openldap-technical

openldap-technical@openldap.org

18 participants
9785 discussions

DHCP breaks LDAP?
by John Oliver 12 May '08

12 May '08

On two RHEL4u5 lab machines, LDAP authentication stopped working. The only thing that was done was DHCP was enabled on a previously-unconfigured interface. That messed up ntpd.conf, so I know that weird stuff was going on. Anyway, all attempts to log in with an LDAP user result in ldap_simple_bind: Can't contact LDAP server However, the machines can ping the LDAP server, and nmap shows 389 and 636 as open. /etc/ldap.conf has not changed. /etc/nsswitch.conf has not changed. I ran "authconfig" and the server line was empty, so I filled it in. No dice. I am completely stumped. -- *********************************************************************** * John Oliver http://www.john-oliver.net/ * * * ***********************************************************************

2 1

Mystery - Authentication Would Fail If Not Binding With Server By Using cn=Manager
by Luke Lee 10 May '08

10 May '08

I am running OpenLDAP 2.3.39 on RedHat. My login authentication on a client system will fail if I don't configure the optional binddn and bindpw by using cn=Manager. Can anyone please enlighten me what could cause the strange problem? Thanks! Luke ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 1

migration question
by Gordon 09 May '08

09 May '08

Our users have Thunderbird configured to search for email addressed in ldap our old ldap has a base DN of dc=sbg,dc=com our new ldap has a base DN of ou=people,dc=sbg,dc=com Is there a way to provide a view or alias of the new system so clients do not have to be updated to the new base DN?

3 2

AD + Openldap integration
by Rich West 07 May '08

07 May '08

I am not entirely sure where to ask this particular question, and I apologize in advance if this is not the correct forum... We have an AD infrastructure and we'd like to get all of our unix boxes to authenticate against the AD servers. I'm able to query against our AD servers by hand using: ldapsearch -x -LLL -E pr=200/noprompt -h ouradhost -D "CN=Administrator,OU=IT Department,OU=Users,OU=My Business,DC=ourdomain,DC=dotcom" -W -b "dc=ourdomain, dc=dotcom" -s sub "(cn=*)" And that gives me the entire tree, but I haven't made much progress from there. Honestly, I am unsure what 'right' resulting architecture would be: have each unix (linux, CentOS) system, using nss_ldap, authenticate against AD directly, or build an openldap replica of the AD contents (just user accounts) and have the unix boxes authenticate against that. Because of the AD layout, I'm not sure nss_ldap is even configurable enough to map users from the mess of groups within AD to one layer of users. The AD layout is messy.. the users are broken up in to different groups ("IT Department", "Executives", etc., etc) within AD, and it isn't straightforward on how to do a query just to get all users (regardless of the group). (unfortunately, I have no ability at this time to re-work the AD architecture, nor do I take responsibility for its current layout) Thanks! -Rich

3 4

change berkeley version
by Benjamin Bellec 07 May '08

07 May '08

Hello, I am new on this list. I am currently configuring a server (virtual machine) to use OpenLDAP 2.2.13 (must use this version) with Berkeley DB 4.2 (must use this version too). BDB 4.2 is the problem. My server use BDB 4.3 and I don't now how to tell OpenLDAP to use BDB 4.2 instead of 4.3. Any idea ? Thanks, Benjamin.

3 4

Examples of back-meta with more than one AD domains
by Vittore Zen 07 May '08

07 May '08

Hi, I need some help to configure a solution to this problem: 1. Some Windows 2000/2003 AD domains 2. A unique openLDAP server I want that openLDAP server contains all users account for every domains (the next step is setup a RADIUS server that use openLDAP as authentication source). I'm looking for a working examples of back-meta with more than one AD domains. Any ideas? Thanks in advance. v.

2 1

Re: How do I add multiple users to a group ldif file ?
by Pooja S 07 May '08

07 May '08

Thanks a lot. posixGroup worked with memberUid attribute.. Thank you so much.. Thanks, Pooja ----- Original Message ---- From: Javier Barroso <javibarroso(a)gmail.com> To: Pooja S <ldapuser(a)yahoo.com> Cc: openldap-technical(a)openldap.org Sent: Wednesday, May 7, 2008 4:31:40 AM Subject: Re: How do I add multiple users to a group ldif file ? On Tue, May 6, 2008 at 11:09 PM, Pooja S <ldapuser(a)yahoo.com> wrote: Hi All, Please help me setting up my groups with multiple group members. ... gidNumber: root,adm,daemon I understand gidNumber is the primary group of the user. If you want the user on several groups, you should look for "PosixGroup" object (or groupOfUniqueNames?) ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

Re: How do I add multiple users to a group ldif file ?
by Pooja S 07 May '08

07 May '08

Hi , Thank you for your reply to my query. I am still doing something wrong and it still doesnt work for me. Can you please replace the wrong with the correct attribute and objectclass: This is what I am using : dn: uid=adm,ou=Groups,dc=grow,dc=lan uid: adm cn: adm objectClass: account objectClass: posixAccount objectClass: PosixGroup objectClass: top objectClass: shadowAccount objectClass: inetOrgPerson userPassword: {crypt}* shadowLastChange: 12864 shadowMax: 99999 shadowWarning: 7 uidNumber: 4 gidNumber: 4 memberuid: 0 homeDirectory: Thanks, Pooja ----- Original Message ---- From: Javier Barroso <javibarroso(a)gmail.com> To: Pooja S <ldapuser(a)yahoo.com> Cc: openldap-technical(a)openldap.org Sent: Wednesday, May 7, 2008 4:31:40 AM Subject: Re: How do I add multiple users to a group ldif file ? On Tue, May 6, 2008 at 11:09 PM, Pooja S <ldapuser(a)yahoo.com> wrote: Hi All, Please help me setting up my groups with multiple group members.. ... gidNumber: root,adm,daemon I understand gidNumber is the primary group of the user. If you want the user on several groups, you should look for "PosixGroup" object (or groupOfUniqueNames?) ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

How do I add multiple users to a group ldif file ?
by Pooja S 07 May '08

07 May '08

Hi All, Please help me setting up my groups with multiple group members. Here is the example of a group "adm" which I want to add as group with group member "root, adm, deamon" whereas root and deamon groups already exist. Here is the ldif config for adm group: dn: uid=adm,ou=Groups,dc=abc,dc=xyz uid: adm cn: adm objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {crypt}* shadowLastChange: 12864 shadowMax: 99999 shadowWarning: 7 uidNumber: 4 gidNumber: root,adm,daemon homeDirectory: When I try to add I get this error . #ldapadd -x -D 'cn=Manager,dc=abc,dc=xyz' -W -f bin.ldif Enter LDAP Password: adding new entry "uid=adm,ou=People,dc=grow" ldap_add: Invalid syntax additional info: gidNumber: value #0 invalid per syntax I have tried various options, such as: gidNumber: 4, 0, 3 gidNumber: 4 gidNumber: 0 gidNumber: 3 Error : adding new entry "uid=adm,ou=People,dc=grow" ldap_add: Constraint violation additional info: gidNumber: multiple values provided Or tried replacing gidNumber with uidNumber. It still doesnt work. Any help is highly appreciated. Thanks, Pooja ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 1

Read encrypted userPassword from Mysql
by jbeezer02 06 May '08

06 May '08

I have been struggling with this for days now, trying different setups to no avail. I have openldap 2.3.40 installed and functioning (at least enough to read) with a mysql backend that is configured through unixODBC. I want to map the 'userPassword' attribute to a Mysql view that will contain the information from our other Mysql databases, such as username, name_first, password, salt, etc. Now the problem becomes how to read the encrypted format of our passwords. Our passwords are stored in Mysql the following way- /UPDATE user SET salt="'.$salt.'", password=SHA1(AES_ENCRYPT("'.$string.'","'.$salt.'")) WHERE id='.$this->id /where salt is generated by- /$salt = substr(md5(uniqid(rand(), true)), 0, 64); /Now I know that openldap doesn't support AES_ENCRYPTION, however it does support SHA. Now, the problem with this setup seems to be that I can't find a way to un-SHA the passwords, and then have it do an AES_DECRYPT. So I have been trying to switch the SHA and AES around so that, when a password is stored it is actually SHA encrypted first, and then AES_ENCRYPTED over top of that (granted, not quite as secure). I think that would enable me to use the AES_DECRYPT function in my 'ldap_attr_mappings' table to read the decrypted AES passwords, and then just check them with SHA. I have been trying to figure out all the base64 encoding that I have to mess with to read the encrypted formats, with not much luck. Has anyone done anything similar to this before? Is there a better way to read our encrypted Mysql passwords? This ldap is going to be used for VPN authentication, so I'm not concerned with writing data to it, just need to be able to read a users password. Thanks.

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical