openldap-bugs

openldap-bugs@openldap.org

1 participants
20966 discussions

(ITS#6567) Enable GSSAPI support and expose ldap_gssadpi_bind_s
by ssalley＠likewise.com 01 Jun '10

01 Jun '10

Full_Name: Scott Salley Version: HEAD OS: Linux URL: http://archives.likewiseopen.org/~ssalley/OpenLDAP/scott-salley-100601-defi… Submission from: (NULL) (67.51.54.234) Note that a similar issue/contribution was submitted in 2008 (Contrib/5369) and appears to have been 'lost'. The patch http://archives.likewiseopen.org/~ssalley/OpenLDAP/scott-salley-100601-defi… makes it possible to use the GSSAPI support in OpenLDAP by: 1. Defining --with-gssapi in configure which a. Checks for appropriate header files b. Checks for the appropriate library c. Defines HAVE_GSSAPI to 1 in everything is in order 2. Exposing ldap_gssapi_bind_s in ldap.h

1 0

(ITS#6566) rwm, ppolicy, sssvlv, and valsort display warnings on STDERR
by mhardin＠symas.com 01 Jun '10

01 Jun '10

Full_Name: Matt Hardin Version: 2.4.22 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (74.38.117.141) rwm, ppolicy, sssvlv, and valsort display warnings on STDERR, not syslog. It seems these warnings should go into syslog instead.

1 0

Re: (ITS#6565) DNSSRV referrals: chaining without search base
by masarati＠aero.polimi.it 01 Jun '10

01 Jun '10

> Hi, > this is a partly duplicate of ITS 6463: I think it's better to split > these 2 > items into 2 separate ITS. > > This ITS only describes the behaviour of OpenLDAP using referrals > generated by > DNSSRV; just ldap (no ldaps) is used. > > You stated that not returning DNs in DNSSRV "conforms to RFC4511". This > seems to > be OK. Nevertheless these returned URLs are used in the chaining code. > > This means that the chained search always searches with base "" (root). I > don't > think that this the right behavior. > > I debugged the code several hours but couldn't find a solution. What I > could > see: > - dnssrv_back_referrals just puts server names into the referral structure > ("ref") > - the functions called afterwards - esp. ldap_chain_op - parse this > structure > "ref" for server names AND DNs (search bases) > > I'm sorry, my knowledge of the OpenLDAP code is not deep enough to propose > a > solution. But I think that this should be fixed: Chained Searches with "" > as > search base in a distributed environment can't really work: problems like > - some servers don't support this kind of search > - loop detection > - access control > are there. Hi. I don't have time to work at this right now, but I think the solution would be to modify slapo-chain(5) so that when a referral's DN is "" and the DN in the original request is not "", to use that DN instead. The original request DN can be found in op->o_req_dn. p.

1 0

(ITS#6565) DNSSRV referrals: chaining without search base
by jochen＠keutel.de 01 Jun '10

01 Jun '10

Full_Name: Jochen Keutel Version: 2.4.22 OS: Solaris 10 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (87.159.200.236) Hi, this is a partly duplicate of ITS 6463: I think it's better to split these 2 items into 2 separate ITS. This ITS only describes the behaviour of OpenLDAP using referrals generated by DNSSRV; just ldap (no ldaps) is used. You stated that not returning DNs in DNSSRV "conforms to RFC4511". This seems to be OK. Nevertheless these returned URLs are used in the chaining code. This means that the chained search always searches with base "" (root). I don't think that this the right behavior. I debugged the code several hours but couldn't find a solution. What I could see: - dnssrv_back_referrals just puts server names into the referral structure ("ref") - the functions called afterwards - esp. ldap_chain_op - parse this structure "ref" for server names AND DNs (search bases) I'm sorry, my knowledge of the OpenLDAP code is not deep enough to propose a solution. But I think that this should be fixed: Chained Searches with "" as search base in a distributed environment can't really work: problems like - some servers don't support this kind of search - loop detection - access control are there. Regards, Jochen.

1 0

ITS#6564
by masarati＠aero.polimi.it 28 May '10

28 May '10

Is this a joke or what? Version 2.2.23 was released about 2005 (as stated by the log message you report). The current release is 2.4.22. The LDIF you're reporting dn: dc=HVRNG1,dc=com objectclass: dcObject objectclass: comanization o: Domain Server dc: HVRNG1 dn: cn=root,dc=HVRNG1,dc=com objectclass: comanizationalRole cn: root clearly contains a typo (twice), assuming by "comanization" you mean "organization". You need to leave one blank like between entries. In any case, the ITS is intended to report software bugs; usage questions should be directed to openldap-technical(a)openldap.org (you need to subscribe first). This ITS will be closed. p.

1 0

Re: (ITS#6563) slapadd locks up shared memory segments
by aravind＠freeshell.org 28 May '10

28 May '10

I now have a fully patched (with the stuff on the oracle/sleepycat) build with db-4.6.21, and it seems to be working correctly with the patches. You can close the its, sorry for the noise and thanks for the help.

1 0

(ITS#6564) Problem of parsing
by herve.gouyet＠free.fr 28 May '10

28 May '10

Full_Name: herve gouyet Version: vendredi 21 octobre 2005, 16:04:16 OS: Windows XP PRO URL: Submission from: (NULL) (82.241.150.119) I don't know the version but its probably the last (i try to install openLdap this week). slapd.exe : $OpenLDAP: slapd 2.2.29 (Oct 21 2005 16:01:14) $ My problem is that i receive the message slapadd : could not parse entry when i run "slapadd -f slapd.conf -l init.ldif". I try to had or remove blanks everywhere. Everytime it's the same error, line number = the last line +1 I search on google, but all propositions found give the same result. My last try of init.ldif --------------------------- dn: dc=HVRNG1,dc=com objectclass: dcObject objectclass: comanization o: Domain Server dc: HVRNG1 dn: cn=root,dc=HVRNG1,dc=com objectclass: comanizationalRole cn: root my ldap.conf ------------------- # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # ucdata-path ./ucdata include ./schema/core.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap:/root.openldap.org pidfile ./run/slapd.pid argsfile ./run/slapd.args # Load dynamic backend modules: # modulepath ./libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=HVRNG1,dc=com" rootdn "cn=Manager,dc=HVRNG1,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory ./data # Indices to maintain index objectClass eq Thanks Hervé GOUYET

1 0

Re: (ITS#6563) slapadd locks up shared memory segments
by aravind＠freeshell.org 27 May '10

27 May '10

On Thu, May 27, 2010 at 8:43 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wr= ote: > Is that BDB 4.6.21 with or without the patches from Sleepycat/Oracle? =C2= =A0IIRC > they are required to be in place to have a functioning BDB build. > This is straight 4.6.21 without the oracle patches. I am working on building a new package with the patches. I will report back if a patched BDB fixes the problems.

1 0

Re: (ITS#6563) slapadd locks up shared memory segments
by quanah＠zimbra.com 27 May '10

27 May '10

--On Wednesday, May 26, 2010 10:54 PM -0700 Aravind Gottipati=20 <aravind(a)freeshell.org> wrote: > On Wed, May 26, 2010 at 8:38 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> > wrote: >> You should use db_recover from the appropriate bdb release to clean them >> up. =C2=A0Not ipcrm. =C2=A0You also fail to note which version of BDB = you are >> linked against. =C2=A0I've certainly never seen this issue. > > I am using Berkeley DB 4.6.21. > > I didn't think to use a db_recover right after slapadd was done since > I assumed that it would be a clean database. When slapd didn't start, > I did try a db_recover, but it didn't help. Is that BDB 4.6.21 with or without the patches from Sleepycat/Oracle? IIRC = they are required to be in place to have a functioning BDB build. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#6556) test031 core dumps after applying first filter
by dieter＠dkluenter.de 27 May '10

27 May '10

Hi, I have run slapd in valgrind now. The full log kan be found here: http://pastebin.de/6914 In short, valgrind reported following error: =20 =3D15353=3D=3D 1 errors in context 1 of 5: =3D=3D15353=3D=3D Invalid write of size 4 =3D=3D15353=3D=3D at 0x80E64B5: slap_sl_free (sl_malloc.c:492) =3D=3D15353=3D=3D by 0x80A0EEA: ch_free (ch_malloc.c:137) =3D=3D15353=3D=3D by 0x80E3DC9: mra_free (mra.c:43) =3D=3D15353=3D=3D by 0x80855B0: filter_free_x (filter.c:556) =3D=3D15353=3D=3D by 0x80836CD: do_search (search.c:230) =3D=3D15353=3D=3D by 0x8080588: connection_operation (connection.c:1109) =3D=3D15353=3D=3D by 0x403B376: ldap_int_thread_pool_wrapper (tpool.c:68= 5) =3D=3D15353=3D=3D by 0x43046E4: start_thread (in /lib/libpthread-2.10.1.= so) =3D=3D15353=3D=3D by 0x43045FF: ??? (in /lib/libpthread-2.10.1.so) =3D=3D15353=3D=3D Address 0x843692b1 is not stack'd, malloc'd or (recently= ) free'd -Dieter --=20 Dieter Kl=C3=BCnter | Systemberatung sip: +49.40.20932173 http://www.dpunkt.de/buecher/2104.html GPG Key ID:8EF7B6C6

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs