openldap-technical

openldap-technical@openldap.org

14 participants
9795 discussions

How to clear a certificate from openldap cache - Client Side
by divyachauhan01.dc＠gmail.com 29 Dec '20

29 Dec '20

Divyanshi Chauhan <divyachauhan01.dc(a)gmail.com> 1:33 PM (3 hours ago) to openldap-technical-owner, openldap-devel-owner, openldap-bugs-owner Hello, I have an ldaps client code which connects to the ldap server securely and does authentication. I have set the global option for ca cert directory. int res = ldap_set_option(0, LDAP_OPT_X_TLS_CACERTFILE, const_cast<char*>("path")); Correct certificate is present in the path and hence connection to the ldap server and authentication is successful in first attempt. Now, as per one of the requirements, the certificate is removed from the above client directory and authentication is attempted, we want it to fail as the certificate is deleted from the directory. But still the bind to ldap server and authentication is happening successfully. It should ideally fail as per my understanding. I did try removing the certificate from memory using following option: char * crt; ldap_get_option(0, LDAP_OPT_X_TLS_CACERTFILE, (void*)&crt); ldap_memfree(crt); I am not sure if the above way is correct or not, please advise. I also did try forcing to look for ca certificate using following option: int reqcert = LDAP_OPT_X_TLS_HARD; ldap_set_option(0, LDAP_OPT_X_TLS_REQUIRE_CERT, &reqcert); But this also did not help. Please suggest how a certificate, which is once loaded can be deleted from the openldap cache. Also please advise if I am doing something wrong in the above approach.

2 3

Using supportedControl 1.3.6.1.4.1.4203.1.10.1 (Subentries) - critical extension is unavailable 12
by Gavin Henry 27 Dec '20

27 Dec '20

Hi all, I'm doing this for a supportControl subentry delete: https://metacpan.org/pod/Net::LDAP::Control like so: my $subentry_ctrl = Net::LDAP::Control->new( type => '1.3.6.1.4.1.4203.1.10.1', value => 'Subentries', critical => 1 ); my $deleted = $c->model('LDAPContacts')->delete( q{ou=Contacts,} . $user_dn, control => [ $subentry_ctrl ] ); if ( $deleted->code ) { $c->error( qq{Failed to delete LDAP contact entries for: $user_dn} . $deleted->error . q{ Code: } . $deleted->code ); return 0; } and I'm getting: Dec 22 12:53:57 gabriel slapd[31511]: conn=1110022 op=2 SRCH attr=dn Dec 22 12:53:57 gabriel slapd[31511]: conn=1110022 op=2 ENTRY dn="xxxx" Dec 22 12:53:57 gabriel slapd[31511]: conn=1110022 op=2 SEARCH RESULT tag=101 err=0 qtime=0.000010 etime=0.001015 nentries=1 text= Dec 22 12:53:57 gabriel slapd[31511]: conn=1110023 fd=435 ACCEPT from IP=xxx:51082 (IP=0.0.0.0:389) Dec 22 12:53:57 gabriel slapd[31511]: conn=1110023 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Dec 22 12:53:57 gabriel slapd[31511]: conn=1110023 op=0 STARTTLS Dec 22 12:53:57 gabriel slapd[31511]: conn=1110023 op=0 RESULT oid= err=0 qtime=0.000007 etime=0.000038 text= Dec 22 12:53:57 gabriel slapd[31511]: conn=1110023 fd=435 TLS established tls_ssf=256 ssf=256 tls_proto=TLSv1.3 tls_cipher=TLS_AES_256_GCM_SHA384 Dec 22 12:53:57 gabriel slapd[31511]: conn=1110023 op=1 BIND dn="xxx" method=128 Dec 22 12:53:57 gabriel slapd[31511]: conn=1110023 op=1 BIND dn="xxx" mech=SIMPLE ssf=0 Dec 22 12:53:57 gabriel slapd[31511]: conn=1110023 op=1 RESULT tag=97 err=0 qtime=0.000017 etime=0.000116 text= Dec 22 12:53:58 gabriel slapd[31511]: conn=1110023 op=2 RESULT tag=107 err=12 qtime=0.000014 etime=0.000274 text=critical extension is unavailable Dec 22 12:53:58 gabriel slapd[31511]: conn=1110023 op=2 do_delete: get_ctrls failed Any ideas? Using ldapdelete with -r works as the same user (so not my ACLs), but I note in the logs that it is doing a base search for subentries and deleting each one. What am I misunderstanding here? Thanks, Gavin.

1 1

Bind using External/Client certificate not working - slapd returns binding in progress..
by dumitru s 27 Dec '20

27 Dec '20

Hi all, I'm using openldap/slapd as a ldap server (using libsasl2-2 & related modules for sasl auth) on ubuntu and trying to get a client to authenticate/bind using external/client certificate. I'm using two clients - one is a native C client using windows winldap native library and one is based on a different client ldap library (i.e. not using winldap or openldap native libraries). The client based on winldap works fine, but not the other one. This is what I can see in the slapd logs for the two cases: - the one which works fine via winldap 5fe876d4 conn=1000 op=0 do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt ({m) ber: ber_scanf fmt (m) ber: ber_scanf fmt (}}) ber: 5fe876d4 >>> dnPrettyNormal: <> 5fe876d4 <<< dnPrettyNormal: <>, <> 5fe876d4 do_bind: dn () SASL mech EXTERNAL 5fe876d4 ==>slap_sasl2dn: converting SASL name email=test(a)test.com,cn=example,ou=example,o=example,st=anystate,c=us to a DN 5fe876d4 ==> rewrite_context_apply [depth=1] string='email=test(a)test.com,cn=example,ou=example,o=example,st=anystate,c=us' 5fe876d4 ==> rewrite_rule_apply rule='email=test(a)test.com,cn=example,ou=example,o=example,st=anystate,c=us' string='email=test(a)test.com,cn=example,ou=example,o=example,st=anystate,c=us' [1 pass(es)] 5fe876d4 ==> rewrite_context_apply [depth=1] res={0,'cn=test,dc=example,dc=com'} 5fe876d4 slap_parseURI: parsing cn=test,dc=example,dc=com ldap_url_parse_ext(cn=test,dc=example,dc=com) 5fe876d4 >>> dnNormalize: <cn=test,dc=example,dc=com> 5fe876d4 <<< dnNormalize: <cn=test,dc=example,dc=com> 5fe876d4 <==slap_sasl2dn: Converted SASL name to cn=test,dc=example,dc=com 5fe876d4 slap_sasl_getdn: dn:id converted to cn=test,dc=example,dc=com 5fe876d4 SASL Authorize [conn=1000]: proxy authorization allowed authzDN="" 5fe876d4 send_ldap_sasl: err=0 len=-1 5fe876d4 do_bind: SASL/EXTERNAL bind: dn="cn=test,dc=example,dc=com" sasl_ssf=0 5fe876d4 send_ldap_response: msgid=1 tag=97 err=0 - the one which doesn't work 5fe87b50 conn=1001 op=0 do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt ({m) ber: ber_scanf fmt (}}) ber: 5fe87b50 >>> dnPrettyNormal: <> 5fe87b50 <<< dnPrettyNormal: <>, <> 5fe87b50 do_bind: dn () SASL mech EXTERNAL 5fe87b50 send_ldap_sasl: err=14 len=0 5fe87b50 send_ldap_response: msgid=1 tag=97 err=14 As can be seen, the second one stops at "do_bind: dn () SASL mech EXTERNAL" and slapd just returns the binding in progress result code. Of course, the same client certificate is used in both cases. The fact that one client works fine suggests that the slapd configuration is correct. Any idea what is wrong? Can I enable any additional logs (sasl one?) to be able to see more? Thanks, Dumitru

1 0

Migrate HDB to MDB
by Pete Ashdown 21 Dec '20

21 Dec '20

I'm looking for some assistance in converting a legacy LDAP from an HDB backend to MDB. I've been unable to find any resources in how this can be executed and my attempts at using ldapmodify have failed. I'm willing to pay consulting fees if someone is available to help, or otherwise be educated if is documented somewhere. Thanks in advance.

3 3

ACL for authz-regexp
by Stefan Kania 20 Dec '20

20 Dec '20

Hello, I try to figure out which ACL I need to get the rewriting of the sasl-username working. I have in my slapd.conf the following lines: ---------- authz-regexp uid=(.+),cn=gssapi,cn=auth ldap:///dc=example,dc=net??sub?(uid=$1) ----------- If I do a "ldapwhoami" without any ACL I get what I want: ----------- ptau@provider-stat:~$ ldapwhoami SASL/GSSAPI authentication started SASL username: ptau(a)EXAMPLE.NET SASL SSF: 256 SASL data security layer installed. dn:uid=ptau,ou=users,dc=example,dc=net ----------- As soon as I include my ACLs I get: ------------ ptau@provider-stat:~$ ldapwhoami SASL/GSSAPI authentication started SASL username: ptau(a)EXAMPLE.NET SASL SSF: 256 SASL data security layer installed. dn:uid=ptau,cn=gssapi,cn=auth ------------ So the rewrite of the DN is not working anymore with ACLs. Here are the relevant part of my ACLs. (It's at the beginning of the ACLs) ------------ limits dn.exact="uid=repl-user,ou=users,dc=example,dc=net" size=unlimited time=unlimited limits dn.exact="cn=kdc,ou=kerberos-adm,dc=example,dc=net" size=unlimited time=unlimited limits dn.exact="cn=kadmin,ou=kerberos-adm,dc=example,dc=net" size=unlimited time=unlimited access to dn.base="" by * read access to dn.base="cn=subSchema" by * read access to * by dn.exact="uid=sssd-user,ou=users,dc=example,dc=net" read by dn.exact="uid=ldap-admin,ou=users,dc=example,dc=net" write by dn.exact="uid=repl-user,ou=users,dc=example,dc=net" read by dn.exact="cn=kdc,ou=kerberos-adm,dc=example,dc=net" write by dn.exact="cn=kadmin,ou=kerberos-adm,dc=example,dc=net" write by dn.regex="(.+),cn=gssapi,cn=auth" auth by * break ------------ As soon as I remove the line: ------------ by dn.regex="(.+),cn=gssapi,cn=auth" auth ------------ and change the last line to: ------------- by * auth ------------- But this will make all other ACLs, after this ACLs, useless. I tried so far: by ssf=256 auth by sasl_ssf=256 auth non of the above is working So it's definitely an ACL issue, but how do I solve it? The log-File is giving me the following output: -------------- Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 fd=20 ACCEPT from IP=192.168.56.81:50728 (IP=0.0.0.0:636) Dez 20 19:22:46 provider-stat ldapwhoami[2047]: GSSAPI client step 1 Dez 20 19:22:46 provider-stat ldapwhoami[2047]: GSSAPI client step 1 Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 fd=20 TLS established tls_ssf=256 ssf=256 Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 op=0 BIND dn="" method=163 Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 op=0 RESULT tag=97 err=14 text=SASL(0): successful result: Dez 20 19:22:46 provider-stat ldapwhoami[2047]: GSSAPI client step 1 Dez 20 19:22:46 provider-stat slapd[2038]: connection_input: conn=1004 deferring operation: binding Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 op=1 BIND dn="" method=163 Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 op=1 RESULT tag=97 err=14 text=SASL(0): successful result: Dez 20 19:22:46 provider-stat ldapwhoami[2047]: GSSAPI client step 2 Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 op=2 BIND dn="" method=163 Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 op=2 BIND authcid="ptau" authzid="ptau" Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 op=2 BIND dn="uid=ptau,cn=gssapi,cn=auth" mech=GSSAPI sasl_ssf=256 ssf=256 Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 op=2 RESULT tag=97 err=0 text= Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 op=3 EXT oid=1.3.6.1.4.1.4203.1.11.3 Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 op=3 WHOAMI Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 op=3 RESULT oid= err=0 text= Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 op=4 UNBIND Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 fd=20 closed Dez 20 19:22:46 provider-stat ldapwhoami[2047]: DIGEST-MD5 common mech free -------------- I think it had something to do with what I found in the manpage: ------------------- Some internal operations and some controls require specific access privileges. The authzID mapping and the proxyAuthz control require auth (=x) privileges on all the attributes that are present in the search filter of the URI regexp maps (the right-hand side of the authz-regexp directives). Auth (=x) privileges are also required on the authzTo attribute of the authorizing identity and/or on the au‐ thzFrom attribute of the authorized identity. In general, when an internal lookup is performed for authentication or authorization purposes, search-specific privileges (see the access requirements for the search operation illustrated above) are relaxed to auth. ------------------- But my problem here is, I'm not a native English speaker and it's hard for me to figure out what the write is telling me here :-( Any solution for the right ACL to solve the problem? Greetings Stefan

2 1

How to set cipher
by Puranjay Pradhan 17 Dec '20

17 Dec '20

I am trying to set cipher list as like below : std::string ciphers = "AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA" returnCode = ldap_set_option(NULL, LDAP_OPT_X_TLS_CIPHER_SUITE, ciphers.c_str()); But, it returns an error : "TLS could not set cipher list ....." Can anyone suggest what is the right way of doing this?

3 2

verify openldap source
by A. Schulze 17 Dec '20

17 Dec '20

Hello, I'm searching for a way to verify the integrity of downloads from openldap.org. Many open source projects use to provide foo-$version.tar.gz.[asc|sha256sum] next to foo-$version.tar.gz Is something similar available for openldap? Andreas

3 4

new index on consumer
by Stefan Kania 10 Dec '20

10 Dec '20

Hello If I create a new index on a provider in slapd.conf NOT in cn=config (using mdb). I have to do a slapindex on the provider. When I configure the same index in consumer slapd.conf do I have to do the slapindex here too? Greeting Stefan --

2 1

Symas OpenLDAP for Linux Ubuntu PPA (18 LTS, 20 LTS)
by Quanah Gibson-Mount 09 Dec '20

09 Dec '20

Symas is now producing a PPA for Symas OpenLDAP for Linux on the Ubuntu platform. Packages can be obtained from: <https://launchpad.net/~symas/+archive/ubuntu/sofl/> The PPA build keeps all Ubuntu modifications (such as building nssov, etc). Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Changes to CentOS project
by Quanah Gibson-Mount 09 Dec '20

09 Dec '20

In case people missed it, the CentOS project is changing how it operates, and changing the EOL for CentOS8 from 2029 to the end of 2021: <https://blog.centos.org/2020/12/future-is-centos-stream/> Symas plans to continue to produce packages suitable for CentOS7 and CentOS8 until their respective EOLs, and to continue to provide packages for RHEL7 and RHEL8 until their EOLs. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical