openldap-technical

openldap-technical@openldap.org

21 participants
9787 discussions

Help with authz-regexp mapping kerberos identity to dn ....SASL
by Chavez, James R. 11 Aug '08

11 Aug '08

Hello all, My plan is to use Kerberos and LDAP as a replacement for NIS. My issue is that I need my kerberos credentials to map to a user in LDAP so I can avoid permission issues when logging in with kerberos creds. All the perms are based on the UNIX/LDAP users and groups. Thing is the user id's are different between kerberos and LDAP. The kerberos names consist of firstname_lastname@REALM. The ldap entries are in the format of standard Unix user names or first letter of first name and up to 7 characters of the last name (jmontana). I migrated the LDAP entries from my existing NIS maps. Now I understand that I can use SASL and authz-regexp in slapd.conf to map these id's. Please correct me if I am wrong. I added all the corresponding "krbName: first_last@REALM" to the users when I added them to the LDAP directory. For example for user Joe Montana..His ldap dn is "dn: uid=jmontana,ou=People,dc=test,dc=example,dc=com" His uid is "uid: jmontana And his Krb name is ""krbName: joe_montana(a)TEST.EXAMPLE.COM" I think all the data is there to get a mapping I just am unsure of the auth-regexp strings I need to add to the slapd.conf file. Does anyone out there have any experience with this and better yet provide the string or example of what strings I can use? I have searched the net on how to authenticate with kerberos and effictively login with a local id but have been unsuccessful in my search. Appreciate any help. Thank You James CONFIDENTIALITY This e-mail message and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail message, you are hereby notified that any dissemination, distribution or copying of this e-mail message, and any attachments thereto, is strictly prohibited. If you have received this e-mail message in error, please immediately notify the sender and permanently delete the original and any copies of this email and any prints thereof. ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS E-MAIL IS NOT INTENDED AS A SUBSTITUTE FOR A WRITING. Notwithstanding the Uniform Electronic Transactions Act or the applicability of any other law of similar substance and effect, absent an express statement to the contrary hereinabove, this e-mail message its contents, and any attachments hereto are not intended to represent an offer or acceptance to enter into a contract and are not otherwise intended to bind the sender, Sanmina-SCI Corporation (or any of its subsidiaries), or any other person or entity.

2 1

Updating password in slave ldap server
by Gustavo Mendes de Carvalho 11 Aug '08

11 Aug '08

Hi All, I have 2 LDAP Servers (1 master and 1 slave) and I synchronize bdb database by slurp daemon. So, when somebody needs to update his/her password or other information, everything is done in master server and then slave server receives this updates. This 2 servers are in the same physical place. Now I am planning to put another LDAP slave in other geographical place (far from this 2 servers) and because of that I am planning to put some slave server receiving all updates from master server, but in all ldap client machines in this new location I would like to configure this new slave server (Slave server 2) as URI host in ldap.conf files. I mean Location 1: Master server 1 and slave server 1 Location 2: Slave server 2 Is there any way to do: 1. ldap client machines in location 2 to authenticate using Slave server 2 ? 2. when client machines needs to change some ldap information (like password or personal information), to force this update to occurs in slave server 2 and then master server 1 receives this uodate ? Do I have to use 2 Master servers (1 in each location) ? If yes, can I synchronize both BDB databases ? How ? Any other suggestions ? Thanks in advance --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com

3 4

using query filter with dynlist attributes
by Rahul Amaram 09 Aug '08

09 Aug '08

Hi, I would like to know if it is possible to use the dynamic attributes (obtained by dynlist overlay), in a ldapsearch query filter. I have tried using it but it does not seem to be working. Is there any fix for this or is there any other overlay which will allow me to perform an operation similar to sql join across different DN? Thanks and Regards, Rahul.

2 1

RE: LDAP Group Membership Scalability
by Jeff Sussna 08 Aug '08

08 Aug '08

Fantastic! What I was hoping/expecting to hear :-). ________________________________________ From: Gavin Henry [ghenry(a)OpenLDAP.org] Sent: Friday, August 08, 2008 4:57 PM To: Jeff Sussna Cc: openldap-technical(a)openldap.org Subject: Re: LDAP Group Membership Scalability Jeff Sussna wrote: > I am looking into using OpenLDAP to manage users and groups for my > system. A single group may contain up to 50,000 users. Does the LDAP > group membership mechanism suffer any scalability problems at that size? > > --------------------------------------------------------------- > Jeff Sussna > No. Some fortune 50s have every employee in an OpenLDAP Dynamic Group. -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

LDAP Group Membership Scalability
by Jeff Sussna 08 Aug '08

08 Aug '08

I am looking into using OpenLDAP to manage users and groups for my system. A single group may contain up to 50,000 users. Does the LDAP group membership mechanism suffer any scalability problems at that size? --------------------------------------------------------------- Jeff Sussna

3 2

Using logical operators in LDAP queries.....
by ashish mahamuni 08 Aug '08

08 Aug '08

Hello everybody... I've my own objectClass called 'Agency'. It has fields called 'radius' and 'agencyName'. I want to find out all 'agencyNames' such that 'radius' is less than 400. How can I achieve this? Regards Ashish Unlimited freedom, unlimited storage. Get it now, on http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html/

3 4

Basic Master/Slave replication, take slave down, slave hangs
by Brad T Waldorf 07 Aug '08

07 Aug '08

This may be problem that's been fixed from 2.4.6 to 2.4.11. I'm hoping someone recognizes it and can confirm it's been fixed. (We committed to 2.4.6 for the short term future.) We've got basic refreshAndPersist replication working fine. Replication declarations from the master slapd.conf... overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 Replication declarations from the slave slapd.conf.... syncrepl rid=123 provider=ldap://<masterIP>:389 type=refreshAndPersist retry="120 +" searchbase="o=replDB" bindmethod=simple binddn="cn=replman,o=replDB" credentials=password When we shut down the slave, the slave hangs. Here's the debug log... daemon: closing 12582954+ slapd shutdown: waiting for 1 threads to terminate+ =.do_syncrepl rid=123+ connection_get(12582955)+ connection_get(12582955): got connid=0+ daemon: removing 12582955r+ ldap_free_request (origid 2, msgid 2)+ ldap_free_connection 1 1+ ldap_send_unbind+ ber_flush2: 7 bytes to sd 12582955+ 0000: 30 05 02 01 03 42 00 0....B. + ldap_write: want=7, written=7+ 0000: 30 05 02 01 03 42 00 0....B. + ldap_free_connection: actually freed+ We think the problem is with the following code in tpool.c. Specifically, ltp_open_count has a value of 1, so we're stuck in a loop. If we set ltp_open_count to 0, the server comes down properly. At that point we can restart it again. while (pool->ltp_open_count) { if (!pool->ltp_pause) ldap_pvt_thread_cond_broadcast(&pool->ltp_cond); ldap_pvt_thread_cond_wait(&pool->ltp_cond, &pool-> ltp_mutex); } Does this problem look familiar to anyone? Once again, we apologize for being on a backlevel release... but we committed to 2.4.6 for the first release, which is coming up shortly. We'll be upgrading for future releases... and we're hoping this problem (if it is a real problem) has been fixed. Thanks in advance...

2 1

RE : [BSD7.0] Openldap Server - Client 2.3.41 / Unknow user UID
by karim.bourenane＠orange-ftgroup.com 07 Aug '08

07 Aug '08

Hi All I found my error about this problem. I correct the right of certificate ssl files. Regards for all Karim Bourenane 112 Av. Charles de Gaules 92520 Neuilly S/Seine Phone: +33156 76 35 52 Fax: +33156 76 35 04 http://www.equant.com <http://www.equant.com/> ********************************* This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. Messages are susceptible to alteration. France Telecom Group shall not be liable for the message if altered, changed or falsified. If you are not the intended addressee of this message, please cancel it immediately and inform the sender. ********************************

1 0

mail Routing thorugh openldap attribute
by Aravind Arjunan 07 Aug '08

07 Aug '08

hi, I had configured mailserver in postfix and integrated openldap with postfix. All my users information is in openldap. Now i need to route my mail for particular user to his respective mail box. eg: user1(a)afnet.com to machine1 user2(a)afnet.com to machine2 So in openldap i had added attribute like for user1 mail: user1(a)afnet.com mailHost: machine1(IP) or Hostname mailRoutingAddress: user1(a)afnet.com for user2 mail: user2(a)afnet.com mailHost: machine2(IP) or Hostname mailRoutingAddress: user2(a)afnet.com In /etc/postfix/main.cf queryfilter = (mail=%s) resultattribute = mailRoutingAddress So when i send mail to user1 , it will first check the mail address is correct or not from ldap entries and check mailHost for the particular user and must go the particular SMTP server where i had mentioned in mailHost attribute in ldap. But for me it is checking the mailHost attribute and i had mentioned the IP of the SMTP server in my LDAP for mailHost attribute.So for me it checks the mailHost attribute and delivering the mail in the same SMTP server by creating the IP as the username and droping the mail Any body plz guide me home to route the mail to the particular user .

2 1

VMware and mirror/multimaster
by Dave Horsfall 05 Aug '08

05 Aug '08

Has anyone tried mirroring or multimaster under VMware i.e. are the virtual clocks stable enough? We're starting to use VMware to cut down on the number of physical hosts, but I'd like to use the latest 2.4 features as well. -- Dave Horsfall DTM VK2KFU Ph: +61 2 9552-5509 (direct) +61 2 9552-5500 (switch) Corinthian Eng'ng P/L, Ste 54 Jones Bay Whf, 26-32 Pirrama Rd, Pyrmont 2009, AU

5 11

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical