openldap-technical

openldap-technical@openldap.org

18 participants
9785 discussions

[ Ldap Native client Solaris 10 conncet to openldap serveur RHEL ]
by Phuong VUONG 11 Jun '08

11 Jun '08

Hello, First, i m sorry about my English. I have an Openldap 2.3.39 Server RHEL 4.6 which work perfectly. All the authentification from Linux client are fine (with the ACL on and the option of host_chech_attr). However, I have some problem to connect a ldap client native Solaris 10. I use ldapclient manual to configure the Solaris client. The option is : #ldapclient -v manual -a "defaultServerList=IP_SERVER_OPENLDAP_RHEL" -a "credentialLevel=proxy" -a "proxyDN=cn=account,dc=example,dc=fr" -a "proxyPassword=Pass" -a "defaultSearchBase=dc=exemple,dc=fr" -a "defaultSearchScope=sub" -a "serviceSearchDescriptor=passwd:ou=People,dc=exemple,dc=fr?one" -a "serviceSearchDescriptor=shadow:ou=People,dc=exempl,dc=fr?one" -a "serviceSearchDescriptor=groupe:ou=Group,dc=exempl,dc=fr?one" When my ACL are activated, this command turne over timeout and the result are : When i put this below ACL on Openldap Server : access to * by * read. ldapclient is ok and the configuration are fine. But disable the ACL is not possible. In the Openldap server log, i can see : conn=6 op=0 BIND dn="" method=128 ... I dont know why the option -a "proxyDN=cn=account,dc=example,dc=fr" didn't send correctly.. Do anyone have this kind of problem ? Do you get any information about solaris ldap native client connect to an openldap server rhel ? I also follow some guide from : http://docs.lucidinteractive.ca/index.php/Solaris_LDAP_client_with_OpenLDAP… but it don't work neither. Any advice ? Thanks by advance for your answer and pardon me about my poor English.

2 1

Vote OpenLDAP for the 2008 Community Choice Awards!
by Gavin Henry 10 Jun '08

10 Jun '08

http://blog.suretecsystems.com/archives/121-Vote-OpenLDAP-for-the-2008-Comm… -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP.

1 0

Syncrepl : Monitor Replication issues
by smainklh＠free.fr 10 Jun '08

10 Jun '08

Hi everybody! I would like to know how to monitor syncrepl. Actually i would like to be warned when data have been rejected (failure on the provider, network issues ...). Thank you in advance, Smaïn

3 5

How to implement some relational behavior...
by AlexanDER Franca 09 Jun '08

09 Jun '08

Hi. How can I, or what tool must I use, to implement a relational visualization of groups on a LDAP directory? In other words, I need some system that permit users go to an specifc group and see a list of users of that group. And have some way to click on user and see the user informations. Must I develop a tool to to this... or is there some tool (web tool) that I can download and install in a Linux box? []'s Alexander Brazil - Rio de Janeiro

3 4

LDAP structure
by Fred Zinsli 09 Jun '08

09 Jun '08

Hi everyone I am completely new to LDAP so I hope my terminology is correct. I am looking at setting up an LDAP server but I can't find information on how I would like it structured. All of the information I find is based on a single directory tree: ie. domain.com and then under that you can have your sub domains. But I would like to be able to have multiple domains. domain1.com, domain2.com. domain1.co.uk, domain1.com.jp and so on. Is this at all possible using LDAP? If it is possible could someone please point me to some information on how I can do this. I don't explicitly want the answer given to me as I won't learn anything. Many thanks in advance for your help and patience. Regards Fred

3 2

Syncprov overlay not pushing change
by Chris 08 Jun '08

08 Jun '08

openldap 2.3.41 from FreeBSD 6.3 ports. I have been using a syncrepl setup for some time and it's been working great. I recently had an app written that allows a user to change his password. It works, but when the user binds and modifies userPassword, the syncprov overlay does not push the change to the refreshAndPersist consumer. contextCSN is updated, entryCSN is updated, but the "search" never gets pushed. If I disconnect the consumer and reconnect, the change is then propagated. If I use refreshOnly, everything works fine. If the same record is modified by rootdn, the update is sent immediately. Nothing is different except the credentials of the user that binds to do the entry modification I've tried everything I can think of short of going to 2.4 to see if it does the same thing. Any suggestions appreciated.

