LDAP: Difference between revisions

From DWIKI
mNo edit summary
Line 43: Line 43:
*[http://docs.sun.com/source/816-6064-10/ErrorMsg.doc7.html Error messages]
*[http://docs.sun.com/source/816-6064-10/ErrorMsg.doc7.html Error messages]


=FAQ=


==OLC==
= FAQ =
===Change OLC config===
 
== OLC ==
 
=== Change OLC config ===
 
  ldapmodify -Y EXTERNAL -H ldapi:///
  ldapmodify -Y EXTERNAL -H ldapi:///
  dn: cn=config
  dn: cn=config
Line 54: Line 57:
  CTRL + D
  CTRL + D


 
=== view configuration in OLC ===


===view configuration in OLC===
  slapcat -H "ldap:///cn=config??sub?(olcDatabase=*)"
  slapcat -H "ldap:///cn=config??sub?(olcDatabase=*)"
   
   
  ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config
  ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config


=== ldap_sasl_interactive_bind_s: Unknown authentication method (-6) ===
try adding "-x" to the ldapsearch,
 


== add indexes ==


==add indexes==
[http://forum.zentyal.org/index.php?topic=3006.0 http://forum.zentyal.org/index.php?topic=3006.0] [http://www.zytrax.com/books/ldap/apa/indeces.html http://www.zytrax.com/books/ldap/apa/indeces.html]
http://forum.zentyal.org/index.php?topic=3006.0
http://www.zytrax.com/books/ldap/apa/indeces.html


NOTE: there is no more need to run slapindex!!
NOTE: there is no more need to run slapindex!!


==additional info: structuralObjectClass: no user modification allowed==
== additional info: structuralObjectClass: no user modification allowed ==
 
use slapadd instead of ldapadd, while slapd is NOT running:
use slapadd instead of ldapadd, while slapd is NOT running:
 
  slapadd -v < ldap.ldif
  slapadd -v < ldap.ldif


==AttributeType inappropriate matching rule: "integerMatch"==
== AttributeType inappropriate matching rule: "integerMatch" ==
 
  duh
  duh


==Replace LDAP database==
== Replace LDAP database ==
 
  service slapd stop
  service slapd stop
  rm /var/lib/ldap/*
  rm /var/lib/ldap/*
Line 83: Line 94:
  service slapd start
  service slapd start


&nbsp;
== create a new database from ldif file ==


==create a new database from ldif file==
  slapadd -f dump.ldif
  slapadd -f dump.ldif
Remember to set rights to the db storage!
Remember to set rights to the db storage!


==add a record==
== add a record ==
ldapadd


==modify a record==
ldapadd
*http://docs.sun.com/source/816-6400-10/lmodify.html


== modify a record ==
*[http://docs.sun.com/source/816-6400-10/lmodify.html http://docs.sun.com/source/816-6400-10/lmodify.html]
&nbsp;


  ldapmodify -x -D "cn=admin, dc=bar, dc=com" -W << EOF
  ldapmodify -x -D "cn=admin, dc=bar, dc=com" -W << EOF
Line 102: Line 119:
  EOF
  EOF


Or  
Or
 
  ldapmodify -D "cn=admin,dc=bar,dc=com" -Y EXTERNAL -H ldapi:/// << EOF
  ldapmodify -D "cn=admin,dc=bar,dc=com" -Y EXTERNAL -H ldapi:/// << EOF
  ..
  ..
Line 108: Line 126:


Or even, also for reconfiguration of OLC
Or even, also for reconfiguration of OLC
  ldapmodify -Y EXTERNAL -H ldapi:/// < foo.ldif
  ldapmodify -Y EXTERNAL -H ldapi:/// < foo.ldif


==change olcAccess, olcSuffix etc==
== change olcAccess, olcSuffix etc ==
 
I managed this changing things in following order:
I managed this changing things in following order:
  olcAccess{2}
  olcAccess{2}
  olcAccess{0}
  olcAccess{0}
Line 117: Line 138:
  olcSuffix
  olcSuffix


&nbsp;


  EOF
  EOF


==add an attribute==
== add an attribute ==
 
  changetype: modify
  changetype: modify
  add: objectClass
  add: objectClass
  objectClass: qmailUser
  objectClass: qmailUser


==search for a record==
== search for a record ==
http://docs.sun.com/source/816-6400-10/lsearch.html
 
[http://docs.sun.com/source/816-6400-10/lsearch.html http://docs.sun.com/source/816-6400-10/lsearch.html]


  ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts
  ldapsearch -x -b '' -s base '(objectclass="*)'" namingContexts''
  ldapsearch -x -b "dc=foo, dc=com" "uid=harry"
  ldapsearch -x -b "dc=foo, dc=com" "uid=harry"


*scope?
*scope?  
 
&nbsp;
 
== ber_get_next on fd 12 failed errno=0 (Success) ==


You're probably trying to use ldapadd without -x


==ber_get_next on fd 12 failed errno=0 (Success)==
== ber_get_next on fd 15 failed errno=11 (Resource temporarily Unavailable) ==
You're probably trying to use ldapadd without -x


==ber_get_next on fd 15 failed errno=11 (Resource temporarily Unavailable)==
??
??


==rootdn is always granted unlimited privileges==
== rootdn is always granted unlimited privileges ==


== Error number: 0x50 (LDAP_OTHER) ==
=== Internal (implementation specific) error ===


==Error number: 0x50 (LDAP_OTHER)==
===Internal (implementation specific) error===
You probably ran slapindex as wrong user. Set rights on the directory you find under 'directory' in slapd.conf for the user slapd runs as ( openldap on debian )
You probably ran slapindex as wrong user. Set rights on the directory you find under 'directory' in slapd.conf for the user slapd runs as ( openldap on debian )


==search filters==
== search filters ==
*http://www.faqs.org/rfcs/rfc2254.html


*[http://www.faqs.org/rfcs/rfc2254.html http://www.faqs.org/rfcs/rfc2254.html]
&nbsp;
== main: TLS init def ctx failed: -1 ==


==main: TLS init def ctx failed: -1==
Probably no access to one of the certificate files
Probably no access to one of the certificate files


&nbsp;
== ldif_read_file: checksum error on "/etc/ldap/slapd.d/cn=config/olcDatabase={1}bdb.ldif" ==


==ldif_read_file: checksum error on "/etc/ldap/slapd.d/cn=config/olcDatabase={1}bdb.ldif"==
You edited config file instead of using ldapmodify. This error will go away once you used ldapmodify on it.
You edited config file instead of using ldapmodify. This error will go away once you used ldapmodify on it.


==check TLS connection==
== check TLS connection ==
 
You might need to set up certs in /etc/openssl/ldap.conf
You might need to set up certs in /etc/openssl/ldap.conf
  ldapsearch -x -ZZ -h hostname -p 389
  ldapsearch -x -ZZ -h hostname -p 389


or
or
  openssl s_client -connect hostname:636 -cert /etc/openldap/certs/clientcert.pem -CAfile /etc/openldap/certs/cacert.pem
  openssl s_client -connect hostname:636 -cert /etc/openldap/certs/clientcert.pem -CAfile /etc/openldap/certs/cacert.pem


===ldap_start_tls: Connect error (-11)===
=== ldap_start_tls: Connect error (-11) ===
 
probably some cert missing
probably some cert missing


Revision as of 15:31, 14 December 2020

Lightweight Directory Access Protocol

In computer networking, the Lightweight Directory Access Protocol, or LDAP ("ell-dap"), is a networking protocol for querying and modifying directory services running over TCP/IP. An LDAP directory usually follows the X.500 model: it is a tree of entries, each of which consists of a set of named attributes with values. While some services use a more complicated "forest" model, the vast majority use a simple starting point for their database organization.

An LDAP directory often reflects various political, geographic, and/or organizational boundaries, depending on the model chosen. LDAP deployments today tend to use Domain Name System (DNS) names for structuring the most simple levels of the hierarchy. Further into the directory might appear entries representing people, organizational units, printers, documents, groups of people or anything else which represents a given tree entry, or multiple entries.

Its current version is LDAPv3. LDAPv3 is specified in a series of IETF Standard Track RFCs as detailed in RFC 4510.

Interfaces

Tutorials and docs

Access control

ldapmodify

Links


FAQ

OLC

Change OLC config

ldapmodify -Y EXTERNAL -H ldapi:///
dn: cn=config
replace: olcLogLevel
olcLogLevel: None

CTRL + D

 

view configuration in OLC

slapcat -H "ldap:///cn=config??sub?(olcDatabase=*)"

ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config

ldap_sasl_interactive_bind_s: Unknown authentication method (-6)

try adding "-x" to the ldapsearch,

 

add indexes

http://forum.zentyal.org/index.php?topic=3006.0 http://www.zytrax.com/books/ldap/apa/indeces.html

NOTE: there is no more need to run slapindex!!

additional info: structuralObjectClass: no user modification allowed

use slapadd instead of ldapadd, while slapd is NOT running: 

slapadd -v < ldap.ldif

AttributeType inappropriate matching rule: "integerMatch"

duh

Replace LDAP database

service slapd stop
rm /var/lib/ldap/*
slapadd -l dump.ldif
chown -R openldap.openldap /var/lib/ldap
service slapd start

 

create a new database from ldif file

slapadd -f dump.ldif

Remember to set rights to the db storage!

add a record

ldapadd

modify a record

  

ldapmodify -x -D "cn=admin, dc=bar, dc=com" -W << EOF
dn: cn=foo, dc=bar, dc=com
changetype: modify
replace: sn
sn: new name
EOF

Or 

ldapmodify -D "cn=admin,dc=bar,dc=com" -Y EXTERNAL -H ldapi:/// << EOF
..
EOF

Or even, also for reconfiguration of OLC 

ldapmodify -Y EXTERNAL -H ldapi:/// < foo.ldif

change olcAccess, olcSuffix etc

I managed this changing things in following order: 

olcAccess{2}
olcAccess{0}
olcRootDN
olcSuffix

  

EOF

add an attribute

changetype: modify
add: objectClass
objectClass: qmailUser

search for a record

http://docs.sun.com/source/816-6400-10/lsearch.html 

ldapsearch -x -b  -s base '(objectclass="*)'" namingContexts
ldapsearch -x -b "dc=foo, dc=com" "uid=harry"
  • scope?

 

ber_get_next on fd 12 failed errno=0 (Success)

You're probably trying to use ldapadd without -x

ber_get_next on fd 15 failed errno=11 (Resource temporarily Unavailable)

??

rootdn is always granted unlimited privileges

Error number: 0x50 (LDAP_OTHER)

Internal (implementation specific) error

You probably ran slapindex as wrong user. Set rights on the directory you find under 'directory' in slapd.conf for the user slapd runs as ( openldap on debian )

search filters

 

main: TLS init def ctx failed: -1

Probably no access to one of the certificate files

 

ldif_read_file: checksum error on "/etc/ldap/slapd.d/cn=config/olcDatabase={1}bdb.ldif"

You edited config file instead of using ldapmodify. This error will go away once you used ldapmodify on it.

check TLS connection

You might need to set up certs in /etc/openssl/ldap.conf 

ldapsearch -x -ZZ -h hostname -p 389

or 

openssl s_client -connect hostname:636 -cert /etc/openldap/certs/clientcert.pem -CAfile /etc/openldap/certs/cacert.pem

ldap_start_tls: Connect error (-11)

probably some cert missing

Keywords

rootdn

The user/account with full access


Tools

  • phpldapadmin
  • ldapbrowser
  • lam
  • shelldap
  • ldapvi
Retrieved from "https://wiki.dhits.nl/index.php?title=LDAP&oldid=6427"