Tag Info

New answers tagged

0

I think what you're looking for is a way to set up referrals from your test LDAP server to your main domain. The specific way to configure that depend on what LDAP server you're using. Take a look at this to have an idea about what referrals are http://www.zytrax.com/books/ldap/ch7/referrals.html Edit: you're talking about AD. Then read this ...


3

I guess the primary error is that you used the same olcDbDirectory for both DITs. Try to use different directories to store the data (you will likely have to wipe the current data and start over).


0

That is not an LDAP servers job. It doesn't even have any information about the activity of the user - all you usually use the LDAP server for is to look up user information and possibly authenticate a user. This assumes your are not writing an LDAP client like Apache Directory Studio.


0

The bug that causes this specific issue has been in the libpam-ldap source for a long time, but it's effect was only seen after a separate bug was fixed in the gnutls library that libldap-2.4-2 uses. The specifics can be found in an enlightening email from Ryan Tandy in the Debian bug page for this issue. ( Debian Bug 790488 ). I had already known that ...


0

Are you sure you want just the ApacheDS? Are you trying this on Windows or Unix-family OS? If the latter is your case, why don't you try with Samba 4.2 instead? It offers an AD-compatible directory right after initial (single-command) provisioning. You can even use Windows RSAT to manage some of the features (ie. users, sites, GPO, ...) - pretty much as with ...


0

I'm betting it's because your libraries weren't compiled with ldap support. From your build logs: cd /«PKGBUILDDIR»/obj-x86_64-linux-gnu/misc && /usr/bin/x86_64-linux-gnu-gcc -DENABLE_LDAP_AUTH=1 This is unfortunately the same as the unofficially recommended ppa.


0

I found that the file permissions were too restrictive in the cert file pointed to by "LDAPTrustedGlobalCert" However, with "LDAPVerifyServerCert Off", I thought reading of that root cert would be bypassed, and I wouldn't need to worry about permissions? No matter, it's fixed now


0

Stop using the directory's RootDN as the dn for the local system's root account. The directory's rootdn is not subject to access controls. Use (create if necessary) a dn entry with the appropriate permissions with your LDAP server to modify passwords correctly.


0

This one worked for me: Get a copy of your data on the old server by running the following command: ldapsearch -z max -LLL -Wx -D "cn=admin,dc=your,dc=domain" -b "dc=your,dc=base" > save.ldif Move the file to the new server and import it by running: ldapmodify -c -Wx -D "cn=admin,dc=your,dc=domain" -a -f save.ldif


0

IF you are using 'ldaps://ip address.......' in your ldap url try 'ldaps://full hostname.......'


1

You likely have a security policy set to not cache accounts and one that disables the local accounts. If its already been decided that caching accounts is risky, then you have exactly the behavior expected. The only solution is to enable caching for some period of time.


1

After lots and lots of searching, I finally found a solution by myself in the deep internet. In case someone has the same problem in the future, I'm gonna post the answer here. Actually, it's pretty simple. On the new server, you need to install LDAP and GOsa normally. To transfer the LDAP-database, there only two commands you need to execute. In many ...


0

If your system is using PAM as the underlying authentication provider according to the documentation the options you specified with authconfig will modify the required PAM files(similar to using pam-config) which should be located in /etc/pam.d(at least on openSUSE, where there is no auth). It also appears that it will modify /etc/nsswitch.conf. You ...


0

I couldn't figure out a way to do this with the pre-existing PAM modules, so I wrote one. It only supports simple authentication at the moment. Be sure to include a uri and binddn template parameter like so: auth sufficient pam_ldapdb.so uri=ldap://example.com binddn=uid=%s,dc=example,dc=com %s will be replaced with the user connecting. This ...


0

https://technet.microsoft.com/en-us/library/Cc755809(v=WS.10).aspx#w2k3tr_adsrh_how_lhjt Scroll down to LDAP Referrals "When a requested object exists in the directory but is not present on the contacted domain controller, resolution of the object name depends on information that is stored on that domain controller about how the directory is partitioned. ...


0

PAM use for user authentication https://wiki.debian.org/LDAP/PAM When user logs into different servers, they have different homes? Yes. How is LDAP acls talk to client acls? If I have www:www on some of the client machines, how do I allow certain users to access them? You need to read about ACL (setfacl, getfacl) Also you need to read about ...


2

Your LDAP database only holds metadata about your users. The path name of the user's home directory will be in there (because that's metadata), but the home directory itself will not (because that's data). Shared/non-shared home directories is a problem entirely orthogonal from where user metadata is stored. You can have shared home directories (via NFS, AFS ...


0

Just guessing: Are these local home directories or are the home directories on NFS or SAMBA shares? If you have so many users and machines, why not use a centrally managed system like privacyIDEA? Addition: Looking at the code ...


0

I came to the same problem today and I believe that the solution is simply to remove the double quotes from the secure_path option: dn: cn=defaults,ou=SUDOers,dc=example.dc=com objectClass: top objectClass: sudoRole cn: defaults description: Default sudoOption's go here sudoOrder: 1 sudoOption: env_reset sudoOption: ...


0

The stock check_ldap does a search when it connects. See check_ldap --help or the online docs, specifically the -a option. By default, it searches "(objectclass=*)", but you can change this.


2

Nagios uses similar return codes to the shell, if you write a script and it exits with the appropriate error code & string (OK, WARN etc) you are set - just abstract the actual commands with a shell script, add that as a plugin and you're done. See the Nagios Plugins guidelines for more information.


0

I have run into issues with pam_ldap and sssd running on the same system. If you want to stop using sssd with pam you should make sure that you run: pam-config -a --ldap which will add LDAP to pam and then run: pam-config -d --sss which will delete the sssd setting in pam related config files in /etc/pam.d/ To make sure that sss is not used you may ...


3

In order to satisfy this one specific scenario, all you really have to do is open port 389 on whatever firewall separates the domain controller from the internet. Everything will be clear text over the wire. Kerberos will not be used. You may also desire some sort of externally resolvable DNS name (though not strictly technically required.) You may also have ...


2

Thanks masegaloeh! Perhaps you have mismatch in userdb { args }' and user_attrs ` in dovecot-ldap.conf – masegaloeh 22 hours ago old one: userdb { args = uid=106 gid=114 home=/var/mail/%u allow_all_users=yes driver = static } new: userdb { args = uid=106 gid=114 home=/var/mail/%n allow_all_users=yes driver = ...


0

It's unfortunate that Spring Security won't allow you to set an appropriate search base. Depending on your environment you may be able to get away with setting a default search base to the frontend config. $ ldapmodify -f <<EOF dn: olcDatabase={-1}frontend,cn=config add: olcDefaultSearchBase olcDefaultSearchBase: dc=example,dc=com


1

An empty base is a special case for retrieving information about the OpenLDAP server that can host several databases (or "namingContexts" or "bases"). E.g.: ldapsearch -x -LLL -b '' -s base 'objectClass=*' + There really should be some way of specifying the base to use for searches


0

I faced same problem like you, when i read your post i didn't have a clue to solve that, but now i solve my problem. Here's my solution's : Install nss-pam-ldapd if you didn't install it previously : [root@www ~]# yum -y install nss-pam-ldapd Disable selinux and reboot : [root@ldap ~]# vi /etc/selinux/config Change this line : selinux=disabled ...


0

The ordering of the ACL lines matters. olcaccess: {0}to dn.subtree="ou=subtree,dc=domain,dc=tld" by self write by dn="cn=subadmin,dc=domain,dc=tld" write by users read by anonymous none olcaccess: {1}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=mpbteam,dc=de" write by * none olcaccess: ...


2

Your .ldif file is formatted incorrectly. After you have gotten the password you need to put it in a correctly formatted .ldif: dn: <DN TO EDIT> changetype: modify userPassword: <NEW PASSWORD> If you have the file like this then look for whitespace, LDAP really doesn't like it. If not then, edit the script you have put above to include the ...


0

You didn't really say what your LDAP server was or how a user in your LDAP directory looks like, but I'll try answer as best as I can. At the moment, SSSD serves only POSIX accounts. That means the the user object on the server side either has to have name and numerical IDs or the numerical IDs must be inferred from Windows SID. The actual objectClass ...


1

inetOrgPerson depends on both core and cosine. It looks like you already have core. Add in cosine, then inetorgperson. Cosine should be at /etc/openldap/schema/cosine.ldif.


1

I would suggest to deny interactive/RDP logon to the DCs with GPO: "Computer Settings/Security Settings/Local Policies/User Rights Assignments/Deny Logon Locally" I've seen such problems with custom/corporate software and some Linux boxes. In these cases "Logon Workstations" should include the DC(s) in the list of allowed workstations. I suppose it's ...


0

I know nothing about file net, but your error message says you provided wrong credential (wrong user or pwd) - "LDAP err 49, data 52e". Check your password, and make sure you are provide user identity in correct form.


1

Even deleting the base entry will not remove a naming context. You'll have to remove it from your configuration.



Top 50 recent answers are included