openldap-bugs November 2007

openldap-bugs@openldap.org

44 participants
170 discussions

Re: (ITS#5207) Password checking: external program
by ghenry＠OpenLDAP.org 04 Nov '07

04 Nov '07

<quote who="Hadmut Danisch"> > Gavin Henry wrote: >> I don't read that as rude, merely advice. Don't take it personally please. > > > I do. His point was not to understand or answer my question. His point was to allege that I would not know what I am talking about and would not have understood the basic principles of LDAP just because my wording differed slightly from his expectations. The problem with e-mail is that a persons tone can't be portrayed. > > It was a personal attack and I take it as such. I don't care about, but I notice that the guys behind openldap tend to rather attack people personally than answering security relevant questions and that they None of our team do this. We all have limited time and do our best to reply to users questions or ITS reports. But you must understand, 99% of questions asked have been asked before with the answers being available in the mailing archives. 9 times out of 10 a user hasn't read any of our docs, so we politely ask, "have you read any of the docs?", that's not "have you *read* any of the docs?" implying an insult. So if we come across as attacking people, then I believe that this is an interpretation of the reader. > expect everyone to know what's not in the docs but hidden somewhere in some strange FAQ machine. Not really strange, pretty standard at the time and still used in many OSS projects. I've actually ported most of the relevant parts of our FAQ-O-Matic to the 2.4 Admin Guide, at present over 80 new pages of content over a 6-7 month period of unpaid commitment. So when I ask, as the OpenLDAP Project Documention Leader, have you read any of the docs, I think I'm entitled to put that question to a user. That's not being rude. > > Beyond the fact that this is not worth of further dispute, from my point of view this way of dealing with questions and handling authentication details disqualifies as software engineers for security relevant software. I disagree. Nothing in this thread can back up your claim here. > > Just for your information: I read the specs when they were issued as X.500 and X.509 in the CCITT Blue Book. But I am not rereading specs every day, LDAP is just a small detail of my daily work. Ok. > >> OpenLDAP supports SASL, SASL does have it's own documentation. Did you try to read any of that? > > Again, this offending way to assume that anyone who does not have exactly your point of view could not have read the specs. "try to read" is offensive. Maybe I should have asked, "Did you browse the SASL docs?", "Or did you take a quick look over at the SASL documentation?". They all mean the same thing, with no offence intended. It's all in how the reader sees it. <snip> > So before blaming me for not reading and understanding specs, tell me, where exactly this is specified. > > Do those particular specs you're blaming me for not having read at all exist? I don't know, I'm not a SASL expert. Maybe one of the Core team can answer this. If you do find the answer or implement something to solve your feature request, documentation patches are always welcome. We are an Open Source Community after all. Gavin.

1 0

(ITS#5211) syncrepl: server fails to sync on unknown cookie
by e.vanoosten＠grons.nl 02 Nov '07

02 Nov '07

Full_Name: Erik van Oosten Version: 2.3.36 OS: cygwin URL: Submission from: (NULL) (212.78.164.66) When I start sync operation with a made up cookie (just some random bytes), the server replies with a response with result code 2 (Protocol Error). RFC4533 specifies: "If the server does not recognize the request cookie or the request is made under different associations or non-equivalent protections, the server SHALL return the initial content as if no cookie had been provided or return an empty content with the e-syncRefreshRequired LDAP result code." RFC2119: "MUST This word, or the terms "REQUIRED" or "SHALL", mean that the definition is an absolute requirement of the specification." Expected behavior: either the initial content as if no cookie had been provided or an empty content with the e-syncRefreshRequired LDAP result code.

1 0

Re: (ITS#5210) SyncRepl: upon unchanged DIT expected only delete phase for refreshAndPersist
by hyc＠symas.com 02 Nov '07

02 Nov '07

e.vanoosten(a)grons.nl wrote: > Full_Name: Erik van Oosten > Version: 2.3.36 > OS: cygwin > URL: > Submission from: (NULL) (212.78.164.66) > > > When you start a refreshAndPersist sync operation with an initial cookie, and > the DIT has not changed since the cookie was issued, during the refresh phase I > expect to get a single message, namely a SyncInfoMessage of refreshDelete with > refreshDone equals to TRUE (no present phase, only the delete phase). > Observed behavior is that you get a single message, namely a SyncInfoMessage of > refreshPresent with refreshDone equals to TRUE (only the present phase, no > delete phase). > > Note: a refreshOnly operation in the same circumstances works as expected. > > Issue submitted as requested by Howard Chu. Thanks for the report. This is now fixed in HEAD. syncprov.c 1.207 and 1.208 contain the relevant changes. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#5210) SyncRepl: upon unchanged DIT expected only delete phase for refreshAndPersist
by e.vanoosten＠grons.nl 02 Nov '07

02 Nov '07

Full_Name: Erik van Oosten Version: 2.3.36 OS: cygwin URL: Submission from: (NULL) (212.78.164.66) When you start a refreshAndPersist sync operation with an initial cookie, and the DIT has not changed since the cookie was issued, during the refresh phase I expect to get a single message, namely a SyncInfoMessage of refreshDelete with refreshDone equals to TRUE (no present phase, only the delete phase). Observed behavior is that you get a single message, namely a SyncInfoMessage of refreshPresent with refreshDone equals to TRUE (only the present phase, no delete phase). Note: a refreshOnly operation in the same circumstances works as expected. Issue submitted as requested by Howard Chu.

1 0

Re: (ITS#5208) OpenLDAP w/ multiple bdb backends provides invalid paged result responses
by hyc＠symas.com 02 Nov '07

02 Nov '07

hume-ml(a)bofh.ca wrote: > On Fri, 2007-11-02 at 11:09 +0000, Gavin Henry wrote: >>> A search such as the following: >>> ldapsearch -h localhost -x -E pr=2 -b dc=dal,dc=ca '(objectclass=*)' > > >> Where is "dc=dal,dc=ca" set? > > That's a typo, sorry. Should be "dc=domain,dc=com". Missed that when > "redacting" the initial submission. This bug has been fixed in CVS HEAD. Also, this is a dup of ITS#5191 so it has already been closed. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5208) OpenLDAP w/ multiple bdb backends provides invalid paged result responses
by hume-ml＠bofh.ca 02 Nov '07

02 Nov '07

On Fri, 2007-11-02 at 11:09 +0000, Gavin Henry wrote: > > > > A search such as the following: > > ldapsearch -h localhost -x -E pr=2 -b dc=dal,dc=ca '(objectclass=*)' > Where is "dc=dal,dc=ca" set? That's a typo, sorry. Should be "dc=domain,dc=com". Missed that when "redacting" the initial submission.

1 0

Re: (ITS#5208) OpenLDAP w/ multiple bdb backends provides invalid paged result responses
by ghenry＠OpenLDAP.org 02 Nov '07

02 Nov '07

hume-ml(a)bofh.ca wrote: > Full_Name: Brandon Hume > Version: 2.3.38 > OS: OpenSolaris/Redhat Linux AS3 > URL: > Submission from: (NULL) (129.173.2.54) > > > When OpenLDAP is serving a tree split into multiple backends (for whatever > reasons someone might do so), searching with the paged result control against > the base DN and ranging across the subordinate trees causes a paged result > cursor to be provided for each backend. > > ie: With a config such as: > > database bdb > directory /opt/csw/var/openldap/people > suffix "ou=People,dc=example,dc=com" > subordinate > rootdn "cn=NOC,dc=example,dc=com" > > database bdb > directory /opt/csw/var/openldap/default > suffix "dc=domain,dc=com" > rootdn "cn=NOC,dc=domain,dc=com" > rootpw {SSHA}[...] > > > A search such as the following: > ldapsearch -h localhost -x -E pr=2 -b dc=dal,dc=ca '(objectclass=*)' > > ... will produce the following result/control response: > > [...] > # search result > search: 2 > result: 0 Success > control: 1.2.840.113556.1.4.319 false MAkCAQAEBAIAAAA= > control: 1.2.840.113556.1.4.319 false MAkCAQAEBP////8= > Press [size] Enter for the next {2|size} entries. > > > This has the effect of causing the next paged result to fail, since one of the > two values is not correct and is rejected by the server. > > Where is "dc=dal,dc=ca" set? -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

Re: (ITS#5207) Password checking: external program
by ghenry＠OpenLDAP.org 02 Nov '07

02 Nov '07

hadmut(a)danisch.de wrote: > Howard Chu wrote: >> hadmut(a)danisch.de wrote: >>> But this opens other questions: >>> Does slapd support multiple password entries? >> Of course. The schema definition for userPassword says that it is a >> multivalued attribute. (Note: "values" not "entries". Seems you need to >> do some more reading on LDAP basics.) > > > Well, I don't think there's reason to get rude. Please understand that > english is not my first language, and I apologize if I did not meet your > expectations. I don't read that as rude, merely advice. Don't take it personally please. > > And I did not ask about LDAP in common, I asked about the slapd > implementation. So reading LDAP basics would not answer the question. > > As it was pointed out before, the details of this {SASL} authentication > scheme are _not_ documented in the slapd manual or any LDAP basics, but > somewhere hidden in the FAQs or even partly undocumented. OpenLDAP supports SASL, SASL does have it's own documentation. Did you try to read any of that? > > >> slappasswd doesn't know anything about that. slapd checks until it finds >> a match. > > That's what I wanted to know. Obviously, as you yourself point out, > that's an implementation detail. > > Does ldappasswd change all entries or just the one matching the given > password? > > > regards > Hadmut > > > > -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

Re: (ITS#5191) Corrupted control value when using pagedresults with subordinate database
by hyc＠symas.com 01 Nov '07

01 Nov '07

ando(a)sys-net.it wrote: >> I disagree. The fact that databases are glued should in no way prevent >> paged >> results from working. > > I mean: the current implementation prevents it from working (AFAIK); I see > disabling it in case of glued database a legitimate fix of the problem. OK. Well, it's working now in HEAD, we can roll that fix for RE24. I don't see much reason to backport to RE23 but am open. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#5209) Setting sasl-host in slapd.conf fails
by arjones＠simultan.dyndns.org 01 Nov '07

01 Nov '07

Full_Name: Andrew Rucker Jones Version: 2.4.6 OS: Linux URL: Submission from: (NULL) (87.165.239.200) I just upgraded from a working 2.3.39 installation to 2.4.6 without making changes, but slapd does not start. Upon further investigation, i found that slaptest claims my slapd.conf is clean, but slapd -d 100 says that sasl-host is already set. That is, in my slapd.conf, i set sasl-host once and only once, but slapd comes across that lines and claims that sasl-host had already been set before that. Looking at the code, it seems that lines 354-358 in config.c (servers/slapd/) fails to accurately check whether or not something with the ARG_UNIQUE flag has really already been set from the configuration file. Commenting out the sasl-host line in slapd.conf lets slapd start, but i assume from looking at bconfig.c that the value of sasl-host is wrong.

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs November 2007