openldap-technical

openldap-technical@openldap.org

9701 discussions

Question concerning the dynlist overlay and single valued attributes
by Gerd Schering 14 Feb '08

14 Feb '08

Hi, I wnt to use the dynlist overlay to collect attribute values from entries in different branches of the DIT, via a dynamic group like this: dn: cn=dynamicTestList,ou=Groups,dc=local,dc=site cn: dynamicTestList objectclass: groupOfURLs memberURL: ldap:///dc=local,dc=site?sn,persID?sub?(objectclass=*) When I query this, I via ldapsearch -x -H ldaps:/// \ -b "cn=dynamicTestList,dc=local,dc=site" -s base "(objectclass=*)" I recieve a reasonable number of "sn" values but just one for "persID", despite the fact, that there should be a lot of them. "persID" is defined SINGLE VALUE. Is this the reason for receiving just one item and if so, what can I do to circumvent this, i.e. retrieve all "persID" from matched entries? BTW, does the dynlist overlay support the "cn=config" staff? Any help will be appreciated, Gerd -- ------------------------------------------------------ -- Gerd Schering, Email: Schering(a)tubit.TU-Berlin.DE -- ------------------------------------------------------

2 2

SSL Help
by Vinh.CTR.Hoang＠faa.gov 13 Feb '08

13 Feb '08

Hi, I'm having some troubles with openldap w/ TLS. I can't seem to do a ldapsearch -x -LLL -ZZ, as it is giving be back "SSL3_GET_SERVER_CERTIFICATE:certificate verify failed" On the server side log I'm getting: TLS trace: SSL3 alert read: fatal:unknown CA TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept TLS: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca s3_pkt.c:1053 I've tried and tested my ssl connection using: openssl s_client -connect ldap1.mylan:636 -showcerts -state -CAfile /usr/local/etc/openldap/cacert.pem and that works, althought if I use "TLSVerifyClient demand" in slapd.conf, the server will reject the connection saying that the client didn't send the certificate. I also tried the client authentication ssl test and the works w/ and w/o the TLSVerifyClient demand option: openssl s_client -connect ldap1.mylan:636 -state \ -CAfile /usr/local/etc/openldap/cacert.pem \ -cert /usr/local/etc/openldap/slapd-cert-ldap1.pem \ -key /usr/local/etc/openldap/slapd-key-ldap1.pem Does any know what i'm doing wrong? Here are the tls part of my configs: slapd.conf .... #TLS SSL keys TLSCipherSuite HIGH:MEDIUM:+TLSv1:+SSLv2:SSLv3 TLSCACertificateFile /usr/local/etc/openldap/cacert.pem TLSCertificateFile /usr/local/etc/openldap/slapd-cert-ldap1.pem TLSCertificateKeyFile /usr/local/etc/openldap/slapd-key-ldap1.pem #TLSVerifyClient demand .... ldap.conf BASE dc=mylan HOST ldap1.mylan #URI ldaps://127.0.0.1:636 TLS_CACERT /usr/local/etc/openldap/cacert.pem ..... /etc/ldap.conf # network or connect timeouts (see bind_timelimit). host 127.0.0.1 # The distinguished name of the search base. #base dc=caplan,dc=org base dc=mylan # Another way to specify your LDAP server is to provide an # uri with the server name. This allows to use # Unix Domain Sockets to connect to a local LDAP Server. host ldap1.mylan #uri ldap://127.0.0.1/ #uri ldap://127.0.0.1/ ldaps://127.0.0.1/ #uri ldapi://%2fvar%2frun%2fldapi_sock/ # Note: %2f encodes the '/' used as directory separator # The LDAP version to use (defaults to 3 # if supported by client library) ldap_version 3 # The distinguished name to bind to the server with. # Optional: default is to bind anonymously. #binddn cn=NonAnon,dc=caplan,dc=org # The credentials to bind with. # Optional: default is no credential. #bindpw SeCrEt # The distinguished name to bind to the server with # if the effective user ID is root. Password is # stored in /etc/ldap.secret (mode 600) #rootbinddn cn=root,dc=padl,dc=com # The port. # Optional: default is 389. port 389 .. ... .. # OpenLDAP SSL mechanism # start_tls mechanism uses the normal LDAP port, LDAPS typically 636 ssl start_tls #ssl on # OpenLDAP SSL options # Require and verify server certificate (yes/no) # Default is to use libldap's default behavior, which can be configured in # /etc/openldap/ldap.conf using the TLS_REQCERT setting. The default for # OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes". tls_checkpeer yes # CA certificates for server certificate verification # At least one of these are required if tls_checkpeer is "yes" #tls_cacertfile /etc/ssl/ca.cert #tls_cacertdir /etc/ssl/certs tls_cacertfile /usr/local/etc/openldap/cacert.pem # Seed the PRNG if /dev/urandom is not provided #tls_randfile /var/run/egd-pool # SSL cipher suite # See man ciphers for syntax #tls_ciphers TLSv1 # Client certificate and key # Use these, if your server requires client authentication. #tls_cert #tls_key Thanks, Vinh

2 1

Re: Ldap ppolicy schema entries
by Aravind Arjunan 12 Feb '08

12 Feb '08

* Am still facing issue while configuring ldap in master slave for replication. am using openldap 2.2 version. OS: RHEL 4.0 And am trying to configure master slave replication thro slurpd method. i had configured my master slapd.conf and slave slave slapd.conf. similarly i configured master and slave ldap.conf. After that i stopped the service in master and slave by [root@server ~]# service ldap stop Stopping slapd: [ OK ] Stopping slurpd: [ OK ] [root@server ~]# similarly in slave also. then i copied the database manually using slapcat [root@server openldap]# slapcat -b "dc=example,dc=com" -v -l example.com.ldif # id=00000001 # id=00000003 [root@server openldap]# scp example.com.ldif root(a)151.2.119.133 :/var/lib/ldap/example.com/ root(a)151.2.119.133's password: example.com.ldif 100% 747 0.7KB/s 00:00 [root@server openldap]# In slave : [root@slave openldap]# slapadd -b "dc=example,dc=com" -v -l example.com.ldif added: "dc=example,dc=com" (00000001) added: "cn=Manager,dc=example,dc=com" (00000002) [root@slave openldap]# but when i create a user in ldapmaster and check that user in slave,i was not able to found. there was no log in replogfile. [root@server ~]# useradd test [root@server ~]# passwd test Changing password for user test. New UNIX password: Retype new UNIX password: passwd: all authentication tokens updated successfully. [root@server ~]# In slave [root@slave openldap]# id test id: test: No such user Here is my configuration files master slapd.conf * *=============* *#######################################################################* # ldbm and/or bdb database definitions ####################################################################### * database bdb * #The base of your directory * suffix "dc=example,dc=com" * #where the database files are physically stored * directory "/var/lib/ldap/example.com" * #Distinguished name,not subject to access control * rootdn "cn=Manager,dc=example,dc=com" rootpw password * # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Replicas of this database * replica uri=ldap://=151.2.119.133:389 suffix="dc=example,dc=com" binddn="cn=syncuser,dc=example,dc=com" bindmethod=simple credentials=hcllch replogfile /var/lib/ldap/replogfile * #ACL's * access to attrs=userpassword by self write by anonymous auth by dn="cn=syncuser,dc=example,dc=com" read by * auth access to * by self write by dn="cn=syncuser,dc=example,dc=com" read by * read * #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM [root@server openldap]# * Slave slapd.conf ============== * ####################################################################### # ldbm and/or bdb database definitions ####################################################################### * database bdb * #The base of your directory * suffix "dc=example,dc=com" * #where the database files are physically stored #directory "/var/lib/ldap/ldap-test" #Distinguished name,not subject to access control * rootdn "cn=Manager,dc=example,dc=com" rootpw password * # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended * updatedn cn=syncuser,dc=example,dc=com updateref ldap://151.2.119.120 directory /var/lib/ldap/example.com access to attrs=userpassword by self write by anonymous auth by dn="cn=syncuser,dc=example,dc=com" write by * auth access to * by self write by dn="cn=syncuser,dc=example,dc=com" write by * read * # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM [root@slave openldap]# * Master ldap.conf ============== * # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example, dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never * host 151.2.119.120 151.2.119.133 base dc=example,dc=com binddn cn=Manager,dc=example,dc=com bindpw password bind_policy soft pam_password expo Slave ldap.conf ============== * # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example, dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never * host 151.2.119.133 151.2.119.120 base dc=example,dc=com binddn cn=Manager,dc=example,dc=com bindpw password bind_policy soft pam_password expo *

2 1

Master Slave ldap
by Aravind Arjunan 11 Feb '08

11 Feb '08

---------- Forwarded message ---------- From: Aravind Arjunan <aravind.arjunan(a)gmail.com> Date: 9 Feb 2008 11:20 Subject: Fwd: Ldap ppolicy schema entries To: openldap-technical(a)openldap.org ---------- Forwarded message ---------- From: Aravind Arjunan <aravind.arjunan(a)gmail.com> Date: 9 Feb 2008 11:19 Subject: Re: Ldap ppolicy schema entries To: Buchan Milne <bgmilne(a)staff.telkomsa.net> Am trying to confiure the ldap in master-slave It was mentioned in the document that after configuring the master and slave slapd.conf file for replication, shutdown the master slapd,so you can copy the database. I cant understand in this part,how to copy the database. where to copy?tell me how to check that my slave slapd is working? wheather by giving ldapsearch command in slave instance or by any other. am attaching the master and slave conf file for reference,please mention me if there is any mistake.

2 1

Fwd: Ldap ppolicy schema entries
by Aravind Arjunan 08 Feb '08

08 Feb '08

---------- Forwarded message ---------- From: Aravind Arjunan <aravind.arjunan(a)gmail.com> Date: 9 Feb 2008 11:19 Subject: Re: Ldap ppolicy schema entries To: Buchan Milne <bgmilne(a)staff.telkomsa.net> Am trying to confiure the ldap in master-slave It was mentioned in the document that after configuring the master and slave slapd.conf file for replication, shutdown the master slapd,so you can copy the database. I cant understand in this part,how to copy the database. where to copy?tell me how to check that my slave slapd is working? wheather by giving ldapsearch command in slave instance or by any other. am attaching the master and slave conf file for reference,please mention me if there is any mistake.

1 0

tips in ldappasswd
by Gustavo Mendes de Carvalho 08 Feb '08

08 Feb '08

Hi there, I have an OpenLDAP Server authenticating with TLSv1, but I ´foound some probelms when I have to change my ldap user´s password. I use the following command to try to change it [ming@ldap-cli ~]$ ldappasswd -AS -ZZ -H ldaps://ldap.server/ -D uid=ming,ou=org-unit,o=org,c=br Old password: Re-enter old password: New password: Re-enter new password: ldap_start_tls: Operations error (1) additional info: TLS already started [ming@ldap-cli ~]$ ldappasswd -AS -H ldaps://ldap.server/ -D uid=ming,ou=org-unit,o=org,c=br Old password: Re-enter old password: New password: Re-enter new password: SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Miscellaneous failure (No credentials cache found) I store only password's hashes in my ldap database, so I need to know how to replace this hash. If I connect to my ldap server using some ldap browser, like ldapadmin, I can change my user´s password, but I need to change it using some command line, like ldappasswd. Do you have some examples about how to use ldappasswd ? I already search it in Google, but all expamples that I found tells me that to use same command that I'm already using. Thanks iin advance --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com

3 5

2.3.39 vs 2.3.40 (as Re: (ITS#5354) slapd repeatedly hangs and stops reponding)
by Buchan Milne 08 Feb '08

08 Feb '08

On Friday 08 February 2008 03:35:54 quanah(a)zimbra.com wrote: > --On Thursday, February 07, 2008 8:13 PM -0500 Oren Laadan > > <orenl(a)cs.columbia.edu> wrote: > > will fix the symbols now. thanks. > > > > as for the patch, it seems unrelated as it fixes a problem during the > > start-up of the daemon; also, it's for 2.4.7, and I just downgraded > > back to 2.4.49 (which I was using originally). the decision to move > > up was because I hoped that the problem would disappear when using a > > more recent version of openldap. as it turns out, it didn't :( > > There's no such thing as 2.4.49. I assume you mean 2.3.40? Or 2.3.39? I > would use 2.3.40 over 2.3.39 Quoting Howard: "While ITS#5342 is still being investigated, I would recommend that everyone use 2.3.39 and not 2.3.40. Sorry for the trouble." ITS#5342 is still open, and while the last two followups seem to indicate that the corruption was not the fault of 2.3.40 ... I'm planning an upgrade for this weekend (from 2.3.34 for one set of servers, and from 2.3.11 for another), and thus far I'm hoping to run with 2.3.39 with most fixes in 2.3.40 (plus #5358's fix), but not the dn2id lock fix ... Maybe I should make provision for an export/import during my upgrade? Regards, Buchan

3 3

Re: Ldap ppolicy schema entries
by Ljunghammar, Darryl K 08 Feb '08

08 Feb '08

Hi Tonni, Could you give me an example of what you meant by putting a + at the end of the ldapsearch command? When I tried putting a plus at the end it didn't give me any found results so I must be doing something wrong with the syntax. I used: [root@alph bin]# ldapsearch -x -H ldaps://alph/ -D "cn=Manager,dc=dst,dc=boeing,dc=com" -W -b "ou=people,dc=dst,dc=boeing,dc=com" "(uid=darryl+)" Enter LDAP Password: xxxxxx # extended LDIF # # LDAPv3 # base <ou=people,dc=dst,dc=boeing,dc=com> with scope sub # filter: (uid=darryl+) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 But if I leave off the + I do get the user fields so I know it has data. Thanks, Darryl ________________________________________________________________________ ___________ Ljunghammar, Darryl K skrev, on 23-01-2008 21:56: I would like to view the ppolicy schema attributes for a user when I do a "ldapsearch" but they don't show up. For example, I would like to see the "pwdHistory" attribute for a user. I know it is being updated because if I enter a previously used password it tells me it can't be reused. I am using openldap 2.3.39-3 on a Redhat 5.1 system. Put a '+' at the end of your ldapsearch string and you'll see only the operational attributes, *if* your ACLs permit this. You will not see empty attributes, only those with values. Best, --Tonni -- Tony Earnshaw Email: tonni at hetnet dot nl

2 1

Openldap and last logon
by Ljunghammar, Darryl K 08 Feb '08

08 Feb '08

Hi, I there a way to record the last logon and hostname into a user's record in openldap? I am using openldap 2.3.27-8 on a Rh5.1 system. Thanks, Darryl

1 0

Trouble Installing LDAP Client On Ubuntu Linux
by Ldap Newbie 08 Feb '08

08 Feb '08

Hi, I have some trouble with the installation of the LDAP client on Ubuntu Linux. I followed the instructions as described the articles below. 1. <http://www.linux.com/feature/114074> 2. <http://mcwhirter.com.au/node/25> Although I followed the steps in the article my Ubuntu keeps running exactly as before, authenticating without using LDAP. Problem is that I don't have a clue what's happening. So any suggestions on what files to check or what commands to run to test things are appreciated. What I do know about this configuration problem is: * The LDAP server is up and running, it's usable from another application * I don't see any incoming traces when I run slapd in full debug mode and try some actions like rebooting or getent passwd from the client * The getent passwd <username> test as described in article .2 fails So likely something went wrong with the configuration of $ apt-get install libpam-ldap libnss-ldap Is there a way I can rerun the installer so that I can verify the configuration data I entered. What other things should I try ? All suggestions apprectiated. Thanks, Carl _________________________________________________________________ Who's friends with who and co-starred in what? http://www.searchgamesbox.com/celebrityseparation.shtml

3 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical