Issue 496 - Samba and OpenLDAP Filters
Summary: Samba and OpenLDAP Filters
Status: VERIFIED FIXED
Alias: None
Product: OpenLDAP
Classification: Unclassified
Component: slapd (show other issues)
Version: unspecified
Hardware: All All
: --- normal
Target Milestone: ---
Assignee: OpenLDAP project
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2000-04-09 23:38 UTC by btenison@dibbs.net
Modified: 2014-08-01 21:06 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this issue.
Description btenison@dibbs.net 2000-04-09 23:38:50 UTC
Full_Name: Bruce Tenison
Version: 1.2.9
OS: Linux RH 6.2
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (216.85.74.42)


In trying to get Samba to authenticate against an OpenLDAP server, I get no
matches
against a filter such as: &(ntuid=goober)(objectclass=sambaaccount)

I tried this with ldapsearch and I get no matches, although I can filter with
ntuid=goober and get a match and objectclass=sambaacount and get MANY matches
(goober account included)

I don't believe that I'm doing anything wrong, but I could be, since I'm new to
this.

Here's an ldif entry for goober and the ldapsearch command line that I'm using.
dn: o=Reid State Technical College, c=US
o: Reid State Technical College
objectClass: organization

dn: uid=root,ou=People,o=Reid State Technical College, c=US
uid: root
cn: root
krbname: root@RSTC.CC.AL.US
objectClass: kerberosSecurityObject
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
sn: root
mail: root@rstc.cc.al.us
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
userPassword: {crypt}XXXXXXXXXXXX
shadowLastChange: 10725
shadowMax: 99999
shadowWarning: 7
shadowFlag: 134538444
loginShell: /bin/bash
uidNumber: 0
gidNumber: 0
homeDirectory: /home/root
gecos: root

dn: uid=goober,ou=People,o=Reid State Technical College, c=US
uid: goober
cn: Bruce Tenison Test Account
krbname: goober@RSTC.CC.AL.US
objectClass: kerberosSecurityObject
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
givenname: Bruce Tenison Test
sn: Account
mail: goober@rstc.cc.al.us
objectClass: account
objectClass: posixAccount
objectClass: sambaAccount
objectClass: shadowAccount
userPassword: {crypt}$XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
shadowLastChange: 11027
shadowMax: 99999
shadowWarning: 7
shadowInactive: -1
shadowExpire: -1
shadowFlag: 134550540
loginShell: /bin/bash
uidNumber: 1604
gidNumber: 1604
homeDirectory: /home/goober
gecos: Bruce Tenison Test Account
description: Samba User
ntuid: goober
lmPassword: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
ntPassword: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
pwdLastSet: 38CA645F
smbHome: \\gate\goober
homeDrive: M
script: logon
profile: \\gate\goober\profile
workstations: ALL


ldapsearch -v -h ldap.server.org -D'cn=superuser, o=Reid State Technical
College, c=US' -b'o=Reid State Technical College, c=US'
'&(ntuid=goober)(objectclass=sambaaccount)' -W
ldap_init( ldap.server.org, 0 )
Enter LDAP Password: 
filter pattern: &(ntuid=goober)(objectclass=sambaaccount)
returning: ALL
filter is: (&(ntuid=goober)(objectclass=sambaaccount))
0 matches

(I've XXXX'd out the passwords and changed the cn=superuser and a different
hostname
for security reasons, but it's exactly the same, otherwise.)

Any ideas?

Thanks!
Comment 1 kunkee@openldap.org 2000-04-11 16:27:07 UTC
> Full_Name: Bruce Tenison
> Version: 1.2.9
> OS: Linux RH 6.2
> URL: ftp://ftp.openldap.org/incoming/
> Submission from: (NULL) (216.85.74.42)
> 
> 
> In trying to get Samba to authenticate against an OpenLDAP server, I get no
> matches
> against a filter such as: &(ntuid=goober)(objectclass=sambaaccount)
> 
> [rest deleted]

This is an invalid filter.  You need an outter set of parenthesis.
OpenLDAP 1.2.9 will just fail to find anything in this circumstance.

	(&(ntuid=goober)(objectclass=sambaaccount))

Comment 2 Kurt Zeilenga 2000-04-11 18:19:42 UTC
changed notes
changed state Open to Feedback
Comment 3 Kurt Zeilenga 2000-04-19 03:09:11 UTC
changed state Feedback to Closed
Comment 4 OpenLDAP project 2014-08-01 21:06:10 UTC
User error.