openldap-technical

openldap-technical@openldap.org

5 participants
9991 discussions

ldap database backend vs requests
by Ricardo Moreira 26 May '08

26 May '08

Hi there, I would like to know if in a database backend it's possible to know the request binded DN at on the search call? What I want is to build a wrapper database backend and integrate LDAP protocol with the private protocol used on the backend authentication/authorization system at my work. Our backend system deals with authentication/authorization and search in one request, usually our request is composed of: user + pass + input parameters + atributes (to be returned). I appreaciate any help! Regards, -- :: Ricardo Moreira

2 1

[Fwd: 2 identical names in address book]
by Thomas De Reyck 23 May '08

23 May '08

Hello, I am not sure if this is the correct place to ask this kind of information, so if I am mistaken, I apologize.. I am quite new to LDAP, however I have used some applications that require it and am now a semi-decent openLDAP administrator. So, as a next step, I am trying to program an address book with an LDAP backend. I have noticed that usually the cn is used as a dn when working with address book entries. This seems to lead to an interesting conflict which I need to resolve before I begin to program: What can be done when one has to import 2 people with an identical name? This seems to be irrelevant, since the chances of an identical name are small, but I for one know 2 people with the same first and last ames. Lets face it: names are not MD5 hashes ;-).. I guess someone must have thought this over before.. how oes one resolve this problem cleanly? Does one use another property? f so, which one? I am aware that this might be a very silly question, but I have een wondering about this for a few days now and google doesn't eem to satisfy my need for a solution.. :-). Thanks in advance, Thomas De Reyck

2 2

n-way multi master setup
by Joshua Miller 23 May '08

23 May '08

Good morning, I am attempting to follow the admin guide in setting up n-way multi-master replication. re: http://www.openldap.org/doc/admin24/replication.html#N-Way%20Multi-Master I'm running OpenLDAP 2.4.7, from Buchan Milne's RPMs, DB 4.6 on CentOS 5.1. I have setup a working directory on both nodes, then removed all data to start fresh, converting my slapd.conf to a slapd.d with slaptest. ie, # /etc/init.d/ldap stop # rm -rf /var/lib/ldap/* # slaptest -f slapd.conf -F slapd.d # /etc/init.d/ldap start Since I already had cn=config setup from my slapd.conf file, I skipped that part of the admin guide's instructions. I then modified the directory with the following LDIF, replacing the URI and credential values with my environment specific ones: dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 ldap://ldapserver1 olcServerID: 2 ldap://ldapserver2 dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://ldapserver2 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=002 provider=ldap://ldapserver1 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 - add: olcMirrorMode olcMirrorMode: TRUE I received no errors on running the modify command to add the changes from this LDIF. I then attempted to make a change and have it replicated, very simple to start with, using the following LDIF: dn: cn=config changetype: modify replace: olcSecurity olcSecurity: ssf=256 Once I successfully made this change on ldapserver1, I received the following errors in the logs of ldapserver2 (continuously repeating): ldapserver2 slapd2.4[12172]: conn=15 op=0 EXT oid=1.3.6.1.4.1.1466.20037 ldapserver2 slapd2.4[12172]: conn=15 op=0 STARTTLS ldapserver2 slapd2.4[12172]: conn=15 op=0 RESULT oid= err=0 text= ldapserver2 slapd2.4[12172]: conn=15 fd=17 ACCEPT from IP=10.12.2.25:4174 (IP=0.0.0.0:389) ldapserver2 slapd2.4[12172]: conn=15 fd=17 TLS established tls_ssf=256 ssf=256 ldapserver2 slapd2.4[12172]: conn=15 op=1 BIND dn="cn=config" method=128 ldapserver2 slapd2.4[12172]: conn=15 op=1 BIND dn="cn=config" mech=SIMPLE ssf=0 ldapserver2 slapd2.4[12172]: conn=15 op=1 RESULT tag=97 err=0 text= ldapserver2 slapd2.4[12172]: conn=15 op=2 SRCH base="cn=config" scope=2 deref=0 filter="(cn=config)" ldapserver2 slapd2.4[12172]: conn=15 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= ldapserver2 slapd2.4[12172]: conn=15 op=3 UNBIND ldapserver2 slapd2.4[12172]: conn=15 fd=17 closed ldapserver2 slapd2.4[12172]: olcServerID: value #1: <olcServerID> unknown factor <80>A<C2> ldapserver2 slapd2.4[12172]: olcServerID: value #1: <olcServerID> unknown factor <D0>A<C2> ldapserver2 slapd2.4[12172]: null_callback : error code 0x50 ldapserver2 slapd2.4[12172]: syncrepl_entry: rid=002 be_modify failed (80) ldapserver2 slapd2.4[12172]: do_syncrepl: rid=002 retrying (4 retries left) ldapserver2 slapd2.4[12172]: olcServerID: value #1: <olcServerID> unknown factor ldapserver2 slapd2.4[12172]: olcServerID: value #1: <olcServerID> unknown factor ldapserver2 slapd2.4[12172]: null_callback : error code 0x50 Any idea what I may have done wrong here? Thanks! Josh Miller, RHCE

5 6

Remote LDAP servers and parallel queries
by Julien Cassignol 20 May '08

20 May '08

Hi, I recently tried to build a setup as follows : Tree : dc=mycompany,dc=com Subtree 1 : dc=subtree1,dc=mycompany,dc=com Subtree 2 : dc=subtree2,dc=mycompany,dc=com Assuming that my needs are to store subtrees 1 and 2 in separate and remote LDAP servers, I used the LDAP backend. It worked pretty fine, and then I tried to check what was the behaviour if a link went down, or a remote server was unavailable. Testing, I saw that if I have a 10 seconds timeout for each server, if they're both down, my server spends 20 seconds waiting for the timeouts. I assume that's because the queries are done sequentially and not in parallel. Is there any way to be able to parallelize the queries and build a "buffer" for each remote backend in order to reconstruct it later, allowing a user not only to use each remote server, but also to find which subtree a user belongs to, without having those kind of problems ? My test case is pretty simple, but as the final implementation I want to build involves a lot more remote LDAP servers, and as I can't modify the architecture, I'm wondering what are the available solutions. Thanks, -- Julien Cassignol

1 0

OpenSSL clients connect over TLS, GnuTLS clients cannot.
by Ben Goldsbury 20 May '08

20 May '08

Hello, I'm having a problem getting TLS connections working properly when clients of the server are built against GnuTLS. When clients are built against OpenSSL, TLS connections work properly. If OpenLDAP is built against GnuTLS, TLS connections fail with this error (some debug included): TLS: peer cert untrusted or revoked (0x42) ldap_err2string ldap_start_tls: Connect error (-11) For testing, I've tried the following setups. Each use the same configuration: GnuTLS (client) -> GnuTLS (server) = failure OpenSSL (client) -> GnuTLS (server) = success GnuTLS (client) -> OpenSSL (server) = failure OpenSSL (client) -> OpenSSL (server) = success Also, I have used GnuTLS's testing tools (gnutls-serv and gnutls-cli) to verify that GnuTLS is working properly with the certificate. gnutls-serv \ --x509certfile /etc/ssl/my_ssl/server.key \ --x509keyfile /etc/ssl/my_ssl/server.crt gnutls-cli \ --x509cafile /etc/ssl/certs/ca-certificates.crt \ -p 5556 \ ldapserver.mydomain.com GnuTLS output: - Peer's certificate is trusted - Version: TLS1.1 - Key Exchange: DHE-RSA - Cipher: AES-128-CBC - MAC: SHA1 - Compression: NULL - Handshake was completed Versions used: GnuTLS 2.2.1 OpenSSL 0.9.8c OpenLDAP 2.4.9 Does anyone have any ideas whats going on, or any idea how to troubleshoot this further? Is this something that should go to the openldap-bugs mailing list? Thank you.

2 1

tls issues with clients
by Kyle Corupe 20 May '08

20 May '08

I'm pretty confused, because my clients are setup with almost identical configs, and the server(localhost), and one of my client PC's can connect and use SSL (ldapsearch -H ldaps://heracross.corpedia.internal/ -b dc=corpedia,dc=internal -x -Z), and it returns the correct results, and I can see it using TLS in the slapd log. I copied the same configs to both boxes /etc/ldap.conf ---- #host heracross.corpedia.internal base dc=corpedia,dc=internal uri heracross.corpedia.internalheracross.corpedia.internal ldap://heracross.corpedia.internal/ binddn cn=root,dc=corpedia,dc=internal bindpw ***************** scope sub bind_policy hard nss_base_passwd dc=corpedia,dc=internal?sub nss_base_shadow dc=corpedia,dc=internal?sub nss_base_group dc=corpedia,dc=internal?sub pam_password md5 ssl yes tls_cacertdir /etc/openldap/cacerts ----- I see the following in my slapd error log as I connect as one of the nonworking boxes root@kyle-laptop:/etc/ldap# ldapsearch -H ldaps://heracross.corpedia.internal/ -b dc=corpedia,dc=internal -x -Z ldap_start_tls: Can't contact LDAP server (-1) ldap_bind: Can't contact LDAP server (-1) ----- connection_get(14): got connid=25 connection_read(14): checking for input on id=25 TLS trace: SSL_accept:before/accept initialization TLS: can't accept. connection_read(14): TLS accept failure error=-1 id=25, closing connection_closing: readying conn=25 sd=14 for close connection_close: conn=25 sd=14 ----- Here is a nopaste link for my slapd.conf file http://rafb.net/p/NHjV1a33.html -- Kyle Corupe Unix Administrator Corpedia Corporation 2020 North Central Avenue, Suite 1050 Phoenix, Arizona 85004-4576 Desk:(602)443-2148 Cell: (623)261-2874 kcorupe(a)corpedia.com

3 4

Help with ACL's for userPassword updates
by Martin Benson 20 May '08

20 May '08

Hi I need some help with the Access Control Lists in my slapd.conf file. I need to allow myself to update a user's password for when they forget their password. With no ACL's in place I can do this using a ldapmodify command that authenticates as "cn=Manager,dc=example,dc=com". I normally have the following in my ACL's: access to attrs=userPassword by self write by anonymous auth by * none access to * by * read What do I need to do to change this to allow the manager to change the userPassword attribute. Thanks Martin Benson

2 1

ldap automount maps loading problem
by Rodrigo Castro 20 May '08

20 May '08

Can anyone tell me what's wrong with the following? May 20 08:59:08 localhost automount[20128]: starting automounter version 4.1.4, path = /home, maptype = ldap, mapname = squid.prof.inf.ufes.br: ou=auto.home,o=inf.ufes.br May 20 08:59:08 localhost automount[20128]: lookup(ldap): server = " squid.prof.inf.ufes.br", port = 389, base dn = "ou=auto.home,o=inf.ufes.br" May 20 08:59:08 localhost automount[20128]: mount(bind): bind_works = 1 May 20 08:59:08 localhost automount[20128]: using kernel protocol version 4.07 May 20 08:59:08 localhost automount[20128]: using timeout 300 seconds; freq 75 secs May 20 08:59:08 localhost automount[20128]: lookup(ldap): searching for "(objectclass=nisObject)" under "ou=auto.home,o=inf.ufes.br" May 20 08:59:08 localhost automount[20128]: lookup(ldap): query succeeded, no matches for (objectclass=nisObject) May 20 08:59:08 localhost automount[20128]: lookup(ldap): searching for "(objectclass=automount)" under "ou=auto.home,o=inf.ufes.br" May 20 08:59:08 localhost automount[20128]: lookup(ldap): examining entries May 20 08:59:08 localhost automount[20128]: lookup(ldap): done updating map May 20 08:59:08 localhost automount[20128]: failed to load map, exiting May 20 08:59:08 localhost automount[20128]: rm_unwanted: /home May 20 08:59:08 localhost automount[20128]: umount_multi: path=/home incl=0 May 20 08:59:08 localhost automount[20128]: umount_multi: no mounts found under /home Here's a part of my ldif: dn: ou=auto.master,o=inf.ufes.br objectClass: top objectClass: automountMap ou: auto.master dn: ou=auto.home,o=inf.ufes.br objectClass: top objectClass: automountMap ou: auto.home dn: cn=/,ou=auto.home,o=inf.ufes.br objectClass: automount cn: / automountInformation: -fstype=nfs,hard,intr,nodev squid.prof.inf.ufes.br: /home/& dn: cn=/home,ou=auto.master,o=inf.ufes.br objectClass: automount cn: /home automountInformation: ldap squid.prof.inf.ufes.br:ou=auto.home,o=inf.ufes.br -- __________________________________ Rodrigo de Castro Cosme Ciência da Computação - Universidade Federal do Espírito Santo Suporte mailing list - suporte(a)inf.ufes.br MSN - rdccosmo(a)gmail.com

1 0

AW: Help with ACL's for userPassword updates
by Kick, Claus 20 May '08

20 May '08

Hello Martin, The rootdn can always change everything everywhere. So, I guess you should use the root dn to do that. You ACL simply says that only the user himself/herself can change the password. Best regards, Claus ________________________________ Von: openldap-technical-bounces+claus.kick=siemens.com(a)OpenLDAP.org [mailto:openldap-technical-bounces+claus.kick=siemens.com@OpenLDAP.org] Im Auftrag von Martin Benson Gesendet: Sonntag, 18. Mai 2008 20:17 An: openldap-technical(a)openldap.org Betreff: Help with ACL's for userPassword updates Hi I need some help with the Access Control Lists in my slapd.conf file. I need to allow myself to update a user's password for when they forget their password. With no ACL's in place I can do this using a ldapmodify command that authenticates as "cn=Manager,dc=example,dc=com". I normally have the following in my ACL's: access to attrs=userPassword by self write by anonymous auth by * none access to * by * read What do I need to do to change this to allow the manager to change the userPassword attribute. Thanks Martin Benson

1 0

slapo-chain - can't get it working
by Richard Nelson 19 May '08

19 May '08

I sent this two days ago, from an unsubscribed account and it still hasn't shown up... don't know if moderation is hampered, or if it just didn't make through... I have the basics covered - 1 master, 4 syncrepl slaves (going to 2-3 MM, 1-2 slaves). This setup has been working quite well - supporting AIX, Linux user data, Samba PDC/BDCs, and Kerberos (slapd 2.4.7 Debian Sid/unstable) The only issue I have now, is having to find the master to perform any updates. I'd like to use slapo-chain so that update referrals are automatically handled, especially since so little stuff supports referrals - even things that should. There are a few examples here and there, and unfortunately, some of them contradict others (probably written to different ldap levels). As an example of my plight, here is the output of ldappasswd on a slave machine (ldapmodify shows the same issue, but isn't as easy to show) # # on the slave, when trying a ldappasswd: $ ldappasswd -Ydigest-md5 -w<my passwd> SASL/DIGEST-MD5 authentication started SASL username: renegade SASL SSF: 128 SASL data security layer installed. Result: Referral (10) Referral: ldap://ldap-master.cobpli.svl.ibm.com # # The following is the slave ldap trace, and there is *no* traffic to the master... conn=0 op=1 BIND authcid="renegade(a)COBPLI.SVL.IBM.COM" authzid="renegade(a)COBPLI.SVL.IBM.COM" conn=0 op=1 BIND dn="uid=renegade,ou=users,dc=cobpli,dc=svl,dc=ibm,dc=com" mech=DIGEST-MD5 sasl_ssf=128 ssf=128 conn=0 op=1 RESULT tag=97 err=0 text= conn=0 op=2 EXT oid=1.3.6.1.4.1.4203.1.11.1 conn=0 op=2 PASSMOD conn=0 op=2 RESULT oid= err=10 text= # # The basics work: $ ldapwhoami SASL/GSSAPI authentication started SASL username: renegade(a)COBPLI.SVL.IBM.COM SASL SSF: 56 SASL data security layer installed. dn:uid=renegade,ou=users,dc=cobpli,dc=svl,dc=ibm,dc=com # # Proxy authentication works: $ ldapwhoami -Uproxy -Ydigest-md5 -w<passwd> -Xu:cowboy SASL/DIGEST-MD5 authentication started SASL username: u:cowboy SASL SSF: 128 SASL data security layer installed. dn:uid=cowboy,ou=users,dc=cobpli,dc=svl,dc=ibm,dc=com # # Here is the likely relevant ldap sections (chain overlay, syncprop, updatref): # overlay chain chain-uri "ldap://ldap-master.cobpli.svl.ibm.com/" # Neither of these lines make a difference chain-rebind-as-user TRUE #chain-rebind-as-user FALSE # Here, I've tried simple/sasl, varied saslmech, etc... chain-idassert-bind bindmethod="simple" saslmech=digest-md5 authz=proxyauthz binddn="uid=proxy,ou=users,dc=cobpli,dc=svl,dc=ibm,dc=com" credentials="<passwd>" mode=self chain-idassert-authzFrom "*" syncrepl rid=1 provider=ldap://ldap-master.cobpli.svl.ibm.com/ starttls=no binddn="cn=Replicator,ou=DSA,dc=cobpli,dc=svl,dc=ibm,dc=com" bindmethod=simple credentials=<passwd> searchbase="dc=cobpli,dc=svl,dc=ibm,dc=com" schemaChecking=off type=refreshAndPersist retry="10 10 300 +" updateref ldap://ldap-master.cobpli.svl.ibm.com/

5 10

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical