Questions tagged [openldap]
For questions about OpenLDAP Software, an open source implementation of the Lightweight Directory Access Protocol (LDAP).
192
questions
0
votes
0
answers
9
views
Missing ldapPublicKey on bitname/openldap
I have an openldap server running from truecharts/openldap, there I have ldapPublicKey:
ldapsearch -H ldap://10.1.5.5:389 -x -s base -b "cn=subschema" objectclasses|grep -i ldapPublicKey
...
- 99
2
votes
1
answer
32
views
Can not administering kerberos for a long time brick it?
I have this strange issue where a kerberos/openldap environment has gotten bricked. I can't add new users, computers, or other things to it, as everything I try results in various variations on ...
- 179
1
vote
0
answers
14
views
ldapsearch silently fails to connect to an AD LDAPS due to non-authentication of the AD LDAPS server
I have a certificate chain that is coming from a big company AD LDAP, i can check as follows :
$ openssl rehash tmp_cert_dir/
$ echo | openssl s_client -showcerts -connect 10.188.1.101:636 2</dev/...
- 1,243
0
votes
1
answer
24
views
Red Hat Directory Server and LDAP
So as the title suggests I have a Red Hat Directory Server with OpenLDAP installed. I also have Windows Active Directory (mixed network). I want to script creating new users on the Red Hat Side.
Now ...
- 1
0
votes
1
answer
34
views
How does kpasswd change password?
When you change password via kpasswd, does it change your password that is stored on the Kerberos server, or does it change your password that is stored in the OpenLDAP server?
- 135
0
votes
1
answer
36
views
Why does GNU sed prepend/append non matching line content to the command executed with the 'e' modifier
The following, which replaces textual user and group names with UIDs and GIDs, works correctly:
echo "uidNumber=root" | sed -E 's/((u|g)idNumber=)([^,+]+)/echo -n \1; id -\2 \3/eg'
uidNumber=...
0
votes
0
answers
242
views
How to configure OpenLDAP with SSL as proxy for Active Directory with LDIF method
EDITED: As it seems nobody seems to really know how OpenLDAP works (beside their developers), I finally dropped it in favor of GLAuth, which is quite easier to set up, with a simple configuration file....
0
votes
0
answers
26
views
How to allow specific LDAP users to authenticate oracle linux servers?
$ sudo grep -v -E '^\s*(#|$)' /etc/openldap/ldap.conf
SASL_NOCANON on
uri ldap://ldap.local.{company}.com
base dc={company},dc=com
$ sudo grep -v -E '^\s*(#|$)' /etc/pam.d/sshd
auth ...
0
votes
1
answer
171
views
Cant login on PhpLdapAdmin using admin user
im trying to configure an LDAP using slapd and PhpLdapAdmin using the non-official version from github on my Ubuntu server. the slapd and phpldapadmin works perfectly but i have a problem while login ...
- 1
0
votes
1
answer
361
views
Getting "ldap_add: Server is unwilling to perform (53) additional info: no global superior knowledge" when trying to add new objectClass to openLDAP
I have created new schema which looks like this
attributetype ( 2.25.3236588
NAME 'x-candidateNumber'
DESC 'Candidate number'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4....
- 3
0
votes
1
answer
357
views
How to set loglevel in slapd.d?
I have set up openLDAP 2.4 on Debian 11, and I want to change a few parameters, like the loglevel and logfile, which appears to be really simple:
# man slapd.conf
SLAPD.CONF(5) ...
- 591
1
vote
0
answers
93
views
New LDAP user can't connect to [homes], but older one can?
My system:
# cat /etc/*release*
PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
NAME="Debian GNU/Linux"
VERSION_ID="11"
VERSION="11 (bullseye)"
VERSION_CODENAME=...
- 591
1
vote
0
answers
50
views
LDAP authentication: why are users still visible on clients after deleting on server?
I have setup OpenLDAP on a Debian 11 server, and configured a number of clients, mostly on Ubuntu 20.04 or 22.04. There are some things I don't understand - well, many, but what I'm concerned about ...
- 591
3
votes
1
answer
292
views
Set a service to run as account in LDAP with credentials
I feel like I am overlooking something obvious.
My goal is to run a systemd service with an LDAP service account at system startup. THAT WAY, if I disable the account in LDAP, then the next time the ...
- 249
0
votes
0
answers
206
views
What is the best way to make LDAP based TOTP only required in some cases?
I have a 2FA setup on my network for certain kinds of authentication, but not others. The way it currently works is a combination of pam_ldap for passwords, and pam_oath for TOTP. PAM is configured in ...
- 5,384
1
vote
1
answer
124
views
LDAP Account Manager: Default profile?
I have installed OpenLDAP on Debian 11 as well as LDAP Account Manager 8.2, which seems to work well, but I have a question: On my login page, it says No default profile set. Please set it in the ...
- 591
0
votes
1
answer
216
views
how to re-install LDAP client in Debian?
I have a system with Debian 11, and want to experiment with setting it up as an LDAP client for user authentication, following this: https://linuxhint.com/configure-ldap-client-debian/. However, about ...
- 591
0
votes
1
answer
518
views
File server for Windows & Linux clients with LDAP authentication
I am facing an issue with implementation planning,
currently using LDAP server & NFS
clients are mixed of windows & Linux, I need to implement a file sharing solution that will cater both ...
- 333
1
vote
1
answer
116
views
How to add utility ldapsearch to yocto image?
I have successfully added the recipe openldap to my yocto-base Linux distribution, by the instruction:
IMAGE_INSTALL += "openldap"
After that I've created a path/to/my-layer/recipes-support/...
- 227
1
vote
1
answer
154
views
What LDAP server can I install only for test LDAP authentication?
I need to do practice with LDAP so I think that is a good idea to install a LDAP server only for do some test.
For client side I'm using a LInux Mint distribution and I have installed all the software ...
- 227
0
votes
1
answer
800
views
Installing OpenLDAP on RHEL 8 -- slapd.pid problem
I have compiled the current version of OpenLDAP on a fresh RHEL 8 instance and am setting it up with a signed SSL certificate. When I start slapd, I get unable to open pid file "/var/run/openldap/...
- 59
0
votes
1
answer
523
views
Moving OpenLDAP to new server -- getting olcBackend error
I'm finally moving from RHEL 7 to 8. I have a new 8.6 installation and I've compiled OpenLDAP 2.5.13 and done the basic setup. As I'm moving from an existing OpenLDAP instance, I exported my LDAP ...
- 59
0
votes
0
answers
429
views
LDAP Entry-Adding/Installation Error "ldap_bind: Invalid credentials (49)"
I am new to LDAP and am trying to install it for a computer cluster. I have been going through this technical guide https://www.openldap.org/doc/admin26/quickstart.html.
I have reached step 11 and am ...
0
votes
1
answer
175
views
Trying to install OpenLDAP with TLS
I have OpenLDAP set up with a GoDaddy SSL certificate installed. A non-secure LDAP search works fine. But when I do this: ldapsearch -x -b dc=yln,dc=info -Z, I get this:
ldap_start_tls: Connect error (...
- 59
0
votes
1
answer
275
views
Supplying multiple names in a single olcRefintAttribute value is unsupported and will be disallowed in a future version
Since a few time with OpenLDAP 2.6.2 on AlpineLinux 3.15, running the slapcat command generates this warning:
Supplying multiple names in a single olcRefintAttribute value is unsupported and will be ...
- 139
8
votes
2
answers
2k
views
Why does LibreOffice (at least as packaged for Debian) depend on libldap?
The Debian package libreoffice-core (which is described in the Debian repositories as containing " the architecture-dependent core files of LibreOffice," and which is itself a dependency for ...
- 197
1
vote
0
answers
71
views
Freebsd Common User Access Management (tried with OpenLDAP, not working) (Open to other suggestions)
What I have are a large number of servers (all freebsd). I need to build a common user access management for it (as new developers are joining, want to add their access details on 1 server, and no ...
0
votes
1
answer
47
views
smbldap-useradd: what are the different addresses for?
smbldap-useradd has some parameters to specify addresses for the user:
# smbldap-useradd --help | grep -i addr
-M e-mail address (comma separated)
-O localMailAddress (comma separated)
-T ...
- 568
2
votes
1
answer
54
views
LDAP client mixing up credentials
I have installed openLDAP using this https://www.techrepublic.com/article/how-to-install-openldap-and-phpldapadmin-on-ubuntu-server-20-04/on a Ubuntu 20.04 Serverand Ubuntu 20.04 Desktop has a client ...
- 31
0
votes
1
answer
160
views
baseDN on ldapsearch vs ldapadd
I am learning to use OpenLDAP and I can not understand why you need to specify a base dn to search in the ldap tree but you do not need it in order to add stuff
ldapsearch -x -b "dc=foo,dc=local&...
- 21
0
votes
1
answer
602
views
How it comes that ldapsearch output can't be piped
ldapsearch always outputs an authentication message with every query at the beginning:
SASL/GSS-SPNEGO authentication started
SASL username: user.princip[email protected]
SASL SSF: 56
SASL data security ...
- 1
0
votes
1
answer
315
views
Weird linking issue with libldap using cmake
I am trying to build SimGear from the FlightGear project using the download_an_compile.sh script (which uses CMake to build the binaries). The build went fine so far, but when the script tried linking ...
- 99
0
votes
1
answer
497
views
symbol lookup error: ldapdelete: undefined symbol: ldap_pvt_conf_option
I'am trying to delete an entry from my LDAP database and it works fine, but for some reason after Linux update I am getting the below error;
symbol lookup error: ldapdelete: undefined symbol:
...
- 1
0
votes
1
answer
158
views
Where to find reference of all/common ObjectClasses of ldap using their English names not OID numbers?
I know the following questions could be naive, but I an ldap beginner and tried searching but i didn't find what am looking for exactly
I am trying to get a reference about ldap object classes and ...
- 177
0
votes
1
answer
319
views
I have Some Problem retrieving information from ldap
I have installed openldap from symas on centos 8,
I modified /etc/openldap/slapd.d/cn=config/olcDatabase={2}mdb.ldif
by adding the following
olcRootPW: {SSHA}......etc line to make a password
...
- 177
0
votes
0
answers
137
views
Does google authenticator supports time step more than 30sec?
I have generated a QR from here https://freeotp.github.io/qrcode.html defining a time period of 60sec and while scanning QR-Code through google authenticator app it uses the default time step of only ...
- 341
1
vote
0
answers
393
views
CentOS 8, SSSD, LDAP and yubikey PIV authentication problem
Trying to set up the following
Authentication with Yubikey (PIV) with LDAP.
Already got the authentication with Yubikey and local users working with SSSD. Also got the LDAP working with SSSD but not ...
3
votes
1
answer
856
views
openldap: is possible to force the starttls from a client?
I don't explain how to configure tls-ldap on server, on google there is a lot of stuff to configure it(create tls certs, create ldif, import ldif, try ldapsearch -ZZ, etc..).
Is also easy to force the ...
- 12.1k
0
votes
1
answer
250
views
SOGo use users name for identity from LDAP
I would like to make SOGo use the users full name instead of the username as the identity.
User authentication is done via the pam-ldapd module through a remote server. But somehow I can't figure out, ...
- 161
1
vote
1
answer
575
views
Sync OpenLDAP - Active Directory
Today, we have an OpenLDAP that works very well.
We would like to create a Domain & AD (Windows) that would be populated and synchronized by OpenLDAP.
I could read some topics for reverse ...
- 11
0
votes
2
answers
288
views
Restrict ldap and linux users to only use ssh?
I have a RHEL 7 server that we are using as a jumpbox to authenticate to all servers. Typically users will login to jumpserver(rhel 7) from local machine and then login to their respective virtual ...
- 101
0
votes
1
answer
121
views
CentOS OpenLdap Apache PHP and MediaWiki
So I have been trying to setup a "Free" wiki that integrates with my "Free" version of Active Directory (aka. OpenLdap), so I can get a super simple setup together for a dev group, ...
0
votes
1
answer
315
views
dovecot effective uid when authenticating against ldap
Setting up a dovecot instance which uses openldap as backend for user accounts (under Ubuntu Bionic). The user mailboxes look like this
# find /home/virtual_mail/emont/ -type d -ls
2228468 4 ...
2
votes
0
answers
328
views
How to get ldap/nss/pam to accept usernames beginning with a number: pam_systemd(gdm-password:session): Failed to get user record: Invalid argument
How to get my ldap/pam/nss stack to accept usernames beginning with a number?
I am installing LDAP/NSS/PAM with the instructions provided by debian. I have tried both libnss-ldap, and libnss-ldapd
...
- 1,187
1
vote
1
answer
5k
views
What is the difference between freeipa and openldap [closed]
What is the difference between openldap and freeipa. Aren’t they same? What is the main work of them and how do they are interconnected or they are separate thing?
0
votes
1
answer
198
views
How to query openLDAP servers cert?
From the "service sssd status" we can see:
Could not start TLS encryption. TLS: hostname does not match CN in
peer certificate
But how could we query the cert to know, that it is really some ...
- 107
0
votes
1
answer
90
views
Securing OpenLDAP on Debian Buster
would this still be the way of securing an OpenLDAP server on Debian 9 (Stretch) and 10 (Buster). See Section 11.7.3.3. Securing LDAP Data Exchanges. Unfortunately the Debian manual seems to always be ...
- 61
1
vote
1
answer
2k
views
slapcat -n 1 -l users.ldif slapcat: database doesn't support necessary operations
I am getting the error
slapcat: database doesn't support necessary operations.
When trying to run the command
slapcat -n 1 -l users.ldif
replacing the 1 for a 0 works and to my understanding that ...
- 705
0
votes
1
answer
4k
views
OpenLDAP TLS error: TLS negotiation failure
I'm trying to setup OpenLDAP on kubernetes via the helm chart.
It deploys correctly and I am able to access the server over port 389 (unencrypted) both locally from within the container and from ...
1
vote
0
answers
129
views
Which users/groups should be migrated to LDAP?
On a modern Debian distro, we're migrating towards centralized authentication using OpenLDAP - rather than using the normal Unix authentication (pam_unix(8), /etc/passwd). The reason for this is to ...
- 381