openldap-bugs July 2008

openldap-bugs@openldap.org

43 participants
131 discussions

Re: (ITS#5584)
by abartlet＠samba.org 15 Jul '08

15 Jul '08

--=-OCQI7+YC0WINty5M6nQu Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Tue, 2008-07-01 at 02:49 -0700, Howard Chu wrote: > abartlet(a)samba.org wrote: > > --=3D-GddVbqVLc61XV3X/kWQ/ > > Content-Type: text/plain > > Content-Transfer-Encoding: quoted-printable > > > > I've uploaded the patch to http://abartlet.net/memberof.patch >=20 > I committed a different patch to HEAD. Please test. I just wanted to note that I have looked at this, but it seems that some other change in the meantime has meant that the invalid DN check is missed - in setting member attributes (I doubt it was ever intentional, but it allowed the test to proceed to this point). I may have to write a validation module on the Samba side for this, until we get this validation in OpenLDAP. Andrew Bartlett --=20 Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. http://redhat.com --=-OCQI7+YC0WINty5M6nQu Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQBIfJXiz4A8Wyi0NrsRAtHRAJ9fY0s6fkAI0I8OmcQUL6NeHxPuFQCglAQT TlftIPNYEIqc1o1j31dgNF0= =qwa/ -----END PGP SIGNATURE----- --=-OCQI7+YC0WINty5M6nQu--

1 0

Re: (ITS#5612) Contributing An Overlay which Submits Modification in LDAP to a Web-Page!
by michael＠stroeder.com 15 Jul '08

15 Jul '08

fawadlateef(a)gmail.com wrote: > > By looking at RFC4533 AND slapo-accesslog I __don't__ think they can > be used against what my contributed overlay can do. Judging from your description using syncrepl is __exactly__ what you need. Especially since some HTTP requests might get lost. > Now the thing is: in our case, the web-page is not used to display > modifications to users or on the browser __rather__ it perform some > operations on other enterprise applications based on the event > triggered from LDAP overlay hence polling kind of mechanism can't work > for us. Use syncrepl's refreshAndPersist mode. Also write your sync component in such a fashion that if connection is down for some times you can catch up with changes happened in between. Ciao, Michael.

1 0

Re: (ITS#5612) Contributing An Overlay which Submits Modification in LDAP to a Web-Page!
by fawadlateef＠gmail.com 15 Jul '08

15 Jul '08

Thanks for your replies. By looking at RFC4533 AND slapo-accesslog I __don't__ think they can be used against what my contributed overlay can do. The overlay actually monitors add/delete/modify operations based on attributes/dn/classobject and if they matches it triggers event to the URL (like interrupt). Now the thing is: in our case, the web-page is not used to display modifications to users or on the browser __rather__ it perform some operations on other enterprise applications based on the event triggered from LDAP overlay hence polling kind of mechanism can't work for us. We are going to use this overlay in our open-source-product "Zivios - Open Source Enterprise Management". Zivios will be used for management of all enterprise applications (like OpenLDAP, Kerberos, Mail-Server, Network Time Server etc) from a single web-based panel, so all modifications done through Zivios on LDAP will be made/reflected on other applications/servers at the same time. Now if somebody perform some operation on OpenLDAP directly (means by skipping Zivios) then Zivios should be triggered for such a change and then it can act on other servers accordingly. Thus event received by Zivios is __not__ for displaying data; rather its for doing some background processing although this overlay can be used to display LDAP operations on web too. Please suggest me someother way which can work on scenario mentioned above if my overlay isn't good enough. Let me know if overlay name or description isn't clear and is creating misundestanding about the functionality of the overlay. -- Fawad Lateef

1 0

Re: (ITS#5614) Ignore invalid search filters
by ando＠sys-net.it 14 Jul '08

14 Jul '08

hyc(a)symas.com wrote: > I don't think ldap_munge_filter() is adequate any more. Note that filter2bv > doesn't use (?=undefined) for unknown attributeTypes or illegal values any > more, it uses (?<attr>=<value>). This change was made to allow the log > messages to show what the actual offending values were. A better strategy here > may be to walk the Filter tree and look for > (f->f_choice&SLAPD_FILTER_UNDEFINED) before making the search request, so that > no retries are needed. That's what the new patch does, for example, for back-meta. However, we still need somehow to "unparse" the filter to allow those substitutions the proxy must honor, like "(?=true)", "(?=false)". p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5614) Ignore invalid search filters
by hyc＠symas.com 14 Jul '08

14 Jul '08

ando(a)sys-net.it wrote: > andrew.graham(a)agustawestland.com wrote: > >> In line with the behavious specified in ITS 3785, any invalid search filter >> applied against back-meta will force a query including the search filter >> (!(objectClass=*)). As this filter can result in slow performance for certain >> brands of LDAP server, please provide an option to ignore invalid search filters >> in back-meta. > > A patch is in HEAD for back-ldap& back-meta. Use the "noundeffilter > {true|FALSE}" statement. Please test. p. I don't think ldap_munge_filter() is adequate any more. Note that filter2bv doesn't use (?=undefined) for unknown attributeTypes or illegal values any more, it uses (?<attr>=<value>). This change was made to allow the log messages to show what the actual offending values were. A better strategy here may be to walk the Filter tree and look for (f->f_choice&SLAPD_FILTER_UNDEFINED) before making the search request, so that no retries are needed. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5612) Contributing An Overlay which Submits Modification in LDAP to a Web-Page!
by quanah＠zimbra.com 14 Jul '08

14 Jul '08

--On Monday, July 14, 2008 9:04 PM +0000 hyc(a)symas.com wrote: > ando(a)sys-net.it wrote: >> fawadlateef(a)gmail.com wrote: >> >>> Contributing an overlay which submits modification in LDAP to a >>> web-page through libcurl. >> >> Thanks for the contribution. Without having looked too much into the >> solution you designed, however, I believe you moved too much effort at >> the DSA side. An alternative approach to your problem consists in using >> the RFC4533 LDAP Sync to design a client that is persistently returned >> any change in data matching a search request, letting the client adapt >> the results into the desired form for the web page. The client could be >> easily embedded in a web server, e.g. using the scripting capabilities >> that most web servers have, or even coded using those scripting >> capabilities, provide they support the capability to implement the LDAP >> extensions used by RFC 4533. > > Actually, even without RFC4533, all that's needed is to use > slapo-accesslog and let the web server query the log DB whenever a user > accesses the page. -- Along Pierangelo's answer, I'll note that Net::LDAPapi perl module can be an LDAP sync client, and thus used to drive any number of things based off changes made to an accesslog DB. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#5612) Contributing An Overlay which Submits Modification in LDAP to a Web-Page!
by hyc＠symas.com 14 Jul '08

14 Jul '08

ando(a)sys-net.it wrote: > fawadlateef(a)gmail.com wrote: > >> Contributing an overlay which submits modification in LDAP to a web-page through >> libcurl. > > Thanks for the contribution. Without having looked too much into the > solution you designed, however, I believe you moved too much effort at > the DSA side. An alternative approach to your problem consists in using > the RFC4533 LDAP Sync to design a client that is persistently returned > any change in data matching a search request, letting the client adapt > the results into the desired form for the web page. The client could be > easily embedded in a web server, e.g. using the scripting capabilities > that most web servers have, or even coded using those scripting > capabilities, provide they support the capability to implement the LDAP > extensions used by RFC 4533. Actually, even without RFC4533, all that's needed is to use slapo-accesslog and let the web server query the log DB whenever a user accesses the page. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5614) Ignore invalid search filters
by ando＠sys-net.it 14 Jul '08

14 Jul '08

andrew.graham(a)agustawestland.com wrote: > In line with the behavious specified in ITS 3785, any invalid search filter > applied against back-meta will force a query including the search filter > (!(objectClass=*)). As this filter can result in slow performance for certain > brands of LDAP server, please provide an option to ignore invalid search filters > in back-meta. A patch is in HEAD for back-ldap & back-meta. Use the "noundeffilter {true|FALSE}" statement. Please test. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5612) Contributing An Overlay which Submits Modification in LDAP to a Web-Page!
by ando＠sys-net.it 14 Jul '08

14 Jul '08

fawadlateef(a)gmail.com wrote: > Contributing an overlay which submits modification in LDAP to a web-page through > libcurl. Thanks for the contribution. Without having looked too much into the solution you designed, however, I believe you moved too much effort at the DSA side. An alternative approach to your problem consists in using the RFC4533 LDAP Sync to design a client that is persistently returned any change in data matching a search request, letting the client adapt the results into the desired form for the web page. The client could be easily embedded in a web server, e.g. using the scripting capabilities that most web servers have, or even coded using those scripting capabilities, provide they support the capability to implement the LDAP extensions used by RFC 4533. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5592) Quarantine in back-meta
by andrew.graham＠agustawestland.com 14 Jul '08

14 Jul '08

*** Before acting on this email or opening any attachment you are advised to read the disclaimer at the end of this email *** I patched the changes into 2.4.10, quarantine now works perfectly. Thanks for yet another speedy response! Drew Andrew Graham AgustaWestland UK andrew.graham(a)agustawestland.com >>> <ando(a)sys-net.it> 12/07/2008 14:23 >>> andrew.graham(a)agustawestland.com wrote: > The quarantine function in back-meta will permanently disable a target if a > query is received while the quarantine has been imposed. Fixed in HEAD; please test. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: ando(a)sys-net.it ----------------------------------- *** Disclaimer *** The information contained in this E-Mail and any subsequent correspondence may be subject to the Export Control Act (ECA) 2002. The content is private and is intended solely for the recipient(s). For those other than the recipient any disclosure, copying, distribution, or action taken, or omitted to be taken, in reliance on such information is prohibited and may be unlawful. If received in error please return to sender immediately. Under the laws of England misuse of information that is subject to the ECA 2002, is a criminal offence. Westland Helicopters Ltd Lysander Road Yeovil BA20 2YB England Registered in England under No 604352

1 0

← Newer
1
2
3
4
5
6
7
8
...
14
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs July 2008