Questions tagged [openldap]

OpenLDAP Software is a free, open source implementation of the Lightweight Directory Access Protocol (LDAP) developed by the OpenLDAP Project. LDAP is a platform-independent protocol for querying and modifying data using directory services running over TCP/IP.

Filter by
Sorted by
Tagged with
0
votes
0answers
39 views

OpenLDAP, writing ACL for specific use

I work with CentOS7 and I am configuring OpenLDAP base. I have root administrator (ldapadmin) who can make changes in the entire base (in all branches). I create branches for departments, that have to ...
0
votes
1answer
51 views

Debian 10, OpenLDAP, LetsEncrypt, Error 80 trying to add

...I have never had so much trouble enabling secure communications. I believe this to be a valid CA cert chain for Let's Encrypt The contents of /etc/ssl/le/ca-chain.pem -----BEGIN CERTIFICATE----- ...
0
votes
0answers
21 views

How to change the error that we get from Openldap in case the account is locked or expired?

I have a question concerning openldap. Is there a solution to change errors via a proxy or any way with Openldap. Because as you maybe know Openldap returns the same error when the account is locked ...
1
vote
1answer
68 views

Errors structure in Openldap

I have a question concerning Openldap. I'm using a solution(PingFederate) that gets errors from openldap to do different things depending on the filter. For example i can say : detect the invalid DN ...
0
votes
1answer
26 views

OpenLDAP Consumer Replica

I have a Cluster OpenLDAP setup with 2 OpenLDAP servers running syncrepl on config and data, providing LDAP authentication to specific systems running various embedded OS. Now I was asked to add a ...
0
votes
0answers
17 views

Can't run slapd inside an ubuntu docker container

I am trying to create two docker containers, one to act as an ldap server and the other an ldap client. I started by creating the server. I am running on ubuntu 18.04 and using ubuntu image for my ...
0
votes
0answers
31 views

Using openldap to connect to Active Directory SSL by trusting primary domain controller's CA cert

A lot has been written on this subject, but not quite my problem. The problem is that whatever I do, I can't get openldap tools (or PHP, which uses openldap), to accept a certificate signed by the ...
2
votes
0answers
41 views

Last login a user in OpenLdap

I am running openldap 2.4.45. Is there anyway I can get the last login time of a user using authtimestamp or any other attribute?
0
votes
1answer
54 views

Use bcrypt password hashing with OpenLDAP (slapd)

I have an OpenLDAP LDAP server on Debian 9 (through the slapd package, v2.4.44). We use crypt for password authentication. Currently the scheme is SHA512: $5$.... The setup is pretty much as described ...
1
vote
0answers
25 views

Can't understand why libnss-pam-ldapd does not find LDAP library

I am trying to cross-compile libnss-pam-ldapd for an arm architecture. The configure command always gives the following error: checking for library containing ldap_search_ext... no checking for ...
1
vote
1answer
51 views

What is the easiest way to set up composable POSIX groups for SSH & Samba authentication?

Background I'm putting together what I would consider to be a fairly ordinary chunk of infrastructure, but have been running into so many problems that I can't help but wonder if there's an easier way....
0
votes
1answer
230 views

SSSD integration with Ldap Error 'Could not start TLS encryption. TLS: hostname does not match CN in peer certificate'

We are currently using Wildcard certificate with SAN. I can successfully run ldapsearch from my client machine when I added TLS_REQSAN allow in openldap configuration. Now i'm trying to integrate SSSD ...
1
vote
1answer
227 views

ldapsearch fails with TLS: hostname does not match CN in peer certificate

I'm trying to configure secure LDAP client using the certificates (RootCA, IntermediateCA, IssuingCA and Server certificate) and created the truststore. openssl s_client works successfully but when I ...
1
vote
0answers
61 views

Using BIND DLZ through LDAPS or LDAPI

Before hardening this server, I had the bind DNS server working flawlessly and storing the DNS database within the OpenLDAP directory through LDAP:// using the following configuration under named.conf:...
0
votes
1answer
64 views

Is there a way to migrate an existing matrix-synapse user database to OpenLDAP?

I am looking for a way to migrate a huge Synapse home server database to OpenLDAP without resetting the users' passwords. Migration to LDAP is necessary as we would like to integrate all our online ...
1
vote
1answer
43 views

Openldap - slap_access_allowed: auth access denied by =0 - Not able to authenticate user

Recently I configured my openldap server to work with certificates. But in process of doing that messed up unsecure port also. Now, authentication is not working for any user at all. I am using python-...
0
votes
1answer
75 views

OpenLDAP implementation allows only root user to set passwords of accounts

I'm working application that requires the use of AWS ParallelCluster assets for some high performance processing. After the initial setup, we need to be able to add/remove user accounts and I am ...
0
votes
1answer
41 views

Multiple LDAP servers

I have two OpenLDAP servers: the server A with Linux VMs a1 and a2 connected to it (PAM LDAP) the server B with Linux VMs b1 and b2 connected to it (PAM LDAP) The servers have different users stored ...
0
votes
1answer
57 views

LDAP sizelimit exceeded despite a high sizelimit

I have the problem "LDAP sizelimit exceeded" (I know it has been discussed here several times). Unfortunately, the previous solutions here and on other sites did not help. I am using Ubuntu ...
0
votes
0answers
24 views

How to Introduce ldap query delay in an openldap server?

I use Ldap on a docker and use Apache Directory studio to browse or change Openldap properties. I could not find options or articles about introducing delay ldap queries
0
votes
0answers
27 views

Openldap granting write access for groups

I want to give an admin group write access cn=admin_group,ou=group,dc=kml,dc=de dn: cn=admin_group,ou=group,dc=kml,dc=de cn: admin_group description: All users member: uid=uf,ou=people,dc=kml,dc=de ...
0
votes
1answer
19 views

OpenLDAP cn=config database access blocked

I use OpenLDAP 2.4.54 with Alpine. Here is my ldap configuration $ sudo slapcat -n0 dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-...
1
vote
1answer
160 views

attribute to enable/disable user on openLDAP using java

My users are inetOrgPerson . What would be the attribute to enable/disable users ? I am using JNDI library and i am trying this code that is for active directory but i am getting LDAP: error code 17 - ...
0
votes
0answers
23 views

postfix backed by LDAP, pull postmaster mail-address from domain

I have a postfix installation, that's backed by OpenLDAP. Postfix is running on virtual domains only. I would like to define a postmaster's e-mail address as a mandatory field on every DNS domain I'm ...
0
votes
3answers
344 views

OpenLDAP server: chaining of SSL certificates (let's encrypt) does not work as expected

Okay, this is gonna be a long one, I fear. Please bear with me. setting I have an OpenLDAP 2.4.50 server running on Alpine 3.12.1. It's serving LDAPS only with a let's encrypt staging certificate (at ...
0
votes
0answers
14 views

how to block usb mass storage with ldap account manager?

I need to be able to block the usb of certain authenticated users, how could I achieve it? What tools do I need? is it possible to create the constraint using ldap?
0
votes
1answer
158 views

LDIF add/replace syntax?

(slapd 2.4.47+dfsg-3+deb10u3 - from Debian 10) I have searched for previous answers on this question, but despite following the suggestions (use changetype: modify), I am still having problems. The ...
1
vote
2answers
163 views

LDAP schema objectclass multiple inheritance confuses me

I have set up OpenLDAP 2.4.50 on alpine 3.12.1 and fed cosine, inetorgperson and nis LDIF schemas to it using ldapadd. Now I wanted to add a custom object class. I added an entry cn=mystuff,cn=schema,...
0
votes
0answers
3k views

Why do I get “Server not found in Kerberos database” using testsaslauthd?

I'm trying to setup Kerberos auth over SASL using OpenLDAP. As I understand it, I need a host keytab in /etc/krb5.keytab from the KDC I'm using and then {SASL}user@realm in the given user's LDAP ...
1
vote
2answers
83 views

Why can users just not login with SSH while everything else seems to work?

I have set up a pair of OpenLDAP servers on Ubuntu 20 with directional failover using Syncrepl. Things that an LDAP user can successfully do include: login su - <uid> remote bind from ...
0
votes
0answers
63 views

OpenLdap - getting MDB_READERS_FULL

we run an OpenLdap server Version: openldap 2.4.47 On the application side: Spring Boot, spring data I have enabled the cluster mode. Today I received MDB_READERS_FULL. Restarting the LDAP server did ...
0
votes
1answer
76 views

ldapwhoami works but pam_authenticate fails with the same credentials

I'm testing the pam_ldap implementation with a C++ application. I configured ldap and pam_ldap to authenticate against a OpenLDAP server running in the same host. Created a user for testing, ...
0
votes
0answers
62 views

OpenLDAP in k8s: authentication does not work

I have set up an openldap (osixia/openldap:1.4.0) container in k8s and it runs smoothly. However, when my app wants to connect to it using the default admin/admin creds, it fails. Data: I have this in ...
0
votes
2answers
458 views

How to start openldap in k8s?

*** CONTAINER_LOG_LEVEL = 3 (info) *** Search service in CONTAINER_SERVICE_DIR = /container/service : *** link /container/service/:ssl-tools/startup.sh to /container/run/startup/:ssl-tools *** link /...
0
votes
2answers
39 views

add ldap user to existing openldap server

I try to add a user to an existing and running openldap server. The server was setup by someone else (who is difficult to reach...) and is actively being used. Now I would like to add a new user, but ...
0
votes
1answer
151 views

LDAPError while authenticating aprasad: INAPPROPRIATE_AUTH

My env. AWX( Ansible Tower) on Centos 7 with docker. And I'm trying to connect AWX with LDAP. It's finding the user but not able aloowing it to authenticate. I was able to run ldapsearch command and ...
0
votes
0answers
73 views

“ldap_modify: No such object (32)” I can't find cn=config

I'm new to OpenLdap. I got an openldap invalid credentials (49) error so i wanted to change the password based on this guide: https://linux-note.com/centos-7-ldap/ I use slappasswd as below : root@...
1
vote
1answer
225 views

In LDAP how does one know which OID arc to use in the object identifier?

I'm new to LDAP and I'm looking to create a new user schema to hold credentials and personal information. I've found several examples of how to do this (this for example) and they all have a string ...
0
votes
0answers
38 views

Openldap with kerberos password over SASL

I have an OpenLDAP server doing (working) SASL passthrough auth to an AD server via LDAPS. I need to change the SASL method to use Kerberos (on a different server) but not intimately familiar with the ...
0
votes
1answer
189 views

ldapsearch fails on centos8 with Google LDAPS but works on Ubuntu 20.04 with work around

My end goal is to use sssd and Google LDAPS but can tell if things will work with ldapsearch. Google LDAPS requires the Server Name Indication (SNI) extension. I have it working on Ubuntu 20.04 with a ...
0
votes
1answer
127 views

OpenLDAP syncrepl does not recover after network interruption

We have an issue we have discovered where syncrepl does not recover after a network interruption. Environment: Centos 7 replicas OpenLDAP 2.4.44(-21.el7_6) Loglevel set to comm sync (produces nothing ...
0
votes
1answer
150 views

How to check if an overlay is enabled with OpenLDAP?

Is there a way to automatically check if that an overlay, for instance memberof, is enabled with openldap? A lot of tutorial out there explain how to enable memberof, but how can I know if this had ...
0
votes
0answers
22 views

removing ldap_initialize( <DEFAULT> )

I'm working with apache camel 2.24.3 and OpenLdap. I'm testing with Postman and when I execute my command ldapDelete it returns this response : { "status_description": "...
0
votes
0answers
48 views

OpenLdap invalid credentials when connecting to JXPLORER

I'm working with OpenLDAP under Centos7. I have an authentication problem with OpenLDAP only when I close the VM(virtual machine) and reopen it. I am doing the test with JXPLORER. I can not connect it ...
0
votes
0answers
81 views

OpenLDAP doesn't lock user accounts (olcPPolicyDefault)

I'm having difficulties getting the OpenLDAP PPolicy module to work (OS: CentOS 7, OpenLDAP: 2.4.44). I configured the schema, loaded the module, created an overlay and a default policy. I don't ...
0
votes
0answers
37 views

LDAP: password quality check pqcheker.so and administrators group

Looks like it works with the ldapadmin user (will bypass the pqchecker all together) but when i try to add an user or change the password of an user with an user that is in the administrators group it ...
0
votes
0answers
263 views

OpenLDAP as a Active Directory Proxy

I have a working LDAP Proxy. This proxy querys two ADs. If only one AD config in slapd.conf is enabled, everything works fine, without errors. But if all two AD entries are enabled in slapd.conf i can ...
0
votes
1answer
746 views

ldapmodify failing implementing TLS certs

I'm probably overlooking a typo, but i cant find it. ~$ /usr/bin/ldapmodify -H ldapi:// -Y EXTERNAL -f /tmp/certs.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=...
0
votes
0answers
70 views

LDAP won't let me create a schema

I'm installing openldap on centos8 following this tutorial: LINK At the point Configure OpenLDAP Logging on CentOS 8 and following Create OpenLDAP Default Root DN I got: ldap_modify: Insufficient ...
0
votes
0answers
35 views

Openldap policy to allow simple password

What is wrong with this setting in openldap to not able to accept new password=amfadm01 but accept password=amfadm_01    "pwdquality": {           "useCracklib": "0",...

1
2 3 4 5
27