openldap-technical

openldap-technical@openldap.org

9 participants
9867 discussions

ldap_bind fails in vpn tunnel
by Sankhadip Sengupta 30 Jan '09

30 Jan '09

Hi, In a VPN tunnel, using TLS, ldap_search works but the ldap_bind fails with error :Can't contact LDAP server(-1). Can any one help me? I am using the openldap sdk. Thanks, Sankhadip

1 0

Sudo Access
by Paul bob 29 Jan '09

29 Jan '09

Hi! I need to give some of ldap users to sudo access. I am not sure how to configure SUDO access in LDAP. Your valuable suggestion appreciated! Thanks in Advance! -

3 2

LDAP password information update failed: Insufficient access
by Paul bob 28 Jan '09

28 Jan '09

I am experiencing a problem trying to configure a ldap server for users authentication. Basically, I am at a point where users can login properly, but they can not change their password. Some info for troubleshooting: slapd.conf access info access to attr=userPassword access to * by self write by users read by anonymous auth I would appreciate your help! Thanks, bob

2 1

Hello
by Donny George 27 Jan '09

27 Jan '09

Hello I have been trying to set up an Ldap server with openssl certificates. the certificates were generated and the ldap were given access to them but once slapd restart was put it, we received an error *main*: *TLS init def ctx failed*: -207 does some one have a clue as to why this comes up ? -- Donny George

1 0

Syslog and symas openldap
by ian.g.fox＠bt.com 26 Jan '09

26 Jan '09

Hi, I am using Symas' OpenLDAP s/w on a solaris 10 box. The package I have installed is symas-openldap-silver-2.4.12.0.sun4u.pkg. # pkginfo -l symas-openldap-silver PKGINST: symas-openldap-silver NAME: Symas OpenLDAP Silver CATEGORY: application ARCH: sun4u VERSION: Dev Release 10/17/2008 BASEDIR: / PSTAMP: gamba20081017182137 INSTDATE: Dec 09 2008 16:36 STATUS: completely installed FILES: 279 installed pathnames 24 directories 72 executables 60155 blocks used (approx) I want to get syslogging from slapd out to a file. I have configured /etc/syslog.conf with the following lines: # LDAP logging local4.debug /var/log/slapd.log The file /var/log/slapd.log exists: # ls -l /var/log/slapd.log -rw-r--r-- 1 root root 0 Dec 10 09:25 /var/log/slapd.log and I have restarted syslog: # svcadm restart svc:/system/system-log In /opt/symas/etc/openldap/slapd.conf I have included a line: loglevel -1 and restarted my slapd server using: /opt/symas/etc/solserver restart Having done all this I am still not getting anything written out to /var/log/slapd.log. Does anyone know what I need to do to get this working please? My regards Ian G Fox

1 0

Re: web apps and client certificate authentication
by Kurt Zeilenga 25 Jan '09

25 Jan '09

On Jan 11, 2009, at 10:07 AM, Emmanuel Dreyfus wrote: > Hello > > I am not sure this is the right place for that question, but I cannot > figure a better one. Please point me to the right place if there is a > better one than here. [[from openldap-software]] > > > I know how to use x509 certificate to authenticate a client against > OpenLDAP. It works great with ldap{search|add|modify|delete| > whatever}.` > > Now I would like to do the same with the client being a web browser > and > with a web application between the browser and slapd: > > browser (client cert) --> apache (PHP web application) --> slapd > > Client certificate authentication from the browser to apache is > strightforward. Yes, so why complicate it? > > > Therefore I can easily have the client authenticating to the web > application, and the web application operating on the directory on > behalf on the client (the web app should bind to the directory as a > privilegied user that would have authzTo: *) The web application should just authenticate as itself and then use proxy authorization to act on behalf of the client. Of course, it has to be authorized to do so. > > > But it would be nicer to actually have the client authenticate to > slapd > using its own client certificate. Why? Generally, the web application is part of the service which encompasses the web server and directory service. They should already have an appropriate trust relationship. > That is, having the web application > behaving as a kind of proxy, without any special privilege on the > directory. Is that possible? If it is, where should I start? Would require cooperation between the web server and the directory server. So nothing gained, IMO, except complexity. > > > -- > Emmanuel Dreyfus > http://hcpnet.free.fr/pubz > manu(a)netbsd.org

4 12

OpenLDAP locks
by Gaëtan Slongo 24 Jan '09

24 Jan '09

Hello all, I saw on a book that OpenLDAP locks parent entries when an entry is updating... It's true ? Example : If I'm updating "uid=username,ou=Users,dc=mydomain", "ou=Users,dc=mydomain" and all children will be locked (write lock?) while the update is performing ?? Thanks. -- Slongo Gaëtan Tel: +32 (0)65/84.23.85 (+6005) GPG/PGP : http://www.gslongo.eu/gslongo_it-optics.pub.asc -- OpenPGP E-Mail Security : http://enigmail.mozdev.org/home/index.php

2 1

LDAP data for JUnit
by yukti kaura 24 Jan '09

24 Jan '09

Hi All, I am using LDAP as a back end for my application. Howeve my JUnit have become LDAPServer dependant. i.e. they read the data from a particular server which I specify as the ldapUrl Do we have a mechanism that for the testing purpose alone I can introduce a static LDIF file ported alongwith the code. The JUnit will then read from LDIF in a manner that they read from LDAP Server. Is there such a method?? Please guide... Thanks for all your help!!!! Yukti Kaura

1 0

openldap C sdk help
by Sankhadip Sengupta 24 Jan '09

24 Jan '09

Hi , I am a developer and I have set up openldap2.4.12 and wrote an ldap client in C using the ldap C sdk. Over lan everything looks fine but when I try to connect and do the same thing over an external IP it fails saying ldap_bind_s :Can;t contact ldap server(-1). The server runnign with d127 shows " error:broken pipe connection reset by peer " Could you please help me? Thanks Sankhadip

1 0

Self-signed server cert within our corp = failure
by Jeff Blaine 23 Jan '09

23 Jan '09

OpenLDAP 2.4.11 client How do I subvert this bogusness? The cert is legit. % /usr/rcf/bin/ldapsearch -d 1 -v -ZZ -h ldap.our.com -p 4890 -D uid=jblaine -W mail=jblaine(a)our.com emailmailbox ... res_errno: 0, res_error: <Start TLS request accepted.Server willing to negotiate SSL.>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ber_scanf fmt ({eAA) ber: ber_scanf fmt (a) ber: ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (x) ber: ber_scanf fmt (}) ber: ldap_msgfree TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 2, err: 19, subject: /O=our.com/OU=Certificate Authority/CN=SuperDuper Corporation Root CA-1, issuer: /O=our.com/OU=Certificate Authority/CN=SuperDuper Corporation Root CA-1 TLS certificate verification: Error, self signed certificate in certificate chain TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed. ldap_err2string ldap_start_tls: Connect error (-11)

4 5

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical