openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

LDAP Host access best practices
by Mathew Rowley 07 Jan '09

07 Jan '09

I am fairly new to LDAP in general, so please excuse any syntax errors. I have a radius proxy which will query an LDAP data store to determine if a user has access to a host. I want to reuse the concept of how users are defined: Ou=users -> defines all users Ou=groups -> defines all groups Ou=groups,cn=groupname -> links the users to the group With hosts. My problem is that I cannot find any specific formal definition on how this is done (in terms of what each subtree¹s objectClass should be). Has anyone done this, or can point me in the right direction? All the user/groups based stuff is based on posixGroup, which im pretty sure is unix/linux concept can this be used for what I am trying to do with hosts? Basic architecutre: Ou=hosts -> defines a host Ou=hostGroups -> defines a group name (organizationlUnit?) Ou=hostGroups,cn=hostGroupName -> this will link what hosts are in the group Thanks for any help. -- MAT

1 0

replication on 2.4.13
by jakjr 07 Jan '09

07 Jan '09

Hello, I'm testing a multimaster config on openldap 2.4.13. I have 2 servers. Adds and Modifies are ok on both. But, when I deleted 300 entries, with server B down and this server goes up again, those entries deleted from server A are no replicated. Server B still keeping those entries. This is a bug or a config error. This is my config: ServerID XXX syncrepl rid=001 provider=ldap://<IP> type=refreshAndPersist retry="5 5 10 +" searchbase="dc=br" bindmethod=simple binddn="cn=admin,dc=br" credentials=** schemachecking=off mirrormode on overlay syncprov syncprov-checkpoint 100 1 syncprov-reloadhint TRUE syncprov-sessionlog 100 Thanks

1 1

authenticate a user to LDAP server using GSS-SPNEGO and Kerberos
by Deepika Srivastava 07 Jan '09

07 Jan '09

Hi I have to authenticate a user to LDAP server using GSS-SPNEGO and Kerberos as base mechanism. I have successfully generated the TGT. Now I want to use ldap_sasl_bind_s() function with "GSS-SPNEGO" as mechanism. I am not sure of the parameters to pass. I read on http://publib.boulder.ibm.com/infocenter/iseries/v5r3/index.jsp?topic=/apis… in case of Kerberos,we can use the above mentioned ticket if we have the TGT.Just we need to pass 'cred' and 'dn' as NULL and the functional will automatically take care of the rest of the mechanism under covers. ldap_sasl_bind_s (g_hLDAP,"", "GSS-SPNEGO" ,NULL,NULL,NULL, &servercredp ) This is how I am calling the function but is throwing LDAP_PARAM_ERROR. I am not sure of the reason. Can anyone help me on the reason? Also i wanted to know that do we need to any configurations at the LDAP server end to do enable kerberos authentication. Also do i need to call krb5_mk_req() before calling ldap_sasl_bind_s() or can i directly call ldap_sasl_bind_s()? Can anyone help me on the flow of API for achieving complete authentication after achieving the kerberos ticket. . Any thoughts?

2 1

ldap.conf location help
by Sankhadip Sengupta 07 Jan '09

07 Jan '09

Hi, I am trying to make a client which will query users via an LDAP server.Now in the code I use TLS to encrypt the session. Using TLS , I face a problem that the client is unable to verify the server certificate. Connect error(-11) ssl error(1490086). When I use ldapsearch to do that it works fine.I have LDAP server on the same machine and running via loopback. I figured this problem is due to location of ldap.conf file as when I changed the entry of TLS_CACERT in the ldap.conf file (commented it out) the ldapsearch also failed which shows it is unable to locate the certificate. Is there any way to make sure that the client tools always find the correct ldap.conf file? Please help. Sankhadip

1 0

Question about ldap filter
by Jason Voorhees 06 Jan '09

06 Jan '09

Hi there: I'm trying to understand how ldap filters work. Based on this simple logic expression: EXPR_1 (or) EXPR_2 if EXPR1 returns TRUE, will slapd still try to evaluate EXPR2? or will slapd evaluate EXPR2 anyway even if EXPR_1 is true? I think that while the ldap filter is bigger then performance is worse, right? could somebody explain me a little about this logic of evaluation in ldap filters? Thanks

3 7

acl to allow access to specific parts of the tree only for a particular dn
by ben thielsen 06 Jan '09

06 Jan '09

i'd like to prevent the dn "cn=foo, ou=services, ou=accounts, dc=example, dc=com" from accessing any part of the tree outside of "ou=test, ou=other, ou=users, ou=accounts, dc=example, dc=com" and "ou=test, ou=other, ou=users, ou=groups, dc=example, dc=com", and would like that dn to have only read access to those two subtrees - the exception being that that user should of course be able/required to authenticate. i'm having trouble constructing a working acl that accomplishes this. one example attempt: dn: olcDatabase={2}bdb,cn=config changetype: modify replace: olcAccess olcAccess: to dn.base="" by * read olcAccess: to attrs=userPassword by self write by anonymous auth by * none olcAccess: to dn.subtree="ou=montage_test,ou=other,ou=users,ou=accounts,dc=ltn,dc=lvc,dc=com" by dn.exact="cn=montage_test,ou=services,ou=accounts,dc=ltn,dc=lvc,dc=com" read by self write by users read by * none olcAccess: to dn.subtree="ou=montage_test,ou=other,ou=users,ou=groups,dc=ltn,dc=lvc,dc=com" by dn.exact="cn=montage_test,ou=services,ou=accounts,dc=ltn,dc=lvc,dc=com" read by self write by users read by * none olcAccess: to * by self write by dn.exact="cn=montage_test,ou=services,ou=accounts,dc=ltn,dc=lvc,dc=com" none by users read by * none that particular example gets me: >ldapsearch -uxLLLWP 3 -H 'ldaps://ldap.ltn.lvc.com' -D 'cn=montage_test, ou=services, ou=accounts, dc=ltn, dc=lvc, dc=com' -b 'dc=ltn, dc=lvc, dc=com' "(objectclass=groupofnames)" dn | grep -i 'dn:' Enter LDAP Password: No such object (32) what am i missing? thanks -ben

1 0

problem with ldap_start_tls_s
by Sankhadip Sengupta 06 Jan '09

06 Jan '09

Hi everyone, I am trying to write an LDAP browser that uses both plain text and TLS.The plain text works fine but when I am using "ldap_start_tls_s" I get an error: ldap_start_tls: Connect error (-11) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Also just to note ldapsearch works fine. ldapsearch -vLxZZ -b "dc=example,dc=com" "(objectClass=*)" no problem with this. My code fragment is below: if ((ld = ldap_init(ldap_host, LDAP_PORT)) == NULL ) { perror( "ldap_init failed" ); exit( EXIT_FAILURE ); } /* set the LDAP version to be 3 */ if (ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &desired_version) != LDAP_OPT_SUCCESS) { ldap_perror(ld, "ldap_set_option"); exit(EXIT_FAILURE); } if(ldap_start_tls_s(ld,NULL,NULL)!=LDAP_SUCCESS) { ldap_perror(ld, "ldap_start_tls"); exit(EXIT_FAILURE); } Please help :( Thanks, Shawn

1 0

contextCSN
by jakjr 05 Jan '09

05 Jan '09

Hello, I'm testing a multi-master installation of openldap 2.4.11 (debian lenny). To check if the masters are consistent, I search for the contextCSN of each one, and check this value. If the values are the same, the masters are consistents, rigth ?? But now, after many, many changes (ADD/DELETE), I am searching for the contextCSN and the server is reporting three contextCSN's. Is this correct ?? EG: # ldapsearch -x -h <IP> objectClass=organization contextCSN -b dc=pr,dc=gov,dc=br -LLL -z 1 dn: dc=org contextCSN: 20081226121401.392297Z#000000#000#000000 contextCSN: 20081226173429.931124Z#000000#001#000000 contextCSN: 20081226173327.189304Z#000000#002#000000 Thanks. João Alfredo

2 2

Database is getting corrupted
by Jason Voorhees 05 Jan '09

05 Jan '09

Hi all: I'm running OpenLDAP 2.3.27 from CentOS 5.2 to build from scratch an LDAP tree based on Phamm sample LDIF files. I have these database definition in slapd.conf: database bdb suffix "dc=redtube,dc=com" rootdn "cn=manager,dc=redtube,dc=com" rootpw {SSHA}5b3FNT6a3PrldYD/X58ghCXa7vhUOO24 directory /var/lib/ldap mode 660 index objectClass eq index cn,mail eq,subinitial index vd,delete eq,pres index accountActive,forwardActive eq,pres index smtpAuth eq,pres index sn,uid,displayName pres,eq,sub index uidNumber,gidNumber eq index default sub I always do the following: 1. # rm /var/lib/ldap/* (to be sure i'm starting from scratch) 2. # slapadd -b dc=redtube,dc=com redtube.ldif After step (2) I can see that /var/lib/ldap/alock has rw-r--r-- and all the other files have -w----r-T as permissions and are owned by root.root . Is that correct? Well, as far as I know they should be owned by ldap user and ldap group with 0660 permissions asigned (based on "mode" directive in slapd.conf). So I do the following: 3. # chown ldap.ldap /var/lib/ldap/* # chmod 660 /var/lib/ldap/* (/var/lib/ldap directory is 0700 and owned by ldap.ldap already) 4. I check against posible errors and then start OpenLDAP: # slapd -Tt # service ldap start 5. OpenLDAP starts correctly, it works perfectly. I can even do modificatons to the LDAP tree adding entries based on attributes like vd, cn, mail, among others. I'm aware that there are no uid.bdb created yet in /var/lib/ldap, so I guess that's ok. My problem comes when I try to perform some operation that causes OpenLDAP to create an index file in /var/lib/ldap. In example, when I try to log in with rootdn trough phpldapadmin I get something like this in logs: Dec 30 11:31:22 ha1 slapd[1889]: conn=5 fd=12 ACCEPT from IP=127.0.0.1:38395 (IP=0.0.0.0:389) Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=0 BIND dn="" method=128 Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=0 RESULT tag=97 err=0 text= Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=1 SRCH base="dc=redtube,dc=com" scope=2 deref=0 filter="(uid=cn=manager,dc=redtube,dc=com)" Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=1 SRCH attr=dn Dec 30 11:31:22 ha1 slapd[1889]: bdb(dc=redtube,dc=com): /var/lib/ldap/uid.bdb: Permission denied Dec 30 11:31:22 ha1 slapd[1889]: bdb_db_cache: db_open(uid) failed: Permission denied (13) Dec 30 11:31:22 ha1 slapd[1889]: <= bdb_equality_candidates: (uid) index_param failed (13) Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=2 UNBIND Dec 30 11:31:22 ha1 slapd[1889]: conn=5 fd=12 closed I don't know why phpldapadmin performs a search based on a filter like "(uid=cn=manager,dc=redtube,dc=com)" but well, it doesn't matter to me. Then I stop and start OpenLDAP and I start getting this: # /etc/init.d/ldap stop Stopping slapd: [ OK ] # /etc/init.d/ldap start Checking configuration files for slapd: bdb_db_open: unclean shutdown detected; attempting recovery. bdb_db_open: Warning - No DB_CONFIG file found in directory /var/lib/ldap: (2) Expect poor performance for suffix dc=mailtest,dc=com. bdb_db_open: Recovery skipped in read-only mode. Run manual recovery if errors are encountered. config file testing succeeded [ OK ] Starting slapd: [ OK ] Question is: Why can't OpenLDAP create /var/lib/ldap/uid.bdb? Why is getting permission denied messages? The hole directory /var/lib/ldap is owned by ldap user with 660 permissions. Can anybody help me? Thanks

3 6

Help with understandig behaviour of crashed OpenLDAP Server
by yukti kaura 04 Jan '09

04 Jan '09

Dear All, I would like to seek clarification with one aspect of LDAP server recovery When a crashed Server in replicated mode is restarted does it immediately start publishing its services or it publishes itself only after resynchronizing Please guide Thanks Yukti Kaura

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical