openldap-bugs March 2019

openldap-bugs@openldap.org

16 participants
40 discussions

(ITS#9000) memberOf value is lost when group DN is modified with only case change
by clement.oudot＠worteks.com 28 Mar '19

28 Mar '19

Full_Name: Clement OUDOT Version: 2.4.47 OS: GNU/Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (81.250.130.213) We use a very standard configuration with memberof overlay. The issue is very easy to reproduce : * Create a group with a user in an OpenLDAP server using memberof overlay * The user should now have the group DN in memberOf attribute * Rename the group to change its case, for example uppercase the first letter * The group has be renamed but was removed form user memberOf attribute The OpenLDAP log is the following: 5c9ba447 conn=1000 op=23 MODRDN dn="cn=memberoftest,ou=groups,dc=example,dc=com" 5c9ba447 conn=1000 op=23: memberof_value_modify DN="uid=coudot,ou=users,dc=example,dc=com" add memberOf="cn=memberofTEST,ou=groups,dc=example,dc=com" failed err=20 Seems it is because memberof try to add the new value before deleting the old one. As the values are the same when ignoring the case, the modification is rejected. I would say that doing the LDAP_SLIST_REMOVE before the LDAP_SLIST_INSERT_HEAD in memberof.c should be enough but I don't know if this is safe.

1 0

Re: (ITS#8999) telephoneNumberMatch crashed slapd
by hyc＠symas.com 26 Mar '19

26 Mar '19

thomassiegmund(a)gmx.de wrote: > Full_Name: Thomas Siegmund > Version: 2.4.47 > OS: OpenBSD > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (2a02:8106:22a:4b02:e76f:90a1:5b27:161e) > > > When importing/saving the following certificate as a userCertificate;binary, > slapd crashes when calling dnX509Normalize. > > Files: > telephoneNumberMatch.der > telephoneNumberMatch.ldif > telephoneNumberMatch.llog > > Thanks for the report. Fixed now in git master. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8999) telephoneNumberMatch crashed slapd
by thomassiegmund＠gmx.de 26 Mar '19

26 Mar '19

Full_Name: Thomas Siegmund Version: 2.4.47 OS: OpenBSD URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (2a02:8106:22a:4b02:e76f:90a1:5b27:161e) When importing/saving the following certificate as a userCertificate;binary, slapd crashes when calling dnX509Normalize. Files: telephoneNumberMatch.der telephoneNumberMatch.ldif telephoneNumberMatch.llog

1 0

(ITS#8998) ldapi:// with SASL_NOCANON -> Local error (-2)
by michael＠stroeder.com 26 Mar '19

26 Mar '19

Full_Name: Michael Str.der Version: 2.4.47 OS: openSUSE Tumbleweed URL: Submission from: (NULL) (213.240.182.56) Adding line SASL_NOCANON on to my ~/.ldaprc causes ldapwhoami to fail like this: $ ldapwhoami -H ldapi:// -Y EXTERNAL ldap_sasl_interactive_bind_s: Local error (-2) Using the full LDAPI path name just works as expected: $ ldapwhoami -H ldapi://%2frun%2fslapd%2fldapi -Y EXTERNAL SASL/EXTERNAL authentication started SASL username: gidNumber=1000+uidNumber=1000,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn:cn=michael,dc=example,dc=com

1 0

Re: (ITS#8995) OpenLdap (SyncRepl + Mirror Mode) issue
by quanah＠symas.com 26 Mar '19

26 Mar '19

--On Monday, March 25, 2019 9:51 PM +0530 abhishek negi <abhisheknegi684(a)gmail.com> wrote: > > > Hi Quanah, > > > We tried with 2.4.47 as well. Unfortunately still getting the same issue. You will need to provide the full configurations for each node, minus passwords to look any further. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#8995) OpenLdap (SyncRepl + Mirror Mode) issue
by abhisheknegi684＠gmail.com 26 Mar '19

26 Mar '19

--0000000000008204140584ecc1ed Content-Type: text/plain; charset="UTF-8" Hi Quanah, We tried with 2.4.47 as well. Unfortunately still getting the same issue. Any further suggestions, please support On Mon 25 Mar, 2019, 7:11 PM Quanah Gibson-Mount <quanah(a)symas.com wrote: > --On Monday, March 25, 2019 2:55 PM +0530 abhishek negi > <abhisheknegi684(a)gmail.com> wrote: > > > > > Hi Team, > > > > > > I tried replication with version 2.4.44 and still facing the same issue. > > Can you help me with it. > > I clearly stated to use the latest release, which as of this moment is > 2.4.47. There was a major focus on fixing replication related bugs in the > 2.4.45 and 2.4.46 releases. You need to upgrade further. > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > > --0000000000008204140584ecc1ed Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"auto"><div>Hi Quanah,</div><div dir=3D"auto"><br></div><div dir= =3D"auto">We tried with 2.4.47 as well. Unfortunately still getting the sam= e issue.</div><div dir=3D"auto"><br></div><div dir=3D"auto">Any further sug= gestions, please support<br><br><div class=3D"gmail_quote" dir=3D"auto"><di= v dir=3D"ltr">On Mon 25 Mar, 2019, 7:11 PM Quanah Gibson-Mount <<a href= =3D"mailto:quanah@symas.com">quanah(a)symas.com</a> wrote:<br></div><blockquo= te class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc so= lid;padding-left:1ex">--On Monday, March 25, 2019 2:55 PM +0530 abhishek ne= gi <br> <<a href=3D"mailto:abhisheknegi684@gmail.com" target=3D"_blank" rel=3D"n= oreferrer">abhisheknegi684(a)gmail.com</a>> wrote:<br> <br> ><br> > Hi Team,<br> ><br> ><br> > I tried replication with version 2.4.44 and still facing the same issu= e.<br> > Can you help me with it.<br> <br> I clearly stated to use the latest release, which as of this moment is <br> 2.4.47.=C2=A0 There was a major focus on fixing replication related bugs in= the <br> 2.4.45 and 2.4.46 releases.=C2=A0 You need to upgrade further.<br> <br> --Quanah<br> <br> <br> --<br> <br> Quanah Gibson-Mount<br> Product Architect<br> Symas Corporation<br> Packaged, certified, and supported LDAP solutions powered by OpenLDAP:<br> <<a href=3D"http://www.symas.com" rel=3D"noreferrer noreferrer" target= =3D"_blank">http://www.symas.com</a>><br> <br> </blockquote></div></div></div> --0000000000008204140584ecc1ed--

1 0

Re: (ITS#8995) OpenLdap (SyncRepl + Mirror Mode) issue
by quanah＠symas.com 26 Mar '19

26 Mar '19

--On Monday, March 25, 2019 2:55 PM +0530 abhishek negi <abhisheknegi684(a)gmail.com> wrote: > > Hi Team, > > > I tried replication with version 2.4.44 and still facing the same issue. > Can you help me with it. I clearly stated to use the latest release, which as of this moment is 2.4.47. There was a major focus on fixing replication related bugs in the 2.4.45 and 2.4.46 releases. You need to upgrade further. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#8995) OpenLdap (SyncRepl + Mirror Mode) issue
by abhisheknegi684＠gmail.com 25 Mar '19

25 Mar '19

--000000000000c9eebd0584e6f502 Content-Type: text/plain; charset="UTF-8" Hi Team, I tried replication with version 2.4.44 and still facing the same issue. Can you help me with it. On Tue 19 Mar, 2019, 11:58 PM abhishek negi <abhisheknegi684(a)gmail.com wrote: > Okay. > Thanks for the help and support. > Hope issue gets resolve after upgradation. > > Thanks, > Abhishek > > On Tue 19 Mar, 2019, 11:10 PM Quanah Gibson-Mount <quanah(a)symas.com wrote: > >> --On Tuesday, March 19, 2019 3:33 PM +0530 abhishek negi >> <abhisheknegi684(a)gmail.com> wrote: >> >> > >> > Hi Quanah, >> > >> > >> > If want to replicate Production (DC) site with Recovery (DR) site at >> real >> > time without any time lag which replication,DB and openldap verison >> would >> > be best to implement. >> >> I've already stated you need to upgrade to the current OpenLDAP release. >> I >> do not know how to make that any clearer. Additionally, it would >> literally >> defy physics to have instantaneous replication. There will always be >> some >> amount of delay. >> >> I would generally recommend the current OpenLDAP release using back-mdb >> as >> the database engine and delta-syncrepl using refreshAndPersist. >> >> --Quanah >> >> -- >> >> Quanah Gibson-Mount >> Product Architect >> Symas Corporation >> Packaged, certified, and supported LDAP solutions powered by OpenLDAP: >> <http://www.symas.com> >> >> --000000000000c9eebd0584e6f502 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"auto">Hi Team,<div dir=3D"auto"><br></div><div dir=3D"auto">I t= ried replication with version 2.4.44 and still facing the same issue.</div>= <div dir=3D"auto">Can you help me with it.</div></div><br><div class=3D"gma= il_quote"><div dir=3D"ltr">On Tue 19 Mar, 2019, 11:58 PM abhishek negi <= <a href=3D"mailto:abhisheknegi684@gmail.com">abhisheknegi684(a)gmail.com</a> = wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8e= x;border-left:1px #ccc solid;padding-left:1ex"><div dir=3D"auto"><div>Okay.= </div><div dir=3D"auto">Thanks for the help and support.</div><div dir=3D"a= uto">Hope issue gets resolve after upgradation.</div><div dir=3D"auto"><br>= </div><div dir=3D"auto">Thanks,</div><div dir=3D"auto">Abhishek</div><div d= ir=3D"auto"><br><div class=3D"gmail_quote" dir=3D"auto"><div dir=3D"ltr">On= Tue 19 Mar, 2019, 11:10 PM Quanah Gibson-Mount <<a href=3D"mailto:quana= h(a)symas.com" target=3D"_blank" rel=3D"noreferrer">quanah(a)symas.com</a> wrot= e:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;bo= rder-left:1px #ccc solid;padding-left:1ex">--On Tuesday, March 19, 2019 3:3= 3 PM +0530 abhishek negi <br> <<a href=3D"mailto:abhisheknegi684@gmail.com" rel=3D"noreferrer noreferr= er" target=3D"_blank">abhisheknegi684(a)gmail.com</a>> wrote:<br> <br> ><br> > Hi Quanah,<br> ><br> ><br> > If want to replicate Production (DC) site with Recovery (DR) site at r= eal<br> > time without any time lag which replication,DB and openldap verison wo= uld<br> > be best to implement.<br> <br> I've already stated you need to upgrade to the current OpenLDAP release= .=C2=A0 I <br> do not know how to make that any clearer.=C2=A0 Additionally, it would lite= rally <br> defy physics to have instantaneous replication.=C2=A0 There will always be = some <br> amount of delay.<br> <br> I would generally recommend the current OpenLDAP release using back-mdb as = <br> the database engine and delta-syncrepl using refreshAndPersist.<br> <br> --Quanah<br> <br> --<br> <br> Quanah Gibson-Mount<br> Product Architect<br> Symas Corporation<br> Packaged, certified, and supported LDAP solutions powered by OpenLDAP:<br> <<a href=3D"http://www.symas.com" rel=3D"noreferrer noreferrer noreferre= r" target=3D"_blank">http://www.symas.com</a>><br> <br> </blockquote></div></div></div> </blockquote></div> --000000000000c9eebd0584e6f502--

1 0

Re: (ITS#8997) openldap-nssov/back ldap segfault
by matt＠pallissard.net 22 Mar '19

22 Mar '19

--hs6rsxv3pygoehyq Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On 2019-03-20T22:01:40, Howard Chu wrote: > matt(a)pallissard.net wrote: > > > 2. Turning the log level to 0 /seems/ to make the issue go away. I'll report > > back once I can confirm that. > > That would imply the SEGV is specifically due to a NULL pointer being passed in a Debug message. > If that's true, you should be able to reproduce this using whatever accounts aren't fully populated > with POSIX attributes. > > > A note on this; We do have a good handful of 'service accounts' that don't > > have all of the posix attributes in active directory. As such those entries do > > spam the logs a bit. I have a backtrace I can submit. What's the proper way of doing so? As there is ldap info in it I'd rather not have it publicly accessable. Matt Pallissard --hs6rsxv3pygoehyq Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTvIUMPApUGn6YFkXl1uof+t048SQUCXJQMhgAKCRB1uof+t048 SbqCAQDSEgiivcwR6cztHGogp+hn5+2pikvZ/djpH5XVkRBD7gD9EhqWRSW8QOeY yPjj8smWGuoO+nbF8VIoGm3Mtw4PCA8= =cG48 -----END PGP SIGNATURE----- --hs6rsxv3pygoehyq--

1 0

Re: (ITS#8997) openldap-nssov/back ldap segfault
by hyc＠symas.com 21 Mar '19

21 Mar '19

matt(a)pallissard.net wrote: > 2. Turning the log level to 0 /seems/ to make the issue go away. I'll report > back once I can confirm that. That would imply the SEGV is specifically due to a NULL pointer being passed in a Debug message. If that's true, you should be able to reproduce this using whatever accounts aren't fully populated with POSIX attributes. > A note on this; We do have a good handful of 'service accounts' that don't > have all of the posix attributes in active directory. As such those entries do > spam the logs a bit. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs March 2019