slacky.eu

ciao a tutti è una settimana che mi sto picchiando con openldap e sembra che continui a vincere lui:
<BR>quando voglio aggiungere delle entry mi riisponde: ldap_bind invalid credential (49)
<BR>il comando che uso, dopo aver lanciato il server è
<BR>ldapadd -x -D "dc=miodominio,dc=net" -f /path/almio/ldif -W
<BR>
<BR>ldap è stato installato su slackware 10
<BR>
<BR>qui vi metto i miei file di config
<BR>slapd.conf:
<BR>include /usr/local/etc/openldap/schema/core.schema
<BR>include /usr/local/etc/openldap/schema/cosine.schema
<BR>include /usr/local/etc/openldap/schema/inetorgperson.schema
<BR>include /usr/local/etc/openldap/schema/openldap.schema
<BR>include /usr/local/etc/openldap/schema/nis.schema
<BR>include /usr/local/etc/openldap/schema/samba.schema
<BR># Define global ACLs to disable default read access.
<BR>
<BR># Do not enable referrals until AFTER you have a working directory
<BR># service AND an understanding of referrals.
<BR>#referral ldap://root.openldap.org
<BR>
<BR>pidfile /usr/local/var/run/slapd.pid
<BR>argsfile /usr/local/var/run/slapd.args
<BR>
<BR># Load dynamic backend modules:
<BR>modulepath /usr/local/libexec/openldap
<BR>moduleload back_bdb.la
<BR># moduleload back_ldap.la
<BR># moduleload back_ldbm.la
<BR># moduleload back_passwd.la
<BR># moduleload back_shell.la
<BR>
<BR># Sample security restrictions
<BR># Require integrity protection (prevent hijacking)
<BR># Require 112-bit (3DES or better) encryption for updates
<BR># Require 63-bit encryption for simple bind
<BR># security ssf=1 update_ssf=112 simple_bind=64
<BR>
<BR># Sample access control policy:
<BR># Root DSE: allow anyone to read it
<BR># Subschema (sub)entry DSE: allow anyone to read it
<BR># Other DSEs:
<BR># Allow self write access
<BR># Allow authenticated users read access
<BR># Allow anonymous users to authenticate
<BR># Directives needed to implement policy:
<BR># access to dn.base="" by * read
<BR># access to dn.base="cn=Subschema" by * read
<BR># access to *
<BR># by self write
<BR># by users read
<BR># by anonymous auth
<BR>#
<BR># if no access controls are present, the default policy
<BR># allows anyone and everyone to read anything but restricts
<BR># updates to rootdn. (e.g., "access to * by * read")
<BR>#
<BR># rootdn can always read and write EVERYTHING!
<BR>
<BR>#access to attrs=userPassword,sambaLMPassword,sambaNTPassword
<BR># by se3lf write
<BR># by anonymous auth
<BR># by * none
<BR>#access to *
<BR># by * read
<BR>#
<BR>#######################################################################
<BR># BDB database definitions
<BR>#######################################################################
<BR>
<BR>database bdb
<BR>suffix "dc=unix,dc=domain,dc=omnirei,dc=net"
<BR>rootdn "cn=unixadmin,dc=unix,dc=domain,dc=omnirei,dc=net"
<BR># Cleartext passwords, especially for the rootdn, should
<BR># be avoid. See slappasswd(8) and slapd.conf(5) for details.
<BR># Use of strong authentication encouraged.
<BR>#rootpw secret
<BR>rootpw {SSHA}c38asaG4+9R8NQ3ErSYrNPW9lNn7QWDV
<BR># The database directory MUST exist prior to running slapd AND
<BR># should only be accessible by the slapd and slap tools.
<BR># Mode 700 recommended.
<BR>directory /usr/local/var/openldap-data
<BR>readonly off
<BR># Indices to maintain
<BR>index objectClass,uidNumber,gidNumber eq
<BR>index cn,sn,uid,displayName pres,sub,eq
<BR>index memberUid,mail,givenname eq,subinitial
<BR>#index sambaSID,sambaPrimary,GroupSID,sambaDomainName eq
<BR>
<BR>e questo è il mio ldif:
<BR>
<BR> 1 dn: dc=unix,dc=domain,dc=omnirei,dc=net
<BR> 2 dc: unix
<BR> 3 objectClass: dcObject
<BR> 4 objectClass: organization
<BR> 5 o: Omnirei
<BR> 6
<BR> 7 dn: ou=amministrazione,dc=unix,dc=domain,dc=omnirei,dc=net
<BR> 8 cn: dc=unix,dc=domain,dc=omnirei,dc=net
<BR> 9 ou: amministrazione
<BR> 10 objectClass: top
<BR> 11 objectClass: organizationalUnit
<BR> 12
<BR> 13 dn: cn=unixadmin,ou=amministrazione,dc=unix,dc=domain,dc=omnirei ,dc=net
<BR> 14 objectClass: account
<BR> 15 objectClass: posixAccount
<BR> 16 uid: unixadmin
<BR> 17 cn: unixadmin
<BR> 18 gidnumber: 666
<BR> 19 uidnumber: 1666
<BR> 20 userPassword: {SSHA}mia password
<BR> 21 homedirectory: /home/admin
<BR>
<BR>
<BR>grazie in anticipo, premetto che ho googolato prima di postare, ma non sono venuto a capo di nulla<br>

Penso che sia errata la tua formulazione del comando ´ldapadd´.
<BR>
<BR>In configurazione gli hai indicato che solo rootdn puo´ scrivere ("cn=unixadmin,dc=unix,dc=domain,dc=omnirei,dc=net"), e poi cerchi di fare un ldapadd con un utente diverso ("dc=miodominio,dc=net")
<BR>
<BR>Per vedere bene cosa fa il maledetto LDAP (mi ci sono limato le corna un po´ di tempo fa), aggiungi in slapd.conf l´istruzione "loglevel -1" che ti fa vedere un po´ di informazioni in /var/log/debug<br>