Advice for distributing schemas for OpenLDAP

2012-07-30 Thread ghudson
MIT krb5 has an LDAP back end for its KDC, which uses its own schema. Currently, we distribute just a .schema file for OpenLDAP, which isn't very friendly to a DS using back-config and slapd.d. I have some questions about how we might do better. 1. For initial installs, I take it we should

Re: Special characters in distinguished name

2012-07-30 Thread Michael Ströder
chris_n...@arcor.de wrote: are special characters, especially German umlauts, acceptable in the distinguished name? If the attribute type used to form the DN component is of DirectoryString syntax there's no problem. Note that DirectoryString means UTF-8 encoded Unicode chars. I've

Re: What will happen if there are two user with same uid in OpenLDAP server

2012-07-30 Thread Qiang Xu
On Sat, Jul 28, 2012 at 10:34 PM, Qian Zhang zhq527...@gmail.com wrote: [Qian] Sorry, I am new to LDAP, can you please let me know how to figure out which way I am using for DN format? By some ldap commands? BTW, I installed and setup LDAP in a default way, so I guess the DN format should be

Re: Translucent Proxy to filter users

2012-07-30 Thread Aaron Richton
On Fri, 27 Jul 2012, Joel Eidsath wrote: Hello, I'm trying to use our corporate openldap server for authentication to an application server (Github Enterprise) that does not support any memberof filters for allowed users. As a workaround, I am looking into a translucent proxy server that

Re: What will happen if there are two user with same uid in OpenLDAP server

2012-07-30 Thread Aaron Richton
On Mon, 30 Jul 2012, Qiang Xu wrote: I don't know what ldap command could be used to find out the DN schema, either. However, there is an open source tool called LDAP Admin Typically, OpenLDAP has a subschemaSubentry of cn=Subschema; that portion of the DIT contains this information.

Re: What will happen if there are two user with same uid in OpenLDAP server

2012-07-30 Thread Guillaume Rousse
Le 30/07/2012 16:52, Aaron Richton a écrit : On Mon, 30 Jul 2012, Qiang Xu wrote: I don't know what ldap command could be used to find out the DN schema, either. However, there is an open source tool called LDAP Admin Typically, OpenLDAP has a subschemaSubentry of cn=Subschema; that portion

Re: What will happen if there are two user with same uid in OpenLDAP server

2012-07-30 Thread Guillaume Rousse
Le 29/07/2012 04:34, Qian Zhang a écrit : Do you use something like cn=My Name,ou=Users,dc=example,dc=com with uid in the entry or uid=ghenry,ou=Users,dc=example,dc=com ? [Qian] Sorry, I am new to LDAP, can you please let me know how to figure out which way I am using for DN format? By some

Re: What will happen if there are two user with same uid in OpenLDAP server

2012-07-30 Thread Qiang Xu
On Mon, Jul 30, 2012 at 10:55 AM, Guillaume Rousse guillomovi...@gmail.comwrote: It lists the available classes and types (the known schemas), which doesn't seems to be the issue here. If the question is 'how is my RDN formed', just querying the directory with ldapsearch should be enough.

Re: What will happen if there are two user with same uid in OpenLDAP server

2012-07-30 Thread Guillaume Rousse
Le 30/07/2012 17:06, Qiang Xu a écrit : On Mon, Jul 30, 2012 at 10:55 AM, Guillaume Rousse guillomovi...@gmail.com mailto:guillomovi...@gmail.com wrote: It lists the available classes and types (the known schemas), which doesn't seems to be the issue here. If the question is 'how is my

Re: What will happen if there are two user with same uid in OpenLDAP server

2012-07-30 Thread Qiang Xu
On Mon, Jul 30, 2012 at 11:24 AM, Guillaume Rousse guillomovi...@gmail.comwrote: No specific syntax. Just get a specific user entry, and check its DN: ldapsearch -x -b yourbase uid=youruid OK, I see. Just do a generic ldapsearch, right? Simple and effective. Thank you, Guillaume.

Re: Special characters in distinguished name

2012-07-30 Thread Qiang Xu
On Sun, Jul 29, 2012 at 11:16 AM, chris_n...@arcor.de wrote: are special characters, especially German umlauts, acceptable in the distinguished name? I've accidentally discovered that CPAN's Net::LDAP::Entry module doesn't support them (in the distinguished name). Other attributes are escaped

Issue with dynlist overlay

2012-07-30 Thread Patrick Hemmer
So I just ran across an undocumented issue with slapo-dynlist. I'm not sure if this is a bug, or just missing in the documentation. The issue is that if the entry being dynamically added to the parent entry has the objectClass slapo-dynlist is configured to use, that entry is not dynamically

Re: Translucent Proxy to filter users

2012-07-30 Thread Guillaume Rousse
Le 30/07/2012 16:45, Aaron Richton a écrit : On Fri, 27 Jul 2012, Joel Eidsath wrote: Hello, I'm trying to use our corporate openldap server for authentication to an application server (Github Enterprise) that does not support any memberof filters for allowed users. As a workaround, I am

Re: Advice for distributing schemas for OpenLDAP

2012-07-30 Thread Howard Chu
ghud...@mit.edu wrote: MIT krb5 has an LDAP back end for its KDC, which uses its own schema. Currently, we distribute just a .schema file for OpenLDAP, which isn't very friendly to a DS using back-config and slapd.d. I have some questions about how we might do better. 1. For initial

Internal telephone extension number

2012-07-30 Thread Gavin Henry
Hi all, What attribute are you using to represent an internal telephone extension? Can't see any standards based ones. Thanks. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghe...@suretec.co.uk Open Source. Open

Re: Advice for distributing schemas for OpenLDAP

2012-07-30 Thread Greg Hudson
On 07/30/2012 03:40 PM, Howard Chu wrote: You could just convert them manually, as documented in the openldap.ldif file. Yes. As the Admin Guide and slapd-config(5) manpage already state, prefixes are generated automatically. You should not set them yourself on newly added data. Thanks,

Aw: Re: Special characters in distinguished name

2012-07-30 Thread chris_news
Hello Michael, Von: Michael Ströder mich...@stroeder.com chris_n...@arcor.de wrote: are special characters, especially German umlauts, acceptable in the distinguished name? If the attribute type used to form the DN component is of DirectoryString syntax there's no problem. Note that

Re: Aw: Re: Special characters in distinguished name

2012-07-30 Thread Philip Guenther
On Tue, 31 Jul 2012, chris_n...@arcor.de wrote: I've accidentally discovered that CPAN's Net::LDAP::Entry module doesn't support them (in the distinguished name). Other attributes are escaped correctly. What exactly leads you to this conclusion? I setup the DN with $entry-dn($dn);