LDAP on Kerberos - Revision history

Ghudson: /* 0. Sample code to follow */

2015-12-22T17:26:53Z

‎0. Sample code to follow

Haoqili: /* Errors */

2009-08-26T15:46:52Z

‎Errors

Haoqili: /* Errors */

2009-08-24T19:51:21Z

‎Errors

Haoqili: /* Errors */

2009-08-24T19:37:20Z

‎Errors

Haoqili: /* 6. Starting */

2009-08-24T15:48:38Z

‎6. Starting

Haoqili: /* 5. Kerb Schema Operations */

2009-08-24T15:14:46Z

‎5. Kerb Schema Operations

Haoqili: /* 4. Build kerb. config */

2009-08-24T15:06:47Z

‎4. Build kerb. config

Haoqili: /* 4. Build kerb. config */

2009-08-24T15:02:51Z

‎4. Build kerb. config

Haoqili: /* 4. Build kerb. config */

2009-08-24T15:02:25Z

‎4. Build kerb. config

Haoqili: /* Errors */

2009-08-24T14:12:46Z

‎Errors

@@ Line 30: / Line 30: @@
 cd /home/haoqili/trunk/src/
 make distclean
-util/reconf
+autoreconf
 ./configure --with-ldap
 make

← Older revision		Revision as of 15:46, 26 August 2009
Line 338:		Line 338:
	</pre>		</pre>
	** I looked at the kdc log file, it says: ''krb5kdc: Error reading password from stash: Bind DN entry missing in stash file - while initializing database for realm D.COM''		** I looked at the kdc log file, it says: ''krb5kdc: Error reading password from stash: Bind DN entry missing in stash file - while initializing database for realm D.COM''
		+	*$ kdb5_ldap_util -D cn=admin,dc=example,dc=org -w a -H ldapi:/// stashsrvpw cn=admin,dc=example,dc=org
		+	*: Password for "cn=admin,dc=example,dc=org":
		+	*: Re-enter password for "cn=admin,dc=example,dc=org":
		+	*: ERROR: kdb5_ldap_util: Permission denied Failed to open file /usr/local/var/service_passwd: Permission denied
		+	*: SOLUTION: make sure your config files are exported in the terminal you use to do this command.

← Older revision		Revision as of 19:51, 24 August 2009
Line 327:		Line 327:
	**: ERROR: kdb5_ldap_util: Kerberos Container create FAILED: Server is unwilling to perform while creating realm 'EXAMPLE.ORG'		**: ERROR: kdb5_ldap_util: Kerberos Container create FAILED: Server is unwilling to perform while creating realm 'EXAMPLE.ORG'
	**: Explaination: this is because even though the command domain names have changed, the config files (krb5.conf, kdc.conf) also need to reflect the correct domain name.		**: Explaination: this is because even though the command domain names have changed, the config files (krb5.conf, kdc.conf) also need to reflect the correct domain name.
		+	* After changing all the example.org's into d.com's, the create command worked. So I proceeded to: <code>kdb5_ldap_util -D cn=admin,dc=example,dc=org -H ldapi:/// stashsrvpw cn=admin,dc=D,dc=COM</code>, I entered my passwords
		+	* kadmin.local and krb5kdc failed with errors:
		+	<pre>
		+	$ kadmin.local
		+	Authenticating as principal haoqili/admin@D.COM with password.
		+	kadmin.local: Server error while initializing kadmin.local interface
		+
		+	$ krb5kdc
		+	krb5kdc: cannot initialize realm D.COM - see log file for details
		+	</pre>
		+	** I looked at the kdc log file, it says: ''krb5kdc: Error reading password from stash: Bind DN entry missing in stash file - while initializing database for realm D.COM''

← Older revision		Revision as of 19:37, 24 August 2009
Line 301:		Line 301:

	*: SOLUTION: This will tell what is locking it: <code>fuser -v /var/cache/debconf/config.dat</code>. [http://spiralinks.blogspot.com/2009/07/debian-apt-get-interrupted-leaves-files.html From here.]		*: SOLUTION: This will tell what is locking it: <code>fuser -v /var/cache/debconf/config.dat</code>. [http://spiralinks.blogspot.com/2009/07/debian-apt-get-interrupted-leaves-files.html From here.]
		+
		+	* Here is a series of steps, some with errors that I got when I am changing the domain name (specified from sudo dpkg-reconfigure slapd) from "example.org" to "D.COM." The errors might be helpful in pointing people to the right direction if they encounter the same errors.
		+	** With my config files still with realms set to "example.org", after I did
		+	<pre>
		+	sudo ldapadd -x -D cn=admin,cn=config -W -f /tmp/ldif_output/cn\=config/cn\=schema/cn\=\{6\}kerberos.ldif -H ldapi:///
		+	Enter LDAP Password:
		+	adding new entry "cn=kerberos,cn=schema,cn=config"
		+	</pre>
		+
		+	** I then did <code>kdb5_ldap_util -D cn=admin,dc=example,dc=org -H ldapi:/// create -s </code>
		+	**: ERROR: kdb5_ldap_util: Invalid credentials while initializing database
		+	**: Explaination: this is because the dc is no longer example.org anymore. So I did:
		+	** Changing this command to reflect the correct domain: <code>kdb5_ldap_util -D cn=admin,dc=D,dc=COM -H ldapi:/// create -s</code>
		+	**: Output:
		+	<pre>
		+	Password for "cn=admin,dc=D,dc=COM":
		+	Initializing database for realm 'EXAMPLE.ORG'
		+	You will be prompted for the database Master Password.
		+	It is important that you NOT FORGET this password.
		+	Enter KDC database master key:
		+	Re-enter KDC database master key to verify:
		+
		+	Kerberos container is missing. Creating now...
		+	</pre>
		+	**: ERROR: kdb5_ldap_util: Kerberos Container create FAILED: Server is unwilling to perform while creating realm 'EXAMPLE.ORG'
		+	**: Explaination: this is because even though the command domain names have changed, the config files (krb5.conf, kdc.conf) also need to reflect the correct domain name.

@@ Line 168: / Line 168: @@
 == 6. Starting ==
 * Create your database with kdb5_ldap_util instead of kdb5_util:
-*: <code>kdb5_ldap_util -D cn=admin,dc=example,dc=org -W -H ldapi:/// create  -s
+*: <code>kdb5_ldap_util -D cn=admin,dc=example,dc=org -H ldapi:/// create  -s
 </code>
 output:

@@ Line 163: / Line 163: @@
 #** Delete the bottom lines: from ''structuralObjectClasses: olcSchemaConfig'' to ''modifyTimestamp: 20090811205313Z''
 # load new schema: <code>sudo ldapadd -x -D cn=admin,cn=config -W -f /tmp/ldif_output/cn\=config/cn\=schema/cn\={6}kerberos.ldif -H ldapi:///</code>
 #: Output: ''adding new entry "cn=kerberos,cn=schema,cn=config"''

@@ Line 108: / Line 108: @@
 #*#: slapd   slapd/allow_ldap_v2     boolean false
 #* Option 2, Noninteractive Option
 #*# Save this file in /tmp/debconfile: [[debconfile]]
 #*# <code>sudo debconf-set-selections /tmp/debconfile</code>

@@ Line 85: / Line 85: @@
 #* for ldapsearch: <code>sudo apt-get install ldap-utils</code>
 #* <code>sudo apt-get install libldap2-dev</code>
-# Set the "domain" of your LDAP server with <code>sudo dpkg-reconfigure slapd</code>
+# Set "domain" of your LDAP server
-##: Indented are the debconf-get-selections lines
+#* Option 1, Interactive Option: <code>sudo dpkg-reconfigure slapd</code>
-## Omit OpenLDAP server configuration: No
+#*: Indented are the debconf-get-selections lines
-##: slapd   slapd/no_configuration  boolean false
+#*# Omit OpenLDAP server configuration: No
-## DNS domain name: example.org
+#*#: slapd   slapd/no_configuration  boolean false
-##: slapd   slapd/domain    string  example.org
+#*# DNS domain name: example.org
-## Organization name: example.org [note: i used the same name for simplicity]
+#*#: slapd   slapd/domain    string  example.org
-##: slapd   shared/organization     string  example.org
+#*# Organization name: example.org [note: i used the same name for simplicity]
-## Databases backend to use: HDB, instead of BDB
+#*#: slapd   shared/organization     string  example.org
-##: slapd   slapd/backend   select  HDB
+#*# Databases backend to use: HDB, instead of BDB
-## Do you want the database to be removed when slapd is purge: Yes
+#*#: slapd   slapd/backend   select  HDB
-##: slapd   slapd/purge_database    boolean true
+#*# Do you want the database to be removed when slapd is purge: Yes
-## Move old database: Yes
+#*#: slapd   slapd/purge_database    boolean true
-##: slapd   slapd/move_old_database boolean true
+#*# Move old database: Yes
-## Admin password: [your pwd]
+#*#: slapd   slapd/move_old_database boolean true
-##: slapd   slapd/password1 password
+#*# Admin password: [your pwd]
-##: [I'm not sure about the debconf-get-selection line here.  There are 5 different password lines!]
+#*#: slapd   slapd/password1 password
-## Confirm password: [your pwd]
+#*#: [I'm not sure about the debconf-get-selection line here.  There are 5 different password lines!]
-##: slapd   slapd/password2 password
+#*# Confirm password: [your pwd]
-## Allow LDAPv2 protocol: No
+#*#: slapd   slapd/password2 password
-##: slapd   slapd/allow_ldap_v2     boolean false
+#*# Allow LDAPv2 protocol: No
-#: Checkpoint:  If you are successful, you should see as output:
+#*#: slapd   slapd/allow_ldap_v2     boolean false
-#:: ''Stopping OpenLDAP: slapd.''
+#* Option 2, Noninteractive Option
-#::  ''Moving old database directory to /var/backups:''
+#*# Save this file in /tmp/debconfile: [debconfile]
-#::  ''- directory unknown... done.''
+#*# <code>sudo debconf-set-selections /tmp/debconfile</code>
-#::  ''Creating initial slapd configuration... done.''
+#*# <code>sudo dpkg-reconfigure --frontend=noninteractive slapd</code>
-#::  ''Creating initial LDAP directory... done.''
+#* Checkpoint:  If you are successful, you should see as output:
-#:: ''* Reloading AppArmor profiles ''
+#*: ''Stopping OpenLDAP: slapd.''
-#::  ''...                                               [ OK ]''
+#*:  ''Moving old database directory to /var/backups:''
-#::  ''Starting OpenLDAP: slapd.''
+#*:  ''- directory unknown... done.''
 # If you haven't done so already, please copy kerberos.schema from your kerberos trunk into /etc/ldap/schema: <code>sudo cp src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema /etc/ldap/schema</code>
 # To restrict access to the local machine, <code>sudo vim /etc/default/slapd</code>, search for SLAPD_SERVICES and set it to: <pre>SLAPD_SERVICES="ldapi:///"</pre>

← Older revision		Revision as of 14:12, 24 August 2009
Line 292:		Line 292:
	</pre>		</pre>

−	*: SOLUTION: This will tell what is locking it: <code>fuser -v /var/cache/debconf/config.dat</code>. [ http://spiralinks.blogspot.com/2009/07/debian-apt-get-interrupted-leaves-files.html From here.]	+	*: SOLUTION: This will tell what is locking it: <code>fuser -v /var/cache/debconf/config.dat</code>. [http://spiralinks.blogspot.com/2009/07/debian-apt-get-interrupted-leaves-files.html From here.]