Questions tagged [openldap]
OpenLDAP Software is a free, open source implementation of the Lightweight Directory Access Protocol (LDAP) developed by the OpenLDAP Project. LDAP is a platform-independent protocol for querying and modifying data using directory services running over TCP/IP.
1,468
questions
0
votes
1
answer
22
views
Openldap "ldapmodify" command fails to run
I'm attempting to update a config parameter within my openldap server by using ldapmodify, but I'm getting the following error:
# ldapmodify -Y EXTERNAL -H ldapi:/// -f tls.ldif
SASL/EXTERNAL ...
2
votes
0
answers
189
views
Why I can't activate SSL on my Ubuntu Server (20.04) with ldap auth? (ldaps)
I have to activate SSL for secure comunications with ldap, I count with Letsencrypt .pem files (chain, fullchain, cert & privkey).
I followed the steps of some pages but it didn't had any effect ...
-1
votes
0
answers
41
views
openldap return no error and no data
We are using an application called XXX that relies on an openldap caching proxy. However, we're facing an issue where the caching proxy sometimes fails to retrieve the requested data, even though we ...
2
votes
1
answer
118
views
Insufficient Acces (50) LDAP
I am trying to execute a custom .ldif file at the beggining of the startup of OpenLDAP server and have succeded using the following command:
ldapadd -x -D cn=admin,dc=vlad,dc=lan -w admin -H ldap:// -...
0
votes
2
answers
83
views
Freeradius filter ldap by group
I would like freeradius to check for group membership and allow access based on group membership:
My current config:
ldap {
identity = 'cn=radius,ou=bindings,dc=company,dc=com'
...
0
votes
0
answers
27
views
Can I Ldap Sync replication to a different backend?
My current OpenLDAP backend is BDB can I replicate (syncrepl) this to another server using a MDB backend?
Probably a no but thought I'd ask.
Thanks,
Andy
1
vote
1
answer
107
views
Combining OpenLDAP and Active Directory via OpenLDAP meta backend
We have an application that used to authenticate via our Atlassian Crowd instance, but after a major rewrite that authentication source is not available anymore. Now I need a solution to authenticate ...
0
votes
1
answer
51
views
OpenLDAP use of ObjectSid from Windows AD
I am creating a docker OpenLDAP to make a test that is simpler than Active Directory.
To do this I have extracted a part of User account in a LDIF. I need the ObjectSid attribute because one of the ...
0
votes
1
answer
44
views
OpenLDAP failing to add new attributes
I want to create some user accounts with attributes like "gender", meaning I need to create custom attributes.
I have created the following LDIF file:
dn: cn=schema
changetype: modify
add: ...
0
votes
0
answers
116
views
OpenLDAP won't look at CA certificate
I have set up an LDAP server that I would like to connect to from a client machine. Ubuntu is OS of both server and client, TLS is active and since this is a practice project, all my certificates are ...
0
votes
1
answer
49
views
Active Directory for linux servers
I have 7 ubuntu servers and a Storage server on freebsd. I am considering deploying OpenLDAP on one of these 7 servers so that these servers can have a centralized user database and authentication ...
0
votes
0
answers
55
views
OpenLDAP peername.ip ACL not working for subnets
I have the following ACL stored in my /etc/openldap/slapd.conf file:
access to dn.regex="^([^,]+,)?ou=(groups|addressbook),dc=ldap$"
by dn.exact="cn=directory,ou=users,dc=ldap&...
0
votes
1
answer
74
views
Creating ppolicy Overlay in OpenLDAP has no effect
I read +++ forums and docs.
My OpenLDAP instance is configured in a Bitnami Container as follows:
dn: cn=module,cn=config
cn: module
objectClass: olcModuleList
olcModuleLoad: ppolicy.so
olcModulePath: ...
0
votes
0
answers
21
views
What OpenLDAP ACL is necessary for Webmin?
I struggle in the arcane science of OpenLDAP ACL configuration.
I would like to store user login data in OpenLDAP and provide it to multiple services, so the users can use the same username and ...
0
votes
0
answers
59
views
Exporting openldap to migrate to new server
I have an install of openldap via Macports. I want to update it and move it to new hardware.
I've taken the slapd.conf from the old system, then I am trying to run it to configure the new server ...
1
vote
1
answer
136
views
openLDAP works for v2.4 but v2.6 returns: Invalid syntax (21) additional info: objectClass: value #0 invalid per syntax
I have been facing this problem for a few days by now, and I would like to preface this by stating that this is the first time I have ever used ldap. So after debugging a bit around the error I have ...
0
votes
0
answers
44
views
pgina not able to authorize as per rules
I have the following settings
img 1
and these are the authorization rules I have added
img 2
Yet pgina is unable to correctly identify and follow the rules.
Here is the output of simulation.
bwayne is ...
0
votes
1
answer
50
views
Dovecot saves incoming mail from LMTP in wrong home directory despite being correctly overwritten
I have setup Postfix 3.8.1, Dovecot 2.3.20 and OpenLDAP on Ubuntu 23.10. Postfix transfers mails for local delivery via LMTP to Dovecot. In some cases, the mail address as seen from the outside world (...
0
votes
0
answers
47
views
OpenLDAP: Is is possible to create an LDAP DB with empty suffx?
Is it possible to create an OpenLDAP database with empty suffix? If yes, how?
I was able to create the olcDatabaseConfig below cn=config, but when I try to add my first entry to the DB I get the error ...
2
votes
1
answer
44
views
OpenLDAP Access Levels: What is "search" without "read" good for? What does "manage" provide which "write" doesn't?
I try to understand the different access level which OpenLDAP provides, see OpenLDAP 2.6 Guide: Access Control - The access to grant.
While access levels like write are clear just by their name, IMHO, ...
0
votes
1
answer
168
views
How to define the password protection scheme (e.g. hash function) used by ldappasswd?
I am using OpenLDAP 2.6. When I set an object's password via
ldappasswd -x -D <dn of root user> -W -S <dn of object whose pwd shall be set>
then some hash of the password end up in the ...
0
votes
1
answer
99
views
Where do I find the LDAP scheme for Postifx or which alternative should I use?
The howto https://www.postfix.org/LDAP_README.html describes LDAP object with
object classes
virtualaccount
ldapgroup
ldapuser
attributes
mail
memberdn
memberaddr
maildrop
Where do I find the ...
1
vote
1
answer
259
views
openldap - adding image to 'photo' attribute gives me 'no validator for syntax'
New to openLDAP - i'm trying to simply add a base64 encoded binary (16Kb) image to the photo attribute to the person objectClass but whatever i try i simply get this error 'no validator for syntax 1.3....
0
votes
0
answers
250
views
"LDAP bind dn value missing" error when setting up Kerberos and OpenLDAP on Ubuntu 22.04
I have been following [these][1] instructions for setting up Kerberos to use an existing OpenLDAP server as its backend.
I have run into a problem in the very last step. I am trying to add an existing ...
0
votes
0
answers
94
views
openLDAP olcAccess settings
i have installed openLdap server on a Rokye Linux:
[root@localhost etc]# cat rocky-release
Rocky Linux release 8.8 (Green Obsidian)
I created the manager account following this guide on how to forge.
...
0
votes
1
answer
228
views
Cannot passwd for root with nslcd and openldap on Debian 12
Fresh Debian 12 for lab (VM). I installed: slapd, phpldapadmin, nslcd, nscd and dependencies.
I have two local accounts: root and user1. Also I have only user1 POSIX-account on local LDAP server.
I ...
0
votes
0
answers
90
views
Windows AD to OpenLDAP synchronisation with password cache
We're looking for an "LDAP proxy" solution that can synchronize a Windows Active Directory with an OpenLDAP server inclusive passwords.
The openLDAP server will act as primary and failover ...
1
vote
1
answer
385
views
SSSD, openLDAP and nested groups
I am trying to figure out how to structure my ldap and/or configure sssd to read membership of nested groups.
Something like this works for normal group membership:
DN: cn=server-admins,ou=Groups,dc=...
0
votes
0
answers
402
views
Cannot connect to LDAP server ERRNO=0
I have a php application (apache,redhat with selinux disabled) and I am struggling with ldap configuration. I am trying to connect to a ldap server and I am getting this error in apache logs:
...
0
votes
0
answers
54
views
OpenLDAP + GSSAPI/Kerberos SASL
I have OpenLDAP 2.5 configured with GSSAPI and Kerberos set up and working. By working I mean I can bind and search when I have a ticket. My question is can I do a bind when I don't have a ticket? Can ...
0
votes
0
answers
294
views
How to synchronize OpenLDAP and Samba4?
I have a samba 4 domain with internal LDAP. Now the need arose to copy OpenLDAP users and passwords to this domain. This copy must be made synchronously every time there is a change in OpenLDAP. ...
0
votes
0
answers
128
views
SSSD LDAP CONFIGURATION
I am trying to configure ldap on port 636 on a redhat server. Right now, when I try the following command :
netstat -antup | grep -i 636
I get
tcp 0 132 IP_ADDRESS_1:40670 XX.XX.XX.XX:...
0
votes
0
answers
1k
views
Unable to login via SSH to a Linux machine with my LDAP credentials
I am trying to setup LDAP for users to login to Linux machines. I can change the users to any given users in the LDAP list of users using the su command. A new directory is created as well. So I'm ...
1
vote
1
answer
147
views
OpenLDAP ppolicy working with passwd, but not ldappasswd
I've been working on this for about a week, and can't seem to figure out why this is happening.
I've got passwd working, letting users change their own ldap password from a client machine, and it ...
0
votes
1
answer
379
views
shared mail address with postfix and dovecot
I'm trying to set up some shared mailboxes like contact or support.
I have made it possible for me to share an IMAP folder between users in Dovecot by doing this in 15-mailboxes.conf
namespace {
...
0
votes
0
answers
143
views
Windows application 'LDAP Admin' fails to connect to OpenLDAP on port 636
I run an OpenLDAP server on (2.6.3_2) FreeBSD.
I works fine with FreeBSD/Linux clients like PAM/NSS/NextCloud over LDAPS port 636.(With a Let's Encrypt certificate)
I can't get it to work together ...
2
votes
1
answer
432
views
Possible to parse ldapsearch output?
I have an ldapsearch query to pull some data of an email system, I am trying to parse the data into something I can analyze in a table/flat file, and generate reports on the accounts.
Sample of the ...
0
votes
1
answer
241
views
Apache 2.4 LDAP "password mismatch" but password is correct
I run apache2.4 on debian and LDAP-Auth tells me "password mismatch" but I am very sure I use correct passwords (tested multiple users).
I also asked chat-gpt and it told me maybe my ...
0
votes
0
answers
149
views
OpenLDAP client config, cannot log in to the server
I'm trying to set up OpenLDAP on a Ubuntu 22.04 to authenticate against a central server running Ubuntu Server 20.04, however, i have found some issues i cannot solve on my own.
The server itself is ...
0
votes
0
answers
43
views
adding vlv(virtual list view) extension to openLDAP (LDAP) Server
Im currently working with LDAPRecord library in a Laravel project. I want to use a pagination function but it's required having virtual list view (vlv) extension to my ldap server
, I dont quite know ...
0
votes
0
answers
43
views
Project specific LDAP authorization for SVN
I am using Apache 2.4 on Ubuntu 14.04 and SVN 1.8.8.
I have installed SVN server and created a number of repositories (one per client). For each team working for each client, I added configurations ...
0
votes
0
answers
26
views
I've got an error while adding an olcOverlay
here is my ldif file :
dn: olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config
objectClass: olcSyncProvConfig
olcOverlay: syncpro
then I enter ldapadd -Y EXTERNAL -H ldapi:// -f overlay.ldif
and here ...
0
votes
0
answers
106
views
Is it possible to add memberUid as bind DN
Can we use memberUid for bind dn string.
Here is my sample ldif file
dn: cn=posixgroup,dc=memtesting,dc=com
objectClass: top
objectClass: posixGroup
gidNumber: 1001
cn: posixgroup
memberUid: posixuser
...
0
votes
1
answer
3k
views
How does userPassword attribute work in LDAP?
I'm just learning about LDAP, and there's something I don't quite understand.
When we create users in a directory, we define their password using the userPassword. When we use for example the {SSHA} ...
0
votes
1
answer
34
views
OpenLDAP + Moodle, member of groups
the teachers in my OpenLDAP are in cn=teachers,ou=groups,dc=school,dc=de
the course creator context in my Moodle installation should then be the same if I am not mistaken. If I query ldap
BINDUSER=&...
0
votes
1
answer
343
views
ldap_group_search_base is not working as intented
I've used the below-given sssd.conf file to authorize the users to a server. The issue is some users who are not listed under the DN: cn=authorized,ou=rona,ou=servers,ou=groups,dc=yolo,dc=com still ...
0
votes
1
answer
127
views
What are all the certificates mandatory to be provide while setting TLSVerifyClient option to demand
In my case, I had set TLSVerifyClient to demand. I couldn't be able to establish a connection While providing TLSCACertificateFile alone.
While setting the TLSVerifyClient option demand is it ...
0
votes
0
answers
15
views
Specific olcAccess does not work for an OU in LDAP
On my OpenLDAP server, I would like the accounts in my "ou=partners" OU to have "read" permissions to all objects in "ou=abos". Here is the tree of my DIT :
[ditTree][1]
...
0
votes
0
answers
164
views
Samba Domain with readonly Active Directory and OpenLDAP
I have a working Samba Windows Domain getting its users from an OpenLDAP database, but now I need to get these users from an Active Directory database. I have full access to the OpenLDAP database but ...
0
votes
1
answer
72
views
Strange hash lengths in OpenLDAP
I recently went through all the hashes stored in an LDAP instance I have access to and noticed something strange that I can't explain.
Despite all the hashes being marked as SSHA (which should be ...