Re: Authenticate to ldap using Kerberos

2010-09-09 Thread Howard Chu
Wouter van Marle wrote: On Wed, 2010-09-08 at 21:34 -0500, Dan White wrote: On 09/09/10 10:21 +0800, Wouter van Marle wrote: That requires pass-through authentication. I see. Well with the above instructions nothing seems to have changed. I have restarted saslauthd and slapd after making the

Re: Authenticate to ldap using Kerberos

2010-09-09 Thread Wouter van Marle
On Wed, 2010-09-08 at 23:40 -0700, Howard Chu wrote: Wouter van Marle wrote: On Wed, 2010-09-08 at 21:34 -0500, Dan White wrote: On 09/09/10 10:21 +0800, Wouter van Marle wrote: That requires pass-through authentication. I see. Well with the above instructions nothing seems to have

Re: I can't login in my system using OpenLDAP

2010-09-09 Thread Eric KOM
Please find attached my libnss-ldap.conf and pam_ldap.conf Even now I can't connect on the system using user that I created. Please, may be I missing some settings. -- Yours truly, Eric KOM 110 LAWN STREET ROSETTENVILLE 2190 JOHANNESBURG SOUTH AFRICA Phone: +27 (0) 788 791 334 Fax: +27 (0)

Re: I can't login in my system using OpenLDAP

2010-09-09 Thread Jonathan CLARKE
Le 09/09/2010 09:11, Eric KOM a écrit : Please find attached my libnss-ldap.conf and pam_ldap.conf Even now I can't connect on the system using user that I created. Please, may be I missing some settings. Installing and setting up slapd as a server is one thing (a network available LDAP

Re: I can't login in my system using OpenLDAP

2010-09-09 Thread Peter Boosten
On 9-9-2010 9:34, Jonathan CLARKE wrote: Le 09/09/2010 09:11, Eric KOM a écrit : Please find attached my libnss-ldap.conf and pam_ldap.conf Even now I can't connect on the system using user that I created. Please, may be I missing some settings. Installing and setting up slapd as a server

Re: Authenticate to ldap using Kerberos

2010-09-09 Thread Dieter Kluenter
Wouter van Marle wou...@squirrel-systems.com writes: On Wed, 2010-09-08 at 23:40 -0700, Howard Chu wrote: Wouter van Marle wrote: On Wed, 2010-09-08 at 21:34 -0500, Dan White wrote: On 09/09/10 10:21 +0800, Wouter van Marle wrote: That requires pass-through authentication. I see.

Re: Authenticate to ldap using Kerberos

2010-09-09 Thread Wouter van Marle
On Thu, 2010-09-09 at 10:43 +0200, Dieter Kluenter wrote: Wouter van Marle wou...@squirrel-systems.com writes: On Wed, 2010-09-08 at 23:40 -0700, Howard Chu wrote: Wouter van Marle wrote: On Wed, 2010-09-08 at 21:34 -0500, Dan White wrote: On 09/09/10 10:21 +0800, Wouter van Marle

objectClass index from slapd.conf is not working

2010-09-09 Thread tim stone
Hello, I've a strange behavior while using index objectClass for searching. In my slapd.conf I have defined the index in the database section: index objectClass eq Other indexes follows in the config. All of them working fine. If I search via ldapsearch like: ldapsearch -x -h localhost -w

rwm rewrite

2010-09-09 Thread Mark Coetser
Hi I have googled and read over slapo-rwm man page, some great examples there BUT I cant seem too grasp the rewrite rule. Basically I have merged a couple of individual openldap directories under a meta database which works fine. Some of the individual directories have clashing posix

Re: rwm rewrite

2010-09-09 Thread masarati
Hi I have googled and read over slapo-rwm man page, some great examples there BUT I cant seem too grasp the rewrite rule. Basically I have merged a couple of individual openldap directories under a meta database which works fine. Some of the individual directories have clashing posix

Re: Authenticate to ldap using Kerberos

2010-09-09 Thread Dan White
On 09/09/10 12:47 +0800, Wouter van Marle wrote: Adding user `openldap' to group `sasl' ... Adding user openldap to group sasl Done. (Did you restart slapd?) The issue is that the /var/run/saslauthd directory, where the saslauthd unix socket is located, is only accessible by group 'sasl'

Re: rwm rewrite

2010-09-09 Thread Mark Coetser
On 2010/09/09 02:56 PM, masar...@aero.polimi.it wrote: slapo-rwm(5) by design can only muck with DN-valued attributes, for the purpose of creating virtual views of existing data. It cannot modify the contents of other attributes. For this purpose you probably need to write some specific piece

Re: objectClass index from slapd.conf is not working

2010-09-09 Thread tim stone
Hello, Sorry, I made a mistake (during sanitize) in my posting. Ldapsearch is looking/starting the search dirctly (-b) in the Container DN with 88000 entires. Only this Container (searchbase) has the objectClass Guest. So the request is look like: ldapsearch -x -h localhost -w password

Re: Authenticate to ldap using Kerberos

2010-09-09 Thread Wouter van Marle
On 9 Sep 10, at 21:47, Dan White wrote: On 09/09/10 12:47 +0800, Wouter van Marle wrote: Adding user `openldap' to group `sasl' ... Adding user openldap to group sasl Done. (Did you restart slapd?) I don't remember... restarted it many times in the process :) I'm not used to need to

Re: Authenticate to ldap using Kerberos

2010-09-09 Thread Quanah Gibson-Mount
--On Thursday, September 09, 2010 5:13 PM +0800 Wouter van Marle wou...@squirrel-systems.com wrote: Kerberos is the authentication system, it's specialised in that. At least that's what I learned about it. I have set it up in order to have a single sign-on, a single password for all services

Re: Authenticate to ldap using Kerberos

2010-09-09 Thread masarati
You are directing your unhappiness at the wrong place, as Howard already noted. As someone who set up a large OpenLDAP directory service that only allows SASL/GSSAPI connections, the issue is not OpenLDAP. The problem is client software that, even though SASL has been a standard for many,

Re: cn=config and ACL formatting

2010-09-09 Thread Marc Patermann
ben, ben thielsen schrieb am 08.09.2010 23:42 Uhr: On Sep 01, 2010, at 10.14, Marc Patermann wrote: b...@bitrate.net schrieb am 31.08.2010 16:47 Uhr: some ldap clients/browsers support different editors for different types of data. for example, in my case, i use apache directory studio

Re: slapcat generate extra space characters in LDIF output

2010-09-09 Thread Mark J. Reed
On Thu, Sep 9, 2010 at 12:33 PM, Emmanuel Lecharny elecha...@gmail.com wrote:      10) When an attrval-spec, distinguishedName, or rdn is base64-          encoded, the encoding rules specified in [5] are used with the          following exceptions:  a) ***The requirement that base64 output    

Re: slapcat generate extra space characters in LDIF output

2010-09-09 Thread masarati
I'd note that while the current maximum width of lines is enforced to 76 chars, they happen to be 78 char long (because of an extra LDIF_KLUDGE set to 1 and, I guess, of the leading blank). In any case, in the spirit of being liberal when needed, I have nothing against allowing OpenLDAP tools to

Re: Authenticate to ldap using Kerberos

2010-09-09 Thread Dan White
On 09/09/10 19:41 +0200, Dieter Kluenter wrote: Wouter van Marle wou...@squirrel-systems.com writes: On 9 Sep 10, at 21:47, Dan White wrote: On 09/09/10 12:47 +0800, Wouter van Marle wrote: [...] Most important difference is that pam is not mentioned here. But then from other mails I

Re: Authenticate to ldap using Kerberos

2010-09-09 Thread masarati
Quanah, I know that in the past you, Howard and others have contributed pieces of software to other LDAP-enabled software to enable SASL auth. I had myself some bad experience in contributing things to software maintainers that did not even understand the need or the importance of what I

Re: GSSAPI Bind across trusted realms

2010-09-09 Thread Dan White
On 09/09/10 13:35 +0930, Indexer wrote: I have REALM.A and REALM.B in my KDC setup. There is a two way trust between REALM.A and REALM.B. I have a client computer on REALM.A, and can correctly kinit to get tickets from both realms via this trust pathway. I also have an OpenLDAP server on the

Re: Authenticate to ldap using Kerberos

2010-09-09 Thread Wouter van Marle
Dear list, First of all thank you for all the comments on this problem. It seems currently the ldap implementation of evolution is blamed, which is something I can not agree with. At this moment, I can connect to my ldap server from Evolution, authenticated. I have to enter a username and a

Re: Authenticate to ldap using Kerberos

2010-09-09 Thread Russ Allbery
Dan White dwh...@olp.net writes: On 09/09/10 20:05 -0700, Russ Allbery wrote: If you are using Kerberos, you should never have to enter your username and password into anything that isn't kinit or your initial authentication to your system. If you do, that something is broken and is not

Re: Authenticate to ldap using Kerberos

2010-09-09 Thread Wouter van Marle
On Thu, 2010-09-09 at 23:02 -0500, Dan White wrote: On 09/09/10 20:05 -0700, Russ Allbery wrote: Wouter van Marle wou...@squirrel-systems.com writes: At this moment, I can connect to my ldap server from Evolution, authenticated. I have to enter a username and a password in my evo settings,

Re: Authenticate to ldap using Kerberos

2010-09-09 Thread Howard Chu
Dan White wrote: On 09/09/10 20:05 -0700, Russ Allbery wrote: Wouter van Marlewou...@squirrel-systems.com writes: At this moment, I can connect to my ldap server from Evolution, authenticated. I have to enter a username and a password in my evo settings, which one way or another is

Re: Authenticate to ldap using Kerberos

2010-09-09 Thread Dan White
On 09/09/10 21:25 -0700, Howard Chu wrote: Dan White wrote: On 09/09/10 20:05 -0700, Russ Allbery wrote: Wouter van Marlewou...@squirrel-systems.com writes: At this moment, I can connect to my ldap server from Evolution, authenticated. I have to enter a username and a password in my evo