Questions tagged [ldap]
Lightweight Directory Access Protocol (LDAP) for reading and editing directories over an IP network
2,750
questions
1
vote
0
answers
45
views
How to configure group based LDAP access to Mercurial
I currently have LDAP authentication configured for Mercurial using the following Apache configuration:
<Location /hg>
AuthBasicProvider ldap
AuthType basic
AuthName "...
0
votes
0
answers
138
views
VPC connection between LDAP server onsite and LDAP client in Amazon
I currently have a VPC connection between LDAP server onsite and LDAP client in Amazon. However, after some time the connection starts to fail. I can notice that, since this appears for my user (even ...
1
vote
1
answer
768
views
Can SSSD authenticate via LDAP with anonymous binding either forbidden in ACLs and with 'olcRequires: authc' enforced?
I manage a LAN with a list of users accessing their NFS-shared homes while being auhtenticated via NIS/YP (CentOS/Fedora-based clients and servers).
I'm in the painful process of migrating out of NIS/...
2
votes
0
answers
258
views
Debugging Active Directory Login with MongoDB
I am trying to log into MongoDB using an active directory username. We're using Percona for MongoDB but I believe this really should be pretty similar to regular MongoDB 5.x authentication.
We've ...
0
votes
1
answer
865
views
Why does my 389-ds configuration work over LDAP but not LDAPS?
Sorry if this has been asked before, but when I searched for similar issues, I got results like these (that make no sense to me).
I've been trying to set up 389-ds using Red Hat's Directory Server 11 ...
0
votes
1
answer
607
views
Apache - Active Directory LDAP authorization
I'm running Apache 2.4 on Fedora 34.
I've configured user authorization based on Active Directory usernames and passwords with "ldap_module" and "authnz_ldap_module" and this entry ...
1
vote
1
answer
950
views
Postfix LDAP aliases - user unknown
I have server POSTFIX + DOVECOT with LDAP (ActiveDirectory) authorization.
/etc/postfix/ldap_virtual_mailbox_maps.cf
query_filter = (&(objectClass=person)(mail=%s))
result_filter = %s
...
0
votes
1
answer
3k
views
Can't bind Macs to Active Directory, it's not time synchronization, what else could be wrong?
Mac computers are unable to bind to our Windows Active Directory server. The error is the unhelpful Node name wasn't found (2000). Windows and Samba clients have no problem. All the systems on our LAN ...
0
votes
1
answer
576
views
Connect to remote LDAP server via Guacamole
Ubuntu 20.04
Guacamole 1.3.0
guacamole-auth-ldap-1.3.0
/etc/guacamole/guacamole.properties:
Ldap-hostname: x.x.x.x
Ldap-port: 389
ldap-user-base-dn: CN=serv,OU=Invis,DC=invis,DC=com
...
1
vote
0
answers
138
views
ejabberd: ldap_filter in LDAP Active Directory
TL;DR: How to setup ejabberd to only allow some Active Directory group members?
Hello,
After having successfully set up an ejabberd service plugged in to our AD, I'd like to narrow the allowed users ...
0
votes
0
answers
143
views
ldap connection with switch HP 5700 flexFabric
Can I restrict ssh login access to my HP Switch 5700, 5800 series using active directory groups?
ldap is working fine when the search-base-dn is using an OrganisationUnit.
search-base-dn OU=...
0
votes
1
answer
184
views
ldapsearch Or other means to verify users
I tried a few answers on ldapsearch usage and yet couldn't authenticate with the ldap service from a linux server. I am not sure what parameters to use?
I am trying this command
ldp=ldap://ldap.xyz....
0
votes
1
answer
226
views
OpenLDAP Access handling
I have installed OpenLDAP on Ubuntu Server 20.04. It works fine so far. Now I want to restrict access to the server, as by now anyone can read all entries e.g. in Thunderbird. Therefore I created a ...
1
vote
1
answer
511
views
Google Cloud Directory Sync java nullpointer exception
I'm trying to do some testing with Google Cloud Directory Sync and Active Directory, but whatever I do, I always get nullpointer exeptions. As far as I can find GCDS is a Java application. The GCDS ...
-1
votes
1
answer
472
views
How to Intercept and cache LDAP Search and Bind requests
I have a production web server running Django. Currently every request made requires an LDAP Bind and Search request. I can use the django-auth-ldap plugin to enable LDAP Search caching. However, my ...
0
votes
0
answers
433
views
SSSD alternative for pam_authz_search option in nslcd
I have servers based on RHEL 7 and 8.
RHEL 7 serevers use nslcd to work with a LDAP server, RHEL 8 use SSSD.
For RHEL 7 I can provide access for users to allowed hosts only.
This functions is covered ...
0
votes
1
answer
50
views
Is it possible to restrict which object classes a dynamically linked auxiliary class can be added to when extending the AD schema?
I've created a custom auxiliary class for the purpose of adding attributes to AD Group objects. I'm dynamically linking the auxiliary class to individual Groups. I can successfully add it to the ...
0
votes
1
answer
204
views
Deactivate user access to SAMBA file server in LDAP while maintaining access to other services
I am trying to cut off access of an ldap user to samba server. Disabling password is not an option, since the user needs to maintain access to other services like Nextcloud which is connected to the ...
0
votes
1
answer
782
views
Active Directory/LDAP replication Windows/Ubuntu
I am trying to setup replication between a Windows AD and OpenLDAP on Ubuntu.
Access to the Windows AD server seems to work OK, the OpenLDAP on Ubuntu also seems to work, however I am getting stuck on ...
0
votes
1
answer
652
views
How to increase OpenLDAP DN max length?
The maximum length of an OpenLDAP DN seems to be 255 characters.
How can this value can be increased?
0
votes
0
answers
114
views
Filter for User Domain Name in LDAPv3 (not AD)
I try to get my UID out of the LDAP by a filter that can recognize the whole user with the (internal) domain. For example: (Internal) LDAP Domain is "office.intern" and the user (uid) is &...
0
votes
0
answers
220
views
SSH to Windows server, fetching public keys from LDAP
We've got an established process where users connecting to an Ubuntu server via SSH have their public keys retrieved from our LDAP infrastructure and then PAM sets up their home directory, etc.
I need ...
0
votes
1
answer
392
views
Dovecot Authenticating with Active Directory, username with period not going through
I have been struggling the past 2 days. My conf file is like this:
hosts = 192.168.2.2
ldap_version = 3
auth_bind_userdn = %Ln
auth_bind = yes
dn = admin
dnpass ...
0
votes
1
answer
1k
views
Problems sudoing using a host connected to Active Directory (sssd, kerberos local sudoers file)
I am configuring Active Directory authentication for an Alma 8 box using SSSD, Kerberos, and initial SSH key for log in stored in an Active Directory object, and a local sudoers file that lists groups ...
0
votes
1
answer
143
views
How to get Gravitee to do recursive group lookups
I have set up Gravitee APIM 3x (gateway, rest-api, console and portal).
This work fine. When trying to replace the memory authentication with LDAP (FreeIPA) authentication, I am able to get the ...
0
votes
0
answers
1k
views
use sssd-simple to restrict access to certain group
I have configured sssd to authenticate against ldap
however i want to restrict the group that can connect to the server.
the sssd.conf below allows users that are not member of the mentioned group to ...
1
vote
0
answers
451
views
syncrepl_message_to_entry: rid=002 mods check (objectClass: value #1 invalid per syntax)
I have a problem with my master master config database replication (i will add the data replication after this one). I am running on each master, openldap and freeradius. To have freeradius working ...
1
vote
0
answers
2k
views
Apache reverse proxy with Kerberos authenticate and LDAP authorization
Server version: Apache/2.4.37 (Red Hat Enterprise Linux)
Apache is launched as a container in the Openshift cluster.
I am using Apache as a forward and reverse proxy for Kibana.
Mandatory requirement ...
0
votes
2
answers
127
views
Putting .k5login credentials in ldap with freeipa
On the systems I administer, in addition to human user accounts, we have a number of accounts associated with roles, software and specific data.
By using a .k5login file in home directories, it is ...
1
vote
1
answer
969
views
Configuration Errors With A Clean Installation of Apache Directory Studio
I have a fresh install of Apache Directory Studio, with the goal of sanity testing some LDAP stuff without actually touching production.
I followed the basic instructions to spin-up the server and it ...
0
votes
1
answer
77
views
Allow any user with specific uid to manager an entire OU
I have a domain (let's call it dc=example,dc=org)
The domain has a branch (ou=users,ou=ftp,ou=services,dc=k9999,dc=z9999,dc=infra,dc=example,dc=org).
There's a simpleSecurityObject in this domain (uid=...
0
votes
1
answer
647
views
OpenLDAP: a custom base DN for a user
Is that possible to make OpenLDAP provide with different base DNs for different users?
Let me explain what exactly I want to acheive.
I have a domain (let's say, dc=example,dc=org).
I also have a ...
1
vote
3
answers
5k
views
every LDAP user gives "permission denied" with LDAP and sssd (Centos7)
I am trying to limit LDAP logins to the "admin" group.
This is my /etc/sssd/sssd.conf file:
[domain/default]
autofs_provider = ldap
ldap_tls_reqcert = allow
auth_provider = ldap
...
0
votes
2
answers
274
views
Tomcat with HTTPD front end. Manager app not accessible
I have an HTTPD server which does the LDAP Authentication in front of Tomcat server. My application resides in the Tomcat.
I am proxying the authenticated requests via AJP connector of tomcat to my ...
0
votes
1
answer
813
views
Migrating OpenLDAP data from 2.4 to 2.5
I have gone through documentation online and on some forums but I am stuck on importing data from ldap 2.4 to 2.5 (Migrating to a new server as well). Here are the steps I did and the error I am ...
0
votes
1
answer
2k
views
openldap / slapd return the error : "daemon: listen(ldap://my.server1.org, 5) failed errno=98 (Address already in use)"
I am trying to set up a master master replication between two openldap servers. To do so, the first steps make me configure theses two files :
/etc/hosts, need to contain the DNS of the baseDN of the ...
0
votes
0
answers
447
views
OpenLDAP/ds-389 Secure Hardening Guide
I am in the process of setting up an Open Ldap Server (ds-389) however, I cannot find many good resources which define a security or hardening guide which can be applied to the configuration or schema ...
0
votes
0
answers
1k
views
slapd service is not starting on centos 7
Hi while I was trying to install open-ldap in my centos 7 server, I think I runned yum remove ldap command(I am not sure exactly) and now slap service is not working at all
[root@kwephispra28828 etc]# ...
0
votes
1
answer
1k
views
Dovecot can't connect to ldap server via ldaps
I have an LDAP server that accepts request through ldaps on port 636. I already use it for many of my applications and I want to have my dovecot server use that for authentication as well.
dovecot ...
0
votes
1
answer
286
views
SAMBA 4 CN with multiple spaces, cannot modify, delete but can view
Samba with internal LDAP (not openLDAP) configured as AD-DC
I have contacts created using CN={name}
Contacts that have multiple spaces in the names cannot be edited, deleted or removed from their ...
0
votes
0
answers
721
views
CentOS 7 PAM / LDAP SSH/LOGIN user does not start in his home directory
On a CentOS 7 machine, users can use their LDAP credentials to connect to my servers.
The first time they do this, the pam_mkhomedir is doing its job well. The user's folder /home/jdoe is well created ...
0
votes
1
answer
2k
views
CRON[83463]: Failure setting user credentials
I have a number of docker containers, all set up mostly identically, which successfully use cron to run nightly backup jobs.
I have another container, set up mostly identically, which tries, and fails,...
1
vote
1
answer
494
views
pam_unix(sshd:auth): authentication failure because of encrypted password from PAM stack
To configure sssd to connect AD server.
I set id_provider to ldap
As AD server cannot accept TLS, so I closed it by:
ldap_id_use_start_tls = false
set ssl off in ldap.conf
When I use login ftp via ...
1
vote
0
answers
246
views
Openldap user login fails when testing with ldapsearch
Using this ldif file:
# LDIF Export for cn=sample,dc=example,dc=org
# Server: ldap-service (ldap-service)
# Search Scope: sub
# Search Filter: (objectClass=*)
# Total Entries: 3
#
# Generated by ...
1
vote
2
answers
3k
views
ldapsearch keeps failing even though the username/password supplied are correct
Working to tie a server into ldap (active directory) and been struggling to get a simple bind working. The commands I have tried are:
ldapsearch -x -H ldap://192.168.10.10 -b "dc=example,dc=...
0
votes
0
answers
131
views
InspIRCd doesn’t even contact configured LDAP
On Ubuntu 20.04 I've installed InspIRCd (which seems to work fine as-is) and added to its config:
<module name="m_ldapauth.so">
<ldapauth baserdn="dc=nodomain"
...
0
votes
1
answer
125
views
Is it possible to overlay local LDAP attributes on top of a replicated tree?
A central LDAP server provides user data as posixAccount, whereby the attributes homeDirectory and loginShell are empty. I want allow users in this central LDAP server to access a Linux system.
If I ...
0
votes
1
answer
617
views
openldap index existing values
I have a ldap database that has been used for some time. naturally it is full on entries.
I recently tried to set up an index for uid to help searching, i added the following to my slapd.conf file
...
1
vote
0
answers
206
views
How can I delete the root node of a LDAP tree?
I would like to restore a LDAP tree with slapadd from a backup generated with slapcat. When I load the backup on a freshly installed OpenLDAP instance, slapadd complains about the root node already ...
0
votes
1
answer
447
views
Enabling an overlay on an OpenLDAP spare
I have two OpenLDAP server, one master and one slave synchronized with syncprov. I would like to enable the memberof overlay on both. I successfully enabled the overlay on the master server, but I ...