openldap-bugs

openldap-bugs@openldap.org

1 participants
20961 discussions

(ITS#4971) patch for OpenLDAP 2-3-32
by jemeterisan＠mail.ru 18 May '07

18 May '07

Full_Name: Petrov Dmitry Version: 2-3-32 OS: Red Hat 9 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (81.195.208.66) Hi, guys! I had noticed, that the patch, used for 'schema-map.c' doesn't work correct. I hope, You also had checked it up. So what had I found in the function 'backsql_ad2at': The attribute name is stored in 'struct berval' structure, so if You change '.bv_val' from 'userCertificate;binary' to 'userCertificate', You should change '.bv_len' in accordance to strlen(aaa.bv_val) without strlen(";binary"). And by the way I want to store 'userCertificate' attribute type in PostrgreSQL. What type of the field in the table should I use? Just another question to the developers: I've heared that OpenLDAP is sensible to DOS attacks, so, how can I avoid this trouble? And I want to know more about this problem, if possible. With best wishes, Dmitry...

1 0

(ITS#4970) Problem between pwdReset and pwdMinAge
by py.bonnetain＠ba-consultants.fr 17 May '07

17 May '07

Full_Name: Pierre-Yves Bonnetain Version: 2.3.35 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (213.41.162.162) There is something "forgotten" in ppolicy overlay code. When pwdReset is set to TRUE, the user is properly asked to change his password. BUT if the (admin-made) previous password change is newer than pwdMinAge, the requested password change will be rejected with a "password too young" message : ----------- $ ssh somehost -l someuser Password: You are required to change your LDAP password immediately. Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information update failed: Constraint violation Password is too young to change ----------- The pwdMinAge parameter should be ignored when pwdReset is set, otherwise the user will effectively be locked out of his account while waiting for the minimum delay to expire. Here is a patch to correct this behavior. Proposed patch may not adhere to coding standards and such, so feel free to enhance it as needed . *** ppolicy.old 2007-02-08 13:31:24.000000000 +0100 --- ppolicy.c 2007-05-17 17:10:39.000000000 +0200 *************** *** 1696,1710 **** time_t pwtime = (time_t)-1, now; int age; ! if ((pa = attr_find( e->e_attrs, ad_pwdChangedTime )) != NULL) ! pwtime = parse_time( pa->a_nvals[0].bv_val ); ! now = slap_get_time(); ! age = (int)(now - pwtime); ! if ((pwtime != (time_t)-1) && (age < pp.pwdMinAge)) { ! rs->sr_err = LDAP_CONSTRAINT_VIOLATION; ! rs->sr_text = "Password is too young to change"; ! pErr = PP_passwordTooYoung; ! goto return_results; } } --- 1696,1716 ---- time_t pwtime = (time_t)-1, now; int age; ! /* Py Bonnetain, B&A Consultants : We DON'T CARE for minAge if pwdReset ! is set. */ ! if ((pa = attr_find( e->e_attrs, ad_pwdReset )) == NULL || ! ! bvmatch( &pa->a_nvals[0], &slap_true_bv) ) { ! ! if ((pa = attr_find( e->e_attrs, ad_pwdChangedTime )) != NULL) ! pwtime = parse_time( pa->a_nvals[0].bv_val ); ! now = slap_get_time(); ! age = (int)(now - pwtime); ! if ((pwtime != (time_t)-1) && (age < pp.pwdMinAge)) { ! rs->sr_err = LDAP_CONSTRAINT_VIOLATION; ! rs->sr_text = "Password is too young to change"; ! pErr = PP_passwordTooYoung; ! goto return_results; ! } } }

1 0

Re: (ITS#4965) slapd stops if access to cn=monitor is restricted
by ando＠sys-net.it 17 May '07

17 May '07

ali.pouya(a)free.fr wrote: > If I include the monitor back-end in my configuration I have to add the > following access rule as well : > > access to dn.sub="cn=monitor" by * read > > Otherwise slapd stops with the log reproduced below (my access rules include > "access to * by * none"). The problem is already fixed in HEAD: slapd starts, although it cannot register back-bdb monitor stuff unless a roodn is defined in the monitor backend. FFT: maybe the monitor database could have a default rootdn "cn=Monitor", much like the config database? p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: (ITS#4968) acl problem
by ando＠sys-net.it 17 May '07

17 May '07

zeaal_3(a)yahoo.com wrote: > Full_Name: dhiren > Version: 2.2 > OS: fedora4 > URL: > Submission from: (NULL) (203.88.149.100) > > > when i enable following acl , user not able to login client side:- > > access to attrs=userPassword > by self write > by anonymous auth > by * none > > whts problem? when disable this acl user can login. Please direct software usage questions to the openldap-software list; or, just read the first few lines of slapd.conf(5) and find the answer yourself. This ITS will be closed. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

(ITS#4969) globalization missing is com.novell.ldap.resources package
by viral_barot＠persistent.co.in 17 May '07

17 May '07

Full_Name: viral barot Version: 2.3 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (220.225.70.2) It is found that package com.novell.ldap.resources does not include many language files for globalization support. This package contains only english and spanish (ResultCodeMessages.java and ResultCodeMessages_es.java) and other language files are missing. It would be fine if following files are included. ResultCodeMessages_ja.java ResultCodeMessages_ko.java ResultCodeMessages_it.java ResultCodeMessages_fr.java ResultCodeMessages_de.java ResultCodeMessages_pt_BR.java ResultCodeMessages_zh_CN.java ResultCodeMessages_zh_TW.java Thanks.

