New to ldap, new to Luma

acid_kewpie · 12-08-2010, 12:56 PM

Well you're getting the same response as before, error 32, meaning the object does not exist, so you've not added the object yet. What ldif's do you have to add? Wha command did you run to add them, what was the output of the add command, what did the server los say about it?

jonaskellens · 12-08-2010, 12:56 PM

Quote:

Originally Posted by acid_kewpie

Well you're getting the same response as before, error 32, meaning the object does not exist, so you've not added the object yet.

What object ???

This works :

Code:

[root@asterisk16 ~]# ldapsearch -x -W -D 'cn=Manager,dc=domain,dc=local' -b 'dc=domain,dc=local'
Enter LDAP Password: 
# extended LDIF
#
# LDAPv3
# base <dc=domain,dc=local> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# domain.local
dn: dc=domain,dc=local
objectClass: dcObject
objectClass: organization
o: MY Ldap
dc: domain

# Manager, domain.local
dn: cn=Manager,dc=domain,dc=local
objectClass: organizationalRole
cn: Manager

# 123456, domain.local
dn: ou=123456,dc=domain,dc=local
ou: 123456
objectClass: organizationalUnit
objectClass: top

<snip>...<snip>

# U123456, 123456, domain.local
dn: cn=U123456,ou=123456,dc=domain,dc=local
cn: U123456
sn: U123456
userPassword:: dGVzdDEyMzQ1Ng==
objectClass: inetOrgPerson
objectClass: top

# 101001, domain.local
dn: ou=101001,dc=domain,dc=local
ou: 101001
objectClass: organizationalUnit
objectClass: top

# U101001, 101001, domain.local
dn: cn=U101001,ou=101001,dc=domain,dc=local
cn: U101001
sn: U101001
userPassword:: dGVzdDEwMTAwMQ==
objectClass: inetOrgPerson
objectClass: top

<snip>...<snip>

# search result
search: 2
result: 0 Success

# numResponses: 11
# numEntries: 10

Why do I need the parameter -b ??

Why is inetOrgPerson U101001 also able to make this same search (ldapsearch -x -W -D 'cn=U123456,ou=123456,dc=domain,dc=local' -b 'dc=domain,dc=local') ??

jonaskellens · 12-09-2010, 07:17 AM

What is wrong here :

Code:

database        bdb
suffix          "dc=mydomain,dc=local"
rootdn          "cn=Manager,dc=mydomain,dc=local"
rootpw          GuessThis

defaultaccess   none
access to *
by dn="cn=Manager,dc=mydomain,dc=local"  write
by dn="cn=U123456,ou=123456,dc=mydomain,dc=local" read

Checking configuration files for slapd: /etc/openldap/slapd.conf: line 99: warning: no by clause(s) specified in access line (ignored).

??

acid_kewpie · 12-09-2010, 09:16 AM

I think you need to indent all the options for the default access entry our it will interpret them as different directives.

jonaskellens · 12-09-2010, 09:26 AM

This works (notice the tab) :

Code:

database        bdb
suffix          "dc=mydomain,dc=local"
rootdn          "cn=Manager,dc=mydomain,dc=local"
rootpw          GuessThis

defaultaccess   none
access to *
[tab]  by dn="cn=Manager,dc=mydomain,dc=local"  write
[tab]  by dn="cn=U123456,ou=123456,dc=mydomain,dc=local" read

But now I have :

[root@asterisk16 ~]# ldapsearch -x -W -D 'cn=U123456,ou=123456,dc=mydomain,dc=local' -b 'ou=123456,dc=mydomain,dc=local'
Enter LDAP Password: test123456
ldap_bind: Invalid credentials (49)

How come it complaints about credentials ??

acid_kewpie · 12-09-2010, 09:48 AM

Your password must be wrong. Or the account could be locked, but that the sort of functionality you'd explicitly have to add, which you haven't. Also could possible be that the password has expired.

jonaskellens · 12-09-2010, 10:35 AM

My password is correct :

Code:

[root@asterisk16 ~]# ldapsearch -x -W -D 'cn=U123456,ou=123456,dc=mydomain,dc=local' -b 'ou=123456,dc=mydomain,dc=local'
Enter LDAP Password: test123456
# extended LDIF
#
# LDAPv3
# base <ou=123456,dc=mydomain,dc=local> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# 123456, mydomain.local
dn: ou=123456,dc=mydomain,dc=local
ou: 123456
objectClass: organizationalUnit
objectClass: top

<snip>

# numResponses: 5
# numEntries: 4

I've removed this from slapd.conf :

defaultaccess none
access to *
by dn="cn=Manager,dc=mydomain,dc=local" write
by dn="cn=U123456,ou=123456,dc=mydomain,dc=local" read

How come when I add some access rules, my 'normal' users are no longer able to do any search ???