openldap-technical

openldap-technical@openldap.org

21 participants
9787 discussions

TLS Configuration - "unable to get TLS client DN, error=49"
by Brad T Waldorf 05 Aug '08

05 Aug '08

Hi. We're trying to configure a basic SSL (TLS) connection through OpenLDAP version 2.4.6. We're using Linux, Debian Version 4.0 ('etch') INTEL. The pertinent info... slapd.conf include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args loglevel -1 logfile /usr/local/var/openldap-data/logb TLSCACertificateFile /home/bwaldorf/certs/1024pcert.pem TLSCertificateFile /home/bwaldorf/certs/1024pcert.pem TLSCertificateKeyFile /home/bwaldorf/certs/1024pkey.pem TLSCipherSuite DES-CBC-SHA TLSVerifyClient never #TLSRandFile #TLSEphemeralDHParamFile ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "o=replDB" rootdn "cn=replman,o=replDB" rootpw password timelimit 1 idletimeout 4 access to attrs=userPassword by self write by anonymous auth by * none access to * by self write by * read directory /usr/local/var/openldap-data index sn,mail,uid,title eq ldap.conf TLS_CACERT /home/bwaldorf/certs/1024pcert.pem TLS_CERT /home/bwaldorf/certs/1024pcert.pem TLS_KEY /home/bwaldorf/certs/1024pkey.pem So we try the following search (-ZZ to force the command to be successful)... ldapsearch -x -D "cn=replman,o=replDB" -w password -b "o=replDB1" -ZZ And we get the following output (below) with -d -1... (sorry for the excessive messages). Looks like the problem is... "connection_read(13): unable to get TLS client DN, error=49 id=5" I did some googling for this error, but never found a thread with a cause/solution. Thanks in advance for your time and help! daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(8): daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 busy >>> slap_listener(ldap:///) daemon: activity on 1 descriptor daemon: listen=8, new connection on 13 daemon: activity on:daemon: added 13r (active) listener=(nil) conn=5 fd=13 ACCEPT from IP=127.0.0.1:32933 (IP=0.0.0.0:389)) daemon: epoll: listen=7 active_threads=1 tvp=zero. daemon: epoll: listen=8 active_threads=1 tvp=zero. daemon: activity on 1 descriptor daemon: activity on: 13r daemon: read active on 13 daemon: epoll: listen=7 active_threads=1 tvp=zero. connection_get(13) daemon: epoll: listen=8 active_threads=1 tvp=zero. connection_get(13): got connid=5 connection_read(13): checking for input on id=5 ber_get_next ldap_read: want=8, got=8 0000: 30 1d 02 01 01 77 18 80 0....w.. ldap_read: want=23, got=23 0000: 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 31 34 36 .1.3.6.1.4.1.146 0010: 36 2e 32 30 30 33 37 6.20037 ber_get_next: tag 0x30 len 29 contents: ber_dump: buf=0xa0c11fc8 ptr=0xa0c11fc8 end=0xa0c11fe5 len=29. 0000: 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 ...w...1.3.6.1.4 0010: 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .1.1466.20037 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=5 op=0 do_extended ber_scanf fmt ({m) ber: ber_dump: buf=0xa0c11fc8 ptr=0xa0c11fcb end=0xa0c11fe5 len=26 0000: 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e w...1.3.6.1.4.1. 0010: 31 34 36 36 2e 32 30 30 33 37 1466.20037 conn=5 op=0 EXT oid=1.3.6.1.4.1.1466.20037 do_extended: oid=1.3.6.1.4.1.1466.20037 daemon: activity on 1 descriptor conn=5 op=0 STARTTLS daemon: activity on:send_ldap_extended: err=0 oid= len=0 send_ldap_response: msgid=1 tag=120 err=0 daemon: epoll: listen=7 active_threads=1 tvp=zero ber_flush2: 14 bytes to sd 13 0000: 30 0c 02 01 01 78 07 0a 01 00 04 00 04 00 0....x........ ldap_write: want=14, written=14 0000: 30 0c 02 01 01 78 07 0a 01 00 04 00 04 00 0....x........ conn=5 op=0 RESULT oid= err=0 text= daemon: epoll: listen=8 active_threads=1 tvp=zero daemon: activity on 1 descriptor daemon: activity on: 13r daemon: read active on 13 daemon: epoll: listen=7 active_threads=1 tvp=zero connection_get(13) daemon: epoll: listen=8 active_threads=1 tvp=zero connection_get(13): got connid=5 connection_read(13): checking for input on id=5 TLS trace: SSL_accept:before/accept initialization tls_read: want=11, got=11 0000: 80 74 01 03 01 00 4b 00 00 00 20 .t....K....... tls_read: want=107, got=107 0000: 00 00 39 00 00 38 00 00 35 00 00 16 00 00 13 00 ..9..8..5....... 0010: 00 0a 07 00 c0 00 00 33 00 00 32 00 00 2f 03 00 .......3..2../.. 0020: 80 00 00 05 00 00 04 01 00 80 00 00 15 00 00 12 ................ 0030: 00 00 09 06 00 40 00 00 14 00 00 11 00 00 08 00 .....@.......... 0040: 00 06 04 00 80 00 00 03 02 00 80 15 2d dd 5d 9a ............-.]. 0050: f5 29 55 3b 15 f2 e5 47 18 9c 22 f2 7d 07 51 72 .)U;...G..".}.Qr 0060: 60 1f 38 61 8d 9a e7 67 2a 5e 9e `.8a...g*^..}. TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write server done A tls_write: want=985, written=985 0000: 16 03 01 00 4a 02 00 00 46 03 01 48 92 1d e7 69 ....J...F..H...i 0010: f3 a0 ea 95 0f 3b 21 71 a5 b0 11 34 27 91 b8 0b .....;!q...4'... 0020: d1 25 4f ca d5 56 fd 55 d2 0f 33 20 a7 fe 44 07 .%O..V.U..3 ..D. 0030: 8a 33 a1 ec 46 61 01 94 2a 05 9a 59 9e 95 02 ec .3..Fa..*..Y.... 0040: 99 82 42 77 1d f6 bf 6e b4 0f 05 23 00 09 00 16 ..Bw...n...#.... 0050: 03 01 03 7c 0b 00 03 78 00 03 75 00 03 72 30 82 ...|...x..u..r0. 0060: 03 6e 30 82 02 d7 a0 03 02 01 02 02 01 00 30 0d .n0...........0. 0070: 06 09 2a 86 48 86 f7 0d 01 01 04 05 00 30 81 87 ..*.H........0.. 0080: 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 11 30 1.0...U....US1.0 0090: 0f 06 03 55 04 08 13 08 4e 65 77 20 59 6f 72 6b ...U....New York 00a0: 31 15 30 13 06 03 55 04 07 13 0c 50 6f 75 67 68 1.0...U....Pough 00b0: 6b 65 65 70 73 69 65 31 0c 30 0a 06 03 55 04 0a keepsie1.0...U.. 00c0: 13 03 49 42 4d 31 0c 30 0a 06 03 55 04 0b 13 03 ..IBM1.0...U.... 00d0: 54 50 46 31 0e 30 0c 06 03 55 04 03 13 05 44 61 TPF1.0...U....Da 00e0: 76 69 64 31 22 30 20 06 09 2a 86 48 86 f7 0d 01 vid1"0 ..*.H.... 00f0: 09 01 16 13 6d 6f 7a 65 73 68 74 61 40 75 73 2e ....mozeshta@us. 0100: 69 62 6d 2e 63 6f 6d 30 1e 17 0d 30 38 30 33 31 ibm.com0...08031 0110: 31 30 31 31 36 31 31 5a 17 0d 31 30 31 32 30 37 1011611Z..101207 0120: 30 31 31 36 31 31 5a 30 81 87 31 0b 30 09 06 03 011611Z0..1.0... 0130: 55 04 06 13 02 55 53 31 11 30 0f 06 03 55 04 08 U....US1.0...U.. 0140: 13 08 4e 65 77 20 59 6f 72 6b 31 15 30 13 06 03 ..New York1.0... 0150: 55 04 07 13 0c 50 6f 75 67 68 6b 65 65 70 73 69 U....Poughkeepsi 0160: 65 31 0c 30 0a 06 03 55 04 0a 13 03 49 42 4d 31 e1.0...U....IBM1 0170: 0c 30 0a 06 03 55 04 0b 13 03 54 50 46 31 0e 30 .0...U....TPF1.0 0180: 0c 06 03 55 04 03 13 05 44 61 76 69 64 31 22 30 ...U....David1"0 0190: 20 06 09 2a 86 48 86 f7 0d 01 09 01 16 13 6d 6f ..*.H........mo 01a0: 7a 65 73 68 74 61 40 75 73 2e 69 62 6d 2e 63 6f zeshta(a)us.ibm.co 01b0: 6d 30 81 9f 30 0d 06 09 2a 86 48 86 f7 0d 01 01 m0..0...*.H..... 01c0: 01 05 00 03 81 8d 00 30 81 89 02 81 81 00 ac ee .......0........ 01d0: f9 a7 40 cc 73 af 67 a0 ea 46 08 45 a5 fd 44 71 ..@.s.g..F.E..Dq 01e0: a4 04 3e 51 f7 39 51 82 3d 7e 9b 99 ae 1d c1 22 ..>Q.9Q.=~....." 01f0: 67 10 e7 15 d1 a9 65 75 e9 3e 0f 77 64 d1 14 4d g.....eu.>.wd..M 0200: 28 f0 8c ba d3 ed 87 e9 b1 5b 11 c1 3f 11 ed 1a (........[..?... 0210: 96 9a 3f b3 4b f3 db bd 84 41 11 aa ea 37 6d ab ..?.K....A...7m. 0220: c5 fb a9 bb ab 9d 87 66 b2 31 7a c8 35 06 06 ec .......f.1z.5... 0230: fb 07 f1 29 f5 f3 fd 29 f4 df 33 bf 40 de 84 6f ...)...)..3.@..o 0240: 9d 66 ea 57 42 ab 0f 13 a0 07 71 d5 e0 6d 02 03 .f.WB.....q..m.. 0250: 01 00 01 a3 81 e7 30 81 e4 30 1d 06 03 55 1d 0e ......0..0...U.. 0260: 04 16 04 14 11 76 af b1 5a bd 99 53 a5 de 02 35 .....v..Z..S...5 0270: 06 51 c4 01 74 71 2c c6 30 81 b4 06 03 55 1d 23 .Q..tq,.0....U.# 0280: 04 81 ac 30 81 a9 80 14 11 76 af b1 5a bd 99 53 ...0.....v..Z..S 0290: a5 de 02 35 06 51 c4 01 74 71 2c c6 a1 81 8d a4 ...5.Q..tq,..... 02a0: 81 8a 30 81 87 31 0b 30 09 06 03 55 04 06 13 02 ..0..1.0...U.... 02b0: 55 53 31 11 30 0f 06 03 55 04 08 13 08 4e 65 77 US1.0...U....New 02c0: 20 59 6f 72 6b 31 15 30 13 06 03 55 04 07 13 0c York1.0...U.... 02d0: 50 6f 75 67 68 6b 65 65 70 73 69 65 31 0c 30 0a Poughkeepsie1.0. 02e0: 06 03 55 04 0a 13 03 49 42 4d 31 0c 30 0a 06 03 ..U....IBM1.0... 02f0: 55 04 0b 13 03 54 50 46 31 0e 30 0c 06 03 55 04 U....TPF1.0...U. 0300: 03 13 05 44 61 76 69 64 31 22 30 20 06 09 2a 86 ...David1"0 ..*. 0310: 48 86 f7 0d 01 09 01 16 13 6d 6f 7a 65 73 68 74 H........mozesht 0320: 61 40 75 73 2e 69 62 6d 2e 63 6f 6d 82 01 00 30 a@us.ibm.com...0 0330: 0c 06 03 55 1d 13 04 05 30 03 01 01 ff 30 0d 06 ...U....0....0.. 0340: 09 2a 86 48 86 f7 0d 01 01 04 05 00 03 81 81 00 .*.H............ 0350: a8 39 22 f9 88 b2 c1 e6 95 5e af 4d ae f6 89 e5 .9"......^.M.... 0360: 64 82 37 42 f6 5b 00 56 22 d0 c6 b9 5f 70 36 2f d.7B.[.V"..._p6/ 0370: 8f 10 bb 5a d1 18 33 2a 37 8a a0 f2 c3 53 21 12 ...Z..3*7....S!. 0380: 2c 28 8a 62 a9 e0 b5 5a 70 4c 77 f1 5c 33 d2 a3 ,(.b...ZpLw.\3.. 0390: 6d 77 e8 6e e8 7e 5b 74 d9 3a 70 24 38 89 ce 11 mw.n.~[t.:p $8... 03a0: 4c ec 64 51 f2 be 61 4c 18 09 25 13 48 e2 5b 13 L.dQ..aL..%.H.[. 03b0: d9 fa 8c 0c b7 a2 dd 09 dd e8 da 01 c7 29 2b 9a .............)+. 03c0: 22 51 6f 19 54 e7 02 90 75 0e a9 3a 4b e0 d1 a4 "Qo.T...u..:K... 03d0: 16 03 01 00 04 0e 00 00 00 ...........: TLS trace: SSL_accept:SSLv3 flush data tls_read: want=5 error=Resource temporarily unavailable TLS trace: SSL_accept:error in SSLv3 read client certificate A.........: TLS trace: SSL_accept:error in SSLv3 read client certificate A.........: daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=1 tvp=zero daemon: epoll: listen=8 active_threads=1 tvp=zero daemon: activity on 1 descriptor daemon: activity on: 13r daemon: read active on 13 daemon: epoll: listen=7 active_threads=1 tvp=zero connection_get(13) daemon: epoll: listen=8 active_threads=1 tvp=zero connection_get(13): got connid=5 connection_read(13): checking for input on id=5 tls_read: want=5, got=5 0000: 16 03 01 00 86 ...........: tls_read: want=134, got=134 0000: 10 00 00 82 00 80 91 6b 72 70 d5 4e 89 66 4e 5f .......krp.N.fN_ 0010: f2 d6 d6 41 e7 3a 85 1e 8e ce 85 4d 90 ac 4a ec ...A.:.....M..J. 0020: 81 f6 4d 2c 1d 94 85 e8 78 cf c9 68 11 77 b3 4e ..M,....x..h.w.N 0030: 13 97 62 43 e2 e8 12 44 42 46 c6 bc c3 74 c7 ad ..bC...DBF...t.. 0040: f7 46 22 2b ac 8c 8e 59 5d de f4 fd f9 73 3f 76 .F"+...Y]....s?v 0050: 1b 58 1f da 5c 95 49 a6 73 ec 75 37 fc 38 fa 53 .X..\.I.s.u7.8.S 0060: 6d 3c a9 fd 2a 7d c3 f7 b9 79 e7 3f 8f da df 04 m<..*}...y.?.... 0070: cb 06 e2 67 75 3c 57 cf 8e 60 6e e4 27 fa 23 a3 ...gu<W..`n.'.#. 0080: b8 fb c6 5b 14 7e ...[.~ TLS trace: SSL_accept:SSLv3 read client key exchange A tls_read: want=5, got=5 0000: 14 03 01 00 01 ..... tls_read: want=1, got=1 0000: 01 ..... tls_read: want=5, got=5 0000: 16 03 01 00 28 ....( tls_read: want=40, got=40 0000: 77 34 09 6c 45 e9 f1 f0 a2 e6 cb 2d e4 49 27 42 w4.lE......-.I'B 0010: 45 a5 84 74 bb bd 0f 6e 24 70 e1 b0 0f 19 83 4a E..t...n $p.....J 0020: 7a 41 c3 b3 ca fe 80 68 zA.....h TLS trace: SSL_accept:SSLv3 read finished A TLS trace: SSL_accept:SSLv3 write change cipher spec A TLS trace: SSL_accept:SSLv3 write finished A tls_write: want=51, written=51 0000: 14 03 01 00 01 01 16 03 01 00 28 97 a6 bb b1 8c ..........(..... 0010: 50 d4 6f 60 2c fb c7 d1 10 a6 a6 37 ff ea 0b e8 P.o`,......7.... 0020: 60 d0 f1 6b 34 d7 26 7b a9 c8 c0 45 72 33 7c 67 `..k4.&{...Er3| g 0030: b4 07 93 ... TLS trace: SSL_accept:SSLv3 flush data connection_read(13): unable to get TLS client DN, error=49 id=5 conn=5 fd=13 TLS established tls_ssf=56 ssf=56 daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=1 tvp=zero daemon: epoll: listen=8 active_threads=1 tvp=zero daemon: activity on 1 descriptor daemon: activity on: 13r daemon: read active on 13 daemon: epoll: listen=7 active_threads=1 tvp=zero connection_get(13) daemon: epoll: listen=8 active_threads=1 tvp=zero connection_get(13): got connid=5 connection_read(13): checking for input on id=5 ber_get_next tls_read: want=5, got=0 ldap_read: want=8, got=0 ber_get_next on fd 13 failed errno=0 (Success) connection_read(13): input error=-2 id=5, closing. connection_closing: readying conn=5 sd=13 for close connection_close: conn=5 sd=13 daemon: removing 13 daemon: activity on 1 descriptor tls_write: want=29, written=29 0000: 15 03 01 00 18 73 41 45 4f f9 51 03 05 e6 66 c2 .....sAEO.Q...f. 0010: f5 65 d2 a9 ab 03 aa 8d d1 79 ef 18 8c .e.......y.... TLS trace: SSL3 alert write:warning:close notify conn=5 fd=13 closed (connection lost) daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL

4 4

updateref difficulty
by John Oliver 05 Aug '08

05 Aug '08

I added an updateref statement to my slave/consumer server, referring back to the master/producer: updateref ldap://test1.mydomain.com In the logs on the slave, I can see that it does look like it refers the client to the master... Aug 5 09:21:19 unix-services2 slapd[29985]: daemon: select: listen=7 active_threads=0 tvp=zero Aug 5 09:21:19 unix-services2 slapd[29985]: daemon: select: listen=8 active_threads=0 tvp=zero Aug 5 09:21:19 unix-services2 slapd[29985]: do_modify Aug 5 09:21:19 unix-services2 slapd[29985]: do_modify: dn (uid=joliver,ou=People,dc=mydomain,dc=com) Aug 5 09:21:19 unix-services2 slapd[29985]: >>> dnPrettyNormal: <uid=joliver,ou=People,dc=mydomain,dc=com> Aug 5 09:21:19 unix-services2 slapd[29985]: <<< dnPrettyNormal: <uid=joliver,ou=People,dc=mydomain,dc=com>, <uid=joliver,ou=people,dc=mydomain,dc=com> Aug 5 09:21:19 unix-services2 slapd[29985]: modifications: Aug 5 09:21:19 unix-services2 slapd[29985]: replace: userPassword Aug 5 09:21:19 unix-services2 slapd[29985]: one value, length 41 Aug 5 09:21:19 unix-services2 slapd[29985]: conn=22 op=5 MOD dn="uid=joliver,ou=People,dc=mydomain,dc=com" Aug 5 09:21:19 unix-services2 slapd[29985]: conn=22 op=5 MOD attr=userPassword Aug 5 09:21:19 unix-services2 slapd[29985]: bdb_dn2entry("uid=joliver,ou=people,dc=mydomain,dc=com") Aug 5 09:21:19 unix-services2 slapd[29985]: send_ldap_result: conn=22 op=5 p=3 Aug 5 09:21:19 unix-services2 slapd[29985]: send_ldap_result: err=10 matched="" text="" Aug 5 09:21:19 unix-services2 slapd[29985]: send_ldap_result: referral="ldap://test1.mydomain.com/uid=joliver,ou=People,dc=mydomain,dc=com" Aug 5 09:21:19 unix-services2 slapd[29985]: send_ldap_response: msgid=6 tag=103 err=10 Aug 5 09:21:19 unix-services2 slapd[29985]: send_ldap_response: ref="ldap://test1.mydomain.com/uid=joliver,ou=People,dc=mydomain,dc=com" Aug 5 09:21:19 unix-services2 slapd[29985]: conn=22 op=5 RESULT tag=103 err=10 text= Aug 5 09:21:22 unix-services2 slapd[29985]: daemon: activity on 1 descriptor Aug 5 09:21:22 unix-services2 slapd[29985]: daemon: activity on: Aug 5 09:21:22 unix-services2 slapd[29985]: 28r Aug 5 09:21:22 unix-services2 slapd[29985]: Aug 5 09:21:22 unix-services2 slapd[29985]: daemon: read active on 28 Aug 5 09:21:22 unix-services2 slapd[29985]: connection_get(28) Aug 5 09:21:22 unix-services2 slapd[29985]: connection_get(28): got connid=22 Aug 5 09:21:22 unix-services2 slapd[29985]: connection_read(28): checking for input on id=22 Aug 5 09:21:22 unix-services2 slapd[29985]: do_unbind Aug 5 09:21:22 unix-services2 slapd[29985]: ber_get_next on fd 28 failed errno=0 (Success) Aug 5 09:21:22 unix-services2 slapd[29985]: conn=22 op=6 UNBIND Aug 5 09:21:22 unix-services2 slapd[29985]: connection_read(28): input error=-2 id=22, closing. Aug 5 09:21:22 unix-services2 slapd[29985]: connection_closing: readying conn=22 sd=28 for close Aug 5 09:21:22 unix-services2 slapd[29985]: connection_close: deferring conn=22 sd=28 Aug 5 09:21:22 unix-services2 slapd[29985]: daemon: select: listen=7 active_threads=0 tvp=zero Aug 5 09:21:22 unix-services2 slapd[29985]: connection_resched: attempting closing conn=22 sd=28 Howver, nothing is logged on the master, and the client bombs out with: LDAP password information update failed: Can't contact LDAP server The client can authenticate against test1 (the master server) with the appropriate change to /etc/ldap.conf -- *********************************************************************** * John Oliver http://www.john-oliver.net/ * * * ***********************************************************************

2 2

Multiple email addresses +Postfix
by Stelios A. 05 Aug '08

05 Aug '08

Hello all, I have a master/slave Openldap 2.4.9 running on ubuntu server along with Postfix and dovecot. At the moment email server is able to server email for domain1.com with Maildir support for Dovecot at /home/username/ for each user. There is a need to add a 2nd domain let's say domain2.com. My question is where that domain will store the emails as the user home dir is already setup in ldap at /home/username Is there a way to define a new attribute like alternative email and have the same user with same auth details authenticate to both domains like user1(a)domain1.com and with same pass on user1(a)domain2.com? I'm not sure if I'm explain enough the situation, please ask for any clarification if you want to. -- Stelios A

2 1

Creating a "big" database... large LDIF file. automated procedure?
by Brad T Waldorf 04 Aug '08

04 Aug '08

Hi again. Thanks again for your responses to my prior posts. So far, all of my experience with OpenLDAP has been with databases with a minimal number of entries... 200 at the most. I'd like to do some performance experiments with a much larger database, say 10,000 database entries or so. What would you recommend for creating such a database? (Entries don't have to have real, sensible data... maybe the distinguished name is an integer that increases by 1?) Is there an automated way for creating such a database? Thanks,

2 2

Organizational Unit Listing
by Emre Yilmaz 04 Aug '08

04 Aug '08

hi list, We need list to all of organizational unit's in Active Directory with members. Its very important for me. Is there any idea? _________________________________________________________________ Windows Live Spaces – hayatınız, Alanınız. Daha fazlasını öğrenmek için buraya tıklayın. http://get.live.com/spaces/overview

5 5

Newbi question.
by Narsi Bala 03 Aug '08

03 Aug '08

I have just started to dig into openLDAP and I am against a roadblock right now...I am sure the issue i am having is straightforward for those LDAP experts out there, so bear with my ignorance. My slapd.conf file is listed below # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # ucdata-path ./ucdata include ./schema/core.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap:/root.openldap.org pidfile ./run/slapd.pid argsfile ./run/slapd.args # Load dynamic backend modules: # modulepath ./libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=my-domain,dc=com" rootdn "cn=Manager,dc=my-domain,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory ./data # Indices to maintain index objectClass eq I am connecting to the server just fine, and I am looking at the database through eclipse apache DS studio plugin. Notice how I have the rootDN set to "cn=Manager,dc=my-domain,dc=com" and the suffix set to "dc=my-domain,dc=com", but I dont see this root entry in my editor. all I see is Root DSE(1). I expand that tree and there is nothing underneath it. I assume that by starting the server with the above slapd.conf, I should be able to create the rootDN, if not how does one go about creating a rootDN ? Thanks Narsi

4 4

Replicating between Active Directory and Openldap
by Greg McConnel 01 Aug '08

01 Aug '08

Can anyone refer me to documentation or a site that describes how to replicate user and password information between Active Directory and Openldap. I have found a number of sites but most are a few years old and none seem to provide the necessary instructions and tools. Thanks!

2 1

Re: Understanding TLS SSF
by J Davis 31 Jul '08

31 Jul '08

That was it. I'm using 2.4.11 now compiled against openssl and it's working. Thanks! -Jake On Wed, Jul 30, 2008 at 7:36 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > I doubt that's the SSL that OpenLDAP is compiled against. It looks to me > like it is compiled against GnuTLS, and likely affected by ITS#5585, which > was fixed in OpenLDAP 2.4.11. If that's correct, then the real TLS value > is 256. Have you actually run ldd on slapd to see what libraries it is > linked against for SSL? > > --Quanah > > > --On Wednesday, July 30, 2008 1:16 PM -0400 J Davis <mrsalty0(a)gmail.com> > wrote: > > >> Openssl 0.9.8g-4ubuntu3.3 >> >> Thanks, >> -Jake >> >> >> On Wed, Jul 30, 2008 at 12:02 PM, Buchan Milne >> <bgmilne(a)staff.telkomsa.net> wrote: >> >> >> >> >> On Wednesday 30 July 2008 15:59:52 J Davis wrote: >> >>> Greetings, >>> >>> I'm testing an installation of openldap 2.4.9. I want to enforce TLS for >>> all access to the directory. >>> My problem is that I cannot get the client to meet the ssf restictions I >>> have in place. The documentation I've seen on ssf and tls_ssf is very >>> sparse so I don't really understand what it does. >>> >>> I'm using self signed cert created using the openssl CA.sh script. >>> >>> Relevant portions of the slapd.conf... >>> >>> TLSCACertificateFile /etc/ldap/ssl/cacert.pem >>> TLSCertificateFile /etc/ldap/ssl/servercrt.pem >>> TLSCertificateKeyFile /etc/ldap/ssl/serverkey.pem >>> ... >>> access to * >>> by tls_ssf=128 ssf=128 anonymous auth >>> by tls_ssf=128 ssf=128 self write >>> >>> Relevant portions of the lapd.conf... >>> >>> TLS_CACERT /etc/ldap/ssl/cacert.pem >>> >>> With those ACLs in place I get the following error: >>> >>> $ ldapsearch -x -ZZ -D "uid=jake,ou=people,dc=example,dc=com" -W -b >>> "uid=jake,ou=people,dc=example,dc=com" >>> ldap_bind: Invalid credentials (49) >>> >>> And slapd in debug mode shows me that I didn't meet the ssf >>> requirments... >>> >>> connection_read(15): unable to get TLS client DN, error=49 id=0 >>> conn=0 fd=15 TLS established tls_ssf=32 ssf=32 >>> ... >>> <= check a_authz.sai_tls_ssf: ACL 128 > OP 32 >>> >> >> What ssl implementation is your slapd using ? >> >> >> >> > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: translucent overlay with local-only entries
by Sven Ulland 31 Jul '08

31 Jul '08

Gavin Henry wrote: > Did you read the man page? man slapo-translucent I did, but the significance of translucent_local and _remote didn't strike me. Unfortunately it seems that enabling local+remote searching doesn't change the result. I must have a silly bug in my configuration, but I cannot figure out where. Various combinations of translucent_local and _remote give different, but consistent, results: neither local nor remote: only remote entries returned local only: no entries returned remote only: only remote entries returned local and remote: only remote entries returned I use the following in my slapd.conf[1]: translucent_remote uid translucent_local uid The databases on each host seem fine. The main ldap directory contains an ou with a single uid[2]; the branch extension directory contains one attribute modification and one local-only entry[3]. I ran a full debug with 'translucent_local uid' in the configuration file: slapd -g openldap -u openldap -f /etc/ldap/slapd.conf -d 65535 The search command I use: ldapsearch -x -W -D 'cn=branchadmin,dc=branch,dc=example,dc=com' \ -H ldap://localhost -b 'dc=example,dc=com' -LLL 'uid=*' uid The output[5] seems to show (on lines 523 and 615, for example), that uid=barney is found, but I'm not able to determine why it is not returned to the client. I also dumped the network packets to verify that uid=barney was not retured. It wasn't. sven [1] Entire /etc/ldap/slapd.conf include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/autofs.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel none modulepath /usr/lib/ldap moduleload back_bdb moduleload back_ldap moduleload translucent sizelimit 500 tool-threads 1 backend bdb backend ldap database bdb directory /var/lib/ldap/translucent4 suffix "dc=example,dc=com" rootdn "cn=branchadmin,dc=branch,dc=example,dc=com" rootpw "admin" index objectclass eq index uid eq,sub lastmod off overlay translucent translucent_remote uid translucent_local uid uri "ldap://172.27.27.37" idassert-bind bindmethod=simple binddn="cn=mainadmin,dc=example,dc=com" credentials="admin" mode=none #end [2] slapcat on main ldap: dn: dc=example,dc=com objectClass: top objectClass: dcObject objectClass: organization dc: example o: Simple example structuralObjectClass: organization dn: cn=mainadmin,dc=example,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: mainadmin description: LDAP administrator userPassword:: e2NyeXB0fTRUT2NoeFV0M3AyUEU= structuralObjectClass: organizationalRole dn: ou=People,dc=example,dc=com ou: People objectClass: organizationalUnit structuralObjectClass: organizationalUnit dn: uid=andrew,ou=People,dc=example,dc=com uid: andrew cn: Andrew sn: Andrewson uidNumber: 401 gidNumber: 501 homeDirectory: /home/andrew structuralObjectClass: person objectClass: person objectClass: posixAccount #end [3] slapcat on local branch, after a) one modification of existing 'description' field for uid=andrew, and b) one new local-only entry for uid=barney. dn: dc=example,dc=com structuralObjectClass: glue objectClass: top objectClass: glue dn: ou=people,dc=example,dc=com structuralObjectClass: glue objectClass: top objectClass: glue dn: uid=andrew,ou=People,dc=example,dc=com description: changed on branch only dn: uid=barney,ou=People,dc=example,dc=com uid: barney cn: Barney sn: Barneyson uidNumber: 402 gidNumber: 502 homeDirectory: /home/barney objectClass: person objectClass: posixAccount description: only exists on branch #end [4] slapd debug output. 1 @(#) $OpenLDAP: slapd 2.4.10 (Jul 17 2008 14:44:35) $ 2 buildd@ninsei:/build/buildd/openldap-2.4.10/debian/build/servers/slapd 3 ldap_pvt_gethostbyname_a: host=debian, r=0 4 daemon_init: <null> 5 daemon_init: listen on ldap:/// 6 daemon_init: 1 listeners to open... 7 ldap_url_parse_ext(ldap:///) 8 daemon: listener initialized ldap:/// 9 daemon_init: 2 listeners opened 10 ldap_create 11 slapd init: initiated server. 12 slap_sasl_init: initialized! 13 reading config file /etc/ldap/slapd.conf 14 line 1 (include /etc/ldap/schema/core.schema) 15 reading config file /etc/ldap/schema/core.schema [several lines of schema debugging removed] 208 line 7 (pidfile /var/run/slapd/slapd.pid) 209 line 8 (argsfile /var/run/slapd/slapd.args) 210 line 9 (loglevel none) 211 line 11 (modulepath /usr/lib/ldap) 212 line 12 (moduleload back_bdb) 213 loaded module back_bdb 214 bdb_back_initialize: initialize BDB backend 215 bdb_back_initialize: Sleepycat Software: Berkeley DB 4.2.52: (December 3, 2003) 216 module back_bdb: null module registered 217 line 13 (moduleload back_ldap) 218 loaded module back_ldap 219 module back_ldap: null module registered 220 line 14 (moduleload translucent) 221 loaded module translucent 222 ==> translucent_initialize 223 module translucent: null module registered 224 line 16 (sizelimit 500) 225 line 17 (tool-threads 1) 226 line 19 (backend bdb) 227 line 20 (backend ldap) 228 line 22 (database bdb) 229 bdb_db_init: Initializing BDB database 230 line 23 (directory /var/lib/ldap/translucent4) 231 line 24 (suffix "dc=example,dc=com") 232 >>> dnPrettyNormal: <dc=example,dc=com> 233 => ldap_bv2dn(dc=example,dc=com,0) 234 <= ldap_bv2dn(dc=example,dc=com)=0 235 => ldap_dn2bv(272) 236 <= ldap_dn2bv(dc=example,dc=com)=0 237 => ldap_dn2bv(272) 238 <= ldap_dn2bv(dc=example,dc=com)=0 239 <<< dnPrettyNormal: <dc=example,dc=com>, <dc=example,dc=com> 240 line 25 (rootdn "cn=branchadmin,dc=branch,dc=example,dc=com") 241 >>> dnPrettyNormal: <cn=branchadmin,dc=branch,dc=example,dc=com> 242 => ldap_bv2dn(cn=branchadmin,dc=branch,dc=example,dc=com,0) 243 <= ldap_bv2dn(cn=branchadmin,dc=branch,dc=example,dc=com)=0 244 => ldap_dn2bv(272) 245 <= ldap_dn2bv(cn=branchadmin,dc=branch,dc=example,dc=com)=0 246 => ldap_dn2bv(272) 247 <= ldap_dn2bv(cn=branchadmin,dc=branch,dc=example,dc=com)=0 248 <<< dnPrettyNormal: <cn=branchadmin,dc=branch,dc=example,dc=com>, <cn=branchadmin,dc=branch,dc=example,dc=com> 249 line 26 (rootpw ***) 250 line 27 (index objectclass eq) 251 index objectClass 0x0004 252 line 28 (index uid eq,sub) 253 index uid 0x0714 254 line 29 (lastmod off) 255 line 31 (overlay translucent) 256 ==> translucent_db_init 257 line 32 (translucent_local uid) 258 line 33 (uri "ldap://172.27.27.37") 259 ==> translucent_db_config: uri 260 ldap_url_parse_ext(ldap://172.27.27.37) 261 line 38 (idassert-bind ***) 262 ==> translucent_db_config: idassert-bind 263 >>> dnNormalize: <cn=mainadmin,dc=example,dc=com> 264 => ldap_bv2dn(cn=mainadmin,dc=example,dc=com,0) 265 <= ldap_bv2dn(cn=mainadmin,dc=example,dc=com)=0 266 => ldap_dn2bv(272) 267 <= ldap_dn2bv(cn=mainadmin,dc=example,dc=com)=0 268 <<< dnNormalize: <cn=mainadmin,dc=example,dc=com> 269 >>> dnNormalize: <cn=Subschema> 270 => ldap_bv2dn(cn=Subschema,0) 271 <= ldap_bv2dn(cn=Subschema)=0 272 => ldap_dn2bv(272) 273 <= ldap_dn2bv(cn=subschema)=0 274 <<< dnNormalize: <cn=subschema> 275 matching_rule_use_init [schema lines omitted] 302 slapd startup: initiated. 303 backend_startup_one: starting "cn=config" 304 config_back_db_open 305 config_build_entry: "cn=config" 306 config_build_entry: "cn=module{0}" 307 config_build_entry: "cn=schema" 308 config_build_entry: "cn={0}core" 309 config_build_entry: "cn={1}cosine" 310 config_build_entry: "cn={2}nis" 311 config_build_entry: "cn={3}inetorgperson" 312 config_build_entry: "cn={4}autofs" 313 config_build_entry: "olcDatabase={-1}frontend" 314 config_build_entry: "olcDatabase={0}config" 315 config_build_entry: "olcDatabase={1}bdb" 316 config_build_entry: "olcOverlay={0}translucent" 317 ==> translucent_cfadd 318 config_build_entry: "olcDatabase=ldap" 319 backend_startup_one: starting "dc=example,dc=com" 320 bdb_db_open: "dc=example,dc=com" 321 bdb_db_open: database "dc=example,dc=com": dbenv_open(/var/lib/ldap/translucent4). 322 ==> translucent_db_open 323 backend_startup_one: starting "dc=example,dc=com" 324 ldap_back_db_open: URI=ldap://172.27.27.37 325 slapd starting 326 daemon: added 4r listener=(nil) 327 daemon: added 7r listener=0x82f6068 328 daemon: added 8r listener=0x82f6130 329 daemon: epoll: listen=7 active_threads=0 tvp=NULL 330 daemon: epoll: listen=8 active_threads=0 tvp=NULL 331 daemon: activity on 1 descriptor 332 daemon: activity on: 333 daemon: epoll: listen=7 active_threads=0 tvp=NULL 334 daemon: epoll: listen=8 active_threads=0 tvp=NULL 335 daemon: activity on 1 descriptor 336 daemon: activity on: 337 slap_listener_activate(8): 338 >>> slap_listener(ldap:///) 339 daemon: listen=8, new connection on 13 340 daemon: added 13r (active) listener=(nil) 341 conn=0 fd=13 ACCEPT from IP=127.0.0.1:51638 (IP=0.0.0.0:389) 342 daemon: epoll: listen=7 active_threads=0 tvp=NULL 343 daemon: epoll: listen=8 active_threads=0 tvp=NULL 344 daemon: activity on 1 descriptor 345 daemon: activity on: 346 daemon: epoll: listen=7 active_threads=0 tvp=NULL 347 daemon: epoll: listen=8 active_threads=0 tvp=NULL 348 daemon: activity on 1 descriptor 349 daemon: activity on: 13r 350 daemon: read active on 13 351 daemon: epoll: listen=7 active_threads=0 tvp=NULL 352 daemon: epoll: listen=8 active_threads=0 tvp=NULL 353 connection_get(13) 354 connection_get(13): got connid=0 355 connection_read(13): checking for input on id=0 356 ber_get_next 357 ldap_read: want=8, got=8 358 0000: 30 3b 02 01 01 60 36 02 0;...`6. 359 ldap_read: want=53, got=53 360 0000: 01 03 04 2a 63 6e 3d 62 72 61 6e 63 68 61 64 6d ...*cn=branchadm 361 0010: 69 6e 2c 64 63 3d 62 72 61 6e 63 68 2c 64 63 3d in,dc=branch,dc= 362 0020: 65 78 61 6d 70 6c 65 2c 64 63 3d 63 6f 6d 80 05 example,dc=com.. 363 0030: 61 64 6d 69 6e admin 364 ber_get_next: tag 0x30 len 59 contents: 365 ber_dump: buf=0x83a9dd8 ptr=0x83a9dd8 end=0x83a9e13 len=59 366 0000: 02 01 01 60 36 02 01 03 04 2a 63 6e 3d 62 72 61 ...`6....*cn=bra 367 0010: 6e 63 68 61 64 6d 69 6e 2c 64 63 3d 62 72 61 6e nchadmin,dc=bran 368 0020: 63 68 2c 64 63 3d 65 78 61 6d 70 6c 65 2c 64 63 ch,dc=example,dc 369 0030: 3d 63 6f 6d 80 05 61 64 6d 69 6e =com..admin 370 ber_get_next 371 ldap_read: want=8 error=Resource temporarily unavailable 372 conn=0 op=0 do_bind 373 ber_scanf fmt ({imt) ber: 374 ber_dump: buf=0x83a9dd8 ptr=0x83a9ddb end=0x83a9e13 len=56 375 0000: 60 36 02 01 03 04 2a 63 6e 3d 62 72 61 6e 63 68 `6....*cn=branch 376 0010: 61 64 6d 69 6e 2c 64 63 3d 62 72 61 6e 63 68 2c admin,dc=branch, 377 0020: 64 63 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 6f dc=example,dc=co 378 0030: 6d 80 05 61 64 6d 69 6e m..admin 379 ber_scanf fmt (m}) ber: 380 ber_dump: buf=0x83a9dd8 ptr=0x83a9e0c end=0x83a9e13 len=7 381 0000: 00 05 61 64 6d 69 6e ..admin 382 >>> dnPrettyNormal: <cn=branchadmin,dc=branch,dc=example,dc=com> 383 => ldap_bv2dn(cn=branchadmin,dc=branch,dc=example,dc=com,0) 384 <= ldap_bv2dn(cn=branchadmin,dc=branch,dc=example,dc=com)=0 385 => ldap_dn2bv(272) 386 <= ldap_dn2bv(cn=branchadmin,dc=branch,dc=example,dc=com)=0 387 => ldap_dn2bv(272) 388 <= ldap_dn2bv(cn=branchadmin,dc=branch,dc=example,dc=com)=0 389 <<< dnPrettyNormal: <cn=branchadmin,dc=branch,dc=example,dc=com>, <cn=branchadmin,dc=branch,dc=example,dc=com> 390 conn=0 op=0 BIND dn="cn=branchadmin,dc=branch,dc=example,dc=com" method=128 391 do_bind: version=3 dn="cn=branchadmin,dc=branch,dc=example,dc=com" method=128 392 translucent_bind: <cn=branchadmin,dc=branch,dc=example,dc=com> method 128 393 conn=0 op=0: rootdn="cn=branchadmin,dc=branch,dc=example,dc=com" bind succeeded 394 conn=0 op=0 BIND dn="cn=branchadmin,dc=branch,dc=example,dc=com" mech=SIMPLE ssf=0 395 do_bind: v3 bind: "cn=branchadmin,dc=branch,dc=example,dc=com" to "cn=branchadmin,dc=branch,dc=example,dc=com" 396 send_ldap_result: conn=0 op=0 p=3 397 send_ldap_result: err=0 matched="" text="" 398 send_ldap_response: msgid=1 tag=97 err=0 399 ber_flush2: 14 bytes to sd 13 400 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ 401 ldap_write: want=14, written=14 402 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ 403 conn=0 op=0 RESULT tag=97 err=0 text= 404 daemon: activity on 1 descriptor 405 daemon: activity on: 406 daemon: epoll: listen=7 active_threads=0 tvp=NULL 407 daemon: epoll: listen=8 active_threads=0 tvp=NULL 408 daemon: activity on 1 descriptor 409 daemon: activity on: 13r 410 daemon: read active on 13 411 daemon: epoll: listen=7 active_threads=0 tvp=NULL 412 daemon: epoll: listen=8 active_threads=0 tvp=NULL 413 connection_get(13) 414 connection_get(13): got connid=0 415 connection_read(13): checking for input on id=0 416 ber_get_next 417 ldap_read: want=8, got=8 418 0000: 30 33 02 01 02 63 2e 04 03...c.. 419 ldap_read: want=45, got=45 420 0000: 11 64 63 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 .dc=example,dc=c 421 0010: 6f 6d 0a 01 02 0a 01 00 02 01 00 02 01 00 01 01 om.............. 422 0020: 00 87 03 75 69 64 30 05 04 03 75 69 64 ...uid0...uid 423 ber_get_next: tag 0x30 len 51 contents: 424 ber_dump: buf=0x83aa218 ptr=0x83aa218 end=0x83aa24b len=51 425 0000: 02 01 02 63 2e 04 11 64 63 3d 65 78 61 6d 70 6c ...c...dc=exampl 426 0010: 65 2c 64 63 3d 63 6f 6d 0a 01 02 0a 01 00 02 01 e,dc=com........ 427 0020: 00 02 01 00 01 01 00 87 03 75 69 64 30 05 04 03 .........uid0... 428 0030: 75 69 64 uid 429 ber_get_next 430 ldap_read: want=8 error=Resource temporarily unavailable 431 conn=0 op=1 do_search 432 ber_scanf fmt ({miiiib) ber: 433 ber_dump: buf=0x83aa218 ptr=0x83aa21b end=0x83aa24b len=48 434 0000: 63 2e 04 11 64 63 3d 65 78 61 6d 70 6c 65 2c 64 c...dc=example,d 435 0010: 63 3d 63 6f 6d 0a 01 02 0a 01 00 02 01 00 02 01 c=com........... 436 0020: 00 01 01 00 87 03 75 69 64 30 05 04 03 75 69 64 ......uid0...uid 437 >>> dnPrettyNormal: <dc=example,dc=com> 438 => ldap_bv2dn(dc=example,dc=com,0) 439 <= ldap_bv2dn(dc=example,dc=com)=0 440 => ldap_dn2bv(272) 441 <= ldap_dn2bv(dc=example,dc=com)=0 442 => ldap_dn2bv(272) 443 <= ldap_dn2bv(dc=example,dc=com)=0 444 <<< dnPrettyNormal: <dc=example,dc=com>, <dc=example,dc=com> 445 SRCH "dc=example,dc=com" 2 0 0 0 0 446 begin get_filter 447 PRESENT 448 ber_scanf fmt (m) ber: 449 ber_dump: buf=0x83aa218 ptr=0x83aa23f end=0x83aa24b len=12 450 0000: 87 03 75 69 64 30 05 04 03 75 69 64 ..uid0...uid 451 end get_filter 0 452 filter: (uid=*) 453 ber_scanf fmt ({M}}) ber: 454 ber_dump: buf=0x83aa218 ptr=0x83aa244 end=0x83aa24b len=7 455 0000: 00 05 04 03 75 69 64 ....uid 456 attrs: uid 457 conn=0 op=1 SRCH base="dc=example,dc=com" scope=2 deref=0 filter="(uid=*)" 458 conn=0 op=1 SRCH attr=uid 459 ==> translucent_search: <dc=example,dc=com> (uid=*) 460 => bdb_search 461 bdb_dn2entry("dc=example,dc=com") 462 => bdb_dn2id("dc=example,dc=com") 463 <= bdb_dn2id: got id=0x1 464 entry_decode: "dc=example,dc=com" 465 <= entry_decode(dc=example,dc=com) 466 => access_allowed: search access to "dc=example,dc=com" "entry" requested 467 <= root access granted 468 => access_allowed: search access granted by manage(=mwrscxd) 469 search_candidates: base="dc=example,dc=com" (0x00000001) scope=2 470 => bdb_dn2idl("dc=example,dc=com") 471 => bdb_filter_candidates 472 AND 473 => bdb_list_candidates 0xa0 474 => bdb_filter_candidates 475 OR 476 => bdb_list_candidates 0xa1 477 => bdb_filter_candidates 478 EQUALITY 479 => bdb_equality_candidates (objectClass) 480 daemon: activity on 1 descriptor 481 daemon: activity on: 482 daemon: epoll: listen=7 active_threads=0 tvp=NULL 483 daemon: epoll: listen=8 active_threads=0 tvp=NULL 484 => key_read 485 bdb_idl_fetch_key: [b49d1940] 486 <= bdb_index_read: failed (-30990) 487 <= bdb_equality_candidates: id=0, first=0, last=0 488 <= bdb_filter_candidates: id=0 first=0 last=0 489 => bdb_filter_candidates 490 PRESENT 491 => bdb_presence_candidates (uid) 492 <= bdb_presence_candidates: (uid) not indexed 493 <= bdb_filter_candidates: id=-1 first=1 last=4 494 <= bdb_list_candidates: id=-1 first=1 last=4 495 <= bdb_filter_candidates: id=-1 first=1 last=4 496 <= bdb_list_candidates: id=-1 first=1 last=4 497 <= bdb_filter_candidates: id=-1 first=1 last=4 498 bdb_search_candidates: id=-1 first=1 last=4 499 entry_decode: "ou=people,dc=example,dc=com" 500 <= entry_decode(ou=people,dc=example,dc=com) 501 => bdb_dn2id("ou=people,dc=example,dc=com") 502 <= bdb_dn2id: got id=0x2 503 entry_decode: "uid=andrew,ou=People,dc=example,dc=com" 504 <= entry_decode(uid=andrew,ou=People,dc=example,dc=com) 505 => bdb_dn2id("uid=andrew,ou=people,dc=example,dc=com") 506 <= bdb_dn2id: got id=0x3 507 is_entry_objectclass("uid=andrew,ou=People,dc=example,dc=com", "2.5.17.0") no objectClass attribute 508 is_entry_objectclass("uid=andrew,ou=People,dc=example,dc=com", "2.16.840.1.113730.3.2.6") no objectClass attribute 509 is_entry_objectclass("uid=andrew,ou=People,dc=example,dc=com", "1.3.6.1.4.1.4203.666.3.4") no objectClass attribute 510 => test_filter 511 PRESENT 512 => access_allowed: search access to "uid=andrew,ou=People,dc=example,dc=com" "uid" requested 513 <= root access granted 514 => access_allowed: search access granted by manage(=mwrscxd) 515 <= test_filter 5 516 bdb_search: 3 does not match filter 517 entry_decode: "uid=barney,ou=People,dc=example,dc=com" 518 <= entry_decode(uid=barney,ou=People,dc=example,dc=com) 519 => bdb_dn2id("uid=barney,ou=people,dc=example,dc=com") 520 <= bdb_dn2id: got id=0x4 521 => test_filter 522 PRESENT 523 => access_allowed: search access to "uid=barney,ou=People,dc=example,dc=com" "uid" requested 524 <= root access granted 525 => access_allowed: search access granted by manage(=mwrscxd) 526 <= test_filter 6 527 ==> translucent_search_cb: uid=barney,ou=People,dc=example,dc=com 528 ldap_create 529 ldap_url_parse_ext(ldap://172.27.27.37) 530 =>ldap_back_getconn: conn=0 op=1: lc=0x83ab8c8 inserted refcnt=1 rc=0 531 ldap_sasl_bind 532 ldap_send_initial_request 533 ldap_new_connection 1 1 0 534 ldap_int_open_connection 535 ldap_connect_to_host: TCP 172.27.27.37:389 536 ldap_new_socket: 16 537 ldap_prepare_socket: 16 538 ldap_connect_to_host: Trying 172.27.27.37:389 539 ldap_pvt_connect: fd: 16 tm: -1 async: 0 540 ldap_open_defconn: successful 541 ldap_send_server_request 542 ber_scanf fmt ({it) ber: 543 ber_dump: buf=0x83b3b90 ptr=0x83b3b90 end=0x83b3bc1 len=49 544 0000: 30 2f 02 01 01 60 2a 02 01 03 04 1e 63 6e 3d 6d 0/...`*.....cn=m 545 0010: 61 69 6e 61 64 6d 69 6e 2c 64 63 3d 65 78 61 6d ainadmin,dc=exam 546 0020: 70 6c 65 2c 64 63 3d 63 6f 6d 80 05 61 64 6d 69 ple,dc=com..admi 547 0030: 6e n 548 ber_scanf fmt ({i) ber: 549 ber_dump: buf=0x83b3b90 ptr=0x83b3b95 end=0x83b3bc1 len=44 550 0000: 60 2a 02 01 03 04 1e 63 6e 3d 6d 61 69 6e 61 64 `*.....cn=mainad 551 0010: 6d 69 6e 2c 64 63 3d 65 78 61 6d 70 6c 65 2c 64 min,dc=example,d 552 0020: 63 3d 63 6f 6d 80 05 61 64 6d 69 6e c=com..admin 553 ber_flush2: 49 bytes to sd 16 554 0000: 30 2f 02 01 01 60 2a 02 01 03 04 1e 63 6e 3d 6d 0/...`*.....cn=m 555 0010: 61 69 6e 61 64 6d 69 6e 2c 64 63 3d 65 78 61 6d ainadmin,dc=exam 556 0020: 70 6c 65 2c 64 63 3d 63 6f 6d 80 05 61 64 6d 69 ple,dc=com..admi 557 0030: 6e n 558 ldap_write: want=49, written=49 559 0000: 30 2f 02 01 01 60 2a 02 01 03 04 1e 63 6e 3d 6d 0/...`*.....cn=m 560 0010: 61 69 6e 61 64 6d 69 6e 2c 64 63 3d 65 78 61 6d ainadmin,dc=exam 561 0020: 70 6c 65 2c 64 63 3d 63 6f 6d 80 05 61 64 6d 69 ple,dc=com..admi 562 0030: 6e n 563 ldap_result ld 0x83ab908 msgid 1 564 wait4msg ld 0x83ab908 msgid 1 (timeout 100000 usec) 565 wait4msg continue ld 0x83ab908 msgid 1 all 1 566 ** ld 0x83ab908 Connections: 567 * host: 172.27.27.37 port: 389 (default) 568 refcnt: 2 status: Connected 569 last used: Wed Jul 30 14:50:54 2008 570 ** ld 0x83ab908 Outstanding Requests: 571 * msgid 1, origid 1, status InProgress 572 outstanding referrals 0, parent count 0 573 ld 0x83ab908 request count 1 (abandoned 0) 574 ** ld 0x83ab908 Response Queue: 575 Empty 576 ld 0x83ab908 response count 0 577 ldap_chkResponseList ld 0x83ab908 msgid 1 all 1 578 ldap_chkResponseList returns ld 0x83ab908 NULL 579 ldap_int_select 580 read1msg: ld 0x83ab908 msgid 1 all 1 581 ber_get_next 582 ldap_read: want=8, got=8 583 0000: 30 0c 02 01 01 61 07 0a 0....a.. 584 ldap_read: want=6, got=6 585 0000: 01 00 04 00 04 00 ...... 586 ber_get_next: tag 0x30 len 12 contents: 587 ber_dump: buf=0x83b4d08 ptr=0x83b4d08 end=0x83b4d14 len=12 588 0000: 02 01 01 61 07 0a 01 00 04 00 04 00 ...a........ 589 read1msg: ld 0x83ab908 msgid 1 message type bind 590 ber_scanf fmt ({eAA) ber: 591 ber_dump: buf=0x83b4d08 ptr=0x83b4d0b end=0x83b4d14 len=9 592 0000: 61 07 0a 01 00 04 00 04 00 a........ 593 read1msg: ld 0x83ab908 0 new referrals 594 read1msg: mark request completed, ld 0x83ab908 msgid 1 595 request done: ld 0x83ab908 msgid 1 596 res_errno: 0, res_error: <>, res_matched: <> 597 ldap_free_request (origid 1, msgid 1) 598 ldap_free_connection 0 1 599 ldap_free_connection: refcnt 1 600 ldap_parse_result 601 ber_scanf fmt ({iAA) ber: 602 ber_dump: buf=0x83b4d08 ptr=0x83b4d0b end=0x83b4d14 len=9 603 0000: 61 07 0a 01 00 04 00 04 00 a........ 604 ber_scanf fmt (}) ber: 605 ber_dump: buf=0x83b4d08 ptr=0x83b4d14 end=0x83b4d14 len=0 606 ldap_msgfree 607 ldap_search_ext 608 put_filter: "(objectclass=*)" 609 put_filter: simple 610 put_simple_filter: "objectclass=*" 611 ldap_build_search_req ATTRS: * 612 ldap_send_initial_request 613 ldap_send_server_request 614 ber_scanf fmt ({it) ber: 615 ber_dump: buf=0x83b3b90 ptr=0x83b3b90 end=0x83b3bdd len=77 616 0000: 30 4b 02 01 02 63 46 04 26 75 69 64 3d 62 61 72 0K...cF.&uid=bar 617 0010: 6e 65 79 2c 6f 75 3d 70 65 6f 70 6c 65 2c 64 63 ney,ou=people,dc 618 0020: 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 6f 6d 0a =example,dc=com. 619 0030: 01 00 0a 01 00 02 01 00 02 01 00 01 01 00 87 0b ................ 620 0040: 6f 62 6a 65 63 74 63 6c 61 73 73 30 00 objectclass0. 621 ber_scanf fmt ({) ber: 622 ber_dump: buf=0x83b3b90 ptr=0x83b3b95 end=0x83b3bdd len=72 623 0000: 63 46 04 26 75 69 64 3d 62 61 72 6e 65 79 2c 6f cF.&uid=barney,o 624 0010: 75 3d 70 65 6f 70 6c 65 2c 64 63 3d 65 78 61 6d u=people,dc=exam 625 0020: 70 6c 65 2c 64 63 3d 63 6f 6d 0a 01 00 0a 01 00 ple,dc=com...... 626 0030: 02 01 00 02 01 00 01 01 00 87 0b 6f 62 6a 65 63 ...........objec 627 0040: 74 63 6c 61 73 73 30 00 tclass0. 628 ber_flush2: 77 bytes to sd 16 629 0000: 30 4b 02 01 02 63 46 04 26 75 69 64 3d 62 61 72 0K...cF.&uid=bar 630 0010: 6e 65 79 2c 6f 75 3d 70 65 6f 70 6c 65 2c 64 63 ney,ou=people,dc 631 0020: 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 6f 6d 0a =example,dc=com. 632 0030: 01 00 0a 01 00 02 01 00 02 01 00 01 01 00 87 0b ................ 633 0040: 6f 62 6a 65 63 74 63 6c 61 73 73 30 00 objectclass0. 634 ldap_write: want=77, written=77 635 0000: 30 4b 02 01 02 63 46 04 26 75 69 64 3d 62 61 72 0K...cF.&uid=bar 636 0010: 6e 65 79 2c 6f 75 3d 70 65 6f 70 6c 65 2c 64 63 ney,ou=people,dc 637 0020: 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 6f 6d 0a =example,dc=com. 638 0030: 01 00 0a 01 00 02 01 00 02 01 00 01 01 00 87 0b ................ 639 0040: 6f 62 6a 65 63 74 63 6c 61 73 73 30 00 objectclass0. 640 ldap_result ld 0x83ab908 msgid 2 641 wait4msg ld 0x83ab908 msgid 2 (infinite timeout) 642 wait4msg continue ld 0x83ab908 msgid 2 all 1 643 ** ld 0x83ab908 Connections: 644 * host: 172.27.27.37 port: 389 (default) 645 refcnt: 2 status: Connected 646 last used: Wed Jul 30 14:50:54 2008 647 ** ld 0x83ab908 Outstanding Requests: 648 * msgid 2, origid 2, status InProgress 649 outstanding referrals 0, parent count 0 650 ld 0x83ab908 request count 1 (abandoned 0) 651 ** ld 0x83ab908 Response Queue: 652 Empty 653 ld 0x83ab908 response count 0 654 ldap_chkResponseList ld 0x83ab908 msgid 2 all 1 655 ldap_chkResponseList returns ld 0x83ab908 NULL 656 ldap_int_select 657 read1msg: ld 0x83ab908 msgid 2 all 1 658 ber_get_next 659 ldap_read: want=8, got=8 660 0000: 30 27 02 01 02 65 22 0a 0'...e". 661 ldap_read: want=33, got=33 662 0000: 01 20 04 1b 6f 75 3d 50 65 6f 70 6c 65 2c 64 63 . ..ou=People,dc 663 0010: 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 6f 6d 04 =example,dc=com. 664 0020: 00 . 665 ber_get_next: tag 0x30 len 39 contents: 666 ber_dump: buf=0x83b4d38 ptr=0x83b4d38 end=0x83b4d5f len=39 667 0000: 02 01 02 65 22 0a 01 20 04 1b 6f 75 3d 50 65 6f ...e".. ..ou=Peo 668 0010: 70 6c 65 2c 64 63 3d 65 78 61 6d 70 6c 65 2c 64 ple,dc=example,d 669 0020: 63 3d 63 6f 6d 04 00 c=com.. 670 read1msg: ld 0x83ab908 msgid 2 message type search-result 671 ber_scanf fmt ({eAA) ber: 672 ber_dump: buf=0x83b4d38 ptr=0x83b4d3b end=0x83b4d5f len=36 673 0000: 65 22 0a 01 20 04 1b 6f 75 3d 50 65 6f 70 6c 65 e".. ..ou=People 674 0010: 2c 64 63 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 ,dc=example,dc=c 675 0020: 6f 6d 04 00 om.. 676 read1msg: ld 0x83ab908 0 new referrals 677 read1msg: mark request completed, ld 0x83ab908 msgid 2 678 request done: ld 0x83ab908 msgid 2 679 res_errno: 32, res_error: <>, res_matched: <ou=People,dc=example,dc=com> 680 ldap_free_request (origid 2, msgid 2) 681 ldap_free_connection 0 1 682 ldap_free_connection: refcnt 1 683 ldap_parse_result 684 ber_scanf fmt ({iAA) ber: 685 ber_dump: buf=0x83b4d38 ptr=0x83b4d3b end=0x83b4d5f len=36 686 0000: 65 22 0a 01 20 04 1b 6f 75 3d 50 65 6f 70 6c 65 e".. ..ou=People 687 0010: 2c 64 63 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 ,dc=example,dc=c 688 0020: 6f 6d 04 00 om.. 689 ber_scanf fmt (}) ber: 690 ber_dump: buf=0x83b4d38 ptr=0x83b4d5f end=0x83b4d5f len=0 691 ldap_msgfree 692 send_ldap_result: conn=0 op=1 p=3 693 send_ldap_result: err=0 matched="" text="" 694 send_ldap_response: msgid=2 tag=101 err=0 695 ber_flush2: 14 bytes to sd 13 696 0000: 30 0c 02 01 02 65 07 0a 01 00 04 00 04 00 0....e........ 697 ldap_write: want=14, written=14 698 0000: 30 0c 02 01 02 65 07 0a 01 00 04 00 04 00 0....e........ 699 conn=0 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= 700 daemon: activity on 1 descriptor 701 daemon: activity on: 13r 702 daemon: read active on 13 703 daemon: epoll: listen=7 active_threads=0 tvp=NULL 704 daemon: epoll: listen=8 active_threads=0 tvp=NULL 705 connection_get(13) 706 connection_get(13): got connid=0 707 connection_read(13): checking for input on id=0 708 ber_get_next 709 ldap_read: want=8, got=7 710 0000: 30 05 02 01 03 42 00 0....B. 711 ber_get_next: tag 0x30 len 5 contents: 712 ber_dump: buf=0x834fca0 ptr=0x834fca0 end=0x834fca5 len=5 713 0000: 02 01 03 42 00 ...B. 714 ber_get_next 715 ldap_read: want=8, got=0 716 ber_get_next on fd 13 failed errno=0 (Success) 717 connection_read(13): input error=-2 id=0, closing. 718 connection_closing: readying conn=0 sd=13 for close 719 daemon: activity on 1 descriptor 720 daemon: activity on: 721 daemon: epoll: listen=7 active_threads=0 tvp=NULL 722 daemon: epoll: listen=8 active_threads=0 tvp=NULL 723 connection_close: deferring conn=0 sd=13 724 conn=0 op=2 do_unbind 725 conn=0 op=2 UNBIND 726 connection_resched: attempting closing conn=0 sd=13 727 connection_close: conn=0 sd=13 728 translucent_connection_destroy 729 =>ldap_back_conn_destroy: fetching conn 0 730 daemon: removing 13 731 conn=0 fd=13 closed #end

1 0

FTP authentication against openldap
by Aravind Arjunan 31 Jul '08

31 Jul '08

hi, I had configured openldap in RHEL 5 and all my users are in ldap database. My FTP want to authenticate with my ldap users. how to do that, plz help me with this issue. Guide me with any link to configure FTP authentication with ldap.

2 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical