openldap-technical

openldap-technical@openldap.org

7 participants
9864 discussions

Help with SASL/GSSAPI to remote Kerberos server
by Wes Modes 01 Mar '08

01 Mar '08

I am using *SASL/GSSAPI* to authenticate to* Kerberos* from *OpenLDAP*. I haven't gotten that to work yet. To separate and modularize some of these services, we have three servers: A file server running Samba; A directory server running OpenLDAP to provide personal and group identities; and an authentication server running Kerberos (administered by another group). Samba connects to OpenLDAP through smbldap-tools. And OpenLDAP connects to the Kerberos server via SASL/GSSAPI. When someone requests a Samba logon, Samba requests an LDAP bind, which in turn should use SASL to authenticate via Kerberos. The connection between Samba and OpenLDAP is working swell. It is the Kerberos connection that has me flummoxed. *Simply put, OpenLDAP with SASL2 and GSSAPI support will be running on one server, while the Kerberos KDC will be running on another server.* I haven't found any documents that address this not-so-wacky design. Almost all of the docs I found presume that I am setting up the KDC on the same server at OpenLDAP. In my case, the KDC is administered by another group who is willing to grant me access to Kerberos. However, none of the docs I've found offer help in setting up SASL/GSSAPI here and the Kerberos server elsewhere. So when a document says, run /kadmin.local/, to generate a principle, that is not available to me. If I can ask specifically for what I want, I might be able to convince the kerberos administrators to do it for me, but I have to be pretty specific about what I want. The docs I'm referring to are Cyrus SASL for System Administrators http://www.sendmail.org/~ca/email/cyrus/sysadmin.html <http://www.sendmail.org/%7Eca/email/cyrus/sysadmin.html> OpenLDAP 2.2 Administrator's Guide - Using SASL http://www.openldap.org/doc/admin22/guide.html#Using%20SASL In several documents, it was suggested that before you try connecting OpenLDAP to Kerberos that you test to make sure your Kerberos configuration is working. That makes a lot of sense to me. So I want to perform a series of checks, but I don't know what those tests might be. Here's what I would like to test: * Can I connect to the Kerberos server directly? (kinit) * Is direct authentication to the Kerberos server working? * Am I getting returned a proper ticket? (klist) * Is the keytab file on my OpenLDAP server being recognized and accepted by the Kerberos server? * Is my machine being authenticated as a principle? Does it need to be? * How do I test SASL2 before getting OpenLDAP involved? * After making changes to my OpenLDAP config, how do I test the Kerberos connection through OpenLDAP? Do you have any pointers here? This project has been delayed weeks and weeks while I climb and climb up Samba, OpenLDAP, and Kerberos' very steep learning curve. So your prompt response will be hugely helpful. Thanks in advance, Wes Specifics of my configuration: * OS: Red Hat Enterprise 4 v2.6.9 * OpenLDAP v2.2.13 * Local MIT Kerberos5 v1.3.4 * KDC: MIT Kerberos5 v? * Cyrus SASL v2.1.19 -- Wes Modes Server Administrator & Programmer Analyst McHenry Library Computing & Network Services Information and Technology Services 459-5208

5 11

Missing Syntax
by Nik Svoboda 29 Feb '08

29 Feb '08

I have noticed that in the openldap system I am using, the schema has a missing syntax. This syntax is "1.3.6.1.4.1.1466.115.121.1.58" ; "Substring Assertion". This is referenced in matching types using partial matching of strings (exactsubstringsmatch, numericStringSubstringsMatch, ...). I am fairly new to these subjects and do not understand fully how they operate. Is there a way to correct this? Are the syntaxes and matching types specified in a way that can be modified dynamically? -Nikkos

3 5

ldapsearch hangs Intermittently
by Kumar, Manish 28 Feb '08

28 Feb '08

I am encountering an issue on ldapsearch periodically "hangs". One out of 100 times it work fine but sometime it hangs. My ldapsearch version is ldapsearch 2.2.13 (Aug 18 2005 22:24:20). When I run it in debug mode it waits in ldap_int_select() function. end of trace is ldap_chkResponseList for msgid=-1, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid -1, all 1 ber_get_next ber_get_next: tag 0x30 len 305 contents: ldap_read: message type search-entry msgid 2, original id 2 adding response id 2 type 100: wait4msg continue, msgid -1, all 1 ** Connections: * host: 209.236.241.6 port: 20001 (default) refcnt: 2 status: Connected last used: Thu Feb 28 15:11:52 2008 ** Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ** Response Queue: * msgid 2, type 100 chained responses: * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 ldap_chkResponseList for msgid=-1, all=1 ldap_chkResponseList returns NULL ldap_int_select Please help me regarding this issue. Regards Manish

1 0

RWM overlay bind operation
by Rui Ramos 28 Feb '08

28 Feb '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello *, I'm having some troubles with the rwm overlay maybe someone can give some ligths on the subject. We have a non standard schema which in turn has an atribute pass1 that we want to use for the LDAP BIND operation. From what i've seen the BIND operation is hardcoded to use userPAssword attribute (please correct me if i'm wrong). So what we did was the following: we have server A with pass2 filled running on port 7001. and server B with the following config ... database ldap suffix "dc=example,dc=org" uri "ldap://localhost:7001" overlay rwm rwm-map attribute userPassword pass2 ... With this configuration the attribute userPassword gets filled with the content of pass2. But if we try to make Bind search in server B with that user password it fails because it tries to make the bind in ldap://localhost:7001. Is there a way to make the bind operation the the changed data ? Best Regards, Rui Ramos - -- Rui Ramos ============================================== Universidade do Porto - IRICUP Praça Gomes Teixeira, 4099-002 Porto, Portugal email: rramos[at]reit.up.pt phone: +351 22 040 8164 ============================================== -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.7 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iQEVAwUBR8aDvL1uR0bdnTWSAQIuhQgAw5rF8zSs0MapMSUMsb96j0PiUV2TdQ9V GTyB6RTeAJmNqh6/bvEoUO3m8a1UaNffQzYpj03S7y4moVVz4r8+bJQ4Xs0eM8C0 PSU1SXisJbVTcqbEoccma6Yllnd2ZYke8zo/kF/4EPycFxGVj36N+krEB7L/ouO8 jx+Mg6KhteqdxX4Pwz+WyG5g1jhxw4/RKiZC5BaWtP5Cv6pz810DZv9W9C9B0/tJ BYuiWWl3ntzI50Vgm3dmdBt3yUBvngfk/e6RIyRA0rDxpu9uslzCm3Q1acU72tOH Rj32AHuciyf6697rvZE/XQHao09AUhOrZliY/lmpLNc0LHKjDkvDCA== =uBz4 -----END PGP SIGNATURE-----

1 0

ldapsearch returns Could not create LDAP session handle (3): Time limit exceeded
by Brooks Campbell 28 Feb '08

28 Feb '08

We upgraded some client servers from RedHat ES3U4 to Redhat ES4U2 and now the ldapsearch string we used in our monitoring software to check if the customers openldap server is working is returning errors. We were using: ldapsearch -x -H ladps://host.domain.com:636 Which worked find with the open ldap-client on redhat 3 (I do not no the version number) but in redhat 4 openldap-clients 2.2.13-3 we get the error "Could not create LDAP session handle (3): Time limit exceeded" immediately. Ldap is working our application authenticates users it is just the ldapsearch we are using to monitor the service which seems to not be working. Does anyone see anything wrong with the line above or is there something else we can use in a automated script to check if the ldap server is running? Brooks Campbell IT Manager, Waterloo CA and Hersham UK Navtech Systems Support Inc. 295 Hagey Blvd Suite 200 Waterloo, ON, N2L 6R5 W:519-747-1170 xt263 brooks(a)navtechinc.com

3 4

integrating LDAP onto EPrints and Dspace
by divya shree 28 Feb '08

28 Feb '08

Hi I am doin a project..where in i hav to integrate LDAP on to Eprints n DSpace..for providin a single user authentication to the users of Eprints n DSapce... For this i am trying to install OpenLdap-2.4.7..software..i would like to knw if i am on the ryt track and also would like to knw the diff between openldap n ldap..if there is any... Thanks and Regards Divya --------------------------------- Forgot the famous last words? Access your message archive online. Click here.

2 1

OpenLDAP question
by Keith Conger 27 Feb '08

27 Feb '08

Hi, I was wondering if the following is possible with OpenLDAP: I'd like to have an OpenLDAP Server or two(load balanced) with an extended custom schema that will proxy certain attributes back to a non-openldap ldap server. Reading through the list archives it seems like it may be possible but does anyone know for sure from experience? Keith -- Keith Conger Server Systems Administrator Onondaga Community College 4585 West Seneca Turnpike Syracuse, N.Y. 13215-4585 Email/JID: congerk(a)sunyocc.edu http://www.sunyocc.edu/~congerk/

2 1

LDAP add fails with Protocol Error
by Alexander Hartner 27 Feb '08

27 Feb '08

After generating an LDIF file using ldapsearch having a direct fast connect to the LDAP directory, attempt to re-import the file have succeeded while being on the local network. However attempt to import the same LDIF file over a WAN connection fail with the following error: ldapadd -c -D "..." -w ... -x -h ... -p 389 -f test2.ldif adding new entry "..." ldap_add: Already exists (68) adding new entry "..." ldap_add: Already exists (68) adding new entry "..." ldap_add: Protocol error (2) additional info: no attributes provided adding new entry "..." ldap_add: Already exists (68) .. adding new entry "..." adding new entry "..." .. adding new entry "..." ldapadd: update failed: ... ldap_add: Can't contact LDAP server (-1) .. All messages after this file with the same error (-1). It seems that the slower connection is causing a Protocol error which results in LDAP falling over, or at least becoming un-available. Any ideas what could be causing this problem and what I could to address this. Regards Alex

2 1

nss_ldap periodic errors
by Kamil Kisiel 27 Feb '08

27 Feb '08

I'm using nss_ldap on a whole bunch of machines on the network, and while it works great most of the time, I continuously get errors in my syslog. A sampling from today (these are actually from different machines, but I have anonymized the hostnames to be the same.): Feb 25 09:30:25 server.example.com sshd[17495]: nss_ldap: could not search LDAP server - Server is unavailable Feb 25 11:11:08 server.example.com -bash: nss_ldap: could not search LDAP server - Server is unavailable Feb 25 21:50:01 server.example.com automount[5030]: nss_ldap: could not search LDAP server - Server is unavailable Feb 25 21:55:16 server.example.com nscd: nss_ldap: could not search LDAP server - Server is unavailable I get a few of these errors in our syslogs every hour, and occasionally it seems I can't log in via SSH. However typically when I log in to the machine and do a "getent passwd" everything is fine. The LDAP server is from Open Directory in OS X Server 10.5.2. The version of nss_ldap is the one from Gentoo Linux, version nss_ldap-258. My /etc/ldap.conf looks like this: uri ldap://ldap1.example:389 base dc=example,dc=com timelimit 30 bind_timelimit 30 bind_policy soft nss_reconnect_maxconntries 5 idle_timelimit 3600 pam_password_prohibit_message Please use System Preferences on your Mac to change your directory password. nss_base_group cn=Groups,dc=zymeworks,dc=com nss_base_passwd cn=Users,dc=zymeworks,dc=com Does anyone have any suggestions as to what I can try to do to debug and fix this ? It's really becoming irritating. -- Kamil

3 4

log fields
by Gustavo Mendes de Carvalho 27 Feb '08

27 Feb '08

Hi there, I would like to get some documentation that can describe, in details, which fiileds there are present in ldap.log file, and the meaning of each field. I need some information about 7th field (op=33 in first line). Where can I find all codes used in this field ? Jan 10 11:50:21 ldap01 slapd[10819]: conn=1702 op=33 SEARCH RESULT tag=101 err=0 nentries=1 text= Jan 10 11:50:25 ldap01 slapd[10819]: conn=1702 op=34 SRCH base="uid=gustavo,ou=company,c=org" scope=0 deref=0 filter="(objectClass=*)" Jan 10 11:50:25 ldap01 slapd[10819]: conn=1702 op=34 SEARCH RESULT tag=101 err=0 nentries=1 text= Jan 10 11:50:26 ldap01 slapd[10819]: conn=1702 op=35 SRCH base="uid=gustavo,ou=company,c=org" scope=0 deref=0 filter="(objectClass=*)" Jan 10 11:50:26 ldap01 slapd[10819]: conn=1702 op=35 SEARCH RESULT tag=101 err=0 nentries=1 text= Jan 10 12:28:13 ldap01 slapd[10819]: conn=1702 op=36 UNBIND Jan 10 12:28:13 ldap01 slapd[10819]: conn=1702 fd=21 closed Thanks --- Gustavo e-mail: gmcarvalho(a)gmail.com

5 7

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical