openldap-technical

openldap-technical@openldap.org

18 participants
9785 discussions

RFC 2307 and me
by Sean Myers 28 Jan '08

28 Jan '08

I'm currently using an LDAP directory to do a few jobs, including acting as a Network Information Server in a POSIX environment (Debian Linux) via libnss-ldap. It's working great, with authentication handled by Kerberos...simple and elegant SSO. The question I have about RFC 2307, though, stems from a few applications that I've encountered along the way that don't really do things in a POSIX way, and while they can sift through my "people" ou just fine with filters I provide, they generally want my groups to act like a groupOfNames entry, with full DN member attributeTypes, insead of the POSIX uid alone. Are the applications that I'm using simply being unreasonably inflexible? If so, they're all open-source and adding in support to do things the RFC 2307 POSIX way as well as the RFC 2256 groupOfNames way is not an unthinkably difficult task. My initial feeling on this is that not everything is POSIX compatible, not everything should be POSIX compatible, and it might be useful for me and others to be able to abandon RFC 2307 for defining groups in favor of RFC 2256, which appears to be the more "LDAP/X.500" way of doing things. I'm using this directory for a few services, and Linux NSS is really the only POSIX user in the bunch, so would it be "right" to instead fork and libnss-ldap to support RFC 2256 for my implementation? If so, has this been done already? Looking for input before I violate established best practice, and apologies if I've failed at searching. Thanks. -- Sean Myers System Administrator American Research Institute (919) 228-4961

2 1

openldap tls with a ca
by Dave 27 Jan '08

27 Jan '08

Hello, I'm trying to set up openldap for network authentication of both FreeBSD and Linux machines as well as integrating a samba pdc. I've created a ca with instructions found at: http://sial.org/howto/openssl/ca/ I've added the appropriate options to slapd.conf, for TLS as i don't want passwords going around in the clear. Slapd starts fine with tls options added, but if i do an ldapsearch -Z i get a can not contact ldap server. ldapsearch: # extended LDIF # # LDAPv3 # base <dc=davemehler,dc=com> (default) with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 13 Confidentiality required text: confidentiality required # numResponses: 1 I assume this is normal, but the below is what i'm getting with ldapsearch -Z ldapsearch -Z: ldap_start_tls: Connect error (-11) ldap_result: Can't contact LDAP server (-1) Here are the tls options i'm using: slapd.conf: security ssf=128 TLSCipherSuite HIGH TLSCertificateFile /usr/local/etc/openldap/tls/ldap.davemehler.com.crt TLSCertificateKeyFile /usr/local/etc/openldap/tls/ldap.davemehler.com.key TLSCACertificateFile /usr/local/etc/openldap/tls/ca-cert.pem #TLSDHParamFile I'm not sure what that last file is or how to make it, is it critical? /usr/local/etc/ldap.conf: ssl start_tls tls_cacert /usr/local/etc/openldap/tls/ca-cert.pem Checking /var/log/debug.log i'm seeing an error confidentiality required, as if ldap can't read the key, but as i said it's mode 644. Here's the complete transaction: Jan 27 15:20:04 ldap slapd[73647]: conn=6 fd=10 ACCEPT from IP=192.168.0.203:51704 (IP=0.0.0.0:389) Jan 27 15:20:04 ldap slapd[73647]: conn=6 op=0 BIND dn="" method=128 Jan 27 15:20:04 ldap slapd[73647]: conn=6 op=0 RESULT tag=97 err=0 text= Jan 27 15:20:04 ldap slapd[73647]: conn=6 op=1 SRCH base="dc=davemehler,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup))" Jan 27 15:20:04 ldap slapd[73647]: conn=6 op=1 SRCH attr=cn userPassword memberUid uniqueMember gidNumber Jan 27 15:20:04 ldap slapd[73647]: conn=6 op=1 SEARCH RESULT tag=101 err=13 nentries=0 text=confidentiality required Jan 27 15:20:04 ldap slapd[73647]: conn=6 fd=10 closed (connection lost) Any help appreciated. Thanks. Dave.

2 1

Unique id for each ldap entry
by Rakesh Yadav 25 Jan '08

25 Jan '08

Hi, I want to get unique ids for each ldap entry, but i don't know whether ldap provides unique id for each entry or not. In case of RDBMS each entry(tuple) has a OID(Object id) through which we can access uniquely this Entry. In case of LDAP, i need such (OID) kind of object identifier. Please tell me whether ldap provides some kind of unique id(Other than DN) for it's entries or not. If yes then please tell me how we can get these unique ids? -- Rakesh Yadav Pune.

3 4

migrating to another server - restore problem - slapcat slapadd
by Christophe Dumonet 24 Jan '08

24 Jan '08

Hello, I'm migrating from an old openldap server to a new one. So, I have done a dump of the ldap database with a " slapcat -l mydump.ldap -f /etc/openldap/slapd.conf -b "dc=mycompany,dc=com" --> So I had a dump ldif file where organisational units and dn are not in hierarchical order. In my new server ( which works fine , I can ldapadd some ou,dn , no problem) --> The slapadd command doesn't work because my ldap data in the ldif file is not in hierarchical order. I can't re-order manually this because it's a important database ( the ldif --> 50Mo). My slapadd command to restore is : slapadd -l mydump.ldif -f /etc/openldap/slapd.conf -b "dc=mycompany,dc=com" and the errors are relative to the ldif OU order, I had trying to cut/paste in the ldif file some OUs to reorder and errors are reporting to another OUs...which are not in hierachical order ! How can I do to restore quickly my data to my new server ? Any help would be appreciated, Christophe Dumonet, From france -- ---------------------------------------------------- Christophe Dumonet Centre de Ressources Informatiques Institut Francais de Mecanique Avancee (IFMA) Campus des Cezeaux BP 265 63175 AUBIERE Cedex Tel : +33 - 4.73.28.80.64 Fax : +33 - 4.73.28.81.00 Mail : Christophe.Dumonet(a)ifma.fr ----------------------------------------------------

4 6

Syncrepl multimaster replication issue
by Penza Kenneth at MITTS 23 Jan '08

23 Jan '08

People, I am currently trying to setup a multi-master ldap setup. The setup is running on CentOS 5.1 with kernel 2.6.18-53.el5. In this setup I have migrated the UNIX authentication files using MigrationTools and everything worked fine. When I am trying to setup the replication I am encountering a strange behavior. The initial synchronization was performed by copying /var/lib/ldap directory when openldap was shutdown. On starting both nodes query each other and everything seems operating correctly. When I perform a change on either node, the node performs the local change however it is not propagated on the other node and in the /var/log/ldap.log I get the following message: When ever the change is made on ldap1 it reports: Jan 23 10:10:43 ldap1 slapd[5787]: null_callback : error code 0x10 Jan 23 10:10:43 ldap1 slapd[5787]: syncrepl_updateCookie: rid=002 be_modify failed (16) When ever the change is made on ldap2 it reports: Jan 23 10:40:31 ldap2 slapd[5677]: null_callback : error code 0x10 Jan 23 10:40:31 ldap2 slapd[5677]: syncrepl_updateCookie: rid=002 be_modify failed (16) Setup details: cd /root/ldap_inst tar xvzf db-4.6.21.tar.gz tar xvzf openldap-2.4.7.tgz cd db-4.6.21 cd build_unix/ ../dist/configure --prefix=/usr make clean (as root) make (as root) cd /usr/share/libtool/libltdl configure --prefix=/usr make make install (as root) cd /root/ldap_install/openldap-2.4.7 ./configure --prefix=/usrd /usr/share/libtool/libltdl./configure --prefix=/usr --sysconfdir=/etc --libexecdir=/usr/sbin --mandir=/usr/share/man --with-tls --without-cyrus-sasl -enable-modules -enable-bdb=mod -enable-hdb=mod -enable-ldap=mod --enable-crypt make depend make make install (as root) This procedure was completed on two nodes, namely ldap1 and ldap2. This slapd.conf of each nodes is as follows: Ldap1: cat /etc/openldap/slapd.conf | grep -v ^# | grep -v ^$ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/misc.schema allow bind_v2 pidfile /var/run/slapd.pid argsfile /var/run/slapd.args modulepath /usr/sbin/openldap moduleload back_bdb.la TLSCipherSuite HIGH:MEDIUM:+TLSv1:+SSLv2:+SSLv3 TLSCACertificateFile /etc/openldap/cacert.pem TLSCertificateFile /etc/openldap/slapd-cert-ldap1.pem TLSCertificateKeyFile /etc/openldap/slapd-key-ldap1.pem serverID 1 ldap://ldap1:389/ serverID 2 ldap://ldap2:389/ database bdb suffix "dc=linuxldap,dc=org" rootdn "cn=Manager,dc=linuxldap,dc=org" rootpw secret directory /var/lib/ldap checkpoint 128 15 cachesize 10000 dncachesize 5000 idlcachesize 30000 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 index objectClass,entryUUID,entryCSN eq #syncRepl rid=001 # provider=ldap://ldap1:389 # binddn="cn=Manager,dc=linuxldap,dc=org" # bindmethod=simple # credentials=secret # searchbase="dc=linuxldap,dc=org" # type=refreshOnly # interval=00:00:00:05 # retry="5 5 300 5" # timeout=1 syncRepl rid=002 provider=ldap://ldap2:389 binddn="cn=Manager,dc=linuxldap,dc=org" bindmethod=simple credentials=secret searchbase="dc=linuxldap,dc=org" type=refreshOnly interval=00:00:00:05 retry="5 5 300 5" timeout=1 mirrormode true sockbuf_max_incoming 5000 sockbuf_max_incoming_auth 5000 database monitor Ldap2: cat /etc/openldap/slapd.conf | grep -v ^# | grep -v ^$ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/misc.schema allow bind_v2 pidfile /var/run/slapd.pid argsfile /var/run/slapd.args modulepath /usr/sbin/openldap moduleload back_bdb.la TLSCipherSuite HIGH:MEDIUM:+TLSv1:+SSLv2:+SSLv3 TLSCACertificateFile /etc/openldap/cacert.pem TLSCertificateFile /etc/openldap/slapd-cert-ldap1.pem TLSCertificateKeyFile /etc/openldap/slapd-key-ldap1.pem serverID 1 ldap://ldap1:389/ serverID 2 ldap://ldap2:389/ database bdb suffix "dc=linuxldap,dc=org" rootdn "cn=Manager,dc=linuxldap,dc=org" rootpw secret directory /var/lib/ldap checkpoint 128 15 cachesize 10000 dncachesize 5000 idlcachesize 30000 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 index objectClass,entryUUID,entryCSN eq syncRepl rid=001 provider=ldap://ldap1:389 binddn="cn=Manager,dc=linuxldap,dc=org" bindmethod=simple credentials=secret searchbase="dc=linuxldap,dc=org" type=refreshOnly interval=00:00:00:05 retry="5 5 300 5" timeout=1 #syncRepl rid=002 # provider=ldap://ldap2:389 # binddn="cn=Manager,dc=linuxldap,dc=org" # bindmethod=simple # credentials=secret # searchbase="dc=linuxldap,dc=org" # type=refreshOnly # interval=00:00:00:05 # retry="5 5 300 5" # timeout=1 mirrormode true sockbuf_max_incoming 5000 sockbuf_max_incoming_auth 5000 database monitor Regards, Kenneth Penza

3 2

Ldap ppolicy schema entries
by Ljunghammar, Darryl K 23 Jan '08

23 Jan '08

I would like to view the ppolicy schema attributes for a user when I do a "ldapsearch" but they don't show up. For example, I would like to see the "pwdHistory" attribute for a user. I know it is being updated because if I enter a previously used password it tells me it can't be reused. I am using openldap 2.3.39-3 on a Redhat 5.1 system. TIA, Darryl

2 1

Adding new LDIF entries
by David Moderski 23 Jan '08

23 Jan '08

I am having trouble finding the correct information about adding new entries. For example, if I am loading the initial directory, do the entries need to have changetype: add or is changetype: add only used for adding attributes to existing entries? -- Dave Moderski Programmer/Analyst Atlantic Cape Community College 609-625-1111 ext. 5298

2 1

Need a multi-client schema
by Carr, Chris 23 Jan '08

23 Jan '08

[deep breath, disclaimer: I am a knowledgeable end user, having administered a LAN of Linux and Windows PCs at home for several years, but I don't code and I knew nothing of LDAP until recently. I originally submitted this to openldap-software, but the moderator said it was more appopriate for this list. I have lurked for a week with increasing agitation at my lack of technical knowledge - apologies if this question is too stupid for most of you.] I run an IMAP server on my Linux box at home (Debian Etch), so that I can read my mail from anywhere, using any IMAP client (Outlook at work, Evolution at home, Thunderbird at my in-laws, etc.). I got frustrated with having to export and import my contacts all the time, never remembering which client had the most up-to-date set. So I looked into setting up my own LDAP server so they could live in one place, available to any client, just like the email. Sadly it doesn't seem to be that simple. Apt-get install slapd went fine - Debian was even so kind as to set up a bdb database for me with suffix "dc=mydomain", so all I had to do was create a rootdn and rootpw in slapd.conf. I painstakingly exported my contacts from Outlook as CSV, via Evolution as vCard then via http://labs.brotherli.ch/vcfconvert/ into LDIF. But trying to import the result into slapd gave lots of errors, and this is when I discovered the joys of schemata. The vCard-to-LDIF converter uses a variant Mozilla-address-book schema which slapd doesn't understand. I tried tweaking the LDIF file with this python script (http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/476224) but that fell over because some of my contacts don't have email addresses. So slapd is up and running but I have no way of importing my contact info without doing some Python hacking or re-keying the info (about 400 records). Basic question: is there an existing schema that I can include in slapd.conf which will allow my contacts to be intelligible to all the clients I use (let alone might use)? They are just basic person data: names, postal addresses, phone/fax numbers, email addresses, etc. Assuming no, can I combine a schema for each client, if I can find one? For example, the Mozilla one is here (https://bugzilla.mozilla.org/attachment.cgi?id=166746), which will work for Thunderbird, SeaMonkey etc. If I can find one for Evolution and one for Outlook, could I just include them all, or would there be incompatibilities? (Even if there aren't, a quick look at the Mozilla one leads me to suspect that I would need to duplicate numerous fields.) Does anyone successfully use LDAP with multiple clients? Is there an easy way to do it? Judging from the 'AD-style AUX classes' thread there are some issues with Outlook - in the first instance I would be happy if both Evolution and Thunderbird/SeaMonkey could see and edit the same contact data. Thanks in advance for any help, and apologies for the lengthy footer over which I have no control, CC This e-mail may contain information which is confidential, legally privileged and/or copyright protected. This e-mail is intended for the addressee only. If you receive this in error, please contact the sender and delete the material from your computer

3 7

Openldap / windows active directory sync
by अनुज Anuj Singh 23 Jan '08

23 Jan '08

Hi, I have one microsoft windows active directory server, 1. How to implement Openldap and Windows dircetory sync so that any user can get authorized from Openldap or M$ active directory. 2. User information/password sync How to sync windows Active directory with Openldap vice-versa. any tutorial/ how to? Thanks and regards Anuj

1 0

openldap 2.4.7 Segfault when deleting olcAccess parameter from cn=config
by Faraz Khan 22 Jan '08

22 Jan '08

When trying to delete a single olcAccess attribute from cn=config the openldap server crashes. The client library (php) returns error code -1 (cant contact LDAP Server) and the openldap server crashes. The delete operation is: dn: olcDatabase={2}bdb,cn=config changetype: modify delete: olcAccess olcAccess: 2 This behavior is not consistent. Sometimes the server crashes while sometimes it will report back : modifying entry "olcDatabase={2}bdb,cn=config" ldap_modify: No such attribute (16) It might continue to say Error 19 for a while (3-4 times) and on the 5th time the operation completes successfully. However, the dn at this time seems to contain NO entries. After this slapd crashes. Restarting will show that the operation was never ACTUALLY completed. The segfault trace is: ber_dump: buf=0x82c1ef0 ptr=0x82c1ef3 end=0x82c1f2c len=57 0000: 66 37 04 1c 6f 6c 63 64 61 74 61 62 61 73 65 3d f7..olcdatabase= 0010: 7b 32 7d 62 64 62 2c 63 6e 3d 63 6f 6e 66 69 67 {2}bdb,cn=config 0020: 30 17 30 15 0a 01 01 30 10 04 09 6f 6c 63 61 63 0.0....0...olcac 0030: 63 65 73 73 31 03 04 01 32 cess1...2 conn=0 op=3 do_modify: dn (olcdatabase={2}bdb,cn=config) ber_scanf fmt ({e{m[W]}}) ber: ber_dump: buf=0x82c1ef0 ptr=0x82c1f15 end=0x82c1f2c len=23 0000: 30 15 0a 01 01 30 10 04 09 6f 6c 63 61 63 63 65 0....0...olcacce 0010: 73 73 31 03 04 01 32 ss1...2 >>> dnPrettyNormal: <olcdatabase={2}bdb,cn=config> => ldap_bv2dn(olcdatabase={2}bdb,cn=config,0) <= ldap_bv2dn(olcdatabase={2}bdb,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={2}bdb,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={2}bdb,cn=config)=0 <<< dnPrettyNormal: <olcDatabase={2}bdb,cn=config>, <olcDatabase={2}bdb,cn=config> conn=0 op=3 modifications: delete: olcaccess one value, length 1 conn=0 op=3 MOD dn="olcDatabase={2}bdb,cn=config" conn=0 op=3 MOD attr=olcaccess <= acl_access_allowed: granted to database root Segmentation fault -- Faraz R Khan Chief Architect Emergen Consulting Pvt Ltd www.emergen.biz

2 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical