lam-public Mailing List for LDAP Account Manager
Brought to you by:
gruberroland
Menu
▾
▴
lam-public — User support list
You can subscribe to this list here.
| 2003 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
(7) |
Aug
(4) |
Sep
(17) |
Oct
(25) |
Nov
(51) |
Dec
(12) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2004 |
Jan
(32) |
Feb
(20) |
Mar
(26) |
Apr
(29) |
May
(17) |
Jun
(34) |
Jul
(11) |
Aug
(22) |
Sep
(22) |
Oct
(20) |
Nov
(34) |
Dec
(7) |
| 2005 |
Jan
(25) |
Feb
(18) |
Mar
(14) |
Apr
(3) |
May
(20) |
Jun
(14) |
Jul
(38) |
Aug
(70) |
Sep
(101) |
Oct
(42) |
Nov
(63) |
Dec
(43) |
| 2006 |
Jan
(46) |
Feb
(87) |
Mar
(36) |
Apr
(38) |
May
(77) |
Jun
(48) |
Jul
(19) |
Aug
(24) |
Sep
(43) |
Oct
(25) |
Nov
(18) |
Dec
(9) |
| 2007 |
Jan
(38) |
Feb
(7) |
Mar
(7) |
Apr
(6) |
May
(7) |
Jun
(20) |
Jul
(18) |
Aug
(32) |
Sep
(21) |
Oct
(21) |
Nov
(14) |
Dec
(25) |
| 2008 |
Jan
(16) |
Feb
(21) |
Mar
(13) |
Apr
(12) |
May
(31) |
Jun
(4) |
Jul
(20) |
Aug
(33) |
Sep
(7) |
Oct
(4) |
Nov
(5) |
Dec
(18) |
| 2009 |
Jan
(6) |
Feb
(21) |
Mar
(4) |
Apr
(24) |
May
(14) |
Jun
(11) |
Jul
(12) |
Aug
(3) |
Sep
(21) |
Oct
(26) |
Nov
(22) |
Dec
(28) |
| 2010 |
Jan
(10) |
Feb
(25) |
Mar
(21) |
Apr
(5) |
May
(12) |
Jun
(16) |
Jul
(22) |
Aug
(22) |
Sep
(29) |
Oct
(11) |
Nov
(8) |
Dec
(7) |
| 2011 |
Jan
(32) |
Feb
(23) |
Mar
(20) |
Apr
(16) |
May
(36) |
Jun
(2) |
Jul
(28) |
Aug
(7) |
Sep
(26) |
Oct
(5) |
Nov
(25) |
Dec
(15) |
| 2012 |
Jan
(30) |
Feb
(30) |
Mar
(20) |
Apr
(15) |
May
(44) |
Jun
(33) |
Jul
(17) |
Aug
(12) |
Sep
(12) |
Oct
(12) |
Nov
(8) |
Dec
(23) |
| 2013 |
Jan
(31) |
Feb
(11) |
Mar
(13) |
Apr
(14) |
May
(14) |
Jun
(19) |
Jul
(22) |
Aug
(4) |
Sep
(28) |
Oct
(5) |
Nov
(34) |
Dec
(17) |
| 2014 |
Jan
(26) |
Feb
(11) |
Mar
(4) |
Apr
(25) |
May
(8) |
Jun
(11) |
Jul
(21) |
Aug
(29) |
Sep
(38) |
Oct
(47) |
Nov
(21) |
Dec
(21) |
| 2015 |
Jan
(13) |
Feb
(22) |
Mar
(25) |
Apr
(9) |
May
(27) |
Jun
(32) |
Jul
(8) |
Aug
(11) |
Sep
(2) |
Oct
(9) |
Nov
(20) |
Dec
(22) |
| 2016 |
Jan
(6) |
Feb
(6) |
Mar
(11) |
Apr
(4) |
May
(5) |
Jun
(13) |
Jul
(9) |
Aug
(31) |
Sep
(24) |
Oct
(2) |
Nov
(5) |
Dec
(9) |
| 2017 |
Jan
(10) |
Feb
(13) |
Mar
(10) |
Apr
(4) |
May
(3) |
Jun
(22) |
Jul
(11) |
Aug
(33) |
Sep
(14) |
Oct
(8) |
Nov
(6) |
Dec
(13) |
| 2018 |
Jan
(4) |
Feb
(26) |
Mar
(16) |
Apr
(2) |
May
(12) |
Jun
(11) |
Jul
(6) |
Aug
(4) |
Sep
(4) |
Oct
(1) |
Nov
(4) |
Dec
(3) |
| 2019 |
Jan
(14) |
Feb
(4) |
Mar
(19) |
Apr
(8) |
May
(4) |
Jun
(4) |
Jul
(6) |
Aug
(2) |
Sep
(34) |
Oct
(9) |
Nov
(10) |
Dec
(4) |
| 2020 |
Jan
(2) |
Feb
(12) |
Mar
(16) |
Apr
(17) |
May
(4) |
Jun
(16) |
Jul
(11) |
Aug
(6) |
Sep
(6) |
Oct
(9) |
Nov
(32) |
Dec
(2) |
| 2021 |
Jan
(2) |
Feb
(8) |
Mar
(6) |
Apr
(9) |
May
(4) |
Jun
(16) |
Jul
(10) |
Aug
(2) |
Sep
(13) |
Oct
(14) |
Nov
(16) |
Dec
(2) |
| 2022 |
Jan
(8) |
Feb
(8) |
Mar
(5) |
Apr
(5) |
May
(4) |
Jun
(21) |
Jul
(12) |
Aug
(29) |
Sep
(4) |
Oct
(6) |
Nov
(16) |
Dec
(1) |
| 2023 |
Jan
(2) |
Feb
(2) |
Mar
(2) |
Apr
(5) |
May
(6) |
Jun
(12) |
Jul
(16) |
Aug
(11) |
Sep
(2) |
Oct
|
Nov
(2) |
Dec
(5) |
| 2024 |
Jan
(2) |
Feb
(4) |
Mar
(15) |
Apr
|
May
|
Jun
(2) |
Jul
|
Aug
|
Sep
(35) |
Oct
(2) |
Nov
(2) |
Dec
(16) |
| 2025 |
Jan
(13) |
Feb
(3) |
Mar
(6) |
Apr
(2) |
May
(12) |
Jun
(25) |
Jul
(12) |
Aug
(2) |
Sep
(2) |
Oct
(2) |
Nov
(3) |
Dec
(1) |
| 2026 |
Jan
(1) |
Feb
|
Mar
(3) |
Apr
(1) |
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
|
From: Roland G. <po...@ro...> - 2026-04-01 14:48:15
|
Announcement: This release fixes issues with custom fields and Windows users. PowerDNS, BindDynDb and Bind DLZ support wildcard DNS records. Full changelog: https://www.ldap-account-manager.org/lamcms/changelog Download: https://www.ldap-account-manager.org/lamcms/releases Features: * management of various account types * Unix * Samba 4/Active Directory * Asterisk * Kopano * DHCP * SSH keys * ... * profiles for account creation * account creation via file upload * automatic creation/deletion of home directories * setting quotas * PDF output for all accounts * editor for organizational units * schema browser * tree view * 2FA support Demo installation: You can try our demo installation online. https://www.ldap-account-manager.org/lamcms/liveDemo Authors & Copyright: Copyright (C) 2003 - 2026: Roland Gruber <po...@ro...> LAM is published under the GNU General Public License. The complete list of licenses can be found in the copyright file. |
|
From: Roland G. <po...@ro...> - 2026-03-18 19:48:34
|
Announcement: This release fixes issues with password changes in self-service. It also solves problems loading server and self-service profiles. Full changelog: https://www.ldap-account-manager.org/lamcms/changelog Download: https://www.ldap-account-manager.org/lamcms/releases Features: * management of various account types * Unix * Samba 4/Active Directory * Asterisk * Kopano * DHCP * SSH keys * ... * profiles for account creation * account creation via file upload * automatic creation/deletion of home directories * setting quotas * PDF output for all accounts * editor for organizational units * schema browser * tree view * 2FA support Demo installation: You can try our demo installation online. https://www.ldap-account-manager.org/lamcms/liveDemo Authors & Copyright: Copyright (C) 2003 - 2026: Roland Gruber <po...@ro...> LAM is published under the GNU General Public License. The complete list of licenses can be found in the copyright file. |
|
From: Roland G. <po...@ro...> - 2026-03-17 19:48:01
|
Announcement: This version includes security fixes. It requires PHP 8.2 or higher. LAM shows details if password policy rules are not fulfilled. The Docker image was migrated to Debian 13 and no longer runs as root. White pages profiles support to specify the initial sorting. Full changelog: https://www.ldap-account-manager.org/lamcms/changelog Download: https://www.ldap-account-manager.org/lamcms/releases Features: * management of various account types * Unix * Samba 4/Active Directory * Asterisk * Kopano * DHCP * SSH keys * ... * profiles for account creation * account creation via file upload * automatic creation/deletion of home directories * setting quotas * PDF output for all accounts * editor for organizational units * schema browser * tree view * 2FA support Demo installation: You can try our demo installation online. https://www.ldap-account-manager.org/lamcms/liveDemo Authors & Copyright: Copyright (C) 2003 - 2026: Roland Gruber <po...@ro...> LAM is published under the GNU General Public License. The complete list of licenses can be found in the copyright file. |
|
From: Roland G. <po...@ro...> - 2026-03-04 07:11:13
|
Announcement: This version requires PHP 8.2 or higher. LAM shows details if password policy rules are not fulfilled. The Docker image was migrated to Debian 13 and no longer runs as root. White pages profiles support to specify the initial sorting. This is a test version. Please report any issues till 2026-03-15. Full changelog: https://www.ldap-account-manager.org/lamcms/changelog Download: https://www.ldap-account-manager.org/lamcms/releases Features: * management of various account types * Unix * Samba 4/Active Directory * Asterisk * Kopano * DHCP * SSH keys * ... * profiles for account creation * account creation via file upload * automatic creation/deletion of home directories * setting quotas * PDF output for all accounts * editor for organizational units * schema browser * tree view * 2FA support Demo installation: You can try our demo installation online. https://www.ldap-account-manager.org/lamcms/liveDemo Authors & Copyright: Copyright (C) 2003 - 2026: Roland Gruber <po...@ro...> LAM is published under the GNU General Public License. The complete list of licenses can be found in the copyright file. |
|
From: Facundo B. <fac...@er...> - 2026-01-13 18:20:36
|
Hi, I've ordered a new license because the current one is next to expire. I see the new one in order number but when I can't view the license key, I continue viewing the old one that is next to expire. Also I can't change the license or something like that. Can you help me with this please? |
|
From: Roland G. <po...@ro...> - 2025-12-13 19:40:34
|
Announcement: The new white pages feature (LAM Pro) allows to create read-only views to search for e.g. user contact information or any other LDAP data (groups, rooms, hardware entries, ...). There is a new SMS provider for email2SMS gateways. Attention: the new configuration file format is enforced now. See https://www.ldap-account-manager.org/static/doc/manual/ch02s02.html#a_versUpgrade See white pages in action: https://www.youtube.com/watch?v=PXO_Zx8-Cdw Full changelog: https://www.ldap-account-manager.org/lamcms/changelog Download: https://www.ldap-account-manager.org/lamcms/releases Features: * management of various account types * Unix * Samba 4/Active Directory * Asterisk * Kopano * DHCP * SSH keys * ... * profiles for account creation * account creation via file upload * automatic creation/deletion of home directories * setting quotas * PDF output for all accounts * editor for organizational units * schema browser * tree view * 2FA support Demo installation: You can try our demo installation online. https://www.ldap-account-manager.org/lamcms/liveDemo Authors & Copyright: Copyright (C) 2003 - 2025: Roland Gruber <po...@ro...> LAM is published under the GNU General Public License. The complete list of licenses can be found in the copyright file. |
|
From: Roland G. <po...@ro...> - 2025-11-25 19:52:49
|
Announcement: The new white pages feature (LAM Pro) allows to create read-only views to search for e.g. user contact information or any other LDAP data (groups, rooms, hardware entries, ...). There is a new SMS provider for email2SMS gateways. Attention: the new configuration file format is enforced now. See https://www.ldap-account-manager.org/static/doc/manual/ch02s02.html#a_versUpgrade This is a test version. Please report any issues till 2025-12-07. See white pages in action: https://www.youtube.com/watch?v=PXO_Zx8-Cdw Full changelog: https://www.ldap-account-manager.org/lamcms/changelog Download: https://www.ldap-account-manager.org/lamcms/releases Features: * management of various account types * Unix * Samba 4/Active Directory * Asterisk * Kopano * DHCP * SSH keys * ... * profiles for account creation * account creation via file upload * automatic creation/deletion of home directories * setting quotas * PDF output for all accounts * editor for organizational units * schema browser * tree view * 2FA support Demo installation: You can try our demo installation online. https://www.ldap-account-manager.org/lamcms/liveDemo Authors & Copyright: Copyright (C) 2003 - 2025: Roland Gruber <po...@ro...> LAM is published under the GNU General Public License. The complete list of licenses can be found in the copyright file. |
|
From: Roland G. <po...@ro...> - 2025-11-20 19:43:32
|
Hi Larry, thanks a lot for your detailed bug report. I was able to reproduce it and it will be fixed in 9.4. The RC-version for 9.4 will be published in the next few days anyway. Here is the ticket for tracking: https://github.com/LDAPAccountManager/lam/issues/517 Best regards Roland Am 20.11.25 um 18:19 schrieb Larry Dillon: > We had custom scripts written by my predecessor working under LAM 8.4 but > can't get them working under 9.3 > > The scripts in the module setting look like this. Basically just removed > "user" before the scripts. > > postCreate /opt/lam-helpers/userAdd.sh $mail$ $givenname$ $sn$ > $INFO.userPasswordClearText$ > postModify /opt/lam-helpers/userModify.sh $mail$ > $INFO.userPasswordClearText$ > postDelete /opt/lam-helpers/userDelete.sh $mail$ > > Example script: userAdd.sh > > #!/bin/sh > mail=$1 > fname=$2 > lname=$3 > pass=$4 > > # Add the User to Google Apps > if [[ $mail =~ "@example.edu" ]] ; then > /usr/bin/sudo -u gam /home/gam/bin/gam/gam create user $mail firstname > "$fname" lastname "$lname" password "$pass" > echo "Adding User to Google Apps via GAM script" > else > echo "Not an Example email address, no Google account created" > fi > > > After some searching, it's throwing errors in /var/log/php-fpm/ > OS is: AlmaLinux 9.6 > PHP is: PHP 8.4.14 > > > [14-Nov-2025 18:19:01 UTC] PHP Fatal error: Uncaught Error: Call to a > member function get_type() on null in > /usr/share/ldap-account-manager/lib/modules/customScripts.inc:590 > Stack trace: > #0 /usr/share/ldap-account-manager/lib/modules/customScripts.inc(491): > customScripts->runCommands() > #1 /usr/share/ldap-account-manager/lib/modules.inc(631): > customScripts->doUploadPostActions() > #2 /usr/share/ldap-account-manager/lib/upload.inc(276): > doUploadPostActions() > #3 /usr/share/ldap-account-manager/lib/upload.inc(260): > LAM\UPLOAD\Uploader->runModulePostActions() > #4 /usr/share/ldap-account-manager/lib/upload.inc(99): > LAM\UPLOAD\Uploader->runPostActions() > #5 /usr/share/ldap-account-manager/templates/misc/ajax.php(175): > LAM\UPLOAD\Uploader->doUpload() > #6 /usr/share/ldap-account-manager/templates/misc/ajax.php(76): > LAM\AJAX\Ajax->handleRequest() > #7 {main} > thrown in /usr/share/ldap-account-manager/lib/modules/customScripts.inc > on line 590 > [14-Nov-2025 18:19:06 UTC] PHP Fatal error: Uncaught Error: Call to a > member function get_type() on null in > /usr/share/ldap-account-manager/lib/modules/customScripts.inc:590 > Stack trace: > #0 /usr/share/ldap-account-manager/lib/modules/customScripts.inc(491): > customScripts->runCommands() > #1 /usr/share/ldap-account-manager/lib/modules.inc(631): > customScripts->doUploadPostActions() > #2 /usr/share/ldap-account-manager/lib/upload.inc(276): > doUploadPostActions() > #3 /usr/share/ldap-account-manager/lib/upload.inc(260): > LAM\UPLOAD\Uploader->runModulePostActions() > #4 /usr/share/ldap-account-manager/lib/upload.inc(99): > LAM\UPLOAD\Uploader->runPostActions() > #5 /usr/share/ldap-account-manager/templates/misc/ajax.php(175): > LAM\UPLOAD\Uploader->doUpload() > #6 /usr/share/ldap-account-manager/templates/misc/ajax.php(76): > LAM\AJAX\Ajax->handleRequest() > #7 {main} > thrown in /usr/share/ldap-account-manager/lib/modules/customScripts.inc > on line 590 > [14-Nov-2025 18:24:23 UTC] PHP Deprecated: htmlspecialchars(): Passing > null to parameter #1 ($string) of type string is deprecated in > /usr/share/ldap-account-manager/lib/html.inc on line 1918 > [14-Nov-2025 18:24:59 UTC] PHP Deprecated: htmlspecialchars(): Passing > null to parameter #1 ($string) of type string is deprecated in > /usr/share/ldap-account-manager/lib/html.inc on line 1918 > [14-Nov-2025 20:35:00 UTC] PHP Warning: Undefined array key > "windowsUser_pwdMustChange" in > /usr/share/ldap-account-manager/lib/modules/windowsUser.inc on line 3300 > [14-Nov-2025 20:35:00 UTC] PHP Warning: Undefined array key "" in > /usr/share/ldap-account-manager/lib/modules/windowsUser.inc on line 3300 > [14-Nov-2025 20:35:05 UTC] PHP Warning: Undefined array key > "windowsUser_pwdMustChange" in > /usr/share/ldap-account-manager/lib/modules/windowsUser.inc on line 3476 > [14-Nov-2025 20:35:07 UTC] PHP Fatal error: Uncaught Error: Call to a > member function get_type() on null in > /usr/share/ldap-account-manager/lib/modules/customScripts.inc:590 > > Any ideas what we're doing wrong? > > Larry > > > > _______________________________________________ > Lam-public mailing list > Lam...@li... > https://lists.sourceforge.net/lists/listinfo/lam-public |
|
From: Larry D. <lar...@ro...> - 2025-11-20 17:45:34
|
We had custom scripts written by my predecessor working under LAM 8.4 but
can't get them working under 9.3
The scripts in the module setting look like this. Basically just removed
"user" before the scripts.
postCreate /opt/lam-helpers/userAdd.sh $mail$ $givenname$ $sn$
$INFO.userPasswordClearText$
postModify /opt/lam-helpers/userModify.sh $mail$
$INFO.userPasswordClearText$
postDelete /opt/lam-helpers/userDelete.sh $mail$
Example script: userAdd.sh
#!/bin/sh
mail=$1
fname=$2
lname=$3
pass=$4
# Add the User to Google Apps
if [[ $mail =~ "@example.edu" ]] ; then
/usr/bin/sudo -u gam /home/gam/bin/gam/gam create user $mail firstname
"$fname" lastname "$lname" password "$pass"
echo "Adding User to Google Apps via GAM script"
else
echo "Not an Example email address, no Google account created"
fi
After some searching, it's throwing errors in /var/log/php-fpm/
OS is: AlmaLinux 9.6
PHP is: PHP 8.4.14
[14-Nov-2025 18:19:01 UTC] PHP Fatal error: Uncaught Error: Call to a
member function get_type() on null in
/usr/share/ldap-account-manager/lib/modules/customScripts.inc:590
Stack trace:
#0 /usr/share/ldap-account-manager/lib/modules/customScripts.inc(491):
customScripts->runCommands()
#1 /usr/share/ldap-account-manager/lib/modules.inc(631):
customScripts->doUploadPostActions()
#2 /usr/share/ldap-account-manager/lib/upload.inc(276):
doUploadPostActions()
#3 /usr/share/ldap-account-manager/lib/upload.inc(260):
LAM\UPLOAD\Uploader->runModulePostActions()
#4 /usr/share/ldap-account-manager/lib/upload.inc(99):
LAM\UPLOAD\Uploader->runPostActions()
#5 /usr/share/ldap-account-manager/templates/misc/ajax.php(175):
LAM\UPLOAD\Uploader->doUpload()
#6 /usr/share/ldap-account-manager/templates/misc/ajax.php(76):
LAM\AJAX\Ajax->handleRequest()
#7 {main}
thrown in /usr/share/ldap-account-manager/lib/modules/customScripts.inc
on line 590
[14-Nov-2025 18:19:06 UTC] PHP Fatal error: Uncaught Error: Call to a
member function get_type() on null in
/usr/share/ldap-account-manager/lib/modules/customScripts.inc:590
Stack trace:
#0 /usr/share/ldap-account-manager/lib/modules/customScripts.inc(491):
customScripts->runCommands()
#1 /usr/share/ldap-account-manager/lib/modules.inc(631):
customScripts->doUploadPostActions()
#2 /usr/share/ldap-account-manager/lib/upload.inc(276):
doUploadPostActions()
#3 /usr/share/ldap-account-manager/lib/upload.inc(260):
LAM\UPLOAD\Uploader->runModulePostActions()
#4 /usr/share/ldap-account-manager/lib/upload.inc(99):
LAM\UPLOAD\Uploader->runPostActions()
#5 /usr/share/ldap-account-manager/templates/misc/ajax.php(175):
LAM\UPLOAD\Uploader->doUpload()
#6 /usr/share/ldap-account-manager/templates/misc/ajax.php(76):
LAM\AJAX\Ajax->handleRequest()
#7 {main}
thrown in /usr/share/ldap-account-manager/lib/modules/customScripts.inc
on line 590
[14-Nov-2025 18:24:23 UTC] PHP Deprecated: htmlspecialchars(): Passing
null to parameter #1 ($string) of type string is deprecated in
/usr/share/ldap-account-manager/lib/html.inc on line 1918
[14-Nov-2025 18:24:59 UTC] PHP Deprecated: htmlspecialchars(): Passing
null to parameter #1 ($string) of type string is deprecated in
/usr/share/ldap-account-manager/lib/html.inc on line 1918
[14-Nov-2025 20:35:00 UTC] PHP Warning: Undefined array key
"windowsUser_pwdMustChange" in
/usr/share/ldap-account-manager/lib/modules/windowsUser.inc on line 3300
[14-Nov-2025 20:35:00 UTC] PHP Warning: Undefined array key "" in
/usr/share/ldap-account-manager/lib/modules/windowsUser.inc on line 3300
[14-Nov-2025 20:35:05 UTC] PHP Warning: Undefined array key
"windowsUser_pwdMustChange" in
/usr/share/ldap-account-manager/lib/modules/windowsUser.inc on line 3476
[14-Nov-2025 20:35:07 UTC] PHP Fatal error: Uncaught Error: Call to a
member function get_type() on null in
/usr/share/ldap-account-manager/lib/modules/customScripts.inc:590
Any ideas what we're doing wrong?
Larry
|
|
From: Roland G. <po...@ro...> - 2025-10-16 11:29:08
|
Hi Larry, basically, you need to configure your custom CA certificate (not the server one) as trusted. This can be done inside LAM or using TLS_CACERT. You can also check your OS documentation how to import root certificates as this might also help. If you purchase a certificate then there should be no issues unless it is a very exotic CA. Some OS do not have Let's Encrypt trusted by default. Another way would be to use a tool like "stunnel" that provides a local port and forwards the communication encrypted: https://www.stunnel.org/ Best regards Roland Am 15.10.25 um 21:46 schrieb Larry Dillon: > Trying to get LAM to talk to Samba via ldaps > > Error message: > > Cannot connect to specified LDAP server. Please try again. > (-1) LDAP error, server says: Can't contact LDAP server - > error:0A000086:SSL routines::certificate verify failed (unable to get local > issuer certificate) > > Wireshark says: Alert (Level: Fatal, Description: Unknown CA) > > I've tried the Import from Server under General settings, which imports > fine, but never works. I feel like this should be an easy procedure, but I > can never get it to work with encryption enabled. > Common name Valid to Serial number Delete > dc5.rmc.example.edu > 2027-09-14 > 1115614824 > > I tried editing the /etc/openldap/ldap.conf on the LAM server to include > what is called the cacert.pem in the documentation as referenced at: > https://www.ldap-account-manager.org/static/doc/manual/apbs03.html > cacert.pem does not exist, so I've tried the Samba generated ca.pem > and cert.pem, with a reboot between the two tries. > > TLS_CACERT /etc/openldap/certs/dc5-ca.pem > #TLS_CACERT /etc/openldap/certs/dc5-cert.pem > > A few years I also tried to get this to work, to no avail. I tried > manually importing the certs and CA, but never got it work. > > I tried generating self-signed certs on the Samba server as outlined at: > https://wiki.samba.org/index.php/Configuring_LDAP_over_SSL_(LDAPS)_on_a_Samba_AD_DC > > I also tried setting up my own CA, but didn't find much documentation and > never got that working. > > I feel like I'm doing something fundamentally wrong. Would this work better > if I installed LAM on Debian or Ubuntu instead of Alma? > > We'd rather use in-house certs, but should we just buy a commercial, > trusted cert? If so from whom, and what type of certs, for what uses, > including what additional names? > > Should I look into setting up a CA again? If so, any pointers to a good > guide? What are most people doing? > > I've installed plenty of web server SSL certs, and manually renewed Samba > certs, but I just can't get this to work. > > Thanks for any help or pointers to a step-by-step procedure that anyone can > provide! > > Larry > > > > _______________________________________________ > Lam-public mailing list > Lam...@li... > https://lists.sourceforge.net/lists/listinfo/lam-public |
|
From: Larry D. <lar...@ro...> - 2025-10-15 20:10:17
|
Trying to get LAM to talk to Samba via ldaps Error message: Cannot connect to specified LDAP server. Please try again. (-1) LDAP error, server says: Can't contact LDAP server - error:0A000086:SSL routines::certificate verify failed (unable to get local issuer certificate) Wireshark says: Alert (Level: Fatal, Description: Unknown CA) I've tried the Import from Server under General settings, which imports fine, but never works. I feel like this should be an easy procedure, but I can never get it to work with encryption enabled. Common name Valid to Serial number Delete dc5.rmc.example.edu 2027-09-14 1115614824 I tried editing the /etc/openldap/ldap.conf on the LAM server to include what is called the cacert.pem in the documentation as referenced at: https://www.ldap-account-manager.org/static/doc/manual/apbs03.html cacert.pem does not exist, so I've tried the Samba generated ca.pem and cert.pem, with a reboot between the two tries. TLS_CACERT /etc/openldap/certs/dc5-ca.pem #TLS_CACERT /etc/openldap/certs/dc5-cert.pem A few years I also tried to get this to work, to no avail. I tried manually importing the certs and CA, but never got it work. I tried generating self-signed certs on the Samba server as outlined at: https://wiki.samba.org/index.php/Configuring_LDAP_over_SSL_(LDAPS)_on_a_Samba_AD_DC I also tried setting up my own CA, but didn't find much documentation and never got that working. I feel like I'm doing something fundamentally wrong. Would this work better if I installed LAM on Debian or Ubuntu instead of Alma? We'd rather use in-house certs, but should we just buy a commercial, trusted cert? If so from whom, and what type of certs, for what uses, including what additional names? Should I look into setting up a CA again? If so, any pointers to a good guide? What are most people doing? I've installed plenty of web server SSL certs, and manually renewed Samba certs, but I just can't get this to work. Thanks for any help or pointers to a step-by-step procedure that anyone can provide! Larry |
|
From: Roland G. <po...@ro...> - 2025-09-16 15:23:32
|
Announcement: The tree view allows you to compare multiple entries. Passwords and password reset links can be sent via SMS in addition to emails. LAM is translated to Greek now. Full changelog: https://www.ldap-account-manager.org/lamcms/changelog Download: https://www.ldap-account-manager.org/lamcms/releases Features: * management of various account types * Unix * Samba 4/Active Directory * Asterisk * Kopano * DHCP * SSH keys * ... * profiles for account creation * account creation via file upload * automatic creation/deletion of home directories * setting quotas * PDF output for all accounts * editor for organizational units * schema browser * tree view * 2FA support Demo installation: You can try our demo installation online. https://www.ldap-account-manager.org/lamcms/liveDemo Authors & Copyright: Copyright (C) 2003 - 2025: Roland Gruber <po...@ro...> LAM is published under the GNU General Public License. The complete list of licenses can be found in the copyright file. |
|
From: Roland G. <po...@ro...> - 2025-09-02 16:08:37
|
Announcement: The tree view allows you to compare multiple entries. Passwords and password reset links can be sent via SMS in addition to emails. LAM is translated to Greek now. This is a test version. Please report any issues till 2025-09-14. Full changelog: https://www.ldap-account-manager.org/lamcms/changelog Download: https://www.ldap-account-manager.org/lamcms/releases Features: * management of various account types * Unix * Samba 4/Active Directory * Asterisk * Kopano * DHCP * SSH keys * ... * profiles for account creation * account creation via file upload * automatic creation/deletion of home directories * setting quotas * PDF output for all accounts * editor for organizational units * schema browser * tree view * 2FA support Demo installation: You can try our demo installation online. https://www.ldap-account-manager.org/lamcms/liveDemo Authors & Copyright: Copyright (C) 2003 - 2025: Roland Gruber <po...@ro...> LAM is published under the GNU General Public License. The complete list of licenses can be found in the copyright file. |
|
From: Roland G. <po...@ro...> - 2025-08-05 05:48:56
|
Hi Serge, if the accounts look identical and the admins are the same then one server profile with one user type should be fine. If you see later that there are differences then you can also create additional user types (with e.g. separate suffixes). When you create a user then LAM allows you to select the OU where to store it. There are also account profiles (see tools menu) where this can be preselected. You can create additional OUs in OU Editor. This can be found in the tools menu inside LAM. Best regards Roland Am 04.08.25 um 23:04 schrieb Serge Cohen: > Hello list, > > I’m brand new to usage of LAM. I have installed it (through Nginx + PHP-FPM) on a small LDAP server to be able to perform some configuration using a web/graphical interface rather than going on with tedious scripting. > > But it is not really clear to me how to use LAM with my setting. > > Concerning my user entries, the current hierarchy of the LDAP is as follows (obviously, best seen in a monospace font): > > dn=domain,dn=name,dn=org (indeed, something else, but of no relevance here) > +-- ou=people (an organizational unit in which all accounts are) > +-- ou=dept1 (a first department) > | --- cn=user1 > | --- cn=user2 > | ..... > +-- ou=dept2 (a second dept., bigger) > +-- ou=team1 (1st team of department 2) > | --- cn=userXX > | ..... > +-- ou=team2 (2nd team of department 2) > --- cn=userYY > > > I have the impression I have to configure one profile for each type of user, so that their base DN is complete. In other words, I have the feeling I have to configure: > Profile 1: base DN: ou=dept1,ou=people,dn=domain,dn=name,dn=org > Profile 2: base DN: ou=team1,ou=dept2,ou=people,dn=domain,dn=name,dn=org > Profile 3: base DN: ou=team2,ou=dept2,ou=people,dn=domain,dn=name,dn=org > > This seems tedious to me, especially since I have a couple of extra other ou (under ou=people,dn=domain,dn=name,dn=org) and indeed all these accounts should (except for their base DN) be rather identical in terms of configuration. > > What am I missing? > > Another (but related) question: is it possible to create some of the intermediate ou within LAM, or should I turn to ‘pure LDAP’ for this purpose? > > Thanks in advance for any pointer or help! > > Serge. > > > > > Dans la mesure du possible, merci de m'écrire à / Please use following email address : ser...@cn... > +++++++++++++++++++++++++++++++++++++++++ > Serge Cohen > GPG Key ID: 5EC8 9F9C 621C FB28 99C2 97F8 9FBF E736 0DD8 7322 > > IPANEMA UAR3461 CNRS/MiC/UVSQ/MNHN > > web : http://ipanema.cnrs.fr > https://cv.archives-ouvertes.fr/sergecohen > +++++++++++++++++++++++++++++++++++++++++ > > > > _______________________________________________ > Lam-public mailing list > Lam...@li... > https://lists.sourceforge.net/lists/listinfo/lam-public |
|
From: Serge C. <ser...@cn...> - 2025-08-04 21:19:55
|
Hello list,
I’m brand new to usage of LAM. I have installed it (through Nginx + PHP-FPM) on a small LDAP server to be able to perform some configuration using a web/graphical interface rather than going on with tedious scripting.
But it is not really clear to me how to use LAM with my setting.
Concerning my user entries, the current hierarchy of the LDAP is as follows (obviously, best seen in a monospace font):
dn=domain,dn=name,dn=org (indeed, something else, but of no relevance here)
+-- ou=people (an organizational unit in which all accounts are)
+-- ou=dept1 (a first department)
| --- cn=user1
| --- cn=user2
| .....
+-- ou=dept2 (a second dept., bigger)
+-- ou=team1 (1st team of department 2)
| --- cn=userXX
| .....
+-- ou=team2 (2nd team of department 2)
--- cn=userYY
I have the impression I have to configure one profile for each type of user, so that their base DN is complete. In other words, I have the feeling I have to configure:
Profile 1: base DN: ou=dept1,ou=people,dn=domain,dn=name,dn=org
Profile 2: base DN: ou=team1,ou=dept2,ou=people,dn=domain,dn=name,dn=org
Profile 3: base DN: ou=team2,ou=dept2,ou=people,dn=domain,dn=name,dn=org
This seems tedious to me, especially since I have a couple of extra other ou (under ou=people,dn=domain,dn=name,dn=org) and indeed all these accounts should (except for their base DN) be rather identical in terms of configuration.
What am I missing?
Another (but related) question: is it possible to create some of the intermediate ou within LAM, or should I turn to ‘pure LDAP’ for this purpose?
Thanks in advance for any pointer or help!
Serge.
Dans la mesure du possible, merci de m'écrire à / Please use following email address : ser...@cn...
+++++++++++++++++++++++++++++++++++++++++
Serge Cohen
GPG Key ID: 5EC8 9F9C 621C FB28 99C2 97F8 9FBF E736 0DD8 7322
IPANEMA UAR3461 CNRS/MiC/UVSQ/MNHN
web : http://ipanema.cnrs.fr
https://cv.archives-ouvertes.fr/sergecohen
+++++++++++++++++++++++++++++++++++++++++
|
|
From: Roland G. <po...@ro...> - 2025-07-18 18:06:02
|
Hi Don, try setting the level to "debug". Then you should get a message on each login. Best regards Roland Am 18.07.25 um 13:37 schrieb Don Wilkinson: > I have the logging set to error level, and to write to syslog. I don’t see anything from LAM being written to /var/log/syslog. I’m running Ubuntu 20.04. Any assistance would be helpful. > > > > _______________________________________________ > Lam-public mailing list > Lam...@li... > https://lists.sourceforge.net/lists/listinfo/lam-public |
|
From: Don W. <dwi...@nr...> - 2025-07-18 11:53:21
|
I have the logging set to error level, and to write to syslog. I don’t see anything from LAM being written to /var/log/syslog. I’m running Ubuntu 20.04. Any assistance would be helpful. |
|
From: Roland G. <po...@ro...> - 2025-07-12 06:03:37
|
Hi Dave, Am 11.07.25 um 09:39 schrieb Dave Hayes: > This did not work to set a group's "mail" field. I used %cn% and it was not > replaced with the value of "cn". Instead I got: > > %cn%@mydomain.com > > placed in the field before I save the actual record. I didn't actually try to > save this record due to seeing this. just save it. ;-) The wildcard is replaced directly before the entry is saved. This is because then the final values from each module are defined. I just tried your example with %cn% and a constant field. Works for me. Best regards Roland |
|
From: Dave H. <dav...@dr...> - 2025-07-11 07:39:37
|
On Tue, 1 Jul 2025 21:00:56 +0200, Roland Gruber <po...@ro...> wrote: >Am 30.06.25 um 19:05 schrieb Dave Hayes: >>> each module can provide wildcards and also defines where they can be >>> replaced (own + other module's). You can find it in the "wildcards" >>> section of the module's documentation, e.g. for Personal: >> >> Does this work for a group's custom field too? > >custom fields can consume wildcard values from other modules (in all >text fields). But they do not provide wildcard values themselves. > >The custom field type "Constant" allows additional wildcards based on >LDAP attribute values of all modules. See here for the complete list and >examples: This did not work to set a group's "mail" field. I used %cn% and it was not replaced with the value of "cn". Instead I got: %cn%@mydomain.com placed in the field before I save the actual record. I didn't actually try to save this record due to seeing this. My groups are of the form cn=<groupname>, cn=groups, (base DN) so perhaps your default to ambiguity is to not replace the token? -- Dave Hayes - Computer and Internet Consultant - LA CA, USA >> *Opinions expressed above are entirely my own* << You ask me what to do about your problems. It is my view that your real problem is that you are a member of the human race. Face that one first. |
|
From: Roland G. <po...@ro...> - 2025-07-07 15:33:10
|
For the archive, old key format sent via email. Am 07.07.25 um 17:03 schrieb Oliver Becker: > Hi, > > our new company license only works with our LAM Pro Version 8.9 > It is not working with our installations of minor versions (e.g. 8.3) > > Are there limitations to the versions with new keys? > Is there something else, that I should care about? > > The old key works well in all installations. > > > Kind regards > Oliver Becker > > > > _______________________________________________ > Lam-public mailing list > Lam...@li... > https://lists.sourceforge.net/lists/listinfo/lam-public |
|
From: Oliver B. <o.b...@he...> - 2025-07-07 15:28:26
|
Hi, our new company license only works with our LAM Pro Version 8.9 It is not working with our installations of minor versions (e.g. 8.3) Are there limitations to the versions with new keys? Is there something else, that I should care about? The old key works well in all installations. Kind regards Oliver Becker |
|
From: Roland G. <po...@ro...> - 2025-07-03 18:51:18
|
Hi Glenn, do you have activated "Require password change on first login" in the PPolicy password policy entry? Together with the option "Use for all operations" in self-service profile, this could cause the issue. In this case, the password reset would be done by an admin user and therefore another password change is enforced. Best regards Roland Am 03.07.25 um 14:32 schrieb Mallon, Glenn: > The Password change required is showing in the attached image. > > When I follow the self reset on my own account, it allows me to set the > password, but when I save, it prompts me to set my password once more. > If I then logout and log back in, it will prompt me to change my > password once more. Would something stop it from changing the flag? > > *From: *Roland Gruber <po...@ro...> > *Date: *Wednesday, July 2, 2025 at 2:36 PM > *To: *lam...@li... <lam...@li...> > *Subject: *Re: [Lam-public] Resetting password locks me out > > Hi Glenn, > > the password hash is configured in the self-service profile, tab module > settings, Unix, password hash type. If you select a hash type that is > not supported by the LDAP server then this would lock you out. > > Can you post a screenshot where it shows the "password change required"? > There are multiple of these depending on LDAP server and activated modules. > > Best regards > Roland > > > Am 02.07.25 um 15:45 schrieb Mallon, Glenn: >> I’ve done a restart of the server just in case, and now it’s letting my log in after changing password, but when I log in it is always making me reset my password. When checking on the user account, it shows Password change required even after a reset. Is this expected? >> >> From: Mallon, Glenn <gle...@ha...> >> Date: Wednesday, July 2, 2025 at 8:29 AM >> To: Lam-Public <lam...@li...> >> Subject: [Lam-public] Resetting password locks me out >> I’m visiting the self-service page to test my config, and entering my password. I’m prompted to set my password (Password change required checked), which I do and am taken to the page to modify my details. >> >> If I try to save anything, I get an Invalid Credentials message. When I try to log out and in, I get the same error. >> >> Is it potentially saving with a different encryption? If so, where so I modify this? >> >> >> >> _______________________________________________ >> Lam-public mailing list >> Lam...@li... >> https://lists.sourceforge.net/lists/listinfo/lam-public <https:// > lists.sourceforge.net/lists/listinfo/lam-public> > > > > _______________________________________________ > Lam-public mailing list > Lam...@li... > https://lists.sourceforge.net/lists/listinfo/lam-public <https:// > lists.sourceforge.net/lists/listinfo/lam-public> > > > > _______________________________________________ > Lam-public mailing list > Lam...@li... > https://lists.sourceforge.net/lists/listinfo/lam-public |
|
From: Mallon, G. <gle...@ha...> - 2025-07-03 17:06:24
|
The Password change required is showing in the attached image. When I follow the self reset on my own account, it allows me to set the password, but when I save, it prompts me to set my password once more. If I then logout and log back in, it will prompt me to change my password once more. Would something stop it from changing the flag? [cid:image001.png@01DBEBF4.9C95C450] From: Roland Gruber <po...@ro...> Date: Wednesday, July 2, 2025 at 2:36 PM To: lam...@li... <lam...@li...> Subject: Re: [Lam-public] Resetting password locks me out Hi Glenn, the password hash is configured in the self-service profile, tab module settings, Unix, password hash type. If you select a hash type that is not supported by the LDAP server then this would lock you out. Can you post a screenshot where it shows the "password change required"? There are multiple of these depending on LDAP server and activated modules. Best regards Roland Am 02.07.25 um 15:45 schrieb Mallon, Glenn: > I’ve done a restart of the server just in case, and now it’s letting my log in after changing password, but when I log in it is always making me reset my password. When checking on the user account, it shows Password change required even after a reset. Is this expected? > > From: Mallon, Glenn <gle...@ha...> > Date: Wednesday, July 2, 2025 at 8:29 AM > To: Lam-Public <lam...@li...> > Subject: [Lam-public] Resetting password locks me out > I’m visiting the self-service page to test my config, and entering my password. I’m prompted to set my password (Password change required checked), which I do and am taken to the page to modify my details. > > If I try to save anything, I get an Invalid Credentials message. When I try to log out and in, I get the same error. > > Is it potentially saving with a different encryption? If so, where so I modify this? > > > > _______________________________________________ > Lam-public mailing list > Lam...@li... > https://lists.sourceforge.net/lists/listinfo/lam-public _______________________________________________ Lam-public mailing list Lam...@li... https://lists.sourceforge.net/lists/listinfo/lam-public |
|
From: Roland G. <po...@ro...> - 2025-07-02 18:35:53
|
Hi Glenn, the password hash is configured in the self-service profile, tab module settings, Unix, password hash type. If you select a hash type that is not supported by the LDAP server then this would lock you out. Can you post a screenshot where it shows the "password change required"? There are multiple of these depending on LDAP server and activated modules. Best regards Roland Am 02.07.25 um 15:45 schrieb Mallon, Glenn: > I’ve done a restart of the server just in case, and now it’s letting my log in after changing password, but when I log in it is always making me reset my password. When checking on the user account, it shows Password change required even after a reset. Is this expected? > > From: Mallon, Glenn <gle...@ha...> > Date: Wednesday, July 2, 2025 at 8:29 AM > To: Lam-Public <lam...@li...> > Subject: [Lam-public] Resetting password locks me out > I’m visiting the self-service page to test my config, and entering my password. I’m prompted to set my password (Password change required checked), which I do and am taken to the page to modify my details. > > If I try to save anything, I get an Invalid Credentials message. When I try to log out and in, I get the same error. > > Is it potentially saving with a different encryption? If so, where so I modify this? > > > > _______________________________________________ > Lam-public mailing list > Lam...@li... > https://lists.sourceforge.net/lists/listinfo/lam-public |
|
From: Mallon, G. <gle...@ha...> - 2025-07-02 14:18:07
|
I’ve done a restart of the server just in case, and now it’s letting my log in after changing password, but when I log in it is always making me reset my password. When checking on the user account, it shows Password change required even after a reset. Is this expected? From: Mallon, Glenn <gle...@ha...> Date: Wednesday, July 2, 2025 at 8:29 AM To: Lam-Public <lam...@li...> Subject: [Lam-public] Resetting password locks me out I’m visiting the self-service page to test my config, and entering my password. I’m prompted to set my password (Password change required checked), which I do and am taken to the page to modify my details. If I try to save anything, I get an Invalid Credentials message. When I try to log out and in, I get the same error. Is it potentially saving with a different encryption? If so, where so I modify this? |
30 messages has been excluded from this view by a project administrator.
