Michael Ströder
  • Member for 3 years, 6 months
  • Last seen this week
How can Samba be configured to use LDAP for authentication only?
5 votes

I assume that you want to run Samba in simple WinNT-compatible domain controller mode, not the full Active Directory mode. First you have to understand that SMB authentication is based on a NTLM ...

View answer
ldaps SRV resolution not working
Accepted answer
3 votes

Probably not the answer you wanted to get: RFC 2782 specifies the use of DNS SRV RRs for LDAP. At that time IETF's general recommendation was to enable TLS encrypted data transmission on the same port ...

View answer
How can I filter one attribute in ldapsearch that starts with the same name of another?
Accepted answer
3 votes

In LDAP you can add so-called descriptions to attribute names separated by semicolon. The interpretation of these descriptions can vary depending on the description. Thus cryptodata and cryptodata;...

View answer
Trying to connect to LDAPS (Windows active directory) but keep receiving Verify return code: 20 (unable to get local issuer certificate) error
3 votes

I assume that you've received a file containing single root CA cert to validate the TLS server cert. Make sure it's ASCII-armored base64-encoded (aka PEM). Normally a certificate authority would not ...

View answer
nslcd provide multiple values to gidNumber
3 votes

You have to add group entries to your LDAP server, using object class posixGroup each with own gidNumber attribute value. Then you add the users to these groups by adding the user to the member ...

View answer
In LDAP how does one know which OID arc to use in the object identifier?
Accepted answer
2 votes

Basically you can register an OID arc by getting an IANA enterprise ID in OID arc 1.3.6.1.4.1. For details see ldapwiki article: How To Get Your Own OID The enterprise numbers are publicly available ...

View answer
centos 8 - sssd configuration not fetching shadow contents for ldap user
2 votes

You don't need the shadow map when using sssd with LDAP backend. And for security reasons you definitely should not try to implement it. That's because password checks going through PAM are done by ...

View answer
OPENLDAP: how to set attributes as required?
2 votes

I need that all users have this attributes required: givenName, sn, cn, userPassword, displayName, o The relevant information in the subschema is the object class definition (see RFC 4512). So the ...

View answer
Enable PostgreSQL password login in pg_hba.conf grammatically
Accepted answer
2 votes

This would be a task for a decent config management implementing idempotent actions. For example ansible has a module called lineinfile for this particular job. I'm not sure whether it's the best ...

View answer
OpenLDAP : Confidentiality required for ldapmodify (ldapi://)
Accepted answer
1 votes

The default SSF value for LDAPI access is 71 which is below the default value of required minssf in attribute olcSaslSecProps. So instead of lowering the required SSF value you should set attribute ...

View answer
Is it possible to overlay local LDAP attributes on top of a replicated tree?
Accepted answer
1 votes

Take a look at overlay slapo-translucent.

View answer
Is Nscd required on the client for accessing an LDAP server without anonymous access?
1 votes

Is there a way to setup the system so that commands like getent work for normal users without relying on nscd running? Simply yes. nscd is just a caching demon for all NSS maps. In fact it does not ...

View answer
what does the ldapadd error: "additional info: objectClass: value #2invalid per syntax mean?
1 votes

You're trying to import an entry with an object class value not present in the subschema of your OpenLDAP server. A migration from MS AD to OpenLDAP is not possible without importing much of MS AD ...

View answer
Postgres authentication type "local" vs "host 127.0.0.1"
1 votes

Provided the database client supports it I would always prefer a connection over Unix domain socket for local connections for these reasons: You can protect access to the Unix domain socket by file ...

View answer
LDAP - Using multiple password
1 votes

The best solution is to have separate user account entries for several services. With such a setup you can apply different access control policies which can be audited more easily. Make sure to ...

View answer
Error message when setting up OpenLDAP on CentOS
1 votes

You are setting olcRootDN: cn=Manager,dc=example,dc=com There is no access control applied to the rootdn anyway. So you can remove all the clauses for cn=Manager,dc=example,dc=com.

View answer
ldap_add: Insufficient access (50)
Accepted answer
1 votes

LDAP result code insufficientAccess(50) means that the currently bound identity for the LDAP connection is not allowed to apply this particular modify operation. You did not provide any relevant ...

View answer
Virtual attributtes on OpenLdap
Accepted answer
1 votes

Generating attributes on-the-fly with OpenLDAP requires some code to be written server-side. This is most times not trivial. Normally this is done by implementing a so-called overlay in C which gives ...

View answer
Using SASL from CentOS 7 Host to Authenticate to Active Directory
1 votes

I vaguely remember that DIGEST-MD5 requires a specific option to be enabled for the user in the MMC. Honestly I see no value using SASL / DIGEST-MD5 today. Because to reach a sufficient security ...

View answer
OpenLdap inetOrgPerson object class attribute missing : "middlename"
1 votes

You have to define your own object class mentioning middleName as optional attribute in MAY clause (or MUST to make it mandatory). You have two options: Define a custom STRUCTURAL object class with ...

View answer
Update AD password from python-ldap code : INSUFF_ACCESS_RIGHTS
Accepted answer
1 votes

MS Active Directory distinguishes two different use-cases. Note: old_passwd_value and new_passwd_value both have to be the weird double-quoted low-ending UTF-16 encoding like in your code snippet. ...

View answer
ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)
Accepted answer
1 votes

Are you sure that your slapd is listening on LDAPI socket at all? It has to get started with `slapd -h "ldapi:// ldap://" to e.g. listen on Unix domain socket (default path name depends on build ...

View answer
Openldap enable ssl on replication
Accepted answer
1 votes

As a reference I post syncrepl directives used in Æ-DIR: olcSyncrepl: rid=001 provider=ldaps://ae-dir-p1.example.com bindmethod=sasl saslmech=EXTERNAL starttls=no tls_cert="/opt/ae-dir/...

View answer
slapd.d missing after installation
1 votes

The default location of configuration files is specified as build configuration option --sysconfdir. The default depends on value used for --prefix. $ ./configure --help --sysconfdir=DIR ...

View answer
OPENLDAP 2.4 , allow anonymous access only to get User Publickey
Accepted answer
1 votes

You have to grant at least search right to the search root entry dc=example,dc=com grant read right to pseudo-attribute entry of the entry containing the attribute PublicKey

View answer
SSL for OpenLDAP on Centos 7 not working
1 votes

The problem is that OpenLDAP server shipped with RHEL/CentOS is linked against Mozilla's libnss but the cert/key files you're using are only suitable for OpenSSL lib. libnss requires a passphrase in ...

View answer
How to use ssh client without local OS login
1 votes

I can do this with private ssh keys, but the problem is that the machine stores the private ssh keys in a user directory with user permissions, requiring the script to be run by a user. Not true. ...

View answer
LDAP TSL ldap_modify: error 80
Accepted answer
1 votes

If openldap is the system user for running OpenLDAP's slapd this ownership/permission listed in your question does not allow slap to read the server certificate and private key: ls -la /etc/apache2/...

View answer
Set ACL in OpenLDAP so that user can find its own entry from filtered subtree
Accepted answer
1 votes

Defining OpenLDAP ACLs is tricky. Most times ACL issues are caused by processing order of ACLs themselves and their who-clauses (by ...) and that ACLs implicitly end with by * none stopping the ...

View answer
Passwords not working after migration from /etc/shadow to LDAP
1 votes

When migrating password hashes from /etc/shadow to LDAP entries the correct LDAP password scheme to use is {CRYPT}, no matter what crypt(3) scheme is used. The disadvantage is that those password ...

View answer