Questions tagged [openldap]
OpenLDAP Software is a free, open source implementation of the Lightweight Directory Access Protocol (LDAP) developed by the OpenLDAP Project. LDAP is a platform-independent protocol for querying and modifying data using directory services running over TCP/IP.
1,468
questions
7
votes
2
answers
23k
views
How do you set password-hash for OpenLDAP?
I have the following version on Ubuntu 12.04:
OpenLDAP: slapd (Sep 19 2013 22:49:31) $
buildd@batsu:/build/buildd/openldap-2.4.28/debian/build/servers/slapd
OpenLDAP now offers SSHA as the default ...
0
votes
0
answers
401
views
Cannot connect to LDAP server ERRNO=0
I have a php application (apache,redhat with selinux disabled) and I am struggling with ldap configuration. I am trying to connect to a ldap server and I am getting this error in apache logs:
...
0
votes
0
answers
2k
views
Sorry i'm stuck with freeradius to LDAP
Ok Im a little stuck with FreeRadus.
I think I have found the problem, I just don't understand why so If I try to auth over the wifi it looks like its not getting the password below is the debug of ...
0
votes
0
answers
54
views
OpenLDAP + GSSAPI/Kerberos SASL
I have OpenLDAP 2.5 configured with GSSAPI and Kerberos set up and working. By working I mean I can bind and search when I have a ticket. My question is can I do a bind when I don't have a ticket? Can ...
3
votes
2
answers
3k
views
Rename base DN in OpenLDAP
I currently have an LDAP directory (OpenLDAP), which does authentication for a bunch of services running across a number of servers.
Let's say the base DN is dc=oldcompany,dc=com.
I'd now like to ...
0
votes
0
answers
294
views
How to synchronize OpenLDAP and Samba4?
I have a samba 4 domain with internal LDAP. Now the need arose to copy OpenLDAP users and passwords to this domain. This copy must be made synchronously every time there is a change in OpenLDAP. ...
0
votes
1
answer
379
views
shared mail address with postfix and dovecot
I'm trying to set up some shared mailboxes like contact or support.
I have made it possible for me to share an IMAP folder between users in Dovecot by doing this in 15-mailboxes.conf
namespace {
...
0
votes
0
answers
128
views
SSSD LDAP CONFIGURATION
I am trying to configure ldap on port 636 on a redhat server. Right now, when I try the following command :
netstat -antup | grep -i 636
I get
tcp 0 132 IP_ADDRESS_1:40670 XX.XX.XX.XX:...
1
vote
1
answer
146
views
OpenLDAP ppolicy working with passwd, but not ldappasswd
I've been working on this for about a week, and can't seem to figure out why this is happening.
I've got passwd working, letting users change their own ldap password from a client machine, and it ...
1
vote
2
answers
783
views
Linux password via kerberos unable to reset
When I try to reset a ldap user password from client machine I am getting the following error
$ passwd
Changing password for user demo.
Current Password:
New password:
Retype new password:
passwd: ...
2
votes
1
answer
15k
views
Why do I get "Server not found in Kerberos database" using testsaslauthd?
I'm trying to setup Kerberos auth over SASL using OpenLDAP. As I understand it, I need a host keytab in /etc/krb5.keytab from the KDC I'm using and then {SASL}user@realm in the given user's LDAP ...
0
votes
0
answers
142
views
Windows application 'LDAP Admin' fails to connect to OpenLDAP on port 636
I run an OpenLDAP server on (2.6.3_2) FreeBSD.
I works fine with FreeBSD/Linux clients like PAM/NSS/NextCloud over LDAPS port 636.(With a Let's Encrypt certificate)
I can't get it to work together ...
2
votes
1
answer
431
views
Possible to parse ldapsearch output?
I have an ldapsearch query to pull some data of an email system, I am trying to parse the data into something I can analyze in a table/flat file, and generate reports on the accounts.
Sample of the ...
0
votes
1
answer
241
views
Apache 2.4 LDAP "password mismatch" but password is correct
I run apache2.4 on debian and LDAP-Auth tells me "password mismatch" but I am very sure I use correct passwords (tested multiple users).
I also asked chat-gpt and it told me maybe my ...
7
votes
3
answers
4k
views
LDAP change user pass on client
I am trying to allow ldap users to change their password on client machines. I have tried pam every which way I can think of /etc/ldap.conf & /etc/pam_ldap.conf, as well. At this point I'm stuck.
...
0
votes
0
answers
149
views
OpenLDAP client config, cannot log in to the server
I'm trying to set up OpenLDAP on a Ubuntu 22.04 to authenticate against a central server running Ubuntu Server 20.04, however, i have found some issues i cannot solve on my own.
The server itself is ...
0
votes
0
answers
43
views
adding vlv(virtual list view) extension to openLDAP (LDAP) Server
Im currently working with LDAPRecord library in a Laravel project. I want to use a pagination function but it's required having virtual list view (vlv) extension to my ldap server
, I dont quite know ...
0
votes
0
answers
43
views
Project specific LDAP authorization for SVN
I am using Apache 2.4 on Ubuntu 14.04 and SVN 1.8.8.
I have installed SVN server and created a number of repositories (one per client). For each team working for each client, I added configurations ...
0
votes
0
answers
26
views
I've got an error while adding an olcOverlay
here is my ldif file :
dn: olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config
objectClass: olcSyncProvConfig
olcOverlay: syncpro
then I enter ldapadd -Y EXTERNAL -H ldapi:// -f overlay.ldif
and here ...
0
votes
0
answers
106
views
Is it possible to add memberUid as bind DN
Can we use memberUid for bind dn string.
Here is my sample ldif file
dn: cn=posixgroup,dc=memtesting,dc=com
objectClass: top
objectClass: posixGroup
gidNumber: 1001
cn: posixgroup
memberUid: posixuser
...
0
votes
0
answers
164
views
Samba Domain with readonly Active Directory and OpenLDAP
I have a working Samba Windows Domain getting its users from an OpenLDAP database, but now I need to get these users from an Active Directory database. I have full access to the OpenLDAP database but ...
0
votes
1
answer
3k
views
How does userPassword attribute work in LDAP?
I'm just learning about LDAP, and there's something I don't quite understand.
When we create users in a directory, we define their password using the userPassword. When we use for example the {SSHA} ...
9
votes
4
answers
31k
views
How to disable an LDAP account?
The LDAP uses the posixAccount schema and related attributes and I wonder if there's a standardized way to disable an account. Re-enabling the account should obviously re-enable the former password.
...
0
votes
1
answer
34
views
OpenLDAP + Moodle, member of groups
the teachers in my OpenLDAP are in cn=teachers,ou=groups,dc=school,dc=de
the course creator context in my Moodle installation should then be the same if I am not mistaken. If I query ldap
BINDUSER=&...
0
votes
1
answer
343
views
ldap_group_search_base is not working as intented
I've used the below-given sssd.conf file to authorize the users to a server. The issue is some users who are not listed under the DN: cn=authorized,ou=rona,ou=servers,ou=groups,dc=yolo,dc=com still ...
0
votes
1
answer
127
views
What are all the certificates mandatory to be provide while setting TLSVerifyClient option to demand
In my case, I had set TLSVerifyClient to demand. I couldn't be able to establish a connection While providing TLSCACertificateFile alone.
While setting the TLSVerifyClient option demand is it ...
0
votes
0
answers
15
views
Specific olcAccess does not work for an OU in LDAP
On my OpenLDAP server, I would like the accounts in my "ou=partners" OU to have "read" permissions to all objects in "ou=abos". Here is the tree of my DIT :
[ditTree][1]
...
1
vote
1
answer
79
views
NetBSD + openLDAP + SASL
I try to set up a connection to a openLDAP server running on NetBSD 10 via TLS and SASL. When I try ldapsreach -Y EXTERNAL
I get
ldapsearch: not compiled with SASL support
and
ldd /usr/bin/ldapsearch
...
0
votes
1
answer
72
views
Strange hash lengths in OpenLDAP
I recently went through all the hashes stored in an LDAP instance I have access to and noticed something strange that I can't explain.
Despite all the hashes being marked as SSHA (which should be ...
1
vote
1
answer
4k
views
Can't install new database in OpenLDAP 2.4 with BDB on Debian
I'm trying to install an openldap server (slapd) on a Debian EC2 instance. I have followed all the instructions I can find, and am using the recommended slapd-config approach to configuration. It all ...
0
votes
1
answer
812
views
ldap_add - Invalid Syntax - Additional Info: ObjectClass - Value #1 Invalid Peer Syntax
I have the following content in adam.ldif
dn: uid=adam,ou=users,dc=wesgibbs,dc=com
objectClass: top
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
cn: adam
uid: adam
...
0
votes
0
answers
269
views
How to delete olcAttributeTypes LDAP
Is there a way to delete olcAttributeTypes from my schema?
It's not a system attribute, I added it myself, now I need to delete it.
I'm using LAM (LDAP Account Manager) v5.6
The attribute is located ...
1
vote
0
answers
200
views
OpenLDAP gidNumber and group membership inconsistency
I encountered an interesting problem while examining a specific AD/OpenLDAP interop case. On the OpenLDAP server, there is a user1, whose gidNumber corresponds to a group1. There is another user2, ...
0
votes
0
answers
701
views
failed to bind to LDAP server ldap://<server IP>/: Can't contact LDAP server: Transport endpoint is not connected
Users are unable to login to network cluster.
var/log/messages =
failed to bind to LDAP server ldap://<ldap server hostname>: Can't contact LDAP server: Transport endpoint is not connected
no ...
0
votes
1
answer
237
views
Getting "ldap_add: Server is unwilling to perform (53) additional info: no global superior knowledge" when trying to add new objectClass to openLDAP
I have created new schema which looks like this
attributetype ( 2.25.3236588
NAME 'x-candidateNumber'
DESC 'Candidate number'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4....
1
vote
0
answers
749
views
How to (properly) force the use of SSL or STARTTLS in OpenLDAP?
I have successfully managed to configure my OpenLDAP (which is an Apple Open Directory variant, but that should not matter) to work with both, SSL (ldaps on port 636) as well as STARTTLS (on port 389)....
0
votes
0
answers
140
views
OpenLDAP meta backend with different directory structure
I am working on a project and we need to "combine" two completely different Active Directory (AD) servers to one. I have found that OpenLDAP might provide a solution by providing a reverse ...
0
votes
2
answers
227
views
Openldap LogLevel : Log timestamp in milliseconds
Does anyone know how to configure the Loglevel in Openldap to log milliseconds? The current loglevel 256 does log day and time (Jan 13 10:32:12). We have tried different levels none of them capable ...
0
votes
0
answers
63
views
Openldap meta backend empty binddn and bindpw after inactivity/operationserror succesful bind must be completed on the connection
meta backend is running in cn=config, OpenLDAP version is 2.4.44
I'm configuring an OpenLDAP meta backend to authenticate Active Directory users from two different domains. I can successfully log in a ...
0
votes
1
answer
1k
views
hard time enabling openldap meta backend
Right now I'm feeling stuck with enabling meta backend using openldap 2,4
this is the result of my slaptest
[root@localhost openldap]# slaptest -f slapd.conf -F slapd.d/
WARNING: No dynamic ...
0
votes
0
answers
277
views
how to get rid off raise at python3-ldap3
Using:
ubuntu22.04
python3-ldap3-2.8.1-1
Code:
conn = Connection(server, user=user, password=password, auto_bind=AUTO_BIND_TLS_BEFORE_BIND, raise_exceptions=False)
conn.start_tls()
if not ...
0
votes
0
answers
61
views
OPENLADAP Monitor running on ubuntu 20.4
I tried to configure the Account monitor with OpenLDAP on ubuntu 20.4.I've followed the steps
in fisrt time i check to enable monitoring then i creat account monitor with file user_monitor.ldif
...
3
votes
1
answer
3k
views
Removing/modifying LDAP objectclasses/attributes using olc
I'm having trouble using openldap's olc to modify a schema without shutting down the server. To test some things out, I made the following schema:
objectIdentifier tests orgUlyssisOID:4
...
0
votes
1
answer
995
views
Nsswitch - sudoers sss vs ldap what am I missing
I'm trying to configure nsswitch to use sudoers: files sss which is default for rhel9 system, however this does not work for me, but the following sudoers: files ldap does indeed work.
What am I ...
0
votes
1
answer
43
views
Does OpenLDAP olcAccess support quorum of users
For example, we have role with sensitive access or privileges. And have two users with less sensitive privileges' role.
We want to grant to this users permission to set more sensitive role to user, ...
1
vote
1
answer
546
views
How to disable inactive OpenLDAP accounts
is there a means to disable such OpenLDAP accounts that show no interaction for a given grace period. In particular, of a user has not logged in to her account since x days (no matter the means of ...
0
votes
1
answer
179
views
Do I have to reconfigure after restarting an LDAP service?
I'm using two LDAP servers in a mirror mode.(active-active hot standby, openldap 2.4)
As explained in an LDAP document, instead of using a config file, I configured dynamically with ldapadd and ...
0
votes
1
answer
645
views
Best practices to completely disable LDAP users' access to mixed services with mixed authentication methods?
Background
We use LDAP in our department to authenticate users to various services including web apps as well as Linux servers (via SSH). When a user leaves the department, we should disable their ...
1
vote
0
answers
45
views
OpenLDAP Child or Relay server configuration assistance
I am a really lost here and would appreciate some help.
My organization already maintains an OpenLDAP server which allows read-only access
Running this gives me an entire dump of all the users and ...
8
votes
2
answers
14k
views
how to configure open ldap to work on localhost
From the documentation:
Use your favorite editor to edit the
provided slapd.conf(5) example
(usually installed as
/usr/local/etc/openldap/slapd.conf) to
contain a BDB database definition of
...