Questions tagged [openldap]

For questions about OpenLDAP Software, an open source implementation of the Lightweight Directory Access Protocol (LDAP).

Filter by
Sorted by
Tagged with
8 votes
2 answers
1k views

Why does LibreOffice (at least as packaged for Debian) depend on libldap?

The Debian package libreoffice-core (which is described in the Debian repositories as containing " the architecture-dependent core files of LibreOffice," and which is itself a dependency for ...
user avatar
1 vote
0 answers
22 views

Freebsd Common User Access Management (tried with OpenLDAP, not working) (Open to other suggestions)

What I have are a large number of servers (all freebsd). I need to build a common user access management for it (as new developers are joining, want to add their access details on 1 server, and no ...
user avatar
0 votes
1 answer
21 views

smbldap-useradd: what are the different addresses for?

smbldap-useradd has some parameters to specify addresses for the user: # smbldap-useradd --help | grep -i addr -M e-mail address (comma separated) -O localMailAddress (comma separated) -T ...
user avatar
  • 548
2 votes
1 answer
32 views

LDAP client mixing up credentials

I have installed openLDAP using this https://www.techrepublic.com/article/how-to-install-openldap-and-phpldapadmin-on-ubuntu-server-20-04/on a Ubuntu 20.04 Serverand Ubuntu 20.04 Desktop has a client ...
user avatar
0 votes
1 answer
38 views

baseDN on ldapsearch vs ldapadd

I am learning to use OpenLDAP and I can not understand why you need to specify a base dn to search in the ldap tree but you do not need it in order to add stuff ldapsearch -x -b "dc=foo,dc=local&...
user avatar
  • 21
0 votes
1 answer
138 views

How it comes that ldapsearch output can't be piped

ldapsearch always outputs an authentication message with every query at the beginning: SASL/GSS-SPNEGO authentication started SASL username: user.principal@DOMAIN.NAME SASL SSF: 56 SASL data security ...
user avatar
  • 1
0 votes
0 answers
23 views

openldap authentication with sssd redhat 7

I did setup an ldap server with a tls certificate. (auth-001) I have a test machine (auth-002) that successfully uses the openldap to authenticate. Therefore the server works fine I did setup a second ...
user avatar
  • 1
0 votes
0 answers
16 views

modrdn very slow on OpenLDAP 2.4.53

The slapd thread runs very hot and slow when processing a modrdn, nearly at 100% CPU usage and it takes anywhere from 3-6 minutes. Our provider is RHEL 7, and has 2 virtual CPUs and 8 GB memory. Based ...
user avatar
0 votes
0 answers
35 views

How to add OU in LDAP?

I have done LDAP setup on ubuntu, using apt install slapd ldap-utils after doing all setup/configuration, added one test user also and here I get: $ ldapsearch -x -b "dc=param,dc=co,dc=in" # ...
user avatar
0 votes
1 answer
96 views

Weird linking issue with libldap using cmake

I am trying to build SimGear from the FlightGear project using the download_an_compile.sh script (which uses CMake to build the binaries). The build went fine so far, but when the script tried linking ...
user avatar
0 votes
1 answer
258 views

symbol lookup error: ldapdelete: undefined symbol: ldap_pvt_conf_option

I'am trying to delete an entry from my LDAP database and it works fine, but for some reason after Linux update I am getting the below error; symbol lookup error: ldapdelete: undefined symbol: ...
user avatar
  • 1
0 votes
1 answer
63 views

Where to find reference of all/common ObjectClasses of ldap using their English names not OID numbers?

I know the following questions could be naive, but I an ldap beginner and tried searching but i didn't find what am looking for exactly I am trying to get a reference about ldap object classes and ...
user avatar
0 votes
1 answer
85 views

I have Some Problem retrieving information from ldap

I have installed openldap from symas on centos 8, I modified /etc/openldap/slapd.d/cn=config/olcDatabase={2}mdb.ldif by adding the following olcRootPW: {SSHA}......etc line to make a password ...
user avatar
0 votes
0 answers
30 views

Does google authenticator supports time step more than 30sec?

I have generated a QR from here https://freeotp.github.io/qrcode.html defining a time period of 60sec and while scanning QR-Code through google authenticator app it uses the default time step of only ...
user avatar
  • 341
1 vote
0 answers
195 views

CentOS 8, SSSD, LDAP and yubikey PIV authentication problem

Trying to set up the following Authentication with Yubikey (PIV) with LDAP. Already got the authentication with Yubikey and local users working with SSSD. Also got the LDAP working with SSSD but not ...
user avatar
3 votes
1 answer
467 views

openldap: is possible to force the starttls from a client?

I don't explain how to configure tls-ldap on server, on google there is a lot of stuff to configure it(create tls certs, create ldif, import ldif, try ldapsearch -ZZ, etc..). Is also easy to force the ...
user avatar
  • 11k
0 votes
1 answer
124 views

SOGo use users name for identity from LDAP

I would like to make SOGo use the users full name instead of the username as the identity. User authentication is done via the pam-ldapd module through a remote server. But somehow I can't figure out, ...
user avatar
1 vote
1 answer
370 views

Sync OpenLDAP - Active Directory

Today, we have an OpenLDAP that works very well. We would like to create a Domain & AD (Windows) that would be populated and synchronized by OpenLDAP. I could read some topics for reverse ...
user avatar
0 votes
2 answers
180 views

Restrict ldap and linux users to only use ssh?

I have a RHEL 7 server that we are using as a jumpbox to authenticate to all servers. Typically users will login to jumpserver(rhel 7) from local machine and then login to their respective virtual ...
user avatar
  • 101
0 votes
1 answer
79 views

CentOS OpenLdap Apache PHP and MediaWiki

So I have been trying to setup a "Free" wiki that integrates with my "Free" version of Active Directory (aka. OpenLdap), so I can get a super simple setup together for a dev group, ...
user avatar
0 votes
1 answer
172 views

dovecot effective uid when authenticating against ldap

Setting up a dovecot instance which uses openldap as backend for user accounts (under Ubuntu Bionic). The user mailboxes look like this # find /home/virtual_mail/emont/ -type d -ls 2228468 4 ...
user avatar
1 vote
0 answers
195 views

How to get ldap/nss/pam to accept usernames beginning with a number: pam_systemd(gdm-password:session): Failed to get user record: Invalid argument

How to get my ldap/pam/nss stack to accept usernames beginning with a number? I am installing LDAP/NSS/PAM with the instructions provided by debian. I have tried both libnss-ldap, and libnss-ldapd ...
user avatar
  • 1,137
1 vote
1 answer
3k views

What is the difference between freeipa and openldap [closed]

What is the difference between openldap and freeipa. Aren’t they same? What is the main work of them and how do they are interconnected or they are separate thing?
user avatar
0 votes
1 answer
131 views

How to query openLDAP servers cert?

From the "service sssd status" we can see: Could not start TLS encryption. TLS: hostname does not match CN in peer certificate But how could we query the cert to know, that it is really some ...
user avatar
0 votes
1 answer
53 views

Securing OpenLDAP on Debian Buster

would this still be the way of securing an OpenLDAP server on Debian 9 (Stretch) and 10 (Buster). See Section 11.7.3.3. Securing LDAP Data Exchanges. Unfortunately the Debian manual seems to always be ...
user avatar
  • 61
1 vote
1 answer
1k views

slapcat -n 1 -l users.ldif slapcat: database doesn't support necessary operations

I am getting the error slapcat: database doesn't support necessary operations. When trying to run the command slapcat -n 1 -l users.ldif replacing the 1 for a 0 works and to my understanding that ...
user avatar
  • 645
0 votes
1 answer
2k views

OpenLDAP TLS error: TLS negotiation failure

I'm trying to setup OpenLDAP on kubernetes via the helm chart. It deploys correctly and I am able to access the server over port 389 (unencrypted) both locally from within the container and from ...
user avatar
1 vote
0 answers
86 views

Which users/groups should be migrated to LDAP?

On a modern Debian distro, we're migrating towards centralized authentication using OpenLDAP - rather than using the normal Unix authentication (pam_unix(8), /etc/passwd). The reason for this is to ...
user avatar
0 votes
1 answer
706 views

failed to start openldap deamon

I have installed openldap server on a server with redhat7.7 when I start it, I get an error. I get the following #systemctl status slapd.service ● slapd.service - OpenLDAP Server Daemon Loaded:...
user avatar
  • 165
1 vote
0 answers
229 views

OpenLDAP Cluster

Trying to implement an OpenLDAP cluster, I already managed to set up the two backend LDAP servers in mirroring mode. The application (iRedMail) using the LDAP service is running on the same systems ...
user avatar
  • 11
3 votes
1 answer
11k views

OpenLDAP v2.4 enable logging

I have openldap v 2.4 running on centos7 and working but i cannot get it to log anything. I have tried adding the below line to the rsyslog.conf file but i still do not get any log file. LOCAL4.* ...
user avatar
  • 645
0 votes
1 answer
158 views

Ideal way to restrict querying of sudoers ldap configuration by anonymous users

I configured sudoers ldap (with openldap as backend LDAP) using the instruction provided from the official sudoers website. (link) Also restricted /etc/sudo-ldap.conf with 600 root:root permissions ...
user avatar
2 votes
1 answer
278 views

sudo-ldap works with !authenticate only

I'm trying to setup sudo-ldap in a clean CentOS 7 docker environment. I've successfully setup sssd and PAM authentication, and it works. However, sudo-ldap works only if !authenticate is set: dn: cn=...
user avatar
  • 51k
1 vote
1 answer
4k views

Trying to remove OpenLDAP: error trying to remove systemd which is protected

After yum remove openldap I get two errors: error trying to remove "systemd" which is protected and error trying to remove "yum" which is protected On the first, I found this: https://access....
user avatar
2 votes
2 answers
577 views

Restricting openldap ldapsearch on attributes

I have the following query against my directory: ldapsearch -x -H ldaps://example.com -D "cn=gitlab,ou=Service Accounts,dc=example,dc=com" -w foobar -b "ou=Persons,dc=example,dc=com" With the ...
user avatar
  • 403
3 votes
1 answer
7k views

Add organisational unit (ou) to organisation (o) in OpenLDAP

On a Debian Buster installation I have just installed the OpenLDAP server slapd with: ~$ sudo apt install slapd ldap-utils ~$ sudo dpkg-reconfigure slapd On its setup with default options I was ...
user avatar
  • 516
0 votes
1 answer
246 views

yum + dependencies errors

during yum installation , we get the following dependencies errors Error: Package: openldap-2.4.40-8.el7.i686 (@local) Requires: libplds4.so Removing: nspr-4.10.8-2.el7_1.i686 (@...
user avatar
  • 11.1k
1 vote
0 answers
31 views

OpenLDAP cluster: deletion of an entry is not replicated

We have an OpenLDAP 2.4 cluster of three nodes configured in multi-master and accessed through a VIP in round-robin. The three machines run RHEL7. We noticed that deletion of an entry (done from a ...
user avatar
  • 26k
0 votes
1 answer
229 views

openldap 2.4.44. error "-D previously specified"

I try to recursively delete our third DIT from our ldap root DSE as it is not needed anymore but I get in our customer's environment the following error: host:~# ldapdelete -x -W -D cn=admin,cn=...
user avatar
  • 11
1 vote
0 answers
68 views

Setup OpenLdap on Oracle Linux 6

I am currently trying to setup an openldap server on an Oracle Linux 6 VM (VirtualBox). Packagemanager yum installed openldap version 2.4.40-16. Following this setup guide: https://docs.oracle.com/cd/...
user avatar
  • 119
0 votes
1 answer
238 views

How to create user and group with specific id in directory389

Since I never worked with 389-ds, I am gonna ask probably stupid question. How can I create group with gid=557, and create user which would have uid=135 that is associated with gid=557? For local is ...
user avatar
1 vote
1 answer
26 views

How I can create accounts with command lines for my OpenLDAP server?

I'm in a Docker, in a VM (Ubuntu Serv). I have created a OpenLDAP server. I want to know simply : how to create groups and users. My DIT tree : dc=company,dc=com ou=group1 ou=group2 ou=group3 ou=...
user avatar
  • 13
0 votes
1 answer
56 views

Use LDAP Server to log into itself

I have an LDAP server (running 18.04LTS) and a bunch of Linux Ubuntu clients. LDAP works fine and we're just using it to authenticate a couple users. My question is as follows. I'd like to use the ...
user avatar
  • 585
-1 votes
3 answers
624 views

Start from scratch LDAP server CentOS

I am trying to set up a LDAP authentication server but I have messed too much with it, and I would like to start from scratch its configuration without reinstalling the OS because I have other stuff ...
user avatar
0 votes
1 answer
352 views

LDAP per-user overrides

I'm using openldap + nslcd to connect to a LDAP server for authentication of some users (these users would want their passwords and most of their configuration shared over many devices). I don't ...
user avatar
  • 11.9k
0 votes
0 answers
302 views

Allow sudo su - only to one user

Allow sudo su - on visudo only to one or some users of a group that access by ldap For example, I have visually defined the following: % dev ALL = (ALL) ALL What I need is that only some users or ...
user avatar
2 votes
2 answers
372 views

Set $PATH as OpenLDAP attribute

I need to set $PATH for OpenLDAP users (CentOS6/7). Not in .profile, not in .bashrc on client machine, but as attribute in LDAP on the LDAP server so it is set whenever the user logs onto any host via ...
user avatar
2 votes
0 answers
423 views

How to tell Kerberos where to find the root certificate for LDAP with TLS?

I run two Debian servers with MIT Kerberos and OpenLDAP backend. I would like to enforce TLS and encrypt replication. So I created and added certificates… dn: cn=config changetype: modify add: ...
user avatar
  • 338
2 votes
1 answer
8k views

ldap users unable to ssh to the server

I have configured ldap local server running centos 7, using this article: https://www.itzgeek.com/how-tos/linux/centos-how-tos/step-step-openldap-server-configuration-centos-7-rhel-7.html. Now my ...
user avatar
1 vote
1 answer
2k views

How to determine cipher in use when using ldapsearch?

I'm trying to debug an LDAPS connection from Ubuntu 14.04 to some sort of VIP. There are 6 nodes behind the VIP. The connection only succeeds "sometimes". A wireshark log shows the failing connections ...
user avatar