openldap-bugs July 2020

openldap-bugs@openldap.org

2 participants
123 discussions

[Issue 9302] New: ppolicy pwdFailureTime race condition leaves acccount unlocked, violating pwdLockout policy
by openldap-its＠openldap.org 03 Sep '20

03 Sep '20

https://bugs.openldap.org/show_bug.cgi?id=9302 Issue ID: 9302 Summary: ppolicy pwdFailureTime race condition leaves acccount unlocked, violating pwdLockout policy Product: OpenLDAP Version: 2.4.50 Hardware: All OS: All Status: UNCONFIRMED Severity: normal Priority: --- Component: overlays Assignee: bugs(a)openldap.org Reporter: requate(a)univention.de Target Milestone: --- Multiple concurrent ldap binds with invalid passwords against a user account sometimes don't trigger account lockout, even though the number of failed attempts exceeds the configured pwdLockout policy of the ppolicy overlay. How to reproduce: 1. Configure ppolicy overlay with pwdLockout: TRUE 2. set pwdMaxFailure to some value, e.g. 5 3. Create a test user account and start just enough (or more) parallel ldapsearch processes to make the account get locked, e.g. like this in bash/sh (note the backgrounding): for i in $(seq 6); do ldapsearch -x -D "uid=testuser1,$ldap_base" -w invalid >/dev/null 2>&1 & done 4. Check relevant ppolicy attributes, like: ldapsearch -x -H LDAPI:// -b "uid=testuser1,$ldap_base" + \ grep -E '^(pwdFailureTime|pwdAccountLockedTime):' This often shows no pwdAccountLockedTime but enough (or more) pwdFailureTime values to meet the lockout policy. -- You are receiving this mail because: You are on the CC list for the issue.

1 8

[Bug 9228] New: libldap depends on liblutil (lutil_memcmp) when cross compiling
by openldap-its＠openldap.org 28 Aug '20

28 Aug '20

https://bugs.openldap.org/show_bug.cgi?id=9228 Bug ID: 9228 Summary: libldap depends on liblutil (lutil_memcmp) when cross compiling Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Severity: normal Priority: --- Component: build Assignee: bugs(a)openldap.org Reporter: ryan(a)openldap.org Target Milestone: --- cross-compiling for Unix: ./configure --host=arm-linux-gnueabihf CC=arm-linux-gnueabihf-gcc --with-yielding-select && make ... libtool: link: arm-linux-gnueabihf-gcc -g -O2 -o ldapurl ldapurl.o lduversion.o ../../libraries/liblutil/liblutil.a ../../libraries/libldap/.libs/libldap.a /home/ryan/tmp/openldap/libraries/liblber/.libs/liblber.a ../../libraries/liblber/.libs/liblber.a -lresolv /usr/lib/gcc-cross/arm-linux-gnueabihf/8/../../../../arm-linux-gnueabihf/bin/ld: ../../libraries/libldap/.libs/libldap.a(os-ip.o): in function `ldap_pvt_is_socket_ready': /home/ryan/tmp/openldap/libraries/libldap/os-ip.c:248: warning: `sys_errlist' is deprecated; use `strerror' or `strerror_r' instead /usr/lib/gcc-cross/arm-linux-gnueabihf/8/../../../../arm-linux-gnueabihf/bin/ld: /home/ryan/tmp/openldap/libraries/libldap/os-ip.c:248: warning: `sys_nerr' is deprecated; use `strerror' or `strerror_r' instead /usr/lib/gcc-cross/arm-linux-gnueabihf/8/../../../../arm-linux-gnueabihf/bin/ld: ../../libraries/libldap/.libs/libldap.a(result.o): in function `try_read1msg': /home/ryan/tmp/openldap/libraries/libldap/result.c:935: undefined reference to `lutil_memcmp' cross-compiling for Windows: ./configure --host=x86_64-w64-mingw32 CC=x86_64-w64-mingw32-gcc && make ... libtool: link: x86_64-w64-mingw32-gcc -shared .libs/bind.o .libs/open.o .libs/result.o .libs/error.o .libs/compare.o .libs/search.o .libs/controls.o .libs/messages.o .libs/references.o .libs/extended.o .libs/cyrus.o .libs/modify.o .libs/add.o .libs/modrdn.o .libs/delete.o .libs/abandon.o .libs/sasl.o .libs/sbind.o .libs/unbind.o .libs/cancel.o .libs/filter.o .libs/free.o .libs/sort.o .libs/passwd.o .libs/whoami.o .libs/vc.o .libs/getdn.o .libs/getentry.o .libs/getattr.o .libs/getvalues.o .libs/addentry.o .libs/request.o .libs/os-ip.o .libs/url.o .libs/pagectrl.o .libs/sortctrl.o .libs/vlvctrl.o .libs/init.o .libs/options.o .libs/print.o .libs/string.o .libs/util-int.o .libs/schema.o .libs/charray.o .libs/os-local.o .libs/dnssrv.o .libs/utf-8.o .libs/utf-8-conv.o .libs/tls2.o .libs/tls_o.o .libs/tls_g.o .libs/tls_m.o .libs/turn.o .libs/ppolicy.o .libs/dds.o .libs/txn.o .libs/ldap_sync.o .libs/stctrl.o .libs/assertion.o .libs/deref.o .libs/ldifutil.o .libs/ldif.o .libs/fetch.o .libs/lbase64.o .libs/msctrl.o .libs/psearchctrl.o .libs/version.o ../../libraries/liblber/.libs/liblber.dll.a -lregex -lws2_32 -g -O2 -o .libs/libldap.dll -Wl,--enable-auto-image-base -Xlinker --out-implib -Xlinker .libs/libldap.dll.a /usr/bin/x86_64-w64-mingw32-ld: .libs/result.o: in function `try_read1msg': /home/ryan/tmp/openldap/libraries/libldap/result.c:935: undefined reference to `lutil_memcmp' /usr/bin/x86_64-w64-mingw32-ld: .libs/dnssrv.o: in function `ldap_dn2domain': /home/ryan/tmp/openldap/libraries/libldap/dnssrv.c:72: undefined reference to `lutil_memcmp' /usr/bin/x86_64-w64-mingw32-ld: .libs/ldif.o: in function `ldif_must_b64_encode': /home/ryan/tmp/openldap/libraries/libldap/ldif.c:426: undefined reference to `lutil_memcmp' collect2: error: ld returned 1 exit status More similar issues occur with --enable-dynamic. Workaround: configure with ac_cv_func_memcmp_working=yes -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 9249] New: A dollar sign ($) at the end of the 2nd argument of olcAuthzRegexp crashes slapd
by openldap-its＠openldap.org 28 Aug '20

28 Aug '20

https://bugs.openldap.org/show_bug.cgi?id=9249 Bug ID: 9249 Summary: A dollar sign ($) at the end of the 2nd argument of olcAuthzRegexp crashes slapd Product: OpenLDAP Version: 2.4.47 Hardware: All OS: Linux Status: UNCONFIRMED Severity: normal Priority: --- Component: slapd Assignee: bugs(a)openldap.org Reporter: kop(a)karlpinc.com Target Milestone: --- The following ldif, fed to ldapmodify, crashes slapd. dn: cn=config changetype: modify replace: olcAuthzRegexp olcAuthzRegexp: "^([^,]+),cn=PLAIN,cn=auth" "$1,ou=People,dc=example,dc=com$" Happens on Debian 10 with openldap 2.4.47 and RHEL 8 with openldap 2.4.46. Doing ldapmodify -d -1 seems to crash only 1 out of 3 times, but it always crashes without the -d -1. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Issue 9304] New: Archived-At: -> 404
by openldap-its＠openldap.org 19 Aug '20

19 Aug '20

https://bugs.openldap.org/show_bug.cgi?id=9304 Issue ID: 9304 Summary: Archived-At: -> 404 Product: website Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Severity: normal Priority: --- Component: website Assignee: bugs(a)openldap.org Reporter: michael(a)stroeder.com Target Milestone: --- I appreciate this mailing list message header: Archived-At: <https://openldap.org/hyperkitty/list/openldap-technical@openldap.org/messag…> But unfortunately the link returns 404. -- You are receiving this mail because: You are on the CC list for the issue.

1 3

[Issue 9294] New: ppolicy and replication: Multiple values for pwdLockedTime in violation of schema
by openldap-its＠openldap.org 19 Aug '20

19 Aug '20

https://bugs.openldap.org/show_bug.cgi?id=9294 Issue ID: 9294 Summary: ppolicy and replication: Multiple values for pwdLockedTime in violation of schema Product: OpenLDAP Version: 2.4.50 Hardware: All OS: All Status: UNCONFIRMED Severity: normal Priority: --- Component: overlays Assignee: bugs(a)openldap.org Reporter: quanah(a)openldap.org Target Milestone: --- If you have the following setup, a replica can end up with user entries in a non-schema compliant state: a) ppolicy is configured on provider(s) and replicas. Replica has schemachecking=off in its syncrepl configuration b) account gets locked on the replica, so pwdAccountLockedTime is set on the replica but not on the provider(s) c) admin does a MOD/ADD op against a provider for the user entry to add a value to pwdAccountLockedTime dn: ... changetype: modify add: pwdAccountLockedTime pwdAccountLockedTime: ... d) provider accepts this modification. e) replica accepts this modification f) account entry on replica now has two values for pwdAccountLockedTime in violation of it being a single valued attribute: "( 1.3.6.1.4.1.42.2.27.8.1.17 " "NAME ( 'pwdAccountLockedTime' ) " "DESC 'The time an user account was locked' " "EQUALITY generalizedTimeMatch " "ORDERING generalizedTimeOrderingMatch " "SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 " "SINGLE-VALUE " -- You are receiving this mail because: You are on the CC list for the issue.

1 4

[Issue 9289] New: Broken link to dmoz.org
by openldap-its＠openldap.org 19 Aug '20

19 Aug '20

https://bugs.openldap.org/show_bug.cgi?id=9289 Issue ID: 9289 Summary: Broken link to dmoz.org Product: website Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Severity: normal Priority: --- Component: website Assignee: bugs(a)openldap.org Reporter: cleydyr(a)gmail.com Target Milestone: --- At https://www.openldap.org/doc/admin24/intro.html, there's the following paragraph: --- A web directory, such as provided by the Open Directory Project <http://dmoz.org>, is a good example of a directory service. These services catalog web pages and are specifically designed to support browsing and searching. --- However, the Dmoz site is not at http://dmoz.org anymore. The user is redirected to an error page of a AWS S3 service if they try to access the link. Currently Dmoz has an archived version at https://dmoz-odp.org/ -- You are receiving this mail because: You are on the CC list for the issue.

1 6

[Issue 9287] New: ldap_create cause 10s delay in some scenario
by openldap-its＠openldap.org 19 Aug '20

19 Aug '20

https://bugs.openldap.org/show_bug.cgi?id=9287 Issue ID: 9287 Summary: ldap_create cause 10s delay in some scenario Product: OpenLDAP Version: 2.4.44 Hardware: All OS: All Status: UNCONFIRMED Severity: normal Priority: --- Component: libraries Assignee: bugs(a)openldap.org Reporter: happy.mu(a)nokia-sbell.com Target Milestone: --- hi LDAP guys there has some issue in our product when we integrate ipv6. scenario: ipv4 internal + ipv6 external after ldap search finish, we need build ldap message by ldap_create function. some times the ldap_create message will cause 10s delay. for example: the ldap search has 4 ocs, and only the first oc's ldap_create will cause 10s delay, the fellowing ocs is within 0.0001s. we just think it may because the mutext is global and locked by other thread. could you help on this ? LOGs: there has 10s delay, and only execute ldap_create between them. 2020/07/08-16:32:11.942114-[INFO] 13 (DBL) [DBL_LlbSearchResponse:76]LLB replied successfully with [4] entries 2020/07/08-16:32:11.942181- [INFO] 13 (DBL) [DBL_LlbSearchResponse:125]Entry Buffer[0] : l_entryBerBufferPtr="0x64820136xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" 2020/07/08-16:32:21.957488 [INFO] 13 (DBL) [DBL_LlbSearchResponse:138]Successfully created LDAP dummy handle -- You are receiving this mail because: You are on the CC list for the issue.

1 16

[Issue 9285] New: Expose ppolicy control in the rootDSE
by openldap-its＠openldap.org 19 Aug '20

19 Aug '20

https://bugs.openldap.org/show_bug.cgi?id=9285 Issue ID: 9285 Summary: Expose ppolicy control in the rootDSE Product: OpenLDAP Version: 2.4.50 Hardware: All OS: All Status: UNCONFIRMED Severity: normal Priority: --- Component: overlays Assignee: bugs(a)openldap.org Reporter: quanah(a)openldap.org Target Milestone: --- Currently the rootDSE does not expose the ppolicy control when ppolicy is instantiated. Generally the project has had a policy of not exposing controls for items that are not on a released RFC/standard. However, at this point, ppolicy is widely used, been around for years, and (eventually) the draft should get finalized. It would be useful to expose the control at this point. -- You are receiving this mail because: You are on the CC list for the issue.

1 3

[Issue 9279] New: Support for Netscape password expiry controls
by openldap-its＠openldap.org 19 Aug '20

19 Aug '20

https://bugs.openldap.org/show_bug.cgi?id=9279 Issue ID: 9279 Summary: Support for Netscape password expiry controls Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Severity: normal Priority: --- Component: overlays Assignee: bugs(a)openldap.org Reporter: ondra(a)mistotebe.net Target Milestone: --- Add support for legacy clients expecting the LDAP server to attach these controls on relevant bind responses: - Password Expired Control (2.16.840.1.113730.3.4.4) - Password Expiration Warning Control (2.16.840.1.113730.3.4.5) Decisions as configured by regular password policy. -- You are receiving this mail because: You are on the CC list for the issue.

1 24

[Issue 9275] New: Replace all references to master/slave with appropriate terminology
by openldap-its＠openldap.org 19 Aug '20

19 Aug '20

https://bugs.openldap.org/show_bug.cgi?id=9275 Issue ID: 9275 Summary: Replace all references to master/slave with appropriate terminology Product: OpenLDAP Version: 2.4.51 Hardware: All OS: All Status: UNCONFIRMED Severity: blocker Priority: --- Component: documentation Assignee: bugs(a)openldap.org Reporter: quanah(a)openldap.org Target Milestone: --- We need to replace all references to master/slave in the documentation, code comments etc. provider, consumer multimaster -> multiprovider -- You are receiving this mail because: You are on the CC list for the issue.

1 6

← Newer
1
...
5
6
7
8
9
10
11
12
13
Older →

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs July 2020