openldap-bugs

openldap-bugs@openldap.org

1 participants
20969 discussions

Re: (ITS#7119) smbldap-populate error
by michael＠stroeder.com 01 Jan '12

01 Jan '12

adri58(a)gmail.com wrote: > > I'mtrying to install a Samba + LDAP PDC but when I try to create the database > with smbldap-populate I get this error: > [..] > failed to add entry: invalid DN at /usr/sbin/smbldap-populate line 498,<GEN1> > line 242. The ITS is for reporting bugs but this seems like a configuration error for which you can get help on the openldap-technical mailing list. (Most like you did not load the Samba3 schema.) Ciao, Michael.

1 0

(ITS#7118)
by thomas＠koeller.dyndns.org 01 Jan '12

01 Jan '12

I found that the patch I proposed actually threw out the baby with the bathwater; rejecting all plugins is inappropriate. So here is a revised version that only excludes the ldapdb plugin specifically: diff -brpu openldap-2.4.28-orig/servers/slapd/sasl.c openldap-2.4.28/servers/slapd/sasl.c --- openldap-2.4.28-orig/servers/slapd/sasl.c 2011-11-25 19:52:29.000000000 +0100 +++ openldap-2.4.28/servers/slapd/sasl.c 2012-01-02 01:48:58.000000000 +0100 @@ -67,6 +67,24 @@ char *slap_sasl_auxprops; #ifdef HAVE_CYRUS_SASL +/* Do not load the ldapdb plugin */ +static int +slap_sasl_verifyfile( + void *context, + const char *file, + sasl_verify_type_t type) +{ + int res = SASL_OK; + + if (type == SASL_VRFY_PLUGIN) { + static const char name[] = "libldapdb.so"; + const char * const p = strstr(file, name); + if (p && !strchr(p, '/')) + res = SASL_CONTINUE; + } + return res; +} + /* Just use our internal auxprop by default */ static int slap_sasl_getopt( @@ -1111,6 +1129,7 @@ int slap_sasl_init( void ) static sasl_callback_t server_callbacks[] = { { SASL_CB_LOG, &slap_sasl_log, NULL }, { SASL_CB_GETOPT, &slap_sasl_getopt, NULL }, + { SASL_CB_VERIFYFILE, &slap_sasl_verifyfile, NULL }, { SASL_CB_LIST_END, NULL, NULL } }; #endif

1 0

(ITS#7119) smbldap-populate error
by adri58＠gmail.com 01 Jan '12

01 Jan '12

Full_Name: Adrián Version: 2.4.23-7.2 OS: Debian Testing "Wheezy" URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (83.213.191.231) Hello everybody. I'mtrying to install a Samba + LDAP PDC but when I try to create the database with smbldap-populate I get this error: -------------------------------------------------------------------------------- Populating LDAP directory for domain empresa (S-1-5-21-802753395-3202467916-1484007712) (using builtin directory structure) entry dc=empresa,dc=com already exist. entry ou=Users,dc=empresa,dc=com already exist. entry ou=Groups,dc=empresa,dc=com already exist. entry ou=Computers,dc=empresa,dc=com already exist. entry ou=Idmap,dc=empresa,dc=com already exist. adding new entry: uid=root,ou=Users,dc=empresa,dc=com failed to add entry: objectClass: value #4 invalid per syntax at /usr/sbin/smbldap-populate line 498, <GEN1> line 58. adding new entry: uid=nobody,ou=Users,dc=empresa,dc=com failed to add entry: objectClass: value #4 invalid per syntax at /usr/sbin/smbldap-populate line 498, <GEN1> line 89. adding new entry: cn=Domain Admins,ou=Groups,dc=empresa,dc=com failed to add entry: objectClass: value #2 invalid per syntax at /usr/sbin/smbldap-populate line 498, <GEN1> line 101. adding new entry: cn=Domain Users,ou=Groups,dc=empresa,dc=com failed to add entry: objectClass: value #2 invalid per syntax at /usr/sbin/smbldap-populate line 498, <GEN1> line 112. adding new entry: cn=Domain Guests,ou=Groups,dc=empresa,dc=com failed to add entry: objectClass: value #2 invalid per syntax at /usr/sbin/smbldap-populate line 498, <GEN1> line 123. adding new entry: cn=Domain Computers,ou=Groups,dc=empresa,dc=com failed to add entry: objectClass: value #2 invalid per syntax at /usr/sbin/smbldap-populate line 498, <GEN1> line 134. adding new entry: cn=Administrators,ou=Groups,dc=empresa,dc=com failed to add entry: objectClass: value #2 invalid per syntax at /usr/sbin/smbldap-populate line 498, <GEN1> line 179. adding new entry: cn=Account Operators,ou=Groups,dc=empresa,dc=com failed to add entry: objectClass: value #2 invalid per syntax at /usr/sbin/smbldap-populate line 498, <GEN1> line 201. adding new entry: cn=Print Operators,ou=Groups,dc=empresa,dc=com failed to add entry: objectClass: value #2 invalid per syntax at /usr/sbin/smbldap-populate line 498, <GEN1> line 212. adding new entry: cn=Backup Operators,ou=Groups,dc=empresa,dc=com failed to add entry: objectClass: value #2 invalid per syntax at /usr/sbin/smbldap-populate line 498, <GEN1> line 223. adding new entry: cn=Replicators,ou=Groups,dc=empresa,dc=com failed to add entry: objectClass: value #2 invalid per syntax at /usr/sbin/smbldap-populate line 498, <GEN1> line 234. adding new entry: sambaDomainName=empresa,dc=empresa,dc=com failed to add entry: invalid DN at /usr/sbin/smbldap-populate line 498, <GEN1> line 242. Please provide a password for the domain root: /usr/sbin/smbldap-passwd: user root doesn't exist ---------------------------------------------------------------------------------- In the log file I get this other error: slapd[1369]: conn=1005 op=28 do_search: invalid dn: "sambaDomainName=empresa,dc=empresa,dc=com" slapd[1369]: conn=1005 op=29 do_add: invalid dn (sambaDomainName=empresa,dc=empresa,dc=com) Any ideas? I've been looking for any solution for 4 days and nobody seems to know anything

1 0

Re: (ITS#7117) Documentation typo
by hyc＠symas.com 27 Dec '11

27 Dec '11

hydrapolic(a)gmail.com wrote: > Full_Name: hydra > Version: 2.4 > OS: Any > URL: http://www.openldap.org/doc/admin24/slapdconf2.html > Submission from: (NULL) (195.91.56.62) > > > Table 5.1: Debugging Levels > trace function callss Thanks, fixed now in git master. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7116) pwdAccountLockedTime not honoured by PAM
by hyc＠symas.com 27 Dec '11

27 Dec '11

rajnesh.siwal(a)gmail.com wrote: > Full_Name: Rajnesh Siwal > Version: 2.4.21-0ubuntu5.6 > OS: Ubuntu 10.4 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (122.180.141.110) > > > The user account has been locked by the parameter "pwdAccountLockedTime" and > still we are able to login into the linux servers (LDAP clients) using the LDAP > credentials. > Please suggest what the reason could be. The ITS is for actual bug reports, not help requests. Please post your question to the openldap-technical mailing list. This ITS will be closed. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7118) [PATCH] Improve SASL plugin handling
by thomas＠koeller.dyndns.org 26 Dec '11

26 Dec '11

Full_Name: Thomas Koeller Version: 2.4.28 OS: Linux x86_64 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (80.171.14.55) I had a problem with slapd always segfaulting. A little debugging revealed that slapd allocated the thread-safe version of 'struct ldapoptions', since it is linked with libldap_r.so. However, the destructor function ldap_int_destroy_global_options() invoked during cleanup seemed to be the non-threadsafe version which assumes a different layout of 'struct ldapoptions' (the ldo_mutex field is missing). I noticed that that SASL loaded all its plugins, including the 'ldapdb' module which is present in my SASL installation, and that ldapdb.so was linked against the non-threadsafe libldap.so. I still do not quite understand the exact reason why this confusion arose, because AFAIK theoretically both libraries should be able to co-exist. However, I did not investigate that problem any further, because I think that loading all sasl plugins is just wrong, because slapd only uses its own internal auxprop module and does not need any of them. I tried the proposed method of excluding ldapdb by having a slapd.conf file containing 'pwcheck_method: auxprop' and 'auxprop_plugin: slapd',but that did not improve anything. I therefore changed slapd to no longer load any sasl plugins whatsoever. With this change, everything works fine. Btw., my SASL installation is cyrus-sasl-2.1.25. Here is the patch I created, along with the required legalese: The inlined patch below is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Thomas Koeller <thomas(a)koeller.dyndns.org>. I have not assigned rights and/or interest in this work to any party. I, Thomas Koeller, hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice. diff -brpu openldap-2.4.28-orig/servers/slapd/sasl.c openldap-2.4.28/servers/slapd/sasl.c --- openldap-2.4.28-orig/servers/slapd/sasl.c 2011-11-25 19:52:29.000000000 +0100 +++ openldap-2.4.28/servers/slapd/sasl.c 2011-12-26 15:40:14.000000000 +0100 @@ -67,6 +67,16 @@ char *slap_sasl_auxprops; #ifdef HAVE_CYRUS_SASL +/* Do not load any plugin modules, only use internal auxprop */ +static int +slap_sasl_verifyfile( + void *context, + const char *file, + sasl_verify_type_t type) +{ + return type == SASL_VRFY_PLUGIN ? SASL_CONTINUE : SASL_OK; +} + /* Just use our internal auxprop by default */ static int slap_sasl_getopt( @@ -1111,6 +1121,7 @@ int slap_sasl_init( void ) static sasl_callback_t server_callbacks[] = { { SASL_CB_LOG, &slap_sasl_log, NULL }, { SASL_CB_GETOPT, &slap_sasl_getopt, NULL }, + { SASL_CB_VERIFYFILE, &slap_sasl_verifyfile, NULL }, { SASL_CB_LIST_END, NULL, NULL } }; #endif

1 0

(ITS#7117) Documentation typo
by hydrapolic＠gmail.com 26 Dec '11

26 Dec '11

Full_Name: hydra Version: 2.4 OS: Any URL: http://www.openldap.org/doc/admin24/slapdconf2.html Submission from: (NULL) (195.91.56.62) Table 5.1: Debugging Levels trace function callss

1 0

(ITS#7116) pwdAccountLockedTime not honoured by PAM
by rajnesh.siwal＠gmail.com 26 Dec '11

26 Dec '11

Full_Name: Rajnesh Siwal Version: 2.4.21-0ubuntu5.6 OS: Ubuntu 10.4 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (122.180.141.110) The user account has been locked by the parameter "pwdAccountLockedTime" and still we are able to login into the linux servers (LDAP clients) using the LDAP credentials. Please suggest what the reason could be.

1 0

Re: (ITS#7045) "ldapsearch -Z" should continue using TLS one cert mis-match
by bgmilne＠staff.telkomsa.net 21 Dec '11

21 Dec '11

On Monday, 19 September 2011 02:41:30 Jason_Haar(a)trimble.com wrote: > > (I'm using ldapsearch to dump Active Directory LDAP data via the DNS > round-robin entry for the domain name: as such the LDAP host *never* > matches the hostname DNS round-robin gives back - and I don't care - I > just don't want the network group sniffing my password ;-) Then your 'Active Directory' servers should have subjectAltName extensions for the DNS round-robin hostname ...

1 0

Re: (ITS#7114) Password synchronization is not working
by quanah＠zimbra.com 20 Dec '11

20 Dec '11

--On Tuesday, December 20, 2011 4:02 PM +0000 venkata.udumula(a)yahoo.co.in wrote: > Full_Name: venkata reddy > Version: 2.4.26 > OS: Windows server 2008 R2 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (170.252.70.4) The ITS System is for bug reports, not help with how to use openldap. The proper forum for your question is to use the openldap-technical(a)openldap.org mailing list. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs