Date: Sat, 26 Jul 2003 12:08:48 +0100 From: Matthew Seaman <m.seaman@infracaninophile.co.uk> To: FreeBSD Questions List <freebsd-questions@freebsd.org> Subject: Re: Setting up OpenLDAP Message-ID: <20030726110848.GC29324@happy-idiot-talk.infracaninophile.co.uk> In-Reply-To: <20030726061328.GA73902@kongemord.krig.net> References: <20030726061328.GA73902@kongemord.krig.net>
next in thread | previous in thread | raw e-mail | index | archive | help
--2JFBq9zoW8cOFH7v Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Jul 26, 2003 at 02:13:28AM -0400, Bob Hall wrote: > OpenLDAP 2.1.22, FBSD 4.8 >=20 > I'm trying to set up LDAP to store passwords. Eventually I will=20 > want to store addresses and do general authentication, but right=20 > now I just want to do something really simple: add passwords. While you can run OpenLDAP servers on FreeBSD 4.8 quite happily, you won't be able to have the FreeBSD 4.8 system be a full blown client of the LDAP server itself. For that, you will need to upgrade to 5.1 where you can install the net/nss_ldap as well as the security/pam_ldap port. =20 > I installed from the ports using portintall, couldn't get it to=20 > work, and went back and reinstalled doing > # make depend > # make > # make test=20 > The install didn't fail any of the tests, although make kept looping > through the tests until I hit ^C. But I still have the same problems.=20 > If anyone has succeeded in installing OpenLDAP from the ports, I'd=20 > be grateful for any pointers. It's generally best to install using ports as that gets you any FreeBSD specific tweaks that have to be made, rather than following the generic Unix install instructions from the software writers. However, once the software is installed, you still need to follow the OpenLDAP installation guide for configuring the server. If you're working from http://www.openldap.org/doc/admin21/quickstart.html, then the ports installation effectively gives you steps 1 -- 7, and you can jump to step 8 directly. You would be well advised to read through section 5 of the admin guide: http://www.openldap.org/doc/admin21/slapdconfig.html so that you can gain a deeper understanding of what the instructions in section 8 of the quick start guide actually do. > I'm trying to do the Quick Install described at www.openldap.org. The=20 > first problem is that the doc claims that this is supposed to be a=20 > non-referring set up, which is what I want, but OpenLDAP complains that= =20 > there's no referral. So I've uncommented the referral line in slapd.conf.= =20 > But attempts to add records still fail.=20 >=20 > When I do search prior to adding records, I get > # /usr/local/bin/ldapsearch -x -b '' -s base '(objectclass=3D*)' > dn: > objectClass: top > objectClass: OpenLDAProotDSE > When I try to add records without a referral, I get=20 > # ldapadd -x -v -D "cn=3DManager,dc=3Ddomain,dc=3Dnet" -W -f domain.ldif > additional info: referral missing > With the referral, I get > ldapadd: update failed: dc=3Ddomain, dc=3Dnet objectclass: dcObject = =20 > objectclass: organization o: SNAFU =20 > dc: domain=20 > ldap_add: Referral (10) > referrals: > ldap://root.openldap.org/dc=3Ddomain,dc=3Dnet%20%20%20ob= jectclass:%20dcObject%20%20%20objectclass:%20organization%20%20%20o:%20SNAF= U%20%20%20dc:%20domain >=20 > Configuration > # less slap.conf > include /usr/local/etc/openldap/schema/core.schema > referral ldap://root.openldap.org > pidfile /var/run/ldap/slapd.pid > argsfile /var/run/ldap/slapd.args > database bdb > suffix "dc=3Ddomain, dc=3Dnet" > rootdn "cn=3DManager, dc=3Ddomain, dc=3Dnet" > rootpw <md5 hash> > directory /var/db/openldap-data > index objectClass eq >=20 > # less domain.ldif > dn: dc=3Ddomain, dc=3Dnet > objectclass: dcObject > objectclass: organization > o: SNAFU > dc: domain > dn: cn=3DManager, dc=3Ddomain, dc=3Dnet > objectclass: organizationalRole > cn: Manager What's the BASE setting in /usr/local/etc/openldap/ldap.conf ? That will set the default dn where clients search for data. As it is, your slapd.conf says that it serves the dn appropriate for 'domain.net'=20 The other question is what security settings have you entered into slapd.conf ? The default security setting is 'Allow read by all' and only the rootdn can write anywhere. =20 Cheers, Matthew --=20 Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks Savill Way PGP: http://www.infracaninophile.co.uk/pgpkey Marlow Tel: +44 1628 476614 Bucks., SL7 1TH UK --2JFBq9zoW8cOFH7v Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (FreeBSD) iD8DBQE/ImFAdtESqEQa7a0RApVYAJ9nzeVfx9BtDNG9e/mCXN/F88GW4wCfdUw6 1pOIom/1dsXx9pr3v++InBU= =adGB -----END PGP SIGNATURE----- --2JFBq9zoW8cOFH7v--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030726110848.GC29324>