1 0

(ITS#4968) acl problem
by zeaal_3＠yahoo.com 17 May '07

17 May '07

Full_Name: dhiren Version: 2.2 OS: fedora4 URL: Submission from: (NULL) (203.88.149.100) when i enable following acl , user not able to login client side:- access to attrs=userPassword by self write by anonymous auth by * none whts problem? when disable this acl user can login.

1 0

(ITS#4966) OpenLDAP 2.3.35 crashes on valsort overlay
by digant＠stanford.edu 16 May '07

16 May '07

Full_Name: Digant C Kasundra Version: 2.3.35 OS: Debian 3.1 URL: ftp://ftp.openldap.org/incoming/digant-kasundra-20070516.txt Submission from: (NULL) (171.64.18.9) When modding an entry, valsort seems to have crashed the server. I've uploaded the stack trace and informaiton I was able to gather out of the core dump.

1 0

(ITS#4965) slapd stops if access to cn=monitor is restricted
by ali.pouya＠free.fr 16 May '07

16 May '07

Full_Name: Ali Pouya Version: 2.2.4alpha OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (145.242.3.30) If I include the monitor back-end in my configuration I have to add the following access rule as well : access to dn.sub="cn=monitor" by * read Otherwise slapd stops with the log reproduced below (my access rules include "access to * by * none"). I can send more information if required. Thanks and best regards Ali ============================================= Log extract : >>> dnPretty: <c=fr> => ldap_bv2dn(c=fr,0) <= ldap_bv2dn(c=fr)=0 => ldap_dn2bv(272) <= ldap_dn2bv(c=fr)=0 <<< dnPretty: <c=fr> >>> dnNormalize: <c=fr> => ldap_bv2dn(c=fr,0) <= ldap_bv2dn(c=fr)=0 => ldap_dn2bv(272) <= ldap_dn2bv(c=fr)=0 <<< dnNormalize: <c=fr> end get_filter 0 => monitor_back_search => access_allowed: search access to "cn=Databases,cn=Monitor" "entry" requested => acl_get: [2] attr entry => acl_mask: access to entry "cn=Databases,cn=Monitor", attr "entry" requested => acl_mask: to all values by "", (=0) <= check a_dn_pat: cn=admin,ou=internal,ou=min,o=gouv,c=fr <= check a_dn_pat: cn=connecteur,ou=internal,ou=min,o=gouv,c=fr <= check a_dn_pat: cn=sync,ou=internal,ou=min,o=gouv,c=fr <= check a_dn_pat: ou=applications,ou=external,ou=min,o=gouv,c=fr <= check a_dn_pat: * <= acl_mask: [5] applying none(=0) (stop) <= acl_mask: [5] mask: none(=0) => slap_access_allowed: search access denied by none(=0) => access_allowed: no more rules send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=32 matched="" text="" monitor_back_register_entry_attrs(""): base="cn=databases,cn=monitor" scope=one filter="(namingContexts:distinguishedNameMatch:=c=fr)": unable to find entry ====> bdb_cache_release_all backend_startup_one: bi_db_open failed! (-1) slapd shutdown: initiated ====> bdb_cache_release_all bdb_db_close: alock_close failed slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy.

1 0

Re: Re: (ITS#4960) the memory increase qu ickly and not can be released sometime.
by hoverwf＠126.com 16 May '07

16 May '07

--Boundary-=_xCXZRVEUxxIpjyEYhiCoTxWoOQsJ Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: 7bit hi Hallvard B Furuseth <h.b.furuseth(a)usit.uio.no> thanks, this is the reason why the memory increase. Pierangelo Masarati ando(a)sys-net.it sorry, next time i will surely discussion it on the OpenLDAP-software mailing list. --Boundary-=_xCXZRVEUxxIpjyEYhiCoTxWoOQsJ Content-Type: text/html; charset="gb2312" Content-Transfer-Encoding: quoted-printable <DIV>      </DIV> <DIV>hi Hallvard B Furuseth <h.b.furuseth(a)usit.uio.no><BR> <DIV>           &n= bsp;    thanks,  this is the reason why the memory in= crease.  </DIV></DIV> <DIV> </DIV> <DIV> </DIV> <DIV>Pierangelo Masarati <A href=3D"mailto:ando@sys-net.it">ando(a)sys-net.= it</A></DIV> <DIV>           &n= bsp;    sorry,  next time i will surely discussi= on it on the OpenLDAP-software mailing list.</DIV> <DIV> </DIV><br><br><hr> <a style=3D"font-size:14px;line-height:15px; color:#000; text-decoration:= none" href=3D"http://event.mail.163.com/chanel/xyq.htm?from=3D126" target= =3D"_blank"><span style=3D"text-decoration:underline; color:blue">=C3=E2=B7= =D1=CA=D4=CD=E62006=D6=D0=B9=FA=D7=EE=BC=D1=CD=F8=C2=E7=D3=CE=CF=B7--=C3=CE= =BB=C3=CE=F7=D3=CE </span> </a> --Boundary-=_xCXZRVEUxxIpjyEYhiCoTxWoOQsJ--

1 0

Re: (ITS#4964) consumer with slapo-chain segfaults when using ldappasswd
by ando＠sys-net.it 15 May '07

15 May '07

krause(a)biochem.mpg.de wrote: > changing the the ldap password using "ldappasswd" from the command line using > the following slapd.conf on a consumer (only relevant part) crashes the server > with a "segmentation fault": The crash is now fixed in HEAD (a NULL pointer was parsed out of the referral's DN, since formally no request DN is available in that exop). However, although the password modify now is correctly resent to the producer, the consumer does not get updated. Investigating... p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs