openldap-technical

openldap-technical@openldap.org

5 participants
9991 discussions

Samba to Kerberos via OpenLDAP
by Wes Modes 08 Mar '08

08 Mar '08

Thanks for all your advice so far. First, I'll just say this is a question principally about the arcane mysteries of Samba to OpenLDAP authentication. I've had Samba to OpenLDAP authentication running for a while now using the samba.schema and the ldapsam module. Now I'd like to understand a bit more about how that works in order to take it a step further and get openLDAP to bind against a Kerberos database via SASL. An aside; Yes, I'd heard that Samba can be configured to authenticate against Kerberos directly, but for my own reasons, I'd prefer that Samba talk only to OpenLDAP, and OpenLDAP can do the authentication. I'll fall back on the Samba to Kerberos direct route if I can't find a way to do what I want. I've noted that the Samba schema and smbldap-tools add to the user record two Samba specific password fields, sambaNTPassword and sambaLMPassword. If I have the ldapsam module specified as the passdb backend in smb.conf, is OpenLDAP merely storing the samba passwords while Samba does the password comparisons? Or does OpenLDAP do the authentication and return a yes or no? Is it possible to have Samba defer authentication to OpenLDAP? If so, I can have OpenLDAP use the {SASL} method to do authentication via kerberos. Wes -- Wes Modes Server Administrator & Programmer Analyst McHenry Library Computing & Network Services Information and Technology Services 459-5208

3 2

Problem setting up OpenLDAP for user authentication
by Guennadi Liakhovetski 05 Mar '08

05 Mar '08

Hi all I'm new to LDAP, and I must say it took me a LONG time to set it up under Debian etch on both server and client at all to do anything useful. Now I can do "ldapsearch -x -v -L" type requests from remote a host and locally. I then tried switching the remote host to using LDAP for user authentication. I'd like users not registered locally to be able to login using ldap, and for locally-known users nothing should change. I did manage to get logins to use ldap by configuring all /etc/pam.d/common-* files to first try pam_unix and then, if that fails to use ldap: * sufficient pam_unix * sufficient pam_ldap (should this be "required?) where * is "account", "auth", "password" and "session". In "auth" and "password" I also had to put * required pam_deny after ldap, because otherwise wrong passwords were accepted. In nsswitch.conf I put *: files ldap for "passwd", "group", "shadow". Now I would expect that with sequences ("pam_unix" before "pam_ldap" and "files" before "ldap") indeed locally known users wouldn't be authenticated using ldap. Unfortunately, this doesn't seem to be the case. Now _all_ nss / pam requests go to the LDAP server. Including calls from udevd, avahi-daemon, and others, which causes them to fail in various ways. What am I doing wrong? I know SASL is not configured in my setup, but that shouldn't be a problem? At least not for the cases when LDAP shouldn't be attempted at all. Thanks Guennadi --- Guennadi Liakhovetski

2 4

Could I import the data through the slapadd what I export by the ldapsearch
by 何萍 05 Mar '08

05 Mar '08

There are 6,000,000 records in my openldap directory, I want to backup the data, but I found that the slapcat isn't work when the file id2entry.dbbsize over 2G, so I export the data by ldapsearch, but after I use slapadd to import the data to the backup server, there are some strange error happened, some records can't be add to the ldap correctly, and the record coundn't be searched by ldapsearch. As the same time, others data can be correctly operated. Operation system is the redhat linux 9.0. The verson of openldap is 2.0.27, use ldbm. Because there are too many records so I couldn't upgrade the version of the openldap . when I use ldapsearch the result is : # # filter: (&(uid=abc)(domain=123)) # requesting: ALL # # search result search: 2 result: 0 Success when i use ldapadd to add the record, it says: ldap_add: Already exists ldif_record() = 68 when i use ldapdelete to del it, the result is: Delete Result: Invalid DN syntax (34) Additional info: invalid DN (my dn is right) I thought mybe the record format is not correct that I exported by ldapsearch and imported by slapadd, because the ldif file lost entryUUID、entryCSN... and so on. now how can i do? I have tried to rebuild the entryUUID and run the slapindex to rebuild the index, but failed at least.

2 1

Fwd: GSSAPI contexts used in multiple threads
by Russ Allbery 04 Mar '08

04 Mar '08

As part of the discussion of adding additional thread safety guarantees to MIT Kerberos's GSS-API implementation to support OpenLDAP's use case, Sam Hartman had the following additional questions about how OpenLDAP uses SASL in such a way as to run into this problem. I'm happy to forward answers back to him. I don't understand the usage well enough to explain it myself. | From: Sam Hartman <hartmans(a)mit.edu> | Subject: GSSAPI contexts used in multiple threads | Date: Mon, 03 Mar 2008 16:28:13 -0500 | | Hi. I'm catching up on email. I read a discussion (although I cannot | find it now) of adding support so that an established gss-api context | can be used in multiple threads at the same time. This seems like a | fine feature to add to MIT Kerberos. | | However I'm quite puzzled as to how this works for LDAP or any other | SASL application. SASL is a stream protocol; it presents an ordered | stream across the network connection. In order to guarantee this the | sasl security layer requires that tokens be wrapped and unwrapped in | the same order. If you don't do that you can get into a situation | where the wrap order is different from the unwrap order and you get | spurious gap tokens or out of order tokens. You cannot tell the | difference between this and an attack. Also, since SASL applications | may chunk data into GSS-API tokens in arbitrary order, GSS-API tokens | may not line up with LDAP PDU boundaries. | | So, I'm very confused about how an LDAP implementation could be a | correct application and run into problems with MIT's current thread | safety requirements. | | I'd appreciate it if people who do remember the original discussion | could forward my message to the right place to get an answer. | | Thanks, | | --Sam -- Russ Allbery (rra(a)stanford.edu) <http://www.eyrie.org/~eagle/>

2 3

LDAP replication when NTP server sets the time ahead
by Lucky Y 03 Mar '08

03 Mar '08

Hi, I have a system in GMT timezone and the NTP server in GMT-2hrs time zone. In this case when the system time syncs with NTP time(for example the first when the system comes up after configuration ), the time in the system will be set 2hours behind the current time in the system. In this case, LDAP relication is failing. What is the dependancy between LDAP replication and NTP servers ? Thanks in adavce. Regards, Lucky

5 7

ldap group name resolving problem
by Christian Weihrauch 03 Mar '08

03 Mar '08

Hi, I have problems with debian etch Linux clients resolving group names served by our LDAP server. user and passwd work because I can login properly. "getent group" properly shows the group served by the LDAP server. eg: #getent group mygroup:x:1000:chris However "id username" only shows LDAP served groupIDs but not their names. eg: #id chris uid=1002(chris) gid=1000 groups=1000,20(dialout) This means that I can't do things like chgrp eg: "chgroup mygroup directoryname" gives: "chgrp: invalid group `mygroup'" I am using nscd and nsswitch.conf says: passwd: files ldap group: files ldap shadow: files ldap Any ideas? Thanks! -- Christian Weihrauch, The University of Reading

3 4

Not able to load the LDIF file onto the LDAP server
by divya shree 02 Mar '08

02 Mar '08

Hi I am trying to load my ldif file onto the server using the command ldapadd -x -D "cn=Manager,dc=example,dc=net" -W -f example.ldif For which i am prompted 4 the password enter LDAP password: When i give the password: secret....i.e., the same as in slapd.conf file... i am getting an error tat says LDAP_BIND: invalid credentials(49) Plz help ASAP Thanks n Regards Divya --------------------------------- Why delete messages? Unlimited storage is just a click away.

3 2

Help with SASL/GSSAPI to remote Kerberos server
by Wes Modes 01 Mar '08

01 Mar '08

I am using *SASL/GSSAPI* to authenticate to* Kerberos* from *OpenLDAP*. I haven't gotten that to work yet. To separate and modularize some of these services, we have three servers: A file server running Samba; A directory server running OpenLDAP to provide personal and group identities; and an authentication server running Kerberos (administered by another group). Samba connects to OpenLDAP through smbldap-tools. And OpenLDAP connects to the Kerberos server via SASL/GSSAPI. When someone requests a Samba logon, Samba requests an LDAP bind, which in turn should use SASL to authenticate via Kerberos. The connection between Samba and OpenLDAP is working swell. It is the Kerberos connection that has me flummoxed. *Simply put, OpenLDAP with SASL2 and GSSAPI support will be running on one server, while the Kerberos KDC will be running on another server.* I haven't found any documents that address this not-so-wacky design. Almost all of the docs I found presume that I am setting up the KDC on the same server at OpenLDAP. In my case, the KDC is administered by another group who is willing to grant me access to Kerberos. However, none of the docs I've found offer help in setting up SASL/GSSAPI here and the Kerberos server elsewhere. So when a document says, run /kadmin.local/, to generate a principle, that is not available to me. If I can ask specifically for what I want, I might be able to convince the kerberos administrators to do it for me, but I have to be pretty specific about what I want. The docs I'm referring to are Cyrus SASL for System Administrators http://www.sendmail.org/~ca/email/cyrus/sysadmin.html <http://www.sendmail.org/%7Eca/email/cyrus/sysadmin.html> OpenLDAP 2.2 Administrator's Guide - Using SASL http://www.openldap.org/doc/admin22/guide.html#Using%20SASL In several documents, it was suggested that before you try connecting OpenLDAP to Kerberos that you test to make sure your Kerberos configuration is working. That makes a lot of sense to me. So I want to perform a series of checks, but I don't know what those tests might be. Here's what I would like to test: * Can I connect to the Kerberos server directly? (kinit) * Is direct authentication to the Kerberos server working? * Am I getting returned a proper ticket? (klist) * Is the keytab file on my OpenLDAP server being recognized and accepted by the Kerberos server? * Is my machine being authenticated as a principle? Does it need to be? * How do I test SASL2 before getting OpenLDAP involved? * After making changes to my OpenLDAP config, how do I test the Kerberos connection through OpenLDAP? Do you have any pointers here? This project has been delayed weeks and weeks while I climb and climb up Samba, OpenLDAP, and Kerberos' very steep learning curve. So your prompt response will be hugely helpful. Thanks in advance, Wes Specifics of my configuration: * OS: Red Hat Enterprise 4 v2.6.9 * OpenLDAP v2.2.13 * Local MIT Kerberos5 v1.3.4 * KDC: MIT Kerberos5 v? * Cyrus SASL v2.1.19 -- Wes Modes Server Administrator & Programmer Analyst McHenry Library Computing & Network Services Information and Technology Services 459-5208

5 11

Missing Syntax
by Nik Svoboda 29 Feb '08

29 Feb '08

I have noticed that in the openldap system I am using, the schema has a missing syntax. This syntax is "1.3.6.1.4.1.1466.115.121.1.58" ; "Substring Assertion". This is referenced in matching types using partial matching of strings (exactsubstringsmatch, numericStringSubstringsMatch, ...). I am fairly new to these subjects and do not understand fully how they operate. Is there a way to correct this? Are the syntaxes and matching types specified in a way that can be modified dynamically? -Nikkos

3 5

ldapsearch hangs Intermittently
by Kumar, Manish 28 Feb '08

28 Feb '08

I am encountering an issue on ldapsearch periodically "hangs". One out of 100 times it work fine but sometime it hangs. My ldapsearch version is ldapsearch 2.2.13 (Aug 18 2005 22:24:20). When I run it in debug mode it waits in ldap_int_select() function. end of trace is ldap_chkResponseList for msgid=-1, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid -1, all 1 ber_get_next ber_get_next: tag 0x30 len 305 contents: ldap_read: message type search-entry msgid 2, original id 2 adding response id 2 type 100: wait4msg continue, msgid -1, all 1 ** Connections: * host: 209.236.241.6 port: 20001 (default) refcnt: 2 status: Connected last used: Thu Feb 28 15:11:52 2008 ** Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ** Response Queue: * msgid 2, type 100 chained responses: * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 * msgid 2, type 100 ldap_chkResponseList for msgid=-1, all=1 ldap_chkResponseList returns NULL ldap_int_select Please help me regarding this issue. Regards Manish

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical