Questions[slapd](server)

I have an OpenLDAP 2.4 server running on Ubuntu 18.04 LTS. Everytime I run

# slapcat -l test.ldif

my slapd.log file gets truncated (i. e. previous log messages are deleted and new ones are written at the beginning of the file).

Actually, the first line of slapd.log shows slapcat's output:

# head /var/log/slapd.log
620ca0f1 The first database does not allow slapcat; using the first available one (2)
Feb 16 08:00:15 srv21449 slapd[2096]: conn=274238 op=552602 SRCH base="" scope=0 deref=0 filter="(objectClass=*)"
Feb 16 08:00:15 srv21449 slapd[2096]: conn=274238 op=552602 SRCH attr=1.1

That leads me to think the truncation of the file happens even before slapcat generates any output.

As far as I understand slapcat doesn't have anything to do with logging (which is done by slapd daemon), so I believe I'm missing something... Any ideas out there?

Edit #1: I run slapcat command with slapd running. At the moment I am not able to stop the service to check if this would happen when the daemon is not running. I read before that this should be avoided, but from slapcat's man page:

For some backend types, your slapd(8) should not be running (at least, not in read-write mode) when you do this to ensure consistency of the database. It is always safe to run slapcat with the slapd-bdb(5), slapd-hdb(5), and slapd-null(5) backends.

Running slapcat over a running slapd with bdb backend (my case) should be safe

Edit #2 Investigating a bit further, I tried to use auditctl to monitor accesses to slapd.log by adding a new audit rule:

# auditctl -w /var/log/slapd.log -k slapd

After running slapcat again I see this:

type=PROCTITLE msg=audit(1645437260.398:5558713): proctitle=736C6170636174002D6C00746573742E6C646966
type=PATH msg=audit(1645437260.398:5558713): item=1 name="/var/log/slapd.log" inode=131414 dev=fd:04 mode=0100640 ouid=0 ogid=4 rdev=00:00 nametype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=PATH msg=audit(1645437260.398:5558713): item=0 name="/var/log/" inode=131074 dev=fd:04 mode=040775 ouid=0 ogid=106 rdev=00:00 nametype=PARENT cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1645437260.398:5558713): cwd="/root"
type=SYSCALL msg=audit(1645437260.398:5558713): arch=c000003e syscall=257 success=yes exit=4 a0=ffffff9c a1=55e525c35410 a2=241 a3=1b6 items=2 ppid=69682 pid=73954 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=903297 comm="slapcat" exe="/usr/sbin/slapcat" key="slapd"

Last line of the audit shows there was an access by /usr/sbin/slapcat, so it confirms that slapcat is actually doing something with slapd.log. I'm starting to ask myself is this is just expected behaviour from running slapcat "hot" (i.e. not stopping the slapd service), even that it does not make much sense to me...

I have configured OpenLDAP to act as a proxy server via meta backend to do remote queries to two different companies' Active Directory servers. Everything works correctly in terms of pulling information from both domains. However... we have a case where two of the same sAMAccountname gets pulled and that causes issues for one of the web application we are using.(The web application requires one search base hence why I am going with a meta solution)

Here is my config

database meta
suffix   "dc=example,dc=com"
rootdn   "cn=admin,dc=example,dc=com"
rootpw   "supers3cr3tpass"
conn-ttl 3600
access to * by * auth
sizelimit 1

uri           "ldap://<companyA>/dc=example,dc=com"
readonly      yes
lastmod       off
suffixmassage "dc=example,dc=com" "dc=companyA,dc=com"
map attribute uid sAMAccountName
idassert-bind bindmethod=simple
        binddn="CN=UserA,DC=companyA,DC=corp"
        credentials="something"
idassert-authzFrom "*"
idle-timeout 300
keepalive 180:3:60
network-timeout 5
timeout 10


uri "ldap://companyB/dc=example,dc=com"
readonly      yes
lastmod       off
suffixmassage "dc=example,dc=com" "dc=companyB,dc=com"
map attribute uid sAMAccountName
idassert-bind bindmethod=simple
   binddn="CN=UserB,DC=companyB,DC=com"
   credentials="dontknow"
idassert-authzFrom "*"
idle-timeout 300
keepalive 180:3:60
network-timeout 5
timeout 10

I know there is a sizelimit clause where you can limit the search query but it does not apply to the rootdn which I am using to do the lookups/binds.

I am wondering...

1. Is there a way to return only one result from the search query?
2. Am I able to use another account that has the DN ending with dc=example,dc=com to do the bind and lookup? Theoretically, this should apply the sizelimit clause.

Any advice and answer is appreciated.

Thanks in advance!

I have configured OpenLDAP with the memberOf overlay and everything works as expected for me. I can see the group memberships in the operational attributes of an object.

Now i am running into the problem, that some applications do not request operational attributes when reading the user object from the directory. Namely i am currently having issues with opnsense and keycloak which appear to not pick up on the memberOf attribute. Opensense even has a tester utility which shows all queried information, and it only shows the non-operational attributes. Other users are describing similar issues in a github issue at opensense's github repository.

My naive solution, and what i have tried to google, is: is there a setting so i can specify which attributes are returned by default? I think that the issue would be solved if memberOf would be returned by default, and not only if operational attributes are requested?

I am running openldap 2.4.45. Is there anyway I can get the last login time of a user using authtimestamp or any other attribute?

I'm trying to configure a LDAP server with some basic security parameters, including TLS and required authenticated binding.

I have started the server, and can access it from localhost with the command:

ldapsearch -x -b 'dc=server,dc=com' 'objectclass=*' -W -D 'cn=manager,dc=server,dc=com' -H ldaps://server.com:389

When I try the same command remotely, from my computer, I get the following error message:

ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

I don't know why this happens, I can ping my server and there is currently no firewall.

slapd is launched with -h ldaps://server.com:389/

DNS server is configured in a basic way on the same server, with only a A record.

Do you have any idea ?

EDIT

I've tested from another workstation, on arch-linux, and it works! On both computer I have TLS_REQCERT allow in /etc/openldap/ldap.conf, so that shouldn't be a certificate problem no?

The workstation on which the ldap query doesn't work is on Mac OS X, if that have any importance.

Some output:

Telnet:

telnet server.com 389

Trying w.x.y.z...
Connected to server.com.
Escape character is '^]'.

Iptables:

sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Netstat:

sudo netstat -lnt | grep 389

tcp        0      0 0.0.0.0:389             0.0.0.0:*               LISTEN     
tcp6       0      0 :::389                  :::*                    LISTEN  

I've tested without any security parameters, and I have the same result.