- openldap-bugs - openldap.org

(ITS#7345) New Feature : Add Connection Information in Access Log Entries
by ldap＠htam.net 03 Aug '12

03 Aug '12

Full_Name: Mathieu MILLET Version: HEAD OS: Linux URL: ftp://ftp.openldap.org/incoming/accesslog_addConnectionInformation.patch Submission from: (NULL) (82.67.21.31) Entries provided by the Access Log Overlay does not contain informations such as the IP Address of the client. This patch adds a simple attribute : reqConnInfo containing the content of o_conn->c_peer_name . Please review this patch because I'm not sure about what safety checks must be performed on these data before "merging" them. If this patch is accepted : I, Mathieu MILLET, hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

Re: (ITS#7342) Password modify EXOP requires a DN
by hyc＠symas.com 02 Aug '12

02 Aug '12

Eric Clements wrote: > I filed it in response to a posting I saw on AFP548 regarding OS X. Some users have patched OpenLDAP to work around the issue. If you have a working patch that behaves as you think it should, you're welcome to submit it. Unfortunately, the RFC is explicitly silent on how other identity formats are represented. I.e., it doesn't even specify that SASL identities (such as used in SASL Bind) are valid here. > Though your statement is true, many SASL methods do not use DNs either. I > do not see why it is not allowed for passwordModify in the same way. If it behaves as designed then feel free to close. > > Thank you, > --------------------------- > Eric Clements > > On Aug 1, 2012, at 2:26 PM, Howard Chu <hyc(a)symas.com> wrote: > >> eclements(a)apple.com wrote: >>> Full_Name: Eric Clements >>> Version: 2.4.26 >>> OS: MacOS >>> URL: ftp://ftp.openldap.org/incoming/ >>> Submission from: (NULL) (17.193.15.131) >>> >>> >>> RFC 3062 Section 2.1 (authored by OpenLDAP) states that a password modify >>> request may or may not be an LDAP DN, yet OpenLDAP backend requires a DN. >> >> I'm not sure I understand why you've filed this ITS. The RFC doesn't specify >> that a server MUST support non-DN valued identities. It in fact says in Section 3: >> >> If the server does not recognize provided fields or does not support >> the combination of fields provided, it SHALL NOT change the user >> password. >> >> Clearly it is allowed for a server to reject identities if it doesn't >> recognize them. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7342) Password modify EXOP requires a DN
by eclements＠apple.com 02 Aug '12

02 Aug '12

I filed it in response to a posting I saw on AFP548 regarding OS X. Some users have patched OpenLDAP to work around the issue. Though your statement is true, many SASL methods do not use DNs either. I do not see why it is not allowed for passwordModify in the same way. If it behaves as designed then feel free to close. Thank you, --------------------------- Eric Clements On Aug 1, 2012, at 2:26 PM, Howard Chu <hyc(a)symas.com> wrote: > eclements(a)apple.com wrote: >> Full_Name: Eric Clements >> Version: 2.4.26 >> OS: MacOS >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (17.193.15.131) >> >> >> RFC 3062 Section 2.1 (authored by OpenLDAP) states that a password modify >> request may or may not be an LDAP DN, yet OpenLDAP backend requires a DN. > > I'm not sure I understand why you've filed this ITS. The RFC doesn't specify > that a server MUST support non-DN valued identities. It in fact says in Section 3: > > If the server does not recognize provided fields or does not support > the combination of fields provided, it SHALL NOT change the user > password. > > Clearly it is allowed for a server to reject identities if it doesn't > recognize them. > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7344) [PATCH] Add initial testsuit for slapo-constraint
by hyc＠symas.com 02 Aug '12

02 Aug '12

jsynacek(a)redhat.com wrote: > Full_Name: Jan Synacek > Version: master > OS: linux-fedora17 > URL: ftp://ftp.openldap.org/incoming/jsynacek-20120802-testsuit-slapo-constraint… > Submission from: (NULL) (209.132.186.34) > > > This patch adds an initial testsuit for slapo-constraint. Thanks, added to master. > > The attached file is derived from OpenLDAP Software. All of the modifications > to > OpenLDAP Software represented in the following patch(es) were developed by Red > Hat. Red Hat has not assigned rights and/or interest in this work to any party. > I, Jan Synacek am authorized by Red Hat, my employer, to release this work > under > the following terms. > > Red Hat hereby place the following modifications to OpenLDAP Software (and only > these modifications) into the public domain. Hence, these modifications may be > freely used and/or redistributed for any purpose with or without attribution > and/or other notice. > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7344) [PATCH] Add initial testsuit for slapo-constraint
by jsynacek＠redhat.com 02 Aug '12

02 Aug '12

Full_Name: Jan Synacek Version: master OS: linux-fedora17 URL: ftp://ftp.openldap.org/incoming/jsynacek-20120802-testsuit-slapo-constraint… Submission from: (NULL) (209.132.186.34) This patch adds an initial testsuit for slapo-constraint. The attached file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Red Hat. Red Hat has not assigned rights and/or interest in this work to any party. I, Jan Synacek am authorized by Red Hat, my employer, to release this work under the following terms. Red Hat hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

Re: (ITS#7342) Password modify EXOP requires a DN
by hyc＠symas.com 01 Aug '12

01 Aug '12

eclements(a)apple.com wrote: > Full_Name: Eric Clements > Version: 2.4.26 > OS: MacOS > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (17.193.15.131) > > > RFC 3062 Section 2.1 (authored by OpenLDAP) states that a password modify > request may or may not be an LDAP DN, yet OpenLDAP backend requires a DN. I'm not sure I understand why you've filed this ITS. The RFC doesn't specify that a server MUST support non-DN valued identities. It in fact says in Section 3: If the server does not recognize provided fields or does not support the combination of fields provided, it SHALL NOT change the user password. Clearly it is allowed for a server to reject identities if it doesn't recognize them. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7343) dynlist overlay does not include attributes of an entry containing objectClass of the dynlist attrset
by openldap＠stormcloud9.net 01 Aug '12

01 Aug '12

Full_Name: Patrick Hemmer Version: 2.4.31 OS: RHEL6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (98.211.220.204) The issue is that if the entry being dynamically added to the parent entry has the objectClass slapo-dynlist is configured to use (to determine expansion), that entry is not dynamically added to the parent. For example: ---- dn: olcOverlay={4}dynlist,olcDatabase={3}hdb,cn=config objectClass: olcDynamicList objectClass: olcOverlayConfig olcOverlay: {4}dynlist olcDlAttrSet: {0}labeledURIObject labeledURI ---- dn: cn=parent,dc=example,dc=com objectClass: groupOfNames objectClass: top objectClass: labeledURIObject cn: parent member: uid=foo,dc=example,dc=com labeledURI: ldap:///cn=child,dc=example,dc=com??base?(objectClass=*) dn: cn=child,dc=example,dc=com objectClass: groupOfNames objectClass: top objectClass: labeledURIObject member: uid=bar,dc=example,dc=com cn: child ---- In the above example, I would expect "member: uid=bar,dc=example,dc=com" to be added to cn=parent,dc=example,dc=com, but it isn't. Now the documentation clearly states recursion is not allowed, so if cn=child were to have a 'labeledURI', this labeledURI would not be expanded. But this is not what is being done here, cn=child has no labeledURI present. It also behaves perfectly fine if I pull the "objetClass: labeledURIObject" off cn=child. ldapsearch with objectClass labeledURIObject present on cn=child: ---- dn: cn=parent,dc=example,dc=com objectClass: groupOfNames objectClass: top objectClass: labeledURIObject cn: parent member: uid=foo,dc=example,dc=com labeledURI: ldap:///cn=child,dc=example,dc=com??base?(objectClass=*) ---- ldapsearch without objectClass labeledURIObject present on cn=child: ---- dn: cn=parent,dc=example,dc=com objectClass: groupOfNames objectClass: top objectClass: labeledURIObject cn: parent cn: child member: uid=foo,dc=example,dc=com member: uid=bar,dc=example,dc=com labeledURI: ldap:///cn=child,dc=example,dc=com??base?(objectClass=*) ----

1 0

(ITS#7342) Password modify EXOP requires a DN
by eclements＠apple.com 01 Aug '12

01 Aug '12

Full_Name: Eric Clements Version: 2.4.26 OS: MacOS URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (17.193.15.131) RFC 3062 Section 2.1 (authored by OpenLDAP) states that a password modify request may or may not be an LDAP DN, yet OpenLDAP backend requires a DN.

1 0

Re: (ITS#7340) Regression in slapo-constraint
by jsynacek＠redhat.com 31 Jul '12

31 Jul '12

On 07/30/2012 08:38 PM, Michael Ströder wrote: > Jan Synacek wrote: >> On 07/27/2012 10:47 PM, michael(a)stroeder.com wrote: >>> It seems there's a regression in slapo-constraint possibly caused by a patch for >>> ITS#7168. >> >> This works for me: >> >> slapd.ldif: >> ... >> dn: olcOverlay=constraint,olcDatabase={1}bdb,cn=config >> objectClass: olcOverlayConfig >> objectClass: olcConstraintConfig >> olcOverlay: constraint >> olcConstraintAttribute: mail count 3 >> olcConstraintAttribute: description count 2 >> ... > > From the excerpt above it seems you've only added a count constraint. > > Please use more features of slapo-constraint for testing, e.g. regex- or > URL-based constraints. > > The patch for ITS#7168 broke all my customer setups since I'm slapo-constraint > quite heavily. > > Ciao, Michael. > I'm having hard time reproducing this. Still works for me. Please provide a minimal setup and an example that fails, so I can fix the patch. Thank you. -- Jan Synacek Software Engineer, BaseOS team Brno, Red Hat

1 0

Re: (ITS#7340) Regression in slapo-constraint
by michael＠stroeder.com 30 Jul '12

30 Jul '12

This is a cryptographically signed message in MIME format. --------------ms010302040303070900010905 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Jan Synacek wrote: > On 07/27/2012 10:47 PM, michael(a)stroeder.com wrote: >> It seems there's a regression in slapo-constraint possibly caused by a= patch for >> ITS#7168. >=20 > This works for me: >=20 > slapd.ldif: > ... > dn: olcOverlay=3Dconstraint,olcDatabase=3D{1}bdb,cn=3Dconfig > objectClass: olcOverlayConfig > objectClass: olcConstraintConfig > olcOverlay: constraint > olcConstraintAttribute: mail count 3 > olcConstraintAttribute: description count 2 > ... =46rom the excerpt above it seems you've only added a count constraint. Please use more features of slapo-constraint for testing, e.g. regex- or URL-based constraints. The patch for ITS#7168 broke all my customer setups since I'm slapo-const= raint quite heavily. Ciao, Michael. --------------ms010302040303070900010905 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIILHzCC BT8wggQnoAMCAQICDwCmSwABAAIAivjZQ8SBvzANBgkqhkiG9w0BAQUFADB8MQswCQYDVQQG EwJERTEcMBoGA1UEChMTVEMgVHJ1c3RDZW50ZXIgR21iSDElMCMGA1UECxMcVEMgVHJ1c3RD ZW50ZXIgQ2xhc3MgMSBMMSBDQTEoMCYGA1UEAxMfVEMgVHJ1c3RDZW50ZXIgQ2xhc3MgMSBM MSBDQSBJWDAeFw0xMjA2MDYxOTAyMTZaFw0xMzA2MDcxOTAyMTZaMCgxCzAJBgNVBAYTAkRF MRkwFwYDVQQDDBBNaWNoYWVsIFN0csO2ZGVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEAxXZGav40rnGNLxEggBW94MILWHlfC8a23Jew5U1gPlfRTXOjjzmoaZ1uCyGdgF6M VvuO9T1aTQNGH+OdeGe3P7Tfc/NsLJFJ2wtd8blvhmodUgse2eypiWjNOd4gZuhalBhgsQ0K b5D6/1foghII4E264iZlJ7AJ+UYcO+GxvFWT0YMTbLckgDkZk7c3qwTozdhYvXarvqx+8Ou/ kuxpQQhac/ebzxpu0N+RHSf2KIUS0g0tEGnPtGv6iL+9QNHc4JKo9Y9KKVw3tQy+Re+FQLxB 1fPE5F+qxuD3AUENpOwkMsqWLM94ohtx3CFqLpxfUPrnKFLAHOhHEbByYGvFPwIDAQABo4IC EDCCAgwwgaUGCCsGAQUFBwEBBIGYMIGVMFEGCCsGAQUFBzAChkVodHRwOi8vd3d3LnRydXN0 Y2VudGVyLmRlL2NlcnRzZXJ2aWNlcy9jYWNlcnRzL3RjX2NsYXNzMV9MMV9DQV9JWC5jcnQw QAYIKwYBBQUHMAGGNGh0dHA6Ly9vY3NwLml4LnRjY2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1 c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAU6bgoHUbP/M34TpvF7ktg69g7P9EwDAYDVR0TAQH/ BAIwADBKBgNVHSAEQzBBMD8GCSqCFAAsAQEBATAyMDAGCCsGAQUFBwIBFiRodHRwOi8vd3d3 LnRydXN0Y2VudGVyLmRlL2d1aWRlbGluZXMwDgYDVR0PAQH/BAQDAgTwMB0GA1UdDgQWBBS2 KAWfTfgJ/JQ63qLGwTXYLnI+LzBiBgNVHR8EWzBZMFegVaBThlFodHRwOi8vY3JsLml4LnRj Y2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1c3RjZW50ZXIuZGUvY3JsL3YyL3RjX0NsYXNzMV9M MV9DQV9JWC5jcmwwMwYDVR0lBCwwKgYIKwYBBQUHAwIGCCsGAQUFBwMEBggrBgEFBQcDBwYK KwYBBAGCNxQCAjAfBgNVHREEGDAWgRRtaWNoYWVsQHN0cm9lZGVyLmNvbTANBgkqhkiG9w0B AQUFAAOCAQEAQ3bvVUpEq+cQrLpcogyt5BJNk/WvUvOHqhzyj28M9pg9hcDl1+MYl5qqj6tR GSTLPQZyf287pcmbMwbcTGZO/gbW9v7RYcut6RauWdwKMCUmKC3J4fVfDq9ZETA2WOV68ef4 B3Gzdhghsbp3Rhp5dDmrCVKAHlafm6ZwJrEQ9P76fxnQZzRLgeKpZep5ePH5YHUB3+YaOQvJ FG0bOXvfHhRiRG7/HW2G+yDgjHSxDz8AFzMWL/RFePqZ4pn6T/SM/qU6WEpW39MWyJNoH/Kx QDYK8gGYuesn1ciMCTnjrvZQj0fonGTO4SfWekJRkuGrJ7dYSZRjYbDcWBBkdFLWzzCCBdgw ggTAoAMCAQICDgboAAEAAkqWLSQM/sXJMA0GCSqGSIb3DQEBBQUAMHkxCzAJBgNVBAYTAkRF MRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSQwIgYDVQQLExtUQyBUcnVzdENlbnRl ciBVbml2ZXJzYWwgQ0ExJjAkBgNVBAMTHVRDIFRydXN0Q2VudGVyIFVuaXZlcnNhbCBDQSBJ MB4XDTA5MTEwMzE0MDgxOVoXDTI1MTIzMTIxNTk1OVowfDELMAkGA1UEBhMCREUxHDAaBgNV BAoTE1RDIFRydXN0Q2VudGVyIEdtYkgxJTAjBgNVBAsTHFRDIFRydXN0Q2VudGVyIENsYXNz IDEgTDEgQ0ExKDAmBgNVBAMTH1RDIFRydXN0Q2VudGVyIENsYXNzIDEgTDEgQ0EgSVgwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC75pBuz2Lp6QuqthDVR+V8XSsncZpozVVt 5KLv5P7yemMRwleKyH3PjmYfZUVL64Biab1GjovFblqVGCrep/EfdRonq20yU+P7TVhiLP8Z 5cegDZotIYhZhM0d8cPIij6w5d4IJM/8QCy6QSOUu4ASiTVItoYE4AFPjLqpmPwcie0fiqHH hpgmHnJla/7PZdkMZEsaCfVDEWBmJuMzVprJPT40anjG5VBLyM2I5DlsUCaeQCy2O3w3sqf1 3dyzUcv03IICuNc63towXA31Qt0TaVNU6YAmQjMepdfMbspmCZ+G8D2+xophEPPR/1vkstst smUMqX0XrLonTUJczglPAgMBAAGjggJZMIICVTCBmgYIKwYBBQUHAQEEgY0wgYowUgYIKwYB BQUHMAKGRmh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvY2VydHNlcnZpY2VzL2NhY2VydHMv dGNfdW5pdmVyc2FsX3Jvb3RfSS5jcnQwNAYIKwYBBQUHMAGGKGh0dHA6Ly9vY3NwLnRjdW5p dmVyc2FsLUkudHJ1c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAUkqR1LKSevoFE63n8isWVpesQ dXMwEgYDVR0TAQH/BAgwBgEB/wIBADBSBgNVHSAESzBJMAYGBFUdIAAwPwYJKoIUACwBAQEB MDIwMAYIKwYBBQUHAgEWJGh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvZ3VpZGVsaW5lczAO BgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFOm4KB1Gz/zN+E6bxe5LYOvYOz/RMIH9BgNVHR8E gfUwgfIwge+ggeyggemGRmh0dHA6Ly9jcmwudGN1bml2ZXJzYWwtSS50cnVzdGNlbnRlci5k ZS9jcmwvdjIvdGNfdW5pdmVyc2FsX3Jvb3RfSS5jcmyGgZ5sZGFwOi8vd3d3LnRydXN0Y2Vu dGVyLmRlL0NOPVRDJTIwVHJ1c3RDZW50ZXIlMjBVbml2ZXJzYWwlMjBDQSUyMEksTz1UQyUy MFRydXN0Q2VudGVyJTIwR21iSCxPVT1yb290Y2VydHMsREM9dHJ1c3RjZW50ZXIsREM9ZGU/ Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlPzANBgkqhkiG9w0BAQUFAAOCAQEAOcjE m+6+mO5Icm+N53G2DpCM07LBFSGoRpBoX0oE8TrJaIQh2KXmBHVdn9LU8kt3QzLclctgvwJV 0KwcsMUUl5tlCsMPpR3s2Ek5lbWpvvr0HqtW56blAQiINV9nBd1EJFASIkRjefGbV2nOq9Yz UU+N8HA7jq1ROhd/NZZraGhjthwKyfjfHV7PKxGlY+3M0MbTIG+q/GhIfm0euDpFqhKG88e9 ALXr/uoSn3MzeOcoOWjTpW3adtFO4VWVgKbgG7jNrFbvRVlHmFLbOm4msjE5aXWxLiTwpJ2X iF4zKca1vAdAOgw9us90jEtOeiH6GzjNxEMvb7TfeO6Zkuc6HDGCA84wggPKAgEBMIGPMHwx CzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQLExxU QyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRlciBD bGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wCQYFKw4DAhoFAKCCAhMwGAYJKoZI hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTIwNzMwMTgzODQyWjAjBgkq hkiG9w0BCQQxFgQUbkqitqiUB3AUptpJBP8IZf85VpcwbAYJKoZIhvcNAQkPMV8wXTALBglg hkgBZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggq hkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBoAYJKwYBBAGCNxAEMYGSMIGP MHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQL ExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRl ciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wgaIGCyqGSIb3DQEJEAILMYGS oIGPMHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYD VQQLExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENl bnRlciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wDQYJKoZIhvcNAQEBBQAE ggEANow9ad7A3wr3HYgEMXZdssyB+upyWbuJ5LwbagTwOvHqIIJRTaKTIEvnUk09t4Jm5EIn Z0Nx7RX/HhOSbK94k1azYSpfabscyEubVv5tmmIJLJ6uwGIk9+9tMr7D0sXj8AKxc5qb96sc 1Aj3NidCu5dE/qJhdiMK84FTAjqMbouQ0v+DaTuw8BDIjcQL7XNxyu536WAOB/5BGOtfms8e SXH2bvNfYbw25+HdC8OTibBoMJrFXZExyT6lpqjgPcSrcixF1bK/Y9w8kxgqq7keFAw3rcuK 7vXpYMYKdazQFhr6Z4XlvH8AOeSdpDgyy9u3miaV/f5p1TBPyQyMAlq9SgAAAAAAAA== --------------ms010302040303070900010905--

1 0

Re: (ITS#7340) Regression in slapo-constraint
by jsynacek＠redhat.com 30 Jul '12

30 Jul '12

On 07/27/2012 10:47 PM, michael(a)stroeder.com wrote: > Full_Name: > Version: RE24 8a0ce24c5abaf687a41696d988f6a1330128368d > OS: > URL: > Submission from: (NULL) (79.227.171.183) > > > It seems there's a regression in slapo-constraint possibly caused by a patch for > ITS#7168. > > If the client sends valid data which not violates a constraint > CONSTRAINT_VIOLATION is returned: > > delete: departmentNumber > departmentNumber: old_number > - > add: departmentNumber > departmentNumber: new_number > - > > It seems turning off only the constraint for departmentNumber does not help. > Turning off all constraints makes it work. > This works for me: slapd.ldif: ... dn: olcOverlay=constraint,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcConstraintConfig olcOverlay: constraint olcConstraintAttribute: mail count 3 olcConstraintAttribute: description count 2 ... root.ldif: dn: dc=my-domain,dc=com objectclass: dcObject objectclass: organization dc: my-domain o: My Domain corp. user.ldif: dn: cn=usr2,dc=my-domain,dc=com objectclass: inetOrgPerson objectclass: organizationalPerson cn: usr2 sn: usr2 mail: original(a)email.com description: desc1 description: desc2 test.ldif: dn: cn=usr2,dc=my-domain,dc=com changetype: modify delete: description description: desc1 - add: description description: desc1-mod < operation is successful > Am I misunderstanding something? If it still doesn't work for you, please, provide more information including your configuration and an example that fails. -- Jan Synacek Software Engineer, BaseOS team Brno, Red Hat

1 0

(ITS#7341) Ordered list error in overlays.sdf and "attr" in access-control.sdf
by ghenry＠OpenLDAP.org 30 Jul '12

30 Jul '12

Full_Name: Gavin Henry Version: master OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (212.159.59.85) Submitted by: ghenry Small typos in access-control.sdf overlays.sdf.

1 0

Re: (ITS#7168) [PATCH] Fix count constraint when using multiple modifications
by quanah＠zimbra.com 28 Jul '12

28 Jul '12

--On Tuesday, June 19, 2012 5:19 AM +0000 jsynacek(a)redhat.com wrote: > On 06/07/2012 03:00 PM, Howard Chu wrote: >> jsynacek(a)redhat.com wrote: >>> Full_Name: Jan Synacek >>> Version: 2.4.29 >>> OS: Fedora 16 >>> URL: >>> http://jsynacek.fedorapeople.org/openldap/jsynacek-20120216-constraint- >>> count.patch Submission from: (NULL) (209.132.186.34) >>> This patch is broken. See ITS#7340 and discussion on -technical. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#7340) Regression in slapo-constraint
by michael＠stroeder.com 27 Jul '12

27 Jul '12

Full_Name: Version: RE24 8a0ce24c5abaf687a41696d988f6a1330128368d OS: URL: Submission from: (NULL) (79.227.171.183) It seems there's a regression in slapo-constraint possibly caused by a patch for ITS#7168. If the client sends valid data which not violates a constraint CONSTRAINT_VIOLATION is returned: delete: departmentNumber departmentNumber: old_number - add: departmentNumber departmentNumber: new_number - It seems turning off only the constraint for departmentNumber does not help. Turning off all constraints makes it work.

1 0

(ITS#7339) back-mdb aborts with online index additions
by hyc＠OpenLDAP.org 26 Jul '12

26 Jul '12

Full_Name: Howard Chu Version: HEAD/RE24 OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (37.19.97.21) Submitted by: hyc Already fixed in d1a7fa267bdb9e27777ba87db44034ce83a75084 If new databases are added (such as when adding a new index via cn=config) they may cause additional pages to be dirtied during txn_commit. The pages would be pulled from the freelist. But the updates occurred after the freelist had already been written out, so the new state of the freelist wasn't being saved. Subsequent transactions would abort due to internal corruption.

1 0

(ITS#7338) Problems changing bdb DB_CONFIG parameters using back-config
by mhardin＠symas.com 26 Jul '12

26 Jul '12

Full_Name: Matthew Hardin Version: 2.4.31 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (69.43.206.100) Using back-config to update bdb DB_CONFIG parameters has problems. Changing the parameters with back-config does work, and writes out a new DB_CONFIG file, but a database reopen doesn't occur and therefore the environment is not rebuilt. Furthermore, if one restarts slapd, a checkpoint occurs, which in turn causes mtimes to change in the database and so the rebuild-env-on-dbopen step isn't triggered. The proper sequence should be: close the db write the new DB_CONFIG open the db The checkpoint will take place before DB_CONFIG is written, and on reopen, the environment will be rebuilt.

1 0

(ITS#7337) libmdb can corrupt when reaching maxsize
by hyc＠OpenLDAP.org 26 Jul '12

26 Jul '12

Full_Name: Howard Chu Version: HEAD/RE24 OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (37.19.97.21) Submitted by: hyc Already fixed by commit 234cd9dfb54ef2f7f83963d95b6eb8e9735bb372 If the DB maxsize was reached while pruning consumed records from the free list inside mdb_txn_commit, the error was ignored. As a result the txn_commit would return success even though it only partly succeeded. The code is now fixed to abort the txn and return the error code.

1 0

Re: (ITS#7335) Error in slapo-refint man page
by hyc＠symas.com 25 Jul '12

25 Jul '12

riggs(a)umn.edu wrote: > Full_Name: Benjamin Riggs > Version: 2.4.23 > OS: http://ftp.scientificlinux.org/linux/scientific/6x/i386/os/Packages/openlda… > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (128.101.155.71) > > > The slapo-refint man page has only documentation for slapd.conf, not > slapd-config. Normally this wouldn't be a problem, but the configuration > keywords are not the usual map of simply adding 'olc': > > refint_attributes is changed to olcRefintAttribute (no 's'!) > refint_nothing is changed to olcRefintNothing > refint_modifiersname is changed to olcRefintModifiersName That's true. All of the manpages should be updated for cn=config. In that respect this ITS can be combined with ITS#7288. However, we need to decide on how the new information will be presented, to avoid any unnecessary duplication. It's already quite redundant to maintain both the cn=config and slapd.conf chapters of the Admin Guide. Also, the overall issue is an extremely low priority, since all of the schema definitions can simply be read out of the cn=schema,cn=config entry. The slapd-config(5) manpage and Admin Guide already note that all of the schema are present here, so anyone looking for this information should already know to look there. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7225) back-monitor/ldap crash in test020-proxycache
by ondrej.kuznik＠acision.com 25 Jul '12

25 Jul '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have noticed the ITS has not been updated after Pierangelo commited ce54dabb1b69c5b310cfc4ff689bc339f3256e22 and still lists this ITS as broken. Currently back-ldap in master is buildable and passes the relevant tests in the test suite and my manual tests. - -- Ondrej Kuznik -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAlAQFJIACgkQ9GWxeeH+cXtjgACcDdbtxso5VaK6OjwZ2CsQETTf kR8AniMzHr3uCExS5JugvmRCI5F14RCi =EloX -----END PGP SIGNATURE----- This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you for understanding.

1 0

Re: (ITS#7182) back-ldap monitoring improvements
by ondrej.kuznik＠acision.com 25 Jul '12

25 Jul '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 04/07/2012 12:52 PM, h.b.furuseth(a)usit.uio.no wrote: > Howard Chu wrote: >> Also, you're using monitor_entry_stub() directly in the back-ldap >> code. It is forbidden for modules to directly reference each >> other's symbols. If you need this function, add it to >> monitor_extra_t first and call it through there. > > Thus, currently './configure --enable-ldap --disable-monitor' does > not compile in master. I have noticed the ITS has not been updated after Pierangelo commited 11acc75e9ff31ae52b3b8c94b63189b51a764c01 and still lists this ITS as broken. Currently back-ldap in master is buildable and passes the relevant tests in the test suite and my manual tests. - -- Ondrej Kuznik -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAlAQFCAACgkQ9GWxeeH+cXshQwCdHRGaMyIOCKQk1jVhZ+S40b9R Hl8Ani1snr8svKOInMCEWL69l6EzNRHW =1RuS -----END PGP SIGNATURE----- This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you for understanding.

1 0

Re: (ITS#7336) Ldapmodify crashes slapd when updating olcTLSVerifyClient attribute via TLS authentication
by quanah＠zimbra.com 25 Jul '12

25 Jul '12

--On Wednesday, July 25, 2012 12:26 PM +0000 martin.bozic(a)gmail.com wrote: > Full_Name: Martin Bozic > Version: 2.4.23 > OS: CentOS 6.3 > URL: http://pastebin.com/hkPEcBgw > Submission from: (NULL) (2001:1470:f800::370) When filing a bug report, please use the latest version of OpenLDAP, otherwise your report is likely to be ignored. Particularly in this case, given the antiquity of 2.4.23. I would note that there have been numerous, significant fixes to the MozNSS support in OpenLDAP, which is what RHEL chose to link OpenLDAP to instead of the more stable OpenSSL. You may want to look at using saner packages, such as <http://ltb-project.org/wiki/download> --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#7336) Ldapmodify crashes slapd when updating olcTLSVerifyClient attribute via TLS authentication
by martin.bozic＠gmail.com 25 Jul '12

25 Jul '12

Full_Name: Martin Bozic Version: 2.4.23 OS: CentOS 6.3 URL: http://pastebin.com/hkPEcBgw Submission from: (NULL) (2001:1470:f800::370) Hello, I've come across a bug that it's not critical but bug none the less. When I'm trying to modify olcTLSVerifyClient via ldapmodify slapd crashes (segmentation fault). Via EXTERNAL everything works without a hitch: ldapmodify -Y EXTERNAL -H ldapi:/// << EOF dn: cn=config changetype: modify replace: olcTLSVerifyClient olcTLSVerifyClient: demand EOF Via TLS connection slapd crashes: ldapmodify -x -H ldaps://ldap.test.com -D cn=admin,cn=config -W << EOF dn: cn=config changetype: modify replace: olcTLSVerifyClient olcTLSVerifyClient: never EOF Configuration in cn=config: dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /usr/share/openldap-servers/slapd.conf.obsolete olcConfigDir: /etc/openldap/slapd.d/ olcArgsFile: /var/run/openldap/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcDisallows: bind_anon olcGentleHUP: FALSE olcIdleTimeout: 30 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcLocalSSF: 128 olcLogLevel: config stats shell filter olcPidFile: /var/run/openldap/slapd.pid olcReadOnly: FALSE olcReverseLookup: FALSE olcSaslSecProps: noanonymous,noplain olcSecurity: ssf=128 olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCACertificateFile: /etc/openldap/cacerts/ca.crt olcTLSCACertificatePath: /etc/openldap/certs olcTLSCertificateFile: /etc/openldap/cacerts/slapd.crt olcTLSCertificateKeyFile: /etc/openldap/cacerts/slapd.key olcTLSCipherSuite: HIGH:MEDIUM:-SSLv2 olcTLSVerifyClient: never olcToolThreads: 1 olcWriteTimeout: 0 The slapd debug log is pasted in the URL below. Regards, Martin Bozic

1 0

(ITS#7335) Error in slapo-refint man page
by riggs＠umn.edu 24 Jul '12

24 Jul '12

Full_Name: Benjamin Riggs Version: 2.4.23 OS: http://ftp.scientificlinux.org/linux/scientific/6x/i386/os/Packages/openlda… URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (128.101.155.71) The slapo-refint man page has only documentation for slapd.conf, not slapd-config. Normally this wouldn't be a problem, but the configuration keywords are not the usual map of simply adding 'olc': refint_attributes is changed to olcRefintAttribute (no 's'!) refint_nothing is changed to olcRefintNothing refint_modifiersname is changed to olcRefintModifiersName

1 0

Re: (ITS#7330) slapd mmr failure due to tls cert name mismatch
by openldap＠stormcloud9.net 24 Jul '12

24 Jul '12

Sent: Tue Jul 24 2012 12:15:27 GMT-0400 (EDT) From: quanah(a)zimbra.com To: openldap-its(a)openldap.org Subject: Re: (ITS#7330) slapd mmr failure due to tls cert name mismatch > Which of the three TLS software packages is your openldap build linked to? > > OpenSSL > MozNSS > GnuTLS > > Thanks, > Quanah > OpenSSL

1 0

Re: (ITS#7330) slapd mmr failure due to tls cert name mismatch
by quanah＠zimbra.com 24 Jul '12

24 Jul '12

--On Friday, July 20, 2012 10:06 PM +0000 openldap(a)stormcloud9.net wrote: > I have also tried tls_reqcert=allow with the same result. And in a > desperate attempt, I also tried setting tls_cacert=/dev/null in the hope > that if it couldn't verify the cert it wouldnt check the hostname against > the cert subject, but this failed as well. Which of the three TLS software packages is your openldap build linked to? OpenSSL MozNSS GnuTLS Thanks, Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs