openldap-technical

openldap-technical@openldap.org

9 participants
9902 discussions

slapo-chain - can't get it working
by Richard Nelson 19 May '08

19 May '08

I sent this two days ago, from an unsubscribed account and it still hasn't shown up... don't know if moderation is hampered, or if it just didn't make through... I have the basics covered - 1 master, 4 syncrepl slaves (going to 2-3 MM, 1-2 slaves). This setup has been working quite well - supporting AIX, Linux user data, Samba PDC/BDCs, and Kerberos (slapd 2.4.7 Debian Sid/unstable) The only issue I have now, is having to find the master to perform any updates. I'd like to use slapo-chain so that update referrals are automatically handled, especially since so little stuff supports referrals - even things that should. There are a few examples here and there, and unfortunately, some of them contradict others (probably written to different ldap levels). As an example of my plight, here is the output of ldappasswd on a slave machine (ldapmodify shows the same issue, but isn't as easy to show) # # on the slave, when trying a ldappasswd: $ ldappasswd -Ydigest-md5 -w<my passwd> SASL/DIGEST-MD5 authentication started SASL username: renegade SASL SSF: 128 SASL data security layer installed. Result: Referral (10) Referral: ldap://ldap-master.cobpli.svl.ibm.com # # The following is the slave ldap trace, and there is *no* traffic to the master... conn=0 op=1 BIND authcid="renegade(a)COBPLI.SVL.IBM.COM" authzid="renegade(a)COBPLI.SVL.IBM.COM" conn=0 op=1 BIND dn="uid=renegade,ou=users,dc=cobpli,dc=svl,dc=ibm,dc=com" mech=DIGEST-MD5 sasl_ssf=128 ssf=128 conn=0 op=1 RESULT tag=97 err=0 text= conn=0 op=2 EXT oid=1.3.6.1.4.1.4203.1.11.1 conn=0 op=2 PASSMOD conn=0 op=2 RESULT oid= err=10 text= # # The basics work: $ ldapwhoami SASL/GSSAPI authentication started SASL username: renegade(a)COBPLI.SVL.IBM.COM SASL SSF: 56 SASL data security layer installed. dn:uid=renegade,ou=users,dc=cobpli,dc=svl,dc=ibm,dc=com # # Proxy authentication works: $ ldapwhoami -Uproxy -Ydigest-md5 -w<passwd> -Xu:cowboy SASL/DIGEST-MD5 authentication started SASL username: u:cowboy SASL SSF: 128 SASL data security layer installed. dn:uid=cowboy,ou=users,dc=cobpli,dc=svl,dc=ibm,dc=com # # Here is the likely relevant ldap sections (chain overlay, syncprop, updatref): # overlay chain chain-uri "ldap://ldap-master.cobpli.svl.ibm.com/" # Neither of these lines make a difference chain-rebind-as-user TRUE #chain-rebind-as-user FALSE # Here, I've tried simple/sasl, varied saslmech, etc... chain-idassert-bind bindmethod="simple" saslmech=digest-md5 authz=proxyauthz binddn="uid=proxy,ou=users,dc=cobpli,dc=svl,dc=ibm,dc=com" credentials="<passwd>" mode=self chain-idassert-authzFrom "*" syncrepl rid=1 provider=ldap://ldap-master.cobpli.svl.ibm.com/ starttls=no binddn="cn=Replicator,ou=DSA,dc=cobpli,dc=svl,dc=ibm,dc=com" bindmethod=simple credentials=<passwd> searchbase="dc=cobpli,dc=svl,dc=ibm,dc=com" schemaChecking=off type=refreshAndPersist retry="10 10 300 +" updateref ldap://ldap-master.cobpli.svl.ibm.com/

5 10

global email address
by J. Manuel Velasco - UBILIBET 19 May '08

19 May '08

Hello, I am using postfix with ldap. There is one special emaill address called tots(a)ubilibet.com to send mails for everybody, but two nre users I added don't receive mails from this address. I have checked the configuration of ldap to other users and postfix aliases, but i can't see anything regarding to this email address. What can i check more, please ? Thanks in advance. --

1 0

OpenLDAP + Kerberos = Crash?
by Andrew Wiley 18 May '08

18 May '08

I sent this twice before realizing I was sending from another email address that isn't on the list. I don't know if emails from non-subscribers are moderated or just dropped, but in any case, I'm very sorry if those emails show up on the list as duplicates. I'm trying to get a setup of Kerberos and LDAP working. LDAP works fine with plain authentication and everything seems to be set up correctly, but when I try to use GSSAPI authentication, slapd crashes. Application Versions: openldap 2.3.40 heimdal 1.0.1 Server log from startup to crash: May 17 21:50:07 Lagbox slapd[11161]: @(#) $OpenLDAP: slapd 2.3.40 (Jan 15 2008 23:41:27) $ nobody@tk-gwa:/build/src/openldap-2.3.40/servers/slapd May 17 21:50:07 Lagbox slapd[11161]: /etc/openldap/slapd.conf: line 139: "attr" is deprecated (and undocumented); use "attrs" instead. May 17 21:50:07 Lagbox slapd[11161]: /etc/openldap/slapd.conf: line 144: "attr" is deprecated (and undocumented); use "attrs" instead. May 17 21:50:07 Lagbox slapd[11162]: bdb_db_open: unclean shutdown detected; attempting recovery. May 17 21:50:07 Lagbox slapd[11162]: bdb_db_open: Warning - No DB_CONFIG file found in directory /var/lib/openldap/openldap-data: (2) Expect poor performance for suffix dc=wileynetworks,dc=org. May 17 21:50:07 Lagbox slapd[11162]: slapd starting May 17 21:51:04 Lagbox slapd[11162]: conn=0 fd=14 ACCEPT from IP= 127.0.0.1:54066 (IP=0.0.0.0:389) May 17 21:51:04 Lagbox slapd[11162]: conn=0 op=0 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" May 17 21:51:04 Lagbox slapd[11162]: conn=0 op=0 SRCH attr=supportedSASLMechanisms May 17 21:51:04 Lagbox slapd[11162]: conn=0 op=0 SEARCH RESULT tag=101 err=0 nentries=1 text= May 17 21:51:04 Lagbox slapd[11162]: conn=0 op=1 BIND dn="" method=163 May 17 21:51:05 Lagbox slapd[11162]: conn=0 op=1 RESULT tag=97 err=14 text= May 17 21:51:05 Lagbox slapd[11162]: conn=0 op=2 BIND dn="" method=163 May 17 21:51:05 Lagbox slapd[11162]: conn=0 op=2 RESULT tag=97 err=14 text= May 17 21:51:05 Lagbox slapd[11162]: conn=0 op=3 BIND dn="" method=163 May 17 21:51:05 Lagbox slapd[11165] general protection eip:b7abeb05 esp:b6c80df0 error:0 Search command that causes crash: [arew264@Lagbox ~]$ ldapsearch -H ldap://localhost/ -b dc=wileynetworks,dc=org SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) [arew264@Lagbox ~]$ Attached: slapd.conf Note: I am leaving all names intact here because this is a test setup and not any sort of production server. The user that ran the search command is in kerberos and had run kinit and gotten a ticket before running the search. With just a crash and no error messages, I don't know where to start in tracking this down. Andrew Wiley

1 0

openldap and heimdal persistent connection
by Brian Thompson 18 May '08

18 May '08

Hello, We're currently running openldap 2.2.20 with the back-hdb ldap backend. It's being used as a proxy to forward ldapi queries from heimdal 0.6.3's ldap backend to a Sun Directory Server 5.2 which doesn't natively support ldapi. It seems that the connection is persistent such that restarting the Sun Directory Server requires us to then restart openldap in order to make heimdal work properly again. Is there any way around this so that openldap doesn't require restarting each time someone restarts the Sun dierctory? Thanks for any info. -Brian

2 1

Re: Lgoin failed if URI in client's ldap.conf is used
by Luke Lee 16 May '08

16 May '08

I corrected the typo but the problem persists. If I use the HOST directive, the problem appears to go away. What else shall I check? Please advice. Thanks. Luke ----- Original Message ---- From: Pierangelo Masarati <ando(a)sys-net.it> To: Luke Lee <leeluke77(a)yahoo.com> Cc: openldap-technical(a)openldap.org Sent: Friday, May 16, 2008 2:52:22 PM Subject: Re: Lgoin failed if URI in client's ldap.conf is used > I am running OpenLDAP 2.3.39 on a RedHat server. I am encountering a user > ssh login failure on an LDAP client if I use the URI based way to specify > the LDAP servers in the client's /etc/ldap.conf and > /etc/openldap/ldap.conf files. I don't have such a problem if I use the > host based way. A snip of the configurations and the ldap.log on the ldapm > is the following: > /etc/ldap.conf: > uri ldap://ldapm.mydomain.com ldap://ldapsl.mydomain.com > /etc/openldap/ldap.conf: > URI ldap://ldapm.mydomain.com ldap://ldapsl..mydomain.com There's probably a typo in the last URI above; don't know if it's related to your issue, though > May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: > cn=admin,dc=mydomain,dc=com > May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: * > May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [4] applying read(=rscxd) > (stop) > May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [4] mask: read(=rscxd) > May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access granted > by read(=rscxd) > May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access to > "uid=luke_l,ou=People,dc=mydomain,dc=com" "uid" requested > May 16 14:16:33 ldapm slapd[27604]: => acl_get: [2] attr uid > May 16 14:16:33 ldapm slapd[27604]: access_allowed: no res from state > (uid) > May 16 14:16:33 ldapm slapd[27604]: => acl_mask: access to entry > "uid=luke_l,ou=People,dc=mydomain,dc=com", attr "uid" requested > May 16 14:16:33 ldapm slapd[27604]: => acl_mask: to value by "", (=0) > May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: self > May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: > cn=admin,dc=mydomain,dc=com > May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: * > May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [4] applying read(=rscxd) > (stop) > May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [4] mask: read(=rscxd) > May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access granted > by read(=rscxd) > May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access to > "uid=luke_l,ou=People,dc=mydomain,dc=com" "userPassword" requested > May 16 14:16:33 ldapm slapd[27604]: => acl_get: [1] attr userPassword > May 16 14:16:33 ldapm slapd[27604]: access_allowed: no res from state > (userPassword) > May 16 14:16:33 ldapm slapd[27604]: => acl_mask: access to entry > "uid=luke_l,ou=People,dc=mydomain,dc=com", attr "userPassword" requested > May 16 14:16:33 ldapm slapd[27604]: => acl_mask: to value by "", (=0) > May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: self > May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: anonymous > May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [2] applying auth(=xd) > (stop) > May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [2] mask: auth(=xd) > May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access denied > by auth(=xd) > May 16 14:16:33 ldapm slapd[27604]: send_search_entry: conn 35 access to > attribute userPassword, value #0 not allowed You only have "auth" access to the userPassword attribute (which sounds reasonable) but the client is trying to "read" the password. I suspect a misconfiguration of the client, which tries to auth by internally comparing userPassword values instead of using an LDAP bind operation. > May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access to > "uid=luke_l,ou=People,dc=mydomain,dc=com" "shadowLastChange" requested > May 16 14:16:33 ldapm slapd[27604]: => acl_get: [2] attr shadowLastChange > May 16 14:16:33 ldapm slapd[27604]: access_allowed: no res from state > (shadowLastChange) > May 16 14:16:33 ldapm slapd[27604]: => acl_mask: access to entry > "uid=luke_l,ou=People,dc=mydomain,dc=com", attr "shadowLastChange" > requested > May 16 14:16:33 ldapm slapd[27604]: => acl_mask: to value by "", (=0) > May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: self > May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: > cn=admin,dc=mydomain,dc=com > May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: * > May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [4] applying read(=rscxd) > (stop) > May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [4] mask: read(=rscxd) > May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access granted > by read(=rscxd) > > Can anyone please help resolve the above problem? Thanks a lot! p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Lgoin failed if URI in client's ldap.conf is used
by Luke Lee 16 May '08

16 May '08

I am running OpenLDAP 2.3.39 on a RedHat server. I am encountering a user ssh login failure on an LDAP client if I use the URI based way to specify the LDAP servers in the client's /etc/ldap.conf and /etc/openldap/ldap.conf files. I don't have such a problem if I use the host based way. A snip of the configurations and the ldap.log on the ldapm is the following: /etc/ldap.conf: uri ldap://ldapm.mydomain.com ldap://ldapsl.mydomain.com /etc/openldap/ldap.conf: URI ldap://ldapm.mydomain.com ldap://ldapsl..mydomain.com May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: cn=admin,dc=mydomain,dc=com May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: * May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [4] applying read(=rscxd) (stop) May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [4] mask: read(=rscxd) May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access granted by read(=rscxd) May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access to "uid=luke_l,ou=People,dc=mydomain,dc=com" "uid" requested May 16 14:16:33 ldapm slapd[27604]: => acl_get: [2] attr uid May 16 14:16:33 ldapm slapd[27604]: access_allowed: no res from state (uid) May 16 14:16:33 ldapm slapd[27604]: => acl_mask: access to entry "uid=luke_l,ou=People,dc=mydomain,dc=com", attr "uid" requested May 16 14:16:33 ldapm slapd[27604]: => acl_mask: to value by "", (=0) May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: self May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: cn=admin,dc=mydomain,dc=com May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: * May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [4] applying read(=rscxd) (stop) May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [4] mask: read(=rscxd) May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access granted by read(=rscxd) May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access to "uid=luke_l,ou=People,dc=mydomain,dc=com" "userPassword" requested May 16 14:16:33 ldapm slapd[27604]: => acl_get: [1] attr userPassword May 16 14:16:33 ldapm slapd[27604]: access_allowed: no res from state (userPassword) May 16 14:16:33 ldapm slapd[27604]: => acl_mask: access to entry "uid=luke_l,ou=People,dc=mydomain,dc=com", attr "userPassword" requested May 16 14:16:33 ldapm slapd[27604]: => acl_mask: to value by "", (=0) May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: self May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: anonymous May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [2] applying auth(=xd) (stop) May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [2] mask: auth(=xd) May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access denied by auth(=xd) May 16 14:16:33 ldapm slapd[27604]: send_search_entry: conn 35 access to attribute userPassword, value #0 not allowed May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access to "uid=luke_l,ou=People,dc=mydomain,dc=com" "shadowLastChange" requested May 16 14:16:33 ldapm slapd[27604]: => acl_get: [2] attr shadowLastChange May 16 14:16:33 ldapm slapd[27604]: access_allowed: no res from state (shadowLastChange) May 16 14:16:33 ldapm slapd[27604]: => acl_mask: access to entry "uid=luke_l,ou=People,dc=mydomain,dc=com", attr "shadowLastChange" requested May 16 14:16:33 ldapm slapd[27604]: => acl_mask: to value by "", (=0) May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: self May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: cn=admin,dc=mydomain,dc=com May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: * May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [4] applying read(=rscxd) (stop) May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [4] mask: read(=rscxd) May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access granted by read(=rscxd) Can anyone please help resolve the above problem? Thanks a lot! Luke

2 1

ldap - adding file from application to ldap
by Raghavendra Sangamesh 16 May '08

16 May '08

Hi I have installed openaldap And I am able to add default things to the bdb (database). I have used this link to install things and to add simple data http://www.devshed.com/c/a/Administration/Understanding-LDAP-part-2/1/ Now I am adding default things like this Here is my example.ldif file dn: dc=my-domain,dc=com objectclass: dcObject objectclass: organization o: MY DOMAIN COMPANY dc: my-domain dn: cn=Manager,dc=my-domain,dc=com objectclass: organizationalRole cn: Manager Now I am adding default things like this /usr/local/openldap/bin/ldapadd -x -D "cn=Manager,dc=my-domain,dc=com" -W -f my-domain.ldif Now I want to add from My CA simulator and retrive data . ie I have ca.ldif file I want to add this data to database, I am unable to do that. Here is the file that I want to add dn: cn=schema objectClass: top objectClass: ldapSubentry objectClass: subschema cn: schema attributeTypes: ( isrevoked-oid NAME 'isrevoked' SYNTAX 1.3.6.1.4.1.1466.115. 121.1.27 X-ORIGIN 'user defined' ) attributeTypes: ( cauid-oid NAME 'cauid' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' ) objectClasses: ( utscau-oid NAME 'utscau' SUP top STRUCTURAL MUST ( cauid $ is revoked ) X-ORIGIN 'user defined' ) nsSchemaCSN: 4632762e000000000000 I dnt to how to go about this , let me know for any solutions it would be great . I want to know how can I modify my slapd.conf to add this above file and retrive data. Thanks & Regards Raghavendra S Mascon Global Limited EMAIL DISCLAIMER : This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. Any unauthorised distribution or copying is strictly prohibited. If you receive this transmission in error, please notify the sender by reply email and then destroy the message. Opinions, conclusions and other information in this message that do not relate to official business of Mascon shall be understood to be neither given nor endorsed by Mascon. Any information contained in this email, when addressed to Mascon clients is subject to the terms and conditions in governing client contract. Whilst Mascon takes steps to prevent the transmission of viruses via e-mail, we can not guarantee that any email or attachment is free from computer viruses and you are strongly advised to undertake your own anti-virus precautions. Mascon grants no warranties regarding performance, use or quality of any e-mail or attachment and undertakes no liability for loss or damage, howsoever caused.

2 1

RES: Openldap 2.3.39 Password Policy
by Gustavo Mendes de Carvalho 15 May '08

15 May '08

Hi Venkata, Check where is your slapd binary. In this directory, you will see a libexec directory. Inside you can find ppolicy.la module. Execute a pwd command and put pwd output in your slapd.conf file Here is my slapd.conf file ####################################################################### # Global definitions ####################################################################### include /usr/local/ldap/servers/slapd/schema/core.schema include /usr/local/ldap/servers/slapd/schema/cosine.schema include /usr/local/ldap/servers/slapd/schema/inetorgperson.schema include /usr/local/ldap/servers/slapd/schema/misc.schema include /usr/local/ldap/servers/slapd/schema/nis.schema include /usr/local/ldap/servers/slapd/schema/ppolicy.schema pidfile /var/run/slapd.pid argsfile /var/run/slapd.args logfile /var/log/ldap.log loglevel 256 # Load dynamic backend modules: modulepath /usr/local/libexec/openldap ### moduleload back_ldap.la ### moduleload back_passwd.la moduleload accesslog.la ### moduleload pcache.la moduleload ppolicy.la moduleload unique.la ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "c=country" rootdn "cn=manager,c=country" rootpw {SSHA}password's hash directory /usr/local/var/openldap-data/ mode 0600 cachesize 1000000 checkpoint 256 60 overlay ppolicy ppolicy_default "cn=default,ou=policies,o=org,c=country" ####################################################################### # ACL's ####################################################################### access to attrs=userPassword by self write by anonymous auth by dn="cn=manager,c=country" write by * read access to * by self write by dn="cn=manager,c=country" write by * read ####################################################################### # Indexes ####################################################################### index objectClass eq,pres index uid,memberUid eq,pres,sub Another tip is remove your shadow parameters from your user accoount. I mean, when you create an account, unset shadow properties. Leave all shadow properties defined in ppolicy options. Check my user output dn: uid=sdanyluk,ou=orgunit,o=org,c=country objectClass: posixAccount objectClass: top objectClass: inetOrgPerson objectClass: person loginShell: /bin/bash givenName: Scott sn: Danyluk displayName: Scott Danyluk uid: sdanyluk homeDirectory: /home/sdanyluk cn: Scott Danyluk uidNumber: 14838 userPassword: xxxxxxxxxxxxxxxxxxxxxxx gidNumber: 25075 Regards --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com ________________________________ De: Venkata Janardhana [mailto:avjana@gmail.com] Enviada em: quinta-feira, 15 de maio de 2008 13:51 Para: jarbas.junior(a)gmail.com; gmcarvalho(a)gmail.com Cc: openldap-technical(a)openldap.org Assunto: Openldap 2.3.39 Password Policy, Hello , I see the you had same issue for the openldap 2.3.39 password policy. I am struggling to get this working like anything. Could you please help me out in configuring password policy and change the user password. I have installed openldap 2.3.39 and ./configure --prefix=/usr/local \ --libexecdir=/usr/sbin \ --sysconfdir=/etc \ --localstatedir=/srv/ldap \ --disable-debug \ --enable-dynamic \ --enable-crypt \ --enable-modules \ --enable-rlookups \ --enable-backends \ --enable-overlays \ --disable-sql && make depend && make make test su root -c 'make install I cannot find modulepath /usr/lib/openldap moduleload ppolicy.la files. Here is my slapd.conf and ldap search file hese are the following slapd.conf file and ldapsearch output.. User can login to the ldap server for the first time and could change the password but cannot login with new password or old password. having hard time in getting password policy working. COuld you some pls help me out.. whats the wrong.. thanks in advance, # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/ppolicy.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! access to amdexrs=userPassword by self write by * auth access to * by * read ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=sales,dc=amdex,dc=com" rootdn "cn=Manager,dc=sales,dc=amdex,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq ---------------------------------------------------------- [root@testserver06 openldap]# ldapsearch -x -b 'dc=sales,dc=amdex,dc=com' '(objectclass=*)' # extended LDIF # # LDAPv3 # base <dc=sales,dc=amdex,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # sales.amdex.com dn: dc=sales,dc=amdex,dc=com dc: sales objectClass: top objectClass: domain objectClass: domainRelatedObject associatedDomain: sales.amdex.com # People, sales.amdex.com dn: ou=People,dc=sales,dc=amdex,dc=com ou: People objectClass: top objectClass: organizationalUnit objectClass: domainRelatedObject associatedDomain: sales.amdex.com # Group, sales.amdex.com dn: ou=Group,dc=sales,dc=amdex,dc=com ou: Group objectClass: top objectClass: organizationalUnit objectClass: domainRelatedObject associatedDomain: sales.amdex.com # ja5199, Group, sales.amdex.com dn: cn=ja5199,ou=Group,dc=sales,dc=amdex,dc=com objectClass: posixGroup objectClass: top cn: ja5199 gidNumber: 609 # ja5199, People, sales.amdex.com dn: uid=ja5199,ou=People,dc=sales,dc=amdex,dc=com uid: ja5199 cn: Jana Avula givenName: Jana sn: Avula mail: ja5199(a)sales.amdex.com objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowLastChange: 14001 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 609 gidNumber: 609 homeDirectory: /home/ja5199 gecos: Jana Avula # Policies, sales.amdex.com dn: ou=Policies,dc=sales,dc=amdex,dc=com objectClass: top objectClass: organizationalUnit ou: Policies # default, Policies, sales.amdex.com dn: cn=default,ou=Policies,dc=sales,dc=amdex,dc=com objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdamdexribute: 2.5.4.35 pwdMaxAge: 15552000 pwdExpireWarning: 864000 pwdInHistory: 1 pwdCheckQuality: 0 pwdMinLength: 8 pwdMaxFailure: 4 pwdLockout: TRUE pwdLockoutDuration: 1920 pwdGraceAuthNLimit: 5 pwdFailureCountInterval: 0 pwdMustChange: TRUE pwdAllowUserChange: TRUE pwdSafeModify: TRUE # search result search: 2 result: 0 Success # numResponses: 8 # numEntries: 7

1 0

openldap and mysql authentication
by thom.laurent＠free.fr 15 May '08

15 May '08

Hi, I have a simple question... I want to use openldap as an address book, so it can be used with mail clients like thunderbird, outlook... I already have a mysql database to store users for my mail server, and I dont want to duplicate these informations. Can I use this sql database as a source for the openldap access control, or do I have to store all my users in the ldap ? This way I could authenticate using user accounts stored in the mysql database and keep all my contact informations in the ldap... Thanks for your answers!

2 1

"invalid structural object class chain"
by Karsten Kankowski 14 May '08

14 May '08

Dear wise guys! Sorry for a "newby" question: I would like to load following LDIF: dn: cn=Zaphod Beblebrox, ou=people,cu=user,cu=a-d,cu=natco,dc=cax,dc=airbus,dc=com cn: Zaphod Beblebrox objectClass:Top objectClass: Person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: account objectClass: posixAccount gidNumber: 42 homeDirectory: /home/ZZ-Plural-Z-Alpha userid:zaphod I get back: ldapadd: Object class violation (65) additional info: invalid structural object class chain (inetOrgPerson/account) I searched before I wrote this mal the Web/ the Forum / the FAQ / the admin-Guide :-) I found at the admin guide chapter C1.13 an description about this issue. BUT: I´m sorry! I don´t understand this real hard to read english. All what I hopfully know is, that a subsequent class of a Structural can be one or more auxiliary OR an other Structural. I assume that Top->Person->organizationalPerson->inetOrgperson "looks" like one structural class in case that they inherit via the SUP keyword ( called superclass ?? ) For that I do not understand why the account object class can´t be "connect" to that superclass. What´s wrong here and how do can I use the account as subsequent class of inetOrgPerson. The "connect" of posixAccount to account should be also possible. Thanks a lot for your help in advance, Karsten (Alien) -- //// Never forget your towel \\\\ *********************************************************** Karsten Kankowski on behalf of Computacenter Subcontractor for OADI Phone: +49 (0)40 743 74589 Fax: +49 (0)40 743 870 74589 Mailto:Karsten.Kankowski@airbus.com PgP-Key 0x754EEF1D ********************************************************** The information in this e-mail is confidential. The contents may not be disclosed or used by anyone other then the addressee. Access to this e-mail by anyone else is unauthorised. If you are not the intended recipient, please notify Airbus immediately and delete this e-mail. Airbus cannot accept any responsibility for the accuracy or completeness of this e-mail as it has been sent over public networks. If you have any concerns over the content of this message or its Accuracy or Integrity, please contact Airbus immediately. All outgoing e-mails from Airbus are checked using regularly updated virus scanning software but you should take whatever measures you deem to be appropriate to ensure that this message and any attachments are virus free.

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical