New answers tagged

2

ldapwhoami is an LDAP client tool. It does not use the olcTLSCACertificateFile parameter. That is a server-side paramater for slapd. You need to specify somewhere, that the client tools understand, that you trust the CA. This can be done (as you have done) in the ldaprc file, in the global /etc/ldap/ldap.conf file, by being overly permissive in your CA ...


1

The error message seems rather clear. inetOrgPerson isn't defined in your server's schema. It won't be there by default, and it doesn't look like you added it. inetOrgPerson schema depends on cosine schema, which in turn depends on core schema. Core schema may be present by default. ldapadd <auth for cn=config> -f /etc/openldap/schema/core.ldif ...


0

In my desperation I removed the first few Lines wich referenced only dc=com. Turns out, that this Lines not really necessary and the Import is now working fine. I've no Idea where this Lines coming from.


0

Use login <username> to get a login prompt.


1

You need to increase the logging level in your OpenLDAP instance. I believe the one you're looking for is 256. http://www.openldap.org/doc/admin24/slapdconf2.html#cn=config For OLC, create a file with the following contents: dn: cn=config changetype: modify replace: olcLogLevel olcLogLevel: stats Then: ldapmodify -H ldapi:// -Y EXTERNAL -f ...


0

I'm assuming rfc2307(nis) schema, the default for Ubuntu 14.04, which is defined just below. objectclass ( 1.3.6.1.1.1.2.2 NAME 'posixGroup' DESC 'Abstraction of a group of accounts' SUP top STRUCTURAL MUST ( cn $ gidNumber ) MAY ( userPassword $ memberUid $ description ) ) The ldif for you ldapadd should like something ...


3

Verify that the olcTLS*File directives in cn=config point to real files. olcTLSCACertificateFile: /etc/ssl/certs/ca-bundle.crt olcTLSCertificateFile: /etc/pki/tls/certs/server.example.com.crt olcTLSCertificateKeyFile: /etc/pki/tls/private/server.example.com.key Check your logs. By default CentOS doesn't log for slapd. slapd defaults to facilty LOCAL4 ...


0

If your LDAP server is configured with the mozillaAbPersonAlpha schema, you can tack the AUX objectClass: mozillaAbPersonAlpha onto your entries (provided they have cn) and then use the mozillaHomeCountryName attribute.


0

It was an interesting issue. I removed the line breaks and it worked like a charm. :)


1

ADS does this somewhat but probably not to the full extent you're talking about. That said, it is open source so if you have the development time behind this it might not be that infeasible. https://www.ldap-account-manager.org/lamcms/ LAM isn't that far off from what you're looking for, however, I would note that in my search for something similar I ...


1

If you're just starting out, I recommend switching to using groupOfNames rather than groupOfUniqueNames. Most systems that interact with OpenLDAP for group membership expect groupOfNames by default, including OpenLDAP itself. While they can generally be modified to use groupOfUniqueNames/uniqueMember (e.g. sssd-ldap ldap_group_member or your own use in ...


1

The problem was that group.exact not work with groupOfUniqueNames. I solved it by changing this rule: by group.exact=cn=people-admins,ou=groups,dc=example,dc=com write to this rule: by group/groupOfUniqueNames/uniqueMember=cn=people-admins,ou=groups,dc=example,dc=com write


0

For example if you have such group: dn: cn=people-admins,ou=groups,dc=example,dc=com objectClass: groupOfUniqueNames cn: admins of people group cn: people-admins uniqueMember: uid=test1,ou=people,dc=example,dc=com uniqueMember: uid=test2,ou=people,dc=example,dc=com you can print all of it's member with: ldapsearch -x -LLL -H ldap://127.0.0.1:3000/ -b ...


1

Thanks everyone, I just made a change in /var/lib/pgsql/9.4/data/pg_hba.conf with : local all all ldap ldapserver=ldap.server ldapport=389 ldaptls=0 ldapprefix="uid=" ldapsuffix=",ou=People,dc=domain,dc=com" And the authentication works!


1

Read the Friendly Manual: http://www.postgresql.org/docs/9.5/static/auth-methods.html You probably want to use https://github.com/larskanis/pg-ldap-sync to sync your LDAP users and groups to PostgreSQL


0

The first thing is to make sure your ldapsearch is correct. This will determine if the problem is with the query or your LDAP configuration. Change the ldap host in your ldapsearch command to be -H ldap://my_corporate_ad:389 to query AD directly. If that returns results, then your search is valid. If not, get that working before reattempting against ...


0

You need to find out what backend databases you have configured: ldapsearch -H ldapi:// -Y EXTERNAL -b "cn=config" -LLL -Q "olcDatabase=*" dn The one you're looking for could be BDB, HDB or MDB.


2

Just in case someone else runs into this (as I did): You need to load the module(s) for different backends before you reference them. In slapd.conf style: modulepath /usr/lib/ldap moduleload back_meta.la In OLC cn=config LDIF style: dn: cn=module{1},cn=config objectClass: olcModuleList cn: module{1} olcModulePath: /usr/lib/ldap olcModuleLoad: back_meta ...


0

Can you say what your use case is? both openldap and AD are x500 directories and can be connected over ldap/ldaps, are you migrating to Openldap or just trying to get directory authentication for an application or directory syncing to an application working? here's the schema for openldap http://www.openldap.org/doc/admin22/schema.html and here for AD ...


2

The term Service Principal Name (SPN), as capitalized, is currently specific to Microsoft Windows, but the general concept of service or server principal names and conventions defined as part of the Kerberos Protocol.


5

They're a Kerberos thing. MIT Kerberos has them. I'd have to google other implementations to see if they have them, too.



Top 50 recent answers are included