openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

How to disable or enable an ldap user account
by RamakrishnaDeepak Battu 22 Oct '08

22 Oct '08

Hello everyone, Can any one point me to how u can disable/enable an ldap user account.Thanks in advance. regards, deepak.

7 6

LDAP proxy for AD
by Lynn York 22 Oct '08

22 Oct '08

Hello, I have been attempting to use openldap as a proxy to AD with no success. I have attempted multiple different ways that I found online. I am able to get the proxy server to connect to AD, but I cannot get a client server to connect through the proxy to the AD server. Can anyone suggest anything? -Lynn

7 22

TLS not working (even though SSL does) -- logging trouble
by Kyle Barger 21 Oct '08

21 Oct '08

I have an OpenLDAP 2.3 server that is up and running. I have been trying to add SSL and TLS. SSL connections on port 636 work fine. However the TLS connection on 389 is not working. The only errors are "TLS accept failure" and "TLS negotiation failure." I've not been able to dig up any more information, even using the -d option, and I notice that people have posted log files with detailed TLS trace messages. How can I enable the TLS logging to find out what's going on? Thanks. -- Kyle Barger Director of Information Systems The Lutheran Theological Seminary at Philadelphia (For questions about your computer, network, or telephone service, email helpdesk(a)ltsp.edu)

2 1

Issue while implementing Password Policy
by daljeet.mehta＠wipro.com 21 Oct '08

21 Oct '08

Hi, I am trying to implement password policy in OpenLDAP. There are already similar postings on the same issue. But I tried all the possible solutions and now I am really tired after one week. Here are the details about my problem Operating System: Red Hat Linux ES 5.0 OpenLDAP Release: 2.3.39 During the addition of userPassword node I get the following error. ldapadd -f /root/openldap/openldap-2.3.39/servers/slapd/schema/paswd_policy1.ldif -D "cn=Manager,dc=xyz,dc=com" -w secret -x adding new entry "cn=default,ouname=ppolicy,oname=P_Policy,dc=xyz,dc=com" ldapadd: Invalid syntax (21) additional info: pwdAttribute: value #0 invalid per syntax Then after reading some of the issues related to it, I tried every possible solution. I added overlay path in my slapd.conf and I got the following error. ./slapd -f /root/openldap/openldap-2.3.39/servers/slapd/slapd.conf -d 1 @(#) $OpenLDAP: slapd 2.3.39 (Aug 25 2008 11:38:51) $ root@localhost.localdomain:/root/openldap/openldap-2.3.39/servers/slapd <mailto:root@localhost.localdomain:/root/openldap/openldap-2.3.39/server s/slapd> daemon_init: listen on ldap:/// <ldap:///> daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap:/// <ldap:///> ) daemon: listener initialized ldap:/// <ldap:///> daemon_init: 2 listeners opened slapd init: initiated server. slap_sasl_init: initialized! bdb_back_initialize: initialize BDB backend bdb_back_initialize: Sleepycat Software: Berkeley DB 4.3.29: (September 12, 2006) hdb_back_initialize: initialize HDB backend hdb_back_initialize: Sleepycat Software: Berkeley DB 4.3.29: (September 12, 2006) overlay "ppolicy" not found slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. Following is my configuration file snapshot:- # This file should NOT be world readable. # include /root/openldap/openldap-2.3.39/servers/slapd/schema/core.schema include /root/openldap/openldap-2.3.39/servers/slapd/schema/local.schema include /root/openldap/openldap-2.3.39/servers/slapd/schema/java.schema include /root/openldap/openldap.3.39/servers/slapd/schema/inetorgperson.schema #include /root/openldap/openldap-2.3.39/servers/slapd/schema/ppolicy.schema include /etc/openldap/schema/ppolicy.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org <ldap://root.openldap.org/> pidfile /var/run/slapd.pid argsfile /var/run/slapd.args # Load dynamic backend modules: modulepath /root/openldap/openldap-2.3.39 modulepath /servers/slapd/overlays modulepath /usr/sbin moduleload ppolicy.la moduleload back_hdb.la moduleload back_monitor.la #modulepath %MODULEDIR% # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la moduleload ppolicy.la moduleload /root/openldap/openldap-2.3.39/libraries/libldap overlay ppolicy ppolicy_default "cn=default,ouname=ppolicy,oname=P_POLICY,dc=xyz,dc=com" ppolicy_use_lockout #overlay ppolicy #overlay refint # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=xyz,dc=com" rootdn "cn=Manager,dc=xyz,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq Trust me I did R & D for 7 days. Even I did a free installation of same version and of newer version(2.4.11 release) also I got the same error. Can you please tell me the steps to make this working. Now it has become matter of life and death for me and I will do possibly anything resolve it. Thanks in advance for your help. Thanks & Regards, Daljeet Mehta Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

2 1

referral and replication
by jakjr 21 Oct '08

21 Oct '08

Hi all, I'm using slapd 2.3.30-5 on Debian Etch. I have 1 provider and 2 consumers using refreshAndPersist replication. The replication works fine, but when I add a referral object on provider, this object is not replicate to the consumers. Is normal not replicate referrals ?? Thanks João Alfredo.

1 1

How to implement Extended DNs for Samba4?
by Andrew Bartlett 21 Oct '08

21 Oct '08

At the CIFS plugfest it became clear that Samba3 requires that we complete the implementation of 'extended DN' replies in the Samba4 LDAP server. This means that a DN in things like memberOf are in the form: <GUID=0bc11d00-e431-40a0-8767-344a320142fa>;<SID=S-1-2-3-2345>;cn=abartlet,cn=users,dc=abartlet,dc=net (or so, I've just made this one up) If the magic 'extended DN' control is specificed, then we have to return this form to the client, and it would work really well to store it in that form on the backend, and if they do not specify the control, only then strip it back to the 'normal' DN. The problem is now particularly how to implement these locally - inside Samba4 it should be pretty easy to have the right triggers in the existing memberOf module, but how to implement this in OpenLDAP and (eventually) FedoraDS. Currently OpenLDAP uses the refint and memberOf modules, knowing that this attribute is simply a DN, nothing more. These modules (and probably the input validation) will no doubt be unable to cope with the 'extended' DN form. Is it reasonable to ask that OpenLDAP carry a module so Samba-specific in it's application (reading the objectSid and entryUUID and formatting the link that way)? Should we try to just fill this in with another search as part of the search entry callback? (at great performance cost). Any thoughts? Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. http://redhat.com

3 8

LDAP + SSH + Key Auth
by openLDAP 17 Oct '08

17 Oct '08

I would like to use public keys on my OS X servers for my LDAP users to use SSH. All indications from the OSX list is that it is not possible. I was hoping someone on this list could confirm that LDAP/Key Pair/SSH is not possible or point me in the right direction to where someone has figured it out. I would like to centrally control SSH access and not have to have local accounts on all of my servers. Any help is appreciated.

3 3

What is the Difference between a LDAP client Prompting for Password as opposed ...
by Kumar, Amit H. 17 Oct '08

17 Oct '08

Hello All, Scenario: OpenLDAP Client Machine <-----talking------> OpenLDAP Server Machine. Both Client and Server are two different machines. What is the Difference between an OpenLDAP client Prompting for Password and then authenticating with the OpenLDAP server via TLS as opposed to : An OpenLDAP client redirecting the authentication request to an OpenLDAP server to prompt for the password and do the authentication. What kind of setup would we require if we want the OpenLDAP Server to prompt for the password and do the authentication for an end user to login onto the OpenLDAP client machine. Any thoughts will be of great help!!! Thank you, Amit

1 0

multiple suffix
by Kermito le kermit 15 Oct '08

15 Oct '08

hello all i want to know if is possible to have multiple suffix to same database ex: suffix dc=exemple,dc=org suffix dc=msn,dc=com any ideas

5 6

Complete list of APIs?
by Brad T Waldorf 14 Oct '08

14 Oct '08

Hi. Does a complete list of client APIs from ldap.h exist? The list provided in the "INDEX" section of the 'ldap' man page doesn't seem to contain all APIs. http://www.openldap.org/software/man.cgi?query=ldap&sektion=3&apropos=0&man… +2.4-Release Thanks

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical