LDAP call is not working openWrt frame work

Using below LDAP version on openWrt framework

/bin/ldapsearch -VV

ldapsearch: @(#) $OpenLDAP: ldapsearch 2.3.32 (Oct 24 2021 09:01:35) $
@c79865fdb2de:/home/jenkins/slave-ngcicd/workspace/AP_SCG_7.0.0_R770_OW/opensource/openwrt/build_dir/target-arm_cortex-a7+neon-vfpv4_musl_eabi/rks-openldap-2.3.32/clients/tools
(LDAP library: OpenLDAP 20332)

LDAP Client

/bin/ldapsearch -h -p 389 -D "cn=admin,dc=ruckus,dc=com" -s sub "(&(uid=ruckus)(objectClass=*))" -b "dc=ruckus,dc=com" dn uid -x -w "vkumara" > "/tmp/ldap/0.3230.pre.ldap" 2>&1 &

When I try to send a BindRequest ro LDAP server running on other non-openwrt server , password is not included .

Same changes works for non-openwrt framework

PCAP attached

The current version of OpenLDAP in OpenWrt is 2.6.4. I couldn't find any 2.3.32 build of OpenLDAP, and I went back to 17.01. I suspect you are not using official OpenWrt but rather a fork (the path suggests Ruckus' fork for the R770).

You have two options:

  • Switch to a supported OpenWrt build (23.05 at the time of this writing)
  • Ask Ruckus

Thanks for the response andyboeh ,

Issue is password is not going in a BindRequest message on openWrt(not working) framework. But whereas on the other framework like buildroot(working) password is going in BindRequest message to LDAP server in a BindRequest.

So, to solve the above issue in openWrt framework, do I need to upgrade OpenLDAP to 2.6.4 from 2.3.32 on openWrt framework? Or is there any other solution to solve above password not included problem on openWrtBindRequest message. Please help to confirm.

Thanks,
Vasanth

There is no OpenWrt framework with 2.3.32 - which version of the "OpenWrt framework" are you using? For which device?

OpenWrt framework version used is 21.02.
OpenLDAP version used is 2.3.32
Used is for Access Point device

21.02 is EOL, you should upgrade.

1 Like

Where did you get this version from?
How did you install ldapsearch?

According to the sources, the OpenLDAP version in 21.02 is 2.4.58.

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
1 Like

After upgrading openldap version to 2.4.58 , still behaviour is same

ubus call system board

Failed to connect to ubus

/bin/ldapsearch -VV

ldapsearch: @(#) $OpenLDAP: ldapsearch 2.4.58 (Nov 20 2023 11:54:03) $
openldap
(LDAP library: OpenLDAP 20458)

It appears you are using firmware that is not from the official OpenWrt project.

When using forks/offshoots/vendor-specific builds that are "based on OpenWrt", there may be many differences compared to the official versions (hosted by OpenWrt.org). Some of these customizations may fundamentally change the way that OpenWrt works. You might need help from people with specific/specialized knowledge about the firmware you are using, so it is possible that advice you get here may not be useful.

You may find that the best options are:

  1. Install an official version of OpenWrt, if your device is supported (see https://firmware-selector.openwrt.org).
  2. Ask for help from the maintainer(s) or user community of the specific firmware that you are using.
  3. Provide the source code for the firmware so that users on this forum can understand how your firmware works (OpenWrt forum users are volunteers, so somebody might look at the code if they have time and are interested in your issue).

If you believe that this specific issue is common to generic/official OpenWrt and/or the maintainers of your build have indicated as such, please feel free to clarify.

No need to upgrade the openWrt version , following is the rootcause and solution worked

RootCause:

  1. openldap cyrus_sasl library linked to openwrt
  2. ldap client and server binding ldapsearch command formatting BaseDomain and Password.
  3. OWRT framework is not allowed to bind request bind password

Solution:

       1. Updated openldap Makefile to disable cyrus_sasl library (not needed for simple authentication)
       2. Updated code to fix the OpenLDAP , Changed the ldapsearch client sending bind request messaging format

/bin/ldapsearch -h IPAddressOfServer -p 389 -D "cn=admin,dc=name,dc=com" -b "dc=name,dc=com" -x -w "password" -s sub "(&(uid=name)(objectClass=*))" -b "dc=name,dc=com" dn uid -x -w "password"

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.