openldap-bugs

openldap-bugs@openldap.org

1 participants
20967 discussions

(ITS#7524) Seg fault of slapd with back-meta traffic
by jorge.perez.burgos＠ericsson.com 12 Feb '13

12 Feb '13

Full_Name: Jorge Perez Burgos Version: 2.4.32 OS: SLES 10 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (195.235.15.243) PROBLEM Sending high load traffic to several slapd servers that are proxying the traffic to only one slapd. It can seen that in this situation originating servers crash sporadically. POSSIBLE SOLUTION In back-meta/conn.c in the method meta_back_retry it seems that the binding flag is not set properly in the following situation: /* restore the "binding" flag, in case */ if ( binding ) { LDAP_BACK_CONN_BINDING_SET( msc ); } if ( rc == LDAP_SUCCESS ) { quarantine = 0; rc = meta_back_single_dobind( op, rs, mcp, candidate, sendok, mt->mt_nretries, 0 ); Setting the binding flag before calling meta_back_single_dobind seems to solve the issue (LDAP_BACK_CONN_BINDING_SET( msc );) CORE DUMP TRACE This is the backtrace of the core dumped. Program terminated with signal 6, Aborted. #0 0x00002ad023473f45 in raise () from /lib64/libc.so.6 (gdb) bt #0 0x00002ad023473f45 in raise () from /lib64/libc.so.6 #1 0x00002ad023475340 in abort () from /lib64/libc.so.6 #2 0x00002ad02346d486 in __assert_fail () from /lib64/libc.so.6 #3 0x000000000051cfe1 in meta_back_bind_op_result (op=0x69d2580, rs=0x2aab95e57c70, mc=0x2aab62a44740, candidate=2, msgid=1, sendok=<value optimized out>, dolock=0) at bind.c:392 #4 0x000000000051d130 in meta_back_proxy_authz_bind (mc=0x2aab62a44740, candidate=2, op=0x69d2580, rs=0x2aab95e57c70, sendok=LDAP_BACK_DONTSEND, dolock=0) at bind.c:1590 #5 0x000000000051d37b in meta_back_single_dobind (op=0x69d2580, rs=0x2aab95e57c70, mcp=0x2aab95e56920, candidate=2, sendok=LDAP_BACK_DONTSEND, nretries=<value optimized out>, dolock=0) at bind.c:605 #6 0x000000000052714d in meta_back_retry (op=0x69d2580, rs=0x2aab95e57c70, mcp=0x2aab95e56920, candidate=2, sendok=LDAP_BACK_DONTSEND) at conn.c:769 #7 0x00000000004db025 in meta_back_search (op=0x69d2580, rs=0x2aab95e57c70) at search.c:1154 #8 0x00000000004636d9 in fe_op_search (op=0x69d2580, rs=0x2aab95e57c70) at search.c:402 #9 0x00000000004c4e02 in overlay_op_walk (op=0x69d2580, rs=0x2aab95e57c70, which=op_search, oi=0x8088000, on=0x0) at backover.c:671 #10 0x00000000004c5307 in over_op_func (op=0x69d2580, rs=0x2aab95e57c70, which=op_search) at backover.c:723 #11 0x0000000000463ee5 in do_search (op=0x69d2580, rs=0x2aab95e57c70) at search.c:247 #12 0x0000000000460f45 in connection_operation (ctx=0x2aab95e57e50, arg_v=<value optimized out>) at connection.c:1308 #13 0x0000000000461e05 in connection_read_thread (ctx=0x2aab95e57e50, argv=<value optimized out>) at connection.c:1444 #14 0x000000000055cb7c in ldap_int_thread_pool_wrapper (xpool=0x8028000) at tpool.c:688 #15 0x00002ad022ec92a3 in start_thread () from /lib64/libpthread.so.0 #16 0x00002ad02350549d in clone () from /lib64/libc.so.6

1 0

(ITS#7523) ldap valsort control is not documented
by quanah＠OpenLDAP.org 11 Feb '13

11 Feb '13

Full_Name: Quanah Gibson-Mount Version: 2.4.33 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (74.196.25.250) The slapo-valsort(5) man page does not mention the fact that the LDAP_CONTROL_VALSORT (1.3.6.1.4.1.4203.666.5.14 can be specified to allow the returning of the values with weights present.

1 0

(ITS#7522) Admin Guide: bugs in example
by openldap＠laimbock.com 10 Feb '13

10 Feb '13

Full_Name: Patrick Laimbock Version: RE24 OS: CentOS 6.3 x86_64 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (94.210.175.192) In the OpenLDAP Admin Guide on page 38 it says: 34. olcSuffix: "dc=example,dc=com" 35. olcDbDirectory: /usr/local/var/openldap-data 36. olcRootDN: "cn=Manager,dc=example,dc=com" 37. olcRootPW: secret 38. olcDbIndex: uid pres,eq 39. olcDbIndex: cn,sn,uid pres,eq,approx,sub When I try to slapadd that example config I get the following errors: 5117a0af str2entry: invalid value for attributeType olcSuffix #0 (syntax 1.3.6.1.4.1.1466.115.121.1.12) 5117a1ea str2entry: invalid value for attributeType olcRootDN #0 (syntax 1.3.6.1.4.1.1466.115.121.1.12) /etc/openldap34/slapd.d: line 1: duplicate index definition for attr "uid" When I remove the quotes from the olcSuffix (line 34) and olcRootDN (line 36) entries and remove the double uid from either line 38 or line 39 then the slapadd action is successful.

1 0

Re: (ITS#7503) slapcat: retry a few times when retrieving an entry
by balint＠balintreczey.hu 07 Feb '13

07 Feb '13

Hi Howard, Thank you! I have updated the Debian bug report [1]. Cheers, Balint [1]: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=673038 2013/2/7 Howard Chu <hyc(a)symas.com>: > I've committed an alternate fix for this to git master, filed against > ITS#6365. Please test and let us know your results, thanks. > The patch is in commit 853b9d1335d27e280751e9cfb8ca6b5356ffec73 > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7503) slapcat: retry a few times when retrieving an entry
by hyc＠symas.com 07 Feb '13

07 Feb '13

I've committed an alternate fix for this to git master, filed against ITS#6365. Please test and let us know your results, thanks. The patch is in commit 853b9d1335d27e280751e9cfb8ca6b5356ffec73 -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7521) Passwords with either a comma or period don't authenticate against AD LDAP
by hyc＠symas.com 06 Feb '13

06 Feb '13

quanah(a)zimbra.com wrote: > --On Wednesday, February 06, 2013 6:33 PM +0000 TCera(a)sjrwmd.com wrote: > >> --_000_EE54DB3B9E0D63489B0845CE62912E8C3BAD846ABY2PRD0511MB441_ >> Content-Type: text/plain; charset="us-ascii" >> Content-Transfer-Encoding: quoted-printable >> >> xwiki uses jldap. >> >> http://www.openldap.org/jldap/ > > JLDAP is written in java, and does not use the OpenLDAP C libraries. If > you are going to use Java, I highly recommend you look at the unboundID SDK. > > I would also note that PHP's LDAP Support is known to be utterly broken. > There is no indication anywhere here in your report that indicates a bug > with the OpenLDAP software. If he could reproduce the issue using OpenLDAP's command line tools, there would be reason to suspect libldap. But no such problem occurs for me using e.g. ldapsearch. Closing this ITS. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7521) Passwords with either a comma or period don't authenticate against AD LDAP
by quanah＠zimbra.com 06 Feb '13

06 Feb '13

--On Wednesday, February 06, 2013 6:33 PM +0000 TCera(a)sjrwmd.com wrote: > --_000_EE54DB3B9E0D63489B0845CE62912E8C3BAD846ABY2PRD0511MB441_ > Content-Type: text/plain; charset="us-ascii" > Content-Transfer-Encoding: quoted-printable > > xwiki uses jldap. > > http://www.openldap.org/jldap/ JLDAP is written in java, and does not use the OpenLDAP C libraries. If you are going to use Java, I highly recommend you look at the unboundID SDK. I would also note that PHP's LDAP Support is known to be utterly broken. There is no indication anywhere here in your report that indicates a bug with the OpenLDAP software. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7521) Passwords with either a comma or period don't authenticate against AD LDAP
by TCera＠sjrwmd.com 06 Feb '13

06 Feb '13

--_000_EE54DB3B9E0D63489B0845CE62912E8C3BAD846ABY2PRD0511MB441_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable xwiki uses jldap. http://www.openldap.org/jldap/ Without delving deeper, I don't know whether jldap uses openldap libraries = or not. I thought that it might since it was an openldap project. Though = if jldap and openldap are different enough then this issue points to a prob= lem then with Active Directory. On the other hand, Windows login, email, .= ..etc. were unaffected by the comma and period in the password. Regardless - take the comma and period out of my password, both tikiwiki an= d xwiki work. --_000_EE54DB3B9E0D63489B0845CE62912E8C3BAD846ABY2PRD0511MB441_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr= osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:= //www.w3.org/TR/REC-html40"> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"= > <meta name=3D"Generator" content=3D"Microsoft Word 12 (filtered medium)"> <style>  </style> </head> <body lang=3D"EN-US" link=3D"blue" vlink=3D"purple"> <div class=3D"WordSection1"> <p class=3D"MsoNormal">xwiki uses jldap.<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">http://www.openldap.org/jldap/<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Without delving deeper, I don't know whether jldap u= ses openldap libraries or not.  I thought that it might since it was a= n openldap project.  Though if jldap and openldap are different enough= then this issue points to a problem then with Active Directory.  On the other hand, Windows login, email, …et= c. were unaffected by the comma and period in the password.  <o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Regardless - take the comma and period out of my pas= sword, both tikiwiki and xwiki work. <o:p></o:p></p> </div> </body> </html> --_000_EE54DB3B9E0D63489B0845CE62912E8C3BAD846ABY2PRD0511MB441_--

1 0

Re: (ITS#7521) Passwords with either a comma or period don't authenticate against AD LDAP
by quanah＠zimbra.com 06 Feb '13

06 Feb '13

--On Wednesday, February 06, 2013 12:50 PM +0000 tim(a)cerazone.net wrote: > Full_Name: Tim Cera > Version: 2.4.23-26.el6_3.2 > OS: CentOS > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (74.252.34.1) > > > Currently using tikiwki (PHP) with LDAP authentication, and began > experimenting with xwiki (Java) also with LDAP authentication. Both > against an Active Directory server. With both systems you cannot > authenticate a password with either a comma or a period, so suspect it is > the underlying OpenLDAP libraries. The test password had both a comma > and period, and the account is locked right now so I can't easily test > which one or both are required to activate the bug. I would suspect you are incorrect if you are having this problem with a Java program, since Java would not be linked to the OpenLDAP C libraries. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#7521) Passwords with either a comma or period don't authenticate against AD LDAP
by tim＠cerazone.net 06 Feb '13

06 Feb '13

Full_Name: Tim Cera Version: 2.4.23-26.el6_3.2 OS: CentOS URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (74.252.34.1) Currently using tikiwki (PHP) with LDAP authentication, and began experimenting with xwiki (Java) also with LDAP authentication. Both against an Active Directory server. With both systems you cannot authenticate a password with either a comma or a period, so suspect it is the underlying OpenLDAP libraries. The test password had both a comma and period, and the account is locked right now so I can't easily test which one or both are required to activate the bug. I did try looking for this bug suspecting that it would have been reported, and didn't find it. Hope this isn't a duplicate.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs