema,cn=config and this appears to work fine, however they are not persisted across slapd restarts. I presume I need to put them under cn=mycustomconfig,cn=schema,cn=config and then they will persist? I'm sure I'm just missing something fundamental here. More coffee is probably needed. TIA for any help. Luke

2 1

SSL
by mario ramirez cervera 17 Mar '09

17 Mar '09

1 0

Re: Problem ldif encrypt MD5
by mario ramirez cervera 17 Mar '09

17 Mar '09

Firstly thank you very much But my problem was that rpincipal, but to explain it wrong. My problem is the config openldad SSL I followed this manualhttp: / / www.juanramartin.com/?p=60 # comment-49151 but did not work for me to insert the lines in slapd.conf .. Podrian ayudarme Greetings 2009/3/16 Brian Friday <brian.friday(a)gmail.com> > Hello Mario, > > Please check out the documentation on the openldap website which > speaks specifically about passwords: > > http://www.openldap.org/faq/data/cache/419.html > > On Mon, Mar 16, 2009 at 2:08 AM, mario ramirez cervera > <marioramirezph(a)gmail.com> wrote: > > Good morning to everyone: > > > > My problem is I need to configure my openldap not have the passwd in > plain > > text. He then ta rootdn with the passwd MD5. > > How can I spend my ldif passwd current MD5? > > > > Thank you very much and hope your help >

1 0

Openldap cookie synchronization
by Mihai Stanescu 16 Mar '09

16 Mar '09

Hello all I am developing a service to replicate openldap changes to another server. For this i am using cookie based search with a certain polling interval (10 secs) My problem occurs when there are many changes to be synced from openldap while openldap is under modification stress. Sometimes openldap returns all the entries of the openldap database to my cookie search (i am not reseting the cookie). Later on after the processing is finalized even a single modification in openldap triggers a situation in which cookie based search fetches all the entries of the openldap database. I am not altering the cookies between searches. Does anyone have any idea why this could happen? Is it nomal behavior or a known issue? Could it be a configuration problem? Thanks Mihai

1 0

Problem ldif encrypt MD5
by mario ramirez cervera 16 Mar '09

16 Mar '09

Good morning to everyone: My problem is I need to configure my openldap not have the passwd in plain text. He then ta rootdn with the passwd MD5. How can I spend my ldif passwd current MD5? Thank you very much and hope your help

1 0

smbk5pwd - slapd stops responding
by Eduardo Sachs 15 Mar '09

15 Mar '09

Hi People, I use the overlay smbk5pwd for sync password of Samba with the of Heimdal Kerberos. In Debian Etch using Samba 3.0.24-6etch10, OpenLDAP 2.3.30-5+etch2 and Heimdal Kerberos 0.7.2.dfsg.1-10, I don't have problems. But, in Debian Lenny using Samba 2:3.2.5-4, OpenLDAP 2.4.11-1, and Heimdal Kerberos 1.2.dfsg.1-2.1, I have problems. When I invoke smbpasswd or ldappaswd and trying change the password, slapd stops responding. With kpasswd I do not have problems, change the password of Samba and Kerberos correctly, and userPassword fixed with {K5KEY}, slapd not stops responding (working correctly), but, I need change the password with smbpasswd for Windows clients. Below follows a more detailed debug, has something else that I can show? This is a bug? slapd.conf configuration: moduleload smbk5pwd overlay smbk5pwd smbk5pwd-enable krb5 smbk5pwd-enable samba smbk5pwd-must-change 2592000 password-hash {K5KEY} - OpenLDAP have permission to read/write the file /var/lib/heimdal-kdc/m-key. - I configure OpenLDAP to run with user root and group root, for tests. smb.conf configuration about password: ldap passwd sync = Only unix password sync = no Look this example: 1 - LDAP OK: root# ps aux|grep slapd root 3841 3.0 0.8 21920 4512 ? Ssl 14:47 0:00 /usr/sbin/slapd -h ldap://10.111.222.100:389/ ldaps://10.111.222.100:636/ ldapi:/// -g root -u root -f /etc/ldap/slapd.conf root 3844 0.0 0.1 3116 728 pts/0 S+ 14:47 0:00 grep slapd root# ldapwhoami -Y GSSAPI SASL/GSSAPI authentication started SASL username: sachs(a)LOCAL.INT.BR SASL SSF: 56 SASL data security layer installed. dn:uid=sachs,ou=samba,ou=usuarios,dc=local,dc=int,dc=br 2 - Change password witch LDAPPASSWD: root# ldappasswd -x -D "krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" "uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" -w secret -S New password: Re-enter new password: ldap_result: Can't contact LDAP server (-1) root# ps aux|grep slapd root 3832 0.0 0.1 3116 724 pts/0 S+ 14:47 0:00 grep slapd root# ldapwhoami -Y GSSAPI ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) Loglevel in 256, trying change password with LDAPPASWD, stop in PASSMOD: conn=0 fd=18 ACCEPT from IP=10.111.222.100:40181 (IP=10.111.222.100:389) conn=0 op=0 BIND dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" method=128 conn=0 op=0 BIND dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" mech=SIMPLE ssf=0 conn=0 op=0 RESULT tag=97 err=0 text= conn=0 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.1 conn=0 op=1 PASSMOD id="uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" new Debug of Overlay Audit, trying change password with LDAPPASWD: # modify 1236964911 dc=local,dc=int,dc=br krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br dn: uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br changetype: modify replace: userPassword userPassword:: e0s1S0VZfQ== - replace: entryCSN entryCSN: 20090313172151.459306Z#000000#000#000000 - replace: modifiersName modifiersName: krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrin cipals,ou=Usuarios,dc=local,dc=int,dc=br - replace: modifyTimestamp modifyTimestamp: 20090313172151Z - # end replace 1236964911 3 - Change Password with SMBPASSWD: LDAP running correctly. root# ldapwhoami -Y GSSAPI SASL/GSSAPI authentication started SASL username: sachs(a)LOCAL.INT.BR SASL SSF: 56 SASL data security layer installed. dn:uid=sachs,ou=samba,ou=usuarios,dc=local,dc=int,dc=br # smbpasswd sachs New SMB password: Retype new SMB password: failed to bind to server ldaps://debian.local.int.br/ with dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" Error: Can't contact LDAP server (unknown) Connection to LDAP server failed for the 2 try! Connection to LDAP server failed for the 3 try! Connection to LDAP server failed for the 4 try! Connection to LDAP server failed for the 5 try! Connection to LDAP server failed for the 6 try! Connection to LDAP server failed for the 7 try! Loglevel in 256, trying change password with SMBPASSWD, stop in PASSMOD: conn=2 fd=27 ACCEPT from IP=10.111.222.100:35715 (IP=10.111.222.100:636) conn=2 fd=27 TLS established tls_ssf=128 ssf=128 conn=2 op=0 BIND dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" method=128 conn=2 op=0 BIND dn="krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br" mech=SIMPLE ssf=0 conn=2 op=0 RESULT tag=97 err=0 text= conn=2 op=1 SRCH base="ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=sachs))" conn=2 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass conn=2 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1 op=5 SRCH base="ou=Grupos,dc=local,dc=int,dc=br" scope=2 deref=0 filter="(&(objectClass=sambaGroupMapping)(gidNumber=513))" conn=1 op=5 SRCH attr=gidNumber sambaSID sambaGroupType sambaSIDList description displayName cn objectClass conn=1 op=5 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1 op=6 SRCH base="ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" scope=2 deref=0 filter="(&(objectClass=sambaSamAccount)(|(sambaSID=s-1-5-21-1831924168-3154312721-1575139623-513)))" conn=1 op=6 SRCH attr=uid sambaSid conn=1 op=6 SEARCH RESULT tag=101 err=0 nentries=0 text= conn=1 op=7 SRCH base="ou=Grupos,dc=local,dc=int,dc=br" scope=2 deref=0 filter="(&(objectClass=sambaGroupMapping)(|(sambaSID=s-1-5-21-1831924168-3154312721-1575139623-513)))" conn=1 op=7 SRCH attr=cn displayName sambaSid sambaGroupType conn=1 op=7 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1 op=8 MOD dn="uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" conn=1 op=8 MOD attr=sambaAcctFlags sambaAcctFlags conn=1 op=9 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" conn=1 op=9 SRCH attr=supportedExtension conn=1 op=9 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1 op=10 EXT oid=1.3.6.1.4.1.4203.1.11.1 conn=1 op=10 PASSMOD id="uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br" new conn=1 op=8 RESULT tag=103 err=0 text= Debug of Overlay Audit, trying change password with SMBPASSWD: # modify 1236968199 dc=local,dc=int,dc=br krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrincipals,ou=Usuarios,dc=local,dc=int,dc=br dn: uid=sachs,ou=Samba,ou=Usuarios,dc=local,dc=int,dc=br changetype: modify delete: sambaAcctFlags sambaAcctFlags: [U] - add: sambaAcctFlags sambaAcctFlags: [U ] - replace: entryCSN entryCSN: 20090313181639.613866Z#000000#000#000000 - replace: modifiersName modifiersName: krb5PrincipalName=ldapmaster/admin(a)LOCAL.INT.BR,ou=KerberosPrin cipals,ou=Usuarios,dc=local,dc=int,dc=br - replace: modifyTimestamp modifyTimestamp: 20090313181639Z - # end replace 1236968199 Thanks!!!

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical