openldap-technical

openldap-technical@openldap.org

7 participants
9864 discussions

Re: Migrating users, groups and machines from Win NT 4.0 PDC to openldap+samba
by Norberto Bensa 07 Apr '09

07 Apr '09

On Tue, Apr 7, 2009 at 5:51 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, April 07, 2009 11:31 AM -0300 Norberto Bensa > <nbensa(a)gmail.com> wrote: >> This is OT to this list, but "net rpc vampire" will do what you want. >> Consult the samba docs/mailing list. > > I don't see why this is off topic. The -technical list is about > interoperability of OpenLDAP with other applications. Thanks. I thought this list was openldap-only questions. Regards, Norberto

1 0

Migrating users, groups and machines from Win NT 4.0 PDC to openldap+samba
by Nathaniel Simch de Morais 07 Apr '09

07 Apr '09

Hi, does anyone know how can i export users, groups and machines from a WinNT 4.0 PDC and put this informations in my OpenLDAP+SAMBA(PDC)? -- --------------------------------------------------- Nathaniel Simch de Morais skype: nathanielmorais --------------------------------------------------- °v° "Você acha que é livre se o | /(_)\ Software que você usa | ^ ^ nao é?" | --------------------------------------------------- Eu uso BrOffice.org!!! Eu uso Mozilla Firefox!!!

3 2

unable to get openldap to bind to active directory
by Kyle Pike 07 Apr '09

07 Apr '09

[kylec@localhost ~]$ ldapsearch -v -H ldap://localhost -x -b "cn=Users,dc=company,dc=internal" ldap_initialize( ldap://localhost ) filter: (objectclass=*) requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <cn=Users,dc=company,dc=internal> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 1 Operations error text: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this ope ration a successful bind must be completed on the connection., data 0, vece # numResponses: 1

1 0

back-ndb vs back-sql for exposing one MySQL db?
by Gavin Henry 07 Apr '09

07 Apr '09

Hi All, Here's a quick question, if you need to expose one MySQL db as LDAP for example, using the existing db that has customer records in it and a 3rd party application can look up via LDAP, do you use bog standard back-sql or back-ndb just use one db, as it looks easier to setup? Going by Howards talk at UKUUG 2009: http://www.ukuug.org/events/spring2009/programme/openldap-mysql.shtml -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

2 1

How to Secure openLdap nss_ldap
by Matthew.GARRETT＠external.total.com 07 Apr '09

07 Apr '09

Folks Note sure if this is the right list ? I have a new OpenLdap (version 2.3) Server that uses Kerberos for Password Authentication, which is going to be a Replacement for NIS (YP) All Normal access works fine and users can login , access automount maps etc However there are 2 types of Ldap binding Simple TLS At the moment any body can run the following ldapsearch -x I would like to try and disable Simple Binding But if I select "disallow bind_anon" in slapd.conf file Things start to break like authentication stops working. /var/log/messages Apr 1 15:42:15 apricot sudo[31515]: pam_ldap: error trying to bind (Inappropriate authentication) Apr 1 15:42:18 apricot sudo[31515]: pam_ldap: error trying to bind (Inappropriate authentication) Apr 1 15:42:25 apricot sudo[31515]: pam_ldap: ldap_result Can't contact LDAP server How do I get a Machine to authenticate to Ldap ? I think the problem lies with nss_ldap ? When I add the following line to /etc/ldap.conf ssl start_tls I start to get the following error's Apr 2 14:09:11 bruce vmware-guestd: nss_ldap: reconnecting to LDAP server (sleeping 4 seconds)... Apr 2 14:09:15 bruce vmware-guestd: nss_ldap: reconnecting to LDAP server (sleeping 8 seconds)... Apr 2 14:09:18 bruce nscd: nss_ldap: reconnecting to LDAP server (sleeping 16 seconds)... Apr 2 14:27:06 bruce sshd: pam_ldap: ldap_starttls_s: Operations error Apr 2 14:27:06 bruce sshd(pam_unix)[11233]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=apricot.uk.ad.ep.corp.local user=mgarrett Apr 2 14:27:06 bruce sshd[11233]: pam_krb5[11233]: authentication succeeds for'mgarrett' (mgarrett(a)UK.AD.EP.CORP.LOCAL) /etc/ldap.conf base dc=unix,dc=total bind_timelimit 120 idle_timelimit 3600 ldap_version 3 pam_password md5 scope sub ssl start_tls timelimit 120 tls_cacertdir /etc/openldap/cacerts tls_checkpeer no Can any body point me in the right direction Thanks Matthew Server is RedHat 5.3 Clients are RedHat 4.7 Copy of slapd.conf pwcheck_method: saslauthd mech_list: gssapi sizelimit unlimited include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/redhat/autofs.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/krb5-kdc.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 TLSCACertificateFile /etc/openldap/cacerts/cacert.pem TLSCertificateFile /etc/openldap/slapd.pem TLSCertificateKeyFile /etc/openldap/slapd.key ## security - other directives ## prevents anonymous access to ## any connection #disallow bind_anon ## forces a bind operation before DIT access #require bind ## Use of reads on ldaps only port forces use ## of TLS/SSL but not a minimum value ## this directive forces a minimum value #security simple_bind=128 sasl-secprops noanonymous,noplain,noactive # Map SASL authentication DNs to LDAP DNs # This leaves "username/admin" principals untouched sasl-regexp uid=([^/]*),cn=GSSAPI,cn=auth uid=$1,ou=people,dc=unix,dc=total # This should be a ^ plus, not a star, but slapd won't accept it # Default read access for everything else except anonymous users who have no access but does not work. ! access to * by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by * read #by anonymous none Matthew Garrett Senior IS Technical Analyst Tel: 01224 297889 Fax: 01224 296806 Email: Matthew.Garrett(a)total.com Total E&P UK, Crawpeel Road, Altens Industrial Estate, Aberdeen AB12 3FG Registered in England and Wales No.811900 Registered Office 33 Cavendish Square, London W1G 0PW This e-mail and any attachments are intended only for the person or entity to whom it is addressed and may contain confidential or privileged information. If you are not the addressee, any disclosure, reproduction, copying, distribution, or use of this communication is strictly prohibited. If you are not the intended recipient or person responsible for delivering this message to the named addressee, please notify us immediately and delete this e-mail. It is the responsibility of the addressee to scan this email and any attachments for computer viruses or other defects. The sender does not accept liability for any loss or damage of any nature, however caused, which may result directly or indirectly from this email or any file attached.

2 3

sasl use ip as digest-uri
by Zhen Li 07 Apr '09

07 Apr '09

Hi, I'm trying to do sasl authentication against an active directory server. In the second sasl bind request sent to AD, the ip address of the AD server is used as the digest-uri. e.g. "ldap/192.168.1.1". Isn't it supposed to use domain name like "ldap/svr.example.com"? I used "ldapsearch -Y DIGEST-MD5". And in ldap.conf, "uri" and "host" are given in domain names. Any help will be appreciated. liz _________________________________________________________________ View your Twitter and Flickr updates from one place – Learn more! http://clk.atdmt.com/UKM/go/137984870/direct/01/

1 0

LDAP presentation PDFs are available
by Gavin Henry 07 Apr '09

07 Apr '09

OpenLDAP Replication Strategies - http://www.ukuug.org/events/spring2009/programme/openldap-replication.shtml OpenLDAP and MySQL: Bridging the Data Model Divide - http://www.ukuug.org/events/spring2009/programme/openldap-mysql.shtml Writing Access Control Policies for LDAP - http://www.ukuug.org/events/spring2009/programme/ldap-access-control.shtml -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

1 0

Question on how to setup OpenLDAP according to RFC2307
by Bryan Boone 06 Apr '09

06 Apr '09

Hi everyone, I am a noobie on LDAP. Here is my problem. I have a tape library that has a web UI that is able to authenticate with and LDAP server. I downloaded and installed OpenLDAP. I have also created some test accounts on the LDAP to make sure it is working properly, and it is. The library documentation says that it is only able to authenticate with LDAP that complys with RFC2307. I read the RFC document and I see that OpenLDAP is already RFC2307 compliant. But I still cannot authenticate the library web UI. So my question is... Is there a structure that the LDAP server should follow in order to comply with RFC2307? For instance, do I need users under certain groups? I used a posixAccount and a posixGroup. Is this correct? Here is my LDIF below. Do I have this setup correct? thanks dn: dc=ibm,dc=com objectClass: dcObject objectClass: organization o: IBM dc: ibm dn: cn=employees,dc=ibm,dc=com objectClass: posixGroup cn: employees gidNumber: 253 dn: cn=bryan,cn=employees,dc=ibm,dc=com cn: bryan uid: bbryan uidNumber: 1 gidNumber: 10 homeDirectory: /home/bryan objectClass: account objectClass: posixAccount userPassword: {crypt}ecVLdK/k7KQMg dn: cn=kenny,cn=employees,dc=ibm,dc=com cn: kenny uid: qkenny uidNumber: 5 gidNumber: 11 homeDirectory: /home/kenny objectClass: account objectClass: posixAccount userPassword: {CRYPT}RuY5yfDjlajGo dn: cn=groups,dc=ibm,dc=com objectClass: posixGroup cn: groups gidNumber: 250 dn: cn=library_a,cn=groups,dc=ibm,dc=com cn: library_a gidNumber: 251 objectClass: posixGroup memberUid: qkenny dn: cn=administrators,cn=groups,dc=ibm,dc=com cn: administrators gidNumber: 252 objectClass: posixGroup memberUid: bbryan _________________________________________________________________ Rediscover Hotmail®: Get quick friend updates right in your inbox. http://windowslive.com/RediscoverHotmail?ocid=TXT_TAGLM_WL_HM_Rediscover_Up…

1 0

Re: openldap-technical Digest, Vol 17, Issue 4
by mario ramirez cervera 06 Apr '09

06 Apr '09

Hello as usuairo admnistador could have a read-only 2009/4/4 <openldap-technical-request(a)openldap.org> > Send openldap-technical mailing list submissions to > openldap-technical(a)openldap.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://www.openldap.org/lists/mm/listinfo/openldap-technical > or, via email, send a message with subject or body 'help' to > openldap-technical-request(a)openldap.org > > You can reach the person managing the list at > openldap-technical-owner(a)openldap.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of openldap-technical digest..." > > > Send openldap-technical mailing list submissions to > openldap-technical(a)openldap.org > When replying, please edit your Subject: header so it is more specific than > "Re: openldap-technical digest..." > > Today's Topics: > > 1. smbk5pwd for openldap 2.3 (Daniel Spannbauer) > 2. Unable to auth on replica (Marcio Merlone) > 3. How to Secure openLdap nss_ldap > (Matthew.GARRETT(a)external.total.com) > 4. TLS/Certificate Problem Openldap (Steffen Knauf) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 02 Apr 2009 12:02:17 +0200 > From: Daniel Spannbauer <ds(a)marco.de> > Subject: smbk5pwd for openldap 2.3 > To: openldap-technical(a)openldap.org > Message-ID: <49D48D29.5010809(a)marco.de> > Content-Type: text/plain; charset=ISO-8859-15; format=flowed > > Hello, > > I'm using the distro opensuse 10.2. > I'm missing the module smbk5pwd. > Can I build this module for openldap 2.3? > > Regards > > Daniel > > -- > Daniel Spannbauer Software Entwicklung > marco Systemanalyse und Entwicklung GmbH Tel +49 8333 9233-27 Fax -11 > Rechbergstr. 4 - 6, D 87727 Babenhausen Mobil +49 171 4033220 > http://www.marco.de/ Email ds(a)marco.de > Gesch?ftsf?hrer Martin Reuter HRB 171775 Amtsgericht M?nchen > > > ------------------------------ > > Message: 2 > Date: Thu, 02 Apr 2009 09:10:32 -0300 > From: Marcio Merlone <marcio.merlone(a)a1.ind.br> > Subject: Unable to auth on replica > To: OpenLDAP <openldap-technical(a)openldap.org> > Message-ID: <49D4AB38.7070403(a)a1.ind.br> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hello, > > I have set two Ubuntu 8.04 servers running OpenLDAP > 2.4.9-0ubuntu0.8.04.2. I have set replication as per the docs. On the > slave, I start with an empty /var/lib/ldap, and when I start the replica > the dir is populated with the files, I am able to anon search, etc. > Great, except my clients are able to auth on the provider but not on the > replica. > > Both provider and consumer have the same acls, and the diff from one > conf to another is: > > --- slapd.conf 2009-04-02 09:04:42.000000000 -0300 > +++ slapd.conf.replica 2009-04-02 09:05:47.000000000 -0300 > @@ -60,19 +61,13 @@ > # 'database' directive occurs > database hdb > > -overlay syncprov > -syncprov-checkpoint 100 10 > -syncprov-sessionlog 100 > - > -# Let the replica DN have limitless searches > -limits dn.exact="cn=syncrepl,dc=a1,dc=ind" time.soft=unlimited > time.hard=unlimited size.soft=unlimited size.hard=unlimited > - > # The base of your directory in database #1 > suffix "dc=a1,dc=ind" > > # rootdn directive for specifying a superuser on the database. This is > needed > # for syncrepl. > -# rootdn "cn=admin,dc=a1,dc=ind" > +rootdn "cn=admin,dc=a1,dc=ind" > + > > # Where the database file are physically stored for database #1 > directory "/var/lib/ldap" > @@ -112,6 +108,21 @@ > # Where to store the replica logs for database #1 > # replogfile /var/lib/ldap/replog > > +syncrepl rid=3 > + provider=ldap://192.168.0.201:389 > + type=refreshAndPersist > + interval=01:00:00:00 > + searchbase="dc=a1,dc=ind" > + scope=sub > + schemachecking=off > + bindmethod=simple > + binddn="cn=syncrepl,dc=a1,dc=ind" > + credentials=xxxxx > + > + > +# updateref ldap://192.168.0.201:389 > + > + > # The userPassword by default can be changed > # by the entry owning it if they are authenticated. > # Others should not be able to see it, except the > > > Any idea on what could be wrong? Thanks in advance for any hint or help. > > > -- > Marcio Merlone > > > > ------------------------------ > > Message: 3 > Date: Thu, 2 Apr 2009 14:43:12 +0100 > From: Matthew.GARRETT(a)external.total.com > Subject: How to Secure openLdap nss_ldap > To: openldap-technical(a)openldap.org > Message-ID: > < > OF428EEFBC.05C17E8A-ON8025758C.004897FD-8025758C.004B5DD3(a)total.com> > Content-Type: text/plain; charset="utf-8" > > Folks > > Note sure if this is the right list ? > > I have a new OpenLdap (version 2.3) Server that uses Kerberos for Password > Authentication, which is going to be a Replacement for NIS (YP) > All Normal access works fine and users can login , access automount maps > etc > > However there are 2 types of Ldap binding > > Simple > TLS > > At the moment any body can run the following > ldapsearch -x > > I would like to try and disable Simple Binding > But if I select "disallow bind_anon" in slapd.conf file > Things start to break like authentication stops working. > /var/log/messages > > Apr 1 15:42:15 apricot sudo[31515]: pam_ldap: error trying to bind > (Inappropriate authentication) > Apr 1 15:42:18 apricot sudo[31515]: pam_ldap: error trying to bind > (Inappropriate authentication) > Apr 1 15:42:25 apricot sudo[31515]: pam_ldap: ldap_result Can't contact > LDAP server > > How do I get a Machine to authenticate to Ldap ? > > I think the problem lies with nss_ldap ? > When I add the following line to /etc/ldap.conf > > ssl start_tls > > I start to get the following error's > Apr 2 14:09:11 bruce vmware-guestd: nss_ldap: reconnecting to LDAP server > (sleeping 4 seconds)... > Apr 2 14:09:15 bruce vmware-guestd: nss_ldap: reconnecting to LDAP server > (sleeping 8 seconds)... > Apr 2 14:09:18 bruce nscd: nss_ldap: reconnecting to LDAP server > (sleeping 16 seconds)... > Apr 2 14:27:06 bruce sshd: pam_ldap: ldap_starttls_s: Operations error > Apr 2 14:27:06 bruce sshd(pam_unix)[11233]: authentication failure; > logname= uid=0 euid=0 tty=ssh ruser= rhost=apricot.uk.ad.ep.corp.local > user=mgarrett > Apr 2 14:27:06 bruce sshd[11233]: pam_krb5[11233]: authentication > succeeds for'mgarrett' (mgarrett(a)UK.AD.EP.CORP.LOCAL) > > /etc/ldap.conf > > base dc=unix,dc=total > bind_timelimit 120 > idle_timelimit 3600 > ldap_version 3 > pam_password md5 > scope sub > ssl start_tls > timelimit 120 > tls_cacertdir /etc/openldap/cacerts > tls_checkpeer no > > Can any body point me in the right direction > > > Thanks > > Matthew > > Server is RedHat 5.3 > Clients are RedHat 4.7 > > Copy of slapd.conf > pwcheck_method: saslauthd > mech_list: gssapi > sizelimit unlimited > > include /etc/openldap/schema/core.schema > include /etc/openldap/schema/cosine.schema > include /etc/openldap/schema/inetorgperson.schema > include /etc/openldap/schema/redhat/autofs.schema > include /etc/openldap/schema/nis.schema > include /etc/openldap/schema/krb5-kdc.schema > > # Allow LDAPv2 client connections. This is NOT the default. > allow bind_v2 > > > TLSCACertificateFile /etc/openldap/cacerts/cacert.pem > TLSCertificateFile /etc/openldap/slapd.pem > TLSCertificateKeyFile /etc/openldap/slapd.key > > ## security - other directives > ## prevents anonymous access to > ## any connection > #disallow bind_anon > ## forces a bind operation before DIT access > #require bind > ## Use of reads on ldaps only port forces use > ## of TLS/SSL but not a minimum value > ## this directive forces a minimum value > #security simple_bind=128 > > sasl-secprops noanonymous,noplain,noactive > > # Map SASL authentication DNs to LDAP DNs > # This leaves "username/admin" principals untouched > sasl-regexp uid=([^/]*),cn=GSSAPI,cn=auth > uid=$1,ou=people,dc=unix,dc=total > # This should be a ^ plus, not a star, but slapd won't accept it > > # Default read access for everything else except anonymous users who have > no access but does not work. ! > access to * > by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write > by * read > > > #by anonymous none > > > > > Matthew Garrett > Senior IS Technical Analyst > Tel: 01224 297889 > Fax: 01224 296806 > Email: Matthew.Garrett(a)total.com > Total E&P UK, Crawpeel Road, Altens Industrial Estate, Aberdeen AB12 3FG > Registered in England and Wales No.811900????????? > Registered Office 33 Cavendish Square, London W1G 0PW > This e-mail and any attachments are intended only for the person or entity > to whom it is addressed and may contain confidential or privileged > information.? If you are not the addressee, any disclosure, reproduction, > copying, distribution, or use of this communication is strictly prohibited. > If you are not the intended recipient or person responsible for delivering > this message to the named addressee, please notify us immediately and > delete > this e-mail. > It is the responsibility of the addressee to scan this email and any > attachments for computer viruses or other defects. The sender does not > accept liability for any loss or damage of any nature, however caused, > which may result directly or indirectly from this email or any file > attached. >

1 0

posixGroup integrated with linux via nss
by Scott Classen 02 Apr '09

02 Apr '09

I have a happily running LDAP installation (2.4.15) running on Fedora 8 with numerous other linux machines using it as a source of authentication and name services. I have a problem with group permissions. Most of my groups have less than 10 members, but I have a few super users that need to belong to many groups (100-200) so that they can help individual users process their data. I can easily add the super users to each group using ldapmodify or GQ, and when I type "groups" or "id" in a terminal window as the super user I see that they belong to all the groups. The problem come when I try to read the contents of a directory that is owned by one of these secondary groups. Maybe its a Fedora/Linux thing, but the super user only has read permissions for the first 16 groups. The super user can not do an "ls -la /home/userwhoisin17thgroup" What is up with that? Also can anyone recommend another way to achieve the one user/many groups scenario using LDAP? Thanks, Scott

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical