openldap-technical

openldap-technical@openldap.org

5 participants
9899 discussions

group of groups
by Andreas Moroder 11 Apr '08

11 Apr '08

Hello, I would like to have groups as members of other groups and use this with nss_ldap. Example: dn: cn=apotheke, ou=groups, dc=sb-brixen,dc=it gidNumber: 1019 memberUid: jack memberUid: joe sambaGroupType: 2 objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping description: apotheke cn: apotheke dn: cn=magazin, ou=groups, dc=sb-brixen,dc=it gidNumber: 1020 memberUid: paul memberUid: frank sambaGroupType: 2 objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping description: magazin cn: magazin dn: cn=common, ou=groups, dc=sb-brixen,dc=it gidNumber: 1021 member???: apotheke member???: magazin sambaGroupType: 2 objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping description: common cn: common what attribute do I have to use for the group in the group ? ( in the example i used member??? ) Thnaks for your reply Andreas

2 1

RE: error while accessing through Java "javax.naming.AuthenticationNotSupportedException: simple"
by Sai 10 Apr '08

10 Apr '08

Hi I did not figure-out the cause of why I am getting this and I did not fix this. But I figured out a work-around for this. Thought might help the community. I did not provide the SECURITY_AUTHENTICATION attribute. So it took the default of the server configured and it succeeded in authenticating the user Entry. What I will do next is to figure out what the default authentication is, for my server and try and pass it. Hope this helps some one out there. Thanks, -Bangaru. _____ From: Sai [mailto:bangaru.adabala@gmail.com] Sent: Monday, April 07, 2008 11:32 AM To: 'openldap-technical(a)openldap.org' Subject: error while accessing through Java "javax.naming.AuthenticationNotSupportedException: simple" Hi I am new to openLDAP. I am configuring it (version: OpenLDAP: slapd 2.3.27) on a Linux machine to use with our Web Application (java). When I try and make a connection I am getting the following error. =============== javax.naming.AuthenticationNotSupportedException: simple [4/7/08 10:42:01:887 EDT] 00000026 SystemErr R at com.sun.jndi.ldap.sasl.LdapSasl.saslBind(LdapSasl.java:115) =============== These are the code / attributes I used. ================= Hashtable env = new Hashtable(); env.put( Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory" ); env.put( Context.PROVIDER_URL, "ldap://<machine name>:<port>" ); env.put( Context.SECURITY_PRINCIPAL, "cn=uimadmin,ou=UIM,o=nhes,dc=nh,dc=gov" ); env.put( Context.SECURITY_AUTHENTICATION, "simple" ); env.put( Context.SECURITY_CREDENTIALS, "<password in plaintext>" ); try { context = new InitialDirContext(env); System.out.println("CONTEXT OPENED WITH ADMIN ACCOUNT"); } catch (NamingException ne) { ne.printStackTrace(); LogManager.logMessage("LDAPManager.getAdminJndiContext()", ne); } return context; ================= When I try and do an ldapsearch with a -x option (simple authentication) on the command line, it is returning results successfully. I am also able to connect using ldapbrowser v2.8.2 and see the results. Any help regarding this is greatly appreciated. Thanks in advance. -Bangaru.

1 0

ldap mail distribution list
by Aniruddha Karanjkar 10 Apr '08

10 Apr '08

Dear LDAP users, I want to use LDAP as shared abook. but I am not finding any information for creating mail distribution list in this. Why ?

1 0

Xen with OpenLDAP
by Quanah Gibson-Mount 09 Apr '08

09 Apr '08

In the past, using slapd under Xen has been problematic due to the issue here: <https://bugzilla.redhat.com/show_bug.cgi?id=91933> as reported here as well: <http://www.openldap.org/lists/openldap-software/200603/msg00214.html> I know that at least as recently as Xen 3.0.4, this was a problem. This was brought up on the Xen devel list, and their answer is found here: <http://lists.xensource.com/archives/html/xen-devel/2008-04/msg00167.html> Does their explanation seem to make sense? It sounded to me like they weren't 100% sure of their understanding of the issue. But it would be nice to be able to have something we could put in the FAQ to address this if this does address the problem. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

2 2

ProxyAuth via slapd-ldap woes
by Mark deJong 09 Apr '08

09 Apr '08

Hello, I'm having the hardest time getting ProxyAuth working to FDS via the OpenLDAP slapd-ldap module. I'm currently using Kerberos SASL bind to the OpenLDAP proxy server, which performs a search of the associated user DN on the FDS server. This part works fine. But when SLAPD attempted to perform proxyauth for that user, I receive the following error from FDS: # search result search: 4 result: 2 Protocol error text: unable to parse proxied authorization control I have tested proxyauth via other methods and they work fine. I have the following in my slapd.conf file: # SASL sasl-realm CORP.COMPANY.COM <http://corp.company.com/> sasl-host ldap03.corp.company.com sasl-secprops minssf=56 # Regexp for SASL authentication: authz-regexp uid=(.*),cn=corp.company.com,cn=gssapi,cn=auth ldap:///dc=corp,dc=company,dc=com??sub?(uid=$1) authz-policy to authzTo=ldap:///dc=corp,dc=company,dc=com??sub?(objectclass=person) ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database ldap suffix "dc=corp,dc=company,dc=com" #uri "ldaps://ldap01.corp.company.com/dc=corp,dc=company,dc=com" uri "ldap://ldap01.corp.company.com/" acl-bind bindmethod=simple binddn="uid=proxyadmin,cn=users,cn=bindaccounts,dc=corp,dc=company,dc=com" credentials="password" idassert-authzFrom "dn:*" idassert-bind bindmethod=simple binddn="uid=proxyadmin,cn=users,cn=bindaccounts,dc=corp,dc=company,dc=com" credentials="password" mode=self Not sure if it's helpful but here is the output in the logs at the event: Apr 8 16:17:39 ldap03 slapd[3166]: ===>slap_sasl_match: comparing DN uid=dejongm,cn=opssec,cn=users,cn=accounts,dc=corp,dc=company,dc=com to rule dn:* Apr 8 16:17:39 ldap03 slapd[3166]: slap_parseURI: parsing dn:* Apr 8 16:17:39 ldap03 slapd[3166]: <===slap_sasl_match: comparison returned 0 Apr 8 16:17:39 ldap03 slapd[3166]: ===>slap_sasl_match: comparing DN uid=dejongm,cn=opssec,cn=users,cn=accounts,dc=corp,dc=company,dc=com to rule dn:* Apr 8 16:17:39 ldap03 slapd[3166]: slap_parseURI: parsing dn:* Apr 8 16:17:39 ldap03 slapd[3166]: <===slap_sasl_match: comparison returned 0 Apr 8 16:17:39 ldap03 slapd[3166]: send_ldap_result: conn=0 op=3 p=3 Apr 8 16:17:39 ldap03 slapd[3166]: send_ldap_result: err=2 matched="" text="unable to parse proxied authorization control" Apr 8 16:17:39 ldap03 slapd[3166]: send_ldap_response: msgid=4 tag=101 err=2 Apr 8 16:17:39 ldap03 slapd[3166]: conn=0 op=3 SEARCH RESULT tag=101 err=2 nentries=0 text=unable to parse proxied authorization control Any suggestions would be appreciated. -Mark

2 1

Password policy can't replicate in openldap 2.4.8
by Paul Lee 09 Apr '08

09 Apr '08

Dear sir, I found that the account policy can't be replicated in openldap 2.4.8 I setup 2 servers, with Mirror mode. Then, I added the password policy and some user accounts in server 1, I then startup server 2, the user accounts are replicated to server 2. Content of policy.ldif : dn: ou=Policies ou: Policies description: All people in organisation objectClass: organizationalUnit dn: ou=Policies,o=HKSARG ou: Policies description: All people in organisation objectClass: organizationalUnit dn: cn=default,ou=Policies,o=HKSARG objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: userPassword pwdMaxFailure: 3 pwdInHistory: 12 pwdMinLength: 6 pwdExpireWarning: 259200 pwdAllowUserChange: TRUE pwdFailureCountInterval: 300 pwdGraceAuthNLimit: 1 pwdLockoutDuration: 300 pwdMustChange: FALSE pwdCheckQuality: 1 pwdMaxAge: 60000000 slapd.conf in server 1 : #overlay syncprov overlay ppolicy ppolicy_default "cn=default,ou=Policies,o=HKSARG" overlay syncprov #access to * by dn="cn=Manager" write by * read access to * by * write access to * by * read #database monitor syncprov-checkpoint 100 10 syncprov-sessionlog 100 # syncrepl directives syncrepl rid=1 provider=ldap://202.245.193.128:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist retry="60 +" syncrepl rid=2 provider=ldap://10.166.23.218:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist retry="60 +" mirrormode on serverID 1 slapd.conf in server 2 : # Password policy overlay ppolicy ppolicy_default "cn=default,ou=Policies,o=HKSARG" overlay syncprov #access to * by dn="cn=Manager" write by * read access to * by * write access to * by * read #database monitor syncprov-checkpoint 100 10 syncprov-sessionlog 100 # syncrepl directives syncrepl rid=1 provider=ldap://202.245.193.128:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist retry="60 +" syncrepl rid=2 provider=ldap://10.166.23.218:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist retry="60 +" mirrormode on serverID 2 I input the incorrect password 3 times in server 1 for a user, then, I find that the attribute pwdAccountLockedTime is updated in server 1, but I find that in server 2, this attribute is not replicated. As I result, when I input correct password in server 2, I still get authentication successful, but in server 1, authentication is failed. Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

2 4

Slapd Won't Start After TLS Was Configured
by Luke Lee 09 Apr '08

09 Apr '08

Hi, I've been trying to configure TLS with OpenLDAP on a RedHat Enterprise 4u4 server running OpenLDAP 2.2.13 but failed. The ldap service won't start and the following error messages are showing under the debugging log: TLS: could not load verify locations (file:`/etc/openldap/TLS/cacert.pem',dir:`/etc/openldap/TLS'). TLS: error:0200100D:system library:fopen:Permission denied bss_file.c:104 TLS: error:2006D002:BIO routines:BIO_new_file:system lib bss_file.c:109 TLS: error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib by_file.c:279 main: TLS init def ctx failed: -1 slapd shutdown: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. Can anyone help resolve the problem please? Thanks! Luke Lee ____________________________________________________________________________________ You rock. That's why Blockbuster's offering you one month of Blockbuster Total Access, No Cost. http://tc.deals.yahoo.com/tc/blockbuster/text5.com

2 1

some help required LDAP - GSSAPI issue.
by Austin Cherian 08 Apr '08

08 Apr '08

Hi, I hope some one can answer this query regarding LDAP and GSSAPI as i really dint find substantial info for this on the net for what i was trying to accomplish. I have some limitations on using OpenLDAP with Cyrus SASL and hence have to manufacture my own GSSAPI client to use with LDAP. However i have run into some technical issues here with my implementation and MS AD. Here's my problem in short: I am using the kerberos mechanism with GSSAPI, i first use kerberos API's to get a TGT for SPN that i have obtained a keytab for previously. I then use GSSAPI gss_init_sec_context to obtain a service ticket for the ldap server. I then call ldap_init and then subsequently call ldap_sasl_bind_s with mech as GSS-SPNEGO and supplying the GSSAPI token ( obtained from gss_init_sec_context ) as credential ( i set the DN in the ldap_sasl_bind_s to NULL ). >From the network traces and the return code i see that the bind was successful. The bind result shows success (0x00) and negTokenTarg shows negResult as accept-completed. This shows that Bind was indeed a success also to note here the krb-blob that comes with the bind result is successfully consumed by subsequent calls to gss_init_sec_context to complete context establishment. The issue that im facing now is that when i pass GSS wraped search request ( i.e. i build a search request and pass it to gss_wrap API to get a token ) token to the ldap_search_ext api. From the network traces i see that the search request has been received by the ldap server properly. However the LDAP server ( MS AD LDAP server ) responds with the following message : LdapErr: DSID-0C09062.27 comment: In order to perform this operation a successful bind must be completed on the connection. Can some one please throw some light on as to why the search query is getting back with an error that there was no bind done in spite of the server responding success for the LDAP bind prior to sending the search request ?? Any help will be greatly appreciated... Thanks, Austin.

1 0

First question...
by Daniel Padula 08 Apr '08

08 Apr '08

Hi! I am Daniel from argentina, I have an strange problem that, after been looking for it, I am really lost. I have made an objectClass in open ldap 2.4.7-6.1 and it works perfectly, but when I implemented in an open ldap 2.3.27-1. it did't work. It fails with the message, ldap_add: Invalid syntax (21) additional info: objectClass: value #0 invalid per syntax. Are there any main difference in schema 's structure between those ldap versions? Where could be the problem? attributetype ( 1.3.6.1.4.1.4203.666.1.124 NAME 'dynastyName' DESC ' Nombre dynasty.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) attributetype ( 1.3.6.1.4.1.4203.666.1.125 NAME 'vars' DESC ' Valores obtenidos de dynasty.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) objectclass (1.3.6.1.4.1.4203.666.1.54775 NAME 'jxfsDevice' SUP top STRUCTURAL DESC 'Estructura de un dispositivo jxfs' MAY ( cn $ vars $ dynastyName)) Thanks in advance! -- Daniel Padula. MSN, Gtalk, Jabber: daniel.padula(a)gmail.com

2 2

mail distribution list problem
by Aniruddha Karanjkar 08 Apr '08

08 Apr '08

Hi I have configured ldap on fedora 8 for contact list. It is working absolutely fine. Only thing is I am not able to create mail distribution list, which can be browsed in OL OE or TB. Please HELP.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical