openldap-technical

openldap-technical@openldap.org

9 participants
9902 discussions

Autofs-OpenLDAP Assistance
by Santosh Balan 30 Jul '08

30 Jul '08

Hi Friends, I am new to this LDAP community. I am haivng redhat evironment on my servers and my clients are also linux based thin clients or redhat linux based clients. I am trying to configure LDAP to authenticate my user to login to the machine and then automatically mount a partition to the user's machine. I have searched through the net and unable to find an appropriate doccumentation on the same. Can you please guide and provide some appropriate doccumentation or method as how I hv to go about with the installation of OpenLDAP and autofs such that it will authenticate my users and automatically mounts the users partition. Thanks and Regards Santosh Balan +91-9819419509 = -- Powered by Outblaze

3 2

Re: N-way multimaster
by Miguel Jinez 29 Jul '08

29 Jul '08

Sure In this case the process was: master B and master C are without service master A performs a delete restart masters A B C Master A: # 20080729212056.000003Z, accesslog dn: reqStart=20080729212056.000003Z,cn=accesslog objectClass: auditDelete reqStart: 20080729212056.000003Z reqEnd: 20080729212056.000004Z reqType: delete reqSession: 33 reqAuthzID: cn=admin,dc=ar reqDN: cn=pbo101,dc=dominio,dc=ar reqResult: 0 Master B: # 20080729212438.000000Z, accesslog dn: reqStart=20080729212438.000000Z,cn=accesslog objectClass: auditModify reqStart: 20080729212438.000000Z reqEnd: 20080729212438.000001Z reqType: modify reqSession: 4294967295 reqAuthzID: cn=admin,dc=ar reqDN: dc=ar reqResult: 0 reqMod: contextCSN:= 20080728211620.143999Z#000000#003#000000 reqMod: contextCSN:= 20080729212056.356833Z#000000#001#000000 reqMod: contextCSN:= 20080728211533.044990Z#000000#002#000000 Master C: # 20080729212911.000000Z, accesslog dn: reqStart=20080729212911.000000Z,cn=accesslog objectClass: auditModify reqStart: 20080729212911.000000Z reqEnd: 20080729212911.000002Z reqType: modify reqSession: 4294967295 reqAuthzID: cn=admin,dc=ar reqDN: dc=ar reqResult: 0 reqMod: contextCSN:= 20080728211620.143999Z#000000#003#000000 reqMod: contextCSN:= 20080729212056.356833Z#000000#001#000000 reqMod: contextCSN:= 20080728211533.044990Z#000000#002#000000 Migue 2008/7/29 Gavin Henry <ghenry(a)openldap.org> > <quote who="Miguel Jinez"> > > Hi I have test from zero and I have test with historical information, I > > have > > found my old configuration and the logs are different, here master A: > > Can we see your actual logs, not the accesslog ones after the test when/i > fit fails. > > Thanks. > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ >

1 0

translucent overlay with local-only entries
by Sven Ulland 29 Jul '08

29 Jul '08

I'm trying to extend an ldap directory using the translucent overlay, like many before me: http://www.openldap.org/lists/openldap-software/200802/msg00128.html http://www.openldap.org/lists/openldap-software/200802/msg00267.html http://www.openldap.org/lists/openldap-software/200511/msg00216.html http://www.openldap.org/lists/openldap-software/200707/msg00471.html Before version 2.4.8, this wasn't possible. Howard Chu seems to have fixed this in rev 1.40 (before release 2.4.8) of translucent.c: http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/overlays/translucent… (http://www.openldap.org/lists/openldap-bugs/200712/msg00109.html) Although it seems to have been fixed, I cannot get it to work on my setup. I use the packaged v2.4.10 in Debian testing. My config: # Config start include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel none modulepath /usr/lib/ldap moduleload back_hdb moduleload back_ldap moduleload translucent sizelimit 500 tool-threads 1 backend hdb backend ldap database hdb directory /var/lib/ldap/translucent suffix "dc=example,dc=com" rootdn "cn=admin,dc=mybranch,dc=example,dc=com" rootpw "admin" overlay translucent uri "ldap://172.27.27.37" idassert-bind bindmethod=simple binddn="cn=admin,dc=example,dc=com" credentials="admin" mode=none idassert-authzFrom "dn.subtree:dc=example,dc=com" # Config end This works perfectly fine for searches where the entry is remote. Changing entries works fine well, with the results stored in the local translucent db. Adding new entries works, but they are not returned on searches. I check this by running slapcat. So, it boils down to these questions: * Does Howard's patch not fully implement the searching? * Is my config wrong? * There is probably other ways to do this, perhaps using a meta ldap backend. With multiple backends, what determines where writes go? Probably where the object is based, but what about new objects? * Is it cleaner to keep my "branch" of the tree under a subdomain, such as mybranch.example.com using rwm, or should they all be on the main example.com domain? * Examples for exotic overlays are very scarce. It would be very helpful if anyone could provide their configuration file. sven

1 0

Modifying every entry in an LDAP address book
by Carr, Chris 29 Jul '08

29 Jul '08

Hi All, Apologies if this is a stupid question, but I can't find the answer via Google. I need to make the same modification to every entry in my address book. Can I do this with a single ldapmodify command? If so, what is the syntax for the mod file? I'm assuming something like this: dn: ?? changetype: modify add: objectClass objectClass: evolutionPerson ... but I can't think what the DN would be, since I don't really understand how wildcards work in DNs, if at all. The entries I want to modify are all in ou=addressbook,dc=mydomain, but all have different cns. Second, some of the entries already have that object class - will this cause a problem? Will ldapmodify simply ignore those entries, or create a duplicate identical objectClass, or crash? Many thanks in advance, CC This e-mail may contain information which is confidential, legally privileged and/or copyright protected. This e-mail is intended for the addressee only. If you receive this in error, please contact the sender and delete the material from your computer

3 3

Client says Can't contact LDAP server, but it can!
by John Oliver 29 Jul '08

29 Jul '08

What can I do to troubleshoot this? OpenLDAP client says ldap_simple_bind Can't contact LDAP server but it can resolve the name, ping the server, connect to port 636... and I have no details as to why it thinks it cannot contact the server. Many other clients authenticate to the same server, and I'm using the same ldap.conf, nsswitch.conf, and pam.d/system-auth files. -- *********************************************************************** * John Oliver http://www.john-oliver.net/ * * * ***********************************************************************

7 21

Re: Client says Can't contact LDAP server, but it can!
by Gustavo Mendes de Carvalho 28 Jul '08

28 Jul '08

Hi There, I use self signed certificates with OpenLDAP, and everything works fine. Check bellow which commands I used to create this certificate ===> Self signed certificate generation (I am using RHAS 4 Up6) cd /usr/share/ssl rm -fr demoCA /usr/share/ssl/misc/CA -newca openssl req -newkey rsa:1024 -nodes -keyout newreq.pem -out newreq.pem /usr/share/ssl/misc/CA -sign ===> putting certificate files to correct place cp demoCA/cacert.pem /etc/openldap/cacerts/cacert.pem cp newcert.pem /etc/openldap/cacerts/servercrt.pem cp newreq.pem /etc/openldap/cacerts/serverkey.pem chmod 0400 /etc/openldap/cacerts/serverkey.pem chown -R ldap:ldap /etc/openldap/cacerts /etc/init.d/ldap restart ===> putting public certificate files in ldap client machines scp /etc/openldap/cacerts/cacert.pem root@<ip_client>:/etc/openldap/cacerts/. And set in ldap config files (in ldap client machine) the correct path When generating certificate file, be sure to specify in hostname field "hostname -f" output command. You can try using localhost too I hope it helps you --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com Date: Mon, 28 Jul 2008 09:20:23 +0200 From: Buchan Milne <bgmilne(a)staff.telkomsa.net> Subject: Re: Client says Can't contact LDAP server, but it can! To: openldap-technical(a)openldap.org Cc: John Oliver <joliver(a)john-oliver.net> Message-ID: <200807280920.33142.bgmilne(a)staff.telkomsa.net> Content-Type: text/plain; charset="iso-8859-1" On Friday 25 July 2008 17:16:12 John Oliver wrote: > On Fri, Jul 25, 2008 at 10:20:55AM +0200, Buchan Milne wrote: > > On Friday 25 July 2008 01:13:37 John Oliver wrote: > > > On Thu, Jul 24, 2008 at 04:04:10PM -0700, Quanah Gibson-Mount wrote: > > > > Any client will need to know about the CA that signed your > > > > self-signed cert. > > > > > > I created my certificate with: > > > > > > openssl req -new -x509 -nodes -out /etc/ssl/ldap.pem -keyout > > > /etc/openldap/ssl/ldap.pem -days 3650 > > > > > > In slapd.conf I have: > > > > > > TLSCertificateFile /etc/ssl/ldap.pem TLSCertificateKeyFile > > > /etc/openldap/ssl/ldap.pem TLSCACertificateFile /etc/ssl/ldap.pem > > > > > > What do I need to do differently? > > > > Configure the *client* ??? > > The clients work perfectly with the working server. Why would they > have to have a different configuration to talk to the backup LDAP server? They don't necessarily need a different configuration, but it being valid for one server doesn't guarantee it will be valid for another server, especially when it comes to ssl, certificate validation etc. > At the moment, I'm far more interested in getting the second LDAP > server working than I am in having perfect security. Then it's easy, turn off SSL. If you don't want to do that, turn of certificate validation. It's better than exposing keys. Or, ensure that the "CA certificate" that the clients use contains the certificates of the issuer of both of the server certificates, and that the value of the subject CN on both certificates matches the name you use to connect to the servers. Regards, Buchan

1 0

Re: N-way multimaster
by Miguel Jinez 28 Jul '08

28 Jul '08

Hi I have test from zero and I have test with historical information, I have found my old configuration and the logs are different, here master A: # 20080728211533.000002Z, accesslog dn: reqStart=20080728211533.000002Z,cn=accesslog objectClass: auditDelete reqStart: 20080728211533.000002Z reqEnd: 20080728211533.000003Z reqType: delete reqSession: 387 reqAuthzID: cn=admin,dc=ar reqDN: cn=user1000,dc=osde1,dc=ar reqResult: 0 Here master B # 20080728211533.000002Z, accesslog dn: reqStart=20080728211533.000002Z,cn=accesslog objectClass: auditDelete reqStart: 20080728211533.000002Z reqEnd: 20080728211533.000003Z reqType: delete reqSession: 387 reqAuthzID: cn=admin,dc=ar reqDN: cn=user1000,dc=osde1,dc=ar reqResult: 0 I am just using accesslog to look what is happening Greetings 2008/7/28 Gavin Henry <ghenry(a)openldap.org> > Hi, > > I meant originally. To test for me: > > 1. Emtpy both databases, including the accesslogs (accesslog not needed > here) > 2. Add original data to one node only, with the other switched off. > 3. Bring the other one up and let it pull data from the first node. > 4. Test they are the same and then try your delete situation. > > I think you've either added fresh data to each node so their *CSN values > are different so the deletes won't work. > > Please test and report back. > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ > > >

1 1

Re: N-way multimaster
by Miguel Jinez 28 Jul '08

28 Jul '08

Hi With my configuration at this time I have in one side: # 20080728202600.000001Z, accesslog dn: reqStart=20080728202600.000001Z,cn=accesslog objectClass: auditDelete reqStart: 20080728202600.000001Z reqEnd: 20080728202600.000002Z reqType: delete reqSession: 604 reqAuthzID: cn=admin,dc=ar reqDN: cn=user100,dc=osde1,dc=ar reqResult: 0 and nothing in the other side, let me try olds configurations to show you the mofify message 2008/7/26 Gavin Henry <ghenry(a)openldap.org> > <quote who="Miguel Jinez"> > > Yes, deletes are performed in one node > > How did you original load the data on each node? > > Can you show the failed delete logs? > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ >

1 0

Re: ACL Help Please
by david stackis 28 Jul '08

28 Jul '08

Hi Andrew - I unsubscribe to the openldap-software(a)openldap.org, but subscribe again today. I thought I had this ACL figured out. I'm trying to have users be able to add entries and to access their own address book. I think I have a pretty good start so far, but I'm having difficulty adding entries that only authenticated users have access to. I can add entries using "cn=root,dc=university,dc=edu" without any problems. Right now I have two users, but I'm confused as to how I get entries into their address book. Attached are both my init.ldif, and the slapd.conf I'm using. Any help is appreciated. My init.ldif # # Initialize the suffix entry defined in slapd.conf # dn: dc=University,dc=edu objectclass: top objectclass: dcObject objectclass: organization dc: university o: office # # Initialize the AddressBooks heirarchy # dn: ou=AddressBooks,dc=University,dc=edu objectclass: top objectclass: organizationalUnit ou: AddressBooks # # Define individual address books # dn: o=me,ou=AddressBooks,dc=University,dc=edu objectclass: top objectclass: organization o: me dn: o=you,ou=AddressBooks,dc=University,dc=edu objectclass: top objectclass: organization o: you # # Initialize the Users heirarchy # dn: ou=Users,dc=University,dc=edu objectclass: top objectclass: organizationalUnit ou: Users # # Define individual users # dn: cn=me,ou=Users,dc=University,dc=edu objectclass: top objectclass: person cn: me sn: Person userPassword: {crypt}XXXXXXX dn: cn=you,ou=Users,dc=University,dc=edu objectclass: top objectclass: person cn: you sn: Lastname userPassword: {crypt}XXXXXXX My slapd.conf... # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # # # Allow users to authenticate access to attrs=userPassword by self write by anonymous auth # Allow authenticated users access to their own address book access to dn.regex="o=(.+),ou=AddressBooks,dc=University,dc=edu" by users.expand="cn=$1,ou=Users,dc=University,dc=edu" write # Allow authenticated users to read the resource to which # they have access by logging in with an empty Bind DN access to dn.base="ou=AddressBooks,dc=University,dc=edu" by * read access to dn.base="" by * read # Allow authenticated users to read the Subschema of the # resources to which they have access access to dn.base="cn=Subschema" by * read # Disallow anonymous access (binds) # With this policy in effect, unathenticated users receive a response of # Error 48: Inappropiate authentication disallow bind_anon # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=University,dc=edu" rootdn "cn=root,dc=University,dc=edu" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq Thanks ------------------- david stackis uc santa barbara

1 0

id returns no such user
by Stelios A. 28 Jul '08

28 Jul '08

Hello, I have 2 servers, one act as master and other as slave syncing data with syncrepl user without a problem. Suddenly and after adding an index to the slapd.conf (the problem is probably somewhere else but just mentioning the last thing that I did) on the slave server where email is running I'm getting a: id: shipsec: No such user wherever I'm trying to see a users details. Then webmail, pop etc are not working because machine is not able to resolve the users from ldap. Howver, the getent passwd command return with all users from ldap like been local without a problem. All users under /home are like 1700:users insteed of username:users. The problem is only at the slave as If I stop the ldap on the slave then everything works as it use the master for getting the ids. Any idea? -- Stelios A

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical