openldap-technical

openldap-technical@openldap.org

7 participants
9864 discussions

RE: LDAP Writes are not propagated to mirror nodes.
by Quanah Gibson-Mount 21 Feb '08

21 Feb '08

--On Thursday, February 21, 2008 2:56 PM +0800 "K C, Sachin (Sachin)" <sachinkc(a)alcatel-lucent.com> wrote: > > Quanah, > > I have compiled the source on solaris 10. OpenLDAP release I > used is 2.4.7 Keep all replies on the list. Sending a reply to the list and then sending a further reply to me is only going to help ensure you end up on my blacklist, and it definitely won't get you a quicker response. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: Ppolicy issues
by Bryan Payne 21 Feb '08

21 Feb '08

Thank you for your help. I added the pwdPolicySubentry to a user to no avail. I did find this in the logfile though: Feb 20 09:01:13 ldapserver slapd[6709]: conn=95289 op=4 SEARCH RESULT tag=101 err=50 nentries=0 text=Operations are restricted to bind/unbind/abandon/StartTLS/modify password So it looks like it's trying to do something but cannot. While I'm concerned about password strength, I'm more concerned (at this point) with just having the machine prompt for a password change. I'm running centos 4.6 and openldap 2.3.39. I compiled it with the following: ./configure --enable-crypt --enable-ppolicy --with-tls --prefix=/opt/openldap/ Once again, thanks for any help. Bryan Payne skrev, on 19-02-2008 22:27: I have some issues with ppolicy. It seems it recognizes expiration dates (I know this from looking in the logs, but it does not warn the user their password is expiring soon), properly locks out accounts with too many failed logins but it cannot seem to force a password change when pwdReset is set to TRUE, nor does it prevent logins when the password has expired. Any help would be greatly appreciated. I'll post the things of importance below. Please let me know if anything else would help. [root@ldapserver ~]# ldapsearch -x -LLL cn=default dn: cn=default,ou=policies,dc=example,dc=com objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: 2.5.4.35 pwdInHistory: 6 pwdCheckQuality: 1 pwdMinLength: 8 pwdMaxFailure: 4 pwdLockout: TRUE pwdFailureCountInterval: 0 pwdMustChange: TRUE pwdSafeModify: FALSE pwdLockoutDuration: 900 pwdExpireWarning: 432000 pwdGraceAuthNLimit: 1 pwdAllowUserChange: TRUE pwdMaxAge: 7776000 From slapd.conf overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=example,dc=com" ppolicy_use_lockout Most of the above looks kosher; my main site is running ppolicy on OpenLDAP 2.3.33 up to 2.3.39 Buchan rpms on Red Hat RHEL5 and all the above work. However: 1: I've found that each posixAccount has to have the operational attribute pwdPolicySubentry. Although this is an operational attribute, it is (the only?) such that is user modifiable. In this (as in many other) respects gq is indispensable as GUI. 2: I've found that extensive use has to be made of pam_ldap to get the best out of ppolicy (for example password strength). 3: It would help if you detailed OS and OL versions, so's one could know whether to contribute help or not. Bets, --Tonni -- Tony Earnshaw Email: tonni at hetnet dot nl

4 6

Re: TLS LDAP Configuration w/Linux 5.0
by Buchan Milne 21 Feb '08

21 Feb '08

Please keep replies on-list. On Thursday 21 February 2008 17:00:11 Mathis, Jim wrote: > Buchan, > > Thanks for the info. I want to ensure when I create the certificates > that I'm doing it correctly. As follows: > > LDAP Server IP: 192.168.10.1 > Host name: node01 > suffix: dc=S80,dc=com > > Do I create a Certificate Common Name using "node01.S80.com" or "node01" You use the name that you are going to use to connect to the host with. The real fqdn does not matter .... So, if you are going to use: URI ldaps://www.microsoft.com then create a cert for www.microsoft.com (of course, you should ensure that the name you use resolves to the IP) Regard,s Buchan

1 0

ldapadd of LDIF files with attribute 'apple-generateduid' not allowed
by Alexander Hartner 21 Feb '08

21 Feb '08

I am trying to import a simple LDIF file into OpenDirectory on OS X 10.5.2 Leopard Server. However when I issue the following ldapadd command I get an error : ldapadd -D [rootdn] -x -w [secretPassword] -f Import.ldif Error : 65 Object class violation" attribute 'apple-generateduid' not allowed I would have thought that I had specified apple-generateduid, but I didn't. This is my import file -----------BEGIN----------- # Alexander Hartner dn: cn=Alexander Hartner2,cn=people,dc=macbook-znet,dc=local objectClass: top objectClass: person objectClass: inetOrgPerson displayName: Alexander Hartner2 cn: Alexander Hartner2 givenName: Alexander sn: Hartner mail: alex(a)j2anywhere.com initials: A o: j2anywhere.com -----------END----------- I know this might not be the best forum for OS X support, but I am a bit stuck on this. Thanks in advance. Alex

1 0

TLS LDAP Configuration w/Linux 5.0
by Mathis, Jim 21 Feb '08

21 Feb '08

Hello, Info as follows: OS: RH Enterprise Server 5.1 Server Certificates: Created using a Common Name of "S80.com" Client Certificate: Copied "cacert.pem" from the server and placed into "/etc/openldap/cacerts/" Problem: When configuring TLS to work with LDAP I'm no longer able to login from a client via LDAP. LDAP works normal when TLS is not configured. Suspect possible configuration problem. I'd appreciate any additional information. Thanks. CLIENT /ETC/LDAP.CONF # The distinguished name of the search base. base dc=S80,dc=com timelimit 120 bind_timelimit 120 idle_timelimit 3600 # Just assume that there are no supplemental groups for these named users nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman bind_policy soft uri ldaps://192.168.10.1/ ssl start_tls TLS_CACERT /etc/openldap/cacerts/cacert.pem pam_password md5 CLIENT /ETC/OPENLDAP/LDAP.CONF URI ldaps://192.168.10.1/ BASE dc=S80,dc=com TLS_CACERT /etc/openldap/cacerts/cacert.pem SERVER /ETC/OPENLDAP/SLAPD.CONF TLSCACertificateFile /var/certs/cacert.pem TLSCertificateFile /var/certs/servercrt.pem TLSCertificateKeyFile /var/certs/serverkey.pem database ldbm suffix "dc=S80,dc=com" rootdn "cn=Administrator,dc=S80,dc=com" USED THE FOLLOWING COMMANDS (Did not observe ldaps port 636 being opened. Not sure if it's necessary due to start_tls on port 389) slapd -h "ldap:/// ldaps:///" nmap 192.168.10.1 PORT STATE SERVICE 22/tcp open ssh 111/tcp open rpcbind 389/tcp open ldap 617/tcp open sco-dtmgr 650/tcp open unknown 722/tcp open unknown 2049/tcp open nfs AMPLIFYING DATA No errors occur using "ldapsearch -x 'uid=jmathis' -H ldap://192.168.10.1" Errors observed using: ldapsearch -x 'uid=jmathis' -H ldaps://192.168.10.1 ldap_bind: Can't contact LDAP server (-1) ldapsearch -x -b 'dc=S80,dc=com' -ZZ ldap_start_tls: Can't contact LDAP server (-1)

3 2

Re: ldapsearch for accont object class
by Hamidreza Hamedtoolloei 21 Feb '08

21 Feb '08

Dear Dieter , Thanks for your response. I am using LDAP as a centrtal authentication unit, and migrated all the linux accounts to ldap via some migration tools. currently authentication for linux users work fine i.e. "su sriram then inputing the password" doesnt complain, but when I want to bind to ldap using a user DN (ex ldapsearch "uid=sriram,ou=People,dc=ibm,dc=com" -W -x) I get the Invalid credentials (49) error. I added password-hash {CRYPR} to my slapd.config file, however, it prevented the server from running. the other entry, "cn=fratbrother,ou=People,dc=ibm,dc=com", I added manually. Although the hashing method is SSHA, when I add password-hash {MD5} to my slapd.config, I still can successfully bind. I dont know why this is happening... since the password-hash method has changed, I expect to get the Invalid credentials error... any ideas? ----- Original Message ---- From: Dieter Kluenter <dieter(a)dkluenter.de> To: openldap-technical(a)openldap.org Sent: Tuesday, February 19, 2008 11:33:05 PM Subject: Re: ldapsearch for accont object class Hamidreza Hamedtoolloei <hamedtoolloei(a)yahoo.com> writes: > Dear all, > Below is the "partial" content of my openldap db. > when I do: > ldapsearch -D "cn=fratbrother,ou=People,dc=ibm,dc=com" -w password -x > everything is fine. However, when I do > ldapsearch -D "uid=sriram,ou=People,dc=ibm,dc=com" -w password -x > I get the ldap_bind: Invalid credentials (49) error. > is this related to the "account" object class? > it seems that none of the openLdap tools such as ldapsearch,ldappasswd works > for "account" object class.. is the syntax different for this type of class? > p.s. in my slapd.config for ACL I have > access to * > by * read Your problem seem to be different password hashing methods > # sriram, People, ibm.com > dn: uid=sriram,ou=People,dc=ibm,dc=com > userPassword:: e2NyeXB0fSQxJC82bGVIazhGJEY3bHpuS1d2bi5UWmQuZ2o1TUhqLy4= this is a crypt hashed passwword > dn: cn=fratbrother,ou=People,dc=ibm,dc=com > userPassword:: e1NTSEF9aXVxUkw1MlAvaS9XUkRkNHhuN0lEbUl3VnhhekRzV2s= this is a ssha hashed password. -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6 ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 1

Another question concerning the dynlist overlay
by Gerd Schering 20 Feb '08

20 Feb '08

Hi, I my slapd.conf i added th following line: dynlist-attrset myAccount myAccountOwnerURL myAccount is a propriatary, auxliliary objectclass. SlapD says: AttributeDescription "myAccountOwnerURL" must be a subtype of "labeledURI". I really don't now how to arrange this. Trying attributetype ( labeledURI:1 NAME 'myAccountOwnerURL' ... ) gives: OID could not be expanded: "labeledURI:1" even the dyngroup.schema wsa loaded prior to the schema containing the "myAccountOwnerURL" Attribute. Any hint how to proceed? Gerd -- ------------------------------------------------------ -- Gerd Schering, Email: Schering(a)tubit.TU-Berlin.DE -- -- TU Berlin, Zentraleinrichtung Rechenzentrum -- -- Sekr. E-N 50, Einsteinufer 17, 10587 Berlin -- -- phone: +49 30 314 24383, fax: +49 30 314 21060 -- ------------------------------------------------------

2 2

ldapsearch for accont object class
by Hamidreza Hamedtoolloei 20 Feb '08

20 Feb '08

Dear all, Below is the "partial" content of my openldap db. when I do: ldapsearch -D "cn=fratbrother,ou=People,dc=ibm,dc=com" -w password -x everything is fine. However, when I do ldapsearch -D "uid=sriram,ou=People,dc=ibm,dc=com" -w password -x I get the ldap_bind: Invalid credentials (49) error. is this related to the "account" object class? it seems that none of the openLdap tools such as ldapsearch,ldappasswd works for "account" object class.. is the syntax different for this type of class? p.s. in my slapd.config for ACL I have access to * by * read # sriram, People, ibm.com dn: uid=sriram,ou=People,dc=ibm,dc=com uid: sriram cn: Sriram Krishnan objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword:: e2NyeXB0fSQxJC82bGVIazhGJEY3bHpuS1d2bi5UWmQuZ2o1TUhqLy4= shadowLastChange: 13923 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 503 gidNumber: 503 homeDirectory: /export/home/sriram gecos: Sriram Krishnan,SDSC,8585555555,8586666666 # fratbrother, People, ibm.com dn: cn=fratbrother,ou=People,dc=ibm,dc=com cn: fratbrother sn: fratbrother objectClass: top objectClass: person userPassword:: e1NTSEF9aXVxUkw1MlAvaS9XUkRkNHhuN0lEbUl3VnhhekRzV2s= ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

3 2

Ppolicy issues
by Bryan Payne 20 Feb '08

20 Feb '08

I have some issues with ppolicy. It seems it recognizes expiration dates (I know this from looking in the logs, but it does not warn the user their password is expiring soon), properly locks out accounts with too many failed logins but it cannot seem to force a password change when pwdReset is set to TRUE, nor does it prevent logins when the password has expired. Any help would be greatly appreciated. I'll post the things of importance below. Please let me know if anything else would help. [root@ldapserver ~]# ldapsearch -x -LLL cn=default dn: cn=default,ou=policies,dc=example,dc=com objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: 2.5.4.35 pwdInHistory: 6 pwdCheckQuality: 1 pwdMinLength: 8 pwdMaxFailure: 4 pwdLockout: TRUE pwdFailureCountInterval: 0 pwdMustChange: TRUE pwdSafeModify: FALSE pwdLockoutDuration: 900 pwdExpireWarning: 432000 pwdGraceAuthNLimit: 1 pwdAllowUserChange: TRUE pwdMaxAge: 7776000 From slapd.conf overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=example,dc=com" ppolicy_use_lockout

2 1

Password change synchronization
by punith punith 20 Feb '08

20 Feb '08

Hi everybody.. Warm greetings to you all. I am doing authentication using OpenLDAP and I think it is best place to ask my problem. What I require is, I have to run a shell script when the user changes password. ie Suppose that a user is changed his OpenLDAP pasword, I want to trigger a shell script which updates oracle login password. Is it possible with Openldap? If so, how and where to keep the shell script? All queris and reply are welcome.

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical