openldap-bugs

openldap-bugs@openldap.org

1 participants
21003 discussions

Re: (ITS#6017) Implement parentGUID or similar in OpenLDAP
by ando＠sys-net.it 12 Mar '09

12 Mar '09

abartlet(a)samba.org wrote: > I found the formal spec in MS-ADTS: > > It currently reads: > > 3.1.1.4.5.28 parentGUID > This attribute is not present on an object that is the root of an NC. > For all other objects, let TO be > the object from which the parentGUID attribute is being read and let > TP be TO!parent. > TO!parentGUID is equal to TP!objectGUID. Sounds like a nightmare of internal searches if we want to generate it on the fly (although possibly acceptable by those queries that require it). It might be worth to consider storing it in directory, and track add/rename operations accordingly. The overlay that implements it should also provide a tool hook for bi_tool_entry_put. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#6018) TLS memory leak
by Pierangelo Masarati 12 Mar '09

12 Mar '09

2.3.32 is obsolete. It's pointless to debug it. Please check whether the problem persists in 2.4.15. p.

1 0

(ITS#6018) TLS memory leak
by timling2003＠gmail.com 12 Mar '09

12 Mar '09

Full_Name: Tim Ling Version: 2.3.32 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (202.111.48.66) I develop a client of LDAP with TLS/SSL. This client is a daemon to query LDAP server. For SSL, I use ldap_initialize(ld, "ldaps://..."). For TLS, I use ldap_start_tls_s( ld, NULL, NULL ). I also use ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &protocol ) (protocol=3) and ldap_set_option( NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &rc ) (rc=0). The method of bind is LDAP_AUTH_SIMPLE. For every request, I will call ldap_initialize(). After that, I will use ldap_unbind_s(ld). ( I cannot use ldap_pvt_tls_destroy(), because this function can be called only once ). After handling a lot of requests, it will cause memory leak.

1 0

Re: (ITS#6016) Make moduleload automatic
by ando＠sys-net.it 12 Mar '09

12 Mar '09

hyc(a)symas.com wrote: > Right. I think we'll go with another approach instead - Samba will always spit > out moduleload directives. We'll change moduleload to check for > already-existing backends or overlays, and silently succeed in those cases. Well, I think we could also provide sort of an off-line means to check what is statically built-in and what's not. In principle, one could implement tool mode in back-monitor and perform a echo "database monitor" > slapd.conf slapcat -f slapd.conf -s "cn=Backends,cn=Monitor" | grep whatever slapcat -f slapd.conf -s "cn=Overlays,cn=Monitor" | grep whatever to find what's available. If it fails, back-monitor itself is needed; then echo "modulepath path/to/back-monitor" > slapd.conf echo "moduleload back_monitor.la" >> slapd.conf echo "database monitor" >> slapd.conf slapcat -f slapd.conf -s "cn=Backends,cn=Monitor" | grep whatever slapcat -f slapd.conf -s "cn=Overlays,cn=Monitor" | grep whatever Looks like an overkill, but it might be of general usefulness. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#6016) Make moduleload automatic
by hyc＠symas.com 11 Mar '09

11 Mar '09

Pierangelo Masarati wrote: > hyc(a)symas.com wrote: >> As a further clarification - we're only considering this for backends and >> overlays; other dynamically loaded elements' (like syntaxes, password hashes, >> whatever) behavior will not be changed. > > I see quite a few issues (unless already discussed). For example, one > would typically discover the need to load back_monitor.la only close to > the end of the configuration, while the module defines some specific > schema and even some specific calls that may be needed by other backends > instantiated earlier in order to allow custom monitoring. I guess the > problem can be generalized. Right. I think we'll go with another approach instead - Samba will always spit out moduleload directives. We'll change moduleload to check for already-existing backends or overlays, and silently succeed in those cases. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6016) Make moduleload automatic
by ando＠sys-net.it 11 Mar '09

11 Mar '09

hyc(a)symas.com wrote: > abartlet(a)samba.org wrote: >> Full_Name: Andrew Bartlett >> Version: 2.4.15 >> OS: Fedora 9 >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (59.167.251.137) >> >> >> In Samba4, we generate a slapd.conf for OpenLDAP as part of our >> provision-backend process. This avoids administrators needing to guess at >> Samba's specific requirements. >> >> However, this places the Samba4 software in the position of having to guess how >> this host's OpenLDAP installation was compiled. In particular, we need to guess >> if the required overlays are built in, or modules. >> >> Work was done a while back to avoid us having to guess what the module path is >> (the default is is now hard-coded in the binary), but we still have to guess >> which set of modules to load. Currently this is done in 'make test' by guessing >> different sets of modules in an included 'modules.conf' and running slaptest >> until we find a combination that works. >> >> We (Samba4) would really like it if the slapd binary would load modules >> (assuming a one-to-one mapping between overlay/backend names and modules) from >> that default path, if not found static in the binary. >> >> This way, Samba would not specify modules at all in the slapd.conf, but they >> would be loaded as required, if required. >> >> Thanks, >> >> Andrew Bartlett >> >> (As discussed with Howard Chu on #openldap-devel) >> > As a further clarification - we're only considering this for backends and > overlays; other dynamically loaded elements' (like syntaxes, password hashes, > whatever) behavior will not be changed. I see quite a few issues (unless already discussed). For example, one would typically discover the need to load back_monitor.la only close to the end of the configuration, while the module defines some specific schema and even some specific calls that may be needed by other backends instantiated earlier in order to allow custom monitoring. I guess the problem can be generalized. > And before we go there, what if we just provided a slapd option to dump out > all of its compiled-in paths? Then you could inspect the modulepath and see > whether any modules of interest reside there. ? p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#6017) Implement parentGUID or similar in OpenLDAP
by abartlet＠samba.org 11 Mar '09

11 Mar '09

--=-IfMlemfEuIIh4cVKP58C Content-Type: text/plain Content-Transfer-Encoding: quoted-printable I found the formal spec in MS-ADTS: It currently reads: 3.1.1.4.5.28 parentGUID This attribute is not present on an object that is the root of an NC. For all other objects, let TO be the object from which the parentGUID attribute is being read and let TP be TO!parent. TO!parentGUID is equal to TP!objectGUID. --=20 Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. --=-IfMlemfEuIIh4cVKP58C Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQBJuINDz4A8Wyi0NrsRAovEAJ9ENJCjmWM0oiK43uK9GWLOWzhzBACbBGpS geE0JFNIqoWTAWYGV5JpJNo= =l42G -----END PGP SIGNATURE----- --=-IfMlemfEuIIh4cVKP58C--

1 0

(ITS#6017) Implement parentGUID or similar in OpenLDAP
by abartlet＠samba.org 11 Mar '09

11 Mar '09

Full_Name: Andrew Bartlett Version: 2.4.15 OS: Fedora 9 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (59.167.251.137) Samba4 would find it most helpful if OpenLDAP would be able to present an operational attribute 'parentGUID' similar to the one that Windows 2008 has implemented in AD. http://msdn.microsoft.com/en-us/library/cc221277(PROT.13).aspx Formalised details of the required semantics are not very clear at this point (I will request clarification from Microsoft on this), but for now: The root entries on a partition have no parentGUID All other entries have a value parentGUID equal to the objectGUID of the parent This value is available in search results if requested. As Samba handles the translation from text to binary, feel free to use the existing entryUUID formatting. Implementing this would avoid Samba having to perform an auxillary search to find this information, which should be very cheaply available to hdb when it is resolving the DN. Thanks, Andrew Bartlett (Discussed with Howard Chu on #openldap-devel)

1 0

Re: (ITS#6016) Make moduleload automatic
by hyc＠symas.com 11 Mar '09

11 Mar '09

abartlet(a)samba.org wrote: > Full_Name: Andrew Bartlett > Version: 2.4.15 > OS: Fedora 9 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (59.167.251.137) > > > In Samba4, we generate a slapd.conf for OpenLDAP as part of our > provision-backend process. This avoids administrators needing to guess at > Samba's specific requirements. > > However, this places the Samba4 software in the position of having to guess how > this host's OpenLDAP installation was compiled. In particular, we need to guess > if the required overlays are built in, or modules. > > Work was done a while back to avoid us having to guess what the module path is > (the default is is now hard-coded in the binary), but we still have to guess > which set of modules to load. Currently this is done in 'make test' by guessing > different sets of modules in an included 'modules.conf' and running slaptest > until we find a combination that works. > > We (Samba4) would really like it if the slapd binary would load modules > (assuming a one-to-one mapping between overlay/backend names and modules) from > that default path, if not found static in the binary. > > This way, Samba would not specify modules at all in the slapd.conf, but they > would be loaded as required, if required. > > Thanks, > > Andrew Bartlett > > (As discussed with Howard Chu on #openldap-devel) > As a further clarification - we're only considering this for backends and overlays; other dynamically loaded elements' (like syntaxes, password hashes, whatever) behavior will not be changed. And before we go there, what if we just provided a slapd option to dump out all of its compiled-in paths? Then you could inspect the modulepath and see whether any modules of interest reside there. ? -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#6016) Make moduleload automatic
by abartlet＠samba.org 11 Mar '09

11 Mar '09

Full_Name: Andrew Bartlett Version: 2.4.15 OS: Fedora 9 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (59.167.251.137) In Samba4, we generate a slapd.conf for OpenLDAP as part of our provision-backend process. This avoids administrators needing to guess at Samba's specific requirements. However, this places the Samba4 software in the position of having to guess how this host's OpenLDAP installation was compiled. In particular, we need to guess if the required overlays are built in, or modules. Work was done a while back to avoid us having to guess what the module path is (the default is is now hard-coded in the binary), but we still have to guess which set of modules to load. Currently this is done in 'make test' by guessing different sets of modules in an included 'modules.conf' and running slaptest until we find a combination that works. We (Samba4) would really like it if the slapd binary would load modules (assuming a one-to-one mapping between overlay/backend names and modules) from that default path, if not found static in the binary. This way, Samba would not specify modules at all in the slapd.conf, but they would be loaded as required, if required. Thanks, Andrew Bartlett (As discussed with Howard Chu on #openldap-devel)

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs