openldap-bugs November 2015

openldap-bugs@openldap.org

25 participants
61 discussions

Re: (ITS#8317) Problem with "force user to password reset at first login"
by quanah＠zimbra.com 20 Nov '15

20 Nov '15

--On Friday, November 20, 2015 7:18 AM +0000 rajagopal.rc(a)tcs.com wrote: > Please help me configure the option to force all users to change their > password at first login or after pwd reset by administrator. The ITS system is for bug reports, not usage questions. Usage questions should be directed to the openldap-technical(a)openldap.org mailing list. This ITS will be closed. --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#8318) Add RECNUM support in LMDB
by lkrispen＠redhat.com 20 Nov '15

20 Nov '15

Full_Name: Ludwig Krispenz Version: 2.4.5 OS: Fedora22 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (79.203.101.97) In BDB the btree databases did also allow RECNUM access, allowing to access and cursor through the btree. LMDB does not include this feature, but for migrating existing deployments from BDB to LMDB this would be helpful. Discussing this with Howard Chu at LDAPCone susuggested to create this issue to get the request evaluated and implemented

1 0

(ITS#8317) Problem with "force user to password reset at first login"
by rajagopal.rc＠tcs.com 19 Nov '15

19 Nov '15

Full_Name: Rajagopal Version: openldap-2.4.39-7.el7_1.x86_64 OS: RHEL7 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (121.242.29.87) Hi, I am trying to force users to change their password at first login or after password reset by administrator. Tried following: 1)Password policy 'pwdMustChange TRUE' doesn't seems to be working as non of the users get prompt to change their password at first login. 2) used the 'pwdReset TRUE' attribute in users attributes, and it won't prompt to change the password and didn't allow to login i observe below messages in log "slapd[12684]: connection restricted to password changing only slapd[12684]: send_ldap_result: err=50 matched="" text="Operations are restricted to bind/unbind/abandon/StartTLS/modify password" slapd[12684]: conn=1053 op=1 SEARCH RESULT tag=101 err=50 nentries=0 text=Operations are restricted to bind/unbind/abandon/StartTLS/modify password" Please help me configure the option to force all users to change their password at first login or after pwd reset by administrator. Thanks & Regards Rajagopal

1 0

Re: (ITS#7992) lmdb: Windows: assume file paths are UTF-8, encode to UTF-16 for WinAPI and enable compiling when UNICODE is defined
by hyc＠symas.com 19 Nov '15

19 Nov '15

oskari.timperi(a)iki.fi wrote: > Full_Name: Oskari Timperi > Version: > OS: Windows 7 > URL: ftp://ftp.openldap.org/incoming/oskari-timperi-141205.zip > Submission from: (NULL) (109.204.204.106) > > > The patches make some changes so that compiling lmdb when UNICODE is defined is > possible. This is achieved by using the A-versions of WinApi functions where > they are needed. Thanks, this part of the patch was done in merging ITS#8069. > > Also use CreateFileW to open files so that one can use exotic characters in > paths. The library interface is not modified, but the code makes an assumption > that paths passed to lmdb functions are encoded as UTF-8. The UTF-8 encoded > paths are encoded to UTF-16 which is then passed to CreateFileW. This patch is now in git mdb.master. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8316) Broken cursor after mdb_cursor_del()
by h.b.furuseth＠usit.uio.no 19 Nov '15

19 Nov '15

Full_Name: Hallvard B Furuseth Version: mdb.master, a98b74e6df6fdb9dbc29d44fe2879f96191d8904 OS: Linux x86_64 URL: ftp://ftp.openldap.org/incoming/Hallvard-Furuseth-151119.c Submission from: (NULL) (2001:700:100:202::105) Submitted by: hallvard The test program does not find V(4) with the cursor which did mdb_cursor_del(). It does find it with the unused cursor. Broken by fca18d2586259c0e802d "ITS#7829 more for prev commit".

1 0

(ITS#8315) assert in commit(nested txn)
by h.b.furuseth＠usit.uio.no 18 Nov '15

18 Nov '15

Full_Name: Hallvard B Furuseth Version: mdb.master, f08b70d0df323ccb33b94a648e9a1b6efd718cae OS: Linux x86_64 URL: ftp://ftp.openldap.org/incoming/Hallvard-Furuseth-151118-3.c Submission from: (NULL) (81.191.45.31) Submitted by: hallvard commit(nested txn) will sometimes hit mdb.c:3528:mdb_tassert(txn, i == x). A fix is to drop the optimization /* Simplify the above for single-ancestor case */ and always use the "if (parent->mt_parent)" branch. Don't know yet if that just hides the symptom though. To reproduce: gcc -pthread -g -I. Hallvard-Furuseth-151118-3.c rm -f testdb/*; ./a.out -r313873253

1 0

Re: (ITS#8313) crash in mdb_rebalance(): uninited cursor flags
by h.b.furuseth＠usit.uio.no 18 Nov '15

18 Nov '15

On 18. nov. 2015 12:07, h.b.furuseth(a)usit.uio.no wrote: > The test program can crash dereferencing mp==NULL at > mdb_cursor_del0() line 8244 "nkeys = NUMKEYS(mp);" Broken by 8bdadf68c580 "ITS#8258 fix rebalance/split". (It broke differently in LMDB 0.9.16. Assertion NUMKEYS(mp)>1, fixed by d84fae3fe31c "ITS#8237 fix ITS#7589 regression".) -- Hallvard

1 0

Re: (ITS#8312) LMDB corruption, perhaps in freelist code
by martin＠bzero.se 18 Nov '15

18 Nov '15

On 2015-11-18 16:32, Hallvard Breien Furuseth wrote: > On 18. nov. 2015 11:51, martin(a)bzero.se wrote: >> Please find linked a test program (replay.c) that consistently fails on >> my centos 7 system. It parses captured commands from a text file. > > Fixed in mdb.master. Please test. Thanks, this resolves my issues.

1 0

Re: (ITS#8312) LMDB corruption, perhaps in freelist code
by h.b.furuseth＠usit.uio.no 18 Nov '15

18 Nov '15

On 18. nov. 2015 11:51, martin(a)bzero.se wrote: > Please find linked a test program (replay.c) that consistently fails on > my centos 7 system. It parses captured commands from a text file. Fixed in mdb.master. Please test. -- Hallvard

1 0

(ITS#8314) ldap_back_is_proxy_authz returned 0 - misconfigured uri? - Maybe a Bug?
by dominique.voest＠neclab.eu 18 Nov '15

18 Nov '15

Full_Name: Dominique V.st Version: 2.4.40 OS: Debian,CentOS,BSDs URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (195.37.70.39) Hi everyone, I installed a new OpenLDAP Server (Debian Jessy) (OpenLDAP Version 2.4.40) which is used to proxy parts of the Active Directory. However, from time to time it is not able to get Entries (does not answer to querys but returns success) from the Active Directory. What I see in the logs is the following: Jun 10 11:37:38 openldap-proxy slapd[41657]: conn=1166 op=1 ldap_back_retry: retrying URI="ldaps://dc.ourdomain.com" DN="cn=ldap-binder,ou=serviceaccounts,dc= ourdomain,dc=com" Jun 10 11:37:38 openldap-proxy slapd[41657]: Error: ldap_back_is_proxy_authz returned 0, misconfigured URI? First of all, the URI is correct and the System works well during most of the time(except for this error), those errors only happen from time to time. The Strange thing is, that this new LDAP Server is running via the exactly same configuration as another OpenLDAP-Server which has been running over 2 Years now and the old OpenLDAP Server (Debian Wheezy) (OpenLDAP Version 2.4.31) does also show the first Log Entry from time to time (the ldap_back_retry one), But does not show the ldap_back_is_proxy_authz error afterwards. Furthermore it does also always return the right answer. For Debugging reasons I tried Wiresharking the Domain Controller, TCP-Dumping the LDAP-Server and the Client. The Traffic looks okay, in case of that error the OpenLDAP Server simply is asking the Domain Controller which returns Success but no results. Since once this error occurs, the query right after the error works and then it takes some time until that error occurs again and due to the fact that in the older OpenLDAP Version it is working, could it be a Bug in the new OpenLDAP Version? I also looked in the Logs of the Domain Controller, everything is fine there. Furthermore I installed test OpenLDAP Systems (Centos[yum], OpenBSD[pkg] and one via compilation from sources via minimal module configuration) (2.4.40) and tried the same configuration there, same Problem. While googling and searching for a solution I stumbled across a guy having the same problem, reporting this 2013 to this mailing list. Someone suggested to add the Active Directory Schema to the OpenLDAP, which I did andhihich did not solve this issue. I tried adding the full schema as well as adding only Attributes and Object classes that are used. Problem still persists. After looking into the code of the bind.c and the commits in the ldap-back Module I saw a change of the code lines in servers/slapd/back-ldap/bind.c (around line 1407): rc = ldap_back_is_proxy_authz( op, rs, LDAP_BACK_DONTSEND, &binddn, &bindcred ); - assert( rc == 1 ); + if ( rc != 1 ) { + Debug( LDAP_DEBUG_ANY, "Error: ldap_back_is_proxy_authz " + "returned %d, misconfigured URI?\n", rc, 0, 0 ); + rs->sr_err = LDAP_OTHER; + rs->sr_text = "misconfigured URI?"; + LDAP_BACK_CONN_ISBOUND_CLEAR( lc ); + if ( sendok & LDAP_BACK_SENDERR ) { + send_ldap_result( op, rs %;%B + } + goto done; + } } rc = ldap_back_proxy_authz_bind( lc, op, rs, sendok, &binddn, &bindcred ); goto done; Diff: http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blobdiff;f=server… Is it intended that there is a call to goto done? Which obviously prevents the ldap_back_proxy_autzh_bind to happen ? - Since in older Versions of OpenLDAP it works. Best Regards, Dominique Voest

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs November 2015