2

I setup the openldap, all look fine but i cant setup authentication,

#getent shadow | grep user                         
user:*:::::::
tuser:*:::::::
tuser2:*:::::::

#getent passwd | grep user
git:!:999:999:git daemon user:/:/bin/bash
user:x:10000:2000:Test User:/home/user/:/bin/zsh
tuser:x:10000:2000:Test User:/home/user/:/bin/zsh
tuser2:x:10002:2000:Test User:/home/tuser2/:/bin/zsh

from root i can login as a one of these users

#su - tuser2
su: warning: cannot change directory to /home/tuser2/: No such file or directory
10:24 tuser2@juliet:/root

i cant login via ssh also passwd is not working

#ldapwhoami -h 192.168.10.156 -D "uid=user,ou=People,dc=xcl,dc=ie"
ldap_bind: Server is unwilling to perform (53)
    additional info: unauthenticated bind (DN with no password) disallowed
10:30 root@juliet:~
#ldapwhoami -h 192.168.10.156 -D "uid=user,ou=People,dc=xcl,dc=ie" -W
Enter LDAP Password: 
ldap_bind: Invalid credentials (49)

typed password by me is correct

/etc/openldap/slapd.conf access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to * by self write by users read by anonymous read

access to *
  by dn="uid=root,ou=Roles,dc=xcl,dc=ie" write
  by users read
  by anonymous auth
access to attrs=userPassword,gecos,description,loginShell
  by self write

access to attrs="userPassword"
  by dn="uid=root,ou=Roles,dc=xcl,dc=ie" write
  by anonymous auth
  by self write
  by * none
access to *
  by dn="uid=root,ou=Roles,dc=xcl,dc=ie" write
  by dn="uid=achmiel,ou=People,dc=xcl,dc=ie" write
  by * search

access to attrs=userPassword
  by self =w
  by anonymous auth
access to *
  by self write
  by users read

database        hdb
suffix          "dc=xcl,dc=ie"
rootdn          "cn=root,dc=xcl,dc=ie"
rootpw          "{SSHA}AM14+..."

there are some parts of that conf file /etc/openldap/ldap.conf looks :

BASE dc=xcl,dc=ie
URI ldap://192.168.10.156/
TLS_REQCERT  allow
TIMELIMIT    2

so my question is what i am missing that ldap not allow me login by using password ?

0

ok i solve the problem by removing those ACL's queries

access to *
  by dn="uid=root,ou=Roles,dc=xcl,dc=ie" write
  by users read
  by anonymous auth
access to attrs=userPassword,gecos,description,loginShell
  by self write

access to attrs="userPassword"
  by dn="uid=root,ou=Roles,dc=xcl,dc=ie" write
  by anonymous auth
  by self write
  by * none
access to *
  by dn="uid=root,ou=Roles,dc=xcl,dc=ie" write
  by dn="uid=achmiel,ou=People,dc=xcl,dc=ie" write
  by * search

i did more changes but anyway those changes doesnt fix that problem until i remove mentioned ACL's

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.