On Wed, May 4, 2022 at 2:05 PM parimala nitesh parimalanitesh@gmail.com wrote:

Hi Pierri,

Thank you Pierri for the response. My queries are inline

[1]If you can set up replication between the two LDAP server instances then the data will be available on both instances.

What if the users are getting added on external LDAP. Then i've to replicate it again?

No Replication keeps the data in sync. That said I am not sure whether we can replicate from Open LDAP towards 389DS.

[2]If server2 suffix is different from server1 suffix, then you could use chaining. (so that request to Server1 get forwarded to request2)

Can i get any documentation link for this chaining(If user1 belongs to ldapserver and ext_user is user for external_ldap. What happens if user1 is requesting will it go to external_ldap to get authenticated ?)

Here is some Chaining documentation: https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/ht... To answer your question: For chaining to work properly you must organize your DIT such a way that entries belongs on different backend So the DIT will looks like uid=user1,ou=users,ou=local data,dc=domain,dc=com uid=ext1_user1,ou=users,ou=openldap data,dc=domain,dc=com uid=ext2_user1,ou=users,ou=AD data,dc=domain,dc=com

So a bind on uid=user1,ou=users,ou=local data,dc=domain,dc=com will be handled locally a bind on uid=user1,ou=users,ou=local data,dc=domain,dc=com will be handled locally a bind on uid=ext1_user1,ou=users,ou=openldap data,dc=domain,dc=com will be send toward open ldap a bind on uid=ext2_user1,ou=users,ou=AD data,dc=domain,dc=com will be sent on AD

But a subtree search on dc=domain,dc=com will be sent on the 3 LDAP servers

[3] using the Pass Through Authentication plugin (In that case only the bind requests will be forwarded. But that may not be enough depending how exactly the application is checking the ldap authentication)

I see that Openldap proxy option isn't there 389ds. Is there any other pass through autentication plugin. if you can you please share a link by which i can implement this option.

I will let the Open ldap expert answer this one ! -;)

Regards Pierre

Thank you Parimala Nitesh _______________________________________________ 389-users mailing list -- 389-users@lists.fedoraproject.org To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

Sorry for the delay I've been unwell.

On 13 May 2022, at 20:05, parimala nitesh parimalanitesh@gmail.com wrote:

Hi Pierre Rogier,

I've tried to follow this document for pass through authentication https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/ht...

For that i've create two 389ds ldap servers

i've created ldap1 with ldap1.inf

# ldap1.inf

[general] config_version = 2

[slapd] self_sign_cert = False instance_name = ldap1 port = 1389 # root_dn (str) # Description: Sets the Distinquished Name (DN) of the administrator account for this instance. # Default value: cn=Directory Manager root_dn = cn=ldap2

# root_password (str) # Description: Sets the password of the account specified in the "root_dn" parameter. You can either set this parameter # to a plain text password dscreate hashes during the installation or to a "{algorithm}hash" string generated by the pwdhash utility. # Note that setting a plain text password can be a security risk if unprivileged users can read this INF file! # Default value: Directory_Manager_Password root_password = #CEEadmin123

You probably shouldn't plaintext your dev password here ...

[backend-userroot] sample_entries = yes suffix = dc=openstack,dc=org

Ldap2 with below file ldap2.inf

# ldap2.inf

[general] config_version = 2

[slapd] self_sign_cert = False instance_name = ldap2 port = 2389 # root_dn (str) # Description: Sets the Distinquished Name (DN) of the administrator account for this instance. # Default value: cn=Directory Manager root_dn = cn=ldap2

# root_password (str) # Description: Sets the password of the account specified in the "root_dn" parameter. You can either set this parameter # to a plain text password dscreate hashes during the installation or to a "{algorithm}hash" string generated by the pwdhash utility. # Note that setting a plain text password can be a security risk if unprivileged users can read this INF file! # Default value: Directory_Manager_Password root_password = #CEEadmin123

[backend-userroot] sample_entries = yes suffix = dc=openstack,dc=org

Created a "ou=users" for ldap1 and added users under that "ou=users"

ceeinfra@infra3:~/389ds/ldap2> sudo dsidm -b "dc=openstack,dc=org" slapd-ldap1 account list dc=openstack,dc=org ou=groups,dc=openstack,dc=org ou=people,dc=openstack,dc=org ou=permissions,dc=openstack,dc=org ou=services,dc=openstack,dc=org uid=demo_user,ou=people,dc=openstack,dc=org cn=demo_group,ou=groups,dc=openstack,dc=org ou=users,dc=openstack,dc=org uid=ldap1_user1,ou=users,dc=openstack,dc=org uid=ldap1_user2,ou=users,dc=openstack,dc=org uid=ldap1_user3,ou=users,dc=openstack,dc=org

Created a "ou==people" for ldap2 and added users under that "ou=people"

ceeinfra@infra3:~/389ds/ldap2> sudo dsidm -b "dc=openstack,dc=org" slapd-ldap2 account list dc=openstack,dc=org ou=groups,dc=openstack,dc=org ou=people,dc=openstack,dc=org ou=permissions,dc=openstack,dc=org ou=services,dc=openstack,dc=org uid=demo_user,ou=people,dc=openstack,dc=org cn=demo_group,ou=groups,dc=openstack,dc=org uid=ldap2_user1,ou=people,dc=openstack,dc=org uid=ldap2_user2,ou=people,dc=openstack,dc=org uid=ldap2_user3,ou=people,dc=openstack,dc=org

Now i've followed your the steps from this link

sudo dsconf -D "cn=ldap1" ldap://localhost:1389 chaining link-create --suffix="ou=users,dc=example,dc=com" --server-url="ldap://localhost:2389" --bind-mech="Simple" --bind-dn="uid=ldap2_user3,ou=people,dc=openstack,dc=org" --bind-pw="ldap2_user3" "example_chain_name"

after that it stated that i've to give proxy admin permission to userroot in this case i think i've give permisson for "uid=ldap2_user3,ou=people,dc=openstack,dc=org"

I tried that with below file and command

#aci.ldif dn: ou=people,dc=openstack,dc=org changetype: modify add: aci aci: (targetattr = "*")(version 2; acl "Proxied authorization for database links"; allow (proxy) userdn = "ldap://localhost:2389/uid=ldap2_user3,ou=people,dc=openstack,dc=org";)

and below command

ceeinfra@infra2:~/389ds/ldap2> sudo ldapmodify -x -h infra2 -p 2389 -D "cn=ldap2" -w "#CEEadmin123" -f aci.ldif -v ldap_initialize( ldap://infra2:2389 ) add aci: (targetattr = "*")(version 3.0; acl "Proxied authorization for database links"; allow (proxy) userdn = "ldap://localhost:2389/uid=ldap2_user3,ou=people,dc=openstack,dc=org";) modifying entry "ou=people,dc=openstack,dc=org" ldap_modify: Invalid syntax (21) additional info: ACL Syntax Error(-5):(targetattr = \22\2a\22)(version 3.0; acl \22Proxied authorization for database links\22; allow (proxy) userdn = \22ldap://localhost:2389/uid=ldap2_user3,ou=people,dc=openstack,dc=org\22;)

I might have messed up some where. I'm stuck and i'm not able to proceed with chaining. Can you please help me

I've below queries also can you please answer them

1. Can you tell me if i've two ldap's whose suffixes are not same i.e.

for ldap1 id suffix is dc=openstack,dc=com for ldap2 suffix is dc=nitesh,com=org

Pretty sure that it works yes. That's the whole reason for chaining.

Can i do pass through authentication or chaining between those two LDAP's?

2. Can you tell me how to check bind of the users with ldapserver also ?

I think it doesn't work the way you think.

Chaining creates a backend database and "routes" through the mapping tree for queries to that. So Ithink in your config you've potentially confused it.

The mapping tree lets you assemble a variety of databases into a consistent tree. So when you added:

chaining link-create --suffix="ou=users,dc=example,dc=com"

Your mapping tree will probably contain something like:

dc=openstack,dc=org -> route-to local DB userRoot ou=users,dc=example,dc=com -> route-to chain DB

If you look at the rootDSE with:

ldapsearch -x -b '' -s base * +

You'll see that there is another suffix, probably the ou=users,dc=example,dc=com one.

So if you were to search under ou=users,dc=example,dc=com on ldap1 that should chain to ldap2.

Does that help?

Regards Nitesh _______________________________________________ 389-users mailing list -- 389-users@lists.fedoraproject.org To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

-- Sincerely,

William Brown

Senior Software Engineer, Identity and Access Management SUSE Labs, Australia

Yes Willam, I'm expecting something like that. After integration, if some users are getting added on external_ldap they should also get authenticated on 389ds

note: external ldap can be 389ds or openldap or windows AD

Regards Parimala Nitesh

Apologies for creating confusion.

My Problem statement: I've a Server1 on which I've installed 389ds lets call it out as internal_ldap. I've installed Openstack on the same server and I'm integrating this internal_ldap as my ldap backend to Openstack Keystone(https://docs.openstack.org/keystone/pike/admin/identity-integrate-with-ldap....) by which all the users of the ldap can use the Openstack. I've an external_ldap(can be 389ds or openldap or any AD) on Server2. Now i've to integrate this external ldap also to my Openstack Keystone.

As my internal_ldap is already integrated with Openstack Keystone, if i can integrate both internal_ldap and external_ldap, then i thought users of external_ldap also also use Openstack.

So by integrating internal_ldap and external_ldap i think i can solve my problem

Regards Nitesh

Hi Willam,

I couldn't find any documentation for pam-passthru authentication. Can you please share any documentation related how to achieve pam-passthru and how to do verification for the same

Regards Nitesh

Hi Willam Brown,

I've tried to follow this document for pass through authentication https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/ht...

For that i've create two 389ds ldap servers

i've created ldap1 with ldap1.inf

# ldap1.inf

[general] config_version = 2

[slapd] self_sign_cert = False instance_name = ldap1 port = 1389 # root_dn (str) # Description: Sets the Distinquished Name (DN) of the administrator account for this instance. # Default value: cn=Directory Manager root_dn = cn=ldap2

# root_password (str) # Description: Sets the password of the account specified in the "root_dn" parameter. You can either set this parameter # to a plain text password dscreate hashes during the installation or to a "{algorithm}hash" string generated by the pwdhash utility. # Note that setting a plain text password can be a security risk if unprivileged users can read this INF file! # Default value: Directory_Manager_Password root_password = #CEEadmin123

[backend-userroot] sample_entries = yes suffix = dc=openstack,dc=org

Ldap2 with below file ldap2.inf

# ldap2.inf

[general] config_version = 2

[slapd] self_sign_cert = False instance_name = ldap2 port = 2389 # root_dn (str) # Description: Sets the Distinquished Name (DN) of the administrator account for this instance. # Default value: cn=Directory Manager root_dn = cn=ldap2

# root_password (str) # Description: Sets the password of the account specified in the "root_dn" parameter. You can either set this parameter # to a plain text password dscreate hashes during the installation or to a "{algorithm}hash" string generated by the pwdhash utility. # Note that setting a plain text password can be a security risk if unprivileged users can read this INF file! # Default value: Directory_Manager_Password root_password = #CEEadmin123

[backend-userroot] sample_entries = yes suffix = dc=openstack,dc=org

Created a "ou=users" for ldap1 and added users under that "ou=users"

ceeinfra@infra3:~/389ds/ldap2> sudo dsidm -b "dc=openstack,dc=org" slapd-ldap1 account list dc=openstack,dc=org ou=groups,dc=openstack,dc=org ou=people,dc=openstack,dc=org ou=permissions,dc=openstack,dc=org ou=services,dc=openstack,dc=org uid=demo_user,ou=people,dc=openstack,dc=org cn=demo_group,ou=groups,dc=openstack,dc=org ou=users,dc=openstack,dc=org uid=ldap1_user1,ou=users,dc=openstack,dc=org uid=ldap1_user2,ou=users,dc=openstack,dc=org uid=ldap1_user3,ou=users,dc=openstack,dc=org

Created a "ou==people" for ldap2 and added users under that "ou=people"

ceeinfra@infra3:~/389ds/ldap2> sudo dsidm -b "dc=openstack,dc=org" slapd-ldap2 account list dc=openstack,dc=org ou=groups,dc=openstack,dc=org ou=people,dc=openstack,dc=org ou=permissions,dc=openstack,dc=org ou=services,dc=openstack,dc=org uid=demo_user,ou=people,dc=openstack,dc=org cn=demo_group,ou=groups,dc=openstack,dc=org uid=ldap2_user1,ou=people,dc=openstack,dc=org uid=ldap2_user2,ou=people,dc=openstack,dc=org uid=ldap2_user3,ou=people,dc=openstack,dc=org

Now i've followed your the steps from this link https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/ht...

and i ran below commands to pass through from ldap1 to ldap2 users to

dsconf -D "cn=ldap1" ldap://infra3:1389 plugin pass-through-auth enable

dsconf -D "cn=ldap1" ldap://infra3:1389 plugin pass-through-auth url add "ldap://infra3:2389/ou=people"

and restarted

sudo dsctl slapd-ldap1 restart

Can you tell me how to verify the users of ldap2 to get authenticated with ldap1 server(below are the points from the documentation)

The user directory is now configured to send all bind requests for entries with a DN containing o=RedHat to the configuration directory authdir.example.com.

The user directory allows any user from o=RedHat to bind.

1) Can you also tell me if i've two ldap's whose suffixes are not same i.e. for ldap1 id suffix is dc=openstack,dc=com for ldap2 suffix is dc=nitesh,com=org

Can i do pass through authentication or chaining between those two LDAP's?

2) Can you tell me how to check bind of the users with ldapserver also ?

I'm literally new to 389ds please bare with my questions.

Regards Nitesh