Tag Info

New answers tagged

0

The config will vary depending on your server, but you essentially need to: a) configure sssd.conf b) run authconfig with arguments that suit your setup There are plenty of examples online but I found these man pages invaluable to do almost exactly what you are attempting (except with ca-signed certificates): * sssd.conf * sssd * sssd-ldap * (and authconfig ...


2

Yes, you can use the Meta backend for OpenLDAP to create a unified view of two directories. This article by user @larsks details the configuration.


0

The best way to keep Samba and LDAP passwords in sync is to deploy the smbk5pwd overlay (despite the name, it can be configured without Kerberos), which updates Samba password hashes in response to LDAP Password Modify operations, and configure Samba with ldap password sync = only. Note that this depends on your clients properly issuing Password Modify ...


0

After much digging, I found a hard-coded query limit in the 'lib/ds_ldap.php' file. I modified the following line from: $size_limit = 500; to $size_limit = 1000; To match my OpenLDAP Servers' Query sizelimit. This may not have been the right place to do it, but in the end this is working now.


2

This is a bit tricky because of point 3. The LDAP in IPA is available just not anonymously, so you need to either kerberize the applications making queries OR give them a generic account to bind with. Most applications I've seen support this. From the samba wiki: " Note that you cannot point Samba4 to your existing OpenLDAP server and expect things to ...


3

It looks as though the problem is that you have used the OID 1.3.6.1.1.1.1.2 to define two "different" attributes (really the same attribute twice), once in cn=config,cn=schema,cn={3}nis, and once in cn=config,cn=schema,cn={2}nis. OIDs referencing attributes must be unique. I don't know what stage you're at in the process of migrating, here, but it looks ...


0

cn=config support for back-meta was added in OpenLDAP 2.4.33. If you run an older version you'll have to use slapd.conf. The changelog also mentions a variety of other fixes to back-meta in subsequent releases. If you're not prepared to build the current OpenLDAP release from source, the LTB-Project provides up-to-date RPM packages.


1

I am working for Univention, the manufacturer of UCS, which you mentioned, and yes, we have a solution for migrating the passwords to Samba 4 with UCS. You can achieve this in two steps: First install UCS with Samba 3 and migrate the sambaNTPassword hashes from your OpenLDAP to the new UCS-OpenLDAP (ldapsearch and ldapmodify seems to be the most comfortable ...


0

When you run getent passwd, do you see your LDAP users listed? If not, make sure libnss-ldapd is installed, and run dpkg-reconfigure libnss-ldapd and make sure at least the passwd database is enabled (and you'll probably want group and shadow as well, sooner or later). If getent passwd mentions your LDAP users but you can't auth as one, run pam-auth-update ...


0

Without access to the running config, you'll have to stop slapd and edit the configuration offline. stop slapd: service slapd stop dump the config database to a text file: slapcat -F /etc/ldap/slapd.d -b cn=config -l config.ldif move the existing config database out of the way: mv /etc/ldap/slapd.d{,.old} make a new, empty config database: mkdir ...


0

Thanks rtandy. I really didn't want to set it on ldapi but was not aware of the fact it is going to be affected too. The problem is the EXTERNAL was the only way I could modify the cn=config so since I've lost that access and haven't created another cn=config admin as suggested, is there any other way I can solve this?


0

Looking into the code: on the server side, in servers/slapd/daemon.c, the authid for EXTERNAL is set up using the uid and gid shortly after the incoming connection is accept()ed. Later on, in servers/slapd/connection.c, if TLS is active, it overwrites that with the name from the client's certificate. Since you aren't providing a client certificate, at this ...


0

The message Program version 5.1 doesn't match environment version 6.1 says that your slapd is linked against Berkley DB 5.1, but the database it's trying to open was last used with Berkeley DB 6.1. BDB 6.1 has never been included in Ubuntu. Did you build your own openldap at some point, linked against BDB 6.1, and now you're trying to revert to the ...


0

The openldap library used by your slapd differs significantly for which it was intended to be used. Check if some type of library compatibility/configurability problems exists with some apt command (apt-get update, apt-get -f install, dpkg --configure -a). If there is nothing to be fixed, the best solution were to recompile your openldap, although it means ...



Top 50 recent answers are included