openldap-bugs

openldap-bugs@openldap.org

1 participants
21065 discussions

Re: (ITS#6545) delta-syncrepl rejects modification master accepted
by Frank.Swasey＠uvm.edu 14 May '10

14 May '10

This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enig9D91E1E8CB10AE4177453556 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Yes, I'll have to do some work to set that up -- I'll get back to you. Frank On 5/13/10 8:44 PM, masarati(a)aero.polimi.it wrote: > I checked with HEAD and re24 (basically, 2.4.22 from CVS) and I couldn'= t > reproduce the issue. Can you provide the configuration and an example > LDIF that triggers the issue? I simply ran test043, restart both serve= rs, > and perform a modification similar to yours, and it went through with n= o > problems. > > p. > > =20 >> Full_Name: Francis Swasey >> Version: 2.4.22 >> OS: Red Hat Enterprise Linux 5 update 5 64-bit >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (132.198.107.64) >> >> >> Platform: Red Hat Enterprise Linux 5, update 5, 64-bit >> OpenLDAP: 2.4.22 (locally compiled), configured with delta-syncrepl. >> >> The following modify ldif successfully applies to the master: >> >> dn: uid=3Dfcswasey,ou=3DPeople,dc=3Duvm,dc=3Dedu >> changetype: modify >> replace: sn >> sn: Swasey >> - >> replace: sn >> sn: Swasey >> - >> >> In OpenLDAP 2.3 -- this modify ldif deck failed because the "sn" >> attribute is presented twice. In OpenLDAP 2.4 -- it works, but the >> delta-syncrepl replica pukes on it with this error: >> >> syncrepl_message_to_op: rid=3D100 mods check (sn: value #0 provided mo= re >> than once) >> >> >> >> =20 > =20 --=20 Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900) --------------enig9D91E1E8CB10AE4177453556 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.14 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBAgAGBQJL7YngAAoJEK5S4SsZ5NvSXhMP/24kilppZcRb+NHqXnP1yqaP 3Y4U/6UJ4E6/oVOccr2trGXzCk4LDPyRvGrlY9SouX5Rf8Y7FsddoE0aiTN3mU+L xd4iTsExl7lTTuPZ55BvLBgCQWIkwppArXR/u8OasNTtIcgdDPKVkjbCsGY6xcji ISefkXix5jNgqOe6dQl/DTfJtsAQepCC18t2AvFh727udKu592e5lawlvc3EBH9C ZB+8Pn7iKbVsUX9htwD3PQY+v52SAgmANoPvbTIeH7HQiclqLBi5qgWW9EbOt43Y 716+FCB55M5W5SKSiFncj45UVAv7z+E1qVuduzcFDuX0LrnC1BMjL/9SbIN2IQX6 ATMrsR1DgxIlBFrKuEAyyQ3IdWMlEtNZQsKj1p+z3YXAJT6C2u8RC3slyL11vMAH OvkOLwj56Nlib70Zezuevh/5R+KnzEipVrGosIbsZSmTUx32MR4ByRy8DMi8uNkt JEGSULErsfQEiCr1UsFnwO7d06bf+m0NvcvxTJYvWPBXOjMkTQja1cKnxdEtgoP5 Qg9MZKia3PqO6lQUHgIkRfcqutbuJ+IIuQJ8/oijD3zc198fuUurtiIis/2mjRQv 1Jd/sa52A4z3YFqQ4GyEJokzxFa3xwF4pIoO8NEf1nE1kvUid2gBfqpIfn+SlwBQ nEKtuFX8bXBV0y2Ze3tv =7Ac3 -----END PGP SIGNATURE----- --------------enig9D91E1E8CB10AE4177453556--

1 0

Re: (ITS#6550) Patch for smbk5pwd slapd overlay to include shadowLastChange
by hyc＠symas.com 14 May '10

