openldap-technical

openldap-technical@openldap.org

5 participants
9991 discussions

Problem to Authenticate Users with openLDAP on Solaris 9
by panagiotis polychronopoulos 23 Apr '09

23 Apr '09

hi to everyone, I try to permit solaris 9 box to authenticate users with openLDAP Server. But I can not get access to "/etc/passwd" of LDAP Server. I have configured the solaris system as LDAP client with "ldapclient" command and I confirmed with the "ldapclient list" that give us the following: root@foivos:/> ldapclient list NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_BINDDN= cn=Manager,dc=tesyd,dc=teimes,dc=gr NS_LDAP_BINDPASSWD= {NS1}5e10c25544515e26 NS_LDAP_SERVERS= 10.0.0.221 NS_LDAP_SEARCH_BASEDN= dc=tesyd,dc=teimes,dc=gr NS_LDAP_AUTH= simple NS_LDAP_SEARCH_SCOPE= sub NS_LDAP_SERVICE_AUTH_METHOD= pam_ldap:simple I also updated the /etc/nsswitch.conf but I still not get access to /etc/passwd file of LdapServer. It is checked by "getent passwd" Please, .any help would be appreciated Thanks in advance _________________________________________________________________ Έχετε Messenger; Έχετε και Windows Live. Μάθετε περισσότερα. http://www.microsoft.com/windows/windowslive

1 0

Comparable and replaceable fax numbers
by Sean Burford 23 Apr '09

23 Apr '09

Hi, On my servers I've redefined facsimileTelephoneNumber as a telephoneNumber: attributetype ( 2.5.4.23 NAME ( 'facsimileTelephoneNumber' 'fax' ) DESC 'RFC2256: Facsimile (Fax) Telephone Number' SUP telephoneNumber ) This requires reimporting the database since the normalisation changes, but it adds comparison rules to fax numbers (allowing comparison and replacement of them): Before: ldapcompare -x uid=person1234,dc=example,dc=com facsimiletelephonenumber::KzEoNTU1KS01NTUtNTU1NQ== Compare Result: Inappropriate matching (18) Additional info: inappropriate matching request UNDEFINED After: ldapcompare -x uid=person1234,dc=example,dc=com facsimiletelephonenumber::KzEoNTU1KS01NTUtNTU1NQ== TRUE Is there any reason to follow the RFC in this case? The RFC itself doesn't make a good argument for or against fax numbers having a separate syntax with no matching rules. -- Thanks, Sean Burford

4 7

entryCSN and back-sql
by Marcel Berteler 23 Apr '09

23 Apr '09

Am I correct in my understanding that 'entryCSN' is updated on every change to an object in order for the replication process to work properly? In a back-sql implementation, I do not see this attribute stored in the database but when requesting the internal attributes of objects i do get the 'entryCSN' back. however, the value changes every time I do the request. Can I assume correctly that 'entryCSN' is not being stored and is therefore of no real use when using back-sql and is only being shown to comply with the LDAP standards? Is it possible to store this attribute in the database by defining it and creating the SQL functions to update it? (same question for creatorsName, createTimestamp, modifiersName, modifyTimestamp, etc) -- Regards, Marcel Berteler *Chief Information Officer */"May the source be with you"/ Website: http://www.bdsolutions.co.za Email Legal Notice: http://www.bdsolutions.co.za/legal/

1 0

Re: Setting up LDAP server
by Santosh Balan 23 Apr '09

23 Apr '09

Hi Team, I am on the look out for free support and advise. I have implemented a basic LDAP server such that it authenticates for my mail server. However this time I have been given a project wherein my LDAP works as an authentication server for user login as well as mails. Also it should have policies while authentication viz. it should disable USB ports for the user, it should set a background wallpaper and screensaver which should start within 20 secs. of the PC's idle time. It should also if possible mount automatically a partition which will be user dependent rather that PC dependent. I hope your getting the picture for which i require your assistance. This is the first time I am working on such a setup. I would appreciate your valuable help and guidance in resolving and setting up an LDAP server as per requirement. Thanking you in advance for your guidance. Thanks and Regards Santosh Balan +91-9819419509 ----- Original Message ----- From: "Andrew Findlay" To: "Santosh Balan" Cc: openldap-technical(a)openldap.org Subject: Re: Setting up LDAP server Date: Wed, 22 Apr 2009 11:09:40 +0100 On Wed, Apr 22, 2009 at 03:05:56AM -0500, Santosh Balan wrote: > Can anyone help me on implementing and configuring LDAP server to > authenticate users with system policies and auto mount a user's partition > provided to him. Also, I want it to authenticate qmail users using LDAP. Are you looking for paid support? Several of us on this list are in the business of determining client requirements then designing and building solutions to fit, so I am sure you would get offers if you were to ask for that service. On the other hand, if you want free advice then I think you will have to do more of the basic research yourself so that you can ask more specific questions. There are lots of papers and guides on the web that will help to get you started. Here is a pointer to some of mine: http://www.skills-1st.co.uk/dir/ Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | ----------------------------------------------------------------------- -- It's News. It's Reviews. It's Interviews. It's Free. What Are You Waiting For? www.movieline.com

2 1

Adding OU with PSQL backend
by Marcel Berteler 23 Apr '09

23 Apr '09

For a project that requires a large user authentication database, we are currently using OpenLDAP with a BDB backend. We have about 150K users in the tree and all works well. Authentication and new user creation is fast and we are happy. But, when we try and get statistical data from the tree, we run into the limitations of LDAP: trying to find all user that have registered last month, using a filter with 2 dates, is just too slow. It takes minutes to come back with a result. To get around this limitation, we want to experiment with a PSQL backend so we can do some comparative testing. (If any of you have a way of allowing us to interrogate our BDB backend with SQL like queries that are relatively fast, than please let me know.) Our test environment: openldap 2.4.16 with Postgres backend I have loaded CORE in slapd.conf as well as our custom schema for our users The only ACL in the conf is ACCESS TO * BY * WRITE Our tree looks like this and I have loaded the data tables and meta-data tables: dc=example,dc=come ou=people,dc=example,dc=com cn=user1,dc=example,dc=com The setup is working about 60%. with openLdapAdmin, I can see the tree and I can add users. What I can not do, is add an OU. It gives me: LDAP said: Server is unwilling to perform Error number: 0x35 (LDAP_UNWILLING_TO_PERFORM) Description: The LDAP server refused to perform the operation. If I get this on our custom schema, I can explain this by not having the right meta-data and procedures loaded. But as this is part of the CORE schema, am I right in only adding the meta-data for OU in ldap_attr_mappings without add or delete procedures? I have looked at the log files and outputs but I can not figure out what is going wrong and why it is not accepting any new OU Any help is appreciated. -- Regards, Marcel Berteler *Chief Information Officer */"May the source be with you"/ Website: http://www.bdsolutions.co.za Email Legal Notice: http://www.bdsolutions.co.za/legal/

7 16

just curious
by Piotr Wadas 22 Apr '09

22 Apr '09

Hello, I've been trying past weeks upgrading my production openldap software. I started from 2.4.11 when it was available, through all available versions, up to 2.4.16. I tried package builds, and my own builds. Each version except 2.4.10 was likely to hang, as it's production, and load is quite high, I haven't too much patience to debug and researching what's actually going on, but I tried disabling syncrepl (no effect), some different settings for bdb backend and slapd thread, concurrency etc ( starting from settings which caused no problems with 2.4.10 ), and finally, got back to 2.4.10 which works fine. Between version change I noticed that 2.4.11+ is build with newer libdb versions (package depends), starting from libdb4.2 (2.4.10), up to libdb4.7 (newer openldap version). I didn't try to build 2.4.15+ with some old (4.2) libdb. Is it some major significant jump between 2.4.10 and all later versions? some general rewrite of some feature ? It's not syncrepl related, as daemon hang no matter whether configured as slave or standalone. The symptoms was, it was (in general) producing BIGGER server load than 2.4.10, and, although daemon process did not segfaults, server stopped responding for requests (?). With higher load I wasn't able to try logging and use of debug symbols. I expected it will work without any slapd.conf, anyway nor leaving it untouched, nor some minor reasonable changes had no effect. So, what's going on? :) Is it possibly related to libdb ? or what? What else could it be ? Except libdb ( 5 different versions available in my system with one default, usually newest ), there was no other software change, just upgrading openldap/libldap. Any clues you may have? I'm sorry I cannot provide more information, anyway config is rather standard and simple, some custom schemas added with indexing, that's all. 2.4.10 has no problems at all, and significantly lower general machine load. ( if 2.4.10 = 100%, 2.4.11+ makes 300-400% ) Actually I'm not expecting some miracle explanation, anyway it's interesting what could it be.. I have about 25 000 entries total in my directory tree, it's used as NSS source, and other information for various applications. regards :) P.

3 4

Porting mozldap to openldap
by Nguyen, Quang 22 Apr '09

22 Apr '09

Hi everybody, I have spend sometime to understand mozldap and openldap. I have searched the archives using these keyword "mozldap to openldap" or just "mozldap" but found nothing. I have to port an application currently using mozldap to openldap. Has anyone done this before, I would like to ask some questions such as: 1. I see that the application called ldapssl_advclientauth_init(), ldapssl_init() if using certificate and call prldap_init() if using simple authentication. The function ldapssl_advclientauth_init() is very big after I traced it down. Is there an equivalent call in openldap? 2. Is there any example posted somewhere that my search on google missed (I could not find any). 3. Is there anything I should be watching for? 4. What is the best approach to do this? I thank you very much for any help, suggestion I can get. Best regards

2 2

Setting up LDAP server
by Santosh Balan 22 Apr '09

22 Apr '09

Hi Friends, Can anyone help me on implementing and configuring LDAP server to authenticate users with system policies and auto mount a user's partition provided to him. Also, I want it to authenticate qmail users using LDAP. Your assistance is highly appreciable. Thanking you in advance. Thanks and Regards Santosh Balan 9819419509 -- It's News. It's Reviews. It's Interviews. It's Free. What Are You Waiting For? www.movieline.com

2 1

ldap SQL backend and syncrepl
by Frederic Bouy 22 Apr '09

22 Apr '09

Hello, For performance issues (millions or records) I have two ldap servers: - one master with an sql backend (postgres) to allow easy data manipulation - one slave to anwer ldap queries and provide good response time When lauching the slave ("./slapd -f /usr/local/openldap/etc/openldap/slapd-front.conf -h "ldap://localhost:3890" -d 1") I got a first non blocking error I don't really understand: " => bdb_dn2id("dc=lnp") <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30988)" According to the fact that the following command is successfull: "ldapwhoami -H "ldap://localhost:389" -D "cn=manager,dc=lnp" -w secret" and then the synchronization fails with this error: "read1msg: ld 0x9ca73e8 msgid 2 message type search-entry ber_scanf fmt ({xx) ber: ber_scanf fmt ({a) ber: ber_scanf fmt (o) ber: ber_scanf fmt ({em) ber: do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD ldap_msgfree connection_get(11): got connid=0 ldap_free_request (origid 2, msgid 2) ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 11 ldap_free_connection: actually freed do_syncrepl: rid=001 quitting" Do you know whether suncrepl is support for ldap with sql backend? Do you know where can I find some documentation on this? Do you have any clue on how I could solve my issues? Thanks in advance. Please find below the .conf of those two ldap servers: # === MASTER ===== include /usr/local/openldap/etc/openldap/schema/core.schema include /usr/local/openldap/etc/openldap/schema/cosine.schema include /usr/local/openldap/etc/openldap/schema/nis.schema include /usr/local/openldap/etc/openldap/schema/inetorgperson.schema include /usr/local/openldap/etc/openldap/schema/lnp.schema pidfile /usr/local/openldap/var/slapd-lnp.pid argsfile /usr/local/openldap/var/slapd-lnp.args backend sql ####################################################################### # sql database definitions ####################################################################### database sql suffix "dc=lnp" rootdn "cn=Manager,dc=lnp" rootpw secret dbname lnp dbuser lnp dbpasswd lnp strcast_func "text" #subtree_cond "ldap.entries.dn like '%'||?" concat_pattern "?||?" has_ldapinfo_dn_ru no overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 lastmod on # === MASTER ===== include /usr/local/openldap/etc/openldap/schema/core.schema include /usr/local/openldap/etc/openldap/schema/cosine.schema include /usr/local/openldap/etc/openldap/schema/nis.schema include /usr/local/openldap/etc/openldap/schema/inetorgperson.schema include /usr/local/openldap/etc/openldap/schema/lnp.schema pidfile /usr/local/openldap/var/run/slapd-front.pid argsfile /usr/local/openldap/var/run/slapd-front.args ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=lnp" rootdn "cn=Manager,dc=lnp" rootpw secret directory /usr/local/openldap/var/openldap-data # index entryCSN,entryUUID eq index entryUUID eq # filter="(objectClass=*)" syncrepl rid=001 provider=ldap://localhost:389 bindmethod=simple type=refreshAndPersist searchbase="ou=31,dc=lnp" schemachecking=off binddn="cn=manager,dc=lnp" credentials=secret filter="(objectClass=*)" mirrormode on serverID 1

4 7

Re: Directory migration
by Michael Ströder 22 Apr '09

22 Apr '09

Ian wrote: > On Tue, 21 Apr 2009 23:07:11 Michael Ströder wrote: >> Hmm, which password scheme is used? Are the userPassword values prefixed >> with {MD5} or with {CRYPT}? In the latter case libcrypt on both systems >> could be incompatible. So this could be another issue. The general >> advice is not to use {CRYPT}. Recommended is to use salted SHA-1 >> (password scheme {SSHA}). > > Well FreeBSD is using MD5 for it's encryption and so is the linux workstation. This does not say much since there are also MD5-based password hashes in Unix crypt. > Is the LDAP server encrypting the hashes as well? No, the clear-text password is hashed depending on the password scheme together with a random salt. > They don't look like the > hashes in master.password What is master.password? > at all, so I guess it is? And that's one reason why > you need to use the PADL scripts when you import /etc/passwd into your LDAP > directory? If you import /etc/shadow or whereever your salted Unix password hashes are stored you would use the platform-specific password scheme {CRYPT}. > The password entry looks like this: > userPassword:: e21kNX01NDdxRWpMNXlRbmZJcDdhREFYZDh3PT0= ^^ The double-colon indicates that the value is base64-encoded in the LDIF representation. $ python -c "print 'e21kNX01NDdxRWpMNXlRbmZJcDdhREFYZDh3PT0='.decode('base64')" {md5}547qEjL5yQnfIp7aDAXd8w== So this is a plain MD5-hashed password. This password scheme is *not* platform-specific. Is this from your original data? Do all entries have password values like this? Check that. If yes, then you should not have a problem to migrate this data. > So I don't know what encoding it's using - is there a setting that controls > this? (nothing in slapd.conf that I can see). There are various relevant settings. But I wonder which component is used for setting the password and which mechanism it uses. You should also consult the fine articles in the FAQ-O-MATIC: http://www.openldap.org/faq/data/cache/419.html Ciao, Michael.

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical