March 2022 - openldap-bugs

[Issue 9812] New: Registered SLAPI plugin functions are not called

by openldap-its＠openldap.org

https://bugs.openldap.org/show_bug.cgi?id=9812 Issue ID: 9812 Summary: Registered SLAPI plugin functions are not called Product: OpenLDAP Version: 2.6.1 Hardware: x86_64 OS: Linux Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: slapd Assignee: bugs(a)openldap.org Reporter: guru(a)unixarea.de Target Milestone: --- We're running since ages with an OpenLDAP server 2.4.40 a plugin which publishes changes (add, modify, delete) in LDAP to an Identity Server (IDM). We compile on SuSE Linux from source. The configure options for 2.6.1 are: ./configure --enable-aci=yes --enable-dynacl --enable-spasswd=yes --enable-crypt=yes --enable-debug=yes --enable-shared=yes --enable-modules=yes --enable-slapi --enable-slapd=yes --with-tls --prefix=/opt/openldap-2.6.1 Our SLAPI plugin, written in C works fine for 2.4.40 and stopped working for 2.6.1. It is configured in slapd.conf as plugin postoperation /opt/openldap-2.6.1/lib64/idm.so idm_init "IDM Plugin" 10.23.33.52 3001 The function idm_init() registers static C functions the supposed way: int idm_init(Slapi_PBlock * pb) { int rc = LDAP_SUCCESS; log("idm-plugin:","now in idm_init()\n"); // first call, create new list and register the functions ... rc |= slapi_pblock_set( /* Plug-in API version */ pb, SLAPI_PLUGIN_VERSION, SLAPI_PLUGIN_CURRENT_VERSION); rc |= slapi_pblock_set( /* Plug-in description */ pb, SLAPI_PLUGIN_DESCRIPTION, (void *) &desc); rc |= slapi_pblock_set( /* Modify function */ pb, SLAPI_PLUGIN_POST_MODIFY_FN, (void *) modify_user); ... // read arguments and add list entry rc |= read_arguments(pb); log("idm-plugin", "idm_init() return rc:%d\n", rc); return rc; } The begin of the function for modify_user() looks like this: static int modify_user(Slapi_PBlock * pb) { Slapi_Entry *entry; log("idm-plugin:", "now in modify_user\n"); if (slapi_pblock_get(pb, SLAPI_SEARCH_TARGET, &entry) != LDAP_SUCCESS) { log("IDM-Connector Plugin", "entry modified, but couldn't get entry"); return -1; } ... But the function gets never called from slapd on changes in LDAP. The log shows only the registering: 03/16/22 10:52:26 idm-plugin:: now in idm_init() 03/16/22 10:52:26 IDM-Connector Plugin: idm_init: Initializing plugin 03/16/22 10:52:26 idm-plugin:: now in read_arguments() 03/16/22 10:52:26 IDM Plugin: added idm connector: ip=10.23.33.52, port=3001 03/16/22 10:52:26 idm-plugin: idm_init() returns rc:0 03/16/22 10:52:26 plugin_pblock_new: Registered plugin OCLC-IDM-Connector-Notifier 1.0 [OCLC.org] (Notify the OCLC IDM-Connector of changes) As I said, with OpenLDAP 2.4.40 this works fine. It does not work anymore with 2.6.1. -- You are receiving this mail because: You are on the CC list for the issue.

12 months

1
7
0 / 0

[Issue 6461] back-sql quote characters in query

by openldap-its＠openldap.org

https://bugs.openldap.org/show_bug.cgi?id=6461 --- Comment #10 from Howard Chu <hyc(a)openldap.org> --- Escaping with a backslash appears to be non-portable. All the major SQL implementations escape a single quote by doubling it, as done in the patch for ITS#9815. -- You are receiving this mail because: You are on the CC list for the issue.

12 months

1
0
0 / 0

[Issue 6461] back-sql quote characters in query

by openldap-its＠openldap.org

https://bugs.openldap.org/show_bug.cgi?id=6461 Ryan Tandy <ryan(a)openldap.org> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.openldap.org/s | |how_bug.cgi?id=9815 -- You are receiving this mail because: You are on the CC list for the issue.

