Questions tagged [openldap]

OpenLDAP Software is a free, open source implementation of the Lightweight Directory Access Protocol (LDAP) developed by the OpenLDAP Project. LDAP is a platform-independent protocol for querying and modifying data using directory services running over TCP/IP.

Filter by
Sorted by
Tagged with
7 votes
2 answers
23k views

How do you set password-hash for OpenLDAP?

I have the following version on Ubuntu 12.04: OpenLDAP: slapd (Sep 19 2013 22:49:31) $ buildd@batsu:/build/buildd/openldap-2.4.28/debian/build/servers/slapd OpenLDAP now offers SSHA as the default ...
0 votes
0 answers
401 views

Cannot connect to LDAP server ERRNO=0

I have a php application (apache,redhat with selinux disabled) and I am struggling with ldap configuration. I am trying to connect to a ldap server and I am getting this error in apache logs: ...
0 votes
0 answers
2k views

Sorry i'm stuck with freeradius to LDAP

Ok Im a little stuck with FreeRadus. I think I have found the problem, I just don't understand why so If I try to auth over the wifi it looks like its not getting the password below is the debug of ...
0 votes
0 answers
54 views

OpenLDAP + GSSAPI/Kerberos SASL

I have OpenLDAP 2.5 configured with GSSAPI and Kerberos set up and working. By working I mean I can bind and search when I have a ticket. My question is can I do a bind when I don't have a ticket? Can ...
3 votes
2 answers
3k views

Rename base DN in OpenLDAP

I currently have an LDAP directory (OpenLDAP), which does authentication for a bunch of services running across a number of servers. Let's say the base DN is dc=oldcompany,dc=com. I'd now like to ...
0 votes
0 answers
294 views

How to synchronize OpenLDAP and Samba4?

I have a samba 4 domain with internal LDAP. Now the need arose to copy OpenLDAP users and passwords to this domain. This copy must be made synchronously every time there is a change in OpenLDAP. ...
0 votes
1 answer
379 views

shared mail address with postfix and dovecot

I'm trying to set up some shared mailboxes like contact or support. I have made it possible for me to share an IMAP folder between users in Dovecot by doing this in 15-mailboxes.conf namespace { ...
0 votes
0 answers
128 views

SSSD LDAP CONFIGURATION

I am trying to configure ldap on port 636 on a redhat server. Right now, when I try the following command : netstat -antup | grep -i 636 I get tcp 0 132 IP_ADDRESS_1:40670 XX.XX.XX.XX:...
1 vote
1 answer
146 views

OpenLDAP ppolicy working with passwd, but not ldappasswd

I've been working on this for about a week, and can't seem to figure out why this is happening. I've got passwd working, letting users change their own ldap password from a client machine, and it ...
1 vote
2 answers
783 views

Linux password via kerberos unable to reset

When I try to reset a ldap user password from client machine I am getting the following error $ passwd Changing password for user demo. Current Password: New password: Retype new password: passwd: ...
2 votes
1 answer
15k views

Why do I get "Server not found in Kerberos database" using testsaslauthd?

I'm trying to setup Kerberos auth over SASL using OpenLDAP. As I understand it, I need a host keytab in /etc/krb5.keytab from the KDC I'm using and then {SASL}user@realm in the given user's LDAP ...
0 votes
0 answers
142 views

Windows application 'LDAP Admin' fails to connect to OpenLDAP on port 636

I run an OpenLDAP server on (2.6.3_2) FreeBSD. I works fine with FreeBSD/Linux clients like PAM/NSS/NextCloud over LDAPS port 636.(With a Let's Encrypt certificate) I can't get it to work together ...
2 votes
1 answer
431 views

Possible to parse ldapsearch output?

I have an ldapsearch query to pull some data of an email system, I am trying to parse the data into something I can analyze in a table/flat file, and generate reports on the accounts. Sample of the ...
0 votes
1 answer
241 views

Apache 2.4 LDAP "password mismatch" but password is correct

I run apache2.4 on debian and LDAP-Auth tells me "password mismatch" but I am very sure I use correct passwords (tested multiple users). I also asked chat-gpt and it told me maybe my ...
7 votes
3 answers
4k views

LDAP change user pass on client

I am trying to allow ldap users to change their password on client machines. I have tried pam every which way I can think of /etc/ldap.conf & /etc/pam_ldap.conf, as well. At this point I'm stuck. ...
0 votes
0 answers
149 views

OpenLDAP client config, cannot log in to the server

I'm trying to set up OpenLDAP on a Ubuntu 22.04 to authenticate against a central server running Ubuntu Server 20.04, however, i have found some issues i cannot solve on my own. The server itself is ...
0 votes
0 answers
43 views

adding vlv(virtual list view) extension to openLDAP (LDAP) Server

Im currently working with LDAPRecord library in a Laravel project. I want to use a pagination function but it's required having virtual list view (vlv) extension to my ldap server , I dont quite know ...
0 votes
0 answers
43 views

Project specific LDAP authorization for SVN

I am using Apache 2.4 on Ubuntu 14.04 and SVN 1.8.8. I have installed SVN server and created a number of repositories (one per client). For each team working for each client, I added configurations ...
0 votes
0 answers
26 views

I've got an error while adding an olcOverlay

here is my ldif file : dn: olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config objectClass: olcSyncProvConfig olcOverlay: syncpro then I enter ldapadd -Y EXTERNAL -H ldapi:// -f overlay.ldif and here ...
0 votes
0 answers
106 views

Is it possible to add memberUid as bind DN

Can we use memberUid for bind dn string. Here is my sample ldif file dn: cn=posixgroup,dc=memtesting,dc=com objectClass: top objectClass: posixGroup gidNumber: 1001 cn: posixgroup memberUid: posixuser ...
0 votes
0 answers
164 views

Samba Domain with readonly Active Directory and OpenLDAP

I have a working Samba Windows Domain getting its users from an OpenLDAP database, but now I need to get these users from an Active Directory database. I have full access to the OpenLDAP database but ...
0 votes
1 answer
3k views

How does userPassword attribute work in LDAP?

I'm just learning about LDAP, and there's something I don't quite understand. When we create users in a directory, we define their password using the userPassword. When we use for example the {SSHA} ...
9 votes
4 answers
31k views

How to disable an LDAP account?

The LDAP uses the posixAccount schema and related attributes and I wonder if there's a standardized way to disable an account. Re-enabling the account should obviously re-enable the former password. ...
0 votes
1 answer
34 views

OpenLDAP + Moodle, member of groups

the teachers in my OpenLDAP are in cn=teachers,ou=groups,dc=school,dc=de the course creator context in my Moodle installation should then be the same if I am not mistaken. If I query ldap BINDUSER=&...
0 votes
1 answer
343 views

ldap_group_search_base is not working as intented

I've used the below-given sssd.conf file to authorize the users to a server. The issue is some users who are not listed under the DN: cn=authorized,ou=rona,ou=servers,ou=groups,dc=yolo,dc=com still ...
0 votes
1 answer
127 views

What are all the certificates mandatory to be provide while setting TLSVerifyClient option to demand

In my case, I had set TLSVerifyClient to demand. I couldn't be able to establish a connection While providing TLSCACertificateFile alone. While setting the TLSVerifyClient option demand is it ...
0 votes
0 answers
15 views

Specific olcAccess does not work for an OU in LDAP

On my OpenLDAP server, I would like the accounts in my "ou=partners" OU to have "read" permissions to all objects in "ou=abos". Here is the tree of my DIT : [ditTree][1] ...
1 vote
1 answer
79 views

NetBSD + openLDAP + SASL

I try to set up a connection to a openLDAP server running on NetBSD 10 via TLS and SASL. When I try ldapsreach -Y EXTERNAL I get ldapsearch: not compiled with SASL support and ldd /usr/bin/ldapsearch ...
0 votes
1 answer
72 views

Strange hash lengths in OpenLDAP

I recently went through all the hashes stored in an LDAP instance I have access to and noticed something strange that I can't explain. Despite all the hashes being marked as SSHA (which should be ...
1 vote
1 answer
4k views

Can't install new database in OpenLDAP 2.4 with BDB on Debian

I'm trying to install an openldap server (slapd) on a Debian EC2 instance. I have followed all the instructions I can find, and am using the recommended slapd-config approach to configuration. It all ...
0 votes
1 answer
812 views

ldap_add - Invalid Syntax - Additional Info: ObjectClass - Value #1 Invalid Peer Syntax

I have the following content in adam.ldif dn: uid=adam,ou=users,dc=wesgibbs,dc=com objectClass: top objectClass: account objectClass: posixAccount objectClass: shadowAccount cn: adam uid: adam ...
0 votes
0 answers
269 views

How to delete olcAttributeTypes LDAP

Is there a way to delete olcAttributeTypes from my schema? It's not a system attribute, I added it myself, now I need to delete it. I'm using LAM (LDAP Account Manager) v5.6 The attribute is located ...
1 vote
0 answers
200 views

OpenLDAP gidNumber and group membership inconsistency

I encountered an interesting problem while examining a specific AD/OpenLDAP interop case. On the OpenLDAP server, there is a user1, whose gidNumber corresponds to a group1. There is another user2, ...
0 votes
0 answers
701 views

failed to bind to LDAP server ldap://<server IP>/: Can't contact LDAP server: Transport endpoint is not connected

Users are unable to login to network cluster. var/log/messages = failed to bind to LDAP server ldap://<ldap server hostname>: Can't contact LDAP server: Transport endpoint is not connected no ...
0 votes
1 answer
237 views

Getting "ldap_add: Server is unwilling to perform (53) additional info: no global superior knowledge" when trying to add new objectClass to openLDAP

I have created new schema which looks like this attributetype ( 2.25.3236588 NAME 'x-candidateNumber' DESC 'Candidate number' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4....
1 vote
0 answers
749 views

How to (properly) force the use of SSL or STARTTLS in OpenLDAP?

I have successfully managed to configure my OpenLDAP (which is an Apple Open Directory variant, but that should not matter) to work with both, SSL (ldaps on port 636) as well as STARTTLS (on port 389)....
0 votes
0 answers
140 views

OpenLDAP meta backend with different directory structure

I am working on a project and we need to "combine" two completely different Active Directory (AD) servers to one. I have found that OpenLDAP might provide a solution by providing a reverse ...
0 votes
2 answers
227 views

Openldap LogLevel : Log timestamp in milliseconds

Does anyone know how to configure the Loglevel in Openldap to log milliseconds? The current loglevel 256 does log day and time (Jan 13 10:32:12). We have tried different levels none of them capable ...
0 votes
0 answers
63 views

Openldap meta backend empty binddn and bindpw after inactivity/operationserror succesful bind must be completed on the connection

meta backend is running in cn=config, OpenLDAP version is 2.4.44 I'm configuring an OpenLDAP meta backend to authenticate Active Directory users from two different domains. I can successfully log in a ...
0 votes
1 answer
1k views

hard time enabling openldap meta backend

Right now I'm feeling stuck with enabling meta backend using openldap 2,4 this is the result of my slaptest [root@localhost openldap]# slaptest -f slapd.conf -F slapd.d/ WARNING: No dynamic ...
0 votes
0 answers
277 views

how to get rid off raise at python3-ldap3

Using: ubuntu22.04 python3-ldap3-2.8.1-1 Code: conn = Connection(server, user=user, password=password, auto_bind=AUTO_BIND_TLS_BEFORE_BIND, raise_exceptions=False) conn.start_tls() if not ...
0 votes
0 answers
61 views

OPENLADAP Monitor running on ubuntu 20.4

I tried to configure the Account monitor with OpenLDAP on ubuntu 20.4.I've followed the steps in fisrt time i check to enable monitoring then i creat account monitor with file user_monitor.ldif ...
3 votes
1 answer
3k views

Removing/modifying LDAP objectclasses/attributes using olc

I'm having trouble using openldap's olc to modify a schema without shutting down the server. To test some things out, I made the following schema: objectIdentifier tests orgUlyssisOID:4 ...
0 votes
1 answer
995 views

Nsswitch - sudoers sss vs ldap what am I missing

I'm trying to configure nsswitch to use sudoers: files sss which is default for rhel9 system, however this does not work for me, but the following sudoers: files ldap does indeed work. What am I ...
0 votes
1 answer
43 views

Does OpenLDAP olcAccess support quorum of users

For example, we have role with sensitive access or privileges. And have two users with less sensitive privileges' role. We want to grant to this users permission to set more sensitive role to user, ...
1 vote
1 answer
546 views

How to disable inactive OpenLDAP accounts

is there a means to disable such OpenLDAP accounts that show no interaction for a given grace period. In particular, of a user has not logged in to her account since x days (no matter the means of ...
0 votes
1 answer
179 views

Do I have to reconfigure after restarting an LDAP service?

I'm using two LDAP servers in a mirror mode.(active-active hot standby, openldap 2.4) As explained in an LDAP document, instead of using a config file, I configured dynamically with ldapadd and ...
0 votes
1 answer
645 views

Best practices to completely disable LDAP users' access to mixed services with mixed authentication methods?

Background We use LDAP in our department to authenticate users to various services including web apps as well as Linux servers (via SSH).  When a user leaves the department, we should disable their ...
1 vote
0 answers
45 views

OpenLDAP Child or Relay server configuration assistance

I am a really lost here and would appreciate some help. My organization already maintains an OpenLDAP server which allows read-only access Running this gives me an entire dump of all the users and ...
8 votes
2 answers
14k views

how to configure open ldap to work on localhost

From the documentation: Use your favorite editor to edit the provided slapd.conf(5) example (usually installed as /usr/local/etc/openldap/slapd.conf) to contain a BDB database definition of ...

1
2
3 4 5
30