New answers tagged

0

I found the answer in the nslcd.conf. By adding the option ssl_canonocalize no this will stop it doing a dns reverse lookup and use the hostname


1

I have found the problem DAEMONOPTS=--user saslauth ===> DAEMONOPTS="--user saslauth" also need to make sure /var/run/saslauthd is accessible


0

I have the same error but the resolution above did not worked for me. I check the permissions and the validity of my cerficate, they are correct. That LDAP server was working normally for 2 years until this morning. I did not do any recent updates on that server. Last change, was to remove a lot of user in the LDAP but that was last week. Thanks in ...


0

I'm quite new to LDAP too, but I was able to do this, so I report the operations I've done, hoping they could be useful. I've found this information in a mailing list reply. I needed to work as root user. First use the command slapcat -n0 to show the LDAP configuration. You should see something like this: dn: olcDatabase={1}hdb,cn=config objectClass: ...


2

With nslcd -d I saw that the address was already taken by the host system. I fixed it by mounting the socket when executing docker run with -v /var/run/nslcd/socket:/var/run/nslcd/socket


0

try using this ACL in your olcDatabase={2}bdb.ldif file olcAccess: {0}to attrs=userPassword by self write by dn.base="cn=admin,dc=domain,dc=com" write by anonymous auth by * none Using the dn.base allow him to write the password. Some suggest to create a user that his sole role is to do such a thing, but i found using the dn.base usually works well


0

In the environments I'm working there are at least two LDAP servers operated, to prevent the problem(s) you're currently thinking about. So, if possible, set up a second LDAP server, preferably on a different physical host than the first one. Additionally, you could check if it's worth to implement the name service cache daemon (nscd), which is a daemon ...


0

Here is an example LDIF file to add the objectClass posixAccount to an existing entry uid=testuser,ou=people,dc=example,dc=com of e.g. objectClass inetOrgPerson: dn: uid=testuser,ou=people,dc=example,dc=com changetype: modify add: objectClass objectClass: posixAccount - add: homeDirectory homeDirectory: /home/testuser - add: uidNumber uidNumber: 1000 - add: ...


0

This would include both servers on the client to look at if one is not available: authconfig --ldapserver=simple-provicder.example.com,simple-replicator.example.com --update I had the full ldap://simple-relicator.example.com which was the mistake, now I can switch off the master and it sees the replicator.


0

Your credentials are likely wrong, unless {SSHA}UJzXEfBudfu5U6IGzFlea0 TjKUvxBtc/ is litterally the plaintext password for cn=Manager,dc=example,dc=com. Note: You should really use TLS. Don't replicate using olcRootDn. Make a global read-only dn instead. The provider will never push. Syncrepl is pull based. (refreshAndPersist is like IMAP idle.) You ...


2

For similar issues on CentOS 7.2 & OpenLDAP 2.4.40-9, you need to modify /etc/sysconfig/slapd and add ldaps:///. It would look like: SLAPD_URLS="ldapi:/// ldap:/// ldaps:///" Then restart slapd by: service slapd restart Thanks


0

So it turns out that the error message did not relate to the error in my case. I just had to set the default realm and then everything worked. To be clear to anyone else running into this error in the future: Make sure that you have default_realm defined in either krb5.conf or kdc.conf, or by DNS if your site uses that (though its still a good idea to have ...


0

It seems to me that your kadmin tool cannot find its admin server. The DNS-message you get is most likely because kadmin trys to find its admin server via dns service record, which is not used at the moment _kerberos-adm._tcp This should list port 749 on your master KDC. Support for it is not complete at this time, but it will eventually be used by the ...


0

Shared libraries don't typically produce their own debug output by default - the programs that link them are supposed to take care of that, because they may use various ways to communicate to the user: the console, some sort of X output, syslog, ... Did you try calling ldap_set_option(..., LDAP_OPT_DEBUG_LEVEL, LDAP_DEBUG_TRACE) from the program you link to ...



Top 50 recent answers are included