6:06 p.m.
On Wednesday 29 July 2009 18:35:56 you wrote:
Roberto Polli wrote:
> On Wednesday 29 July 2009 18:09:17 Rich Megginson wrote:
>> Does this give any useful information?
>> http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Configuring_Directo
>>ry_
>> Databases-Creating_and_Maintaining_Database_Links.html#Creating_and_Main
>>tain ing_Database_Links-Database_Links_and_Access_Control_Evaluation
>
> I read it more than once..made some slides too
> http://docs.google.com/present/view?id=dd4mpk7p_10366hxdsmn
>
> nonethless I may have made some mistake.
>
> what I didn't understood is why - when updating userPassword - the remote
> server states that
>
>> NSACLPlugin - proxied authorization dn is ()
>
> instead of
>
>> NSACLPlugin - proxied authorization dn is (uid=u1,ou=serv
>> ice administrators,dc=babel,dc=it)
>
> hope this could clarify a bit my problem..
Are you using the ldappasswd command to update the password?
ldapmodify:
dn: uid=pippo,dc=example,dc=com
changetype: modify
replace: userPassword
userPassword: pippo1242102d32d322d8321p8enxnc093212190cx321
You may have to allow that component to chain.
http://www.redhat.com/docs/manuals/dir-server/8.1/admin/Configuring_Directo
ry_Databases-Creating_and_Maintaining_Database_Links.html#Configuring_the_Ch
aining_Policy-Chaining_Component_Operations
Even if I don't use SASL, anyway I enabled chaining of PasswordPolicy
controls, but nothing changes.
..
but..is it right that in aclplugin.c the function
acl_get_proxyauth_dn( pb, &proxy_dn, &errtext )
returns proxy_dn = "" ?
Peace,
R.
--
Roberto Polli
Babel S.r.l. - http://www.babel.it
Tel. +39.06.91801075 - fax +39.06.91612446
Tel. cel +39.340.6522736
P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma)
"Il seguente messaggio contiene informazioni riservate. Qualora questo
messaggio fosse da Voi ricevuto per errore, Vogliate cortesemente darcene
notizia a mezzo e-mail. Vi sollecitiamo altresì a distruggere il messaggio
erroneamente ricevuto. Quanto precede Vi viene chiesto ai fini del rispetto
della legge in materia di protezione dei dati personali."
6:15 p.m.
New subject: Chaining and LDAP_UNWILLING_TO_PERFORM problem
Roberto Polli wrote:
On Wednesday 29 July 2009 18:35:56 you wrote:
> Roberto Polli wrote:
>
>> On Wednesday 29 July 2009 18:09:17 Rich Megginson wrote:
>>
>>> Does this give any useful information?
>>> http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Configuring_Directo
>>> ry_
>>> Databases-Creating_and_Maintaining_Database_Links.html#Creating_and_Main
>>> tain ing_Database_Links-Database_Links_and_Access_Control_Evaluation
>>>
>> I read it more than once..made some slides too
>> http://docs.google.com/present/view?id=dd4mpk7p_10366hxdsmn
>>
>> nonethless I may have made some mistake.
>>
>> what I didn't understood is why - when updating userPassword - the remote
>> server states that
>>
>>
>>> NSACLPlugin - proxied authorization dn is ()
>>>
>> instead of
>>
>>
>>> NSACLPlugin - proxied authorization dn is (uid=u1,ou=serv
>>> ice administrators,dc=babel,dc=it)
>>>
>> hope this could clarify a bit my problem..
>>
> Are you using the ldappasswd command to update the password?
>
ldapmodify:
dn: uid=pippo,dc=example,dc=com
changetype: modify
replace: userPassword
userPassword: pippo1242102d32d322d8321p8enxnc093212190cx321
> You may have to allow that component to chain.
> http://www.redhat.com/docs/manuals/dir-server/8.1/admin/Configuring_Directo
> ry_Databases-Creating_and_Maintaining_Database_Links.html#Configuring_the_Ch
> aining_Policy-Chaining_Component_Operations
>
Even if I don't use SASL, anyway I enabled chaining of PasswordPolicy
controls, but nothing changes.
..
but..is it right that in aclplugin.c the function
acl_get_proxyauth_dn( pb, &proxy_dn, &errtext )
returns proxy_dn = "" ?
It is if there is no proxy auth control being sent.
Peace,
R.
6:28 p.m.
New subject: Chaining and LDAP_UNWILLING_TO_PERFORM problem
On Thursday 30 July 2009 01:15:00 Rich Megginson wrote:
> but..is it right that in aclplugin.c the function
> acl_get_proxyauth_dn( pb, &proxy_dn, &errtext )
> returns proxy_dn = "" ?
It is if there is no proxy auth control being sent.
but tcpdump states it's
sent...
Peace,
R.
--
Roberto Polli
Babel S.r.l. - http://www.babel.it
Tel. +39.06.91801075 - fax +39.06.91612446
Tel. cel +39.340.6522736
P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma)
"Il seguente messaggio contiene informazioni riservate. Qualora questo
messaggio fosse da Voi ricevuto per errore, Vogliate cortesemente darcene
notizia a mezzo e-mail. Vi sollecitiamo altresì a distruggere il messaggio
erroneamente ricevuto. Quanto precede Vi viene chiesto ai fini del rispetto
della legge in materia di protezione dei dati personali."
6:36 p.m.
New subject: Chaining and LDAP_UNWILLING_TO_PERFORM problem
Roberto Polli wrote:
On Thursday 30 July 2009 01:15:00 Rich Megginson wrote:
>> but..is it right that in aclplugin.c the function
>> acl_get_proxyauth_dn( pb, &proxy_dn, &errtext )
>> returns proxy_dn = "" ?
>>
> It is if there is no proxy auth control being sent.
>
but tcpdump states it's sent...
Without walking through the server with the debugger, it's going to be
difficult to tell what's going on. The function acl_get_proxyauth_dn()
is pretty straightforward - look at the request controls, see if version
1 or version 2 of the proxy auth control was sent, if so, grab the DN
from the control value. There is no obvious place in the code where
acl_get_proxyauth_dn() would be called conditionally (that is, not
called due to some condition). So I'm at a loss to explain how
acl_get_proxyauth_dn() could be called at all, with a valid proxy auth
control containing a non-empty DN value, and return a NULL or empty DN.
Peace,
R.
6:41 p.m.
New subject: Chaining and LDAP_UNWILLING_TO_PERFORM problem
On Thursday 30 July 2009 01:36:15 Rich Megginson wrote:
Roberto Polli wrote:
> On Thursday 30 July 2009 01:15:00 Rich Megginson wrote:
>>> but..is it right that in aclplugin.c the function
>>> acl_get_proxyauth_dn( pb, &proxy_dn, &errtext )
>>> returns proxy_dn = "" ?
>>
>> It is if there is no proxy auth control being sent.
>
> but tcpdump states it's sent...
Without walking through the server with the debugger, it's going to be
difficult to tell what's going on.
it's the whole day I'm trying that
way ;) hope to discover something.. I
should set thread to 1 to use gdb against slapd
The function acl_get_proxyauth_dn()
is pretty straightforward - look at the request controls, see if version
1 or version 2 of the proxy auth control was sent,
ok
if so, grab the DN
from the control value. There is no obvious place in the code where
acl_get_proxyauth_dn() would be called conditionally (that is, not
called due to some condition).
ok
So I'm at a loss to explain how
acl_get_proxyauth_dn() could be called at all, with a valid proxy auth
control containing a non-empty DN value, and return a NULL or empty DN.
Thats a
nice answer :P I'll continue to play with it..just hope not to be
silly enough to have some mistake in configs.
Maybe it's worth an rpm -U of the server...
Rich, thank you very much for all your prompt replies. I'll let you know.
Thanks again + Peace,
R.
--
Roberto Polli
Babel S.r.l. - http://www.babel.it
Tel. +39.06.91801075 - fax +39.06.91612446
Tel. cel +39.340.6522736
P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma)
"Il seguente messaggio contiene informazioni riservate. Qualora questo
messaggio fosse da Voi ricevuto per errore, Vogliate cortesemente darcene
notizia a mezzo e-mail. Vi sollecitiamo altresì a distruggere il messaggio
erroneamente ricevuto. Quanto precede Vi viene chiesto ai fini del rispetto
della legge in materia di protezione dei dati personali."
10:44 a.m.
New subject: Chaining and LDAP_UNWILLING_TO_PERFORM problem
just another failing test, to be sure it's a remote server issue:
#ldapmodify -D "uid=tproxy,cn=config" -w -Y "dn:uid=u1..." -f
/root/pippo.password.ldif
ldap_modify: Insufficient access
# dapmodify -D "uid=tproxy,cn=config" -w -Y "dn:uid=u1..." -f
/root/pippo.givenName.ldif
modifying entry uid=pippo,dc=example,dc=com
logs state:
NSACLPlugin - #### conn=11 op=1 binddn="uid=tproxy,cn=config"
instead of:
NSACLPlugin - proxied authorization dn is (uid=u1,ou=Service
Administrators,dc=babel,dc=it)
NSACLPlugin - #### conn=12 op=1 binddn="uid=tproxy,cn=config"
Peace, R
--
Roberto Polli
Babel S.r.l. - http://www.babel.it
Tel. +39.06.91801075 - fax +39.06.91612446
Tel. cel +39.340.6522736
P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma)
"Il seguente messaggio contiene informazioni riservate. Qualora questo
messaggio fosse da Voi ricevuto per errore, Vogliate cortesemente darcene
notizia a mezzo e-mail. Vi sollecitiamo altresì a distruggere il messaggio
erroneamente ricevuto. Quanto precede Vi viene chiesto ai fini del rispetto
della legge in materia di protezione dei dati personali."
5380
days inactive
5382
days old
389-users@lists.fedoraproject.org
5 comments
2 participants
participants (2)
-
Rich Megginson -
Roberto Polli