openldap-technical

openldap-technical@openldap.org

7 participants
9901 discussions

Disk Quota with LDAP
by Shafiqul Abedin 04 May '08

04 May '08

Hello All: I am new to this forum. If I am making any mistakes, please let me know. After searching google a million times, I am finally asking you guys. How do I set disk quota with LDAP? Is it possible to do it at all? Any docuentation? Any help? I am new to LDAP. Please help. Thanks ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 1

Tony Earnshaw, 29/02/40 - 29/04/08
by Ace Suares 04 May '08

04 May '08

Dear List, Tony Earnshaw, active member of this list, has passed away last Tuesday. About a month ago he was diagnosed with stage 5 lung cancer and within a very short time Tony left us. Tony's body will be cremated Monday 5th of May in Amsterdam. For those who want to express their feelings, please visit http://www.xs4all.nl/~snore/tony If among you there are people who want to have more information, send me an email at ace(a)suares.an and I will forward it to the kind people that take care of his affairs. With Sadness, Ace Suares

1 0

query Active Directory
by Chris Henderson 04 May '08

04 May '08

I am querying AD to get the first proxyaddresses:smtp field with only the username but it is giving me lots of other information that I don't really need. I was wondering if it is be possible to filter the query in slapd.conf to give me what I need. Here's my slapd.conf Allow bind_v2 access to dn.base="" by * read access to * by * read database ldap suffix "dc=ad3,dc=merog,dc=org" uri "ldap://ad3.merog.org" query_filter=(PROXYADDRESSES :smtp:%s@*) cachesize 10000 sizelimit unlimited I am querying for PROXYADDRESSES which comes like this: PROXYADDRESSES: smtp:username@merog.org - I only want the "username" bit. Here's my query: ldapsearch -x -h ad3.merog.org -b "dc=ad3,dc=merog,dc=org" cn="user name" I don't want to use any sed, awk script to achieve the result. Just would like to use openldap itself if that's at all possible. Thanks for any help.

4 6

Authentication Problem Regarding aliasedObjectName
by Christian Felsing 02 May '08

02 May '08

Hello, my installation has two OUs, one contains real inetOrgPerson objects, other one contains aliases to the first OU. First OU contains DNs which are not acceptable to a specific application (pls. don't ask me why) so 2nd OU was introduced with DNs which are acceptable to that application. Unfortunally, authentication to an alias seems to be not possible, because that application is not able to do dereferencing. OU1: # 007(a)x86.be, freemail, my.net dn: uid=007(a)example.com,ou=mail,dc=my,dc=net objectClass: top objectClass: inetOrgPerson uid: 007(a)x86.be cn: testuser Application does not like DN "uid=007(a)example.com,ou=mail,dc=my,dc=net" but other applications depend on it. So following was introduced: OU2: # testuser, members, my.net dn: uid=testuser,ou=members,dc=my,dc=net objectClass: top objectClass: alias objectClass: extensibleObject uid: testuser aliasedObjectName: uid=007(a)example.com,ou=mail,dc=my,dc=net That application would accept DN "uid=testuser,ou=members,dc=my,dc=net", but is not able to dereference that to "uid=007(a)example.com,ou=mail,dc=my,dc=net" :-( Is there a way to let a proxy do dereferencing an aliasedObjectName to "real" object, so that application may be able to authenticate to that proxy ? best regards Christian

2 1

how to stop openldap
by Paul Lee 02 May '08

02 May '08

I know to start openldap, the following command is used. > slapd -f slapd.conf but to shutdown openldap, what is the command used ? Currently, I am using "pkill slapd" but I think it's not the proper way. Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

2 1

Starting Openldap and adding a new entry into the dabase
by youness hsina 02 May '08

02 May '08

Hi All, i'm a french student, i'm trying to make an Opendldap server on FreeBSD. my openldap version is : openldap-2.3.41 i configured the "slapd.conf" and ldap.conf" in order to start the server. i have two problems the first one is : i try to start the server but it doesn't work ... i don't understand whay it doesn"t work!! stavril# /usr/local/etc/rc.d/slapd start Starting slapd. stavril# /usr/local/etc/rc.d/slapd status slapd is not running. the 2 nd one is : i want to add a new entry into my database but i can't !! stavril# ldapadd -h localhost -x -f test.ldif ldap_bind: Can't contact LDAP server (-1) here there are the files of configuration : slapd.conf, ldap.conf, test.ldif, rc.conf *stavril# cat slapd.conf* # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema #include /usr/local/etc/openldap/schema/nis.schema schemacheck on # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: modulepath /usr/local/libexec/openldap moduleload back_bdb # moduleload back_ldap # moduleload back_ldbm # moduleload back_passwd # moduleload back_shell # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! access to attrs=userPassword by dn="cn=Manager,dc=uvsq,dc=fr" write by dn="cn=proxyuser,dc=uvsq,dc=fr" read by self write by anonymous auth by * none access to attrs=uidNumber,gidNumber by dn="cn=Manager,dc=uvsq,dc=fr" write by dn="cn=proxyuser,dc=uvsq,dc=fr" read by * read access to * by dn="cn=Manager,dc=uvsq,dc=fr" write by self write by * read ##################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=uvsq,dc=fr" rootdn "cn=Manager,dc=uvsq,dc=fr" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/db/openldap-data mode 700 # indice to maintain index objectClass eq #last modification lastmod on *stavril# cat ldap.conf* # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example, dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 BASE dc=uvsq, dc=fr URI ldap://127.0.0.1/ ldap_version 3 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never stavril# cat test.ldif dn: dc=uvsq, dc= fr dc: uvsq objectClass: top objectClass: domain dn: cn=Manager, dc=uvsq, dc=fr objectClass: organizationalRole cn: Manager *rc.conf (the importante lines) * slapd_enable="YES" slapd_flags="-h ldap://%2fvar%2frun%2fopenldap%2fldapi/ ldap://0.0.0.0" slapd_sockets="/var/run/openldap/ldapi" stavril# cat test.ldif dn: dc=uvsq, dc= fr dc: uvsq objectClass: top objectClass: domain dn: cn=Manager, dc=uvsq, dc=fr objectClass: organizationalRole cn: Manager i tried to find a soltuion to my problem 3 days ago without success, i'm waiting for you ideas. thank you very much best regards Uness

1 0

Re: Delete events not propogating with syncrepl
by Srinidhi Sharma 02 May '08

02 May '08

Hi Gavin, Here are the details . Following logs were available at -d255 level. user.ldif file ======== dn: cn=user19,ou=people,dc=example,dc=com objectclass: inetOrgPerson cn: user19 sn: user19-lastname1 uid: user19-user1-lastname1 userpassword: welcome1 carlicense: HISCAR 123 homephone: 555-111-2222 mail: user19(a)example.com description: cool guy ou: Human Resources Master node log file snippet: ==================== >>> dnPrettyNormal: <cn=user19,ou=people,dc=example,dc=com> => ldap_bv2dn(cn=user19,ou=people,dc=example,dc=com,0) <= ldap_bv2dn(cn=user19,ou=people,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=user19,ou=people,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=user19,ou=people,dc=example,dc=com)=0 <<< dnPrettyNormal: <cn=user19,ou=people,dc=example,dc=com>, <cn=user19,ou=people,dc=example,dc=com> bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") => bdb_entry_get: ndn: "cn=user19,ou=people,dc=example,dc=com" => bdb_entry_get: oc: "(null)", at: "(null)" bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") => bdb_entry_get: found entry: "cn=user19,ou=people,dc=example,dc=com" bdb_entry_get: rc=0 ==> bdb_delete: cn=user19,ou=people,dc=example,dc=com bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") => access_allowed: delete access to "ou=people,dc=example,dc=com" "children" requested <= root access granted => access_allowed: delete access granted by manage(=mwrscxd) => access_allowed: delete access to "cn=user19,ou=people,dc=example,dc=com" "entry" requested <= root access granted => access_allowed: delete access granted by manage(=mwrscxd) => bdb_dn2id_delete 0x11: "cn=user19,ou=people,dc=example,dc=com" bdb_idl_delete_key: 11 @cn=user19,ou=people,dc=example,dc=com bdb_idl_delete_key: 11 %ou=people,dc=example,dc=com bdb_idl_delete_key: 11 @ou=people,dc=example,dc=com <= bdb_dn2id_delete 0x11: 0 => index_entry_del( 17, "cn=user19,ou=people,dc=example,dc=com" ) => key_change(DELETE,11) bdb_idl_delete_key: 11 [860433ad] <= key_change 0 => key_change(DELETE,11) bdb_idl_delete_key: 11 [0250ebcb] <= key_change 0 => key_change(DELETE,11) bdb_idl_delete_key: 11 [8c70ccf9] bdb_idl_delete_key: 11 [860433ad] <= key_change 0 => key_change(DELETE,11) bdb_idl_delete_key: 11 [0250ebcb] <= key_change 0 => key_change(DELETE,11) bdb_idl_delete_key: 11 [8c70ccf9] <= key_change 0 => key_change(DELETE,11) bdb_idl_delete_key: 11 [0096defd] <= key_change 0 => key_change(DELETE,11) bdb_idl_delete_key: 11 [e8d6b696] <= key_change 0 => key_change(DELETE,11) bdb_idl_delete_key: 11 <= key_change 0 <= index_entry_del( 17, "cn=user19,ou=people,dc=example,dc=com" ) success ====> bdb_cache_delete( 17 ) bdb_delete: deleted id=00000011 dn="cn=user19,ou=people,dc=example,dc=com" send_ldap_result: conn=1 op=15 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=16 tag=107 err=0 ber_flush2: 14 bytes to sd 12 0000: 30 0c 02 01 10 6b 07 0a 01 00 04 00 04 00 0....k........ ldap_write: want=14, written=14 0000: 30 0c 02 01 10 6b 07 0a 01 00 04 00 04 00 0....k........ daemon: activity on 1 descriptor daemon: activity on: 12r daemon: read activity on 12 daemon: select: listen=7 active_threads=0 tvp=NULL connection_get(12) connection_get(12): got connid=1 connection_read(12): checking for input on id=1 Slave log snippet: ( I didnt see any log msg for delete entry in the slave, so wasnt sure what to cut/paste, so just cut/pasting the user addition log msg) ============= ber_scanf fmt ({mW}) ber: ber_dump: buf=5c5780 ptr=5c5892 end=5c58ca len=56 0000: 30 36 04 08 65 6e 74 72 79 43 53 4e 31 2a 04 28 06..entryCSN1*.( 0010: 32 30 30 38 30 35 30 32 30 39 34 33 34 36 2e 38 20080502094346.8 0020: 38 39 39 34 36 5a 23 30 30 30 30 30 30 23 30 30 89946Z#000000#00 0030: 30 23 30 30 30 30 30 30 0#000000 => bdb_search bdb_dn2entry("dc=example,dc=com") => access_allowed: search access to "dc=example,dc=com" "entry" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) search_candidates: base="dc=example,dc=com" (0x00000001) scope=2 => bdb_dn2idl("dc=example,dc=com") => bdb_filter_candidates AND => bdb_list_candidates 0xa0 => bdb_filter_candidates EQUALITY => bdb_equality_candidates (entryUUID) => key_read bdb_idl_fetch_key: [e8d6b696] <= bdb_index_read: failed (-30989) <= bdb_equality_candidates: id=0, first=0, last=0 <= bdb_filter_candidates: id=0 first=0 last=0 <= bdb_list_candidates: id=0 first=1 last=0 <= bdb_filter_candidates: id=0 first=1 last=0 bdb_search_candidates: id=0 first=1 last=0 bdb_search: no candidates send_ldap_result: conn=-1 op=0 p=3 send_ldap_result: err=0 matched="" text="" ==> bdb_add: cn=user19,ou=people,dc=example,dc=com bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") => bdb_dn2id("cn=user19,ou=people,dc=example,dc=com") <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) => access_allowed: add access to "ou=people,dc=example,dc=com" "children" requested <= root access granted => access_allowed: add access granted by manage(=mwrscxd) => access_allowed: add access to "cn=user19,ou=people,dc=example,dc=com" "entry" requested <= root access granted => access_allowed: add access granted by manage(=mwrscxd) => bdb_dn2id_add 0x11: "cn=user19,ou=people,dc=example,dc=com" bdb_idl_insert_key: 11 %ou=people,dc=example,dc=com bdb_idl_insert_key: 11 @ou=people,dc=example,dc=com <= bdb_dn2id_add 0x11: 0 => index_entry_add( 17, "cn=user19,ou=people,dc=example,dc=com" ) => key_change(ADD,11) bdb_idl_insert_key: 11 [860433ad] <= key_change 0 => key_change(ADD,11) bdb_idl_insert_key: 11 [0250ebcb] <= key_change 0 => key_change(ADD,11) bdb_idl_insert_key: 11 [8c70ccf9] <= key_change 0 => key_change(ADD,11) bdb_idl_insert_key: 11 [0096defd] <= key_change 0 => key_change(ADD,11) bdb_idl_insert_key: 11 [e8d6b696] <= key_change 0 => key_change(ADD,11) bdb_idl_insert_key: 11 <= key_change 0 <= index_entry_add( 17, "cn=user19,ou=people,dc=example,dc=com" ) success => entry_encode(0x00000011): cn=user19,ou=people,dc=example,dc=com bdb_add: added id=00000011 dn="cn=user19,ou=people,dc=example,dc=com" send_ldap_result: conn=-1 op=0 p=3 send_ldap_result: err=0 matched="" text="" ldap_msgfree ldap_result ld 5b9630 msgid 2 wait4msg ld 5b9630 msgid 2 (infinite timeout) wait4msg continue ld 5b9630 msgid 2 all 0 ** ld 5b9630 Connections: - Srinidhi On Wed, Apr 30, 2008 at 7:53 PM, Gavin Henry <ghenry(a)openldap.org> wrote: > Srinidhi Sharma wrote: > > > Hi, > > I am using open ldap 2.4.8 with Berkeley DB 4.6.21 ( I haven't applied > > any patch to either open ldap or to Berkeley DB). > > > > When I configure a slave process, the addition and modification of users > > get propogated from master to slave. But the deletion of users from the > > master do not get propogated. the slapd logs in the master show that user > > is getting deleted. > > > > Logs needed and an example user please ;-) > > > > I saw a old note " > > http://www.openldap.org/lists/openldap-bugs/200409/msg00001.html" which > > listed similar issue. > > > > > Not relevant as that's for 2.2. > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ > > Suretec Systems is a limited company registered in Scotland. Registered > number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, > Aberdeenshire, AB51 4FP. > -- Thanks, Srinidhi

1 0

Recommendation for Web Interface for OpenLDAP
by Wes Modes 02 May '08

02 May '08

Howdy, I'm looking for a web interface for OpenLDAP. I want something pretty simple since I won't need to reorganize the entire DIT through the web, only add, delete, and modify users and groups. I'm using smbldap-tools which has it's own set of scripts that I can tap into. I will need to extend the web interface to modify the samba schema extensions to LDAP or run the smbldap-scripts. With that in mind, I am interested in something written in PHP or Perl that can be easily modified or extended. I'd love it if you can recommend a simple web interface for LDAP. If you can recommend something, please tell me what features appeal to you or work well for you. And how does it meet my criteria: * Simple - minimal bells and whistles * add, delete, and modify users * add, delete, and modify groups * secure - using SSL/TLS * linux and apache friendly * written in perl, php, or python Thanks for your help.

4 5

Re: syncrel seems ignore some of the LDAP update request
by Paul Lee 02 May '08

02 May '08

I setup 2-way master as shown in the config file previously. I think the openldap will sync the data once I update one of the openldap servers. I use a java program to update the data every 100ms. Thanks Gavin Henry wrote: > How did you bring the data over to the second MirrorMode node? > Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

1 0

Passwd can not able to updated Centerlize LDAP Server
by Vipul Ramani 01 May '08

01 May '08

Hi all , I have openldap running on solaris 10 x86 server with all system users are migrated on LDAP TREE.!. I configure client on other solaris 10 x86 server. I can login( SSH and dtlogin) to other solaris 10 server using LDAP user . but while i am try to change password i m getting this problem do i missing anything . I am suspecting about pam.conf configuration. I tried couple of combinations but not able to get rid of this. Same configuration is working Linux ( as standard changes in system-auth config file...) I am using Solaris 10 ( intel) NATIVE LDAP Client as LDAP client. ==Solaris console=== bash-3.00$ passwd passwd: Changing password for vipul3 Enter existing login password: New Password: Re-enter new Password: passwd: vipul3 does not exist. Permission denied bash-3.00$ ======================== Var/adm/message Apr 30 02:27:30 xxxx passwd[6954]: [ID 574280 user.error] passwdutil: no legal LDAP authentication method configured Apr 30 02:27:30 xxxx passwd[6954]: [ID 574280 user.error] passwdutil: no legal LDAP authentication method configured ============================= -- Regards Vipul Ramani

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical