Hot answers tagged

3

ldapwhoami is an LDAP client tool. It does not use the olcTLSCACertificateFile parameter. That is a server-side paramater for slapd. You need to specify somewhere, that the client tools understand, that you trust the CA. This can be done (as you have done) in the ldaprc file, in the global /etc/ldap/ldap.conf file, by being overly permissive in your CA ...


2

I don't think you'll be able to do this without changing client configs. However, after the client computers all set up, you'll be able to manage this from the LDAP server. One way to achieve this is: Write an access_ldap.conf file which contains this, and put it /etc/security: +:root:ALL -:ALL EXCEPT (the_group_that_has_access):ALL There is an ...


1

The error message seems rather clear. inetOrgPerson isn't defined in your server's schema. It won't be there by default, and it doesn't look like you added it. inetOrgPerson schema depends on cosine schema, which in turn depends on core schema. Core schema may be present by default. ldapadd <auth for cn=config> -f /etc/openldap/schema/core.ldif ...


1

I was having a similar issue. You have the fields mixed up LDAP filter: should be empty because there is some kind of issue between the Zimbra LDAP filter and Redmine's. Account: uid=zimbra,cn=admins,cn=zimbra Password: The password you entered for LDAP during installation Base DN: ou=people,dc=domain,dc=com (replace domain for your domain and com for ...


1

I'm confused, your groups use "memberuid: $username", which is RFC2307, so why dooes your config specify rfc2307bis and uniqueMember? I would propose to use rfc2307 (which is the default) and if that doesn't work, crank up the debugging and see what queries are made towards the LDAP server.


1

When you replace the default: ldap_schema = rfc2307 with ldap_schema = rfc2307bis in your sssd.conf file you need to follow the instructions from the SSSD FAQ: SSSD supports three LDAP schema types: RFC 2307, RFC 2307bis and IPA (the last being an extension of RFC 2307bis including memberOf backlinks). By default, SSSD will use the more common ...


1

Your OpenLDAP server doesn't appear to have TLS configured. Your /etc/ldap/slapd.d/cn=config.ldif should have something like the following: olcTLSCertificateKeyFile: /etc/ldap/ssl/ldap.key olcTLSCACertificateFile: /etc/ldap/ssl/ldap_ca.cert olcTLSCertificateFile: /etc/ldap/ssl/ldap.cert olcTLSCipherSuite: HIGH:!aNull:!MD5:@STRENGTH olcTLSProtocolMin: 3.1 ...



Only top voted, non community-wiki answers of a minimum length are eligible