2 1

OpenLDAP & Thunderbird with SSL
by Erik Lotspeich 08 Jun '08

08 Jun '08

Hi: I have OpenLDAP set up and working such that Thunderbird can access my addressbook without SSL or authentication. This part is good, but I want to move to the next level. My OpenLDAP server (slapd) is set up with SASL authentication (using the PLAIN method) and a self-signed certificate. The slapd command line is: /usr/local/libexec/slapd -h ldap:/// ldaps:/// When I connect to my OpenLDAP server using an OpenLDAP client such as ldapsearch, everything works (I have my self-generated CA cert as part of my system's ca-bundle): ldapsearch -ZZ -b 'ou=xxx, dc=yyy,dc=zzz' '(objectclass=*)' ldapsearch prompts for authentication and returns the contents of my addressbook: SASL/PLAIN authentication started Please enter your password: SASL username: erik SASL SSF: 0 # extended LDIF # # LDAPv3 # base <ou=xxx, dc=yyy,dc=zzz> with scope subtree # filter: (objectclass=*) # requesting: ALL # . . . When I enable SSL in Thunderbird, Thunderbird is unable to connect. I know using tcpdump that it's attempting a connection on the SSL port, but is failing and giving up somewhere. Is this a known issue? In slapd.conf I'm not requiring authentication at the moment. I will require authentication once I get the SSL working; since I'm using PLAIN, I don't want to allow non-SSL authentication. Any help would be greatly appreciated. Regards, Erik.

1 0

slapcat: symbol lookup error ldap_pvt_sasl_mutex_unlock
by M. Todd Smith 07 Jun '08

07 Jun '08

Hello all, I'm currently looking at upgrading my LDAP server from version 2.3.19. In trying to slapcat my db from the old machine I am getting the following error: slapcat: symbol lookup error: slapcat: undefined symbol: ldap_pvt_sasl_mutex_unlock I get this error whenever I attempt to use any of the slap tools. There is a little noise on the web in regards to the ldap_pvt_sasl_mutex_unlock but nothing definitive that I can find. I am going to replicate the db if possible and see if I can slapcat them from a different machine. Barring that however it would be good to be able to solve this from the original perspective. Any ideas? Many thanks in advance. Cheers Todd Systems Administrator -- Soho VFX 99 Atlantc Ave. Suite 303 Toronto, Ontario M6K-3J8 (416)516-7863 x240

1 0

Password policy questions
by Vincent Panel 07 Jun '08

07 Jun '08

Hi list, I'd like to do something rather simple (at least to me) with password policy : * Ensure the userPassword is 6 characters long at least * Ensure there's at least onenumber * Ensure there's at least one uppercase character I found out my first condition can be set by using the pwdMinLength attribute and the ppolicy overlay, but what should I do for the other two ? If it implies using pwdCheckModule and writing a C function and plugging it into openldap then I find it rather difficult for an ldap administrator just wanting to enforce policies... Is there any plan to make things easier, like having openldap providing 2 or 3 default C functions for this module ? Finally, why is it taking so long for the IETF to approve the ppolicy draft published in 2001 ? Has the effort been abandonned ? Thanks, Vincent

2 2

Trouble authenticating using OSX 10.4 and Openldap 2.4
by Donald Thompson 06 Jun '08

06 Jun '08

I have an openldap 2.4 authentication system, that works smoothly with many versions of linux, and OSX 10.5. But I can't get OSX 10.4 to authenticate with it. I was previously using openldap 2.0.27 with an identical setup, and 10.4 was able to authenticate with it. I can su to user accounts that are in the ldap database, but when I'm required to enter a password for the user, the authentication fails. Heres the relevant section from my logfile when I try to authenticate: Jun 6 16:03:58 owl slapd[10661]: conn=22 op=20 SRCH base="dc=mydomain,dc=gov" scope=2 deref=0 filter="(&(|(objectClass=posixAccount)(objectClass=inetOrgPerson)(objectClass=shadowAccount))(|(|(uid=dthomp))(|(cn=dthomp))))" Jun 6 16:03:58 owl slapd[10661]: conn=22 op=20 SRCH attr=uid cn Jun 6 16:03:58 owl slapd[10661]: <= bdb_equality_candidates: (uid) not indexed Jun 6 16:03:58 owl slapd[10661]: <= bdb_equality_candidates: (cn) not indexed Jun 6 16:03:58 owl slapd[10661]: conn=22 op=20 SEARCH RESULT tag=101 err=0 nentries=1 text= Jun 6 16:03:58 owl slapd[10661]: conn=22 op=21 SRCH base="dc=mydomain,dc=gov" scope=2 deref=0 filter="(&(|(objectClass=posixAccount)(objectClass=inetOrgPerson)(objectClass=shadowAccount))(|(uid=dthomp)(cn=dthomp)))" Jun 6 16:03:58 owl slapd[10661]: conn=22 op=21 SRCH attr=userPassword Jun 6 16:03:58 owl slapd[10661]: <= bdb_equality_candidates: (uid) not indexed Jun 6 16:03:58 owl slapd[10661]: <= bdb_equality_candidates: (cn) not indexed Jun 6 16:03:58 owl slapd[10661]: conn=22 op=21 SEARCH RESULT tag=101 err=0 nentries=1 text= Jun 6 16:03:58 owl slapd[10661]: conn=22 op=22 SRCH base="dc=mydomain,dc=gov" scope=2 deref=0 filter="(&(|(objectClass=posixAccount)(objectClass=inetOrgPerson)(objectClass=shadowAccount))(|(uid=dthomp)(cn=dthomp)))" Jun 6 16:03:58 owl slapd[10661]: <= bdb_equality_candidates: (uid) not indexed Jun 6 16:03:58 owl slapd[10661]: <= bdb_equality_candidates: (cn) not indexed Jun 6 16:03:58 owl slapd[10661]: conn=22 op=22 SEARCH RESULT tag=101 err=0 nentries=1 text= Jun 6 16:03:58 owl slapd[10661]: conn=35 fd=20 ACCEPT from IP=192.168.1.145:49405 (IP=0.0.0.0:636) Jun 6 16:03:58 owl slapd[10661]: conn=35 fd=20 closed (TLS negotiation failure) Jun 6 16:03:59 owl slapd[10661]: conn=36 fd=20 ACCEPT from IP=192.168.1.145:49406 (IP=0.0.0.0:636) Jun 6 16:03:59 owl slapd[10661]: conn=36 fd=20 TLS established tls_ssf=32 ssf=32 Jun 6 16:03:59 owl slapd[10661]: conn=36 op=0 BIND dn="" method=163 Jun 6 16:03:59 owl slapd[10661]: conn=36 op=0 RESULT tag=97 err=14 text=SASL(0): successful result: Jun 6 16:03:59 owl slapd[10661]: conn=36 op=1 BIND dn="" method=163 Jun 6 16:03:59 owl slapd[10661]: SASL [conn=36] Failure: no secret in database Jun 6 16:03:59 owl slapd[10661]: conn=36 op=1 RESULT tag=97 err=49 text=SASL(-13): user not found: no secret in database Jun 6 16:03:59 owl slapd[10661]: conn=36 op=2 UNBIND Jun 6 16:03:59 owl slapd[10661]: conn=36 fd=20 closed Jun 6 16:03:59 owl slapd[10661]: conn=22 op=23 SRCH base="dc=mydomain,dc=gov" scope=2 deref=0 filter="(&(|(objectClass=posixAccount)(objectClass=inetOrgPerson)(objectClass=shadowAccount))(|(|(uid=dthomp))(|(cn=dthomp))))" Jun 6 16:03:59 owl slapd[10661]: conn=22 op=23 SRCH attr=uid cn Jun 6 16:03:59 owl slapd[10661]: <= bdb_equality_candidates: (uid) not indexed Jun 6 16:03:59 owl slapd[10661]: <= bdb_equality_candidates: (cn) not indexed Jun 6 16:03:59 owl slapd[10661]: conn=22 op=23 SEARCH RESULT tag=101 err=0 nentries=1 text= Jun 6 16:03:59 owl slapd[10661]: conn=22 op=24 SRCH base="dc=mydomain,dc=gov" scope=2 deref=0 filter="(&(|(objectClass=posixAccount)(objectClass=inetOrgPerson)(objectClass=shadowAccount))(|(uid=dthomp)(cn=dthomp)))" Jun 6 16:03:59 owl slapd[10661]: conn=22 op=24 SRCH attr=userPassword Jun 6 16:03:59 owl slapd[10661]: <= bdb_equality_candidates: (uid) not indexed Jun 6 16:03:59 owl slapd[10661]: <= bdb_equality_candidates: (cn) not indexed Jun 6 16:03:59 owl slapd[10661]: conn=22 op=24 SEARCH RESULT tag=101 err=0 nentries=1 text= Jun 6 16:03:59 owl slapd[10661]: conn=22 op=25 SRCH base="dc=mydomain,dc=gov" scope=2 deref=0 filter="(&(|(objectClass=posixAccount)(objectClass=inetOrgPerson)(objectClass=shadowAccount))(|(uid=dthomp)(cn=dthomp)))" Jun 6 16:03:59 owl slapd[10661]: <= bdb_equality_candidates: (uid) not indexed Jun 6 16:03:59 owl slapd[10661]: <= bdb_equality_candidates: (cn) not indexed Jun 6 16:03:59 owl slapd[10661]: conn=22 op=25 SEARCH RESULT tag=101 err=0 nentries=1 text= Jun 6 16:03:59 owl slapd[10661]: conn=37 fd=20 ACCEPT from IP=192.168.1.145:49407 (IP=0.0.0.0:636) Jun 6 16:03:59 owl slapd[10661]: conn=37 fd=20 closed (TLS negotiation failure) Jun 6 16:03:59 owl slapd[10661]: conn=38 fd=20 ACCEPT from IP=192.168.1.145:49408 (IP=0.0.0.0:636) Jun 6 16:03:59 owl slapd[10661]: conn=38 fd=20 TLS established tls_ssf=32 ssf=32 Jun 6 16:03:59 owl slapd[10661]: conn=38 op=0 BIND dn="" method=163 Jun 6 16:03:59 owl slapd[10661]: conn=38 op=0 RESULT tag=97 err=14 text=SASL(0): successful result: Jun 6 16:03:59 owl slapd[10661]: conn=38 op=1 BIND dn="" method=163 Jun 6 16:03:59 owl slapd[10661]: SASL [conn=38] Failure: no secret in database Jun 6 16:03:59 owl slapd[10661]: conn=38 op=1 RESULT tag=97 err=49 text=SASL(-13): user not found: no secret in database Jun 6 16:03:59 owl slapd[10661]: conn=38 op=2 UNBIND Jun 6 16:03:59 owl slapd[10661]: conn=38 fd=20 closed I'm not sure why its trying to use sasl to authenticate, or even sure if thats the problem. I ended up creating an empty sasl database, because originally it kept trying to open one that wasn't there. Do I have to do some king of mapping from the sasl database to ldap?

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical