Topic: LDAP and Password Modification from window post

[pierre31]

Hi,
Maybe this is a known issue but I could not find any previous post talking about this problem :
I am using a sme server 8.0 beta 5.
I noticed that I was not able to bind to a user with ldap if I change its password from a window computer.
But if ever I save some dummy user modification on sme server web interface, then LDAP is updated with the new password.
Is there any things I have to do to have automatic password refreshment in LDAP database ? Any cron job maybe ?
Thanks for your help, and work
Pierre

[Stefano]

first of all you must upgrade to SME8 final.. SME8b5 is old and unsupported (beta sw)

[CharlieBrady]

But if ever I save some dummy user modification on sme server web interface, then LDAP is updated with the new password.

Passwords aren't stored in ldap in unmodified SME8.

[pierre31]

You are certainly right I should have say authentification is possible with LDAP and password :

ldapsearch -x -H ldaps://smeserver/ -b dc=mycompany -D "uid=username,ou=Users,dc=mycompany"  -d1 -W

leads to no error.

Note that while we should update our smeserver I would be interesting still by a workaround.

Thx for your help,
Pierre

[janet]

pierre31

The sme8beta5 software is nearly 3 years old & should be updated IMMEDIATELY for a variety of reasons, including security & the fact that LDAP support was read only for 3rd party apps.

From sme8beta5 release notes here:
http://forums.contribs.org/index.php/topic,45681.0.html
March 7 2010
LDAP authentication: third party applications can authenticate against
SME Users passwords. LDAP is still read only, built automatically
from SME databases.


The workaround you request, is to update to sme8.0 final release, see
http://forums.contribs.org/index.php/topic,48671.0.html
Then apply all latest updates with
yum update

From sme 8.0 (final) release notes
25 May 2012

Optional - LDAP authentication can be enabled. Once enabled it cannot
  be disabled, so experiment with care.
  To enable: db configuration setprop ldap Authentication enabled

LDAP (Optional in SME 8, and considered experimental)
----
- Create samba account during event for machine
- Keep uid/gid for computer accounts in synch for Unix/Samba/LDAP
- Fixed syntax error in create-machine-account
- Fix samba-group-mapping for users without group membership
- Fix cpu critical patch missing '
- LDAP admin password needs to be loaded in secrets.tdb
- Change authentication from passwd/shadow files to the pam database
- Turba searches on LDAP address book fixed
- Properly handle account with accents in first- or lastname with
  regards to LDAP
- Fix create user gid parameter
- Path for gpasswd command fixed in "init-accounts" script
- All ibay account commands as system accounts in LDAP
- Create ibay accounts as system accounts in LDAP
- Use cpu commands to manage Ibays accounts if ldap is master
- Make cpu calls critical only with ldap{Auth} is enabled
- Check slapd.conf syntax before trying to dump the database
- Simplify ldap-update call by calling ldif-fix
- Change script order: ldap-update should be called after
  domain-group-maps
- LDAP ou field is taken from Dept not Department
- LDAP changes: Add rfc2739.schema back in and include in config
- Use ldapmodify to load ldif, add -a if no changetype
- Remove bogus junk attribute from ldif templates
- Change startup order for ldap
- ldap should store locked passwords for expired passwords
- Add ldap as an auth type to radius
- Radius should use LDAP backend (if LDAP auth is enabled)
- Fix ldap-create errors when adding empty groups.
- The LDAP information for admin was not being updated.
- Don't try to save ibay password to LDAP.
- Fix admin user password change (Daniel B.)
- Init database if the ldif dump is empty (ie from sme8b)
- revert re-init database
- re-init readonly database on post-upgrade
- Force SSL/TLS for remote authentication
- reuse users_groups_ous.patch2
- Separate groups and users with mailboxRelatedObject
- Set readonly access
- Fix ldap-update action script to user-lock event
- Add Groups entries
- Add admin user as a standard user
- Add ldap-update action script to user-lock event
- Add ldap authentication and tls support
- Update schema for newer openldap and remove calFBurl
- Convert ldif dump
- Create bdb log directory
- Change ldap backend to bdb, and fix initialisation problem