openldap-bugs

openldap-bugs@openldap.org

1 participants
20961 discussions

(ITS#8747) LDAP load balancer daemon (lloadd)
by ondra＠openldap.org 28 Sep '17

28 Sep '17

Full_Name: Ondrej Kuznik Version: master OS: URL: https://github.com/mistotebe/openldap/tree/lloadd Submission from: (NULL) (82.10.24.68) The 'lloadd' branch linked above contains the load balancer code that is now ready for review. This adds a new server to the OpenLDAP project, a load balancing proxy (prototype). Also, the tls branch contains the work in progress toward StartTLS/ldaps support (which works apart from certificate checking) and can be merged once ITS#8746 has been closed. To test, make sure you have libevent >= 2.0 installed and regenerate the configure script which now accepts the --enable-balancer option. The code in question has only been compiled/tested on Linux so far.

1 0

(ITS#8746) Add ldap_pvt_tls_connect()
by ondra＠openldap.org 28 Sep '17

28 Sep '17

Full_Name: Ondrej Kuznik Version: master OS: URL: ftp://ftp.openldap.org/incoming/Ondrej-Kuznik-20170928-ldap_pvt_tls_connect… Submission from: (NULL) (82.10.24.68) There is no way to reuse the libldap implementation to set up a client TLS layer on a Sockbuf. This exposes ldap_int_tls_connect through ldap_pvt.h as ldap_pvt_tls_connect. Needless to say, skipping the full libldap infrastructure means it is up to the user to do certificate verification etc. when using this API.

1 0

(ITS#8745) Need to join Windows server 2012 R2 to open lapd as a client
by ramkumar＠mgtechsoft.com 28 Sep '17

28 Sep '17

Full_Name: Ramkumar Raman Version: 2.4.28 OS: Ubuntu 12.04 LTS URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (14.143.3.78) Hello Team, I configured open ldap 2.4.28 with samba version 3.6.25 on Ubuntu 12.04 LTS server. And now window 7 to Windows 2008 R2 server I could able to join with open ldap. But, When we try to join windows server 2012 R2 server it is not happening and error which I am facing is as follows, Error: /// The following error occurred when DNS was queried for the service location (SRV) resource record used to locate an Active Directory Domain Controller (AD DC) for domain "opeldap.sdef.com": The error was: "DNS name does not exist." (error code 0x0000232B RCODE_NAME_ERROR) The query was for the SRV record for _ldap._tcp.dc._msdcs.opeldap.sdef.com Common causes of this error include the following: - The DNS SRV records required to locate a AD DC for the domain are not registered in DNS. These records are registered with a DNS server automatically when a AD DC is added to a domain. They are updated by the AD DC at set intervals. This computer is configured to use DNS servers with the following IP addresses: XXX.XX.XX.X XXX.XX.XX.XXX - One or more of the following zones do not include delegation to its child zone: opeldap.sdef.com sdef.com com . (the root zone) // Request you to inform whether can we join windows 2012 server to Open Ldap as client? and if it is possible please share the procedure with us. Thanks for your reply in advance. Regards, Ramkumar R

1 0

Re: (ITS#8732) LDAP_CIRCLEQ improvements
by hyc＠symas.com 28 Sep '17

28 Sep '17

okuznik(a)symas.com wrote: > On Tue, Sep 26, 2017 at 02:00:40PM +0100, Howard Chu wrote: >> Nothing in this patch says "rotate" anywhere. Please add some more >> descriptive comments describing the purpose of each new macro. > > A version with the circular queue description extended to cover the > rotation macros is available here: > > ftp://ftp.openldap.org/incoming/Ondrej-Kuznik-20170926-LDAP_CIRCLEQ.patch OK. Go ahead and merge. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8743) slaptest segfault with invalid back-meta configuration
by quanah＠openldap.org 27 Sep '17

27 Sep '17

Full_Name: Quanah Gibson-Mount Version: 2.4.45 OS: N/A URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (47.208.148.239) When converting a slapd.conf file to cn=config, where the back-meta backend has an invalid configuration for the "filter" directive, slaptest will segfault. It would be better to detect an error and exit accordingly. This is trivial to reproduce by using the following directive: filter "(objectClass=*)" as per slapd-meta(5), the "filter" directive takes a regex(5) rather than an LDAP filter. Still, it should not cause a segfault. ;)

1 0

(ITS#8742) slapd.conf/slapd-config divergence
by quanah＠openldap.org 26 Sep '17

26 Sep '17

Full_Name: Quanah Gibson-Mount Version: HEAD OS: N/A URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (47.208.148.239) The slapd.conf(5) and slapd-config(5) man pages have some significant divergence that need fixing. Examples: slapd.conf(5): Used by the authentication framework to convert simple user names, such as provided by SASL subsystem, or extracted from certificates in case of cert-based SASL EXTERNAL, or provided within the RFC 4370 "proxied authorization" control, to an LDAP DN used for authorization purposes. Note that the resulting DN need not refer to an existing entry to be considered valid. When an authorization request is received from the SASL subsystem, the SASL slapd-config(5): Used by the authentication framework to convert simple user names, such as provided by SASL subsystem, to an LDAP DN used for authorization purposes. Note that the resultant DN need not refer to an existing entry to be considered valid. When an authorization request is received from the SASL subsystem, the SASL slapd.conf(5): .B concurrency <integer> Specify a desired level of concurrency. Provided to the underlying thread system as a hint. The default is not to provide any hint. slapd-config(5): .B olcConcurrency: <integer> Specify a desired level of concurrency. Provided to the underlying thread system as a hint. The default is not to provide any hint. This setting is only meaningful on some platforms where there is not a one to one correspondence between user threads and kernel threads. slapd.conf(5) .B proxy_authz_non_critical disables acceptance of the proxied authorization control (RFC4370) when criticality is FALSE. .B dontusecopy_non_critical disables acceptance of the dontUseCopy control (a work in progress) when criticality is FALSE. slapd-config(5): These options are not listed slapd.conf(5) and slapd-config(5) have index_substr_if_minlen/index_substr_if_maxlen in opposite order in the man page slapd.conf(5): .B ldapsyntax "(\ <oid>\ [DESC\ <description>]\ [X\-SUBST <substitute-syntax>]\ )" .RS Specify an LDAP syntax using the LDAPv3 syntax defined in RFC 4512. The slapd parser extends the RFC 4512 definition by allowing string forms as well as numeric OIDs to be used for the syntax OID. (See the .B objectidentifier description.) The slapd parser also honors the .B X\-SUBST extension (an OpenLDAP-specific extension), which allows one to use the .B ldapsyntax statement to define a non-implemented syntax along with another syntax, the extension value .IR substitute-syntax , as its temporary replacement. The .I substitute-syntax must be defined. This allows one to define attribute types that make use of non-implemented syntaxes using the correct syntax OID. Unless .B X\-SUBST is used, this configuration statement would result in an error, since no handlers would be associated to the resulting syntax structure. .RE slapd-config(5): Section missing

1 0

Re: (ITS#8741) libldap ignoring timeout value
by Sean.Haugh＠vertivco.com 26 Sep '17

26 Sep '17

On Tue, Sep 26, 2017 at 06:06:23PM +0000, Hallvard Breien Furuseth wrote: > Try again without the "_" after "LDAP", like the ldap.conf manpage says. > That's unintuitive, but rather late to change at this point. This is using the LDAP C API. I have also used ldap_get_option calls to verify that the values are set correctly.=

1 0

Re: (ITS#8741) libldap ignoring timeout value
by h.b.furuseth＠usit.uio.no 26 Sep '17

26 Sep '17

On 26. sep. 2017 19:54, sean.haugh(a)vertivco.com wrote: > I have tried setting the LDAP_OPT_TIMEOUT, LDAP_OPT_NETWORK_TIMEOUT, > LDAP_OPT_TIMELIMIT values with ldap_simple_bind_s, and the call returns after > ~65 seconds rather than the 10-20 seconds I expect. Try again without the "_" after "LDAP", like the ldap.conf manpage says. That's unintuitive, but rather late to change at this point. -- Hallvard

1 0

(ITS#8741) libldap ignoring timeout value
by sean.haugh＠vertivco.com 26 Sep '17

26 Sep '17

Full_Name: Sean Haugh Version: 2.4.42 OS: Linux URL: Submission from: (NULL) (143.166.81.254) I have tried setting the LDAP_OPT_TIMEOUT, LDAP_OPT_NETWORK_TIMEOUT, LDAP_OPT_TIMELIMIT values with ldap_simple_bind_s, and the call returns after ~65 seconds rather than the 10-20 seconds I expect. The same is seen with ldap_result and ldap_simple_bind--regardless of the value of `timeout` that is set, whether explicit or NULL, the call blocks for ~65 seconds.

1 0

(ITS#8740) libldap ignoring timeout value
by sean.haugh＠vertivco.com 26 Sep '17

26 Sep '17

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs