Interdomain authentication

2010-06-22 Thread Luiz Marcelo
Hello everyone, good, someone could tell me if there is a way to configure a client to openLDAP see an entry in the local database and if this entry does not exist, the server performs the query on another remote server? I used the chain module for this purpose, but even if the entry exists in

Re: PROBLEM: can't use SASL to authentication openldap client

2010-06-22 Thread Dan White
On 21/06/10 09:52 +0800, LI Ji D wrote: 3. Then I configure the slapd.conf to be like this: authz-policy to sasl-regexp ^uid=([^,]+),.* uid=$1,cn=bjims31,cn=digest-md5,cn=auth database bdb suffix dc=example,dc=com rootdn uid=111,cn=digest-md5,cn=auth 4. Then

Re: What DN (user name) I should use for connecting to ldap server?

2010-06-22 Thread sam
Chris Jacobs wrote: Sam, You need to specify a DN (that has at least read access). It could be a DN within the scope of the server, or root/manager/etc DN's specified in your slapd.conf (which would give you write access). For example, use the rootdn entry from your slapd.conf: rootdn

Unigueness of RID; changing RID

2010-06-22 Thread Nick Urbanik
Dear Folks, I am trying to improve my understanding of the RID before making many large deployments of syncrepl. My understanding is that the replica ID (RID) is unique within one level of [provider] -- [consumer], [consumer],... relationship. Here, an arrow -- represents replication of one

Copying trees from one consumer to another

2010-06-22 Thread Nick Urbanik
Dear Folks, With slurpd, copying a tree from one slave to another was like this: 1. stop slapd on both slaves. 2. netcat the directory across from one slave to the other. 3. stop slurpd on master 4. edit slurpd.status to make the time and replication number match by copying that for the

Configuring slapd.conf-less OpenLDAP

2010-06-22 Thread Braden McDaniel
I'm trying to get OpenLDAP up and running on Fedora (12) using the cn=config-based configuration. I've changed /etc/openldap/slapd.d/cn=config/oldCatabase={1}bdb.ldif to point to my domain: olcSuffix: dc=endoframe,dc=net olcRootDN: cn=Manager,dc=endoframe,dc=net And I've added:

Re: Simple question about LDAP and web authentication.

2010-06-22 Thread Benjamin Griese
Check this out :) http://httpd.apache.org/docs/2.0/mod/mod_auth_ldap.html On Tue, Jun 22, 2010 at 01:37, Bryan Boone v_1bb...@yahoo.com wrote: Hi everyone. I am a noob to LDAP and I have a question. I am on a team that is building a special server. This server will be running linux with

Re: Interdomain authentication

2010-06-22 Thread Jonathan Clarke
On 22/06/2010 02:09, Luiz Marcelo wrote: Hello everyone, good, someone could tell me if there is a way to configure a client to openLDAP see an entry in the local database and if this entry does not exist, the server performs the query on another remote server? I used the chain module for this

Re: Simple question about LDAP and web authentication.

2010-06-22 Thread Jonathan Clarke
On 22/06/2010 01:37, Bryan Boone wrote: Hi everyone. I am a noob to LDAP and I have a question. I am on a team that is building a special server. This server will be running linux with an apache web server with PHP and apache is running a special website that we designed. I need to have the

Re: Simple question about LDAP and web authentication.

2010-06-22 Thread Marc Patermann
Bryan, Bryan Boone schrieb am 22.06.2010 01:37 Uhr: So my question is??? Is an LDAP client to be run as a Daemon or service? Is this what OpenLDAP provides? Or can I simply use function calls (from PHP or C) from the OpenLDAP library for the authentication? Just search the web for php

Re: Unigueness of RID; changing RID

2010-06-22 Thread Howard Chu
Nick Urbanik wrote: Dear Folks, I am trying to improve my understanding of the RID before making many large deployments of syncrepl. My understanding is that the replica ID (RID) is unique within one level of [provider] -- [consumer], [consumer],... relationship. That is not what the

Re: Can't start ldap or can't create ldap database.

2010-06-22 Thread Dieter Kluenter
Chris Jacobs chris.jac...@apollogrp.edu writes: R It's merely reminding you that you might want one have one. Put a blank file in your BDB directory with that name. It's purely a BDB thing - nothing to do with OpenLDAP. There are article 'out there' on what might go in the file, but in many

Re: Copying trees from one consumer to another

2010-06-22 Thread Quanah Gibson-Mount
--On Tuesday, June 22, 2010 12:24 PM +1000 Nick Urbanik nick.urba...@optusnet.com.au wrote: If so, does that mean that with syncrepl, the above operation is reduced to the following three steps? 1. Stop slapd on both consumers. 2. Netcat the database from one to the other. 3. start both

Re: Unigueness of RID; changing RID

2010-06-22 Thread Quanah Gibson-Mount
--On Tuesday, June 22, 2010 12:00 PM +1000 Nick Urbanik nick.urba...@optusnet.com.au wrote: Dear Folks, I am trying to improve my understanding of the RID before making many large deployments of syncrepl. The RID uniquely identifies a syncrepl stanza inside the replica for a given

Re: Copying trees from one consumer to another

2010-06-22 Thread Chris Jacobs
Nick, I've done this a number of times - Dev on an 'in production' ldap infrastructure. I've managed to get the boxes out of sync a number of times. 1. Stop slapd. 2. Delete the contents of the db dir 3. Copy a db-config into it. 4. Startup slapd. The full tree is replicated pretty quickly.

Re: Copying trees from one consumer to another

2010-06-22 Thread Jonathan Clarke
Hi, On 22/06/2010 04:24, Nick Urbanik wrote: Dear Folks, With slurpd, copying a tree from one slave to another was like this: 1. stop slapd on both slaves. 2. netcat the directory across from one slave to the other. 3. stop slurpd on master 4. edit slurpd.status to make the time and

Re: Regression failure on openldap-2.4.21 stable (test058-syncrepl-asymmetric)

2010-06-22 Thread Mark Cave-Ayland
Quanah Gibson-Mount wrote: The point of this exit message is that this test is currently known to fail, and failure should be ignored. --Quanah Okay, thanks. This was the output on our i386 build host, so I just went to cross-check against our amd64 build host and I am also seeing some

Re: Regression failure on openldap-2.4.21 stable (test058-syncrepl-asymmetric)

2010-06-22 Thread Quanah Gibson-Mount
--On Tuesday, June 22, 2010 5:24 PM +0100 Mark Cave-Ayland mark.cave-ayl...@siriusit.co.uk wrote: Quanah Gibson-Mount wrote: The point of this exit message is that this test is currently known to fail, and failure should be ignored. --Quanah Okay, thanks. This was the output on our i386

RE: Simple question about LDAP and web authentication.

2010-06-22 Thread Chris Jacobs
Bryan, Frankly though, I wonder if OpenLDAP is the right solution for your problem (see OpenID or perhaps just something simple setup in MySQL - [encrypt those passwords! ] - which you're likely using /anyway/), but moving on... Apache has pretty good LDAP support - I use it control access to

Re: PROBLEM: can't use SASL to authentication openldap client

2010-06-22 Thread Dieter Kluenter
Hi, LI Ji D ji.d...@alcatel-lucent.com writes: Hi, I tried again with following steps: dn: uid=admin,ou=People,o=Ever objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson userPassword: {SHA}5en6G6MezRroT3XKqkdPOmY/BfQ= [...] 4.