openldap-technical

openldap-technical@openldap.org

18 participants
9785 discussions

ProxyAuth via slapd-ldap woes
by Mark deJong 09 Apr '08

09 Apr '08

Hello, I'm having the hardest time getting ProxyAuth working to FDS via the OpenLDAP slapd-ldap module. I'm currently using Kerberos SASL bind to the OpenLDAP proxy server, which performs a search of the associated user DN on the FDS server. This part works fine. But when SLAPD attempted to perform proxyauth for that user, I receive the following error from FDS: # search result search: 4 result: 2 Protocol error text: unable to parse proxied authorization control I have tested proxyauth via other methods and they work fine. I have the following in my slapd.conf file: # SASL sasl-realm CORP.COMPANY.COM <http://corp.company.com/> sasl-host ldap03.corp.company.com sasl-secprops minssf=56 # Regexp for SASL authentication: authz-regexp uid=(.*),cn=corp.company.com,cn=gssapi,cn=auth ldap:///dc=corp,dc=company,dc=com??sub?(uid=$1) authz-policy to authzTo=ldap:///dc=corp,dc=company,dc=com??sub?(objectclass=person) ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database ldap suffix "dc=corp,dc=company,dc=com" #uri "ldaps://ldap01.corp.company.com/dc=corp,dc=company,dc=com" uri "ldap://ldap01.corp.company.com/" acl-bind bindmethod=simple binddn="uid=proxyadmin,cn=users,cn=bindaccounts,dc=corp,dc=company,dc=com" credentials="password" idassert-authzFrom "dn:*" idassert-bind bindmethod=simple binddn="uid=proxyadmin,cn=users,cn=bindaccounts,dc=corp,dc=company,dc=com" credentials="password" mode=self Not sure if it's helpful but here is the output in the logs at the event: Apr 8 16:17:39 ldap03 slapd[3166]: ===>slap_sasl_match: comparing DN uid=dejongm,cn=opssec,cn=users,cn=accounts,dc=corp,dc=company,dc=com to rule dn:* Apr 8 16:17:39 ldap03 slapd[3166]: slap_parseURI: parsing dn:* Apr 8 16:17:39 ldap03 slapd[3166]: <===slap_sasl_match: comparison returned 0 Apr 8 16:17:39 ldap03 slapd[3166]: ===>slap_sasl_match: comparing DN uid=dejongm,cn=opssec,cn=users,cn=accounts,dc=corp,dc=company,dc=com to rule dn:* Apr 8 16:17:39 ldap03 slapd[3166]: slap_parseURI: parsing dn:* Apr 8 16:17:39 ldap03 slapd[3166]: <===slap_sasl_match: comparison returned 0 Apr 8 16:17:39 ldap03 slapd[3166]: send_ldap_result: conn=0 op=3 p=3 Apr 8 16:17:39 ldap03 slapd[3166]: send_ldap_result: err=2 matched="" text="unable to parse proxied authorization control" Apr 8 16:17:39 ldap03 slapd[3166]: send_ldap_response: msgid=4 tag=101 err=2 Apr 8 16:17:39 ldap03 slapd[3166]: conn=0 op=3 SEARCH RESULT tag=101 err=2 nentries=0 text=unable to parse proxied authorization control Any suggestions would be appreciated. -Mark

2 1

Password policy can't replicate in openldap 2.4.8
by Paul Lee 09 Apr '08

09 Apr '08

Dear sir, I found that the account policy can't be replicated in openldap 2.4.8 I setup 2 servers, with Mirror mode. Then, I added the password policy and some user accounts in server 1, I then startup server 2, the user accounts are replicated to server 2. Content of policy.ldif : dn: ou=Policies ou: Policies description: All people in organisation objectClass: organizationalUnit dn: ou=Policies,o=HKSARG ou: Policies description: All people in organisation objectClass: organizationalUnit dn: cn=default,ou=Policies,o=HKSARG objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: userPassword pwdMaxFailure: 3 pwdInHistory: 12 pwdMinLength: 6 pwdExpireWarning: 259200 pwdAllowUserChange: TRUE pwdFailureCountInterval: 300 pwdGraceAuthNLimit: 1 pwdLockoutDuration: 300 pwdMustChange: FALSE pwdCheckQuality: 1 pwdMaxAge: 60000000 slapd.conf in server 1 : #overlay syncprov overlay ppolicy ppolicy_default "cn=default,ou=Policies,o=HKSARG" overlay syncprov #access to * by dn="cn=Manager" write by * read access to * by * write access to * by * read #database monitor syncprov-checkpoint 100 10 syncprov-sessionlog 100 # syncrepl directives syncrepl rid=1 provider=ldap://202.245.193.128:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist retry="60 +" syncrepl rid=2 provider=ldap://10.166.23.218:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist retry="60 +" mirrormode on serverID 1 slapd.conf in server 2 : # Password policy overlay ppolicy ppolicy_default "cn=default,ou=Policies,o=HKSARG" overlay syncprov #access to * by dn="cn=Manager" write by * read access to * by * write access to * by * read #database monitor syncprov-checkpoint 100 10 syncprov-sessionlog 100 # syncrepl directives syncrepl rid=1 provider=ldap://202.245.193.128:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist retry="60 +" syncrepl rid=2 provider=ldap://10.166.23.218:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist retry="60 +" mirrormode on serverID 2 I input the incorrect password 3 times in server 1 for a user, then, I find that the attribute pwdAccountLockedTime is updated in server 1, but I find that in server 2, this attribute is not replicated. As I result, when I input correct password in server 2, I still get authentication successful, but in server 1, authentication is failed. Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

2 4

Slapd Won't Start After TLS Was Configured
by Luke Lee 08 Apr '08

08 Apr '08

Hi, I've been trying to configure TLS with OpenLDAP on a RedHat Enterprise 4u4 server running OpenLDAP 2.2.13 but failed. The ldap service won't start and the following error messages are showing under the debugging log: TLS: could not load verify locations (file:`/etc/openldap/TLS/cacert.pem',dir:`/etc/openldap/TLS'). TLS: error:0200100D:system library:fopen:Permission denied bss_file.c:104 TLS: error:2006D002:BIO routines:BIO_new_file:system lib bss_file.c:109 TLS: error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib by_file.c:279 main: TLS init def ctx failed: -1 slapd shutdown: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. Can anyone help resolve the problem please? Thanks! Luke Lee ____________________________________________________________________________________ You rock. That's why Blockbuster's offering you one month of Blockbuster Total Access, No Cost. http://tc.deals.yahoo.com/tc/blockbuster/text5.com

2 1

some help required LDAP - GSSAPI issue.
by Austin Cherian 08 Apr '08

08 Apr '08

Hi, I hope some one can answer this query regarding LDAP and GSSAPI as i really dint find substantial info for this on the net for what i was trying to accomplish. I have some limitations on using OpenLDAP with Cyrus SASL and hence have to manufacture my own GSSAPI client to use with LDAP. However i have run into some technical issues here with my implementation and MS AD. Here's my problem in short: I am using the kerberos mechanism with GSSAPI, i first use kerberos API's to get a TGT for SPN that i have obtained a keytab for previously. I then use GSSAPI gss_init_sec_context to obtain a service ticket for the ldap server. I then call ldap_init and then subsequently call ldap_sasl_bind_s with mech as GSS-SPNEGO and supplying the GSSAPI token ( obtained from gss_init_sec_context ) as credential ( i set the DN in the ldap_sasl_bind_s to NULL ). >From the network traces and the return code i see that the bind was successful. The bind result shows success (0x00) and negTokenTarg shows negResult as accept-completed. This shows that Bind was indeed a success also to note here the krb-blob that comes with the bind result is successfully consumed by subsequent calls to gss_init_sec_context to complete context establishment. The issue that im facing now is that when i pass GSS wraped search request ( i.e. i build a search request and pass it to gss_wrap API to get a token ) token to the ldap_search_ext api. From the network traces i see that the search request has been received by the ldap server properly. However the LDAP server ( MS AD LDAP server ) responds with the following message : LdapErr: DSID-0C09062.27 comment: In order to perform this operation a successful bind must be completed on the connection. Can some one please throw some light on as to why the search query is getting back with an error that there was no bind done in spite of the server responding success for the LDAP bind prior to sending the search request ?? Any help will be greatly appreciated... Thanks, Austin.

1 0

First question...
by Daniel Padula 08 Apr '08

08 Apr '08

Hi! I am Daniel from argentina, I have an strange problem that, after been looking for it, I am really lost. I have made an objectClass in open ldap 2.4.7-6.1 and it works perfectly, but when I implemented in an open ldap 2.3.27-1. it did't work. It fails with the message, ldap_add: Invalid syntax (21) additional info: objectClass: value #0 invalid per syntax. Are there any main difference in schema 's structure between those ldap versions? Where could be the problem? attributetype ( 1.3.6.1.4.1.4203.666.1.124 NAME 'dynastyName' DESC ' Nombre dynasty.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) attributetype ( 1.3.6.1.4.1.4203.666.1.125 NAME 'vars' DESC ' Valores obtenidos de dynasty.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) objectclass (1.3.6.1.4.1.4203.666.1.54775 NAME 'jxfsDevice' SUP top STRUCTURAL DESC 'Estructura de un dispositivo jxfs' MAY ( cn $ vars $ dynastyName)) Thanks in advance! -- Daniel Padula. MSN, Gtalk, Jabber: daniel.padula(a)gmail.com

2 2

mail distribution list problem
by Aniruddha Karanjkar 07 Apr '08

07 Apr '08

Hi I have configured ldap on fedora 8 for contact list. It is working absolutely fine. Only thing is I am not able to create mail distribution list, which can be browsed in OL OE or TB. Please HELP.

1 0

error while accessing through Java "javax.naming.AuthenticationNotSupportedException: simple"
by Sai 07 Apr '08

07 Apr '08

Hi I am new to openLDAP. I am configuring it (version: OpenLDAP: slapd 2.3.27) on a Linux machine to use with our Web Application (java). When I try and make a connection I am getting the following error. =============== javax.naming.AuthenticationNotSupportedException: simple [4/7/08 10:42:01:887 EDT] 00000026 SystemErr R at com.sun.jndi.ldap.sasl.LdapSasl.saslBind(LdapSasl.java:115) =============== These are the code / attributes I used. ================= Hashtable env = new Hashtable(); env.put( Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory" ); env.put( Context.PROVIDER_URL, "ldap://<machine name>:<port>" ); env.put( Context.SECURITY_PRINCIPAL, "cn=uimadmin,ou=UIM,o=nhes,dc=nh,dc=gov" ); env.put( Context.SECURITY_AUTHENTICATION, "simple" ); env.put( Context.SECURITY_CREDENTIALS, "<password in plaintext>" ); try { context = new InitialDirContext(env); System.out.println("CONTEXT OPENED WITH ADMIN ACCOUNT"); } catch (NamingException ne) { ne.printStackTrace(); LogManager.logMessage("LDAPManager.getAdminJndiContext()", ne); } return context; ================= When I try and do an ldapsearch with a -x option (simple authentication) on the command line, it is returning results successfully. I am also able to connect using ldapbrowser v2.8.2 and see the results. Any help regarding this is greatly appreciated. Thanks in advance. -Bangaru.

1 0

Questions about Active Directory Password Cache overlay
by Wes Modes 07 Apr '08

07 Apr '08

Thanks to Buchan Milne, I'm looking into the Active Directory Password Cache overlay for OpenLDAP, which seems to offer more or less what I'm trying to do. Is anyone here experienced with it? Is this the right place to ask or is there an openLDAP overlays list? I understand this description of ADPC: Active Directory Password Cache =============================== Active Directory does not provide any means to read user credentials on any public API. It is possible, to install additional libraries as password sniffer to catch and forward cleartext passwords on changes. In case you cannot or simply dont want to install such libraries, the Active Directory Password Cache overlay is your option. The Active Directory Password Cache overlay allows to mirror user account credentials without any modification on the AD server. It only takes one occasional simple bind authentication against the OpenLDAP server. If the credential has not been mirrored yet, the overlay uses the krbPrincipalName and the password provided by the user to perform a Kerberos init against the Active Directory. A successful Kerberos init guarantees a correct password for this principal, and therefor the bind finally succeeds. Within this overlay operation, the password gets encrypted with the default OpenLDAP hash alorithm and stored as userPassword attribute. There is an option to update the sambaNTPassword also (using code borrowed from Howard Chu's smbk5pwd overlay). All following simple bind authentications will first try these cached credentials, making the OpenLDAP server independent from AD. In case the user changes its password on the Active Directory server, the old password stays valid in OpenLDAP until the user first presents the new password for an simple bind. Within this bind operation, the overlay performs another Kerberos init and updates the cached credentials in OpenLDAP. It is clear to me that after a password change, that a failure to authenticate initiates a new auth attempt against the KDC, and if it succeeds, ADPC caches the passwd as a hash in OpenLDAP. But if Samba fails to authenticate against the hash stored in sambaNTPassword, is a new authentication attempt made against the KDC? And if it does, where does it get the passwd to hash (since Samba never gets the passwd in NTLM authentication)? Practically speaking, it seems that the password that the overlay hashes has to come from a source other than Samba. A web app? How have people used it in the past? W. -- Wes Modes Server Administrator & Programmer Analyst McHenry Library Computing & Network Services Information and Technology Services 459-5208

2 1

RE: openLDAP controls‏
by Quanah Gibson-Mount 06 Apr '08

06 Apr '08

--On Saturday, April 05, 2008 9:23 PM -0700 Gene Kupfer <kupferg(a)msn.com> wrote: > I'm using Jumpbox beta which uses the latest OpenLDAP release I believe. > My application is a software streaming app on which I can configure > provisioning to users or groups. However, I am not able to list users in > my openLDAP server so I am not able to configure what apps they have > access to. These controls I referenced are required by my app to return a > list of user accounts. Keep your replies to the list if you want responses. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

4 5

openLDAP controls‏
by Gene Kupfer 05 Apr '08

05 Apr '08

Hello, I’m trying to figure out how to enable some controls, but can’t find a single thing online that references this topic. The controls are defined in the ldap.h file (please see below), but when I query my directory for supported controls it does not show them in the list. #define LDAP_CONTROL_SORTREQUEST "1.2.840.113556.1.4.473" #define LDAP_CONTROL_SORTRESPONSE "1.2.840.113556.1.4.474" #define LDAP_CONTROL_VLVREQUEST "2.16.840.1.113730.3.4.9" #define LDAP_CONTROL_VLVRESPONSE "2.16.840.1.113730.3.4.10" I’m trying to connect an application that lists these controls as CRITICAL and fails to show the LDAP users and groups. Thank you very much for your help. Gene

3 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical