openldap-technical

openldap-technical@openldap.org

12 participants
9794 discussions

user home directory perms
by Geoffrey 04 Feb '09

04 Feb '09

We are using a combination of ldap and samba, therefore are adding users via the smbldap-useradd script. How do we set the permissions for the home directory when the user logs in for the first time. The directories are being created, but not with the permissions we want. Thanks. -- Until later, Geoffrey Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. - Benjamin Franklin

1 0

Forgotten password recovery
by Vincent Panel 04 Feb '09

04 Feb '09

Hello, Many websites now provide a feature which allow users to reset their password on their own, without being helped by an administrator or another privileged person. A website I'm working on is using drupal which is able to handle such a situation by sending a mail to the user. The body of this mail contains a specific url crafted by drupal so that when the user clicks on the link, drupal can automatically authenticate the user. This URL is only valid once. If you try to integrate drupal with openldap, you'll find that openldap does not support such an authentication scheme. So you are either forced to create a privileged user in LDAP which is able to reset all users' passwords or live with it and give up this feature. So I'm writing to this list to know if anyone already had a similar issue and which solution was found ? Would it be possible for openldap or an openldap overlay to implement such an authentication mechanism ? Is there any IETF draft about it (one can dream) ? Vincent

3 4

best practices - dn:
by Brian Krusic 04 Feb '09

04 Feb '09

Hi all, I've read and config'd my ldifs as follows; option 1; dn: uid=fbar,ou=People,dc=company,dc=com uid: foo sn: Bar mail: foo(a)company.com cn: Foo Bar objectClass: inetOrgPerson objectClass: apple-user objectClass: shadowAccount objectClass: posixAccount objectClass: top uidNumber: 1000 gidNumber: 20 loginShell: /bin/tcsh homeDirectory: /homes/fbar apple-user-homeDirectory: /homes/fbar userPassword:: agbeirrklflhfihverrrknv= option 2; dn: cn=Foo Bar,ou=People,dc=company,dc=com uid: foo sn: Bar mail: foo(a)company.com cn: Foo Bar objectClass: inetOrgPerson objectClass: apple-user objectClass: shadowAccount objectClass: posixAccount objectClass: top uidNumber: 1000 gidNumber: 20 loginShell: /bin/tcsh homeDirectory: /homes/fbar apple-user-homeDirectory: /homes/fbar userPassword:: agbeirrklflhfihverrrknv= My OpenLDAP server is used for company white pages and authentication for Linux, OSX clients. What do you think the most reliable dn value should be; with uid or with cn? - Brian

2 2

multiple groups not showing up in "groups" cmd
by Justin Lintz 03 Feb '09

03 Feb '09

Hi, I've configured a user to be a member of another posixGroup as so... dn: cn=dev2,ou=groups,dc=test,dc=net cn: dev2 gidNumber: 1003 objectClass: posixGroup objectClass: top memberUid: dave The users info: dn: cn=David FooBar,ou=people,dc=test,dc=net givenName: David sn: FooBar cn: David FooBar uid: dave userPassword:: uidNumber: 1009 gidNumber: 1004 homeDirectory: /home/dave loginShell: /bin/bash objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: top If I log into a server with the users account, it shows him properly a member of gid 1004, but does not list his seconday group of dev2. My /etc/ldap.conf file is base dc=test,dc=net binddn cn=Manager,dc=test,dc=net bindpw timelimit 15 bind_timelimit 15 idle_timelimit 3600 nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman pam_filter objectclass=posixaccount pam_member_attribute memberuid nss_base_passwd ou=People,dc=test,dc=net?one nss_base_shadow ou=People,dc=test,dc=net?one nss_base_group ou=Groups,dc=test,dc=net?one uri ldaps://prodldap01/ ldaps://prodldap02/ ssl on tls_cacertdir /etc/openldap/cacerts tls_checkpeer no pam_password md5 I also tried changing the value of memberUid to the DN of the user, but that did not work as well. Any suggestions are appreciated. Thanks - Justin Lintz

2 2

Active Directory & Open LDAP Synchronization
by Paul bob 03 Feb '09

03 Feb '09

Hi - I have installed Active directory authentication for windows servers and users and LDAP for Linux servers, now I am planning to use single sign on system windows and Linux. How can I sync with these two directory? I would appreciate your advice! Thanks, PB

3 2

supportedSASLMechanisms not Work in Debian Lenny
by Jarbas Peixoto Júnior 03 Feb '09

03 Feb '09

I have two servers: * Server A: Debian Etch - Works Fine * Server B: Debian Lenny - Do not Works supportedSASLMechanisms EXTERNAL In Server A I have: # ldapsearch -v -H ldap://server-Etch -b "" -LLL -s base supportedSASLMechanisms -ZZ ldap_initialize( ldap://server-Etch ) SASL/EXTERNAL authentication started SASL username: emailAddress=jarbas.peixoto(a)previdencia.gov.br,CN=jarbas.peixoto,OU=DATAPREV,O=Previdencia Social,L=Campo Grande,ST=Mato Grosso do Sul,C=BR SASL SSF: 0 filter: (objectclass=*) requesting: supportedSASLMechanisms dn: supportedSASLMechanisms: PLAIN supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: LOGIN supportedSASLMechanisms: NTLM supportedSASLMechanisms: CRAM-MD5 supportedSASLMechanisms: EXTERNAL In Server B I have: # ldapsearch -v -H ldap://server-Lenny -b "" -LLL -s base supportedSASLMechanisms -ZZ ldap_initialize( ldap://server-Lenny:389/??base ) ldap_start_tls: Connect error (-11 # ldapsearch -v -H ldap://server-Lenny -b "" -LLL -s base supportedSASLMechanisms -ZZ -d 1 ldap_url_parse_ext(ldap://server-Lenny) ldap_create ldap_url_parse_ext(ldap://server-Lenny:389/??base) ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP server-Lenny:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.82.0.234:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush2: 31 bytes to sd 3 ldap_result ld 0x9d73280 msgid 1 wait4msg ld 0x9d73280 msgid 1 (infinite timeout) wait4msg continue ld 0x9d73280 msgid 1 all 1 ** ld 0x9d73280 Connections: * host: www-mmldap port: 389 (default) refcnt: 2 status: Connected last used: Thu Jan 29 18:17:22 2009 ** ld 0x9d73280 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x9d73280 request count 1 (abandoned 0) ** ld 0x9d73280 Response Queue: Empty ld 0x9d73280 response count 0 ldap_chkResponseList ld 0x9d73280 msgid 1 all 1 ldap_chkResponseList returns ld 0x9d73280 NULL ldap_int_select read1msg: ld 0x9d73280 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 12 contents: read1msg: ld 0x9d73280 msgid 1 message type extended-result ber_scanf fmt ({eAA) ber: read1msg: ld 0x9d73280 0 new referrals read1msg: mark request completed, ld 0x9d73280 msgid 1 request done: ld 0x9d73280 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ber_scanf fmt ({eAA) ber: ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (}) ber: ldap_msgfree ldap_err2string ldap_start_tls: Connect error (-11) In the /var/log/syslog I have: Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 fd=21 ACCEPT from IP=10.82.0.234:50441 (IP=0.0.0.0:389) Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 op=0 STARTTLS Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 op=0 RESULT oid= err=0 text= Jan 29 18:17:22 server-Lenny slapd[12945]: conn=99 fd=21 closed (TLS negotiation failure) This is very important for use openldap with user certificates. Anybody have a help for me? Tanks!

3 3

RE: ldap_bind fails in vpn tunnel
by Christopher Barry 30 Jan '09

30 Jan '09

> -----Original Message----- > From: Shankhadeep Sen [mailto:shanks.iit@gmail.com] > Sent: Friday, January 30, 2009 1:25 PM > To: Christopher Barry > Subject: Re: ldap_bind fails in vpn tunnel > > Hi Christopher, > > Thanks for your email.It seems that > without TLS , the search works first but next when I initiate > a TLS session, the ldap api says "SERVER DOWN".I must mention > that the bandwidth is very low in that VPN tunnel and there > is only one route. > > Now I used tcpdump to check the packets on port 389 , it > seems that there are a lot of packets being exchanged.My > guess is that because of the low b/w even if one packet gets > dropped because of router overflow, the SSL handshake will be > terminated. > > What do you think? > > Thanks, > > Sankhadip > > > On Fri, Jan 30, 2009 at 9:05 AM, Christopher Barry > <christopher.barry(a)qlogic.com> wrote: > > > > -----Original Message----- > > From: > > openldap-technical-bounces+christopher.barry=qlogic.com@openld > > ap.org > > [mailto:openldap-technical-bounces+christopher.barry > <mailto:openldap-technical-bounces%2Bchristopher.barry> =qlogic.co > > m(a)openldap.org] On Behalf Of Sankhadip Sengupta > > Sent: Friday, January 30, 2009 9:34 AM > > To: openldap-technical(a)openldap.org > > Subject: ldap_bind fails in vpn tunnel > > > > Hi, > > > > In a VPN tunnel, using TLS, ldap_search works but the > > ldap_bind fails with error :Can't contact LDAP server(-1). > > > > Can any one help me? I am using the openldap sdk. > > > > Thanks, > > > > Sankhadip > > > > > You might try putting the LDAP server's name and IP > address in the hosts file of the client. > > -C > > > > > Is this link helpful to you? http://www.openldap.org/lists/openldap-software/200201/msg00625.html

2 1

ldap_bind fails in vpn tunnel
by Sankhadip Sengupta 30 Jan '09

30 Jan '09

Hi, In a VPN tunnel, using TLS, ldap_search works but the ldap_bind fails with error :Can't contact LDAP server(-1). Can any one help me? I am using the openldap sdk. Thanks, Sankhadip

1 0

Sudo Access
by Paul bob 29 Jan '09

29 Jan '09

Hi! I need to give some of ldap users to sudo access. I am not sure how to configure SUDO access in LDAP. Your valuable suggestion appreciated! Thanks in Advance! -

3 2

LDAP password information update failed: Insufficient access
by Paul bob 28 Jan '09

28 Jan '09

I am experiencing a problem trying to configure a ldap server for users authentication. Basically, I am at a point where users can login properly, but they can not change their password. Some info for troubleshooting: slapd.conf access info access to attr=userPassword access to * by self write by users read by anonymous auth I would appreciate your help! Thanks, bob

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical