Tag Info

New answers tagged

0

First, you need a parent object for your user, second, you can't use the dot in the dcObject, dc (domain component) takes only alphanumerics and hyphen (see RFC4519) dn: dc=corp,dc=f7 objectClass: dcObject objectClass: organization dc: corp o: corp (And you can't use dcObject as the only object class because it's defined as auxilliary, so you need a ...


0

I'm using the following configuration for PAM passwd support: password requisite pam_cracklib.so try_first_pass retry=3 password sufficient pam_ldap.so try_first_pass use_authtok password sufficient pam_unix.so sha512 shadow nullok use_authtok try_first_pass password required pam_deny.so Also remember that ACLs should ...


0

If you have enough time for a little infrastructure overhaul, I'd heartily recommend the following: stop using the outdated distribution packages, start using packages from the LDAP Toolbox project, switch the database format to MDB: the database is rock-stable, faster and uses half the memory the BDB-based databases used (there's wealth of new features ...


2

With LDAP referrals. What is that? When a client connects to a LDAP server that does not contain the needed information, the server will tell the client to ask from some other server. OpenLDAP fully supports this on the server-side and the admin guide has a section called Constructing a Distributed Directory Service.


0

I've experienced this exact same problem before; in order to resolve this, I needed to remove use_authtok - this allowed us to then change user's passwords using passwd ... I'm not sure what repercussions this would have if your authentication chain requires tokens, but this should do the trick if you only auth via LDAP


1

Either you have problems with the permissions (you did not show us your slapd.conf), or you have made some modifications to indexing and have not yet run slapindex.


1

Escape the ldap uri like this: ldapsearch -H ldap:///dc%3Dexample%2Cdc%3Dcom


0

Your base DN should be the name of the domain that your zimbra server is responsible for, but in distinguishedName syntax. That is, if your domain were example.com, the Base DN would be dc=example,dc=com. If your domain is sub.example.com, then your base DN would be dc=sub,dc=example,dc=com. Your domain name may not be the same as your server name, depending ...


1

Performance isn't usually an issue with OpenLDAP, it can run on really small hardware, but I would strongly recommend running a replicated database with at least two instances. Being lightweight as it is, running it along other services also shouldn't be a problem, but of course it depends a lot on what the other services are and how active they are. A ...


1

It looks like you're attempting to use slapd.conf and slurpd. slapd.conf is depriciated and you ought to be using slapd.d. However, your main problem is that you're trying to use slurpd, which was completely removed in OpenLDAP 2.4. You should instead setup a syncrepl provider on your master server, and a syncrepl consumer on your "slave" (replica) server. ...


2

Yes you can. Just search filter and attrs you want to replicate at your syncrepl configuration syncrepl rid=1 provider=ldap://provider.myorg.com:389 type=refreshOnly interval=01:00:00:00 searchbase="ou=sales,o=employees,o=myorg,cn=com" filter="(objectClass=posixAccount)" scope=base attrs="cn,sn,userPassword" schemachecking=off ...


1

2 backends approach As far as your different branches are in different backends, you can have a backend configured to be a consumer of a remote master, and another backend configured to be a standard backend when read and write are performed directly. You define ou=sales,o=employees,o=myorg,cn=com as the DN of one backend with the settings for the ...


1

If you are referring to is it possible to have different data schema for an consumer , then I think that you could just replicate things separately for one forest (or create another one ) then connect the consumer to that forest or AD site . Unfortunately I used openldap only briefly. I hope this helps .



Top 50 recent answers are included