openldap-technical

openldap-technical@openldap.org

5 participants
9991 discussions

objectClass: ...
by Brian Krusic 06 Feb '09

06 Feb '09

Hi all, I'm back to ask for proper population of ldap dirs so I start with good habits. I've done all three on test servers and haven't noticed any functional issues. What is the best way to define my top level nodes; objectClass: dcObject objectClass: organizationalUnit or objectClass: top objectClass: dcObject objectClass: organization or objectClass: domain Humbly your, - Brian

3 3

Moving Old Certs to New Servers
by James Angell 05 Feb '09

05 Feb '09

Hi Guys, We have just built new replacement LDAP servers and are about to make to switch from the old ones. All of the certs we use are currently authenticated against the old servers. Does anyone know if it is possible to use these certs to authenticate against the new servers or are we going to have to create all new certs for all servers and workstations? Thanks in advance. - Jim -- Regards Jim Angell Cade Network Operations College Of Engineering Phone: 581-7551

1 0

RE: Forgotten password recovery
by Brett Maxfield 05 Feb '09

05 Feb '09

Maybe generate a random challenge, store it in ldap as an additional hashed password value maybe with a special {challenge} hash type as a marker, assuming ldap will try *all* passwords when logging in. openldap would need to know the marker {challenge} hash type is like {plain} or some other hash type for purposes of comparison. You cannot allow reset of a password (destroying the old one) immediately, as otherwise you are allowing a denial of service attack where people could randomly reset passwords. But given the random challenge (returned by the user) could now be used for authentication, the user could authenticate as themselves and reset thier own password, and remove the temporary challenge password. This probably requires a marker "hash" type to identify temporary hash password, to allow reliable removal of old or expired challenge passwords. -----Original Message----- From: Vincent Panel <yohonet(a)gmail.com> Sent: Thursday, 5 February 2009 1:59 AM To: openldap-technical(a)openldap.org Subject: Forgotten password recovery On 2/4/09, Michael Ströder <michael(a)stroeder.com> wrote: > Yes, but these "temporary security objects" have to be generated. If you > do this automagically you have a privileged service account which resets > the user's password in combination with a e-mail based > challenge-response check. I agree, but until I get your replies, I did not find any satisfying solution integrating this "e-mail based challenge-response check". I wanted the ldap server to validate the challenge which is going to be possible if I make drupal create those security objects with the challenge answer as the password. Once a user comes back with its response to the challenge, drupal will try to bind to the LDAP server as this temporary security object with the password being the "challenge" url. If the bind is successful, then drupal will automatically be granted the right to reset the corresponding user's password (thanks to regex ACLs). Once this is done, the user will be able to log in (or actually, drupal will log the user in) This is probably a bit complex to implement, but I'm gonna try.

3 2

[openldap] Newbie question: can the server (slapd) show incoming search queries?
by sol myr 05 Feb '09

05 Feb '09

Hi, I'm new to ldap, and would appreciate help on the following: I'm running the stand-alone server (slapd), and allow some client machines run search queries against it (ldapsearch). My question: I'd like the "slapd" server to show the incoming search queries. Can it be done? For example: - If the client runs "ldapsearch -h myhost -b "dc=example,dc=com" -s sub "objectclass=*" - I'd like the server console(or log file) to show something like: Incoming query: -b "dc=example,dc=com" -s sub "objectclass=*" I'd tries running "slapd" in debug mode (slupd -d 1), but couldn't quite deduce the query from it (it logs lot of detailed lines, but I couldn't gather the qeury from them. Probably my fault for being a newbie). Thanks :)

3 2

slave dbd files and timestamps
by Ken McLauchlin 05 Feb '09

05 Feb '09

Hi there, We're running openldap 4.1.25 on 4 servers. 2 servers on a site running in master/slave configuration and 2 more on a remote site running as slaves receiving updates from the slurpd running on the master. The question I have isn't really anything to do with the configuration but with what files should be updated on the remote slave servers on update? The slave running at the same site as the master has all the files (dc.bdb, db2id.bdb, id2entry.bdb and objectClass.bdb) all updated with the same timestamp. However on the remote slaves the objectClass.bdb is NOT updated at the same time as the others. Is this a problem? As an aside, we are getting a log.00000xxxx file created every couple of days on the remote slave servers which isn't happening on the primary site slave server. Is this a configuration issue? Hope you can help. Cheers, Ken

1 0

Forgotten password recovery
by Vincent Panel 04 Feb '09

04 Feb '09

On 2/4/09, Michael Ströder <michael(a)stroeder.com> wrote: > Yes, but these "temporary security objects" have to be generated. If you > do this automagically you have a privileged service account which resets > the user's password in combination with a e-mail based > challenge-response check. I agree, but until I get your replies, I did not find any satisfying solution integrating this "e-mail based challenge-response check". I wanted the ldap server to validate the challenge which is going to be possible if I make drupal create those security objects with the challenge answer as the password. Once a user comes back with its response to the challenge, drupal will try to bind to the LDAP server as this temporary security object with the password being the "challenge" url. If the bind is successful, then drupal will automatically be granted the right to reset the corresponding user's password (thanks to regex ACLs). Once this is done, the user will be able to log in (or actually, drupal will log the user in) This is probably a bit complex to implement, but I'm gonna try.

1 0

Re: Forgotten password recovery
by Vincent Panel 04 Feb '09

04 Feb '09

Thanks, but as discussed, even creating a user able to reset all the userPassword attributes of all other users is not security risk free. This is what I call a privileged user and I would like to avoid it. Drupal already supports such a solution, but I don't find it secure enough. I had an interesting suggestion on the list : to create a database of temporary security objects where drupal is the only one who knows the passwords. Each temporary security object is able to reset one password in the main database (by the use of regex ACLs) and only once. On 2/4/09, Brett Maxfield <brett.maxfield(a)gmail.com> wrote: > If we are talking about openldap, not drupal, there are probably many ways > of doing so.. My thoughts.. > > You cannot bind as the user in this case, as presumably the reason they want > to reset password is that they dont know it. > > You should probably give the website it's own standard read-only user, which > has been (only) allowed to update userPassword. > > Giving the website manager/root access just to change a password would be > extremely unwise and inasvisable. > > Drupal should let you specify any ldap user for password resers.. > > -----Original Message----- > From: Vincent Panel <yohonet(a)gmail.com> > Sent: Wednesday, 4 February 2009 2:16 AM > To: openldap-technical(a)openldap.org > Subject: Forgotten password recovery > > Hello, > > Many websites now provide a feature which allow users to reset their > password on their own, without being helped by an administrator or > another privileged person. > > A website I'm working on is using drupal which is able to handle such > a situation by sending a mail to the user. The body of this mail > contains a specific url crafted by drupal so that when the user clicks > on the link, drupal can automatically authenticate the user. This URL > is only valid once. > > If you try to integrate drupal with openldap, you'll find that > openldap does not support such an authentication scheme. So you are > either forced to create a privileged user in LDAP which is able to > reset all users' passwords or live with it and give up this feature. > > So I'm writing to this list to know if anyone already had a similar > issue and which solution was found ? Would it be possible for openldap > or an openldap overlay to implement such an authentication mechanism ? > Is there any IETF draft about it (one can dream) ? > > Vincent > >

2 1

user home directory perms
by Geoffrey 04 Feb '09

04 Feb '09

We are using a combination of ldap and samba, therefore are adding users via the smbldap-useradd script. How do we set the permissions for the home directory when the user logs in for the first time. The directories are being created, but not with the permissions we want. Thanks. -- Until later, Geoffrey Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. - Benjamin Franklin

1 0

Forgotten password recovery
by Vincent Panel 04 Feb '09

04 Feb '09

Hello, Many websites now provide a feature which allow users to reset their password on their own, without being helped by an administrator or another privileged person. A website I'm working on is using drupal which is able to handle such a situation by sending a mail to the user. The body of this mail contains a specific url crafted by drupal so that when the user clicks on the link, drupal can automatically authenticate the user. This URL is only valid once. If you try to integrate drupal with openldap, you'll find that openldap does not support such an authentication scheme. So you are either forced to create a privileged user in LDAP which is able to reset all users' passwords or live with it and give up this feature. So I'm writing to this list to know if anyone already had a similar issue and which solution was found ? Would it be possible for openldap or an openldap overlay to implement such an authentication mechanism ? Is there any IETF draft about it (one can dream) ? Vincent

3 4

best practices - dn:
by Brian Krusic 03 Feb '09

03 Feb '09

Hi all, I've read and config'd my ldifs as follows; option 1; dn: uid=fbar,ou=People,dc=company,dc=com uid: foo sn: Bar mail: foo(a)company.com cn: Foo Bar objectClass: inetOrgPerson objectClass: apple-user objectClass: shadowAccount objectClass: posixAccount objectClass: top uidNumber: 1000 gidNumber: 20 loginShell: /bin/tcsh homeDirectory: /homes/fbar apple-user-homeDirectory: /homes/fbar userPassword:: agbeirrklflhfihverrrknv= option 2; dn: cn=Foo Bar,ou=People,dc=company,dc=com uid: foo sn: Bar mail: foo(a)company.com cn: Foo Bar objectClass: inetOrgPerson objectClass: apple-user objectClass: shadowAccount objectClass: posixAccount objectClass: top uidNumber: 1000 gidNumber: 20 loginShell: /bin/tcsh homeDirectory: /homes/fbar apple-user-homeDirectory: /homes/fbar userPassword:: agbeirrklflhfihverrrknv= My OpenLDAP server is used for company white pages and authentication for Linux, OSX clients. What do you think the most reliable dn value should be; with uid or with cn? - Brian

2 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical