7:29 a.m.
Eric Speake
Web Systems Administrator
O'Reilly Auto Parts
From: "Ulrich Windl" <Ulrich.Windl(a)rz.uni-regensburg.de>
To: <espeake(a)oreillyauto.com>
Date: 08/29/2013 01:46 AM
Subject: Antw: Re: Object not found
Eric,
following you progress on LDAP, why don't you use a working simple starting
configuration and then try simple steps towards getting where you want to
be at
the end? Only proceed if the current configuration works as intended; if
not
either undo or fix it.
Something like:
olcAccess: {0}to * by dn.base="uid=syncrepl,ou=system,dc=whatever" read by
group/organizationalRole/roleOccupant.exact="cn=LDAP-Manager,dc=whatever"
write
by * break
olcAccess: {1}to attrs=userPassword by self write by * auth
olcAccess: {2}to attrs=shadowLastChange by self write by * read
olcAccess: {3}to attrs=userPKCS12 by self read by * none
olcAccess: {4}to * by * read
You can leave out rule {0}, because that's some local extension used here
(use a group for Managers).
Also I can recommend turning on auth logging for your tests. In
LDIF-format:
dn: cn=config
changetype: modify
add: olcLogLevel
olcLogLevel: ACL
-
I also recommend doing frequent database dumps per slapcat, so you can
revert
to a working configuration once you messed up things. However when using
replication, be aware that restoring one node to an older configuration,
the
older node may be overwritten if the other nodes still have a newer
configuration.
To all: Is there an option to slapadd to make any entries actually added
being
"new" (i.e. ignoring CSNs and modification timestamps in the LDIF)?
Regards,
Ulrich
>> <espeake(a)oreillyauto.com> schrieb am 29.08.2013 um
05:25 in Nachricht
<OF5EFEDB5F.26657526-ON86257BD6.001209FD-86257BD6.0012CADD@LocalDomain>:
Okay so I have the access list figured out and everything looks good
except
now the credentials for my user aren't working. I get an error
49
(invalid
credentials) I have reentered the password for the user. There is
one
other user that will not autenticate. Both of thes users are in the ou
System. The base admin account can login and get the informatio. Here
is
the new access list.
olcAccess: {0}to * by
dn.base="uid=syncrepl,ou=System,dc=oreillyauto,dc=com" read by
dn.base="uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" read by
dn.base="uid=ldapAdmin,ou=System,dc=oreillyauto,dc=com" write by
dn.base="uid=newUserAdmin,ou=System,dc=oreillyauto,dc=com" write by
dn.base="uid=passwordAdmin,ou=System,dc=oreillyauto,dc=com" write by *
break
olcAccess: {1}to dn.subtree="dc=oreillyauto,dc=com" by
group/groupOfUniqueNames/uniqueMember="cn=System
Administrators,ou=Groups,dc=oreillyauto,dc=com" write
by group/groupOfUniqueNames/uniqueMember="cn=LDAP
Admin,ou=Groups,dc=oreillyauto,dc=com" write by * none break
olcAccess: {2}to attrs=userPassword by
group/groupOfUniqueNames/uniqueMember="cn=Authenticate,ou=Groups,dc=oreillya
uto,dc=com"
write by anonymous auth by self write
olcAccess: {3}to attrs=uid by anonymous read by users read
olcAccess: {4}to attrs=ou,employeeNumber by users read
olcAccess: {5}to dn.subtree="ou=System,dc=oreillyauto,dc=com" by
dn.subtree="ou=Users,dc=oreillyauto,dc=com" none by users read
olcAccess: {6}to dn.children="ou=Groups,dc=oreillyauto,dc=com" by
dnattr=owner write by dnattr=uniqueMember read by * none
olcAccess: {7}to dn.children="ou=Users,dc=oreillyauto,dc=com by self read
by
group/groupOfUniqueNames/uniqueMember="cn=Authenticate,ou=Groups,dc=oreillya
uto,dc=com"
read by * none
olcAccess: {8}to * by self read by users read
The two users that I need to work are:
readOnlyUser
dn="uid=readOnlyUser,ou=System,dc=oreilly,dc=com
and
ldapadmin dn="uid=ldapadmin,
ou=System,dc=oreulllyauto,dc=com
Here is the search and result:
root@tntest-ldap-3:/var/lib/ldap# ldapsearch -Wx -D
"uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" -b
"dc=oreillyauto,dc=com" -H ldap://<ldap-server>.oreillyauto.com
uid=espeake
uid dsplayName employeeNumber
Enter LDAP Password:
ldap_bind: Invalid credentials (49)
any and all ideas are welcomed.
Eric Speake
Web Systems Administrator
O'Reilly Auto Parts
From: Quanah Gibson-Mount <quanah(a)zimbra.com>
To: espeake(a)oreillyauto.com, openldap-technical(a)openldap.org
Date: 08/28/2013 11:35 AM
Subject: Re: Object not found
Sent by: openldap-technical-bounces(a)OpenLDAP.org
--On Wednesday, August 28, 2013 8:12 AM -0500 espeake(a)oreillyauto.com
wrote:
>
> I have a user name readonly that we use in our applications to get
uid's.
> THis has worked in the past with our old LDAP solution. We have
moved
to
> 2.4.31 on Ubuntu 12.04 with a n-way Multi master setup.
>
> The slap cat for this database looks like this.
>
> dn: olcDatabase={1}hdb,cn=config
> objectClass: olcDatabaseConfig
> objectClass: olcHdbConfig
> olcDatabase: {1}hdb
> olcDbDirectory: /var/lib/ldap
> olcSuffix: dc=oreillyauto,dc=com
> olcAccess: {0}to attrs=userPassword by anonymous auth by * none
> olcAccess: {1}to dn.subtree="dc=oreillyauto,dc=com" by
> group/groupOfUniqueName
> s/uniqueMember="cn=System
Administrators,ou=Groups,dc=oreillyauto,dc=com"
> wri
> te by group/groupOfUniqueNames/uniqueMember="cn=LDAP
> Admin,ou=Groups,dc=oreil
> lyauto,dc=com" write by * none break
> olcAccess: {2}to attrs=userPassword by
> group/groupOfUniqueNames/uniqueMember="
> cn=Authenticate,ou=Groups,dc=oreillyauto,dc=com" write by anonymous
auth
> by s
> elf write
Hi,
You need to spend some time reading the manual pages and admin guide on
access rules for slapd.
It is immediately obvious that rule {2) will never evaluate because of
rule
{0}. Those shouldn't even be separate rule lines, they should be a
single
rule. I haven't looked further because that was so blatant,
I'm guessing
you have any number of other issues in your access lines.
--Quanah
--
Quanah Gibson-Mount
Lead Engineer
Zimbra, Inc
--------------------
Zimbra :: the leader in open source messaging and collaboration
--
This message has been scanned for viruses and dangerous content,
and is believed to be clean.
Message id: 898DB600A44.A073B
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended
recipient, and may contain legally privileged material. If you are
not
the
intended recipient, please return or destroy it immediately. Thank
you.
Here what shows up in the log. I am high lighting what I thought would
have been the issue but it appears to be a double-negative so it is not
where it is getting denied. Just must be missing it because it looks like
it really working.
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: conn=1027 op=0 BIND
dn="uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" method=128
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => bdb_entry_get: found entry:
"uid=readonlyuser,ou=system,dc=oreillyauto,dc=com"
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => bdb_entry_get: found entry:
"cn=passwordadminpolicy,ou=policies,dc=oreillyauto,dc=com"
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (userPassword)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: auth access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "userPassword"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => acl_get: [1] attr
userPassword
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => acl_mask: access to entry
"uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com", attr
"userPassword"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => acl_mask: to value by "",
(=0)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= check a_dn_pat:
uid=syncrepl,ou=system,dc=oreillyauto,dc=com
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= check a_dn_pat:
uid=readonlyuser,ou=system,dc=oreillyauto,dc=com
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= check a_dn_pat:
uid=ldapadmin,ou=system,dc=oreillyauto,dc=com
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= check a_dn_pat:
uid=newuseradmin,ou=system,dc=oreillyauto,dc=com
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= check a_dn_pat:
uid=passwordadmin,ou=system,dc=oreillyauto,dc=com
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= acl_mask: no more <who>
clauses, returning =0 (stop)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => slap_access_allowed: auth
access denied by =0
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: no more
rules
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => bdb_entry_get: found entry:
"uid=readonlyuser,ou=system,dc=oreillyauto,dc=com"
Aug 29 08:53:32 slapd[18777]: last message repeated 3 times
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"objectClass"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"objectClass"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => bdb_entry_get: found entry:
"uid=readonlyuser,ou=system,dc=oreillyauto,dc=com"
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => bdb_entry_get: found entry:
"cn=passwordadminpolicy,ou=policies,dc=oreillyauto,dc=com"
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entry"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"objectClass"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entry"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"objectClass"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= acl_access_allowed: granted
to database root
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => bdb_entry_get: found entry:
"uid=readonlyuser,ou=system,dc=oreillyauto,dc=com"
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"objectClass"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"objectClass"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => bdb_entry_get: found entry:
"uid=readonlyuser,ou=system,dc=oreillyauto,dc=com"
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entry"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (objectClass)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "objectClass"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result was
in cache (objectClass)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (uid)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "uid" requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (description)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "description"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => bdb_entry_get: found entry:
"uid=readonlyuser,ou=system,dc=oreillyauto,dc=com"
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entry"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (objectClass)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "objectClass"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result was
in cache (objectClass)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (uid)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "uid" requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (description)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "description"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (pwdPolicySubentry)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"pwdPolicySubentry"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (structuralObjectClass)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"structuralObjectClass" requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (entryUUID)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entryUUID"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (creatorsName)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "creatorsName"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (createTimestamp)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"createTimestamp"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (pwdHistory)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "pwdHistory"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (pwdPolicySubentry)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"pwdPolicySubentry"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (structuralObjectClass)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"structuralObjectClass" requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (entryUUID)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entryUUID"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (creatorsName)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "creatorsName"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (createTimestamp)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"createTimestamp"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (pwdHistory)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "pwdHistory"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result was
in cache (pwdHistory)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (userPassword)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "userPassword"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result was
in cache (pwdHistory)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (pwdChangedTime)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"pwdChangedTime"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (userPassword)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (pwdFailureTime)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "userPassword"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"pwdFailureTime"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (pwdChangedTime)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"pwdChangedTime"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (pwdFailureTime)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"pwdFailureTime"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result was
in cache (pwdFailureTime)
Aug 29 08:53:32 slapd[18777]: last message repeated 5 times
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (entryCSN)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entryCSN"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (modifiersName)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "modifiersName"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (modifyTimestamp)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"modifyTimestamp"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (entryDN)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entryDN"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result was
in cache (entryDN)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (subschemaSubentry)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"subschemaSubentry"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result was
in cache (subschemaSubentry)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (hasSubordinates)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"hasSubordinates"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result was
in cache (hasSubordinates)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
--
This message has been scanned for viruses and dangerous content,
and is believed to be clean.
Message id: 28CE360097D.AE572
This communication and any attachments are confidential, protected by Communications
Privacy Act 18 USCS § 2510, solely for the use of the intended recipient, and may contain
legally privileged material. If you are not the intended recipient, please return or
destroy it immediately. Thank you.
12:30 p.m.
New subject: Antw: Re: Object not found
From: espeake(a)oreillyauto.com
To: "Ulrich Windl" <Ulrich.Windl(a)rz.uni-regensburg.de>
Cc: openldap-technical(a)openldap.org
Date: 08/29/2013 10:29 AM
Subject: Re: Antw: Re: Object not found
Sent by: openldap-technical-bounces(a)OpenLDAP.org
Eric Speake
Web Systems Administrator
O'Reilly Auto Parts
From: "Ulrich Windl" <Ulrich.Windl(a)rz.uni-regensburg.de>
To: <espeake(a)oreillyauto.com>
Date: 08/29/2013 01:46 AM
Subject: Antw: Re: Object not found
Eric,
following you progress on LDAP, why don't you use a working simple starting
configuration and then try simple steps towards getting where you want to
be at
the end? Only proceed if the current configuration works as intended; if
not
either undo or fix it.
Something like:
olcAccess: {0}to * by dn.base="uid=syncrepl,ou=system,dc=whatever" read by
group/organizationalRole/roleOccupant.exact="cn=LDAP-Manager,dc=whatever"
write
by * break
olcAccess: {1}to attrs=userPassword by self write by * auth
olcAccess: {2}to attrs=shadowLastChange by self write by * read
olcAccess: {3}to attrs=userPKCS12 by self read by * none
olcAccess: {4}to * by * read
You can leave out rule {0}, because that's some local extension used here
(use a group for Managers).
Also I can recommend turning on auth logging for your tests. In
LDIF-format:
dn: cn=config
changetype: modify
add: olcLogLevel
olcLogLevel: ACL
-
I also recommend doing frequent database dumps per slapcat, so you can
revert
to a working configuration once you messed up things. However when using
replication, be aware that restoring one node to an older configuration,
the
older node may be overwritten if the other nodes still have a newer
configuration.
To all: Is there an option to slapadd to make any entries actually added
being
"new" (i.e. ignoring CSNs and modification timestamps in the LDIF)?
Regards,
Ulrich
>> <espeake(a)oreillyauto.com> schrieb am 29.08.2013 um
05:25 in Nachricht
<OF5EFEDB5F.26657526-ON86257BD6.001209FD-86257BD6.0012CADD@LocalDomain>:
Okay so I have the access list figured out and everything looks good
except
now the credentials for my user aren't working. I get an error
49
(invalid
credentials) I have reentered the password for the user. There is
one
other user that will not autenticate. Both of thes users are in the ou
System. The base admin account can login and get the informatio. Here
is
the new access list.
olcAccess: {0}to * by
dn.base="uid=syncrepl,ou=System,dc=oreillyauto,dc=com" read by
dn.base="uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" read by
dn.base="uid=ldapAdmin,ou=System,dc=oreillyauto,dc=com" write by
dn.base="uid=newUserAdmin,ou=System,dc=oreillyauto,dc=com" write by
dn.base="uid=passwordAdmin,ou=System,dc=oreillyauto,dc=com" write by *
break
olcAccess: {1}to dn.subtree="dc=oreillyauto,dc=com" by
group/groupOfUniqueNames/uniqueMember="cn=System
Administrators,ou=Groups,dc=oreillyauto,dc=com" write
by group/groupOfUniqueNames/uniqueMember="cn=LDAP
Admin,ou=Groups,dc=oreillyauto,dc=com" write by * none break
olcAccess: {2}to attrs=userPassword by
group/groupOfUniqueNames/uniqueMember="cn=Authenticate,ou=Groups,dc=oreillya
uto,dc=com"
write by anonymous auth by self write
olcAccess: {3}to attrs=uid by anonymous read by users read
olcAccess: {4}to attrs=ou,employeeNumber by users read
olcAccess: {5}to dn.subtree="ou=System,dc=oreillyauto,dc=com" by
dn.subtree="ou=Users,dc=oreillyauto,dc=com" none by users read
olcAccess: {6}to dn.children="ou=Groups,dc=oreillyauto,dc=com" by
dnattr=owner write by dnattr=uniqueMember read by * none
olcAccess: {7}to dn.children="ou=Users,dc=oreillyauto,dc=com by self read
by
group/groupOfUniqueNames/uniqueMember="cn=Authenticate,ou=Groups,dc=oreillya
uto,dc=com"
read by * none
olcAccess: {8}to * by self read by users read
The two users that I need to work are:
readOnlyUser
dn="uid=readOnlyUser,ou=System,dc=oreilly,dc=com
and
ldapadmin
dn="uid=ldapadmin,
ou=System,dc=oreulllyauto,dc=com
Here is the search and result:
root@tntest-ldap-3:/var/lib/ldap# ldapsearch -Wx -D
"uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" -b
"dc=oreillyauto,dc=com" -H ldap://<ldap-server>.oreillyauto.com
uid=espeake
uid dsplayName employeeNumber
Enter LDAP Password:
ldap_bind: Invalid credentials (49)
any and all ideas are welcomed.
Eric Speake
Web Systems Administrator
O'Reilly Auto Parts
From: Quanah Gibson-Mount <quanah(a)zimbra.com>
To: espeake(a)oreillyauto.com,
openldap-technical(a)openldap.org
Date: 08/28/2013 11:35 AM
Subject: Re: Object not found
Sent by: openldap-technical-bounces(a)OpenLDAP.org
--On Wednesday, August 28, 2013 8:12 AM -0500 espeake(a)oreillyauto.com
wrote:
>
> I have a user name readonly that we use in our applications to get
uid's.
> THis has worked in the past with our old LDAP solution. We have
moved
to
> 2.4.31 on Ubuntu 12.04 with a n-way Multi master setup.
>
> The slap cat for this database looks like this.
>
> dn: olcDatabase={1}hdb,cn=config
> objectClass: olcDatabaseConfig
> objectClass: olcHdbConfig
> olcDatabase: {1}hdb
> olcDbDirectory: /var/lib/ldap
> olcSuffix: dc=oreillyauto,dc=com
> olcAccess: {0}to attrs=userPassword by anonymous auth by * none
> olcAccess: {1}to dn.subtree="dc=oreillyauto,dc=com" by
> group/groupOfUniqueName
> s/uniqueMember="cn=System
Administrators,ou=Groups,dc=oreillyauto,dc=com"
> wri
> te by group/groupOfUniqueNames/uniqueMember="cn=LDAP
> Admin,ou=Groups,dc=oreil
> lyauto,dc=com" write by * none break
> olcAccess: {2}to attrs=userPassword by
> group/groupOfUniqueNames/uniqueMember="
> cn=Authenticate,ou=Groups,dc=oreillyauto,dc=com" write by anonymous
auth
> by s
> elf write
Hi,
You need to spend some time reading the manual pages and admin guide on
access rules for slapd.
It is immediately obvious that rule {2) will never evaluate because of
rule
{0}. Those shouldn't even be separate rule lines, they should be a
single
rule. I haven't looked further because that was so blatant,
I'm guessing
you have any number of other issues in your access lines.
--Quanah
--
Quanah Gibson-Mount
Lead Engineer
Zimbra, Inc
--------------------
Zimbra :: the leader in open source messaging and collaboration
--
This message has been scanned for viruses and dangerous content,
and is believed to be clean.
Message id: 898DB600A44.A073B
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended
recipient, and may contain legally privileged material. If you are
not
the
intended recipient, please return or destroy it immediately. Thank
you.
Here what shows up in the log. I am high lighting what I thought would
have been the issue but it appears to be a double-negative so it is not
where it is getting denied. Just must be missing it because it looks like
it really working.
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: conn=1027 op=0 BIND
dn="uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" method=128
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => bdb_entry_get: found entry:
"uid=readonlyuser,ou=system,dc=oreillyauto,dc=com"
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => bdb_entry_get: found entry:
"cn=passwordadminpolicy,ou=policies,dc=oreillyauto,dc=com"
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (userPassword)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: auth access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "userPassword"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => acl_get: [1] attr
userPassword
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => acl_mask: access to entry
"uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com", attr
"userPassword"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => acl_mask: to value by "",
(=0)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= check a_dn_pat:
uid=syncrepl,ou=system,dc=oreillyauto,dc=com
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= check a_dn_pat:
uid=readonlyuser,ou=system,dc=oreillyauto,dc=com
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= check a_dn_pat:
uid=ldapadmin,ou=system,dc=oreillyauto,dc=com
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= check a_dn_pat:
uid=newuseradmin,ou=system,dc=oreillyauto,dc=com
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= check a_dn_pat:
uid=passwordadmin,ou=system,dc=oreillyauto,dc=com
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= acl_mask: no more <who>
clauses, returning =0 (stop)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => slap_access_allowed: auth
access denied by =0
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: no more
rules
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => bdb_entry_get: found entry:
"uid=readonlyuser,ou=system,dc=oreillyauto,dc=com"
Aug 29 08:53:32 slapd[18777]: last message repeated 3 times
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"objectClass"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"objectClass"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => bdb_entry_get: found entry:
"uid=readonlyuser,ou=system,dc=oreillyauto,dc=com"
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => bdb_entry_get: found entry:
"cn=passwordadminpolicy,ou=policies,dc=oreillyauto,dc=com"
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entry"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"objectClass"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entry"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"objectClass"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= acl_access_allowed: granted
to database root
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => bdb_entry_get: found entry:
"uid=readonlyuser,ou=system,dc=oreillyauto,dc=com"
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"objectClass"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"objectClass"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search
access granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => bdb_entry_get: found entry:
"uid=readonlyuser,ou=system,dc=oreillyauto,dc=com"
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entry"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (objectClass)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "objectClass"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result was
in cache (objectClass)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (uid)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "uid" requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (description)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "description"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => bdb_entry_get: found entry:
"uid=readonlyuser,ou=system,dc=oreillyauto,dc=com"
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entry"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (objectClass)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "objectClass"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result was
in cache (objectClass)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (uid)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "uid" requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (description)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "description"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (pwdPolicySubentry)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"pwdPolicySubentry"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (structuralObjectClass)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"structuralObjectClass" requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (entryUUID)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entryUUID"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (creatorsName)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "creatorsName"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (createTimestamp)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"createTimestamp"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (pwdHistory)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "pwdHistory"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (pwdPolicySubentry)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"pwdPolicySubentry"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (structuralObjectClass)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"structuralObjectClass" requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (entryUUID)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entryUUID"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (creatorsName)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "creatorsName"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (createTimestamp)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"createTimestamp"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (pwdHistory)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "pwdHistory"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result was
in cache (pwdHistory)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (userPassword)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "userPassword"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result was
in cache (pwdHistory)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (pwdChangedTime)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"pwdChangedTime"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (userPassword)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (pwdFailureTime)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "userPassword"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"pwdFailureTime"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (pwdChangedTime)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"pwdChangedTime"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (pwdFailureTime)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"pwdFailureTime"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result was
in cache (pwdFailureTime)
Aug 29 08:53:32 slapd[18777]: last message repeated 5 times
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (entryCSN)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entryCSN"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (modifiersName)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "modifiersName"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (modifyTimestamp)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"modifyTimestamp"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (entryDN)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entryDN"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result was
in cache (entryDN)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (subschemaSubentry)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"subschemaSubentry"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result was
in cache (subschemaSubentry)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not
in cache (hasSubordinates)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com"
"hasSubordinates"
requested
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result was
in cache (hasSubordinates)
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted
Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access
granted by manage(=mwrscxd)
--
This message has been scanned for viruses and dangerous content,
and is believed to be clean.
Message id: 28CE360097D.AE572
Quanah,
I have retyped the password a couple of times to be sure I didn't
fat-finger the password. I have a 3 node n-way multimaster cluster that
working with replication on all changes with no issues other than the
authentication. I changed the password for the user on one server and
checked the other two making sure the password hash replicated to the other
servers and it did with no problems. I tried the ldapsearch with two
system users that will be used against the ldap server with the same result
for both. The only user that will authenticate is the DB rootDN user. And
of course that password is stored in the config.
Any ideas on what I can check on next. I tried changing the logging to -1
to get everything, but I just wasn't seeing anything that looked helpful.
Thanks for the help,
Eric
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you are
not the intended recipient, please return or destroy it immediately. Thank
you.
--
This message has been scanned for viruses and dangerous content,
and is believed to be clean.
Message id: C880F600DE5.A20BF
This communication and any attachments are confidential, protected by Communications
Privacy Act 18 USCS § 2510, solely for the use of the intended recipient, and may contain
legally privileged material. If you are not the intended recipient, please return or
destroy it immediately. Thank you.
3:54 p.m.
New subject: Antw: Re: Object not found
--On Thursday, August 29, 2013 2:30 PM -0500 espeake(a)oreillyauto.com wrote:
Quanah,
I have retyped the password a couple of times to be sure I didn't
fat-finger the password. I have a 3 node n-way multimaster cluster that
working with replication on all changes with no issues other than the
authentication. I changed the password for the user on one server and
checked the other two making sure the password hash replicated to the
other servers and it did with no problems. I tried the ldapsearch with
two system users that will be used against the ldap server with the same
result for both. The only user that will authenticate is the DB rootDN
user. And of course that password is stored in the config.
Any ideas on what I can check on next. I tried changing the logging to -1
to get everything, but I just wasn't seeing anything that looked helpful.
So, as someone else noted, if your previous OpenLDAP version used a {crypt}
type hash, the newer build of OpenLDAP may not support {crypt} type
passwords. So, my suggestion was you modify the password of the user who
can't bind. You can do this using the rootdn and the ldappasswd utility.
--Quanah
--
Quanah Gibson-Mount
Lead Engineer
Zimbra, Inc
--------------------
Zimbra :: the leader in open source messaging and collaboration
4:16 p.m.
New subject: Antw: Re: Object not found
--On Thursday, August 29, 2013 6:11 PM -0500 espeake(a)oreillyauto.com wrote:
Sorry that I was unclear. I have changed the password and I still
the
invalid credentials error.
Changed it how?
--Quanah
--
Quanah Gibson-Mount
Lead Engineer
Zimbra, Inc
--------------------
Zimbra :: the leader in open source messaging and collaboration
8:55 a.m.
New subject: Antw: Re: Object not found
From: Quanah Gibson-Mount <quanah(a)zimbra.com>
To: espeake(a)oreillyauto.com
Cc: Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de>,
openldap-technical(a)openldap.org
Date: 08/29/2013 06:25 PM
Subject: Re: Antw: Re: Object not found
Sent by: openldap-technical-bounces(a)OpenLDAP.org
--On Thursday, August 29, 2013 2:30 PM -0500 espeake(a)oreillyauto.com wrote:
Quanah,
I have retyped the password a couple of times to be sure I didn't
fat-finger the password. I have a 3 node n-way multimaster cluster that
working with replication on all changes with no issues other than the
authentication. I changed the password for the user on one server and
checked the other two making sure the password hash replicated to the
other servers and it did with no problems. I tried the ldapsearch with
two system users that will be used against the ldap server with the same
result for both. The only user that will authenticate is the DB rootDN
user. And of course that password is stored in the config.
Any ideas on what I can check on next. I tried changing the logging to
-1
to get everything, but I just wasn't seeing anything that looked
helpful.
So, as someone else noted, if your previous OpenLDAP version used a {crypt}
type hash, the newer build of OpenLDAP may not support {crypt} type
passwords. So, my suggestion was you modify the password of the user who
can't bind. You can do this using the rootdn and the ldappasswd utility.
--Quanah
--
Quanah Gibson-Mount
Lead Engineer
Zimbra, Inc
--------------------
Zimbra :: the leader in open source messaging and collaboration
Quanah,
I tried this morning to change the password:
ldappasswd -s <password> -Wx -D "uid=admin,dc=<domain>,dc=com"
"uid=readOnlyUser,ou=system,dc=<domain>,dc=com"
I confirmed that the hashed password changed. I still get invalid
credentials. I am betting that there is some little simple thing that is
holding this up.
Thanks,
Eric
--
This message has been scanned for viruses and dangerous content,
and is believed to be clean.
Message id: 4651C600DEA.A3E58
This communication and any attachments are confidential, protected by Communications
Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain
legally privileged material. If you are not the intended recipient, please return or
destroy it immediately. Thank you.
10:37 a.m.
New subject: Antw: Re: Object not found
--On Friday, August 30, 2013 10:55 AM -0500 espeake(a)oreillyauto.com wrote:
Quanah,
I tried this morning to change the password:
ldappasswd -s <password> -Wx -D "uid=admin,dc=<domain>,dc=com"
"uid=readOnlyUser,ou=system,dc=<domain>,dc=com"
I confirmed that the hashed password changed. I still get invalid
credentials. I am betting that there is some little simple thing that is
holding this up.
Ok, so error (49) means one of two things:
a) Password is incorrect
b) No such object
No such object means either the entry you are attempting to bind as does
not exist in the LDAP DB, or ACLs prevent reading it, so it appears not to
exist.
My guess is this ACL is blocking access to the entry:
olcAccess: {5}to dn.subtree="ou=System,dc=oreillyauto,dc=com" by
dn.subtree="ou=Users,dc=oreillyauto,dc=com" none by users read
--Quanah
--
Quanah Gibson-Mount
Lead Engineer
Zimbra, Inc
--------------------
Zimbra :: the leader in open source messaging and collaboration
11:37 a.m.
New subject: Antw: Re: Object not found
From: Quanah Gibson-Mount <quanah(a)zimbra.com>
To: espeake(a)oreillyauto.com
Cc: openldap-technical(a)openldap.org,
openldap-technical-bounces(a)OpenLDAP.org, Ulrich Windl
<Ulrich.Windl(a)rz.uni-regensburg.de>
Date: 08/30/2013 12:37 PM
Subject: Re: Antw: Re: Object not found
--On Friday, August 30, 2013 10:55 AM -0500 espeake(a)oreillyauto.com wrote:
Quanah,
I tried this morning to change the password:
ldappasswd -s <password> -Wx -D "uid=admin,dc=<domain>,dc=com"
"uid=readOnlyUser,ou=system,dc=<domain>,dc=com"
I confirmed that the hashed password changed. I still get invalid
credentials. I am betting that there is some little simple thing that is
holding this up.
Ok, so error (49) means one of two things:
a) Password is incorrect
b) No such object
No such object means either the entry you are attempting to bind as does
not exist in the LDAP DB, or ACLs prevent reading it, so it appears not to
exist.
My guess is this ACL is blocking access to the entry:
olcAccess: {5}to dn.subtree="ou=System,dc=oreillyauto,dc=com" by
dn.subtree="ou=Users,dc=oreillyauto,dc=com" none by users read
--Quanah
--
Quanah Gibson-Mount
Lead Engineer
Zimbra, Inc
--------------------
Zimbra :: the leader in open source messaging and collaboration
Wouldn't the following control grant the access first since it is the first
in the list.
olcAccess: {0}to *
by dn.base="uid=syncrepl,ou=System,dc=oreillyauto,dc=com" read
by dn.base="uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" read
by dn.base="uid=ldapAdmin,ou=System,dc=oreillyauto,dc=com" write
by dn.base="uid=newUserAdmin,ou=System,dc=oreillyauto,dc=com" write
by dn.base="uid=passwordAdmin,ou=System,dc=oreillyauto,dc=com" write
I think it may be in how the password is presented. When I do a ldapsearch
for the readOnlyUser, the account is found. I decode the password that is
presented and the password in the encrypted {SSHA} matches what I see in my
ldap browser. I am going to have my developers do some further testing
against this ldap instance.
--
This message has been scanned for viruses and dangerous content,
and is believed to be clean.
Message id: 63BD3600DF4.A1731
This communication and any attachments are confidential, protected by Communications
Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain
legally privileged material. If you are not the intended recipient, please return or
destroy it immediately. Thank you.
11:43 a.m.
New subject: Antw: Re: Object not found
--On Friday, August 30, 2013 1:37 PM -0500 espeake(a)oreillyauto.com wrote:
From: Quanah Gibson-Mount <quanah(a)zimbra.com>
To: espeake(a)oreillyauto.com
Cc: openldap-technical(a)openldap.org,
openldap-technical-bounces(a)OpenLDAP.org, Ulrich Windl
<Ulrich.Windl(a)rz.uni-regensburg.de>
Date: 08/30/2013 12:37 PM
Subject: Re: Antw: Re: Object not found
--On Friday, August 30, 2013 10:55 AM -0500 espeake(a)oreillyauto.com wrote:
> Quanah,
>
> I tried this morning to change the password:
>
> ldappasswd -s <password> -Wx -D "uid=admin,dc=<domain>,dc=com"
> "uid=readOnlyUser,ou=system,dc=<domain>,dc=com"
>
> I confirmed that the hashed password changed. I still get invalid
> credentials. I am betting that there is some little simple thing that is
> holding this up.
Ok, so error (49) means one of two things:
a) Password is incorrect
b) No such object
No such object means either the entry you are attempting to bind as does
not exist in the LDAP DB, or ACLs prevent reading it, so it appears not to
exist.
My guess is this ACL is blocking access to the entry:
olcAccess: {5}to dn.subtree="ou=System,dc=oreillyauto,dc=com" by
dn.subtree="ou=Users,dc=oreillyauto,dc=com" none by users read
--Quanah
--
Quanah Gibson-Mount
Lead Engineer
Zimbra, Inc
--------------------
Zimbra :: the leader in open source messaging and collaboration
Wouldn't the following control grant the access first since it is the
first in the list.
olcAccess: {0}to *
by dn.base="uid=syncrepl,ou=System,dc=oreillyauto,dc=com" read
by dn.base="uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" read
by dn.base="uid=ldapAdmin,ou=System,dc=oreillyauto,dc=com" write
by dn.base="uid=newUserAdmin,ou=System,dc=oreillyauto,dc=com" write
by dn.base="uid=passwordAdmin,ou=System,dc=oreillyauto,dc=com" write
No, it would not, because you aren't bound as that user yet, you are still
anonymous.
--Quanah
--
Quanah Gibson-Mount
Lead Engineer
Zimbra, Inc
--------------------
Zimbra :: the leader in open source messaging and collaboration
11:42 a.m.
New subject: Antw: Re: Object not found
From: espeake(a)oreillyauto.com
To: Quanah Gibson-Mount <quanah(a)zimbra.com>
Cc: Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de>,
openldap-technical(a)openldap.org
Date: 08/29/2013 06:39 PM
Subject: Re: Antw: Re: Object not found
Sent by: openldap-technical-bounces(a)OpenLDAP.org
To: espeake(a)oreillyauto.com
From: Quanah Gibson-Mount <quanah(a)zimbra.com>
Date: 08/29/2013 05:55PM
Cc: Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de>,
openldap-technical(a)openldap.org
Subject: Re: Antw: Re: Object not found
--On Thursday, August 29, 2013 2:30 PM -0500 espeake(a)oreillyauto.com wrote:
Quanah,
I have retyped the password a couple of times to be sure I didn't
fat-finger the password. I have a 3 node n-way multimaster cluster that
working with replication on all changes with no issues other than the
authentication. I changed the password for the user on one server and
checked the other two making sure the password hash replicated to the
other servers and it did with no problems. I tried the ldapsearch with
two system users that will be used against the ldap server with the same
result for both. The only user that will authenticate is the DB rootDN
user. And of course that password is stored in the config.
Any ideas on what I can check on next. I tried changing the logging to
-1
to get everything, but I just wasn't seeing anything that looked
helpful.
So, as someone else noted, if your previous OpenLDAP version used a {crypt}
type hash, the newer build of OpenLDAP may not support {crypt} type
passwords. So, my suggestion was you modify the password of the user who
can't bind. You can do this using the rootdn and the ldappasswd utility.
--Quanah
--
Quanah Gibson-Mount
Lead Engineer
Zimbra, Inc
--------------------
Zimbra :: the leader in open source messaging and collaboration
Sorry that I was unclear. I have changed the password and I still the
invalid credentials error.
Thanks,
Eric
--
This message has been scanned for viruses and dangerous content,
and is believed to be clean.
Message id: 879D0600DEB.AF5BB
I came across something might explain what is causing the authentication
issue. In looking at the readOnlyUser that is not authenticating on my new
server running openladap 2.4.31 and my old server running openldap 2.4.21
is the password hash. When decode the provided password hash the old
server returns that the the password was generated with a standard hash and
on the new server it is a salted hash. I have looked through ppolicy from
my slapcat.ldif file and I don't see anything there dealing with password
storage. I am trying to figure out how I can toggle the salt hash off to do
further testing.
Thanks,
Eric
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you are
not the intended recipient, please return or destroy it immediately. Thank
you.
This communication and any attachments are confidential, protected by
Communications Privacy Act 18 USCS § 2510, solely for the use of the
intended recipient, and may contain legally privileged material. If you are
not the intended recipient, please return or destroy it immediately. Thank
you.
-- This message has been scanned for viruses and dangerous content, and is
believed to be clean. Message id: D3D8E600DEA.A3662
This communication and any attachments are confidential, protected by Communications
Privacy Act 18 USCS § 2510, solely for the use of the intended recipient, and may contain
legally privileged material. If you are not the intended recipient, please return or
destroy it immediately. Thank you.
3491
days inactive
3496
days old
openldap-technical@openldap.org
10 comments
2 participants
participants (2)
-
espeake＠oreillyauto.com -
Quanah Gibson-Mount