openldap-bugs February 2011

openldap-bugs@openldap.org

35 participants
158 discussions

Re: (ITS#6115) gdi32.lib required by OpenSSL+Windows
by hyc＠symas.com 16 Feb '11

16 Feb '11

slapd(a)hannebauer.name wrote: > Full_Name: Christoph Hannebauer > Version: 2.4.16 > OS: Windows/cygwin > URL: http://www.hannebauer.name/openldap-openssl/configure.in.patch > Submission from: (NULL) (139.18.40.169) > > > I tried to use OpenSSL 0.9.8k for TLS in my cygwin (target MinGW) OpenLDAP > build. The configure script does not detect OpenSSL (however, it doesn't break, > instead it finishes without TLS support), because the static library cannot be > linked. The config.log file contains error messages like > > /usr/local/mingw/lib/libcrypto.a(rand_win.o):rand_win.c:(.text+0xa0c): undefined > reference to `_CreateDCA@16' > > The missing functions are part of the library gdi32.lib. The OpenSSL readme file > INSTALL.W32 says, that Windows program using OpenSSL should link gdi32.lib (and > user32.lib, ..., but on my machine, gdi32.lib seems to be sufficient). Therefore > I have created the attached patch file to configure.in (1.697), which adds > gdi32.lib to LIBS, if it is required for OpenSSL. I have tested the patched > configure file on my machine, the build works without problems. You should simply add -lgdi32 to LIBS when running configure then, as documented in the INSTALL file. We add some platform-specific flags but we don't add site-specific flags to configure itself, and your problem depends on whether OpenSSL is using static or shared libraries on your installation. I.e., this issue is not generic to the Win32 platform. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6740) syncrepl/--disable-rewrite dependency
by hyc＠symas.com 16 Feb '11

16 Feb '11

h.b.furuseth(a)usit.uio.no wrote: > Full_Name: Hallvard B Furuseth > Version: HEAD > OS: > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (129.240.6.233) > Submitted by: hallvard > > > configure should mention syncrepl here: > --enable-rewrite enable DN rewriting in back-ldap and rwm overlay > > test059-slave-config fails with --disable-rewrite. Testrun/test.out says > parse_syncrepl_line: > unable to parse "suffixmassage=cn=schema,cn=config,cn=slave" > > Ando wrote: >> What's special about DN rewriting so it has a configure option >> anyway? It doesn't disable building of libraries/librewrite. > > It used to, as far as I remember. I remember something about performing > simple suffixmassage when librewrite is not built. In any case I agree > that given the widespread usage of rewrite capabilities (authz regexp, for > example) not building librewrite is somehow pointless. Agreed. I'm fine with dropping this configure switch and unifdef'ing it so that librewrite is always used. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

ITS#6512 BDB 5.0
by hyc＠symas.com 16 Feb '11

16 Feb '11

This was resolved by ITS#6698, support for BDB 5.x was released in 2.4.24. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6834) Conversion to cn=config needs more detail
by hyc＠symas.com 16 Feb '11

16 Feb '11

andrew.findlay(a)skills-1st.co.uk wrote: > On Wed, Feb 16, 2011 at 11:50:21AM +0000, Andrew Findlay wrote: > >> Admin Guide Section 5.4. "Converting old style slapd.conf(5) file to cn=config >> format" suggests that it is enough to run a slapd tool with both -f and -F >> options to perform this conversion. While strictly true, this will almost >> certainly result in an un-manageable server because there is no rootPW set for >> cn=config. >> >> The attached patch provides guidance to avoid this trap. > > It would also be useful to copy the config database clause from > slapd-config(5) into the example in the Admin Guide: > > # set a rootpw for the config database so we can bind. > # deny access to everyone else. > dn: olcDatabase=config,cn=config > objectClass: olcDatabaseConfig > olcDatabase: config > olcRootPW: {SSHA}XKYnrjvGT3wZFQrDD5040US592LxsdLy > olcAccess: to * by * none That ACL is already the default. In an isolated example there's no need to specify it. (It is present in the slapd-config(5) example to ensure that it takes precedence over the olcFrontendConfig ACLs immediately above it.) -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6833) LDAP hangs on Solaris
by tombolala＠gmx.de 16 Feb '11

16 Feb '11

Hi Quanah! sorry for the wrong release, I meant 2.4.22 of course. /Thomas -------- Original-Nachricht -------- > Datum: Wed, 16 Feb 2011 16:34:39 GMT > Von: quanah(a)zimbra.com > An: openldap-its(a)openldap.org > Betreff: Re: (ITS#6833) LDAP hangs on Solaris > --On Wednesday, February 16, 2011 11:37 AM +0000 tombolala(a)gmx.de wrote: > > > Full_Name: Thomas Bopp > > Version: 4.2.22 > > > I really need a solution for this problem. > > I suggest you list an actual OpenLDAP release. It's near impossible to > help you without that. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > > -- Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de

1 0

(ITS#6835) extend pwFailureTime timestamp to microsecond resolution to improve pwdMaxFailure enforcement
by brian-ldap＠starvingprogrammer.com 16 Feb '11

16 Feb '11

Full_Name: Brian Wasserman Version: 2.4.21-0ubuntu5.3 OS: Ubuntu 10.04 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (198.151.13.15) More than pwdMaxFailure attempts can be made before locking out an account if multiple attempts are made within the same second since it'll only log one pwdFailureTime per second. This is because the timestamp is stored in second resolution. Changing this timestamp to use microsecond resolution should minimize this limitation. In order to reproduce the problem by exceeding the number of max failures configured, just attempt to bind to a server with the policy below (or similar) multiple times per second with a valid user and observer the number of pwdFailureTime entries that are added to the given account. The account is locked after three pwdFailureTime entries are added, regardless of the number of actual attempts. Here's my policy configuration: dn: cn=Standard,ou=Policies,dc=local,dc=com cn: Standard description: Standard password policy. pwdAttribute: userPassword pwdCheckQuality: 1 pwdLockout: TRUE pwdMustChange: TRUE pwdAllowUserChange: TRUE pwdSafeModify: TRUE objectClass: device objectClass: pwdPolicy pwdInHistory: 3 pwdMaxFailure: 3 pwdMinLength: 8 pwdMaxAge: 7776000 pwdMinAge: 86400

1 0

sortvals oddity
by Andrew Elble 16 Feb '11

16 Feb '11

I've run into the following issue while trying to track down why we are occasionally seeing duplicate members/memberUids in our groups: Set the server up for "sortvals memberUid". Add a posixGroup without any memberUid attributes present. Adding new memberUid attributes to the group afterwards will result in them being unsorted until server restart. I'm shooting from the hip here - shouldn't attr_merge() (in attr.c) have something like the following? if ( *a == NULL ) { *a = attr_alloc( desc ); if (desc->ad_type->sat_flags & SLAP_AT_SORTED_VAL) { (*a)->a_flags |= SLAP_ATTR_SORTED_VALS; } } else { Thanks, Andy -- Andrew W. Elble aweits(a)discipline.rit.edu Infrastructure Engineer, Communications Technical Lead Rochester Institute of Technology PGP: BFAD 8461 4CCF DC95 DA2C B0EB 965B 082E 863E C912 CONFIDENTIALITY NOTE: The information transmitted, including attachments, is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and destroy any copies of this information.

2 1

Re: (ITS#6833) LDAP hangs on Solaris
by quanah＠zimbra.com 16 Feb '11

16 Feb '11

--On Wednesday, February 16, 2011 11:37 AM +0000 tombolala(a)gmx.de wrote: > Full_Name: Thomas Bopp > Version: 4.2.22 > I really need a solution for this problem. I suggest you list an actual OpenLDAP release. It's near impossible to help you without that. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#6834) Conversion to cn=config needs more detail
by andrew.findlay＠skills-1st.co.uk 16 Feb '11

16 Feb '11

On Wed, Feb 16, 2011 at 11:50:21AM +0000, Andrew Findlay wrote: > Admin Guide Section 5.4. "Converting old style slapd.conf(5) file to cn=config > format" suggests that it is enough to run a slapd tool with both -f and -F > options to perform this conversion. While strictly true, this will almost > certainly result in an un-manageable server because there is no rootPW set for > cn=config. > > The attached patch provides guidance to avoid this trap. It would also be useful to copy the config database clause from slapd-config(5) into the example in the Admin Guide: # set a rootpw for the config database so we can bind. # deny access to everyone else. dn: olcDatabase=config,cn=config objectClass: olcDatabaseConfig olcDatabase: config olcRootPW: {SSHA}XKYnrjvGT3wZFQrDD5040US592LxsdLy olcAccess: to * by * none Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

(ITS#6834) Conversion to cn=config needs more detail
by andrew.findlay＠skills-1st.co.uk 16 Feb '11

16 Feb '11

Full_Name: Andrew Findlay Version: 2.4.24 OS: OpenSuSE 11.3 URL: ftp://ftp.openldap.org/incoming/afindlay-slapdconf2.sdf.20110216.diff Submission from: (NULL) (88.97.25.132) Admin Guide Section 5.4. "Converting old style slapd.conf(5) file to cn=config format" suggests that it is enough to run a slapd tool with both -f and -F options to perform this conversion. While strictly true, this will almost certainly result in an un-manageable server because there is no rootPW set for cn=config. The attached patch provides guidance to avoid this trap.

1 0

← Newer
1
...
4
5
6
7
8
9
10
...
16
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs February 2011