Questions tagged [openldap]
OpenLDAP Software is a free, open source implementation of the Lightweight Directory Access Protocol (LDAP) developed by the OpenLDAP Project. LDAP is a platform-independent protocol for querying and modifying data using directory services running over TCP/IP.
89
questions
17
votes
2
answers
37k
views
Configure OpenLDAP with TLS=required
Nowadays, OpenLDAP needs to be configured with ldapmodify cn=config, as describe here. But nowhere I can find how you configure it to only accept TLS traffic. I just confirmed that our server accepts ...
20
votes
2
answers
38k
views
How do I configure Reverse Group Membership Maintenance on an openldap server? (memberOf)
I am currently working on integrating LDAP authentication into a system and I would like to restrict access based on LDAP group. The only way to do this is via a search filter and therefore I believe ...
10
votes
3
answers
20k
views
Disallow global anonymous bind with cn=config
With slapd.conf you could globally disable anonymous binding and require authentication with the following static directives:
disallow bind_anon
require authc
How can I achieve the same global ...
35
votes
2
answers
90k
views
How do I configure LDAP on Centos 6 for user authentication in the most secure and correct way?
During the last couple of days I have been using a lot of F-words, while browsing Internet for good documentation about how to setup an LDAP-server. So far I have found none, but plenty that are less ...
15
votes
2
answers
26k
views
Basic openldap setup using slapd.d configuration
I'm trying to set up a test openldap server, having not worked with openldap before. I'm using the standard openldap-servers package on a redhat based machine (using Oracle Linux). I've installed the ...
16
votes
2
answers
42k
views
LDAP: backup with slapcat vs ldapsearch
Used: openldap-servers-2.4.23-34.el6_5.1.x86_64
Task: create script for crontab to create scheduled database full backup.
1) slapcat - create file in in the default format, Berkeley DB.
2) slapcat ...
5
votes
2
answers
20k
views
VsFTPd - LDAP - PAM
I am trying to configure a VsFTPd server to authenticate agains an LDAP server. It may be easy, but since it is the first time that I am using both LDAP and PAM, I have some difficulties. VsFTPd runs ...
5
votes
2
answers
8k
views
dn-based linux groups from ldap
Is there any way to use one of LDAP's DN-based groups for linux groups instead of using the uid-based posixGroup objectclass?
More broadly, is there any way I can avoid having one set of groups for ...
1
vote
1
answer
3k
views
nagios - Web interface: authentication through kerberos OK, what about authorization on cgi.cfg?
I have successfully installed nagios, and it provides authentication through apache2 which contacts a kerberos authentication server to authenticate users.
Now, users are authenticated, but they don'...
12
votes
9
answers
17k
views
OpenLDAP TLS Authentification
I am trying to implement TLS as per https://help.ubuntu.com/lts/serverguide/openldap-server.html
When I try to modify cn=config database with this ldif file:
dn: cn=config
add: ...
11
votes
4
answers
44k
views
ldap_modify: Other (e.g., implementation specific) error (80), <olcAccess> handler exited with 1
When modifying the Open-LDAP configuration using:
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to *
by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=...
10
votes
1
answer
18k
views
OpenLdap TLS authentication setup
I am trying to setup openldap on ubuntu 12.04 by following this guide
https://help.ubuntu.com/12.04/serverguide/openldap-server.html
When I tried to enable TLS on the server by creating a self signed ...
8
votes
10
answers
23k
views
Using Lets Encrypt certificates with openLDAP
I've been running an openLDAP server for several months now and we use it to authenticate for a number of applications. A previous staff member set up the server and it doesn't seem to be a standard ...
7
votes
5
answers
82k
views
How to set ulimits in Solaris 10
I normally use pam_limits.so and /etc/security/limits.conf to set ulimits on file size, CPU time, etc. for the regular users logging in to my server running Ubuntu. What is the best way of doing ...
7
votes
2
answers
23k
views
How do you set password-hash for OpenLDAP?
I have the following version on Ubuntu 12.04:
OpenLDAP: slapd (Sep 19 2013 22:49:31) $
buildd@batsu:/build/buildd/openldap-2.4.28/debian/build/servers/slapd
OpenLDAP now offers SSHA as the default ...
6
votes
1
answer
35k
views
How can Samba be configured to use LDAP for authentication only?
I'm looking to set up a new Samba file share that uses LDAP for back-end authentication. The LDAP server is already set up, and the machine the Samba server will be on is already set up to allow SSH ...
4
votes
2
answers
12k
views
Is there any bad thing happens if I change /etc/ldap/slapd.d/cn=config.ldif manually?
Since 2.3, OpenLDAP uses a configuration engine called slapd-config. They said that use it make all LDAP configuration can be changed on fly.
This is the header of /etc/ldap/slapd.d/cn=config.ldif:
#...
3
votes
3
answers
10k
views
How to set Maximum Password Expiry in OpenLDAP Linux
I am trying to find how to change some password policy settings in OpenLDAP (on a system-wide level, not on a per user level) such that all LDAP account users (i.e., existing and new users) have their ...
2
votes
1
answer
4k
views
LDAP Login fails, but su to ldap users works
I have a new ldap setup and I am trying to login, either directory to the machine or remotely over SSH.
When I try to actually login, my authentication fails.
If I login with a local user, (root), ...
0
votes
1
answer
3k
views
LDAP dying for unknown reasons
We're using LDAP as a backend user database for our drupal sites (drupal reads from/and writes to it). LDAP has been running fine for weeks but for some reason it justs stopped running today. I was ...
0
votes
1
answer
2k
views
How to setup SASL Proxy Authorization with an OpenLDAP server on Debian
For Kerberos Authentication together with SASL/GSSAPI Authorization on client devices I need Proxy Authorization on an OpenLDAP server running on Raspberry Pi with Debian/Raspbian Buster. I tried to ...
16
votes
5
answers
41k
views
Setting up RADIUS + LDAP for WPA2 on Ubuntu
I'm setting up a wireless network for ~150 users. In short, I'm looking for a guide to set RADIUS server to authenticate WPA2 against a LDAP. On Ubuntu.
I got a working LDAP, but as it is not in ...
15
votes
4
answers
56k
views
Why does this ldapadd command quit with an "Invalid syntax" error?
I'm very new to openldap but extremely well versed in the linux/unix environment. I'm trying to setup my very first test openldap environment using the guide here. I've also read most of the admin ...
14
votes
2
answers
47k
views
"no global superior knowledge" while adding a country
I must add an organizationalunit like this into a freshly installed OpenLDAP (on Ubuntu 12.04) :
dn: ou=MYREGION, ou=MYAPP, ou=GROUPS, o=myorganization, c=fr
ou: MYREGION
objectClass: top
objectClass:...
14
votes
3
answers
97k
views
ldap_modify: Insufficient access (50)
I am running an OpenLDAP 2.4 server that uses the SSL service for communication. It works for lookups.
I am trying to add mirror mode replication.
So this is the command that I'm executing:
...
12
votes
5
answers
12k
views
Small, simple LDAP server as an alternative to OpenLDAP [closed]
I have taken a look at the installation and configuration instructions for the newer OpenLDAP releases and decided that it's too much work to set up for my small userbase. Basically, I only use LDAP ...
12
votes
3
answers
33k
views
How do I get openldap on Centos 6 to write anything to it's log files
I don't get any information in my log file for openldap on my Centos 6 server. This is how i configured it. SELinux is disabled at the moment.
First created a folder where I'd like to store the log ...
10
votes
3
answers
21k
views
"wrong attributetype" when using ldapadd
When attempting to load the following configuration
dn: olcDatabase={1}hdb,cn=config
changetype: modify
add: olcMirrorMode
olcMirrorMode: TRUE
I get the following error:
root@box:~# ldapadd -Y ...
10
votes
5
answers
38k
views
ldap_add: Constraint violation (19)
I'm having issues importing users with ldapadd and ldif files. The error I'm getting is:
ldap_add: Constraint violation (19)
additional info: structuralObjectClass: no user modification allowed
The ...
9
votes
4
answers
31k
views
How to disable an LDAP account?
The LDAP uses the posixAccount schema and related attributes and I wonder if there's a standardized way to disable an account. Re-enabling the account should obviously re-enable the former password.
...
9
votes
6
answers
16k
views
No Root DSE returned from OpenLDAP
I'm trying to set up an OpenLDAP server on ubuntu 9.10, which uses slapd version 2.4.18.
After initializing and populating a new hdb database, everything seems OK, but I can not get the server to ...
9
votes
1
answer
46k
views
ldap export and import
Is it possible to export all the data inside openldap for example using ldapsearch or some other tool to a (ldif?) file and then import everything on another server and put this in a script that would ...
8
votes
4
answers
49k
views
How to add new attribute to an existing LDAP user objects
I want to add mail attribute to the existing ldap users. I think, its possible with using ldapmodify but not sure how. I have done that using phpldapadmin web GUI manually, but I have like more than ...
8
votes
2
answers
36k
views
ldap_add error (80) <olcModuleLoad> handler exited with 1
I'm trying to follow this tutorial to setup a basic LDAD server (OpenLDAP) for cleint authentication, but I am stuck on the step where I add the back-end configuration.
I've created my backend.ldif ...
8
votes
2
answers
14k
views
how to configure open ldap to work on localhost
From the documentation:
Use your favorite editor to edit the
provided slapd.conf(5) example
(usually installed as
/usr/local/etc/openldap/slapd.conf) to
contain a BDB database definition of
...
7
votes
1
answer
34k
views
How to add a new attribute to an existing LDAP objectclass?
I created a custom LDAP objectClass, but forgot a couple attributes before I added it to my OpenLDAP server. I followed the instructions on this Ubuntu doc page: https://help.ubuntu.com/12.04/...
6
votes
2
answers
6k
views
Multiple LDAP servers with mod_authn_alias: failover not working when the first LDAP is down?
I've been trying to setup redundant LDAP servers with Apache 2.2.3.
/etc/httpd/conf.d/authn_alias.conf
<AuthnProviderAlias ldap master>
AuthLDAPURL ldap://192.168.5.148:389/dc=domain,dc=...
6
votes
4
answers
12k
views
Caching OpenLDAP credentials for offline use on laptops
Our clients (Ubuntu 14.04) can login with there LDAP login.
As soon as they have no network they cannot login with LDAP.
Is there a way to cache those passwords and usernames,
so that the laptops ...
6
votes
3
answers
8k
views
Linux console is unusable when LDAP server is down
When our OpenLDAP server lost power the CentOS machines' console became nearly unusable.
We were trying to login with a local account, but each command would take minutes to return. Even simple ...
5
votes
1
answer
9k
views
OpenLDAP ACL to allow users to change their password
What ACL should be added slapd.conf to allow users to change their password. We are now having the default ACL allowing only rootdn the rights to modify while allowing reading by everyone including ...
5
votes
2
answers
16k
views
OpenLDAP/SSSD Automatically Add User to Local Group
I've got a host of servers running various flavors of Linux all setup as OpenLDAP clients via SSSD. I added an LDAP group (sysadmins). I also added a sysadmins group on all of my servers. The members ...
5
votes
4
answers
12k
views
Can't use EXTERNAL authentication after enabling TLS in ldap-2.4
I used the following LDIF file to activate the TLS support for the LDAP server:
dn: cn=config
changetype: modify
add: olcTLSCipherSuite
olcTLSCipherSuite: NORMAL
-
add: olcTLSCRLCheck
olcTLSCRLCheck:...
5
votes
3
answers
24k
views
openLDAP ldap_modify: Server is unwilling to perform (53) when trying to delete custom schema
I have created this custom and very basic schema:
objectclass ( 2.25.2.2.1
NAME 'myObjectClass'
DESC 'myObjectClass objectclass'
STRUCTURAL
MUST ( cn )
)
I have added it without ...
5
votes
3
answers
15k
views
Ubuntu OpenLDAP: TLS init def ctx failed: -1
I had a working OpenLDAP but broke it while trying to configure SSL using the instructions here: https://help.ubuntu.com/10.04/serverguide/C/openldap-server.html. Now I'm getting the following error ...
4
votes
2
answers
19k
views
what is the simple Command to check password expiry time of an openldap user account
I am running openldap 2.3.43.el5 on RHEL 5.3 I am trying to find a simple command that will tell you when the password for an ldap user will expire, any help would be greatly appreciated.This would ...
4
votes
1
answer
17k
views
ldap_modify: Insufficient access (50) when changing password
I'm trying to modify the LDAP admin password on a fresh OpenLDAP install on CentOS 6.7 (similar to RHEL 6.7).
I created a file called change_ldap_password.ldif:
# Hash your password:
# slappasswd -h ...
4
votes
2
answers
3k
views
Keep AD Group Synced in OpenLDAP with POSIX Account Augmentation
What's the most obvious way of achieving the following: The site has an working AD infrastructure and certain parts of the infrastructure are tightly coupled GNU/Linux machines where people from the ...
4
votes
3
answers
13k
views
Persuading openldap to work with SSL on Ubuntu with cn=config
I simply cannot get this (TLS connection to openldap) to work and would appreciate some assistance.
I have a working openldap server on ubuntu 10.04 LTS, it is configured to use cn=config and most of ...
4
votes
1
answer
10k
views
OpenLDAP cannot add new schema
I'm trying to add new schema to my OpenLDAP server. The version of slapd is 2.4.23. I'm using Debian 6.
If I understood it well, slapd 2.4+ uses OLC configuration with (cn=config) by default for this ...
4
votes
1
answer
7k
views
Configure Freeradius to check a connecting user against multiple LDAP groups
I'm setting up a Cisco ASA as a client vpn server.
The appliance is relying on freeradius to authenticate the users. Freeradius has in turn been configured to query OpenLDAP.
The modules/ldap file ...