14 May '10

Michael Ströder wrote: > Howard Chu wrote: >> michael(a)stroeder.com wrote: >>> michael(a)stroeder.com wrote: >>>> I'd rather argue that for >>>> Samba 3 'sambaPwdLastSet' should be set. >>> >>> Uumpf! This is already set. Sorry for the noise. >>> >>>> 'shadowLastChange' is rather a POSIX account attribute which from my >>>> understanding is out-of-scope for slapo-smbk5pwd. Well, the scope >>>> could be >>>> extended... >>> >>> But still it's the question whether we want to have this functionality >>> for >>> various password-related attribute all in on overlay or whether there >>> should >>> be distinct overlays for each account type (posixAccount/shadowAccount, >>> sambaSAMAccount, Kerberos user). >> >> shadowAccount is deprecated. LDAP ppolicy already provides a >> pwdChangedTime attribute. > > While I agree that slapo-ppolicy is the better solution in the long run I see > no reason why to not set both attributes at the server's side to make older > LDAP clients happy. This is not a realistic use case. smbk5pwd was written starting in 2004; pam_ldap started supporting LDAP password policy long before then. Anyone running LDAP clients (pam_ldap, nss_ldap) older than that has far worse problems to worry about. >> Ultimately both Kerberos and Samba will just be using LDAP ppolicy. > > Yes. But there is indeed a real need for a solution in the meantime... Yes, in the meantime both Heimdal and Samba use the smbPwdLastSet attribute which is already taken care of. This ITS will be closed. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6550) Patch for smbk5pwd slapd overlay to include shadowLastChange
by michael＠stroeder.com 14 May '10

14 May '10

Howard Chu wrote: > michael(a)stroeder.com wrote: >> michael(a)stroeder.com wrote: >>> I'd rather argue that for >>> Samba 3 'sambaPwdLastSet' should be set. >> >> Uumpf! This is already set. Sorry for the noise. >> >>> 'shadowLastChange' is rather a POSIX account attribute which from my >>> understanding is out-of-scope for slapo-smbk5pwd. Well, the scope >>> could be >>> extended... >> >> But still it's the question whether we want to have this functionality >> for >> various password-related attribute all in on overlay or whether there >> should >> be distinct overlays for each account type (posixAccount/shadowAccount, >> sambaSAMAccount, Kerberos user). > > shadowAccount is deprecated. LDAP ppolicy already provides a > pwdChangedTime attribute. While I agree that slapo-ppolicy is the better solution in the long run I see no reason why to not set both attributes at the server's side to make older LDAP clients happy. > Ultimately both Kerberos and Samba will just be using LDAP ppolicy. Yes. But there is indeed a real need for a solution in the meantime... Ciao, Michael.

1 0

Re: (ITS#6550) Patch for smbk5pwd slapd overlay to include shadowLastChange
by michael＠stroeder.com 14 May '10

14 May '10

Mark A. Ziesemer wrote: > 2010/5/14 Michael Ströder <michael(a)stroeder.com > <mailto:michael@stroeder.com>> > 'shadowLastChange' is rather a POSIX account attribute which from my > understanding is out-of-scope for slapo-smbk5pwd. Well, the scope could be > extended... > > I guess I wouldn't have any objections if all the references to "shadow" > were renamed to "posix". However, the shadowLastChange attribute is > part of the shadowAccount objectClass - with neither of these names > referring to POSIX. I didn't consider to change the name of the attribute. With POSIX account data I rather wanted to point to RFC 2307 where posixAccount and shadowAccount object classes and the accompanying attributes are defined. Don't get me wrong. I support the idea of setting shadowLastChange even if Howard considers it to be deprecated. And I have no objections to a one-sets-all-of-these overlay. But I'd even like to see this overlay available as standard feature. Since in the current state it has build dependencies to Kerberos libs this is not easy. Only building the Samba support is possible and needs some tweaking of the Makefile. > There are many issues posted online with all the password attributes > except shadowLastChange getting updated. This patch should provide a > solution for many of these cases. Yupp. I already thought these problems long ago when implementing the different password change use-cases in web2ldap. Ciao, Michael.

1 0

Re: (ITS#6550) Patch for smbk5pwd slapd overlay to include shadowLastChange
by online＠mark.ziesemer.com 14 May '10

14 May '10

--00504501586f17398e04868dddb7 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable 2010/5/14 Michael Str=F6der <michael(a)stroeder.com> > online(a)mark.ziesemer.com wrote: > > Full_Name: Mark A. Ziesemer > > Version: 2.4.21 / HEAD > > OS: Ubuntu Linux > > URL: ftp://ftp.openldap.org/incoming/smbk5pwd-shadow-b.patch > > Submission from: (NULL) (2001:470:1f11:3ae:dc54:73ba:be16:148) > > > > Using the PasswordModify Extended Operation (exop) along with the > smbk5pwd slapd > > overlay provides several benefits, but does not currently include the > > shadowLastChange attribute of the shadowAccount class. This means the > > shadowLastChange is missed from update, unless specially done along wit= h > a > > PasswordModify. > > While I agree that this could be useful in general I'd rather argue that > for > Samba 3 'sambaPwdLastSet' should be set. > sambaPwdLastSet is already handled by the "samba" portion of this overlay. 'shadowLastChange' is rather a POSIX account attribute which from my > understanding is out-of-scope for slapo-smbk5pwd. Well, the scope could b= e > extended... > I guess I wouldn't have any objections if all the references to "shadow" were renamed to "posix". However, the shadowLastChange attribute is part o= f the shadowAccount objectClass - with neither of these names referring to POSIX. I had considered a separate overlay. However, in terms of purpose, shared code, functionality, and performance, it seems to make the most sense to include this addition into the smbk5pwd overlay. Both pam_ldap and the Samba client support use of exop password changes. Additionally, pam_ldap doesn't appear to support hashing to SSHA (only MD5, which is also the default) - so setting to "exop" also allows for a stronge= r hash of the password to be stored. With the unpatched overlay, doing an exop password change updates userPassword (used by POSIX), as well as all the Samba attributes: sambaLMPassword, sambaNTPassword, and sambaPwdLastSet . This allows Samba clients to use the updated password as well as seeing when the password was last set, but POSIX clients do not see an updated shadowLastChange. This patch adds support for the otherwise missing shadowLastChange, keeping everything consistent. There are many issues posted online with all the password attributes except shadowLastChange getting updated. This patch should provide a solution for many of these cases. > Ciao, Michael. > -- Mark A. Ziesemer www.ziesemer.com --00504501586f17398e04868dddb7 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable <div class=3D"gmail_quote">2010/5/14 Michael Str=F6der <span dir=3D"ltr">&l= t;<a href=3D"mailto:michael@stroeder.com">michael(a)stroeder.com</a>></spa= n><br><blockquote class=3D"gmail_quote" style=3D"margin: 0pt 0pt 0pt 0.8ex;= border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"> <a href=3D"mailto:online@mark.ziesemer.com">online(a)mark.ziesemer.com</a> wr= ote:<br> > Full_Name: Mark A. Ziesemer<br> > Version: 2.4.21 / HEAD<br> > OS: Ubuntu Linux<br> > URL: <a href=3D"ftp://ftp.openldap.org/incoming/smbk5pwd-shadow-b.patc= h" target=3D"_blank">ftp://ftp.openldap.org/incoming/smbk5pwd-shadow-b.patc= h</a><br> > Submission from: (NULL) (2001:470:1f11:3ae:dc54:73ba:be16:148)<br> ><br> > Using the PasswordModify Extended Operation (exop) along with the smbk= 5pwd slapd<br> > overlay provides several benefits, but does not currently include the<= br> > shadowLastChange attribute of the shadowAccount class. =A0This means t= he<br> > shadowLastChange is missed from update, unless specially done along wi= th a<br> > PasswordModify.<br> <br> While I agree that this could be useful in general I'd rather argue tha= t for<br> Samba 3 'sambaPwdLastSet' should be set.<br></blockquote><div><br>s= ambaPwdLastSet is already handled by the "samba" portion of this = overlay. <br><br></div><blockquote class=3D"gmail_quote" style=3D"margin: 0= pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: = 1ex;"> 'shadowLastChange' is rather a POSIX account attribute which from m= y<br> understanding is out-of-scope for slapo-smbk5pwd. Well, the scope could be<= br> extended...<br></blockquote><div><br>I guess I wouldn't have any object= ions if all the references to "shadow" were renamed to "posi= x".=A0 However, the shadowLastChange attribute is part of the shadowAc= count objectClass - with neither of these names referring to POSIX.<br> <br>I had considered a separate overlay.=A0 However, in terms of purpose, s= hared code, functionality, and performance, it seems to make the most sense= to include this addition into the smbk5pwd overlay.<br><br>Both pam_ldap a= nd the Samba client support use of exop password=20 changes.=A0 Additionally, pam_ldap doesn't appear to support hashing to= =20 SSHA (only MD5, which is also the default) - so setting to "exop"= also=20 allows for a stronger hash of the password to be stored.<br> <br>With the unpatched overlay, doing an exop password change updates userP= assword (used by POSIX), as well as all the Samba attributes: sambaLMPasswo= rd, sambaNTPassword, and sambaPwdLastSet .=A0 This allows Samba clients to = use the updated password as well as seeing when the password was last set, = but POSIX clients do not see an updated shadowLastChange.=A0 This patch add= s support for the otherwise missing shadowLastChange, keeping everything co= nsistent.<br> =A0<br>There are many issues posted online with all the password attributes= except shadowLastChange getting updated.=A0 This patch should provide a so= lution for many of these cases.<br><br></div><blockquote class=3D"gmail_quo= te" style=3D"margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204= , 204); padding-left: 1ex;"> <br> Ciao, Michael.<br></blockquote><div>=A0</div></div>--<br>Mark A. Ziesemer<b= r><a href=3D"http://www.ziesemer.com">www.ziesemer.com</a><br> --00504501586f17398e04868dddb7--

1 0

Re: (ITS#6550) Patch for smbk5pwd slapd overlay to include shadowLastChange
by hyc＠symas.com 14 May '10

14 May '10

michael(a)stroeder.com wrote: > michael(a)stroeder.com wrote: >> I'd rather argue that for >> Samba 3 'sambaPwdLastSet' should be set. > > Uumpf! This is already set. Sorry for the noise. > >> 'shadowLastChange' is rather a POSIX account attribute which from my >> understanding is out-of-scope for slapo-smbk5pwd. Well, the scope could be >> extended... > > But still it's the question whether we want to have this functionality for > various password-related attribute all in on overlay or whether there should > be distinct overlays for each account type (posixAccount/shadowAccount, > sambaSAMAccount, Kerberos user). shadowAccount is deprecated. LDAP ppolicy already provides a pwdChangedTime attribute. > Personally I'd like to see this overlay moved from contrib/ into the standard > build. But for Kerberos-related attributes the build and schema dependencies > are an obstacle. => separate overlays at least for KDC/LDAP and Samba-Posix/LDAP. Ultimately both Kerberos and Samba will just be using LDAP ppolicy. But yes, the build dependencies are still annoying. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6550) Patch for smbk5pwd slapd overlay to include shadowLastChange
by michael＠stroeder.com 14 May '10

14 May '10

michael(a)stroeder.com wrote: > I'd rather argue that for > Samba 3 'sambaPwdLastSet' should be set. Uumpf! This is already set. Sorry for the noise. > 'shadowLastChange' is rather a POSIX account attribute which from my > understanding is out-of-scope for slapo-smbk5pwd. Well, the scope could be > extended... But still it's the question whether we want to have this functionality for various password-related attribute all in on overlay or whether there should be distinct overlays for each account type (posixAccount/shadowAccount, sambaSAMAccount, Kerberos user). Personally I'd like to see this overlay moved from contrib/ into the standard build. But for Kerberos-related attributes the build and schema dependencies are an obstacle. => separate overlays at least for KDC/LDAP and Samba-Posix/LDAP. Ciao, Michael.

1 0

Re: (ITS#6550) Patch for smbk5pwd slapd overlay to include shadowLastChange
by michael＠stroeder.com 14 May '10

14 May '10

online(a)mark.ziesemer.com wrote: > Full_Name: Mark A. Ziesemer > Version: 2.4.21 / HEAD > OS: Ubuntu Linux > URL: ftp://ftp.openldap.org/incoming/smbk5pwd-shadow-b.patch > Submission from: (NULL) (2001:470:1f11:3ae:dc54:73ba:be16:148) > > Using the PasswordModify Extended Operation (exop) along with the smbk5pwd slapd > overlay provides several benefits, but does not currently include the > shadowLastChange attribute of the shadowAccount class. This means the > shadowLastChange is missed from update, unless specially done along with a > PasswordModify. While I agree that this could be useful in general I'd rather argue that for Samba 3 'sambaPwdLastSet' should be set. 'shadowLastChange' is rather a POSIX account attribute which from my understanding is out-of-scope for slapo-smbk5pwd. Well, the scope could be extended... Ciao, Michael.

1 0

(ITS#6550) Patch for smbk5pwd slapd overlay to include shadowLastChange
by online＠mark.ziesemer.com 14 May '10

14 May '10

Full_Name: Mark A. Ziesemer Version: 2.4.21 / HEAD OS: Ubuntu Linux URL: ftp://ftp.openldap.org/incoming/smbk5pwd-shadow-b.patch Submission from: (NULL) (2001:470:1f11:3ae:dc54:73ba:be16:148) Using the PasswordModify Extended Operation (exop) along with the smbk5pwd slapd overlay provides several benefits, but does not currently include the shadowLastChange attribute of the shadowAccount class. This means the shadowLastChange is missed from update, unless specially done along with a PasswordModify. This patch adds support for updating shadowLastChange into the smbk5pwd overlay for slapd. An added benefit is that once the updated overlay is in effect, write access to the shadowLastChange attribute can optionally be restricted by configuration, preventing users from updating shadowLastChange without actually updating their password. The SHA-1 hash of the provided patch (smbk5pwd-shadow-b.patch) is c29ff518ea4fe03a4c5ee87d07a3af0082256950 . (Please discard "smbk5pwd-shadow.patch".) Patch was generated against HEAD just now, but also applies cleanly to 2.4.21. I am currently using the patched overlay in my current environment without noticeable issue. However, C is not current primary language, so please give appropriate attention to review. This patch file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch were developed by Mark A. Ziesemer <online(a)mark.ziesemer.com>. I have not assigned rights and/or interest in this work to any party. I, Mark A. Ziesemer, hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

Re: (ITS#6545) delta-syncrepl rejects modification master accepted
by masarati＠aero.polimi.it 14 May '10

14 May '10

I checked with HEAD and re24 (basically, 2.4.22 from CVS) and I couldn't reproduce the issue. Can you provide the configuration and an example LDIF that triggers the issue? I simply ran test043, restart both servers, and perform a modification similar to yours, and it went through with no problems. p. > Full_Name: Francis Swasey > Version: 2.4.22 > OS: Red Hat Enterprise Linux 5 update 5 64-bit > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (132.198.107.64) > > > Platform: Red Hat Enterprise Linux 5, update 5, 64-bit > OpenLDAP: 2.4.22 (locally compiled), configured with delta-syncrepl. > > The following modify ldif successfully applies to the master: > > dn: uid=fcswasey,ou=People,dc=uvm,dc=edu > changetype: modify > replace: sn > sn: Swasey > - > replace: sn > sn: Swasey > - > > In OpenLDAP 2.3 -- this modify ldif deck failed because the "sn" > attribute is presented twice. In OpenLDAP 2.4 -- it works, but the > delta-syncrepl replica pukes on it with this error: > > syncrepl_message_to_op: rid=100 mods check (sn: value #0 provided more > than once) > > >

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs