OpenDS Tab Sweep April 27

It’s been a while since I last swept my browser’s tabs. OpenDS is being used and mentioned more and more those days.

  • Masoud Kalali, in the Java zone of DZone.com, wrote a long and detailed article demonstrating how to do end to end security with JavaDB. One of the mechanism for securing the access to the database is LDAP based authentication and authorization and Masoud details how to use OpenDS to enable this.
  • In the Architects zone of DZone.com, Masoud again published an interview with me (yeah, I know, but a little bit of self promotion never hurts) about the OpenDS project and Sun Directory Server Enterprise Edition.
  • Johan Andersson, wrote a blog post on the subject of LDAP and MySQL Cluster, describing some of the work we’ve done in the OpenDS project (and that has also been conducted in OpenLDAP).
  • On a different note, I came accross the Ldap Synchronization Connector (LSC) open source project (under the BSD license), delivering tools to to synchronize a LDAP directory from a list of data sources including any database with a JDBC connector, another LDAP directory, flat files… LSC seems a pretty new and confidential project, yet they are listing a few real customers based deployments. LSC is written in Java, and uses OpenDS as an embedded directory server.
  • OpenDS on Amazon EC2. An Amazon Machine Image (AMI) built on the OpenSolaris AMI, with OpenDS pre-installed and ready to use is now available and supported. This was announced along with AMI for GlassFish and OpenSSO.

Technorati Tags: , , , ,

Meeting the OpenDS and OpenSSO teams…

The OpenSSO and OpenDS communities will be gathering twice in the coming months.

In an “unconference” format, join us for a day or half-day of discussions and presentations with users, deployers and developers of our identity related open source projects.

May 5, 2009 in Munich.

This second OpenSSO Community Day will take place at the Deutschen Museum, München (Munich), Germany, kindly hosted by the European Identity Conference 2009.

If you haven’t done so, it is still time to register, but hurry up, there are few remaining seats.

And suggest your ideas, proposals for presentations on the OpenSSO Community Wiki page.

Note that OpenSSO Community Day attendees are eligible for a 20% discount on registration for the European Identity Conference. Quote discount code OPENSSO when registering.

May 31, 2009 in San Francisco, just before CommunityOne and JavaOne.

The third OpenSSO Community Day will be at the Moscone Center, San Francisco, CA, immediately before the CommunityOne West and JavaOne conferences.

Still in an ‘unconference’ format, the agenda includes all of Sun’s open source identity projects: OpenDS, OpenSSO and Identity Connectors. Suggest your ideas, proposal for presentations at http://wikis.sun.com/display/OpenSSO/OpenSSO+Community+Day+-+San+Francisco+-+May+31+2009.

Technorati Tags: , , , , ,

MySQL, data and LDAP access

MySQL Conference & Expo 2009

LDAP and RDBMs have often been opposed in the past with LDAP being the preferred service for fast frequent lookups, authentication and authorization, and RDBMs being the preferred service to write large data, updated frequently, mined some time to time.

But both technologies have some things in common: they are data stores and they are heavily used. And often, within an enterprise or a service provider, the data stored in the RDBMs is duplicated from the LDAP directory service (or vice-versa).

So there is an interest in sharing the data between RDBMs and LDAP. There are different ways to achieve this.

At the MySQL conference on April 20-23, 2009, we will be holding a BoF session to discuss how to make use of LDAP with MySQL databases, with Sun products : Sun Directory Server Enterprise Edition and OpenDS.

I hope to see you there.

Technorati Tags: , , , , , , ,

Hallo OpenDS ! Cześć OpenDS ! Hola OpenDS !

OpenDS, LDAP directory server. Open Standards, Open SourceCommunities are amazing. A day after we announced the Translation Community for the OpenDS project, we’ve already added 3 languages to the ones already set.

So I’m please to announce the availability in the Community Translation Interface, the OpenDS German translation project, the OpenDS Spanish translation project and the OpenDS Polish translation project.

OpenDS Gemeinschaft für Deutsch Übersetzung ist nun offen

OpenDS comunidad para la traducción español ya está abierto

OpenDS społeczność niemiecki tłumaczenie jest już otwarty

Disclaimer : those 3 translation above are computer generated, unlike the OpenDS community let translations !

General discussion are taking place on the G11N alias <g11n@opends.dev.java.net> but language specific mailing lists have been created to discuss in native languages the details:

  • For German : g11n_de@opends.dev.java.net
  • For Spanish : g11n_es@opends.dev.java.net
  • For Polish: g11n_pl@opends.dev.java.net

Please subscribe to the mailing lists if you intend to participate. And many thanks to the OpenDS community members that have already signed up.

Technorati Tags: , , , , ,

OpenDS 1.3.0-Build004 is now available

Opends Logo TagWe have just uploaded OpenDS 1.3.0-build004, built from revision 5184 of our source tree, to our promoted builds folder.

Note that this is a jump from OpenDS 1.3.0-build002 to OpenDS 1.3.0-build004. OpenDS 1.3.0-build003 was done with specific compilation to enable the MySQL Cluster NDB Backend, but not promoted with the regular builds.

The direct link to download the core server is: http://www.opends.org/promoted-builds/1.3.0-build004/OpenDS-1.3.0-build004.zip

The direct link to download the DSML gateway is: http://www.opends.org/promoted-builds/1.3.0-build004/OpenDS-1.3.0-build004-DSML.war

We have also updated the archive that may be used to install OpenDS via Java Web Start. You may launch that using the URL http://www.opends.org/promoted-builds/1.3.0-build004/install/QuickSetup.jnlp, or visit https://www.opends.org/wiki/page/OverviewOfTheQuickSetupTool for more information.

Upgrade from 1.0 or 1.2 is still broken, but upgrade from 1.3.0-build002 should work. However, a Flag Day was raised with revision 5134 which requires a rebuild of all indexes, or even better export the database to LDIF and re-import it.

Compared to 1.2.0, OpenDS 1.3.0-build004 contains the following new features and major improvements :

  • Assured Replication that provides stronger consistency and availability for replicated data
  • Supports Recurring Tasks allowing an administrator to schedule repeated tasks such as backups
  • Improves defaults settings and ergonomics for some server properties
  • Now builds VLV indexes during Import
  • A new internal ASN.1 encoding / decoding library that delivers better and more stable performances
  • Improves the Control Panel in various area
  • Now works well / better with IBM JVM
  • Full compliance with RFC 4518. Now DirectoryString matching fully supports UTF-8 characters
  • Supports languages specific matching rules for DirectoryStrings, for comparing and ordering, as well as support for indexing according to those rules
  • Provides better monitoring information for Replication
  • Full support for negotiating encryption through SASL and stacking encryption channels with TLS
  • Many performance improvements in the Core server and in Replication

Detailed information about this build is available at http://www.opends.org/promoted-builds/1.3.0-build004.

Major changes that have been incorporated since the last promoted build (OpenDS 1.3.0-build002) include:

  • Revision 5124 (Issue #3626) – Replace occurrences of grep, cat, etc. with built-in shell commands.
  • Revision 5125 (Issue #3896) – Fix an issue that prevented users from creating a sub-suffix with the Control Panel.
  • Revision 5126 (Issue #3826) – Fix an exception in the Control Panel that occurred if a node existed as a non-suffix node.
  • Revision 5129 (Issues # 3295 & 3899) – Fix an SNMP exception at startup and a resource issue on Windows platforms.
  • Revision 5130 (Issue #3297) – Fix a problem that caused localised answers to be rejected by certain commands.
  • Revision 5131 (Issue #3528) – Check that the start time entered for scheduled tasks has not already passed.
  • Revision 5132 – Remove keytool dependencie by using the keystore API, integrate Andy Wang’s IBM JVM/JDK changes, provide a Platform class to put platform and JDK version-specific code in a single location, provide APIs for core matching rules.
  • Revision 5133 (Issue #2616) – Fix an ldapsearch error when parsing command-line arguments.
  • Revision 5134 (Issue #3880) – Provide support for unicode characters in core matching rules.
  • Revision 5135 – Create a flag day for changes in revision 5134.
  • Revision 5136 (Issue #3555) – Refresh the DIT view in the Manage Entries menu of the Control Panel.
  • Revision 5138 (Issue #3582) – Fix a problem that caused reverts to fail with the error “no valid existing backup locations”.
  • Revision 5139 (Issue #3451) – Use a specific error message with ldapcompare if a specified file cannot be read.
  • Revision 5141 (Issue #3894) – Fix a potential data corruption issue when writing binary attributes/blobs.
  • Revision 5143 (Issue #3903) – Fix a problem that caused the “Start Server when the Upgrade has Completed” option to fail when upgrading using QuickSetup.
  • Revision 5145 (Issue #3455) – Correct an error that occurred when deleting a VLV index.
  • Revision 5147 (Issue #2793) – Ensure that incremental backups work as expected when an empty directory is specified.
  • Revision 5148 – Provide localized resource files.
  • Revision 5149 (Issue #3893) – Correct a problem that caused dsreplication enable between an OpenDS 1.2 server and an OpenDS 1.3 server to fail.
  • Revision 5150 & 5153 (Issue #3629) – Remove duplicate dsconfig error messages.
  • Revision 5151 (Issue #3793) – Provide the ability to create extensible indexes using dsconfig.
  • Revision 5152 (Issue #3910) – Ensure that Base64 encoding works with UTF-8 characters.
  • Revision 5155 (Issue #3908) – Fix a problems with ChangeNumber generators.
  • Revision 5156 (Issue #3892) – Make ACI evaluation optional when returning entries and references to clients.
  • Revision 5157 (Issue #3900) – Fix an error that occurred when importing / adding LDIF due to trailing spaces.
  • Revision 5158 (Issue #3505) – Fix a confusing ACI targetscope message.
  • Revision 5159 (Issue #2667) – Fix a problem that occurred when configuring VLV indexes with dsconfig.
  • Revision 5160 (Issue #3312) – Change aci and ds-cfg-global-aci equality matching rules to octetStringMatch instead of CaseIgnoreIA5EqualityMatchingRule.
  • Revision 5161 (Issue #2624) – Ensure that ldapsearch returns the correct return code when no password is provided.
  • Revision 5167 (Issue #3828) – Prevent a connection to the server from being tied up while waiting for the user to enter a password.
  • Revision 5168 (Issue #3321) – Fix an error raised during index creation and delete with dsconfig.
  • Revision 5169 (Issue #3270) – Ensure that ldappasswordmodify takes into account the password history count.
  • Revision 5171 (Issue #3251) – Fix the LDIFReader rejectLastEntry, which printed an incorrect entry.
  • Revision 5172 (Issue #2963) – Fix a problem that caused dsreplication status to display an incorrect value for missing changes.
  • Revision 5173 (Issue #3907) – Provide a pkg(5) delivery.
  • Revision 5174 (Issue #3904) – Complete the replication referral URL configuration regular expression implementation.
  • Revision 5175 (Issue #3748) – Ensure that all admin tools use 4444 as the default admin port.
  • Revision 5176 (Issue #3856) – Fix a problem that caused LDAPS connections to be logged as LDAP connections in the access log.
  • Revision 5177 (Issue #3673) – Ensure that the server checks for port availability on Windows.
  • Revision 5178 (Issue #3528) – Ensure that scheduled tasks check that the start time has not passed.
  • Revision 5179 (Issue #2965) – Add the missing-changes to cn=monitor for replication servers.
  • Revision 5180 & 5181 (Issue #3119) – Prevent a null pointer exception that occurred when disabling the referential integrity plugin.
  • Revision 5184 (Issue #3914) – Fix a problem that prevented the server state from being updated.

Technorati Tags: , , , , ,

Getting started with OpenDS Translations

OpenDS for the International crowd...Pavel Heimlich, the lead for the French translation for OpenDS, kindly posted an How To Guide for using CTI for the OpenDS community led translations, on the OpenDS Wiki.

If you’re interested in testing your translation skills with OpenDS messages, check the page, it gives a pretty good idea on how simple it is to use the tool… The hard part is really in providing good and consistent translation !

Technorati Tags: , , , , ,

Hello OpenDS ! こんにちは OpenDS ! Salut OpenDS !

OpenDS, the open source LDAP directory server in Java

[English] [Japanese] [French]

Dear OpenDS Community,

We are in the process of building the Translation Community for OpenDS, the open source LDAP Directory Service, and are calling for your participation. If you are interested in trying your skills as a translator a Quick start guide() is provided for you to get started with Community Translation Interface (CTI), a web based tool allowing community led translation.

As you may know, OpenDS 1.1 was translated into 7 languages. We would like your help now, to translate OpenDS 2.0 into the same 7 languages: Japanese, Traditional Chinese, Simplified Chinese, Korean, French, German, and Spanish. Today we’re starting with two languages (Japanese and French) but we will expand as contributors are lining up.

We would like to introduce our Language Leads for growing Community Translations.

Language Lead for Japanese Community Translation : Shinichi Hanaki <Shinichi (dot) Hanaki (at)Sun (dot) COM>. Contact Japanese Community Alias: g11n_ja@opends.dev.java.net

Language Lead for French Community Translation: Pavel Heimlich <Pavel (dot) Heimlich (at) Sun (dot) COM >

Contact French Community Alias: g11n_fr@opends.dev.java.net

Welcome Hanaki and Pavel.

Send your queries to g11n@opends.dev.java.net

Regards,

Shankar and Ludovic.


OpenDS コミュニティにご参加のみなさん、

私たちは、オープンソースの LDAP ディレクトリサービスである OpenDS

翻訳をコミュニティと共同で行うために、翻訳プロジェクトへのみなさんの参加をお待ちしてます。

もし、翻訳作業に関して興味がありましたら、以下のクイックスタートガイドを

参照してみてください。

https://cti.sunvirtuallab.com/community/help.jsp

このガイドでは、コミュニティの方が翻訳する際に実際に使っていただく、

web ベースのツール Community Translation Interface (CTI) について紹介しています。

ご存じのように OpenDS 1.0 では、英語以外に、日本語を含めて 7 つの言語でローカライズされていますが、

翻訳されている範囲はまだまだ限られており、今後、もっと多くの範囲を翻訳するために、

ぜひコミュニティの方にもお手伝いいただければと思っております。

まずは、手始めに日本語とフランス語に関して、コミュニティと共同での翻訳作業を考えてまして、

将来は、他の言語にも手を広げていく予定です。

日本人のコミュニティユーザー向けには、日本語のメーリングリストも用意されており、

メールアドレスは、g11n_ja@opends.dev.java.net になります。

コンタクト先:Shinichi Hanaki <Shinichi.Hanaki@Sun.COM>

(OpenSSO や OpenDS など、Sun のアイデンティティー関連製品の日本語ローカライズを

担当している者です。)

OpenDS の他のメーリングリストとは違って、ここでは日本語で気兼ねなくコミュニケーションを

とることができますので、日本語翻訳に興味のある方、また、翻訳は別にしても

OpenDS を実際お使いになられてる方、これから OpenDS を使ってみようと興味をもたれてる方も、

ぜひ、こちらのメーリングリストにご参加ください。

なにかわからないことなどございましたら、

g11n_ja@opends.dev.java.net 宛、もしくは上記コンタクト先アドレスへ

お問い合わせください。

みなさんのご参加をお待ちしてます。


Chers membres de la communauté OpenDS,

Nous sommes en train de mettre en place une Communauté de Traduction pour OpenDS, le serveur d’annuaire LDAP en logiciel libre, et faisons appel à votre participation. Si vous êtes intéressés par exercer vos talents de traducteur, vous trouverez ici un guide de prise en main de l’Interface de Traduction Communautaire (Community Translation Interface, CTI), un outil web pour faire de la traduction assistée par communauté.

OpenDS 1.1 a été traduit dans 7 langues. Nous aimerions de l’aide pour traduire OpenDS 2.0 dans ces 7 langues : Japonais, Chinois Traditionel, Chinous Simplifié, Coréen, Français, Allemand et Espagnol. Nous commençons dès aujourd’hui avec 2 langues (le Japonais et le Français) mais nous ajouterons les autres au fur et à mesure de la participation de traducteurs volontaires.

Permettez nous de vous présenter les responsables des différentes langues pour cette Traduction Communautaire naissante.

La traduction en Japonaise est conduite par Shinichi Hanaki <Shinichi (point) Hanaki (a) Sun (point) COM>, et un alias a été mis en place pour collaborer en Japonais autour des traductions : g11n_ja@opends.dev.java.net

La traduction Française est conduite par Pavel Heimlich <Pavel (point) Heimlich (a) Sun (point) COM>, et un alias a été mis en place pour discuter en Français sur les traductions : g11n_fr@opends.dev.java.net

Bienvenue à Hanaki et Pavel.

Pour toute information supplémentaire, contactez g11n@opends.dev.java.net

Cordialement,

Shankar et Ludovic.

Technorati Tags: , , , , , ,

Sun Directory Masters 2009 in Grenoble. Day 1.

Gecday1It’s been a busy day in the Grenoble Engineer Center with Directory Masters gathering from all over Europe and even Japan for two days of training on the coming releases of Sun Directory Server Enterprise Edition and Sun OpenDS Standard Edition.

For those two days, we’re hosting 30 sales, presales, architects, consultants from Sun and partner companies, immersed within the developers, architects, managers of the Directory Engineering team. This is a very good way for our guest to understand where the product is going and how to better sell it to customers, and for engineers to learn more about the real customers needs and problems to solve.

Today we’ve touched mostly the Directory landscape, our product roadmap, DSEE, deployments, performances, virtual directory features. Tomorrow will have more of an OpenDS flavor…

PS: To my Japanese friends, Moryia is not on the picture, but he’s in Grenoble 😉

Technorati Tags: , , , , , ,

OpenDS Tips: Adding schema from OpenLDAP

Opends Logo TagThe OpenDS schema is slightly different from the OpenLDAP one, but it’s quite simple to convert schema files from one format to another.

OpenDS, like Sun Directory Server Enterprise Edition and Fedora DS, uses a strict RFC 4512 and LDIF format.

In OpenLDAP, the actual text of the schema definition is similar and described using the RFC 4512 notation but uses the printer friendly notation, similar to the textual description in RFC documents.

So when converting schema files from OpenLDAP, for use in OpenDS, there are mainly 4 differences to take care of:

  • In OpenLDAP, an attribute definition begins with “attributetype” while in OpenDS it begins with “attributetypes: “
  • Similarly, in OpenLDAP, an object class definition has an “objectclass” prefix while it is “objectclasses: “
  • OpenDS follows the LDIF conventions that the continuation line begins with a single space character, and that an empty line is an entry separator
  • Finally, OpenDS schema files have a .ldif extension and only this extension is considered when loading schema from the config/schema directory.

The following python script can be used to convert an OpenLDAP schema file to a format usable by OpenDS (as well as Sun Directory Enterprise Edition). The script also recursively expands the OID macro format used in OpenLDAP schema files.

For now, syntax definitions are currently ignored as they cannot be loaded in OpenDS as they require associated code.

Usage is quite simple: schema-convert.py -o result.ldif openldap-schema-file

Enjoy and don’t hesitate to send feedback, suggestions for improvements.

Update on March 15: I’ve added support for name prefixed OIDs substitution as suggested by Martin Gwerder.

Update on April 9: OpenDS schema files uses the .ldif extension, and only files with this extension are loaded by the server from the config/schema directory.

Update on July 31: Now checking and removing quotes around Sup or Syntaxes values.

 


#!/usr/bin/env python
# encoding: utf-8
"""
schema-convert.py
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License, Version 1.0 only
# (the "License").  You may not use this file except in compliance
# with the License.
#
# You can obtain a copy of the license at
# trunk/opends/resource/legal-notices/OpenDS.LICENSE
# or https://OpenDS.dev.java.net/OpenDS.LICENSE.
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at
# trunk/opends/resource/legal-notices/OpenDS.LICENSE.  If applicable,
# add the following below this CDDL HEADER, with the fields enclosed
# by brackets "[]" replaced with your own identifying information:
#      Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#
#
#      Copyright 2009 Sun Microsystems, Inc.
Created by Ludovic Poitou on 2009-01-28.
This program converts an OpenLDAP schema file to the OpenDS schema file format.
"""
import sys
import getopt
import re
import string
help_message = '''
Usage: schema-convert.py [options] <openldap-schema-file>
options:
\t -o output : specifies the output file, otherwise stdout is used
\t -v : verbose mode
'''
class Usage(Exception):
def __init__(self, msg):
self.msg = msg
def main(argv=None):
output = ""
seclineoid = 0
IDs = {}
if argv is None:
argv = sys.argv
try:
try:
opts, args = getopt.getopt(argv[1:], "ho:v", ["help", "output="])
except getopt.error, msg:
raise Usage(msg)
# option processing
for option, value in opts:
if option == "-v":
verbose = True
if option in ("-h", "--help"):
raise Usage(help_message)
if option in ("-o", "--output"):
output = value
except Usage, err:
print >> sys.stderr, sys.argv[0].split("/")[-1] + ": " + str(err.msg)
print >> sys.stderr, "\t for help use --help"
return 2
try:
infile = open(args[0], "r")
except Usage, err:
print >> sys.stderr, "Can't open file: " + str(err.msg)
if output != "":
try:
outfile = open(output, "w")
except Usage, err:
print >> sys.stderr, "Can't open output file: " + str(err.msg)
else:
outfile = sys.stdout
outfile.write("dn: cn=schema\n")
outfile.write("objectclass: top\n")
outfile.write("")
for i in infile:
newline = ""
if not i.strip():
continue
#if i.startswith("#"):
#	continue
if re.match("objectidentifier", i, re.IGNORECASE):
# Need to fill in an array of identifiers
oid = i.split()
if not re.match ("[0-9.]+", oid[2]):
suboid = oid[2].split(':')
IDs[oid[1]] = IDs[suboid[0]] + "." + suboid[1]
else:
IDs[oid[1]] = oid[2]
continue
if seclineoid == 1:
subattr = i.split()
if not re.match("[0-9.]+", subattr[0]):
if re.match (".*:", subattr[0]):
# The OID is an name prefixed OID. Replace string with the OID
suboid = subattr[0].split(":")
repl = IDs[suboid[0]] + "." + suboid[1]
else:
# The OID is a name. Replace string with the OID
repl = IDs[subattr[0]]
newline = string.replace(i, subattr[0], repl, 1)
seclineoid = 0
if re.match("attributetype ", i, re.IGNORECASE):
newline = re.sub("attribute[tT]ype", "attributeTypes:", i)
# replace OID string with real OID if necessary
subattr = newline.split()
if len(subattr) < 3:
seclineoid = 1
else:
if not re.match("[0-9.]+", subattr[2]):
if re.match (".*:", subattr[2]):
# The OID is an name prefixed OID. Replace string with the OID
suboid = subattr[2].split(":")
repl = IDs[suboid[0]] + "." + suboid[1]
else:
# The OID is a name. Replace string with the OID
repl = IDs[subattr[2]]
newline = string.replace(newline, subattr[2], repl, 1)
if re.match("objectclass ", i, re.IGNORECASE):
newline = re.sub("object[cC]lass", "objectClasses:", i)
# replace OID String with real OID
subattr = newline.split()
if len(subattr) < 3:
seclineoid = 1
else:
if not re.match("[0-9.]+", subattr[2]):
if re.match (".*:", subattr[2]):
# The OID is an name prefixed OID. Replace string with the OID
suboid = subattr[2].split(":")
repl = IDs[suboid[0]] + "." + suboid[1]
else:
# The OID is a name. Replace string with the OID
repl = IDs[subattr[2]]
newline = string.replace(newline, subattr[2], repl, 1)
# Remove quoted syntax.
if re.search("SYNTAX\s'[\d.]+'", newline):
# Found a quoted syntax in an already updated line
newline = re.sub("SYNTAX '([\d.]+)'", "SYNTAX \g<1>", newline)
else:
if re.search("SYNTAX\s'[\d.]+'", i):
# Found a quoted syntax in the original line
newline = re.sub("SYNTAX '([\d.]+)'", "SYNTAX \g<1>", i)
# Remove quoted SUP
if re.search("SUP\s'[\w\-]+'", newline):
# Found a quoted sup in an already updated line
newline = re.sub("SUP '([\w\-]+)'", "SUP \g<1>", newline)
else:
if re.search("SUP\s'[\w\-]+'", i):
# Found a quoted sup in the original line
newline = re.sub("SUP '([\w\-]+)'", "SUP \g<1>", i)
# transform continuation lines with only 2 spaces
if re.match("  +|\t", i):
if newline != "":
newline = "  " + newline.strip() + "\n"
else:
newline = "  " + i.strip() + "\n"
if newline != "":
outfile.write(newline)
else:
outfile.write(i)
outfile.close()
if __name__ == "__main__":
sys.exit(main())

Technorati Tags: , , , , , , ,

OpenDS Tips: Importing LDIF with encrypted passwords.

Opends Logo TagBy default, the OpenDS LDAP directory server password policy is set to reject encrypted passwords, as it cannot check that they match the quality requirements.

So when adding or importing data with encrypted passwords, the server returns some error like this:

LDAP: error code 53 – Pre-encoded passwords are not allowed for the password attribute userPassword

To allow pre-encoded passwords, the default password policy settings must be changed. This can be done using the dsconfig command line tool in advanced mode:

$ dsconfig --advanced -p 4444 -h localhost -D "cn=directory manager" -X
>>>> Specify OpenDS LDAP connection parameters
Password for user 'cn=directory manager':
>>>> OpenDS configuration console main menu
What do you want to configure?
1)   Access Control Handler          24)  Monitor Provider
2)   Account Status Notification     25)  Network Group
Handler
3)   Administration Connector        26)  Network Group Criteria
4)   Alert Handler                   27)  Network Group Request Filtering
Policy
5)   Attribute Syntax                28)  Network Group Resource Limits
6)   Backend                         29)  Password Generator
7)   Certificate Mapper              30)  Password Policy
8)   Connection Handler              31)  Password Storage Scheme
9)   Crypto Manager                  32)  Password Validator
10)  Debug Target                    33)  Plugin
11)  Entry Cache                     34)  Plugin Root
12)  Extended Operation Handler      35)  Replication Domain
13)  Extension                       36)  Replication Server
14)  Global Configuration            37)  Root DN
15)  Group Implementation            38)  Root DSE Backend
16)  Identity Mapper                 39)  SASL Mechanism Handler
17)  Key Manager Provider            40)  Synchronization Provider
18)  Local DB Index                  41)  Trust Manager Provider
19)  Local DB VLV Index              42)  Virtual Attribute
20)  Log Publisher                   43)  Work Queue
21)  Log Retention Policy            44)  Workflow
22)  Log Rotation Policy             45)  Workflow Element
23)  Matching Rule
q)   quit
Enter choice: 30
>>>> Password Policy management menu
What would you like to do?
1)  List existing Password Policies
2)  Create a new Password Policy
3)  View and edit an existing Password Policy
4)  Delete an existing Password Policy
b)  back
q)  quit
Enter choice [b]: 3
>>>> Select the Password Policy from the following list:
1)  Default Password Policy
2)  Root Password Policy
c)  cancel
q)  quit
Enter choice [c]: 1
>>>> Configure the properties of the Password Policy
Property                                   Value(s)
--------------------------------------------------------------------
1)   account-status-notification-handler        -
2)   allow-expired-password-changes             false
3)   allow-multiple-password-values             false
4)   allow-pre-encoded-passwords                false
5)   allow-user-password-changes                true
6)   default-password-storage-scheme            Salted SHA-1
7)   deprecated-password-storage-scheme         -
8)   expire-passwords-without-warning           false
9)   force-change-on-add                        false
10)  force-change-on-reset                      false
11)  grace-login-count                          0
12)  idle-lockout-interval                      0 s
13)  last-login-time-attribute                  -
14)  last-login-time-format                     -
15)  lockout-duration                           0 s
16)  lockout-failure-count                      0
17)  lockout-failure-expiration-interval        0 s
18)  max-password-age                           0 s
19)  max-password-reset-age                     0 s
20)  min-password-age                           0 s
21)  password-attribute                         userpassword
22)  password-change-requires-current-password  false
23)  password-expiration-warning-interval       5 d
24)  password-generator                         Random Password Generator
25)  password-history-count                     0
26)  password-history-duration                  0 s
27)  password-validator                         -
28)  previous-last-login-time-format            -
29)  require-change-by-time                     -
30)  require-secure-authentication              false
31)  require-secure-password-changes            false
32)  skip-validation-for-administrators         false
33)  state-update-failure-policy                reactive
?)   help
f)   finish - apply any changes to the Password Policy
c)   cancel
q)   quit
Enter choice [f]: 4
>>>> Configuring the "allow-pre-encoded-passwords" property
Indicates whether users can change their passwords by providing a
pre-encoded value.
This can cause a security risk because the clear-text version of the
password is not known and therefore validation checks cannot be applied to
it.
Do you want to modify the "allow-pre-encoded-passwords" property?
1)  Keep the default value: false
2)  Change it to the value: true
?)  help
q)  quit
Enter choice [1]: 2
Press RETURN to continue
>>>> Configure the properties of the Password Policy
Property                                   Value(s)
--------------------------------------------------------------------
1)   account-status-notification-handler        -
2)   allow-expired-password-changes             false
3)   allow-multiple-password-values             false
4)   allow-pre-encoded-passwords                true
5)   allow-user-password-changes                true
6)   default-password-storage-scheme            Salted SHA-1
7)   deprecated-password-storage-scheme         -
8)   expire-passwords-without-warning           false
9)   force-change-on-add                        false
10)  force-change-on-reset                      false
11)  grace-login-count                          0
12)  idle-lockout-interval                      0 s
13)  last-login-time-attribute                  -
14)  last-login-time-format                     -
15)  lockout-duration                           0 s
16)  lockout-failure-count                      0
17)  lockout-failure-expiration-interval        0 s
18)  max-password-age                           0 s
19)  max-password-reset-age                     0 s
20)  min-password-age                           0 s
21)  password-attribute                         userpassword
22)  password-change-requires-current-password  false
23)  password-expiration-warning-interval       5 d
24)  password-generator                         Random Password Generator
25)  password-history-count                     0
26)  password-history-duration                  0 s
27)  password-validator                         -
28)  previous-last-login-time-format            -
29)  require-change-by-time                     -
30)  require-secure-authentication              false
31)  require-secure-password-changes            false
32)  skip-validation-for-administrators         false
33)  state-update-failure-policy                reactive
?)   help
f)   finish - apply any changes to the Password Policy
c)   cancel
q)   quit
Enter choice [f]:
The Password Policy was modified successfully
Press RETURN to continue

The equivalent non interactive command is:

$ dsconfig set-password-policy-prop \
--policy-name "Default Password Policy" \
--set allow-pre-encoded-passwords:true \
--hostname localhost \
--trustAll \
--port 4444 \
--bindDN "cn=directory manager" \
--bindPassword ****** \
--no-prompt

Alternately, this can be done over LDAP (although it’s not officially supported):

$ bin/ldapmodify -Z -X -p 4444 -h localhost -D "cn=directory manager"
Password for user 'cn=directory manager':
dn: cn=Default Password Policy,cn=Password Policies,cn=config
changetype: modify
replace: ds-cfg-allow-pre-encoded-passwords
ds-cfg-allow-pre-encoded-passwords: true
Processing MODIFY request for cn=Default Password Policy,cn=Password Policies,cn=config
MODIFY operation successful for DN cn=Default Password Policy,cn=Password Policies,cn=config

Technorati Tags: , , ,