openldap-technical

openldap-technical@openldap.org

3 participants
9898 discussions

Fwd: GSSAPI contexts used in multiple threads
by Russ Allbery 04 Mar '08

04 Mar '08

As part of the discussion of adding additional thread safety guarantees to MIT Kerberos's GSS-API implementation to support OpenLDAP's use case, Sam Hartman had the following additional questions about how OpenLDAP uses SASL in such a way as to run into this problem. I'm happy to forward answers back to him. I don't understand the usage well enough to explain it myself. | From: Sam Hartman <hartmans(a)mit.edu> | Subject: GSSAPI contexts used in multiple threads | Date: Mon, 03 Mar 2008 16:28:13 -0500 | | Hi. I'm catching up on email. I read a discussion (although I cannot | find it now) of adding support so that an established gss-api context | can be used in multiple threads at the same time. This seems like a | fine feature to add to MIT Kerberos. | | However I'm quite puzzled as to how this works for LDAP or any other | SASL application. SASL is a stream protocol; it presents an ordered | stream across the network connection. In order to guarantee this the | sasl security layer requires that tokens be wrapped and unwrapped in | the same order. If you don't do that you can get into a situation | where the wrap order is different from the unwrap order and you get | spurious gap tokens or out of order tokens. You cannot tell the | difference between this and an attack. Also, since SASL applications | may chunk data into GSS-API tokens in arbitrary order, GSS-API tokens | may not line up with LDAP PDU boundaries. | | So, I'm very confused about how an LDAP implementation could be a | correct application and run into problems with MIT's current thread | safety requirements. | | I'd appreciate it if people who do remember the original discussion | could forward my message to the right place to get an answer. | | Thanks, | | --Sam -- Russ Allbery (rra(a)stanford.edu) <http://www.eyrie.org/~eagle/>

2 3

LDAP replication when NTP server sets the time ahead
by Lucky Y 04 Mar '08

04 Mar '08

Hi, I have a system in GMT timezone and the NTP server in GMT-2hrs time zone. In this case when the system time syncs with NTP time(for example the first when the system comes up after configuration ), the time in the system will be set 2hours behind the current time in the system. In this case, LDAP relication is failing. What is the dependancy between LDAP replication and NTP servers ? Thanks in adavce. Regards, Lucky

5 7

ldap group name resolving problem
by Christian Weihrauch 03 Mar '08

03 Mar '08

Hi, I have problems with debian etch Linux clients resolving group names served by our LDAP server. user and passwd work because I can login properly. "getent group" properly shows the group served by the LDAP server. eg: #getent group mygroup:x:1000:chris However "id username" only shows LDAP served groupIDs but not their names. eg: #id chris uid=1002(chris) gid=1000 groups=1000,20(dialout) This means that I can't do things like chgrp eg: "chgroup mygroup directoryname" gives: "chgrp: invalid group `mygroup'" I am using nscd and nsswitch.conf says: passwd: files ldap group: files ldap shadow: files ldap Any ideas? Thanks! -- Christian Weihrauch, The University of Reading

3 4

Not able to load the LDIF file onto the LDAP server
by divya shree 02 Mar '08

02 Mar '08

Hi I am trying to load my ldif file onto the server using the command ldapadd -x -D "cn=Manager,dc=example,dc=net" -W -f example.ldif For which i am prompted 4 the password enter LDAP password: When i give the password: secret....i.e., the same as in slapd.conf file... i am getting an error tat says LDAP_BIND: invalid credentials(49) Plz help ASAP Thanks n Regards Divya --------------------------------- Why delete messages? Unlimited storage is just a click away.

3 2

Help with SASL/GSSAPI to remote Kerberos server
by Wes Modes 01 Mar '08

01 Mar '08

I am using *SASL/GSSAPI* to authenticate to* Kerberos* from *OpenLDAP*. I haven't gotten that to work yet. To separate and modularize some of these services, we have three servers: A file server running Samba; A directory server running OpenLDAP to provide personal and group identities; and an authentication server running Kerberos (administered by another group). Samba connects to OpenLDAP through smbldap-tools. And OpenLDAP connects to the Kerberos server via SASL/GSSAPI. When someone requests a Samba logon, Samba requests an LDAP bind, which in turn should use SASL to authenticate via Kerberos. The connection between Samba and OpenLDAP is working swell. It is the Kerberos connection that has me flummoxed. *Simply put, OpenLDAP with SASL2 and GSSAPI support will be running on one server, while the Kerberos KDC will be running on another server.* I haven't found any documents that address this not-so-wacky design. Almost all of the docs I found presume that I am setting up the KDC on the same server at OpenLDAP. In my case, the KDC is administered by another group who is willing to grant me access to Kerberos. However, none of the docs I've found offer help in setting up SASL/GSSAPI here and the Kerberos server elsewhere. So when a document says, run /kadmin.local/, to generate a principle, that is not available to me. If I can ask specifically for what I want, I might be able to convince the kerberos administrators to do it for me, but I have to be pretty specific about what I want. The docs I'm referring to are Cyrus SASL for System Administrators http://www.sendmail.org/~ca/email/cyrus/sysadmin.html <http://www.sendmail.org/%7Eca/email/cyrus/sysadmin.html> OpenLDAP 2.2 Administrator's Guide - Using SASL http://www.openldap.org/doc/admin22/guide.html#Using%20SASL In several documents, it was suggested that before you try connecting OpenLDAP to Kerberos that you test to make sure your Kerberos configuration is working. That makes a lot of sense to me. So I want to perform a series of checks, but I don't know what those tests might be. Here's what I would like to test: * Can I connect to the Kerberos server directly? (kinit) * Is direct authentication to the Kerberos server working? * Am I getting returned a proper ticket? (klist) * Is the keytab file on my OpenLDAP server being recognized and accepted by the Kerberos server? * Is my machine being authenticated as a principle? Does it need to be? * How do I test SASL2 before getting OpenLDAP involved? * After making changes to my OpenLDAP config, how do I test the Kerberos connection through OpenLDAP? Do you have any pointers here? This project has been delayed weeks and weeks while I climb and climb up Samba, OpenLDAP, and Kerberos' very steep learning curve. So your prompt response will be hugely helpful. Thanks in advance, Wes Specifics of my configuration: * OS: Red Hat Enterprise 4 v2.6.9 * OpenLDAP v2.2.13 * Local MIT Kerberos5 v1.3.4 * KDC: MIT Kerberos5 v? * Cyrus SASL v2.1.19 -- Wes Modes Server Administrator & Programmer Analyst McHenry Library Computing & Network Services Information and Technology Services 459-5208

5 11

Missing Syntax
by Nik Svoboda 29 Feb '08

29 Feb '08

I have noticed that in the openldap system I am using, the schema has a missing syntax. This syntax is "1.3.6.1.4.1.1466.115.121.1.58" ; "Substring Assertion". This is referenced in matching types using partial matching of strings (exactsubstringsmatch, numericStringSubstringsMatch, ...). I am fairly new to these subjects and do not understand fully how they operate. Is there a way to correct this? Are the syntaxes and matching types specified in a way that can be modified dynamically? -Nikkos

3 5

ldapsearch hangs Intermittently
by Kumar, Manish 29 Feb '08

29 Feb '08

I am encountering an issue on ldapsearch periodically "hangs". One out of 100 times it work fine but sometime it hangs. My ldapsearch version is ldapsearch 2.2.13 (Aug 18 2005 22:24:20). When I run it in debug mode it waits in ldap_int_select() function. end of trace is ldap_chkResponseList for msgid=-1, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid -1, all 1 ber_get_next ber_get_next: tag 0x30 len 305 contents: ldap_read: message type search-entry msgid 2, original id 2 adding response id 2 type 100: wait4msg continue, msgid -1, all 1 ** Connections: * host: 209.236.241.6 port: 20001 (default) refcnt: 2 status: Connected last used: Thu Feb 28 15:11:52 2008 ** Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ** Response Queue: * msgid 2, type 100 chained responses: * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 ldap_chkResponseList for msgid=-1, all=1 ldap_chkResponseList returns NULL ldap_int_select Please help me regarding this issue. Regards Manish

1 0

RWM overlay bind operation
by Rui Ramos 28 Feb '08

28 Feb '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello *, I'm having some troubles with the rwm overlay maybe someone can give some ligths on the subject. We have a non standard schema which in turn has an atribute pass1 that we want to use for the LDAP BIND operation. From what i've seen the BIND operation is hardcoded to use userPAssword attribute (please correct me if i'm wrong). So what we did was the following: we have server A with pass2 filled running on port 7001. and server B with the following config ... database ldap suffix "dc=example,dc=org" uri "ldap://localhost:7001" overlay rwm rwm-map attribute userPassword pass2 ... With this configuration the attribute userPassword gets filled with the content of pass2. But if we try to make Bind search in server B with that user password it fails because it tries to make the bind in ldap://localhost:7001. Is there a way to make the bind operation the the changed data ? Best Regards, Rui Ramos - -- Rui Ramos ============================================== Universidade do Porto - IRICUP Praça Gomes Teixeira, 4099-002 Porto, Portugal email: rramos[at]reit.up.pt phone: +351 22 040 8164 ============================================== -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.7 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iQEVAwUBR8aDvL1uR0bdnTWSAQIuhQgAw5rF8zSs0MapMSUMsb96j0PiUV2TdQ9V GTyB6RTeAJmNqh6/bvEoUO3m8a1UaNffQzYpj03S7y4moVVz4r8+bJQ4Xs0eM8C0 PSU1SXisJbVTcqbEoccma6Yllnd2ZYke8zo/kF/4EPycFxGVj36N+krEB7L/ouO8 jx+Mg6KhteqdxX4Pwz+WyG5g1jhxw4/RKiZC5BaWtP5Cv6pz810DZv9W9C9B0/tJ BYuiWWl3ntzI50Vgm3dmdBt3yUBvngfk/e6RIyRA0rDxpu9uslzCm3Q1acU72tOH Rj32AHuciyf6697rvZE/XQHao09AUhOrZliY/lmpLNc0LHKjDkvDCA== =uBz4 -----END PGP SIGNATURE-----

1 0

ldapsearch returns Could not create LDAP session handle (3): Time limit exceeded
by Brooks Campbell 28 Feb '08

28 Feb '08

We upgraded some client servers from RedHat ES3U4 to Redhat ES4U2 and now the ldapsearch string we used in our monitoring software to check if the customers openldap server is working is returning errors. We were using: ldapsearch -x -H ladps://host.domain.com:636 Which worked find with the open ldap-client on redhat 3 (I do not no the version number) but in redhat 4 openldap-clients 2.2.13-3 we get the error "Could not create LDAP session handle (3): Time limit exceeded" immediately. Ldap is working our application authenticates users it is just the ldapsearch we are using to monitor the service which seems to not be working. Does anyone see anything wrong with the line above or is there something else we can use in a automated script to check if the ldap server is running? Brooks Campbell IT Manager, Waterloo CA and Hersham UK Navtech Systems Support Inc. 295 Hagey Blvd Suite 200 Waterloo, ON, N2L 6R5 W:519-747-1170 xt263 brooks(a)navtechinc.com

3 4

integrating LDAP onto EPrints and Dspace
by divya shree 28 Feb '08

28 Feb '08

Hi I am doin a project..where in i hav to integrate LDAP on to Eprints n DSpace..for providin a single user authentication to the users of Eprints n DSapce... For this i am trying to install OpenLdap-2.4.7..software..i would like to knw if i am on the ryt track and also would like to knw the diff between openldap n ldap..if there is any... Thanks and Regards Divya --------------------------------- Forgot the famous last words? Access your message archive online. Click here.

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical