openldap-technical

openldap-technical@openldap.org

9 participants
9902 discussions

Re: Subject: Re: Help with authz-regexp mapping kerberos identity to dn --RAHUL
by Chavez, James R. 16 Aug '08

16 Aug '08

Rahul, Thank you again..I will try this expression you have provided. Am I going about this in the correct way? What I want is to login through ssh or even the local box and be authenticated by the kerberos credentials. But I want the effective uid or account to be that of the ldap user in the openldap directory. I want my kerberos credentials to authorize my ldap login even though the account names do not match. Is it possible with this authz-regexp? Or is this simply for services. Sorry for all the questions. Thanks James Message: 1 Date: Wed, 13 Aug 2008 15:08:43 +0530 From: Rahul Amaram <rahul(a)synovel.com> Subject: Re: Subject: Re: Help with authz-regexp mapping kerberos identity to dn --RAHUL Cc: openldap-technical(a)openldap.org Message-ID: <48A2ABA3.9090900(a)synovel.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Hi Chavez, Try this expression. It should work. authz-regexp uid=(.).*_([^,]*),cn=company.com,cn=gssapi,cn=auth uid=$1$2,ou=People,dc=company,dc=com The "sasl-realm" parameter is set in /etc/slapd/slapd.conf (main slapd.conf file). You might also be interested in sasl-host (for hard-coding the host sasl fqdn name to be used while fetching ldap/<fqdn>@<REALM> password from the keytab file) and sasl-secprops parameters. Regards, Rahul. Chavez, James R. wrote: > > Rahul, > My friend finally a response. > Thank you for the input I had also read that link you provided, it was > somewhat helpful. If the usernames were identical that would work > great I believe. However the source name is coming in as joe_montana > and I need it to map to jmontana. > So I need only the first character of the first name and everything > after the underscore (last name). I am looking for the expression that > would give me that. I am not too familiar with the expressions syntax > or how to manipulate them. I see there is an option to search ldap > using ldap:///ou=people,dc=example,dc=com??one?(uid=$1), maybe I > should look into that. Do you have any suggestions or source for > reading on authz-regexp? I have been looking. If it was shell > scripting I could manage another way. > > When you say the SASL Realm would that go in the main slapd.conf or > the /usr/lib/sasl2/slapd.conf? > > I am indeed using GSSAPI for the SASL-auth-mechanism. I am getting > close,just gotta get past this. :) > > Thank you again. > James > > > > > ------------------------------ > > Message: 2 > Date: Mon, 11 Aug 2008 17:54:02 +0530 > From: Rahul Amaram <rahul(a)synovel.com> > Subject: Re: Help with authz-regexp mapping kerberos identity to dn > ....SASL > To: openldap-technical(a)openldap.org > Message-ID: <48A02F62.1000305(a)synovel.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hi Chavez, > This is the authz-regexp string I have used in slapd.conf: > > authz-regexp uid=([^,]*),cn=synovel.com,cn=gssapi,cn=auth > uid=$1,ou=People,dc=synovel,dc=com > > This works if the SASL auth mechanism is gssapi. I have also > hard-coded the SASL Realm with the below config option: > > sasl-realm SYNOVEL.COM > > If it uses the default realm (i.e. sasl-realm option is missing) then > the string would probably be: > > authz-regexp uid=([^,]*),cn=gssapi,cn=auth > uid=$1,ou=People,dc=synovel,dc=com > > > Hope this is of some assistance. For furthur information, kindly read > http://www.openldap.org/doc/admin24/sasl.html#Mapping%20Authentication > %2 > 0Identities > . > > Regards, > Rahul. > > Chavez, James R. wrote: > >> Hello all, >> My plan is to use Kerberos and LDAP as a replacement for NIS. >> My issue is that I need my kerberos credentials to map to a user in >> > LDAP > >> so I can avoid permission issues when logging in with kerberos creds. >> All the perms are based on the UNIX/LDAP users and groups. Thing is >> > the > >> user id's are different between kerberos and LDAP. >> The kerberos names consist of firstname_lastname@REALM. The ldap >> > entries > >> are in the format of standard Unix user names or first letter of >> first name and up to 7 characters of the last name (jmontana). I >> migrated >> > the > >> LDAP entries from my existing NIS maps. >> Now I understand that I can use SASL and authz-regexp in slapd.conf >> to map these id's. Please correct me if I am wrong. >> >> I added all the corresponding "krbName: first_last@REALM" to the >> > users > >> when I added them to the LDAP directory. >> For example for user Joe Montana..His ldap dn is "dn: >> uid=jmontana,ou=People,dc=test,dc=example,dc=com" >> His uid is "uid: jmontana >> And his Krb name is ""krbName: joe_montana(a)TEST.EXAMPLE.COM" >> >> I think all the data is there to get a mapping I just am unsure of >> the auth-regexp strings I need to add to the slapd.conf file. >> Does anyone out there have any experience with this and better yet >> provide the string or example of what strings I can use? >> I have searched the net on how to authenticate with kerberos and >> effictively login with a local id but have been unsuccessful in my >> search. >> Appreciate any help. >> >> Thank You >> James CONFIDENTIALITY This e-mail message and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail message, you are hereby notified that any dissemination, distribution or copying of this e-mail message, and any attachments thereto, is strictly prohibited. If you have received this e-mail message in error, please immediately notify the sender and permanently delete the original and any copies of this email and any prints thereof. ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS E-MAIL IS NOT INTENDED AS A SUBSTITUTE FOR A WRITING. Notwithstanding the Uniform Electronic Transactions Act or the applicability of any other law of similar substance and effect, absent an express statement to the contrary hereinabove, this e-mail message its contents, and any attachments hereto are not intended to represent an offer or acceptance to enter into a contract and are not otherwise intended to bind the sender, Sanmina-SCI Corporation (or any of its subsidiaries), or any other person or entity.

2 1

How to build custom backend database?
by Ricardo Moreira 15 Aug '08

15 Aug '08

Hi, I am trying to create a custom backend database. I have read http://www.umich.edu/~dirsvcs/ldap/doc/guides/slapd/12.html<http://www.umich.edu/%7Edirsvcs/ldap/doc/guides/slapd/12.html>and just created my custom API as indicated but I don't know how to make "configure" create the makefile for my custom backend? Do I have to edit "configure.in" and see how the other backends are configured to create my custom code? Regards, -- :: Ricardo Moreira

2 2

DN question
by Kós Tamás 15 Aug '08

15 Aug '08

2008/8/15 Andrew Findlay <andrew.findlay(a)skills-1st.co.uk>: > On Fri, Aug 15, 2008 at 10:41:54AM +0200, Kós Tamás wrote: > >> >> I got a little bit off topic problem, but I hope you can help me about >> >> it. We got an LDAP directory, with many names. We got some same CNs >> >> for instance: John Smiths. The only difference is between the 2 names >> >> is the e-mail address. How can I modify one of them? ldapmodify >> >> request DN, but our enviroment DN seems to be DN: CN=John Smiths. >> >> How can I include the e-mail address to the DN? > >> Thank for your help. I tried to search with this command: >> ldapsearch -xv -h host.somewhere.net -D "CN=jsmiths,O=ACME" -w >> password mail=jsmiths(a)moewhere.net+CN=John\ Smiths >> Nothing found... > > Ah - we have some confusion here. Michael and I both replied to your > first message assuming that you wanted to add new entries for two > people with the same name. I now think that you are trying to > find and modify an existing entry. Yes, we want to modify existing entries, which could be same CN, the unique is the mail attribute. > If you already have two people in the directory who have the same name > then they must have different DNs. It does not matter what those DNs > are - we just need to find them. It looks as if the mail address is > the best way to select the one you want so the search should look > something like this: > > ldapsearch -x -h host.somewhere.net -D "CN=jsmiths,O=ACME" \ > -w password -b O=ACME mail=jsmiths(a)moewhere.net > In this directory where are the two John Smiths don't have Organization, because it has been synchronised from an other directory. The unique attribute is the mail address... The Acme organization needs for only the authentication. I could write admin, not jsmiths. Sorry. > Note that I am assuming that there really is a user with DN > "CN=jsmiths,O=ACME". If not, you will get an "Invalid credentials" > error. In many directories you do not need to specify the DN and > password as they allow anonymous users to search and read. > > Note also that I have supplied a base for the search with the -b > flag. If you do not do this you will get a "No such object" error. > The base object must exist. > >> This persons don't have O or DC attributes. >> Can I ask you to give me some examples for searches and to modify >> people by mail and CN attributes. > > Get the search working first, to find the DN of the entry. > To modify the entry using command-line tools you will need to write > a small LDIF file. Let us assume that you want to add a phone > number to CN=jsmiths,O=ACME: > > dn: CN=jsmiths,O=ACME > changetype: modify > add: telephonenumber > telephonenumber: +1 234 567 890 > > (the file should end with a blank line). > > Now the command will be: > > ldapmodify -x -h host.somewhere.net -D "CN=jsmiths,O=ACME" \ > -w password -f FILENAME > > This assumes that the user "CN=jsmiths,O=ACME" is allowed > to modify their own entry. > > Why not try jXplorer? I will try it, thanks for the idea. > > Andrew > -- > ----------------------------------------------------------------------- > | From Andrew Findlay, Skills 1st Ltd | > | Consultant in large-scale systems, networks, and directory services | > | http://www.skills-1st.co.uk/ +44 1628 782565 | > ----------------------------------------------------------------------- > -- What kind of person would do this?" "Only one kind. Whoever this player is, he has played World of Warcraft nearly every hour of every day for the past year and a half. Gentlemen, we are dealing with someone here who... had absolutely no life." -- What kind of person would do this?" "Only one kind. Whoever this player is, he has played World of Warcraft nearly every hour of every day for the past year and a half. Gentlemen, we are dealing with someone here who... had absolutely no life."

1 0

Re: ldap_bind: Can't contact LDAP server (-1)
by Michael Ströder 14 Aug '08

14 Aug '08

Kristen Walker wrote: > >> Kristen, please stay on the mailing list you started the thread. Don't >> e-mail me solely personally. > > Sorry about that. Again: Please, use your "Reply to all" button! >> Kristen Walker wrote: >>> Thanks for your help. I can't seem to be able to start the server with the >>> -d flag. Here is what I tried: >>> >>> su root -c /usr/local/libexec/slapd -d 65535 >>> >>> I also tried: >>> >>> su root -d 65535 -c /usr/local/libexec/slapd >>> >>> And it complains in both cases that -d is an invalid option. >> Using -d works for me. Which version of OpenLDAP is this? >> >> Can you post any output it produces? > > I am using openldap-2.3.39 on Ubuntu. > > Here is the output: > > su root -d 65535 -c /usr/local/libexec/slapd > su: invalid option -- d > Usage: su [options] [LOGIN] Obviously this is wrong since you use option -d for the su command. How about doing "su -" just to get root and then use /usr/local/libexec/slapd -d 65535 [..other needed args..] You also have to check your syslog and which user is running slapd normally. Ciao, Michael.

1 0

Re: allow admin group to write excluding specific users
by Gavin Henry 14 Aug '08

14 Aug '08

----- "Stelios A." <stelios.a(a)gmail.com> wrote: > No, i have seperated Groups like: > > dn: cn=IT,ou=Groups,dc=bca,dc=edu,dc=gr > cn: IT > objectClass: groupOfUniqueNames > uniqueMember: cn=Some Name1,ou=Users,dc=mydomain,dc=edu,dc=com > uniqueMember: cn=Some Name2,ou=Users,dc=mydomain,dc=edu,dc=com > > and all users under ou=Users,dc=mydomain,dc=edu,dc=com OK, just grant one group write and not the other. Remember, ACLs are accessed from top down. There are plenty of examples on the FAQ: http://www.openldap.org/faq/data/cache/52.html Again, also read the man page. Thanks. -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

1 0

Re: allow admin group to write excluding specific users
by Stelios A. 14 Aug '08

14 Aug '08

No, i have seperated Groups like: dn: cn=IT,ou=Groups,dc=bca,dc=edu,dc=gr cn: IT objectClass: groupOfUniqueNames uniqueMember: cn=Some Name1,ou=Users,dc=mydomain,dc=edu,dc=com uniqueMember: cn=Some Name2,ou=Users,dc=mydomain,dc=edu,dc=com and all users under ou=Users,dc=mydomain,dc=edu,dc=com Thanks 2008/8/14 Gavin Henry <ghenry(a)openldap.org>: > Stelios A. wrote: >> >> Hello, >> >> I have a group called IT and another one called LDAP Admins. There are >> 5 users under IT and 2 under LDAP Admins. >> I'm looking for an acl where members of IT (groupOfUniqueNames) can >> modify/write anywhere under ou=Users.... apart from those users under >> the LDAP Admins group. >> Can anyone give me a help about this please. >> >> I've found only how to give access to IT group but not how to exclude >> LDAP Admins (2 in total) where those 2 exist also under IT group. >> >> Any ideas? > > Your DIT sounds a bit messy. Do you have groups under ou=Users? > > What is your design? > > BTW, man slapd.access > > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ > -- Stelios A

1 0

Drupal/OpenLDAP integration
by Jeff Sussna 13 Aug '08

13 Aug '08

Anyone have success integrating Drupal with OpenLDAP via the ldapauth module? I've been thrashing all day. Have read Drupal posts that imply others have thrashed as well. Details of my pain are at http://drupal.org/node/295029 . Thx, Jeff

2 1

Re: Drupal/OpenLDAP integration
by Jeff Sussna 13 Aug '08

13 Aug '08

Never mind. I am a blithering idiot. When I changed user passwords in JXplorer, I clicked OK in the password dialog, but then forgot to click Submit in the main window, so the changes never took effect. Tried againd and did it right this time, and everything works just fine. Good news is that I can attest that integrating Drupal with OpenLDAP is trivial, as long as you have a few brain cells left to spare :-).

1 0

NewBi: Trying to setup a custom project.
by Flip Vernooij 13 Aug '08

13 Aug '08

Hi all, For a project at work I need to setup a LDAP server and make it possible to authenticate allot of (yet unwriten) applications. I have been reading for the past 2 days on the internet about this issue but I have the feeling I do not have enough knowledge to provide a correct setup. The idea is that there are a few different ou¹s holding several users. These users all hold login-profiles for the applications we are developping right now. Alldue this sounds kinda logic, I do not exactly understand how the authentication should take place. Lets say: Dn=domain,dn=com ou=test -user name=me pass=secret --app_1 username=appuser password=appSecret ap_related_opt=variable --app_2 username=app2user password=app2secret other_ap_related_opt=variable --app_3 username=app3user password=app3secret other_ap_related_opt=variable -user /// Next user holding the same structure. Now I wrote a master_app that should handle the authentication using LDAP. It received the ³me² username with corresponding password and must fetch a list of profiles used for the requested applications (say app_1 and app_2) I¹m still in doubt about the app username and password, as without a matching profile, application access would be denied anyways so I could store some acl values to (is that right?) Am I on the right track here, any ideas sugestions links or examples? Thanks for reading! Flip Vernooij

1 0

allow admin group to write excluding specific users
by Stelios A. 13 Aug '08

13 Aug '08

Hello, I have a group called IT and another one called LDAP Admins. There are 5 users under IT and 2 under LDAP Admins. I'm looking for an acl where members of IT (groupOfUniqueNames) can modify/write anywhere under ou=Users.... apart from those users under the LDAP Admins group. Can anyone give me a help about this please. I've found only how to give access to IT group but not how to exclude LDAP Admins (2 in total) where those 2 exist also under IT. Thanks

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical