LDAP - Revision history

Tony: /* FAQ */

2023-06-14T09:32:50Z

FAQ

← Older revision		Revision as of 09:32, 14 June 2023
Line 83:		Line 83:

	ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config		ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config

			=== LdapErr: DSID-0C090AE1, comment: In order to perform this operation a successful bind must be completed on the connection. ===

			login?


	=== ldap_sasl_interactive_bind_s: Unknown authentication method (-6) ===		=== ldap_sasl_interactive_bind_s: Unknown authentication method (-6) ===

Tony at 07:31, 20 May 2022

2022-05-20T07:31:53Z

← Older revision		Revision as of 07:31, 20 May 2022
Line 31:		Line 31:
	*[http://moduli.net/sysadmin/sarge-ldap-auth-howto.html http://moduli.net/sysadmin/sarge-ldap-auth-howto.html]		*[http://moduli.net/sysadmin/sarge-ldap-auth-howto.html http://moduli.net/sysadmin/sarge-ldap-auth-howto.html]
	*[http://www.zytrax.com/books/ldap/ch6/slapd-config.html#intro OpenLDAP using OLC (cn=config)]		*[http://www.zytrax.com/books/ldap/ch6/slapd-config.html#intro OpenLDAP using OLC (cn=config)]
			*[https://www.ibm.com/support/pages/how-test-ca-certificate-and-ldap-connection-over-ssltls LDAP and SSL certificates]
	== Access control ==		== Access control ==

Tony: /* FAQ */

2022-03-25T10:15:52Z

FAQ

← Older revision		Revision as of 10:15, 25 March 2022
Line 219:		Line 219:



			== php and ldap ==
			===ignore certificates===
			LDAPTLS_REQCERT=never
			related to TLS_REQCERT in ldap.conf, so see
			man ldap.conf


	== check TLS connection ==		== check TLS connection ==

Tony at 09:42, 25 March 2022

2022-03-25T09:42:13Z

← Older revision		Revision as of 09:42, 25 March 2022
Line 50:		Line 50:
	*[http://www.redhat.com/docs/manuals/dir-server/deploy/7.1/deployTOC.html Red Hat Directory Server documentation, worth reading]		*[http://www.redhat.com/docs/manuals/dir-server/deploy/7.1/deployTOC.html Red Hat Directory Server documentation, worth reading]
	*[http://docs.sun.com/source/816-6064-10/ErrorMsg.doc7.html Error messages]		*[http://docs.sun.com/source/816-6064-10/ErrorMsg.doc7.html Error messages]

			= Client configuration =
			In /etc/openldap/ldap.conf


	== Ldapsearch ==		== Ldapsearch ==

Tony at 15:01, 17 March 2022

2022-03-17T15:01:05Z

← Older revision		Revision as of 15:01, 17 March 2022
Line 54:		Line 54:

	*[https://theitbros.com/ldapsearch/ https://theitbros.com/ldapsearch/]		*[https://theitbros.com/ldapsearch/ https://theitbros.com/ldapsearch/]
			*[[ldapsearch]]

Tony at 14:02, 1 February 2022

2022-02-01T14:02:16Z

← Older revision		Revision as of 14:02, 1 February 2022
Line 56:		Line 56:




	= FAQ =		= FAQ =
Line 87:		Line 88:

	=== LdapErr: DSID-0C09127F, comment: TLS or SSL already in effect, data 0, v3839 ===		=== LdapErr: DSID-0C09127F, comment: TLS or SSL already in effect, data 0, v3839 ===

			===TLS certificate verification: Error, unable to get local issuer certificate===


	== add indexes ==		== add indexes ==

Tony at 07:26, 20 October 2021

2021-10-20T07:26:56Z

← Older revision		Revision as of 07:26, 20 October 2021
Line 17:		Line 17:
	= Tutorials and docs =		= Tutorials and docs =

	*[https://ldapwiki.com/wiki/ LDAP wiki]		*[https://ldapwiki.com/wiki/ LDAP wiki]
	*[[Pam-ldap\|Pam-ldap]]		*[[Pam-ldap\|Pam-ldap]]
	*[http://www.zytrax.com/books/ldap/ http://www.zytrax.com/books/ldap/]		*[http://www.zytrax.com/books/ldap/ http://www.zytrax.com/books/ldap/]
Line 55:		Line 55:
	*[https://theitbros.com/ldapsearch/ https://theitbros.com/ldapsearch/]		*[https://theitbros.com/ldapsearch/ https://theitbros.com/ldapsearch/]



	= FAQ =		= FAQ =
Line 83:		Line 84:


	==ldapsearch==		== ldapsearch ==
	~~=== LdapErr: DSID-0C09127F, comment: TLS or SSL already in effect, data 0, v3839=~~==

			=== LdapErr: DSID-0C09127F, comment: TLS or SSL already in effect, data 0, v3839 ===

	== add indexes ==		== add indexes ==
Line 222:		Line 223:
	or		or

	openssl s_client -starttls ldap hostname:636		openssl s_client -starttls ldap -connect hostname:636

	=== ldap_start_tls: Connect error (-11) ===		=== ldap_start_tls: Connect error (-11) ===

Tony at 11:22, 12 July 2021

2021-07-12T11:22:22Z

← Older revision		Revision as of 11:22, 12 July 2021
Line 54:		Line 54:

	*[https://theitbros.com/ldapsearch/ https://theitbros.com/ldapsearch/]		*[https://theitbros.com/ldapsearch/ https://theitbros.com/ldapsearch/]


	= FAQ =		= FAQ =
Line 81:		Line 82:



			==ldapsearch==
			=== LdapErr: DSID-0C09127F, comment: TLS or SSL already in effect, data 0, v3839===


	== add indexes ==		== add indexes ==
Line 203:		Line 208:
	You edited config file instead of using ldapmodify. This error will go away once you used ldapmodify on it.		You edited config file instead of using ldapmodify. This error will go away once you used ldapmodify on it.



	== check TLS connection ==		== check TLS connection ==
Line 215:		Line 221:

	or		or

	openssl s_client -starttls ldap hostname:636		openssl s_client -starttls ldap hostname:636

Tony at 13:12, 16 March 2021

2021-03-16T13:12:29Z

← Older revision		Revision as of 13:12, 16 March 2021
Line 202:		Line 202:

	You edited config file instead of using ldapmodify. This error will go away once you used ldapmodify on it.		You edited config file instead of using ldapmodify. This error will go away once you used ldapmodify on it.


	== check TLS connection ==		== check TLS connection ==
Line 212:		Line 213:

	openssl s_client -connect hostname:636 -cert /etc/openldap/certs/clientcert.pem -CAfile /etc/openldap/certs/cacert.pem		openssl s_client -connect hostname:636 -cert /etc/openldap/certs/clientcert.pem -CAfile /etc/openldap/certs/cacert.pem

			or
			openssl s_client -starttls ldap hostname:636

	=== ldap_start_tls: Connect error (-11) ===		=== ldap_start_tls: Connect error (-11) ===

Tony at 09:54, 22 February 2021

2021-02-22T09:54:42Z

← Older revision		Revision as of 09:54, 22 February 2021
Line 1:		Line 1:

	'''L'''ightweight '''D'''irectory '''A'''ccess '''P'''rotocol		'''L'''ightweight '''D'''irectory '''A'''ccess '''P'''rotocol

	In [http://en.wikipedia.org/wiki/computer_networking computer networking], the '''Lightweight Directory Access Protocol''', or '''LDAP''' ("ell-dap"), is a [http://en.wikipedia.org/wiki/networking_protocol networking protocol] for querying and modifying [http://en.wikipedia.org/wiki/directory_service directory service]s running over [http://en.wikipedia.org/wiki/Internet_protocol_suite TCP/IP]. An LDAP directory usually follows the [http://en.wikipedia.org/wiki/X.500 X.500] model: it is a tree of entries, each of which consists of a set of named attributes with values. While some services use a more complicated "forest" model, the vast majority use a simple starting point for their database organization.		In [http://en.wikipedia.org/wiki/computer_networking computer networking], the '''Lightweight Directory Access Protocol''', or '''LDAP''' ("ell-dap"), is a [http://en.wikipedia.org/wiki/networking_protocol networking protocol] for querying and modifying [http://en.wikipedia.org/wiki/directory_service directory service]s running over [http://en.wikipedia.org/wiki/Internet_protocol_suite TCP/IP]. An LDAP directory usually follows the [http://en.wikipedia.org/wiki/X.500 X.500] model: it is a tree of entries, each of which consists of a set of named attributes with values. While some services use a more complicated "forest" model, the vast majority use a simple starting point for their database organization.

			An LDAP directory often reflects various political, geographic, and/or organizational boundaries, depending on the model chosen. LDAP deployments today tend to use [http://en.wikipedia.org/wiki/Domain_Name_System Domain Name System] (DNS) names for structuring the most simple levels of the hierarchy. Further into the directory might appear entries representing people, organizational units, printers, documents, groups of people or anything else which represents a given tree entry, or multiple entries.

			Its current version is LDAPv3. LDAPv3 is specified in a series of [http://en.wikipedia.org/wiki/IETF IETF] Standard Track [http://en.wikipedia.org/wiki/Request_for_Comments RFC]s as detailed in RFC 4510.

	An LDAP directory often reflects various political, geographic, and/or organizational boundaries, depending on the model chosen. LDAP deployments today tend to use [http://en.wikipedia.org/wiki/Domain_Name_System Domain Name System] (DNS)		= Interfaces =
	names for structuring the most simple levels of the hierarchy. Further into the directory might appear entries representing people, organizational units, printers, documents, groups of people or anything else which represents a given tree entry, or multiple entries.

	~~Its current version is LDAPv3. LDAPv3 is specified in a series of~~ [http://en.~~wikipedia~~.org/~~wiki~~/~~IETF IETF~~] ~~Standard Track~~ [http://en.~~wikipedia~~.~~org~~/~~wiki~~/~~Request_for_Comments RFC~~]~~s as detailed in RFC 4510.~~		*[http://directory.apache.org/studio/ Apache Directory Studio]
			*[http://lam.sourceforge.net/ LAM (LDAP Account Manager)]
			*[http://phpldapadmin.sourceforge.net phpldapadmin]
			*ldapvi

	=~~Interfaces~~=		= Tutorials and docs =
	*[http://directory.apache.org/studio/ Apache Directory Studio]
	*[http://lam.sourceforge.net/ LAM (LDAP Account Manager)]
	*[http://phpldapadmin.sourceforge.net phpldapadmin]
	*ldapvi

	~~=Tutorials and docs=~~		*[https://ldapwiki.com/wiki/ LDAP wiki]
	*[[Pam-ldap]]		*[[Pam-ldap\|Pam-ldap]]
	*http://www.zytrax.com/books/ldap/		*[http://www.zytrax.com/books/ldap/ http://www.zytrax.com/books/ldap/]
	*http://tuxick.net/ldap.html		*[http://tuxick.net/ldap.html http://tuxick.net/ldap.html]
	*http://ldapadministrator.com		*[http://ldapadministrator.com http://ldapadministrator.com]
	*[https://www.calmblue.net/blog/server/linux/openldap-server-on-debian-using-olc OpenLDAP server on Debian using OLC]		*[https://www.calmblue.net/blog/server/linux/openldap-server-on-debian-using-olc OpenLDAP server on Debian using OLC]
	*[http://thomas-howard.com/Reference/Articles/Apache+AD/ Apache Authentication with Active Directory]		*[http://thomas-howard.com/Reference/Articles/Apache+AD/ Apache Authentication with Active Directory]
	*[http://www.gentoo.org/doc/en/ldap-howto.xml LDAP authentication on Gentoo (slightly outdated)]		*[http://www.gentoo.org/doc/en/ldap-howto.xml LDAP authentication on Gentoo (slightly outdated)]
	*[[LDAP Replication]]		*[[LDAP_Replication\|LDAP Replication]]
	*[http://www.linuxtopia.org/online_books//network_administration_guides/ldap_administration/appendix-common-errors_Common_causes_of_LDAP_errors.html Common causes of LDAP errors]		*[http://www.linuxtopia.org/online_books//network_administration_guides/ldap_administration/appendix-common-errors_Common_causes_of_LDAP_errors.html Common causes of LDAP errors]
	*[http://www.oav.net/mirrors/LDAP-ObjectClasses.html Objectclasses]		*[http://www.oav.net/mirrors/LDAP-ObjectClasses.html Objectclasses]
	*[http://www.zytrax.com/books/ldap/ LDAP for Rocket Scientists]		*[http://www.zytrax.com/books/ldap/ LDAP for Rocket Scientists]
	*http://moduli.net/sysadmin/sarge-ldap-auth-howto.html		*[http://moduli.net/sysadmin/sarge-ldap-auth-howto.html http://moduli.net/sysadmin/sarge-ldap-auth-howto.html]
	*[http://www.zytrax.com/books/ldap/ch6/slapd-config.html#intro OpenLDAP using OLC (cn=config)]		*[http://www.zytrax.com/books/ldap/ch6/slapd-config.html#intro OpenLDAP using OLC (cn=config)]

	==Access control==		== Access control ==
	*[http://www.openldap.org/doc/admin24/access-control.html Access Control]
	*http://www.zytrax.com/books/ldap/ch6/#access
	*[http://www.linuxtopia.org/online_books/network_administration_guides/ldap_administration/slapdconf2_Access_Control.html OLC access control]

	~~==ldapmodify==~~		*[http://www.openldap.org/doc/admin24/access-control.html Access Control]
	*http://www.~~tldp~~.org/~~HOWTO~~/~~LDAP~~-~~HOWTO/utilities~~.html		*[http://www.zytrax.com/books/ldap/ch6/#access http://www.zytrax.com/books/ldap/ch6/#access]
	*[http://~~publib~~.~~boulder~~.~~ibm~~.com/~~infocenter~~/~~iseries~~/~~v5r3~~/~~index~~.~~jsp?topic=~~/~~rzahy~~/~~rzahydeleteobj~~.~~htm Delete an objectclass~~]		*[http://www.linuxtopia.org/online_books/network_administration_guides/ldap_administration/slapdconf2_Access_Control.html OLC access control]

			== ldapmodify ==

			*[http://www.tldp.org/HOWTO/LDAP-HOWTO/utilities.html http://www.tldp.org/HOWTO/LDAP-HOWTO/utilities.html]
			*[http://publib.boulder.ibm.com/infocenter/iseries/v5r3/index.jsp?topic=/rzahy/rzahydeleteobj.htm Delete an objectclass]



	= Links =		= Links =
Line 44:		Line 50:
	*[http://www.redhat.com/docs/manuals/dir-server/deploy/7.1/deployTOC.html Red Hat Directory Server documentation, worth reading]		*[http://www.redhat.com/docs/manuals/dir-server/deploy/7.1/deployTOC.html Red Hat Directory Server documentation, worth reading]
	*[http://docs.sun.com/source/816-6064-10/ErrorMsg.doc7.html Error messages]		*[http://docs.sun.com/source/816-6064-10/ErrorMsg.doc7.html Error messages]

	== Ldapsearch ==		== Ldapsearch ==
	*https://theitbros.com/ldapsearch/
			*[https://theitbros.com/ldapsearch/ https://theitbros.com/ldapsearch/]

	= FAQ =		= FAQ =
Line 70:		Line 77:

	=== ldap_sasl_interactive_bind_s: Unknown authentication method (-6) ===		=== ldap_sasl_interactive_bind_s: Unknown authentication method (-6) ===
	try adding "-x" to the ldapsearch,
			try adding "-x" to the ldapsearch,


Line 209:		Line 217:
	probably some cert missing		probably some cert missing

	=Keywords=		= Keywords =
	==rootdn==
			== rootdn ==

	The user/account with full access		The user/account with full access



			= Tools =

	~~=Tools=~~		*phpldapadmin
	*phpldapadmin		*ldapbrowser
	*ldapbrowser		*lam
	*lam		*shelldap
	*shelldap
	*ldapvi		*ldapvi