On 06/02/2016 05:54 PM, Job Cacka wrote:
Do you get entries back, or no entries?
I get back 222 entries. The entries are basically the contents of the directory minus the
attributes. like this, but with real data and commented lines removed:
dn: ou=USERS,dc=domain,dc=com
dn: uid=USERID,ou=USERS,dc=domain,dc=com
dn: sambaDomainName=SOMEGROUP,dc=domain,dc=com
Can you
paste the access log
showing these 4 searches(including the RESULT lines)?
Let me see what that contains...
/etc/dirsrv/slapd-INSTANCE/access
mine is in:
/var/log/dirsrv/slapd-INSTANCE/access
PLEASE NOTE: I obfuscated the IP address and the domain name in the below info.
ldapsearch -H
ldaps://ds1.domain.com [-x] -D "cn=directory manager" -w
"pass" -b "dc=domain,dc=com" "uid=*"
[02/Jun/2016:15:45:04 -0700] conn=36851 fd=67 slot=67 SSL connection from 192.168.x.y to
192.168.x.y
[02/Jun/2016:15:45:04 -0700] conn=36851 SSL 256-bit AES
[02/Jun/2016:15:45:04 -0700] conn=36851 op=0 BIND dn="cn=directory manager"
method=128 version=3
[02/Jun/2016:15:45:04 -0700] conn=36851 op=0 RESULT err=0 tag=97 nentries=0 etime=0
dn="cn=directory manager"
[02/Jun/2016:15:45:04 -0700] conn=36851 op=1 SRCH base="dc=domain,dc=com"
scope=2 filter="(objectClass=*)" attrs="[-x] uid=*"
[02/Jun/2016:15:45:04 -0700] conn=36851 op=1 RESULT err=0 tag=101 nentries=222 etime=0
notes=U
[02/Jun/2016:15:45:04 -0700] conn=36851 op=2 UNBIND
[02/Jun/2016:15:45:04 -0700] conn=36851 op=2 fd=67 closed - U1
ldapsearch -H
ldaps://ds1.domain.com [-x] -D "cn=directory manager" -w
"pass" -b "dc=domain,dc=com" uid=USERID
[02/Jun/2016:15:50:17 -0700] conn=37168 fd=91 slot=91 SSL connection from 192.168.x.y to
192.168.x.y
[02/Jun/2016:15:50:17 -0700] conn=37168 SSL 256-bit AES
[02/Jun/2016:15:50:17 -0700] conn=37168 op=0 BIND dn="cn=directory manager"
method=128 version=3
[02/Jun/2016:15:50:17 -0700] conn=37168 op=0 RESULT err=0 tag=97 nentries=0 etime=0
dn="cn=directory manager"
[02/Jun/2016:15:50:17 -0700] conn=37168 op=1 SRCH base="dc=domain,dc=com"
scope=2 filter="(objectClass=*)" attrs="[-x] uid=USERID"
[02/Jun/2016:15:50:17 -0700] conn=37168 op=1 RESULT err=0 tag=101 nentries=222 etime=0
notes=U
[02/Jun/2016:15:50:17 -0700] conn=37168 op=2 UNBIND
[02/Jun/2016:15:50:17 -0700] conn=37168 op=2 fd=91 closed - U1
ldapsearch -H
ldaps://ds1.domain.com [-x] -D "cn=directory manager" -w
"pass" -b "dc=domain,dc=com" uid=XYZ
[02/Jun/2016:15:55:46 -0700] conn=37444 fd=96 slot=96 SSL connection from 192.168.x.y to
192.168.x.y
[02/Jun/2016:15:55:46 -0700] conn=37444 SSL 256-bit AES
[02/Jun/2016:15:55:46 -0700] conn=37444 op=0 BIND dn="cn=directory manager"
method=128 version=3
[02/Jun/2016:15:55:46 -0700] conn=37444 op=0 RESULT err=0 tag=97 nentries=0 etime=0
dn="cn=directory manager"
[02/Jun/2016:15:55:46 -0700] conn=37444 op=1 SRCH base="dc=domain,dc=com"
scope=2 filter="(objectClass=*)" attrs="[-x] uid=xyz"
[02/Jun/2016:15:55:46 -0700] conn=37444 op=1 RESULT err=0 tag=101 nentries=222 etime=0
notes=U
[02/Jun/2016:15:55:46 -0700] conn=37444 op=2 UNBIND
[02/Jun/2016:15:55:46 -0700] conn=37444 op=2 fd=96 closed - U1
ldapsearch -H
ldaps://ds1.domain.com [-x] -D "cn=directory manager" -w
"pass" -b "dc=domain,dc=com" uid=USERID,ou=USERS,dc=domain,dc=com
[02/Jun/2016:16:02:34 -0700] conn=37831 fd=81 slot=81 SSL connection from 192.168.x.y to
192.168.x.y
[02/Jun/2016:16:02:34 -0700] conn=37831 SSL 256-bit AES
[02/Jun/2016:16:02:34 -0700] conn=37831 op=0 BIND dn="cn=directory manager"
method=128 version=3
[02/Jun/2016:16:02:34 -0700] conn=37831 op=0 RESULT err=0 tag=97 nentries=0 etime=0
dn="cn=directory manager"
[02/Jun/2016:16:02:34 -0700] conn=37831 op=1 SRCH base="dc=domain,dc=com"
scope=2 filter="(objectClass=*)" attrs="[-x]
uid=test2015,ou=users,dc=domain,dc=com"
[02/Jun/2016:16:02:34 -0700] conn=37831 op=1 RESULT err=0 tag=101 nentries=222 etime=0
notes=U
[02/Jun/2016:16:02:34 -0700] conn=37831 op=2 UNBIND
[02/Jun/2016:16:02:34 -0700] conn=37831 op=2 fd=81 closed - U1
for comparison I did this search. It gives a different number of entries, and it gives
only the attributes listed.
ldapsearch -H
ldaps://ds1.domain.com [-x] -D "cn=directory manager" -w
"pass" -b "ou=USERS,dc=domain,dc=com" uid cn entryid entrydn
sambaprimarygroupsid sambasid
[02/Jun/2016:16:06:06 -0700] conn=38002 fd=84 slot=84 SSL connection from 192.168.x.y to
192.168.x.y
[02/Jun/2016:16:06:06 -0700] conn=38002 SSL 256-bit AES
[02/Jun/2016:16:06:06 -0700] conn=38002 op=0 BIND dn="cn=directory manager"
method=128 version=3
[02/Jun/2016:16:06:06 -0700] conn=38002 op=0 RESULT err=0 tag=97 nentries=0 etime=0
dn="cn=directory manager"
[02/Jun/2016:16:06:06 -0700] conn=38002 op=1 SRCH
base="ou=USERS,dc=domain,dc=com" scope=2 filter="(objectClass=*)"
attrs="[-x] uid cn entryid entrydn sambaPrimaryGroupSID sambaSID"
[02/Jun/2016:16:06:06 -0700] conn=38002 op=1 RESULT err=0 tag=101 nentries=188 etime=0
notes=U
[02/Jun/2016:16:06:06 -0700] conn=38002 op=2 UNBIND
[02/Jun/2016:16:06:06 -0700] conn=38002 op=2 fd=84 closed - U1
> Yeah, it is a bit to digest...
>
> I would like to see what rights the uid=admin user has for an entry:
> Like I said "cn=directory
> manager" has full rights - it bypasses all
> access control. Just keep that in mind.
>
> Thanks,
> Mark