openldap-bugs May 2007

openldap-bugs@openldap.org

42 participants
156 discussions

Re: (ITS#4965) slapd stops if access to cn=monitor is restricted
by ali.pouya＠free.fr 18 May '07

18 May '07

Hi Pierangelo; The HEAD misses some new definitions (see followup 5 in ITS 4959) so I reproduced the problem with OPENLDAP_REL_ENG_2_4. I feel that the problem has not been fixed in this release. Thanks and best regards Ali

1 0

Re: (ITS#4959) replica seg faults if syncrepl searchbase =""
by ali.pouya＠free.fr 18 May '07

18 May '07

Hi Pierangelo; The HEAD misses some new definitions (see below) so I reproduced the problem with OPENLDAP_REL_ENG_2_4. The backtrace is the same as before : #0 0x00179d5a in strcmp () from /lib/tls/libc.so.6 #1 0x08068ede in select_backend (dn=0xb78bef5c, manageDSAit=0, noSubs=0) at backend.c:684 #2 0x0806a8ac in fe_aux_operational (op=0xb78bef40, rs=0xb78bee80) at backend.c:1779 #3 0x0806a01b in backend_operational (op=0xb78bef40, rs=0xb78bee80) at backend.c:1801 #4 0x080a7d06 in do_syncrepl (ctx=0xb78bf2a0, arg=0x88ab2e0) at syncrepl.c:547 #5 0x081281c3 in ldap_int_thread_pool_wrapper (xpool=0x886fd78) at tpool.c:704 #6 0x00907371 in start_thread () from /lib/tls/libpthread.so.0 #7 0x001d8ffe in clone () from /lib/tls/libc.so.6 =============== N.B. The HEAD misses the definition of 'oids' 'oid_name', etc. So I get the following error at build time : tls.c:2908: error: syntax error before '*' token tls.c: In function `find_oid': tls.c:2913: error: `oids' undeclared (first use in this function) tls.c:2913: error: (Each undeclared identifier is reported only once tls.c:2913: error: for each function it appears in.) tls.c: In function `ldap_X509dn2bv': tls.c:2946: error: `oid_name' undeclared (first use in this function) tls.c:2946: error: `oidname' undeclared (first use in this function) make[2]: *** [tls.lo] Erreur 1 make[2]: Leaving directory `/var/ali/openldap-2.4/head-170507/libraries/libldap' make[1]: *** [all-common] Erreur 1 make[1]: Leaving directory `/var/ali/openldap-2.4/head-170507/libraries' make: *** [all-common] Erreur 1 Thanks Best Regards Ali

1 0

(ITS#4971) patch for OpenLDAP 2-3-32
by jemeterisan＠mail.ru 18 May '07

18 May '07

Full_Name: Petrov Dmitry Version: 2-3-32 OS: Red Hat 9 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (81.195.208.66) Hi, guys! I had noticed, that the patch, used for 'schema-map.c' doesn't work correct. I hope, You also had checked it up. So what had I found in the function 'backsql_ad2at': The attribute name is stored in 'struct berval' structure, so if You change '.bv_val' from 'userCertificate;binary' to 'userCertificate', You should change '.bv_len' in accordance to strlen(aaa.bv_val) without strlen(";binary"). And by the way I want to store 'userCertificate' attribute type in PostrgreSQL. What type of the field in the table should I use? Just another question to the developers: I've heared that OpenLDAP is sensible to DOS attacks, so, how can I avoid this trouble? And I want to know more about this problem, if possible. With best wishes, Dmitry...

1 0

(ITS#4970) Problem between pwdReset and pwdMinAge
by py.bonnetain＠ba-consultants.fr 17 May '07

17 May '07

Full_Name: Pierre-Yves Bonnetain Version: 2.3.35 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (213.41.162.162) There is something "forgotten" in ppolicy overlay code. When pwdReset is set to TRUE, the user is properly asked to change his password. BUT if the (admin-made) previous password change is newer than pwdMinAge, the requested password change will be rejected with a "password too young" message : ----------- $ ssh somehost -l someuser Password: You are required to change your LDAP password immediately. Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information update failed: Constraint violation Password is too young to change ----------- The pwdMinAge parameter should be ignored when pwdReset is set, otherwise the user will effectively be locked out of his account while waiting for the minimum delay to expire. Here is a patch to correct this behavior. Proposed patch may not adhere to coding standards and such, so feel free to enhance it as needed . *** ppolicy.old 2007-02-08 13:31:24.000000000 +0100 --- ppolicy.c 2007-05-17 17:10:39.000000000 +0200 *************** *** 1696,1710 **** time_t pwtime = (time_t)-1, now; int age; ! if ((pa = attr_find( e->e_attrs, ad_pwdChangedTime )) != NULL) ! pwtime = parse_time( pa->a_nvals[0].bv_val ); ! now = slap_get_time(); ! age = (int)(now - pwtime); ! if ((pwtime != (time_t)-1) && (age < pp.pwdMinAge)) { ! rs->sr_err = LDAP_CONSTRAINT_VIOLATION; ! rs->sr_text = "Password is too young to change"; ! pErr = PP_passwordTooYoung; ! goto return_results; } } --- 1696,1716 ---- time_t pwtime = (time_t)-1, now; int age; ! /* Py Bonnetain, B&A Consultants : We DON'T CARE for minAge if pwdReset ! is set. */ ! if ((pa = attr_find( e->e_attrs, ad_pwdReset )) == NULL || ! ! bvmatch( &pa->a_nvals[0], &slap_true_bv) ) { ! ! if ((pa = attr_find( e->e_attrs, ad_pwdChangedTime )) != NULL) ! pwtime = parse_time( pa->a_nvals[0].bv_val ); ! now = slap_get_time(); ! age = (int)(now - pwtime); ! if ((pwtime != (time_t)-1) && (age < pp.pwdMinAge)) { ! rs->sr_err = LDAP_CONSTRAINT_VIOLATION; ! rs->sr_text = "Password is too young to change"; ! pErr = PP_passwordTooYoung; ! goto return_results; ! } } }

1 0

Re: (ITS#4965) slapd stops if access to cn=monitor is restricted
by ando＠sys-net.it 17 May '07

17 May '07

ali.pouya(a)free.fr wrote: > If I include the monitor back-end in my configuration I have to add the > following access rule as well : > > access to dn.sub="cn=monitor" by * read > > Otherwise slapd stops with the log reproduced below (my access rules include > "access to * by * none"). The problem is already fixed in HEAD: slapd starts, although it cannot register back-bdb monitor stuff unless a roodn is defined in the monitor backend. FFT: maybe the monitor database could have a default rootdn "cn=Monitor", much like the config database? p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: (ITS#4968) acl problem
by ando＠sys-net.it 17 May '07

17 May '07

zeaal_3(a)yahoo.com wrote: > Full_Name: dhiren > Version: 2.2 > OS: fedora4 > URL: > Submission from: (NULL) (203.88.149.100) > > > when i enable following acl , user not able to login client side:- > > access to attrs=userPassword > by self write > by anonymous auth > by * none > > whts problem? when disable this acl user can login. Please direct software usage questions to the openldap-software list; or, just read the first few lines of slapd.conf(5) and find the answer yourself. This ITS will be closed. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

(ITS#4969) globalization missing is com.novell.ldap.resources package
by viral_barot＠persistent.co.in 17 May '07

17 May '07

Full_Name: viral barot Version: 2.3 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (220.225.70.2) It is found that package com.novell.ldap.resources does not include many language files for globalization support. This package contains only english and spanish (ResultCodeMessages.java and ResultCodeMessages_es.java) and other language files are missing. It would be fine if following files are included. ResultCodeMessages_ja.java ResultCodeMessages_ko.java ResultCodeMessages_it.java ResultCodeMessages_fr.java ResultCodeMessages_de.java ResultCodeMessages_pt_BR.java ResultCodeMessages_zh_CN.java ResultCodeMessages_zh_TW.java Thanks.

1 0

(ITS#4968) acl problem
by zeaal_3＠yahoo.com 17 May '07

17 May '07

Full_Name: dhiren Version: 2.2 OS: fedora4 URL: Submission from: (NULL) (203.88.149.100) when i enable following acl , user not able to login client side:- access to attrs=userPassword by self write by anonymous auth by * none whts problem? when disable this acl user can login.

1 0

(ITS#4966) OpenLDAP 2.3.35 crashes on valsort overlay
by digant＠stanford.edu 16 May '07

16 May '07

Full_Name: Digant C Kasundra Version: 2.3.35 OS: Debian 3.1 URL: ftp://ftp.openldap.org/incoming/digant-kasundra-20070516.txt Submission from: (NULL) (171.64.18.9) When modding an entry, valsort seems to have crashed the server. I've uploaded the stack trace and informaiton I was able to gather out of the core dump.

1 0

(ITS#4965) slapd stops if access to cn=monitor is restricted
by ali.pouya＠free.fr 16 May '07

16 May '07

Full_Name: Ali Pouya Version: 2.2.4alpha OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (145.242.3.30) If I include the monitor back-end in my configuration I have to add the following access rule as well : access to dn.sub="cn=monitor" by * read Otherwise slapd stops with the log reproduced below (my access rules include "access to * by * none"). I can send more information if required. Thanks and best regards Ali ============================================= Log extract : >>> dnPretty: <c=fr> => ldap_bv2dn(c=fr,0) <= ldap_bv2dn(c=fr)=0 => ldap_dn2bv(272) <= ldap_dn2bv(c=fr)=0 <<< dnPretty: <c=fr> >>> dnNormalize: <c=fr> => ldap_bv2dn(c=fr,0) <= ldap_bv2dn(c=fr)=0 => ldap_dn2bv(272) <= ldap_dn2bv(c=fr)=0 <<< dnNormalize: <c=fr> end get_filter 0 => monitor_back_search => access_allowed: search access to "cn=Databases,cn=Monitor" "entry" requested => acl_get: [2] attr entry => acl_mask: access to entry "cn=Databases,cn=Monitor", attr "entry" requested => acl_mask: to all values by "", (=0) <= check a_dn_pat: cn=admin,ou=internal,ou=min,o=gouv,c=fr <= check a_dn_pat: cn=connecteur,ou=internal,ou=min,o=gouv,c=fr <= check a_dn_pat: cn=sync,ou=internal,ou=min,o=gouv,c=fr <= check a_dn_pat: ou=applications,ou=external,ou=min,o=gouv,c=fr <= check a_dn_pat: * <= acl_mask: [5] applying none(=0) (stop) <= acl_mask: [5] mask: none(=0) => slap_access_allowed: search access denied by none(=0) => access_allowed: no more rules send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=32 matched="" text="" monitor_back_register_entry_attrs(""): base="cn=databases,cn=monitor" scope=one filter="(namingContexts:distinguishedNameMatch:=c=fr)": unable to find entry ====> bdb_cache_release_all backend_startup_one: bi_db_open failed! (-1) slapd shutdown: initiated ====> bdb_cache_release_all bdb_db_close: alock_close failed slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy.

1 0

← Newer
1
...
6
7
8
9
10
11
12
...
16
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs May 2007