openldap-bugs November 2008

openldap-bugs@openldap.org

44 participants
242 discussions

RE: (ITS#5805) Problem when modifying access control
by emmanuel.duru＠atosorigin.com 18 Nov '08

18 Nov '08

OK, my mistake, here follows a completely detailed description. * I have a slapd.conf as follows -----------------begin slapd.conf include schema/core.schema include schema/cosine.schema include schema/inetorgperson.schema pidfile slapd.pid argsfile slapd.args access to * attrs=userPassword by self write by anonymous auth by * none access to dn=cn=manager,c=fr by self write by * none access to * by self write by users read by anonymous read by * none database bdb suffix "c=fr" rootdn "cn=manager,c=fr" cachesize 20000 checkpoint 10000 10 directory db index objectClass,entryCSN,entryUUID eq index cn,sn eq,sub -----------------end slapd.conf * I convert this slapd.conf to a configdb: slapd -f slapd.conf -F configdb * I stop slapd. * I create the initial database with the following LDIF file: -----------------begin initial database dn: c=fr objectClass: country c: fr dn: cn=manager,c=fr objectClass: person cn: manager sn: manager userPassword:: c2VjcmV0 dn: cn=user,c=fr objectClass: person cn: user sn: user userPassword:: dXNlcg== dn: cn=user2,c=fr objectClass: person cn: user2 sn: user2 userPassword:: dXNlcjI= -----------------end initial database slapadd -f configdb -l initialdatabase.ldif * I edit olcDatabase={0}config.ldif file to replace olcRootDN: cn=config by olcRootDN: cn=manager,c=fr * I start slapd slapd -d 256 -F configdb * I try to bind : ldapsearch.exe -x -D cn=manager,c=fr -w secret -s base -b "" objectclass=* + It works fine. * I perform the ldap modifications with this LDIF file: -----------------begin LDAP modifications dn: olcDatabase={-1}frontend,cn=config changetype: modify replace: olcAccess olcAccess: {0}to attrs=userPassword by self write by anonymous auth by * no ne olcAccess: {1}to dn=cn=manager,c=fr by self write by * none olcAccess: {2}to * by self write by users read by anonymous read by * none dn: olcDatabase={0}config,cn=config changetype: modify replace: olcAccess olcAccess: {0}to * by * none -----------------end LDAP modifications ldapmodify -x -D cn=manager,c=fr -w secret -f LDAPmodifications.ldif * I try to bind : ldapsearch.exe -x -D cn=manager,c=fr -w secret -s base -b "" objectclass=* + I get: ldap_bind: Invalid credentials (49) * I stop slapd I get: filter_free: unknown filter type=19008 filter_free: unknown filter type=13304 slapd stopped. filter_free: unknown filter type=13744 filter_free: unknown filter type=1264 filter_free: unknown filter type=13744 filter_free: unknown filter type=1264 and slapd crashes. * I restart slapd * I try to bind : ldapsearch.exe -x -D cn=manager,c=fr -w secret -s base -b "" objectclass=* + It works fine.

1 0

(ITS#5816) back-ldap stops searching if send_search_entry() returns harmless errors (like insufficientAccess)
by ando＠sys-net.it 17 Nov '08

17 Nov '08

Full_Name: Pierangelo Masarati Version: HEAD/re24 OS: irrelevant URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (81.72.89.40) Submitted by: ando To trigger: define acls that block one entry, and the search will stop at that entry. A fix is coming... p.

1 0

Re: (ITS#5640) slapd scans too many objects at startup
by ali.pouya＠free.fr 17 Nov '08

17 Nov '08

Hi Howard, Sorry for being back again but I think that a residue of the problem of whole tree scanning persists : The improvement is that it only happens once if the mirrors are not synchronized (the later statups are OK). I uploaded the new archive file ITS_5640_new.tar.gz to the FTP server (incoming directory). To reproduce the problem y can proceed as explained in folowwup 9. Thanks Best Regards Ali

1 0

Re: (ITS#5796) back-sql intermittently failing
by robb＠wtg.cw.com 17 Nov '08

17 Nov '08

Pierangelo Masarati wrote: > OK, this makes sense. In fact, back-sql does not seem to specifically > handle broken connections to the odbc. It appears it would need > something similar to idle-timeout as in back-ldap and back-meta. current work-around is to set "idletimeout" in openldap shorter than mysql's "wait_timeout" (default 8hrs).

1 0

Re: (ITS#5805) Problem when modifying access control
by ando＠sys-net.it 17 Nov '08

17 Nov '08

emmanuel.duru(a)atosorigin.com wrote: > I'm sorry, but I don't. > cn=manager,c=fr was already the rootdn of config database (as well as rootdn > of c=fr database) before doing the test, with no rootpw in the config > database. > My first test consisted in modifying both olcAccess and olcRootDn for all > databases (if present) without changing any value (replacing the existing > values with the same ones). Then I made another test, with olcAccess > modifications only (on both frontend and config databases), and the problem > still appears. It only appears if I modify olcAccess of both databases, and > in this order: frontend then config. Well, I simply followed what you described in your bug report (at least what I understood). Next time, please provide a full featured script that fires up slapd and performs the offending writes. I'll change "cannot reproduce" to "report obscure". p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

RE: (ITS#5805) Problem when modifying access control
by h.b.furuseth＠usit.uio.no 17 Nov '08

17 Nov '08

Please post your configuration (minus any passwords) so it's possible to test what you are doing. Makes for less guesswork too. -- Hallvard

1 0

RE: (ITS#5805) Problem when modifying access control
by emmanuel.duru＠atosorigin.com 17 Nov '08

17 Nov '08

I'm sorry, but I don't. cn=manager,c=fr was already the rootdn of config database (as well as rootdn of c=fr database) before doing the test, with no rootpw in the config database. My first test consisted in modifying both olcAccess and olcRootDn for all databases (if present) without changing any value (replacing the existing values with the same ones). Then I made another test, with olcAccess modifications only (on both frontend and config databases), and the problem still appears. It only appears if I modify olcAccess of both databases, and in this order: frontend then config. > > You do, since you modify the configuration using the cn=config rootdn in > order to modify itself, and set it to cn=manager,c=fr. So in the first > place you had a rootdn in cn=config, with a rootpw. And the > modification you posted did not remove the rootpw.

1 0

Re: (ITS#5805) Problem when modifying access control
by ando＠sys-net.it 17 Nov '08

17 Nov '08

emmanuel.duru(a)atosorigin.com wrote: >> Emmanuel Duru wrote: >>> I wouldn't say that it is harmless. >> I'm not saying your problem is harmless. I'm saying that having a >> rootdn of cn=config that is not within cn=config but with the rootpw is >> a violation of slapd's configuration rules (when the rootdn is not >> within the naming context, it cannot have a rootpw set). >> > > But I don't. > My rootdn is cn=manager,c=fr which is a real entry in the c=fr database > (bdb) with the password in the entry and no rootpw neither in c=fr nor in > cn=config. You do, since you modify the configuration using the cn=config rootdn in order to modify itself, and set it to cn=manager,c=fr. So in the first place you had a rootdn in cn=config, with a rootpw. And the modification you posted did not remove the rootpw. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

RE: (ITS#5805) Problem when modifying access control
by emmanuel.duru＠atosorigin.com 17 Nov '08

17 Nov '08

> Emmanuel Duru wrote: > > I wouldn't say that it is harmless. > > I'm not saying your problem is harmless. I'm saying that having a > rootdn of cn=config that is not within cn=config but with the rootpw is > a violation of slapd's configuration rules (when the rootdn is not > within the naming context, it cannot have a rootpw set). > But I don't. My rootdn is cn=manager,c=fr which is a real entry in the c=fr database (bdb) with the password in the entry and no rootpw neither in c=fr nor in cn=config.

1 0

Re: (ITS#5805) Problem when modifying access control
by ando＠sys-net.it 17 Nov '08

17 Nov '08

Emmanuel Duru wrote: > I wouldn't say that it is harmless. I'm not saying your problem is harmless. I'm saying that having a rootdn of cn=config that is not within cn=config but with the rootpw is a violation of slapd's configuration rules (when the rootdn is not within the naming context, it cannot have a rootpw set). > To sum up, the problem is that when I modify frontend access control and > then config access control (olcAccess attribute in both cases), I can not > bind any more (neither with rootdn nor with any other dn). > Concerning further releases, I will try later. Maybe I will wait for the > 2.4.13... Fine. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

← Newer
1
...
8
9
10
11
12
13
14
...
25
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs November 2008