- openldap-bugs - openldap.org

Re: (ITS#5054) AVA in slapd-meta(5) and slapo-rwm(5)
by hyc＠symas.com 20 Jul '07

20 Jul '07

ghenry(a)OpenLDAP.org wrote: > Full_Name: Gavin Henry > Version: HEAD > OS: > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (80.229.93.1) > Submitted by: ghenry > > > Dear All, > > It's not clear or explained what AVA means in slapd-meta(5) and slapo-rwm(5) Standard terminology in X.500/LDAP. "Attribute Value Assertion" > > A user was asking in #ldap > > I presume it means "Attribute Value"? > > If so, I will add an explaination in each man page. OpenLDAP docs are not intended to explain the basics of LDAP. You're expected to already know LDAP or refer to the RFCs for basic terminology. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#5055) index generation failure with empty suffix
by quanah＠zimbra.com 20 Jul '07

20 Jul '07

Full_Name: Quanah Gibson-Mount Version: 2.3.34 OS: NA URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (71.202.148.128) If a database has a zero-length suffix, the NULL context entry gets an entry ID of zero, which is usually an invalid ID number and always omitted from indexing. But it looks like with slapadd -q, it is possible for this entry to get included in various indices, which will totally confuse them. (per Howard) --Quanah

1 0

Re: (ITS#5054) AVA in slapd-meta(5) and slapo-rwm(5)
by ghenry＠suretecsystems.com 20 Jul '07

20 Jul '07

<quote who="Ralf Haferkamp"> > On Friday 20 July 2007 16:45, ghenry(a)openldap.org wrote: >> Full_Name: Gavin Henry >> Version: HEAD >> OS: >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (80.229.93.1) >> Submitted by: ghenry >> >> >> Dear All, >> >> It's not clear or explained what AVA means in slapd-meta(5) and >> slapo-rwm(5) >> >> A user was asking in #ldap >> >> I presume it means "Attribute Value"? > It means "Attribute Value Assertion", normally. Doh, helped if I read the RFCs. Oh but look who has a nice page in it: https://www.opends.org/wiki//page/DefinitionAttributeValueAssertion Maybe we need a nice OpenLDAP Wiki? (one for -devel list I think) > >> If so, I will add an explaination in each man page. > > -- > Ralf >

1 0

Re: (ITS#5054) AVA in slapd-meta(5) and slapo-rwm(5)
by rhafer＠suse.de 20 Jul '07

20 Jul '07

On Friday 20 July 2007 16:45, ghenry(a)openldap.org wrote: > Full_Name: Gavin Henry > Version: HEAD > OS: > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (80.229.93.1) > Submitted by: ghenry > > > Dear All, > > It's not clear or explained what AVA means in slapd-meta(5) and > slapo-rwm(5) > > A user was asking in #ldap > > I presume it means "Attribute Value"? It means "Attribute Value Assertion", normally. > If so, I will add an explaination in each man page. -- Ralf

1 0

(ITS#5054) AVA in slapd-meta(5) and slapo-rwm(5)
by ghenry＠OpenLDAP.org 20 Jul '07

20 Jul '07

Full_Name: Gavin Henry Version: HEAD OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (80.229.93.1) Submitted by: ghenry Dear All, It's not clear or explained what AVA means in slapd-meta(5) and slapo-rwm(5) A user was asking in #ldap I presume it means "Attribute Value"? If so, I will add an explaination in each man page. Gavin.

1 0

(ITS#5053) openldap 2.3.36 crashing
by igbed＠wmin.ac.uk 20 Jul '07

20 Jul '07

Full_Name: Damian Igbe Version: 2.3.6 OS: SLES 10 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (161.74.11.24) I have a delta-syncrepl replication working with password policy in place. Authentication to the master works fine but when a client tries to authenticate to the replica server, the following bug is encountered and the system crashes. bdb_modify: modify failed (20) send_ldap_result: conn=1 op=3 p=3 send_ldap_response: msgid=4 tag=97 err=49 ber_flush: 82 bytes to sd 17 slapd: ppolicy.c:847: ctrls_cleanup: Assertion `rs->sr_ctrls != ((void *)0)' failed. Aborted Please help. Thanks Damian It also happens in other instances with errors such as: => key_change(DELETE,13) <= key_change 0 => key_change(ADD,13) <= key_change 0 => entry_encode(0x00000013): uid=delaitt,ou=staff,ou=users,dc=cscs,dc=wmin,dc=ac,dc=uk bdb_modify: updated id=00000013 dn="uid=delaitt,ou=staff,ou=users,dc=cscs,dc=wmin,dc=ac,dc=uk" send_ldap_result: conn=2 op=3 p=3 bdb_dn2entry("uid=delaitt,ou=staff,ou=users,dc=cscs,dc=wmin,dc=ac,dc=uk") bdb_entry_get: rc=0 bdb_dn2entry("uid=delaitt,ou=staff,ou=users,dc=cscs,dc=wmin,dc=ac,dc=uk") bdb_entry_get: rc=0 bdb_dn2entry("uid=delaitt,ou=staff,ou=users,dc=cscs,dc=wmin,dc=ac,dc=uk") bdb_entry_get: rc=0 bdb_dn2entry("uid=delaitt,ou=staff,ou=users,dc=cscs,dc=wmin,dc=ac,dc=uk") bdb_modify_internal: 0x00000013: uid=delaitt,ou=staff,ou=users,dc=cscs,dc=wmin,dc=ac,dc=uk bdb_modify: modify failed (20) send_ldap_result: conn=2 op=3 p=3 send_ldap_response: msgid=4 tag=97 err=49 ber_flush: 82 bytes to sd 17 slapd: ppolicy.c:847: ctrls_cleanup: Assertion `rs->sr_ctrls != ((void *)0)' failed. Aborted

1 0

Re: (ITS#5048) Suspicious use of 'unchecked' limit syncprov
by hyc＠symas.com 20 Jul '07

20 Jul '07

h.b.furuseth(a)usit.uio.no wrote: > Full_Name: Hallvard B Furuseth > Version: HEAD, RE23 > OS: > URL: > Submission from: (NULL) (129.240.202.105) > Submitted by: hallvard > > > overlays/syncprov.c:syncprov_findcsn() sets an unchecked limit to 1. > findcsn_cb() says > /* We just want to know that at least one exists, so it's OK if > * we exceed the unchecked limit or size limit. > */ > > This looks like it can return a false positive if two or more other > entries which the filter would eliminate have the same hash as the > value syncprov searches for. I don't believe this can cause any problem though. CSN indexing doesn't use a hash the way other indices do; the CSN timestamp is converted to binary form and saved as a 40 bit integer. Index collisions will only occur for multiple changes that occurred within the same 1-second interval. The purpose of this search is to detect if a consumer's context CSN is stale, i.e., the provider no longer has any entries as old as the consumer's CSN. The fact that there is any index collision essentially proves that the CSN is not stale. > Also syncprov_findcsn() passes fc_limits uninitialized outside of the > .lms_s_unchecked field to slapd. Valgrind complains in test018 about > .lms_s_pr_hide in back-bdb/search.c:bdb_search(). Tested in HEAD. Fixed in HEAD. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#5052) slapadd -q can create invalid index
by hyc＠OpenLDAP.org 20 Jul '07

20 Jul '07

Full_Name: Howard Chu Version: 2.3.x OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (204.95.127.34) Submitted by: hyc On a database with a zero-length suffix, slapadd and slapindex in quick mode can erroneously generate index records for the context entry, which has an entry ID of zero. The entry ID zero is normally invalid in an index, and is always filtered out of index operations, but the quick mode indexer didn't exclude it as it should.

1 0

Re: (ITS#5051) Translucent overlay and back-monitor
by ghenry＠suretecsystems.com 20 Jul '07

20 Jul '07

<quote who="hyc(a)symas.com"> > ghenry(a)OpenLDAP.org wrote: >> Full_Name: Gavin Henry >> Version: 19/07/07 HEAD >> OS: >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (212.159.59.85) >> Submitted by: ghenry >> >> >> Dear All, >> >> Is slapd not started and giving below expected? >> >> >> ================ >> monitor_back_register_entry_parent(""): base="cn=databases,cn=monitor" >> scope=subordinate >> filter="(&(monitoredInfo=ldap)(!(monitorOverlay=ldap))(namingContexts:distinguishedNameMatch:=dc=suretecsystems,dc=com))": >> unable to find entry >> backend_startup_one: bi_db_open failed! (1) >> slapd shutdown: initiated >> ================ >> >> Using a config like: >> >> ================ >> include /usr/local/etc/openldap/schema/core.schema >> >> pidfile /usr/local/var/run/slapd.pid >> argsfile /usr/local/var/run/slapd.args >> >> # Load dynamic backend modules: >> modulepath /usr/local/libexec/openldap >> moduleload back_bdb.la >> moduleload back_ldap.la >> moduleload back_monitor.la >> moduleload translucent.la >> >> database bdb >> directory /usr/local/var/openldap-data >> cachesize 10000 >> suffix "dc=suretecsystems,dc=com" >> >> rootdn "cn=admin,dc=suretecsystems,dc=com" >> rootpw {SSHA}blah >> >> index default eq >> index objectClass,uid,dc,o,ou >> >> overlay translucent >> uri ldap://x.x.x.x:389 >> idassert-bind binddn="cn=admin,dc=suretecsystems,dc=com" >> credentials=blah >> >> database config >> rootdn "cn=config" >> rootpw {SSHA}blah >> >> database monitor >> ================ >> >> >> If I remove "database monitor", all is obviously well. >> >> However, if I put "database monitor" before "database bdb", slapd starts >> fine, >> but complains with: >> >> ================ >> monitor_back_register_entry_parent(""): base="cn=databases,cn=monitor" >> scope=subordinate >> filter="(&(monitoredInfo=ldap)(!(monitorOverlay=ldap))(namingContexts:distinguishedNameMatch:=dc=suretecsystems,dc=com))": >> unable to find entry >> slapd starting >> ================ > > Pretty sure your monitor database needs a rootdn now for this to work. > Ok. What can the rootdn do on the monitor database then? Write to anything? I can update the "Monitoring" section with this info then ;-) Gavin.

1 0

Re: (ITS#5051) Translucent overlay and back-monitor
by hyc＠symas.com 19 Jul '07

19 Jul '07

ghenry(a)OpenLDAP.org wrote: > Full_Name: Gavin Henry > Version: 19/07/07 HEAD > OS: > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (212.159.59.85) > Submitted by: ghenry > > > Dear All, > > Is slapd not started and giving below expected? > > > ================ > monitor_back_register_entry_parent(""): base="cn=databases,cn=monitor" > scope=subordinate filter="(&(monitoredInfo=ldap)(!(monitorOverlay=ldap))(namingContexts:distinguishedNameMatch:=dc=suretecsystems,dc=com))": > unable to find entry > backend_startup_one: bi_db_open failed! (1) > slapd shutdown: initiated > ================ > > Using a config like: > > ================ > include /usr/local/etc/openldap/schema/core.schema > > pidfile /usr/local/var/run/slapd.pid > argsfile /usr/local/var/run/slapd.args > > # Load dynamic backend modules: > modulepath /usr/local/libexec/openldap > moduleload back_bdb.la > moduleload back_ldap.la > moduleload back_monitor.la > moduleload translucent.la > > database bdb > directory /usr/local/var/openldap-data > cachesize 10000 > suffix "dc=suretecsystems,dc=com" > > rootdn "cn=admin,dc=suretecsystems,dc=com" > rootpw {SSHA}blah > > index default eq > index objectClass,uid,dc,o,ou > > overlay translucent > uri ldap://x.x.x.x:389 > idassert-bind binddn="cn=admin,dc=suretecsystems,dc=com" credentials=blah > > database config > rootdn "cn=config" > rootpw {SSHA}blah > > database monitor > ================ > > > If I remove "database monitor", all is obviously well. > > However, if I put "database monitor" before "database bdb", slapd starts fine, > but complains with: > > ================ > monitor_back_register_entry_parent(""): base="cn=databases,cn=monitor" > scope=subordinate filter="(&(monitoredInfo=ldap)(!(monitorOverlay=ldap))(namingContexts:distinguishedNameMatch:=dc=suretecsystems,dc=com))": > unable to find entry > slapd starting > ================ Pretty sure your monitor database needs a rootdn now for this to work. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: Contrib: addpartial overlay (ITS#3593)
by ghenry＠suretecsystems.com 19 Jul '07

19 Jul '07

<quote who="dhawes(a)vt.edu"> > On Thursday 19 July 2007 05:35, Gavin Henry wrote: >> > An updated version of addpartial is available at: >> > >> > ftp://ftp.openldap.org/incoming/david_hawes-addpartial-070126.tgz >> > >> > This version includes changes to work with OpenLDAP 2.3 as well as >> > ensuring syncrepl works properly. >> > >> > david hawes >> >> If this hasn't been added to 2.4/HEAD yet, would you consider updating >> it >> for inclusion in 2.4 contrib? > > Absolutely, I've been meaning to test with 2.4. I'll bump it to the top > of > the list. Can you make sure that is dynamically configurable via cn=config like everything else in 2.4. Thanks. > > dave > > >

1 0

Re: Contrib: addpartial overlay (ITS#3593)
by dhawes＠vt.edu 19 Jul '07

19 Jul '07

On Thursday 19 July 2007 05:35, Gavin Henry wrote: > > An updated version of addpartial is available at: > > > > ftp://ftp.openldap.org/incoming/david_hawes-addpartial-070126.tgz > > > > This version includes changes to work with OpenLDAP 2.3 as well as > > ensuring syncrepl works properly. > > > > david hawes > > If this hasn't been added to 2.4/HEAD yet, would you consider updating it > for inclusion in 2.4 contrib? Absolutely, I've been meaning to test with 2.4. I'll bump it to the top of the list. dave

1 0

(ITS#5051) Translucent overlay and back-monitor
by ghenry＠OpenLDAP.org 19 Jul '07

19 Jul '07

Full_Name: Gavin Henry Version: 19/07/07 HEAD OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (212.159.59.85) Submitted by: ghenry Dear All, Is slapd not started and giving below expected? ================ monitor_back_register_entry_parent(""): base="cn=databases,cn=monitor" scope=subordinate filter="(&(monitoredInfo=ldap)(!(monitorOverlay=ldap))(namingContexts:distinguishedNameMatch:=dc=suretecsystems,dc=com))": unable to find entry backend_startup_one: bi_db_open failed! (1) slapd shutdown: initiated ================ Using a config like: ================ include /usr/local/etc/openldap/schema/core.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: modulepath /usr/local/libexec/openldap moduleload back_bdb.la moduleload back_ldap.la moduleload back_monitor.la moduleload translucent.la database bdb directory /usr/local/var/openldap-data cachesize 10000 suffix "dc=suretecsystems,dc=com" rootdn "cn=admin,dc=suretecsystems,dc=com" rootpw {SSHA}blah index default eq index objectClass,uid,dc,o,ou overlay translucent uri ldap://x.x.x.x:389 idassert-bind binddn="cn=admin,dc=suretecsystems,dc=com" credentials=blah database config rootdn "cn=config" rootpw {SSHA}blah database monitor ================ If I remove "database monitor", all is obviously well. However, if I put "database monitor" before "database bdb", slapd starts fine, but complains with: ================ monitor_back_register_entry_parent(""): base="cn=databases,cn=monitor" scope=subordinate filter="(&(monitoredInfo=ldap)(!(monitorOverlay=ldap))(namingContexts:distinguishedNameMatch:=dc=suretecsystems,dc=com))": unable to find entry slapd starting ================ Gavin.

1 0

(ITS#5050) array bounds violation in test045-syncreplication-proxied
by h.b.furuseth＠usit.uio.no 18 Jul '07

18 Jul '07

Full_Name: Hallvard B Furuseth Version: HEAD, RE23 OS: Linux URL: Submission from: (NULL) (129.240.202.105) Submitted by: hallvard syncprov + back-ldap, and presumably + back-meta if that were used, give an array bounds violation in test045-syncreplication-proxied: syncprov_db_open() uses connection_fake_init(), which sets op->o_tag=0. It passes op to back-ldap. ldap_back_op_result() assumes op is a known LDAP request: It calls slap_req2op() and gets SLAP_OP_LAST (for unknown tag). That is used as an index into ldapinfo_t.li_timeout[], which has size SLAP_OP_LAST. back-meta/bind.c does the same in meta_back_bind_op_result() and meta_back_op_result(). HEAD backtrace, from an assert(0) I put in slap_req2op(): #3 0x003d8d91 in __assert_fail () from /lib/tls/libc.so.6 #4 0x0809ac0e in slap_req2op (tag=0) at operation.c:203 #5 0x0816dba8 in ldap_back_op_result (lc=0x83a12f8, op=0xbfffe948, rs=0xbfffe70c, msgid=1, timeout=-1, sendok=20) at bind.c:1582 #6 0x0816d727 in ldap_back_dobind_int (lcp=0xbfffe760, op=0xbfffe948, rs=0xbfffe70c, sendok=LDAP_BACK_GETCONN, retries=0, dolock=1) at bind.c:1411 #7 0x0816d814 in ldap_back_dobind (lcp=0xbfffe760, op=0xbfffe948, rs=0xbfffe70c, sendok=LDAP_BACK_DONTSEND) at bind.c:1440 #8 0x0812921a in ldap_back_entry_get (op=0xbfffe948, ndn=0x833b2a8, oc=0x0, at=0x82ec610, rw=0, ent=0xbfffe944) at search.c:790 #9 0x080f7a55 in overlay_entry_get_ov (op=0xbfffe948, dn=0x833b2a8, oc=0x0, ad=0x82ec610, rw=0, e=0xbfffe944, on=0x0) at backover.c:365 #10 0x081bd9da in syncprov_db_open (be=0x833a8a0) at syncprov.c:2550 #11 0x080f70b2 in over_db_func (be=0x833a8a0, which=db_open) at backover.c:61 #12 0x080f74c9 in over_db_open (be=0x833a8a0) at backover.c:174 #13 0x08092515 in backend_startup_one (be=0x833a8a0) at backend.c:212 #14 0x080929a2 in backend_startup (be=0x833a8a0) at backend.c:303 #15 0x080b9a94 in slap_startup (be=0x0) at init.c:243 #16 0x0806719d in main (argc=8, argv=0xbfffef14) at main.c:919

1 0

(ITS#5049) uninitialized Connection in syncprov
by h.b.furuseth＠usit.uio.no 18 Jul '07

18 Jul '07

Full_Name: Hallvard B Furuseth Version: HEAD, RE23 OS: Linux URL: Submission from: (NULL) (129.240.202.105) Submitted by: hallvard syncprov_db_close() does not initialize 'conn' before passing it to connection_fake_init(). (That function is a bit misnamed - the passed connection must be initialized, but not the passed operation.) Fixing in HEAD. Is RE23 frozen now?

1 0

(ITS#5048) Suspicious use of 'unchecked' limit syncprov
by h.b.furuseth＠usit.uio.no 18 Jul '07

18 Jul '07

Full_Name: Hallvard B Furuseth Version: HEAD, RE23 OS: URL: Submission from: (NULL) (129.240.202.105) Submitted by: hallvard overlays/syncprov.c:syncprov_findcsn() sets an unchecked limit to 1. findcsn_cb() says /* We just want to know that at least one exists, so it's OK if * we exceed the unchecked limit or size limit. */ This looks like it can return a false positive if two or more other entries which the filter would eliminate have the same hash as the value syncprov searches for. Also syncprov_findcsn() passes fc_limits uninitialized outside of the .lms_s_unchecked field to slapd. Valgrind complains in test018 about .lms_s_pr_hide in back-bdb/search.c:bdb_search(). Tested in HEAD.

1 0

(ITS#5046) ITS auto-reply and copyright date
by ghenry＠OpenLDAP.org 14 Jul '07

14 Jul '07

Full_Name: Gavin Henry Version: OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (212.159.59.85) Submitted by: ghenry ITS auto-reply needs updating: "Copyright 1998-2006 The OpenLDAP Foundation, All Rights Reserved."

1 0

(ITS#5045) collect.c and Dynamic Config
by ghenry＠OpenLDAP.org 14 Jul '07

14 Jul '07

Full_Name: Gavin Henry Version: HEAD OS: N/A URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (212.159.59.85) Submitted by: ghenry Dear all, I think if collect.c is still to be used as demonstration of overlay code in 2.4, then it needs some of the usual ConfigDriver/ConfigTable/ConfigOCs stuff. Would be useful for new contributors etc. Saying that, there is no harm in others reviewing existing overlays. Just some thoughts. Gavin.

1 0

Re: (ITS#5044) slapd: rdwr.c:256: ldap_pvt_thread_rdwr_runlock: Assertion `rw->ltrw_r_active >= 0' failed
by h.b.furuseth＠usit.uio.no 13 Jul '07

13 Jul '07

Do you use "database ldbm" in slapd.conf? The LDAP Compare operation can make it crash that way. (Since OpenLDAP 2.3.16; back-ldbm/compare.c rev 1.53.) I've committed a fix: http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/back-ldbm/Attic/comp… BDB more reliable. LDBM has been removed in OpenLDAP 2.4. -- Regards, Hallvard

1 0

Re: (ITS#5044) slapd: rdwr.c:256: ldap_pvt_thread_rdwr_runlock: Assertion `rw->ltrw_r_active >= 0' failed
by hyc＠symas.com 13 Jul '07

13 Jul '07

alexander.kasper(a)ruhr-uni-bochum.de wrote: > Full_Name: Alexander Kasper > Version: @(#) $OpenLDAP: slapd 2.3.36 (Jul 6 2007 14:15:37) $ > OS: Linux version 2.6.18-xendomU (root@localhost) (gcc version 4.1.1 (Gentoo 4.1.1-r3)) #3 SMP > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (134.147.48.236) > > > I cannot clearly reproduce the error/assert > > slapd: rdwr.c:256: ldap_pvt_thread_rdwr_runlock: Assertion `rw->ltrw_r_active >= > 0' failed > > since the slapd dies randomly. I'm runnig it on a virtual xen userDomain in > 64Bit mode. > > plz tell me, which debug-level would be fine, since -d 65535 produce 10MB output > for one search, and as i said slapd dies randomly. There are reports that Xen does not properly support mutexes. As such, it cannot be used to run slapd. http://www.openldap.org/lists/openldap-software/200603/msg00207.html -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#5044) slapd: rdwr.c:256: ldap_pvt_thread_rdwr_runlock: Assertion `rw->ltrw_r_active >= 0' failed
by alexander.kasper＠ruhr-uni-bochum.de 13 Jul '07

13 Jul '07

Full_Name: Alexander Kasper Version: @(#) $OpenLDAP: slapd 2.3.36 (Jul 6 2007 14:15:37) $ OS: Linux version 2.6.18-xendomU (root@localhost) (gcc version 4.1.1 (Gentoo 4.1.1-r3)) #3 SMP URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (134.147.48.236) I cannot clearly reproduce the error/assert slapd: rdwr.c:256: ldap_pvt_thread_rdwr_runlock: Assertion `rw->ltrw_r_active >= 0' failed since the slapd dies randomly. I'm runnig it on a virtual xen userDomain in 64Bit mode. plz tell me, which debug-level would be fine, since -d 65535 produce 10MB output for one search, and as i said slapd dies randomly. greets Alex

1 0

Re: (ITS#5028) incomplete slapcat docs
by ghenry＠suretecsystems.com 13 Jul '07

13 Jul '07

<quote who="ghenry(a)suretecsystems.com"> > <quote who="h.b.furuseth(a)usit.uio.no"> >> hyc(a)symas.com writes: >>> steve(a)stevenwills.com wrote: >>>> The slapcat man page says in the Limitations section: >>>> >>>> In general, your slapd(8) should not be running (at least, not >>>> in >>>> read-write mode) when you do this to ensure consistency of the >>>> database. >>>> (...) >>> Given that back-ldbm has been deleted for 2.4, I guess we can just >>> delete this sentence. >> >> It could produce garbage data with back-ldif, and with some foreign >> database module. I think it should say it's safe with bdb (and null). >> Could copy it to the slapd-bdb(5) too. (I don't suggest to make >> slapcat(8) refer the user to that, since there is only one example >> anyway.) > > Obviously hdb too. Would it produce garbage on 2.4? Do we want to do anything with this for .37? > >> >> -- >> Regards, >> Hallvard >> >> >> > > >

1 0

Re: (ITS#5043) double free in slapo-rwm when rewriting search filters
by ando＠sys-net.it 12 Jul '07

12 Jul '07

Fixed in HEAD/re23 Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

(ITS#5043) double free in slapo-rwm when rewriting search filters
by ando＠sys-net.it 12 Jul '07

12 Jul '07

Full_Name: Pierangelo Masarati Version: HEAD/re23 OS: irrelevant URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (81.72.89.40) Submitted by: ando See subject; a fix is coming.

1 0

(ITS#5042) Contribution: Active Directory Password Cache
by s.hetze＠linux-ag.de 12 Jul '07

12 Jul '07

Full_Name: Sebastian Hetze Version: 2.3.30 OS: Linux URL: ftp://ftp.openldap.org/incoming/Sebastian-Hetze-pgk-070712.tgz Submission from: (NULL) (212.21.78.130) Hi *, in your FTP incoming you find a piece of software that we would like to contribute to the slapd-modules collection. We hope you find it useful and we would very much like to receive feedback about useability, ideas for improvements and (in the very unlikely case of occurance ;-) bugreports and fixes. Best regards Sebastian Hetze ------------------------------------------------------------------------------------ Active Directory Password Cache =============================== Active Directory does not provide any means to read user credentials on any public API. It is possible, to install additional libraries as password sniffer to catch and forward cleartext passwords on changes. In case you cannot or simply dont want to install such libraries, the Active Directory Password Cache overlay is your option. The Active Directory Password Cache overlay allows to mirror user account credentials without any modification on the AD server. It only takes one occasional simple bind authentication against the OpenLDAP server. If the credential has not been mirrored yet, the overlay uses the krbPrincipalName and the password provided by the user to perform a Kerberos init against the Active Directory. A successful Kerberos init guarantees a correct password for this principal, and therefor the bind finally succeeds. Within this overlay operation, the password gets encrypted with the default OpenLDAP hash alorithm and stored as userPassword attribute. There is an option to update the sambaNTPassword also (using code borrowed from Howard Chu's smbk5pwd overlay). All following simple bind authentications will first try these cached credentials, making the OpenLDAP server independent from AD. In case the user changes its password on the Active Directory server, the old password stays valid in OpenLDAP until the user first presents the new password for an simple bind. Within this bind operation, the overlay performs another Kerberos init and updates the cached credentials in OpenLDAP.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs