openldap-technical

openldap-technical@openldap.org

18 participants
9786 discussions

OpenLDAP and HP iLO
by "Maurice Völkel" 18 Jun '08

18 Jun '08

Hello together, Since a couple of weeks, I tried to connect an OpenLDAP server with an iLO board, for an central authentication system. The LDAP server Runs with Open SuSe 10.3 on OpenLDAP 2.3.37 and is configured with PAM, so that a user registration works. My problem is the configuration of the directory settings of iLO. I try to describe my config of the LDAP Server and the problem which I have with the config. In /etc/openldap/slap.conf, I included a schema called ilo.schema. The ilo.schema looks like: attributetype (1.3.6.1.4.1.15959.9.1.1 NAME 'memberOf' DESC 'Group which user belongs to' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12) objectclass (1.3.6.1.4.1.15959.9.2.1 NAME 'memberOf' SUP top AUXILIARY DESC 'Required by Integrated Lights-Out for OpenLDAP' MUST (memberOf)) objectclass (1.3.6.1.4.1.15959.9.2.2 NAME 'user' SUP top AUXILIARY DESC 'Required by Integrated Lights-Out for OpenLDAP') A test user for the iLO, added on the LDAP like the following schema: # Max, my-domain.de dn: uid = max, ou = Mitarbeiter, ou = users, dc = my-domain, dc = de cn: Max Doe givenName: Max SN: Foo gidNumber: 100 UID: Max uidNumber: 1003 userPassword: SSHA) (passwortmax homeDirectory: / home / max loginShell: / bin / bash Street: postalCode: l: ST: mail: max.mustermann(a)my-domain.de telephoneNumber: +49 shadowExpire: 14152 shadowInactive: 10 shadowLastChange: 14042 shadowMax: 14 shadowMin: 1 shadowWarning: 10 memberOf: cn = iloadmin, ou = groups, dc = my-domain, dc = de description: iLO users Max Mustermann objectClass: shadowAccount objectClass: person objectClass: inetOrgPerson objectClass: posixAccount objectClass: organizationalPerson objectClass: memberOf objectClass: user objectClass: top the cn = iloadmin, ou = groups, dc = my-domain, dc = de look like: dn: cn = iloadmin, ou = groups, dc = my-domain, dc = de cn: iloadmin objectClass: top objectClass: groupOfNames member: cn = Max Mustermann, ou = Mitarbeiter, ou = users, dc = my-domain, dc = de The settings I config on iLO web interface as follows: Under Administration -> Directory Settings -> Use Directory DefaultSchema: running Directory Server Address: my-domain.de [or IP] Directory Server LDAP Port: 636 Directory User Context 1: ou = Mitarbeiter, ou = users, dc = my-domain, dc = de And under Administration Groups -> Select a group: Administrator -> View / Modify Security Group Distinguished Name: cn = iloadmin, ou = groups, dc = my-domain, dc = de Administer Group and Accounts, Console Remote Access, Virtual Power and Reset, Virtual Media undConfigure iLO settings are enabled. If I had a test run, I get the following message: Overall status: Problem Detected Description Test status Ping Directory Server Passed Directory Server IP Address Not run Directory Server DNS name Passed Connect to Directory Server Passed Connect using SSL Passed Certificate of Directory Server Passed Bind to Directory Server Not run Directory administrator login Not Run User Authentication Failed User Authorization Not Run Directory User Context 1 Not run Directory User Not run Context 2 Directory User Context 3 Not run LOM exists Object Not Run LOM Word Object Not Run Sign Test Initiating diagnostic Directory settings for server my-domain.de Directory Server address my-domain.de resolved to IP address Accepting certificate for Directory Server / C = DE / ST = [state]/ O = [company] / OU = ldapserver / CN = meine-domain.de/EMAIL ca(a)meine-domain.de signed by / C = DE / ST = [state] / L = [place] / O = [company] / OU = [Department] / CN = [person] / EMAIL = ca(a)meine-domain.de Warning: certificate does not match my Address Directory Server-domain.de. Unable to authenticate user test max [Invalid credentials] Ceasing tests. Some diagnostics for server FAILED my-domain.de Complete tests. I read a lot of threads, but nothing could help me to find a mistake. I hope someone could help me to find the mistake. kind regards SysNewbie -- Psssst! Schon vom neuen GMX MultiMessenger gehört? Der kann`s mit allen: http://www.gmx.net/de/go/multimessenger

1 0

Re: schema in openldap
by Buchan Milne 18 Jun '08

18 Jun '08

On Wednesday 18 June 2008 12:38:10 Aravind Arjunan wrote: > I like to know whether it is possible to create our own schema and add our > own attributes and objectclass for that or not? It is possible. But, in my opinion, it is not yet necessary for your requirements. If you want to waste your time learning schema design instead of the LDAP basics, that might solve your problem, that's your decision (but I'm not going to waste my time). > If it is possible send me an example file so that i would be very thankfull > to you. > Since am trying to create my own schema and try to add attributes in > that.But when i try to restart the ldap service i got the below error. > > Checking configuration files for slapd: /etc/openldap/schema/att.schema: > line 3: AttributeType SYNTAX or SUPerior required: > "1.3.6.1.4.1.4203.666.1.100.121" > slaptest: bad configuration file! > [FAILED] > please help me with this issue. You didn't supply att.schema, but it seems that your schema definition for your OID 1.3.6.1.4.1.4203.666.1.100.121 does not include the SYNTAX or SUP keywords, one of them is required. And, you really shouldn't be using the OpenLDAP Foundations' OID arc ... Regards, Buchan

1 0

Re: schema in openldap
by Buchan Milne 18 Jun '08

18 Jun '08

On Wednesday 18 June 2008 12:34:40 Aravind Arjunan wrote: > Ok i had add entries like what you said, but when i try synchronize the > ldap address book in squirrel mail its saying no such object in ldap. > This could merely be a configuration issue. How did you determine what the exact problem was? Did you see what search squirrelmail was doing? And why it failed? Regards, Buchan

1 0

Fwd: schema in openldap
by Aravind Arjunan 18 Jun '08

18 Jun '08

---------- Forwarded message ---------- From: Aravind Arjunan <aravind.arjunan(a)gmail.com> Date: 18 Jun 2008 16:08 Subject: Re: schema in openldap To: Buchan Milne <bgmilne(a)staff.telkomsa.net> I like to know whether it is possible to create our own schema and add our own attributes and objectclass for that or not? If it is possible send me an example file so that i would be very thankfull to you. Since am trying to create my own schema and try to add attributes in that.But when i try to restart the ldap service i got the below error. Checking configuration files for slapd: /etc/openldap/schema/att.schema: line 3: AttributeType SYNTAX or SUPerior required: "1.3.6.1.4.1.4203.666.1.100.121" slaptest: bad configuration file! [FAILED] please help me with this issue. On 18/06/2008, Aravind Arjunan <aravind.arjunan(a)gmail.com> wrote: > > Ok i had add entries like what you said, but when i try synchronize the > ldap address book in squirrel mail its saying no such object in ldap. > > On 18/06/2008, Buchan Milne <bgmilne(a)staff.telkomsa.net> wrote: >> >> On Wednesday 18 June 2008 10:33:47 Aravind Arjunan wrote: >> > This is my newely created schema file in my ldap server for adding the >> > attributes. >> >> Why are you making your life difficult? Just add entries like this: >> >> >> dn: cn=Saju Kuttan,ou=solution,dc=test,dc=com >> objectClass: inetOrgPerson >> cn: Saju Kuttan >> sn: Kuttan >> givenName: Saju >> description: Saju Kuttan in the Oracle team >> telephoneNumber: 9891950975 >> mail: csaju(a)hcl.in >> >> >> There doesn't seem to be an attribute for the Nick Name field in Outlook, >> see: >> http://www.openldap.org/faq/data/cache/294.html >> >> >> Regards, >> Buchan >> >> >

1 0

Re: Openldap fine grained / advanced ACLs
by Faraz R. Khan 18 Jun '08

18 Jun '08

So basically I can do: to * by cn=admin,dc=company,dc=com add by cn=faraz,dc=company,dc=com zap That is indeed not documented anywhere. Will start an ITS Pierangelo Masarati wrote: > Faraz R. Khan wrote: >> Is it possible to have fine grained ACLs in OpenLDAP? My problem is >> that the 'write' access is too broad. I wish to be able to control >> ADD, modify and delete separately. I tried looking at >> aacls.sourceforge.net but it involves the setup of a separate server >> and looks abandoned. >> >> Any pointers would be appreciated- maybe the denyop module? I was >> trying to find some docs but all I could find was a FAQ entry. > > OpenLDAP 2.4 allows to split the write privilege into "a" (add) and "z" > (zap). A separate privilege for "modify" does not make too much sense > to me: if a value is added, then one just needs "add"; if a (set of) > value(s) is replaced, then one needs both "zap" (to delete old values) > and "add" (to add new ones), and thus "write" is just fine. On a > related note, I just realized this is not documented anywhere but in the > mailing list. I suggest you file an ITS <http://ww.openldap.org/its/> > to request a documentation update. > > p. > > > Ing. Pierangelo Masarati > OpenLDAP Core Team > > SysNet s.r.l. > via Dossi, 8 - 27100 Pavia - ITALIA > http://www.sys-net.it > ----------------------------------- > Office: +39 02 23998309 > Mobile: +39 333 4963172 > Email: ando(a)sys-net.it > ----------------------------------- > > -- Faraz R Khan Chief Architect Emergen Consulting Pvt Ltd +92.21.529.0381 x200 www.emergen.biz

2 1

Re: openldap
by Aravind Arjunan 17 Jun '08

17 Jun '08

hi buchan, These are the schema files in my server. include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema And i need to add the following attribute, 1)mail id or E-mail address 2)mailbox location 3)First name 4)Last name 5)Additional info 6)Nickname ( this is for squirrelmail address book syncronization with ldap database) On 17/06/2008, Michael Ströder <michael(a)stroeder.com> wrote: > > Aravind Arjunan wrote: > >> ldap_modify: Cannot modify object class (69) >> additional info: structural object class modification from 'person' >> to ' >> inetOrgPerson' not allowed >> > > You cannot change a structural object class. 'person' and 'inetOrgPerson' > are both structural object classes with the latter derived from the former. > In this case you have to delete and re-add the entries. > > See also: > http://www.openldap.org/faq/data/cache/1341.html > > Ciao, Michael. >

1 0

meta config help
by danz＠wustl.edu 17 Jun '08

17 Jun '08

We are attempting to setup a configuration that would allow us to bind/search 2 different back-ends with 2 completely different suffixes. Below is our configuration and the error we get back. We are able to connect to both back-ends provided the other is commented out in the slapd.conf file so we are sure the suffix change works for both targets. [slapd.conf] database meta suffix "dc=virtual" lastmod off #rebind-as-user uri "ldap://foo.wuaddev.wustl.edu/dc=virtual" suffixmassage "dc=virtual" "ou=Users,ou=Persons,dc=wuaddev,dc=wustl,dc=edu" #uri "ldap://bar.wustl.edu/dc=virtual" #suffixmassage "dc=virtual" "OU=users,OU=ais" [search command] -bash-3.00# ldapsearch -h localhost -v -b 'dc=virtual' -s sub -D 'cn=ssbinduser,dc=virtual' -w 'foobar' 'cn=ssbinduser' ldapsearch: started Tue Jun 17 13:28:59 2008 ldap_init( localhost, 389 ) ldap_simple_bind: Operations error [Debug output of /usr/local/libexec/slapd] Ldap Err: DSID-0C0906 2B, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece. This error comes from the remote LDAP server not accepting the bind request successfully. Your insight is greatly appreciated. Regards, Dan

1 0

Re: Openldap fine grained / advanced ACLs
by Raphaël Ouazana-Sustowski 17 Jun '08

17 Jun '08

Hi, Le Mar 17 juin 2008 16:30, Faraz R. Khan a écrit : > Is it possible to have fine grained ACLs in OpenLDAP? My problem is that > the 'write' access is too broad. I wish to be able to control ADD, > modify and delete separately. I tried looking at aacls.sourceforge.net > but it involves the setup of a separate server and looks abandoned. Just a note: this project has not been abandoned. In fact the "set" functionality of OpenLDAP now supersedes AACLs: http://www.openldap.org/faq/data/cache/1133.html Regards, Raphaël Ouazana.

1 0

Openldap fine grained / advanced ACLs
by Faraz R. Khan 17 Jun '08

17 Jun '08

Is it possible to have fine grained ACLs in OpenLDAP? My problem is that the 'write' access is too broad. I wish to be able to control ADD, modify and delete separately. I tried looking at aacls.sourceforge.net but it involves the setup of a separate server and looks abandoned. Any pointers would be appreciated- maybe the denyop module? I was trying to find some docs but all I could find was a FAQ entry. Any pointers would be welcome. Thank you. -- Faraz R Khan Chief Architect Emergen Consulting Pvt Ltd +92.21.529.0381 x200 www.emergen.biz

2 1

Re: Fwd: openldap
by Aravind Arjunan 17 Jun '08

17 Jun '08

Ya i had tried through schema, in internet. It was mentioned tat we can create our own schema for eg: test.schema and we can add the list off attributes that are required for us. I have tried that also but it was not working. I will tell the objective of mine. we have mailserver in RHEL 5 and ldap server is separate. we have all the user information in ldap server including mail id mail box location and other things related to mail and organization. so when a user sends mail the information must want to fetched from ldap server and work accordingly. somehow please help with this issue.Since i need some help from you guys. And thanks in advance. On 17/06/2008, Buchan Milne <bgmilne(a)staff.telkomsa.net> wrote: > > On Tuesday 17 June 2008 14:55:34 Aravind Arjunan wrote: > > Its working when i do it intially. > > can you please tell wat objectclass i have to add when i add the below > > attributes. > > > > 1)Nickname: > > 2)E-mail address: > > 3)First name: > > 4)Last name: > > 5)Additional info: > > These aren't attributes. You haven't specified the client, so it is > difficult > to guess what attributes the client is going to map to these address book > fields. > > However, if I were to guess, they would be: > > 1)displayName (from officeperson.schema) > 2)mail > 3)gn > 4)sn > 5)N/A > > 2-4 are all supported with inetOrgPerson. > > However, this is the kind of information you can determine for yourself. > Please consult the schema definitions ... > > Regards, > Buchan >

2 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical