Questions tagged [openldap]
OpenLDAP Software is a free, open source implementation of the Lightweight Directory Access Protocol (LDAP) developed by the OpenLDAP Project. LDAP is a platform-independent protocol for querying and modifying data using directory services running over TCP/IP.
1,440
questions
0
votes
1
answer
9
views
OpenLDAP + Moodle, member of groups
the teachers in my OpenLDAP are in cn=teachers,ou=groups,dc=school,dc=de
the course creator context in my Moodle installation should then be the same if I am not mistaken. If I query ldap
BINDUSER=&...
- 1
0
votes
1
answer
27
views
ldap_group_search_base is not working as intented
I've used the below-given sssd.conf file to authorize the users to a server. The issue is some users who are not listed under the DN: cn=authorized,ou=rona,ou=servers,ou=groups,dc=yolo,dc=com still ...
0
votes
1
answer
33
views
What are all the certificates mandatory to be provide while setting TLSVerifyClient option to demand
In my case, I had set TLSVerifyClient to demand. I couldn't be able to establish a connection While providing TLSCACertificateFile alone.
While setting the TLSVerifyClient option demand is it ...
- 11
0
votes
0
answers
5
views
Specific olcAccess does not work for an OU in LDAP
On my OpenLDAP server, I would like the accounts in my "ou=partners" OU to have "read" permissions to all objects in "ou=abos". Here is the tree of my DIT :
[ditTree][1]
...
0
votes
0
answers
17
views
Samba Domain with readonly Active Directory and OpenLDAP
I have a working Samba Windows Domain getting its users from an OpenLDAP database, but now I need to get these users from an Active Directory database. I have full access to the OpenLDAP database but ...
0
votes
1
answer
21
views
Strange hash lengths in OpenLDAP
I recently went through all the hashes stored in an LDAP instance I have access to and noticed something strange that I can't explain.
Despite all the hashes being marked as SSHA (which should be ...
- 11
1
vote
1
answer
51
views
NetBSD + openLDAP + SASL
I try to set up a connection to a openLDAP server running on NetBSD 10 via TLS and SASL. When I try ldapsreach -Y EXTERNAL
I get
ldapsearch: not compiled with SASL support
and
ldd /usr/bin/ldapsearch
...
- 31
0
votes
0
answers
40
views
How to delete olcAttributeTypes LDAP
Is there a way to delete olcAttributeTypes from my schema?
It's not a system attribute, I added it myself, now I need to delete it.
I'm using LAM (LDAP Account Manager) v5.6
The attribute is located ...
1
vote
0
answers
41
views
OpenLDAP gidNumber and group membership inconsistency
I encountered an interesting problem while examining a specific AD/OpenLDAP interop case. On the OpenLDAP server, there is a user1, whose gidNumber corresponds to a group1. There is another user2, ...
- 11
0
votes
0
answers
86
views
failed to bind to LDAP server ldap://<server IP>/: Can't contact LDAP server: Transport endpoint is not connected
Users are unable to login to network cluster.
var/log/messages =
failed to bind to LDAP server ldap://<ldap server hostname>: Can't contact LDAP server: Transport endpoint is not connected
no ...
- 1
1
vote
0
answers
52
views
How to (properly) force the use of SSL or STARTTLS in OpenLDAP?
I have successfully managed to configure my OpenLDAP (which is an Apple Open Directory variant, but that should not matter) to work with both, SSL (ldaps on port 636) as well as STARTTLS (on port 389)....
- 206
0
votes
0
answers
23
views
OpenLDAP meta backend with different directory structure
I am working on a project and we need to "combine" two completely different Active Directory (AD) servers to one. I have found that OpenLDAP might provide a solution by providing a reverse ...
- 1
0
votes
1
answer
63
views
Getting "ldap_add: Server is unwilling to perform (53) additional info: no global superior knowledge" when trying to add new objectClass to openLDAP
I have created new schema which looks like this
attributetype ( 2.25.3236588
NAME 'x-candidateNumber'
DESC 'Candidate number'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4....
- 3
0
votes
2
answers
47
views
Openldap LogLevel : Log timestamp in milliseconds
Does anyone know how to configure the Loglevel in Openldap to log milliseconds? The current loglevel 256 does log day and time (Jan 13 10:32:12). We have tried different levels none of them capable ...
0
votes
0
answers
37
views
Openldap meta backend empty binddn and bindpw after inactivity/operationserror succesful bind must be completed on the connection
meta backend is running in cn=config, OpenLDAP version is 2.4.44
I'm configuring an OpenLDAP meta backend to authenticate Active Directory users from two different domains. I can successfully log in a ...
- 1
0
votes
0
answers
64
views
how to get rid off raise at python3-ldap3
Using:
ubuntu22.04
python3-ldap3-2.8.1-1
Code:
conn = Connection(server, user=user, password=password, auto_bind=AUTO_BIND_TLS_BEFORE_BIND, raise_exceptions=False)
conn.start_tls()
if not ...
0
votes
0
answers
26
views
OPENLADAP Monitor running on ubuntu 20.4
I tried to configure the Account monitor with OpenLDAP on ubuntu 20.4.I've followed the steps
in fisrt time i check to enable monitoring then i creat account monitor with file user_monitor.ldif
...
0
votes
0
answers
218
views
openLDAP / Sasl - ldap_sasl_interactive_bind_s: Local error (-2)
I configure openldap with sasl bind.
Trying connect:
# ldapsearch -v -H ldaps:// -Y PLAIN -U name@example.com
But getting error:
ldap_sasl_interactive_bind_s: Local error (-2)
I create a config ...
- 1
0
votes
1
answer
140
views
Nsswitch - sudoers sss vs ldap what am I missing
I'm trying to configure nsswitch to use sudoers: files sss which is default for rhel9 system, however this does not work for me, but the following sudoers: files ldap does indeed work.
What am I ...
- 131
0
votes
1
answer
30
views
Does OpenLDAP olcAccess support quorum of users
For example, we have role with sensitive access or privileges. And have two users with less sensitive privileges' role.
We want to grant to this users permission to set more sensitive role to user, ...
- 1
1
vote
1
answer
102
views
How to disable inactive OpenLDAP accounts
is there a means to disable such OpenLDAP accounts that show no interaction for a given grace period. In particular, of a user has not logged in to her account since x days (no matter the means of ...
- 125
0
votes
0
answers
31
views
OpenLDAP Client hangs indefinitely on SSL_connect
I'm using the C/C++ OpenLDAP client library. I specified a NETWORK_TIMEOUT and TIMEOUT of 3 seconds in my openldap.cfg. However, when the OpenLDAP client library issues SSL_connect, it hangs ...
- 1
0
votes
1
answer
37
views
Do I have to reconfigure after restarting an LDAP service?
I'm using two LDAP servers in a mirror mode.(active-active hot standby, openldap 2.4)
As explained in an LDAP document, instead of using a config file, I configured dynamically with ldapadd and ...
- 103
0
votes
0
answers
21
views
OpenLDAP Child or Relay server configuration assistance
I am a really lost here and would appreciate some help.
My organization already maintains an OpenLDAP server which allows read-only access
Running this gives me an entire dump of all the users and ...
- 51
0
votes
0
answers
23
views
Using Ppolicy in a provider peer cluster can trigger consumer refresh condition
My ldap consists of a cluster of 3 providers that all replicate to each other, and a fleet of consumers replicating from them, and we have ppolicy installed on our providers and consumers both, though ...
- 1
0
votes
0
answers
36
views
Setting ACL on OpenLDAP server
I did setup OpenLDAP server, but I need to implement ACL. I'm not linux admin and I'm not even sure if what I'm trying to achieve is possible.
I have 3 groups. These has users which are posixAccount ...
- 3
0
votes
0
answers
57
views
ldapwhoami command returning can't contact
I tried to connect from my ubuntu local system to ldap server for checking the connection getting can't connect response, following is the command I tried.
ldapwhoami -H ldap://192.168.132.241:389 -D &...
- 101
0
votes
0
answers
72
views
ldap password policy for other attributes
Say, you have a user with a normal password attribute, userPassword, and an apllication-password attribute, appPassword, that are not the same and also have a different hash-scheme.
In OpenLDAP, you ...
1
vote
1
answer
109
views
Cannot initialize openLDAP-backed kerberos realm using krb5_ldap_util with startTLS?
I have set up an openLDAP backed MIT Kerberos realm on a server after much iteration, and I am now trying to move it to its own server. When I first set it up on the original server, I created a ...
- 163
0
votes
1
answer
67
views
Does ldapmodify propagate changes of dn/uid to associated groups of the user?
I have to modify a user's UID and DN in an OpenLDAP server because of marriage. Now, I follow this example from Oracle's website: https://docs.oracle.com/cd/E22289_01/html/821-1273/adding-modifying-...
0
votes
1
answer
31
views
OpenLDAP to 389-DS: Can I have "named password policies"?
I'm trying to understand how "password policy" works in 389-DS, compared to OpenLDAP 2.4:
In OpenLDAP 2.4 I could define multiple "named" password policy entries, and assign those ...
- 366
0
votes
1
answer
48
views
ldapmodify error 80 olcAccess Handler exited with 1
I have an error trying to add an olcAccess using ldapmodify command:
ldap_initialize( ldapi:///??base )
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=...
0
votes
1
answer
163
views
Best practices to completely disable LDAP users' access to mixed services with mixed authentication methods?
Background
We use LDAP in our department to authenticate users to various services including web apps as well as Linux servers (via SSH). When a user leaves the department, we should disable their ...
- 38
0
votes
1
answer
109
views
LDAP configuration for slapd-sock / slapo-sock / back-sock
Current system: CentOS 7.9, OpenLDAP 2.4
I would like to implement a "hook" into my LDAP operations so that when an ldapadd or ldapmodify operation takes place, a script is run in addition ...
1
vote
1
answer
36
views
Error 20080078:BIO routines:bio_write_intern: uninitialized
My php test script for SSL connection to the LDAP server crashes.
When I run it from command line CLI crashes.
The message from the LDAP logging shows this before the crash:
Error 20080078:BIO ...
- 153
0
votes
1
answer
218
views
TLS: could not load verify locations
I am trying to contact the organization's OpenLDAP server over SSL.
I am not sure if I am trying with the correct certificate, but I am using a .pfx file I found.
It is located at C:/cert/mycert.pfx
...
- 153
0
votes
1
answer
167
views
LDAP auth for hosts : same user should have different posixgroup memberships while login to different machines(hosts)
Any idea on how to achieve following objective with openLDAP server with unix clients
Objective :
a) Each user should have separate access restrictions to different hosts(unix servers) through LDAP ...
- 1
1
vote
1
answer
71
views
Adding Chained CA certificate on /etc/ssl/certinfo.ldif file
I have been created following files for my LDAP server using certtool.
1.root.pem
2.ldap_crt.pem
3.ldap_key.pem
Above created files has been configured in the /etc/ssl/certinfo.ldif file like ...
- 11
0
votes
0
answers
33
views
pwdFailureTime behavior for accounts that are set to no lockout
I want to have a no lockout policy, but would like to remove the consecutive failure timestamps from pwdFailureTime. I know that a successful login clears the pwdFailureTime attribute, but I don't ...
- 1
0
votes
1
answer
176
views
TLS Negotiation issue in OpenLDAP
I have the OpenLDAP Master-Slave architecture. One day I have restarted the slapd service in the LDAP Slave and then found the TLS negotiation issue in the Logs. Before restarting the service, it was ...
- 1
0
votes
0
answers
18
views
Openldap Bind user issue
I am facing an issue regarding openldap 2.6 running on rhel 8.
PasswordMustChange Attribute is affecting the bind user.
Whenever I change the PasswordMustChange to TRUE then bind dn user password ...
1
vote
2
answers
397
views
OpenLDAP and Kerberos servers on Ubuntu Server 22.04; Krb5 isn't creating /var/lib/krb5kdc/principal
I have an existing openldap server on Ubuntu Server 22.04 and am trying to set up a kerberos server with it, following this guide: https://ubuntu.com/server/docs/service-kerberos-with-openldap-backend
...
- 163
0
votes
1
answer
93
views
Active directory to ldap synchronization
I have two LDAP servers. First is Active Directory and second is openLDAP. I need setup between these servers.
Is here anybody, who know, how to do it?
I tried to use this link for tutorial, but I ...
- 13
1
vote
2
answers
497
views
openLDAP config broken after Ubuntu upgrade (20.04 -> 22.04)
I have problems with openLDAP after updating from Ubuntu 20.04 to 22.04. If I use slapcat after the update it leads to the following error:
olcAttributeTypes: value #0 olcAttributeTypes: Duplicate ...
0
votes
0
answers
110
views
CentOS Stream 8 OpenLDAP failing to start slapd service
I tried to install openldap by following this guide: https://computingforgeeks.com/install-configure-openldap-server-centos/
but the service does not start showing the following error:
● slapd.service ...
- 1
0
votes
0
answers
147
views
OpenLDAP slapd.d configuration directory not updated
I have 'inherited' an openldap (CentOS 7) server which configuration is handled dynamically (using a slapd.d directory and a tree of ldif files).
I used ldapmodify to add an attribute (olcDbCheckpoint)...
- 163
0
votes
1
answer
806
views
openLDAP certificates untrusted or revoked
I've already spent two days on this problem but I can't find any solution.
Two openLDAP server run from docker on different hosts in master/master scenario. ldapsearch command or syncrepl process run ...
- 121
0
votes
0
answers
62
views
why does my slapd.log file isn't created?
I'm setting up an ldap server to log the user in my association. My client connect using sssd and I would like to enable the logs on my server side. I followed this article bug my /var/log/slapd.log ...
- 101
0
votes
1
answer
98
views
How to create accesslog in OpenLDAP with name "{2}accesslog"
I'm trying to setup OpenLdap on ubuntu.
The following command is trying to add the accesslog database:
ldapmodify -Y EXTERNAL -H ldapi:/// -f test.ldif
When the name is "{2}mdb", the result ...
- 103
0
votes
0
answers
17
views
How to delete a schema with OpenLDAP without service interruption? [duplicate]
I run OpenLDAP 2.6.2. I could successfully add a new custom schema with ldapadd, but now I would like to remove the schema without stopping the OpenLDAP server. In other words I would like to use ...
- 175