Falha na atualização da informação de senha LDAP: acesso insuficiente (50)

Question

Falha na atualização da informação de senha LDAP: acesso insuficiente (50)

#1 resposta do (2 votos)

1

Este problema é semelhante a este , exceto que neste caso, não está funcionando. : (

Até agora, tenho esse conjunto como ACL:

access to attrs=userPassword,shadowLastChange,shadowMin,shadowMax,shadowWarning,loginShell,shadowLastChange
    by anonymous auth
    by self write
    by users read 
    by * none

access to *
    by self write
    by users read
    by * none

Eu posso alterar a senha como raiz:

[root@sl6 openldap]# ldappasswd -D 'cn=root,dc=monzell,dc=com' -W -S 'uid=monzell,ou=People,dc=monzell,dc=com'
New password: 
Re-enter new password: 
Enter LDAP Password: 
[root@sl6 openldap]#

Mas não como usuário:

[root@sl6 openldap]# ldappasswd -D 'uid=monzell,ou=People,dc=monzell,dc=com' -W -S 'uid=monzell,ou=People,dc=monzell,dc=com'
New password: 
Re-enter new password: 
Enter LDAP Password: 
Result: Insufficient access (50)

Aqui está o meu esquema do usuário, BTW:

# monzell, People, monzell.com
dn: uid=monzell,ou=People,dc=monzell,dc=com
uid: monzell
cn: monzell
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
shadowLastChange: 15192
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 501
gidNumber: 501
homeDirectory: /home/users/monzell
userPassword:: (REDACTED)

Além do meu DN base:

dn: dc=monzell,dc=com
dc: monzell
objectClass: top
objectClass: domain

dn: ou=People,dc=monzell,dc=com
ou: People
objectClass: top
objectClass: organizationalUnit

dn: ou=Group,dc=monzell,dc=com
ou: Group
objectClass: top
objectClass: organizationalUnit

Estou executando o scientific linux 6.1, com o OpenLDAP 2.4.23-15.

(A propósito, a configuração é baseada na página aqui )

A saída de log de ldappasswd retorna o seguinte:

Aug 20 08:45:18 sl6 slapd[4634]: conn=1019 fd=24 ACCEPT from IP=127.0.0.1:50252 (IP=0.0.0.0:389)
Aug 20 08:45:18 sl6 slapd[4634]: conn=1019 op=0 BIND dn="uid=monzell,ou=People,dc=monzell,dc=com" method=128
Aug 20 08:45:18 sl6 slapd[4634]: conn=1019 op=0 BIND dn="uid=monzell,ou=People,dc=monzell,dc=com" mech=SIMPLE ssf=0
Aug 20 08:45:18 sl6 slapd[4634]: conn=1019 op=0 RESULT tag=97 err=0 text=
Aug 20 08:45:18 sl6 slapd[4634]: conn=1019 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.1
Aug 20 08:45:18 sl6 slapd[4634]: conn=1019 op=1 PASSMOD id="uid=monzell,ou=People,dc=monzell,dc=com" new
Aug 20 08:45:18 sl6 slapd[4634]: conn=1019 op=1 RESULT oid= err=50 text=
Aug 20 08:45:18 sl6 slapd[4634]: conn=1019 op=2 UNBIND
Aug 20 08:45:18 sl6 slapd[4634]: conn=1019 fd=24 closed

Aqui está o arquivo conf:

include     /etc/openldap/schema/corba.schema
include     /etc/openldap/schema/core.schema
include     /etc/openldap/schema/cosine.schema
include     /etc/openldap/schema/duaconf.schema
include     /etc/openldap/schema/dyngroup.schema
include     /etc/openldap/schema/inetorgperson.schema
include     /etc/openldap/schema/java.schema
include     /etc/openldap/schema/misc.schema
include     /etc/openldap/schema/nis.schema
include     /etc/openldap/schema/openldap.schema
include     /etc/openldap/schema/ppolicy.schema
include     /etc/openldap/schema/collective.schema
pidfile     /var/run/openldap/slapd.pid
argsfile    /var/run/openldap/slapd.args
TLSCACertificateFile /etc/openldap/cacerts/cacert.pem
TLSCertificateFile /etc/openldap/ssl/cert.crt
TLSCertificateKeyFile /etc/openldap/ssl/private.key
database    bdb
suffix "dc=monzell,dc=com"
checkpoint  1024 15
rootdn "cn=root,dc=monzell,dc=com"
rootpw <REDACTED
directory   /var/lib/ldap
index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub
database monitor
access to attrs=userPassword 
 by self write
 by users read 
 by * none
access to *
 by self write
 by users read
 by * none

EDIT: Agora isso é interessante. Quando eu definir o nível de log para 128, eu recebo isso no arquivo de log:

Aug 20 12:27:54 sl6 slapd[2692]: /etc/openldap/slapd.conf: line 139: warning: cannot assess the validity of the ACL scope within backend naming context
Aug 20 12:27:54 sl6 slapd[2692]: /etc/openldap/slapd.conf: line 144: warning: cannot assess the validity of the ACL scope within backend naming context
Aug 20 12:27:54 sl6 slapd[2693]: config_back_db_open: line 0: warning: cannot assess the validity of the ACL scope within backend naming context
Aug 20 12:27:54 sl6 slapd[2693]: slapd starting

EDIT: E quando tentei redefinir a senha, vejo isso:

Aug 20 12:32:47 sl6 slapd[2868]: => access_allowed: result not in cache (userPassword)
Aug 20 12:32:47 sl6 slapd[2868]: => access_allowed: auth access to "uid=monzell,ou=People,dc=monzell,dc=com" "userPassword" requested
Aug 20 12:32:47 sl6 slapd[2868]: => slap_access_allowed: backend default auth access granted to "(anonymous)"
Aug 20 12:32:47 sl6 slapd[2868]: => access_allowed: auth access granted by read(=rscxd)
Aug 20 12:32:47 sl6 slapd[2868]: => access_allowed: backend default write access denied to "uid=monzell,ou=People,dc=monzell,dc=com"

ldap openldap

por Rilindo 20.08.2011 / 04:54

1 resposta

Tags ldap openldap

Não é possível SSH na instância do EC2 Qual utilitário de backup de banco de dados devo usar?

score 2 · Accepted Answer

Sugiro que você ative o log do LDAP e dê uma olhada nisso. Em distros baseadas no Red Hat, você pode fazer isso seguindo as etapas:

Defina um recurso de syslog:

cat /etc/sysconfig/ldap 
SLAPD_OPTIONS="-l local4"

Especifique um arquivo de log para o OpenLDAP em /etc/syslog.conf :
```
# OpenLDAP log
local4.*            /var/log/ldap.log
```
touch /var/log/ldap.log e reinicie o syslogd

Em outras distros, na primeira etapa, basta adicionar o -l local4 na função start () no seu script de inicialização.

EDITAR

Defina loglevel para 128 (processamento de ACL) e tente novamente.

EDIT 2

cannot assess the validity of the ACL scope within backend naming context

Coloque as ACLs antes do contexto de back-end:

access to attrs=userPassword 
 by self write
 by users read 
 by * none
access to *
 by self write
 by users read
 by * none

database    bdb
suffix "dc=monzell,dc=com"
checkpoint  1024 15
rootdn "cn=root,dc=monzell,dc=com"
rootpw <REDACTED
directory   /var/lib/ldap
index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub
database monitor