12 months

1
0
0 / 0

[Issue 9816] New: slapcat cordeumps during mdb subtree dump with -s

by openldap-its＠openldap.org

https://bugs.openldap.org/show_bug.cgi?id=9816 Issue ID: 9816 Summary: slapcat cordeumps during mdb subtree dump with -s Product: OpenLDAP Version: 2.5.11 Hardware: x86_64 OS: Linux Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: slapd Assignee: bugs(a)openldap.org Reporter: khoffmann(a)united-internet.de Target Milestone: --- Created attachment 887 --> https://bugs.openldap.org/attachment.cgi?id=887&action=edit gdb backtrace of slapcat run When trying to use slapcat in combination with -b and -s in order to create a LDIF backup of a mdb subtree, slapd crashes with a coredump (please see the attached snippet with gdb output from a reproduced test tree). The problem was reporducible with different mdb databases / suffixes and only appears with option -s. The same dump with -H 'ldap:///ou=users,o=company,c=de??sub?' instead of -s ou=users,o=company,c=de works perfectly fine, as long as the "attrs part" is empty in the ldap-uri. Also using slapcat with -b only (for a full database dump) works fine as well. I'm aware of the fact that -s option is marked as DEPRECATED - I'm not sure if you are going to fix this bug or if you rather take the change to remove the option completely from future major versions. Please let me also know if it's expected behaviour that the -H option doesn't work whenever the attribute part isn't empty and if I should contribute to a documentation update for this edge case. Best regards, Kris -- You are receiving this mail because: You are on the CC list for the issue.

12 months

1
3
0 / 0

[Issue 7978] OpenLDAP 2.4 fails to build with LibreSSL

by openldap-its＠openldap.org

https://bugs.openldap.org/show_bug.cgi?id=7978 ismael(a)iodev.co.uk changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ismael(a)iodev.co.uk --- Comment #13 from ismael(a)iodev.co.uk --- Created attachment 889 --> https://bugs.openldap.org/attachment.cgi?id=889&action=edit Fix building against LibreSSL OpenLDAP 2.6.1 works fine against LibreSSL 3.4+. The only problem is the configure script checks for a symbol LibreSSL doesn't implement yet. -- You are receiving this mail because: You are on the CC list for the issue.

12 months

1
0
0 / 0

[Issue 7832] Proposing ppolicy extended module for OpenLDAP

by openldap-its＠openldap.org

https://bugs.openldap.org/show_bug.cgi?id=7832 --- Comment #25 from Quanah Gibson-Mount <quanah(a)openldap.org> --- (In reply to David Coutadeur from comment #24) > Hello, > I have just opened a new MR: > https://git.openldap.org/openldap/openldap/-/merge_requests/509 to upgrade > ppm to 2.1 release: > > Changes: > - Reject password if it contains tokens from an attribute of the LDAP entry > https://github.com/ltb-project/ppm/issues/17 You should file a new issue for this, rather than commenting in this issue. Thanks -- You are receiving this mail because: You are on the CC list for the issue.

1 year

1
0
0 / 0

[Issue 7832] Proposing ppolicy extended module for OpenLDAP

by openldap-its＠openldap.org

https://bugs.openldap.org/show_bug.cgi?id=7832 --- Comment #24 from David Coutadeur <david.coutadeur(a)gmail.com> --- Hello, I have just opened a new MR: https://git.openldap.org/openldap/openldap/-/merge_requests/509 to upgrade ppm to 2.1 release: Changes: - Reject password if it contains tokens from an attribute of the LDAP entry https://github.com/ltb-project/ppm/issues/17 -- You are receiving this mail because: You are on the CC list for the issue.

1 year

1
0
0 / 0

[Issue 7089] ppolicy adds PWDFAILURETIME to organizationalUnit

by openldap-its＠openldap.org

https://bugs.openldap.org/show_bug.cgi?id=7089 Ondřej Kuzník <ondra(a)mistotebe.net> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.openldap.org/s | |how_bug.cgi?id=9813 -- You are receiving this mail because: You are on the CC list for the issue.

1 year

1
0
0 / 0

[Issue 9810] New: slapacl peername

by openldap-its＠openldap.org

https://bugs.openldap.org/show_bug.cgi?id=9810 Issue ID: 9810 Summary: slapacl peername Product: OpenLDAP Version: 2.4.59 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: slapd Assignee: bugs(a)openldap.org Reporter: ratness(a)gmail.com Target Milestone: --- Found in 2.4.59 on a $WORK system, replicated in 2.6.1: [root@centos-s-1vcpu-1gb-ams3-01 ~]# rpm -qf /opt/symas/sbin/slapacl symas-openldap-servers-2.6.1-2.el7.x86_64 This is a box where I don't even have slapd running, but that's okay because my point is visible without it: [root@centos-s-1vcpu-1gb-ams3-01 ~]# /opt/symas/sbin/slapacl -F /etc/openldap/slapd.d -D 'someuser' -b 'somewhere' -o peername.ip=127.0.0.1 entry/read usage: slapacl [-v] [-d debuglevel] [-f configfile] [-F configdir] [-o <name>[=<value>]] [-U authcID | -D authcDN] [-X authzID | -o authzDN=<DN>] -b DN [-u] [attr[/access][:value]] [...] When I ask for `-o peername.ip=127.0.0.1` the `slapacl` command bails out with usage, indicating a parse failure. If I then run `slapacl` with `-o peername=ip=127.0.0.1`, I get: [root@centos-s-1vcpu-1gb-ams3-01 ~]# /opt/symas/sbin/slapacl -F /etc/openldap/slapd.d -D 'someuser' -b 'somewhere' -o peername=ip=127.0.0.1 entry/read invalid config directory /etc/openldap/slapd.d, error 2 slapacl: bad configuration directory! (which I would expect here since I have no server running) Demo on 2.4.59 at work: $ /usr/sbin/slapacl -F /etc/openldap/slapd.d -D uid=replicator,ou=logins,dc=example -b 'mail=me(a)example.com,o=com,dc=mozilla' -o peername=ip=127.0.0.1 entry/read authcDN: "uid=replicator,ou=logins,dc=example" read access to entry: ALLOWED $ /usr/sbin/slapacl -F /etc/openldap/slapd.d -D uid=replicator,ou=logins,dc=example -b 'mail=me(a)example.com,o=com,dc=mozilla' -o peername=ip=127.0.0.2 entry/read authcDN: "uid=replicator,ou=logins,dc=example" read access to entry: DENIED slapacl(8) mentions peername, but also aims us at slapd.access(5), which lists peername[.<peernamesytle>]. It's possible I'm dense and this isn't a bug, but minimally the equalsign repetition is really awkward to my eye. I'd suggest at least an example in slapacl(8) so it's easier to figure out. -- You are receiving this mail because: You are on the CC list for the issue.

1 year

1
3
0 / 0

[Issue 9807] New: Cannot enable {ARGON2} passwd scheme support

by openldap-its＠openldap.org

https://bugs.openldap.org/show_bug.cgi?id=9807 Issue ID: 9807 Summary: Cannot enable {ARGON2} passwd scheme support Product: OpenLDAP Version: unspecified Hardware: x86_64 OS: Linux Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: build Assignee: bugs(a)openldap.org Reporter: gregory.widmer(a)gwidmer.fr Target Milestone: --- Created attachment 881 --> https://bugs.openldap.org/attachment.cgi?id=881&action=edit Trace of every executed command. I want to build OpenLDAP with argon2 support. Unfortunately, it doesn't work and I don't understand why. It seems to be a build issue. Here is how to reproduce the issue : I'm using a fresh install of Debian 11. The following packages were installed for this : - libargon2-dev - libltdl-dev - git - build-essential I am using the master branch of the git repository : https://git.openldap.org/openldap/openldap/-/commit/e8813b12b6188d5ba5f17... I'm using root, and the repo is under /root/openldap. My objective is to : - Run slapd with {ARGON2} support - Set {ARGON2} as password-hash - Use slappasswd to create a password for LDAP admin in slapd.conf I ran the following commands : - apt install libltdl-dev libargon2-dev git build-essential -y - ./configure --with-argon2=libargon2 --enable-modules --enable-argon2=yes - make depend - make - make check - make install I then created a systemd service for slapd, reloaded daemons with systemctl then started the service. I got the following error : @(#) $OpenLDAP: slapd 2.X (Mar 12 2022 15:31:06) $ root@ldap:/root/openldap/servers/slapd /usr/local/etc/openldap/slapd.conf: line 65: <password-hash> scheme not available ({ARGON2}) /usr/local/etc/openldap/slapd.conf: line 65: <password-hash> no valid hashes found slapd stopped. connections_destroy: nothing to destroy. I don't understand how to build openldap with argon2. I did not find anything. You will find a global trace file for every command used with the program. -- You are receiving this mail because: You are on the CC list for the issue.

1 year

1
2
0 / 0

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs March 2022