1

Recently I configured my openldap server to work with certificates. But in process of doing that messed up unsecure port also. Now, authentication is not working for any user at all. I am using python-ldap client for creating connection.

import ldap
import os
l = ldap.initialize('ldap://<ip>:1389')
l.set_option(ldap.OPT_REFERRALS, 0)
l.set_option(ldap.OPT_PROTOCOL_VERSION, 3)
l.simple_bind_s('uid=myuser,ou=People,ou=myorg,dc=my,dc=com', 'mypasspw')

I am getting ldap.INVALID_CREDENTIALS: {'desc': 'Invalid credentials'} for the request for all users.

I started ldap server in debug mode and here are the logs.

6021594b connection_read(12): checking for input on id=1000
ber_get_next
ldap_read: want=8, got=8
  0000:  30 46 02 01 01 60 41 02                            0F...`A.
ldap_read: want=64, got=64
  0000:  01 03 04 32 75 69 64 3d  73 62 61 74 72 61 2c 6f   ...2uid=myuser,o
  0010:  75 3d 50 65 6f 70 6c 65  2c 6f 75 3d 62 6c 75 65   u=People,ou=myo
  0020:  70 6c 61 6e 65 74 2c 64  63 3d 63 69 65 6e 61 2c   rg,dc=my,
  0030:  64 63 3d 63 6f 6d 80 08  73 62 61 74 72 61 70 77   dc=com..mypasspw
ber_get_next: tag 0x30 len 70 contents:
ber_dump: buf=0x7f5f1c2fe390 ptr=0x7f5f1c2fe390 end=0x7f5f1c2fe3d6 len=70
  0000:  02 01 01 60 41 02 01 03  04 32 75 69 64 3d 73 62   ...`A....2uid=my
  0010:  61 74 72 61 2c 6f 75 3d  50 65 6f 70 6c 65 2c 6f   user,ou=People,o
  0020:  75 3d 62 6c 75 65 70 6c  61 6e 65 74 2c 64 63 3d   u=myorg,dc=
  0030:  63 69 65 6e 61 2c 64 63  3d 63 6f 6d 80 08 73 62   my,dc=com..my
  0040:  61 74 72 61 70 77                                  passpw
6021594b op tag 0x60, time 1612798283
ber_get_next
ldap_read: want=8 error=Resource temporarily unavailable
6021594b conn=1000 op=0 do_bind
ber_scanf fmt ({imt) ber:
ber_dump: buf=0x7f5f1c2fe390 ptr=0x7f5f1c2fe393 end=0x7f5f1c2fe3d6 len=67
  0000:  60 41 02 01 03 04 32 75  69 64 3d 73 62 61 74 72   `A....2uid=myuse
6021594b daemon: activity on 1 descriptor
6021594b daemon: activity on:
6021594b daemon: epoll: listen=7 active_threads=0 tvp=zero
6021594b daemon: epoll: listen=8 active_threads=0 tvp=zero
  0010:  61 2c 6f 75 3d 50 65 6f  70 6c 65 2c 6f 75 3d 62   a,ou=People,ou=
  0020:  6c 75 65 70 6c 61 6e 65  74 2c 64 63 3d 63 69 65   myorg,dc=my
  0030:  6e 61 2c 64 63 3d 63 6f  6d 80 08 73 62 61 74 72   ,dc=com..mypas
  0040:  61 70 77                                           spw
ber_scanf fmt (m}) ber:
ber_dump: buf=0x7f5f1c2fe390 ptr=0x7f5f1c2fe3cc end=0x7f5f1c2fe3d6 len=10
  0000:  00 08 73 62 61 74 72 61  70 77                     ..mypasspw
6021594b >>> dnPrettyNormal: <uid=myuser,ou=People,ou=myorg,dc=my,dc=com>
=> ldap_bv2dn(uid=myuser,ou=People,ou=myorg,dc=my,dc=com,0)
<= ldap_bv2dn(uid=myuser,ou=People,ou=myorg,dc=my,dc=com)=0
=> ldap_dn2bv(272)
<= ldap_dn2bv(uid=myuser,ou=People,ou=myorg,dc=my,dc=com)=0
=> ldap_dn2bv(272)
<= ldap_dn2bv(uid=myuser,ou=people,ou=myorg,dc=my,dc=com)=0
6021594b <<< dnPrettyNormal: <uid=myuser,ou=People,ou=myorg,dc=my,dc=com>, <uid=myuser,ou=people,ou=myorg,dc=my,dc=com>
6021594b do_bind: version=3 dn="uid=myuser,ou=People,ou=myorg,dc=my,dc=com" method=128
6021594b ==> mdb_bind: dn: uid=myuser,ou=People,ou=myorg,dc=my,dc=com
6021594b mdb_dn2entry("uid=myuser,ou=people,ou=myorg,dc=my,dc=com")
6021594b => mdb_dn2id("uid=myuser,ou=people,ou=myorg,dc=my,dc=com")
6021594b <= mdb_dn2id: got id=0xb
6021594b => mdb_entry_decode:
6021594b <= mdb_entry_decode
6021594b => access_allowed: result not in cache (userPassword)
6021594b => access_allowed: auth access to "uid=myuser,ou=People,ou=myorg,dc=my,dc=com" "userPassword" requested
6021594b => dn: [1]
6021594b => dn: [2] cn=subschema
6021594b => acl_get: [3] attr userPassword
6021594b => acl_mask: access to entry "uid=myuser,ou=People,ou=myorg,dc=my,dc=com", attr "userPassword" requested
6021594b => acl_mask: to value by "", (=0)
6021594b <= check a_dn_pat: cn=webadm,dc=webadm
6021594b <= acl_mask: no more <who> clauses, returning =0 (stop)
6021594b => slap_access_allowed: auth access denied by =0
6021594b => access_allowed: no more rules
6021594b send_ldap_result: conn=1000 op=0 p=3
6021594b send_ldap_result: err=49 matched="" text=""
6021594b send_ldap_response: msgid=1 tag=97 err=49
ber_flush2: 14 bytes to sd 12
  0000:  30 0c 02 01 01 61 07 0a  01 31 04 00 04 00         0....a...1....
ldap_write: want=14, written=14
  0000:  30 0c 02 01 01 61 07 0a  01 31 04 00 04 00         0....a...1....
^C6021594f daemon: shutdown requested and initiated.
6021594f daemon: closing 7
6021594f daemon: closing 8
6021594f connection_closing: readying conn=1000 sd=12 for close
6021594f connection_close: conn=1000 sd=12
6021594f daemon: removing 12
6021594f slapd shutdown: waiting for 0 operations/tasks to finish
6021594f slapd shutdown: initiated
6021594f slapd destroy: freeing system resources.
6021594f syncinfo_free: rid=011
6021594f slapd stopped.

What I am suspecting is that something is not allowing access to userPassword but I don't know what. I didn't touch olcAccess configs which are:

olcAccess: to dn.base="" by * read
olcAccess: to dn.base="cn=Subschema" by * read
olcAccess: to * by dn="cn=webadm,dc=webADM" write
olcAccess: to * by self write by users read by anonymous auth

Where I can look further? Kind of stuck now.

1

First, looks like you're sending your password over the wire in clear text. Don't do that. Get some kind of TLS going, either starttls or LDAPS .

Also, dn.base="" and dn.base="cn=Subschema" are generally controlled by a different backend than the one you'll be applying ACLs to, so you might want to check if you even need those lines where you're putting them.

To your actual question: OpenLDAP ACLs are a first match wins situation. Also, all lines end in an implied by * none. So, olcAccess: to * by dn="cn=webadm,dc=webADM" write is effectively olcAccess: to * by dn="cn=webadm,dc=webADM" write by * none, which means that your following line never gets parse because you've already had a match. (Flow control can change things, but you probably don't need it yet.)

Standard:

olcAccess: to *
  by dn="cn=webadm,dc=webADM" write
  by self write
  by users read
  by anonymous auth

Flow Control:

olcAccess: to *
  by group.exact="cn=ldap-admins,ou=groups,dc=example,dc=com" write
  by group.exact="cn=ldap-servers,ou=groups,dc=example,dc=com" read
  by dn.exact="cn=webadm,ou=users,dc=example,dc=com" write
  by * break
olcAccess: to attr=userPassword
  by self write
  by * auth
olcAccess: to attrs=member
  by set="this/owner & this/owner/member* & user" write
  by users read
olcAccess: to *
  by self write
  by users read
  by anonymous auth

(Yes, you could make your webadm part of ldap-admins, but really there's so much I don't know about what you're doing or the scope of your system. I also threw in the best common use of sets as an example in case that's handy at some point.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.