Questions tagged [openldap]
OpenLDAP Software is a free, open source implementation of the Lightweight Directory Access Protocol (LDAP) developed by the OpenLDAP Project. LDAP is a platform-independent protocol for querying and modifying data using directory services running over TCP/IP.
472
questions with no upvoted or accepted answers
1
vote
0
answers
237
views
ldapadd entries dynamicaly with operational attributes
In a multi-master openldap 2.4.X architecture, i want to dynamically add entries with operational attributes, like entryUUID, creatorsName, createTimestamp, modifiersName, entryCSN, modifyTimestamp,...
- 11
1
vote
1
answer
1k
views
OpenLDAP being very slow
I've inherited an OpenLDAP installation which suddenly seems to be extremely slow to respond to queries, breaking many client applications. I've checked the basics; server has plenty of memory free, ...
- 11
1
vote
0
answers
107
views
Can't modify olcAccess values because LDAP has passthrough auth
I'm an intern working at a company that uses an OpenLDAP server on Linux in conjunction with Windows server 2016. I'm trying to modify an olcAccess value in olcDatabase={0}config, to deny/grant users ...
- 11
1
vote
0
answers
159
views
openLDAP modify error 80 configuring TLS
when I try to modify LDAP with the following code:
dn: cn=config
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/pki/tls/certs/cacert.pem
-
replace: olcTLSCertificateFile
...
- 11
1
vote
0
answers
98
views
Postfix isn't delivering Mails only to one specific user
Our Mailsystem includes a Postfix, openLDAP and Cyrus. All run smoothly till last week. When I created a new Mailbox for a user who before had only an Alias with an forwarding external Mailadress. To ...
1
vote
0
answers
643
views
OpenLDAP with LDAPS and N-Way Multi-master replication
We have the following setup:
Two OpenLDAP servers - openldap1, openldap2
They are to be set up as N-Way multi-master
Certificates are all set up correctly with alternate names etc and trust each ...
- 11
1
vote
0
answers
784
views
How to test ldap authentication from specific ldap master on Solaris client
I have OpenDS LDAP running on Linux, which is two node master, sea-ldap.xx.yy.ss and phx-ldap.xx.yy.ss. There are Solaris clients, which gets authentication from these servers depend on client it ...
- 21
1
vote
2
answers
6k
views
ldapsearch show member entries without CN
I am using ldapsearch on a debian 9 Linux box to query a MS Active Directory. I would like to query/find all users in my group "mygroupname".
The command
ldapsearch -o ldif-wrap=no -xWLLL -D "...
- 191
1
vote
1
answer
489
views
Unable to find Plugin
I'm trying to execute this command,
kdb5_ldap_util -D cn=ldapadm,dc=c4ilietest,dc=com stashsrvpw -f /etc/krb5.d/stash.keyfile cn=kerberos,dc=c4ilietest,dc=com
I get this error
kdb5_ldap_util: ...
1
vote
1
answer
3k
views
How do I authenticate against ldap.google.com?
I've set up SSSD and openldap to successfully query ldaps://ldap.google.com. I can use ldapsearch to perform queries and can interact with the directory using both sssctl and getent. Unfortunately all ...
- 121
1
vote
0
answers
614
views
Issues compiling ldap - Berkeley DB major version in db.h... none
I'm trying to compile openldap on ubuntu, but my /configure get stuck on this:
checking for db.h... yes
checking for Berkeley DB major version in db.h... none
configure: error: Unknown Berkeley DB ...
- 145
1
vote
0
answers
2k
views
OpenLDAP Proxy to AD - userPrincipalName as BindDN
I've setup OpenLDAP as AD proxy according to:
https://wiki.samba.org/index.php/OpenLDAP_as_proxy_to_AD
Everything's working fine for clients using standard bindDN of full dn: attribute (e.g. cn=jdoe,...
- 13
1
vote
0
answers
1k
views
ldap pass though authentication
We have a scenario where the local ldap will actually receive all authentication requests and then pass the authentication to SASLauthd module when password is stored as {SASL}username. Thus, the ...
- 11
1
vote
0
answers
270
views
How to create a single Authentication point with multiple LDAP servers?
I'm currently into a process of creating a central service system from where users can connect to VMs.
My goal with this is to have a single point of authentication for all possible users.
The issue ...
- 46
1
vote
1
answer
557
views
OpenLDAP ACL permissions for cn=config
I am trying to add ssl certificates in olcTLSCertificateFile.
dn: cn=config
changetype: modify
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/certs/file.crt
dn: cn=config
...
- 111
1
vote
1
answer
1k
views
Editing a value in a ldap dn
What is the correct syntax to edit a value in an LDAP dn? As of now I was trying the following:
serveradmin@magic:~$ ldapmodify -x -W -D cn=admin,dc=example,dc=com <<EOF
> dn: uid=foo,ou=...
- 143
1
vote
0
answers
2k
views
slapd won't start (due to missing certificate?)
I'm trying to setup a OpenLDAP server on a CentOS 7.5. Following this guide seemed to work very well until something went wrong (LDAP-password wasn't accepted any longer) due to a server crash. I ...
- 45
1
vote
0
answers
139
views
Ubuntu Server openLDAP + Windows Server AD LDS?
Is possible to have a Ubuntu server with openLDAP + Samba and a Windows Server with AD LDS, taking the DDBB from the Ubuntu?
If it's possible could you point me where to find information about this?
...
1
vote
0
answers
295
views
OpenLdap 2.4 ACL
Can you help me with rights for group OpenLdap 2.4?
There is my slapd.conf
# Allow LDAPv2 client connections. This is NOT the default.
allow bind_v2
#Basic rights for authentication
access to ...
- 11
1
vote
1
answer
2k
views
OpenLDAP schema files to mimic ActiveDirectory (for dev/test environments)
I support a development environment for an ETL application that interacts with various services, including OpenLDAP. I've setup Docker-Compose with a container for each of the services and datastores ...
- 111
1
vote
2
answers
1k
views
openldap group membership ACL
When I run a search eg.
ldapsearch -h XX.XX.XX.XX -b 'dc=mycompany,dc=com' -D 'uid=lama,ou=people,mycompany,dc=com' -w YYYY
I would like to see my groups membership and not to be allowed to see ...
- 11
1
vote
0
answers
4k
views
SSH and LDAP auth with groups
I have SSH/LDAP working just fine with public keys and all on an AWS Linux instance. I'm using nss-pam-ldapd and pam_ldap.
But when I set /etc/pam_ldap.conf as follows to restrict login to a LDAP ...
- 596
1
vote
0
answers
638
views
OpenLDAP slapo-unique fails with UID
I have several branches in my LDAP directory that all use a UID attribute as part of the DN. Recently, I've been tasked with ensuring uniqueness for the UID attribute across the board, so that UID ...
- 834
1
vote
1
answer
1k
views
OpenLDAP backend failover
I'm trying to configure OpenLDAP server as a proxy to Active Directory. And it works fine, but I cannot make openldap server to failover automatically without restarting slapd service. I have the ...
- 341
1
vote
1
answer
261
views
Ldapsearch suddenly stopped authenticating against Active Directory
We have a Linux Web application authenticating against Active Directory using ldapsearch. Everything worked well for a year, until it suddenly stopped about a week ago. Any idea about a possible cause?...
- 109
1
vote
0
answers
269
views
Ubuntu/OpenLDAP/Autofs : local user instead of LDAP user
I mount home directories for my LDAP users trhough autofs. It works like a charm except with one computer. On LDAP logs, I have :
ldap rpc.mountd[975]: authenticated mount request from 192.168.0.XX:...
- 111
1
vote
1
answer
3k
views
Kerberos KDC won't start : invalid credentials
I'm having troubles my kerberos server (LDAP back-end).
I wanted to restart the KDC service and it failed. It has been working fine for several weeks.
Since I had just tweaked LDAP ACLs, I tried the ...
- 153
1
vote
0
answers
267
views
Is it ok to change the EQUALITY on an attributetype in openldap
I'd like to be able to do substring searches against a particular attribute which is defined in the schema as:
attributetype ( 1.3.6.1.1.1.1.25 NAME 'automountInformation'
DESC 'Information ...
1
vote
0
answers
340
views
What is the DN value to add Windows Active Directory attributes / ObjectClasses to OpenLDAP
I am newbie in LDAP and trying to add extra attributes & ObjectClass to OpenLDAP (2.4.40) schema, so it could compatible with the java code that is working with Active Directory
I did quite a lot ...
- 111
1
vote
0
answers
116
views
How do I return relevant error messages to an end-user from ppm/cracklib when embedded in an OpenLDAP password policy?
I'm deploying a new OpenLDAP server with a password policy that uses ppm as the pwdcheckmodule with cracklib enabled. When a user authenticates, the only response they get back is from OpenLDAP "(-19)...
- 11
1
vote
0
answers
321
views
Why does syncrepl do nothing when ldapsearch works fine?
I'm trying to set up LDAP multi-master replication using OpenLDAP on Red Hat 7 (with very little preexisting knowledge of LDAP).
As a first stage, I've got syncprov installed:
# ldif format
dn: cn=...
- 181
1
vote
1
answer
1k
views
Need help creating LDAP Server that syncs users from 3 separate AD Controllers
Hopefully I can get some help here as I have really been beating my head against the ol' keyboard over here.
So, here's the situation.
We recently migrated end users from an onsite Exchange server ...
- 11
1
vote
0
answers
1k
views
OpenLDAP as Proxy
First, please note that I have experience with Linux, but for some reason, the OpenLDAP proxy authentication has me very confused and so I'm hoping someone can simply answer my questions to help me ...
1
vote
0
answers
3k
views
How to enable PwdAccountLockedTime in OpenLDAP
I wanna set PwdAccountLockedTime attribute for 000001010000Z value and deactivate user account. I know how this works, but I have problems with enabling pwdAccountLockedTime attribute. At first, I ...
- 31
1
vote
0
answers
372
views
CTDB failover and samba/openldap authentication fails
I'm trying to setup a HA storage with gluster. Share it with Samba so I can access it on Windows clients. CTDB for HA connection to the clients and OpenLDAP for user authentication. It's a virtual ...
- 11
1
vote
0
answers
2k
views
Why does slapd say "bdb_equality_candidates: (objectClass) not indexed" when the indices actually exist?
I have slapd 2.4.31-1+nmu2ubuntu8.3 installed on Ubuntu 14.04 and running as master to a secondary sync. It works well for all things LDAP, but I notice these errors in /var/log/debug every so often:
...
- 3,784
1
vote
0
answers
3k
views
How to import data from CSV file to LDAP directory and keeping them up to date
lets say I have CSV file in format
userID;login;firstName;lastName;validUntil
Is here any easy way how to import data from this CSV to LDAP directory and how keeping LDAP up to date based on CSV (...
- 31
1
vote
0
answers
54
views
Is it possible to make the Kerberos Server use LDAP for just the crendential validation, and use a local Keberos Principal DB for everything else?
We are working with a LDAP setup that we can not change or extend. We need to add a Kerberos Server to the environment.
Is it possible to make the Kerberos Server use LDAP for just the crendential ...
- 438
1
vote
1
answer
885
views
Yum Update Now SLAPD Will Not Start
I'll preface with saying I have used *nix, regularly, for >20 years; however, I have minimal experiene with openldap. I had openldap (slapd) running on a server that has been working for years. ...
- 357
1
vote
0
answers
827
views
ldap_bind: Invalid credentials (49) when configuring Pass-Trough authentication with SASL in OpenLDAP with AD
I'm using ubuntu 14.04 and OpenLDAP-2.4.40. I have synchronized Active Directory users in OpenLDAP using LSC utility. Now I want to do the authentications on the OpenLDAP part and will use the AD ...
- 11
1
vote
1
answer
13k
views
pam_unix(sshd:auth): authentication failure
I have openldap and server Debian 8. I want to set ldap authentication. I have installed ldap-utils libnss-ldapd libpam-ldapd and set these.
# getent passwd user.name
user.name:x:1537:3174:User Name:/...
- 13
1
vote
0
answers
5k
views
How to force full resync on slave
I have an openldap master and 2 slaves, synced using syncrepl. It worked fine until recently but after a long shutdown of one slave some removed entries are still present on it (they are absent from ...
- 121
1
vote
0
answers
511
views
activating ldaps support, getting implementation specific error
System: Ubuntu 16.04 running OpenLDAP 2.4.42
I'm following the tutorial to configure OpenLDAP for TLS. The LDIF file that I ended up creating is as follows:
dn: cn=config
changetype: modify
replace: ...
- 111
1
vote
0
answers
3k
views
Cannot sync OpenLDAP directory with Azure AD
I am trying to connect and sync OpenLDAP with Microsoft Azure AD using Generic LDAP connector as described in the URL below:
https://azure.microsoft.com/en-in/documentation/articles/active-directory-...
1
vote
0
answers
218
views
Openldap configuration on RHEL 6.6 client
We have a shell script which runs perl program to connect to LDAP server and make entries.
This is the only script which uses ldap. This server is hosting all batch related files and run batch jobs ...
- 21
1
vote
1
answer
218
views
Forcing OpenLDAP connections to use STARTTLS not allowing user to login
I have a basic OpenLDAP server running on Ubuntu 16.04LTS which authenticates users perfectly fine but I really wanted to make it more secure so I decided to use STARTTLS and How To Encrypt OpenLDAP ...
- 153
1
vote
0
answers
307
views
rfc2307bis LDAP schema: ipNetmaskNumber lookup for an ipHost object
I'm using Openldap for IAM, and consider using it also as a configuration management backend.
The rfc2307bis schema has an ipHost class, which allows for ipHostNumber attribute, but not for the ...
- 928
1
vote
0
answers
174
views
Import Windows 2008R2 .p12 certificate into Samba4 SDC
In our firm we need to migrate our existing infrastructure from Windows 2008R2 to Samba 4. To do this we already managed to add the Samba machine as a secondary domain controller. The next step would ...
- 11
1
vote
0
answers
2k
views
`ldap_bind: Invalid credentials` during setup of LDAP server on Centos 7 VM
I am setting up an LDAP server on a centos 7 VM, by following the guide here.
Everything is fine until the last part of step 4, after I create the base domain. I have not changed ldap.conf or similar ...
- 169
1
vote
1
answer
175
views
openldap alternative to modifying core schema syntax
I have an application that stores contacts in OpenLDAP. It uses the c attribute to store a string describing a country name. The syntax of c only allows a two-letter country code, but the application ...
- 1,796