- openldap-bugs - openldap.org

(ITS#5287) lanman hashes break compiling with GnuTLS
by quanah＠zimbra.com 17 Dec '07

17 Dec '07

Full_Name: Quanah Gibson-Mount Version: 2.4.7 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (66.92.25.194) If one enables lanman hashes while building OpenLDAP, and using GnuTLS instead of OpenSSL, the build will fail as the lanman code has OpenSSL specific assumptions. --Quanah

1 0

(ITS#5286) NULL value in sets
by raphael.ouazana＠linagora.com 17 Dec '07

17 Dec '07

Full_Name: Raphael Ouazana Version: HEAD, RE24, RE23 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (164.2.255.244) Hi, I repost this here as I think the discussion was lost in a closed ITS (#4860). The two solutions (other operation or previous behavior) would be fine for us, but I have not really time to make a patch for the moment. Le Sam 10 novembre 2007 16:37, ando(a)sys-net.it a .crit : >> Below I represent sets in {element1, element2} notation, to describe the >> current behaviour (in HEAD) for slap_set_join on the '+' operation: >> - {"One", "Two"} + {"Three", "Four"} ==> {"OneThree", "OneFour", >> "TwoThree", "TwoFour"} >> - {"One", "Two"} + {""} ==> {"One", "Two"} >> - {"One", "Two"} + {NULL} ==> {"One", "Two"} > > Although sets lack a specification, I think this behavior is desirable > in many cases: adding NULL is equivalent to adding EMPTY (""). The problem is that {NULL} is equivalent to NULL, ie the empty set. >> Consider the following set: >> set="[ldap:///] + [ldap:///<searchbase>??<scope>?<filter1>] + >> [??<scope>?<filter2>]" >> >> Assuming [ldap:///<searchbase>??<scope>?<filter1>] returns a DN, this >> works. However, if [ldap:///<searchbase>??<scope>?<filter1>] returns no >> entries, this value is NULL. Therefore, the rest of the set becomes: >> "[ldap:///] + {NULL} + [??<scope>?<filter2>]" >> ...which is handed to the '+' operation in slap_set_join, to become: >> [ldap:///??<scope>?<filter2>] >> ...which obviously isn't valid. > > Well, it is valid: it's an URI with an EMPTY DN. In terms of LDAP, yes, but it can cause security issues here, as the EMPTY DN is at a higher level that any one which would have been returned by a normal result. >> The attached patch changes the last case of the current behaviour for >> slap_set_join on the '+' operation. This was already the behaviour >> before version 1.24.2.6 Thu Sep 13 20:43:29 2007 UTC: >> - {"One", "Two"} + {NULL} ==> {NULL} > > This is different from the above behavior, although it makes sense on > its own. Probably we need two different addition operators: one > inclusive (NULL is equivalent to "") and one exclusive (NULL nullifies > the concatenation). > > Comments? No problem in having the two operators. I just think the normal behavior is to return NULL, has in term of sets the cartesian product A x NULL returns NULL, not A. Regards, Raphael Ouazana.

1 0

Re: (ITS#5274) add search to online docs
by h.b.furuseth＠usit.uio.no 16 Dec '07

16 Dec '07

kurt(a)OpenLDAP.org writes: > Right, not everyone knows how to make the fullest of the tools > available to them, or even know what tools are available to them. I > don't see providing yet another tool as a solution to these problems. I thought I was suggesting (an interface to) an existing tool - and teaching a way to use that as an added bonus. A matter of semantics I guess. -- Regards, Hallvard

1 0

Re: (ITS#5274) add search to online docs
by kurt＠OpenLDAP.org 16 Dec '07

16 Dec '07

On Dec 13, 2007, at 4:47 AM, Hallvard B Furuseth wrote: > kurt(a)OpenLDAP.org writes: >> There are lots of existing ways of searching an admin guide. >> >> First, most web search engines can be told to localize their search >> to >> a set of pages. For instance: >> http://www.google.com/search?q=site:www.openldap.org/doc/ >> admin24+rwm > > Not everyone knows how to do that. Right, not everyone knows how to make the fullest of the tools available to them, or even know what tools are available to them. I don't see providing yet another tool as a solution to these problems. -- Kurt

1 0

Re: (ITS#5285) password policy checks userPassword hash even without policies
by hyc＠symas.com 15 Dec '07

15 Dec '07

mbackes(a)symas.com wrote: > Full_Name: Matthew Backes > Version: 2.3, 2.4, head, etc > OS: all > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (67.115.65.234) > > > When receiving a new userPassword, slapo-ppolicy checks to see if that password > matches the hash already present in userPassword, and disallows it if this is > the case. > > This is a sensible default for most circumstances, as otherwise the user could > reset their age counters by using the same password. > > Unfortunately, it also blocks arguably-legitimate password changes; e.g. when > migration to SSHA from CRYPT where the first 8 chars of the new password match > the old. > > This patch changes this userPassword-has-changed check to only apply if there is > a password policy defined which requires it; in particular, any of pwdInHistory, > pwdMinAge, pwdMaxAge, pwdCheckQuality, or pwdMustChange must apply for this > check to be enforced. Rereading draft-behera, it says 5.2.4 pwdInHistory This attribute specifies the maximum number of used passwords stored in the pwdHistory attribute. If this attribute is not present, or if the value is 0, used passwords are not stored in the pwdHistory attribute and thus may be reused. As such the test can be simplified. Committing to HEAD. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

ITS#5145 Automatic groups overlay
by hyc＠symas.com 15 Dec '07

15 Dec '07

I did some minor cleanup and committed this. I think there may be other changes that could be made, to take advantage of sorted values and so cut down on the overhead of managing groups with large numbers of members. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: ITS#3515 ACLs enhancements
by ando＠sys-net.it 15 Dec '07

15 Dec '07

hyc(a)symas.com wrote: > This looks mostly like ACI to me, with some special inheritance rules. Is it > still relevant? AFAIR that was a custom ACL checking development that I found interesting from a technical point of view but (I might be wrong) of limited usefulness outside the scope it was developed for. In the meanwhile, and probably triggered by that posting, I added several ways of customizing access checking: via overlays, using dynacl (that was added earlier, for the purpose of isolating ACIs, but it could have served the same purpose). In this sense, I don't think this contribution can be of any use right now; it coulr be turned into a dynacl for custom use by the posters, or by anyone who find it useful. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: ITS#4987 slapo-constraint improvement
by hyc＠symas.com 15 Dec '07

15 Dec '07

hyc(a)symas.com wrote: > In reviewing the patch, I see several small details that need to be fixed. > E.g., you added a config keyword but re-used an existing OID for your new > attribute. OIDs must never be re-used, and certainly you must not use two > different attributes with the same OID. Oh never mind, I see the confusion. You're just defining a new 2nd argument to the existing keyword. > You use strlen/strncat, which are heavily discouraged in our code. (We never > use strcat/strncat; we use strlen only when it's unavoidable.) (Some uses of > strlen already existed in constraint.c; we just didn't get around to > eliminating them.) In general we use bervals instead of flat strings, and > there's almost never a reason to count string lengths at runtime. > > I got 3 rejects when applying the patch to my source tree (current HEAD). > > I think these points can all be cleaned up pretty easily. Let me know if you > need any particular pointers. I'm working on getting this to build now. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

ITS#4987 slapo-constraint improvement
by hyc＠symas.com 15 Dec '07

15 Dec '07

In reviewing the patch, I see several small details that need to be fixed. E.g., you added a config keyword but re-used an existing OID for your new attribute. OIDs must never be re-used, and certainly you must not use two different attributes with the same OID. You use strlen/strncat, which are heavily discouraged in our code. (We never use strcat/strncat; we use strlen only when it's unavoidable.) (Some uses of strlen already existed in constraint.c; we just didn't get around to eliminating them.) In general we use bervals instead of flat strings, and there's almost never a reason to count string lengths at runtime. I got 3 rejects when applying the patch to my source tree (current HEAD). I think these points can all be cleaned up pretty easily. Let me know if you need any particular pointers. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

ITS#4366 userPassword compare
by hyc＠symas.com 15 Dec '07

15 Dec '07

I think this is in general a bad idea. It's already noted as such in the README, which is fine. The code generally looks pretty good, although it would need to be updated for cn=config support. Does anyone else see a reason to integrate this and get it working with cn=config? -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

ITS#3515 ACLs enhancements
by hyc＠symas.com 15 Dec '07

15 Dec '07

This looks mostly like ACI to me, with some special inheritance rules. Is it still relevant? -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#5285) password policy checks userPassword hash even without policies
by mbackes＠symas.com 15 Dec '07

15 Dec '07

Full_Name: Matthew Backes Version: 2.3, 2.4, head, etc OS: all URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (67.115.65.234) When receiving a new userPassword, slapo-ppolicy checks to see if that password matches the hash already present in userPassword, and disallows it if this is the case. This is a sensible default for most circumstances, as otherwise the user could reset their age counters by using the same password. Unfortunately, it also blocks arguably-legitimate password changes; e.g. when migration to SSHA from CRYPT where the first 8 chars of the new password match the old. This patch changes this userPassword-has-changed check to only apply if there is a password policy defined which requires it; in particular, any of pwdInHistory, pwdMinAge, pwdMaxAge, pwdCheckQuality, or pwdMustChange must apply for this check to be enforced. RCS file: /repo/OpenLDAP/pkg/ldap/servers/slapd/overlays/ppolicy.c,v retrieving revision 1.110 diff -u -r1.110 ppolicy.c --- ppolicy.c 17 Nov 2007 12:39:19 -0000 1.110 +++ ppolicy.c 15 Dec 2007 03:21:27 -0000 @@ -1776,7 +1776,13 @@ * Last check - the password history. */ /* FIXME: no access checking? */ - if (slap_passwd_check( op, NULL, pa, bv, &txt ) == LDAP_SUCCESS) { + if (( pp.pwdInHistory + || pp.pwdMinAge + || pp.pwdMaxAge + || pp.pwdCheckQuality + || pp.pwdMustChange ) /* make sure we care */ + && ( slap_passwd_check( op, NULL, pa, bv, &txt ) + == LDAP_SUCCESS )) { /* * This is bad - it means that the user is attempting * to set the password to the same as the old one.

1 0

ITS#3429 schema download module
by hyc＠symas.com 15 Dec '07

15 Dec '07

I was looking at this code in relation to current HEAD/RE24, and things have changed quite a bit. Given the ability to dynamically load schema into cn=config, is there still a need for this module? (It is in fact the changes made for dynamic schema manipulation in slapd that causes the compatibility issues with this module.) -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

ITS#4398 unique overlay enhancement
by hyc＠symas.com 15 Dec '07

15 Dec '07

Thanks for your patches. A more extensive version of these features was added in OpenLDAP 2.4 (March 2007). This ITS will be closed. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5263) ldap_parse_sasl_bind_result() returning wrong error code
by hyc＠symas.com 15 Dec '07

15 Dec '07

rhafer(a)suse.de wrote: > Full_Name: Ralf Haferkamp > Version: HEAD, RE23, RE24 > OS: - > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (89.166.205.58) > > > According to the man-pages and the C-API draft the ldap_parse_*_result() > functions return LDAP_SUCCESS, when the result was successfully parsed, > otherwise != LDAP_SUCCESS. > The current implementation of ldap_parse_sasl_bind_result() (not sure about > ldap_parse_extended_result()) however will return the LDAP Error Code of the > passwd LDAPMessages as the result (e.g. LDAP_SASL_BIND_IN_PROGRESS). > > If this is the desired behavior we should fix our documentation. But I guess > this is a bug in ldap_parse_sasl_bind_result() and probably > ldap_parse_extended_result(). Fixed in HEAD. ldap_parse_extended_result() was correct. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5284) cn=config overlay order
by hyc＠symas.com 15 Dec '07

15 Dec '07

dhawes(a)vt.edu wrote: > Full_Name: David Hawes > Version: 2.3.39/2.4.6 > OS: Debian GNU/Linux > URL: > Submission from: (NULL) (96.228.44.90) > > > Overlays are processed in the reverse order of slapd.conf when using slapd.d. Thanks for the report, this is now fixed in CVS HEAD. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#5284) cn=config overlay order
by dhawes＠vt.edu 14 Dec '07

14 Dec '07

Full_Name: David Hawes Version: 2.3.39/2.4.6 OS: Debian GNU/Linux URL: Submission from: (NULL) (96.228.44.90) Overlays are processed in the reverse order of slapd.conf when using slapd.d. If I have the following in slapd.conf: ... overlay overlay1 overlay overlay2 overlay overlay3 ... and convert it to slapd.d, I will see the following in cn=config: ... # {0}overlay3, {1}bdb, config dn: olcOverlay={0}overlay3,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig olcOverlay: {0}overlay3 # {1}overlay2, {1}bdb, config dn: olcOverlay={1}overlay2,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig olcOverlay: {1}overlay2 # {2}overlay1, {1}bdb, config dn: olcOverlay={2}overlay1,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig olcOverlay: {2}overlay1 ... When slapd is started with slapd.conf, the overlay stack is correct (overlay3 -> overlay2 -> overlay1 for processing order), although cn=config reports the above. When slapd.d is used, the overlay stack is the opposite (overlay1 -> overlay2 -> overlay3). This occurs in both 2.3.39 and 2.4.6. I see this as a problem in situations where order of overlays is important (syncprov comes to mind).

1 0

Re: (ITS#5280) JLDAP waits for response for request which hasn't been sent because of connection shutdown
by M.Waldowski＠sulechow.net 14 Dec '07

14 Dec '07

Hello. I didn't know that pastes from rafb.net are removed after 24 hours. The new location of thread dump is here: http://www.sulechow.net/~mwaldows/ITS-5280/thread-dump.log and new location of JLDAP debug is here: http://www.sulechow.net/~mwaldows/ITS-5280/debug.log Regards Marcin M.Waldowski(a)sulechow.net wrote: > Full_Name: Marcin Waldowski > Version: novell-jldap-devel-2007.10.12-1netware_windows > OS: Windows XP > URL: > Submission from: (NULL) (83.20.102.205) > > > Hello. > > Our application gets lots of information from LDAP server which uses refferals. > Code which use jldap is executed in single thread. After some time of obtaining > informations JLDAP hangs in MessageAgent.getLDAPMessage() as you can see at > following thread dump: > > http://rafb.net/p/kwhTyh67.html > > It is repeatable every time we execute our application. It hangs always in the > same line of JLDAP code. > > We turned on jldap debug (-Dldap.debug=TraceAll) and also sniffed communication > between JLDAP and LDAP server using Wireshark. Interesting part of JLDAP debug > you can see here: > > http://rafb.net/p/diqKzz11.html > > As you can see some refferal connections is lost in lines 14, 35, 53. After that > we have some writes to that connections in lines 240 (message 146), 283 > (message 147) and 333 (message 148). All this writes didn't come to the wire (as > we can see in Wireshark or rather cannot see) because of "java.io.IOException: > Output stream not initialized". This exception is only logged to debug stream > and silently discarded in com.novell.ldap.Connection.writeMessage(LDAPMessage > msg) because variable clientActive is false. So, If I understand it correctly, > caller code doesn't know that anything goes wrong in called (write message) > code. As a result JLDAP still wait for responses of messages 146, 147, 148 which > hasn't been sent. This ends up with forever wait in line 368 of debug stream. > > Regards > Marcin > > >

1 0

(ITS#5280) JLDAP waits for response for request which hasn't been sent because of connection shutdown
by M.Waldowski＠sulechow.net 14 Dec '07

14 Dec '07

Full_Name: Marcin Waldowski Version: novell-jldap-devel-2007.10.12-1netware_windows OS: Windows XP URL: Submission from: (NULL) (83.20.102.205) Hello. Our application gets lots of information from LDAP server which uses refferals. Code which use jldap is executed in single thread. After some time of obtaining informations JLDAP hangs in MessageAgent.getLDAPMessage() as you can see at following thread dump: http://rafb.net/p/kwhTyh67.html It is repeatable every time we execute our application. It hangs always in the same line of JLDAP code. We turned on jldap debug (-Dldap.debug=TraceAll) and also sniffed communication between JLDAP and LDAP server using Wireshark. Interesting part of JLDAP debug you can see here: http://rafb.net/p/diqKzz11.html As you can see some refferal connections is lost in lines 14, 35, 53. After that we have some writes to that connections in lines 240 (message 146), 283 (message 147) and 333 (message 148). All this writes didn't come to the wire (as we can see in Wireshark or rather cannot see) because of "java.io.IOException: Output stream not initialized". This exception is only logged to debug stream and silently discarded in com.novell.ldap.Connection.writeMessage(LDAPMessage msg) because variable clientActive is false. So, If I understand it correctly, caller code doesn't know that anything goes wrong in called (write message) code. As a result JLDAP still wait for responses of messages 146, 147, 148 which hasn't been sent. This ends up with forever wait in line 368 of debug stream. Regards Marcin

2 1

Re: (ITS#5273) ldap.conf and TLS as a default
by hyc＠symas.com 14 Dec '07

14 Dec '07

This appears to be the same as ITS#5039. This ITS will be closed, you can followup to #5039. cardoe(a)gentoo.org wrote: > Full_Name: Douglas Klima > Version: 2.3. > OS: Linux > URL: > Submission from: (NULL) (216.155.111.10) > > > I was looking for a way to make TLS the default in > /etc/openldap/ldap.conf however it currently seems impossible. You can > specify LDAP over clear text and LDAP over SSL but you can't specify > LDAP over TLS (I'm talking about "start_tls"). It seems like ldaps:// is > deprecated in favor of ldap:// + TLS, which is why I'm trying to > configure this. > > Currently my /etc/openldap/ldap.conf looks like: > BASE dc=example,dc=com > URI ldap://srv1.example.com ldap://srv2.example.com > TLS_REQCERT demand > TLS_CACERTDIR /etc/ssl/certs > > If I do the following: > $ ldapsearch > ldap_bind: Confidentiality required (13) > additional info: TLS confidentiality required > > If I change URI to have "ldaps://srv1.example.com:389", then > $ ldapsearch > just hangs until it times out. Clearly it's not using start_tls. > > Now if I change URI back to it's original setting and do: > > $ ldapsearch -Z > .... > # search result > search: 3 > result: 0 Success > > # numResponses: 54 > # numEntries: 53 > > I get a successful lookup. I'm basically looking for a way to pass "-Z" > in /etc/openldap/ldap.conf and in .ldaprc > > Initially I tried to send this to the OpenLDAP ML but was told by MacJobBz to > submit this to ITS. > > > -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#5283) translucent search enhancement
by hyc＠OpenLDAP.org 14 Dec '07

14 Dec '07

Full_Name: Howard Chu Version: HEAD/RE24 OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (76.91.220.157) Submitted by: hyc Currently the translucent overlay only searches the remote database, then matches local entries to the results. It needs to be able to search the local database as well.

1 0

Re: (ITS#5276) include handler broken
by quanah＠zimbra.com 14 Dec '07

14 Dec '07

--On December 13, 2007 1:17:08 AM +0000 quanah(a)zimbra.com wrote: > Full_Name: Quanah Gibson-Mount > Version: 2.3.39 Also broken in OpenLDAP 2.4.7. This config works as expected: include "/usr/local/etc/openldap/schema/core.schema" include "/usr/local/etc/openldap/schema/cosine.schema" include "/usr/local/etc/openldap/schema/inetorgperson.schema" threads 8 pidfile "/var/run/slapd.pid" argsfile "/var/run/slapd.args" loglevel 256 modulepath /usr/local/lib/openldap moduleload back_bdb.la moduleload back_hdb.la moduleload back_monitor.la moduleload syncprov.la moduleload accesslog.la access to * by * write database config rootpw secret database bdb suffix "" rootdn "cn=config" cachesize 10000 idlcachesize 10000 checkpoint 64 5 directory "/usr/local/openldap-data" index objectClass eq index uid pres,eq index mail pres,eq,sub index cn pres,eq,sub index displayName pres,eq,sub index sn pres,eq,sub index gn pres,eq,sub index entryUUID eq index entryCSN eq sizelimit unlimited timelimit unlimited overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 500 Modifying it so that it is now: include "/usr/local/etc/openldap/schema/core.schema" include "/usr/local/etc/openldap/schema/cosine.schema" include "/usr/local/etc/openldap/schema/inetorgperson.schema" threads 8 pidfile "/var/run/slapd.pid" argsfile "/var/run/slapd.args" loglevel 256 modulepath /usr/local/lib/openldap moduleload back_bdb.la moduleload back_hdb.la moduleload back_monitor.la moduleload syncprov.la moduleload accesslog.la access to * by * write database config rootpw secret include /usr/local/etc/openldap/bdb-conf include /usr/local/etc/openldap/overlays-conf Where bdb-conf is: database bdb suffix "" rootdn "cn=config" cachesize 10000 idlcachesize 10000 checkpoint 64 5 directory "/usr/local/openldap-data" index objectClass eq index uid pres,eq index mail pres,eq,sub index cn pres,eq,sub index displayName pres,eq,sub index sn pres,eq,sub index gn pres,eq,sub index entryUUID eq index entryCSN eq sizelimit unlimited timelimit unlimited and overlays-conf is: overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 500 The contextCSN is never created in the root database, whereas in the former example it is. I did other experiments with a more complicated config, and managed to completely lock up slapd as well. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#5161) delta-syncrepl mutex lockup
by quanah＠zimbra.com 13 Dec '07

13 Dec '07

Verified fix for 2.3 works for me. --Quanah --On December 5, 2007 3:27:07 PM +0000 quanah(a)zimbra.com wrote: > Just to note, Howard tracked this down to the overlay not handling > abandonding clients. i.e., I can trigger this behavior repeatably by > issuing 3 async deletes to the master and then unbinding without waiting > for the results of the deletes. Sync deletes obviously do not trigger > this. > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > > -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#5282) refreshAndPersist can miss changes if error occurs
by hyc＠symas.com 13 Dec '07

13 Dec '07

quanah(a)zimbra.com wrote: > Full_Name: Quanah Gibson-Mount > Version: 2.3.39 > OS: > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (76.21.80.71) > > > If one is using refreshAndPersist with syncrepl, and an error occurs during a > change, the contextCSN will not be updated. However, if a /new/ change comes in > after that, that is successful, the CSN will be updated, and the missed change > is lost. This can happen, for example, if the replica runs out of locks while > making the change. It would be best then, if this happens, for the replica to > drop out of persist mode. This is a good reason to set an interval with this > mode. This was fixed in HEAD in January 2006. So the fix is in all 2.4 releases, but never made it into RE23. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#5282) refreshAndPersist can miss changes if error occurs
by quanah＠zimbra.com 13 Dec '07

13 Dec '07

Full_Name: Quanah Gibson-Mount Version: 2.3.39 OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (76.21.80.71) If one is using refreshAndPersist with syncrepl, and an error occurs during a change, the contextCSN will not be updated. However, if a /new/ change comes in after that, that is successful, the CSN will be updated, and the missed change is lost. This can happen, for example, if the replica runs out of locks while making the change. It would be best then, if this happens, for the replica to drop out of persist mode. This is a good reason to set an interval with this mode.

1 0

(ITS#5281) doc contribution - set examples - following references
by andreas＠mandriva.com.br 13 Dec '07

13 Dec '07

Full_Name: Andreas Hasenack Version: 2.4.6 OS: Linux URL: http://users.mandriva.com.br/~andreas/ldap-doc/doc-set-examples/set-followi… Submission from: (NULL) (200.140.247.99) http://users.mandriva.com.br/~andreas/ldap-doc/doc-set-examples/set-followi… Documentation contribution with further examples regarding the usage of sets in ACLs. This time, using a user/manager/secretary/group example. These files are derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Andreas Hasenack <andreas(a)mandriva.com.br>. These modifications are not subject to any license of Mandriva. I, Andreas Hasenack, hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

(ITS#5279) doc contribution - set examples - memberUid
by andreas＠mandriva.com.br 13 Dec '07

13 Dec '07

Full_Name: Andreas Hasenack Version: 2.4.6 OS: Linux URL: http://users.mandriva.com.br/~andreas/ldap-doc/doc-set-examples/set-memberU… Submission from: (NULL) (200.140.247.99) http://users.mandriva.com.br/~andreas/ldap-doc/doc-set-examples/set-memberU… Documentation contribution explaining how to use sets to emulate group ACLs when the member attribute is not in the DN syntax (like posixGroup as defined in RFC2307). These files are derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Andreas Hasenack <andreas(a)mandriva.com.br>. These modifications are not subject to any license of Mandriva. I, Andreas Hasenack, hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

(ITS#5278) doc contribution - set examples - recursive groups
by andreas＠mandriva.com.br 13 Dec '07

13 Dec '07

Full_Name: Andreas Hasenack Version: 2.4.6 OS: Linux URL: http://users.mandriva.com.br/~andreas/ldap-doc/doc-set-examples/set-recursi… Submission from: (NULL) (200.140.247.99) Please find at http://users.mandriva.com.br/~andreas/ldap-doc/doc-set-examples/set-recursi… a documentation contribution giving set examples. So far, it has one example (recursive groups) and I will expand it to include more examples in the future. It is not in the form of a patch because I'm not sure in the guide where it would fit in, considering that the ACL part is duplicated (cn=config and slapd.conf) and will probably be changed. These files are derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Andreas Hasenack <andreas(a)mandriva.com.br>. These modifications are not subject to any license of Mandriva. I, Andreas Hasenack, hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

Re: (ITS#5274) add search to online docs
by h.b.furuseth＠usit.uio.no 13 Dec '07

13 Dec '07

kurt(a)OpenLDAP.org writes: > There are lots of existing ways of searching an admin guide. > > First, most web search engines can be told to localize their search to > a set of pages. For instance: > http://www.google.com/search?q=site:www.openldap.org/doc/admin24+rwm Not everyone knows how to do that. And in some cases such a Google search gives a better interface than a browser search, since it can show all resulsts together, with some context. The HTML seems easy enough - I derived this from a "search within results" form in a Google search: <form action="http://www.google.com/search"> <input type=hidden name=q value="site:openldap.org/doc/admin24"> <input type=text name=as_q size=31 maxlength=256 value=""> <input type=submit name=btnG VALUE="Search Admin Guide"> </form> I don't know how easy it is to auto-insert it in the Guide though. (Could easily be put as a third column in the /doc/index.html table I imagine.) -- Regards, Hallvard

1 0

Re: (ITS#5274) add search to online docs
by kurt＠OpenLDAP.org 13 Dec '07

13 Dec '07

On Dec 12, 2007, at 12:02 PM, craig5(a)pobox.com wrote: > Full_Name: Craig Sebenik > Version: 2.3.35 > OS: CentOS 4.5 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (209.220.152.66) > > > It would be helpful if the admin documentation on the OpenLDAP web > pages had > some way to search. There are lots of existing ways of searching an admin guide. First, most web search engines can be told to localize their search to a set of pages. For instance: http://www.google.com/search?q=site:www.openldap.org/doc/admin24+rwm Second, the guide is available as a readily searchable single HTML document. Third, the guide is available as readily searchable PDF document. > > > http://www.openldap.org/doc/admin24/ > > IMO, it would be fantastic if there was a simple search box on each > page and an > "advanced search page" with more options. Use your browsers built-in search functions to search any single page, and if they aren't advanced enough for you, try a different browser. > However, a simple search box on just > the main page would be a great start. See above suggestions. Lastly, such things are easier said than done. I simply don't see sufficient value here to warrant expending the significant resources it would take to design, implement, test, and deploy a solution fulfilling this request. -- Kurt

1 0

Re: (ITS#5274) add search to online docs
by ghenry＠OpenLDAP.org 13 Dec '07

13 Dec '07

craig5(a)pobox.com wrote: > Full_Name: Craig Sebenik > Version: 2.3.35 > OS: CentOS 4.5 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (209.220.152.66) > > > It would be helpful if the admin documentation on the OpenLDAP web pages had > some way to search. > > http://www.openldap.org/doc/admin24/ > > IMO, it would be fantastic if there was a simple search box on each page and an > "advanced search page" with more options. However, a simple search box on just > the main page would be a great start. > > Maybe htdig or similar, or a custom Google link? -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

(ITS#5277) Feature request: Impose SSL/TLS for some addresses/interfaces
by michele.codutti＠uniud.it 13 Dec '07

13 Dec '07

Full_Name: Michele Codutti Version: 2.3 OS: Linux/Debian URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (158.110.7.132) Recently I need to implement a clustered system of OpenLDAP with syncrepl replication method. Every node has two interfaces: one public (let's say eth0) and one connected to a private subnet (let's say eth1). What I want is to impose only SSL/TLS connection on eth0 and unencrypted connection on eth1. I want this because is useless to encrypt syncrepl traffic through the private (dedicated and secured) subnet. I haven't found any directive that do what I want. At last I've implemented a solution suggested by Pierangelo Masaratti. I imposed TLS/SSL by these ACL's: access to * by sockurl="ldap://$PUBLIC_NAME" ssf=128 break by sockurl="ldap://$PUBLIC_NAME" stop by sockurl="ldaps://$PUBLIC_NAME" ssf=128 break by sockurl="ldaps://$PUBLIC_NAME" stop by * break Pierangelo also suggested me to write an ITS to ask for a specific directive to do this more naturaly. So here I'm. Could it be done?

1 0

(ITS#5236) core.ldif differs from core.schema
by hyc＠symas.com 13 Dec '07

13 Dec '07

Michael Ströder wrote: > HI! > > following up on this because some older schema files reference > 'countryName' (and worked with RE23). > > Howard Chu wrote: >> I'm puzzled why RFC4519 drops the 'countryName' alias for this type >> from the RFC2256 definition. > > Me too... > > How to deal with that (except changing the schema files of other vendors)? After chatting with Kurt, we confirmed that there was no reason to drop the alias from our schema files, so I've restored it. (Implementations are allowed to recognize multiple names for the same attribute. Since slapd still only generates the canonical name in its output, we are still conformant.) -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5261) Samba4 can 'hang' OpenLDAP slapd
by hyc＠symas.com 13 Dec '07

13 Dec '07

Andrew Bartlett wrote: > On Tue, 2007-12-11 at 14:22 -0800, Howard Chu wrote: >> Andrew Bartlett wrote: >>> I wonder if there is a known issue with db 4.6 and OpenLDAP, as Fedora's >>> OpenLDAP seems to include it's own libslapd_db-4.4.so (it has a >>> slapd_db_stat to match, for 4.4). >> I think they packaged that to avoid using BDB 4.3 which was known to be >> broken. I've been using OpenLDAP with BDB 4.6.1 thru 4.6.3, and 4.6.18 thru >> 4.6.21 without any trouble. > > Where there any further clues on my deadlock in the db_stat output? I've just built Samba4 from svn and tried to run this test, but it fails much earlier on my AMD64 system. It looks like your ldbsearch client is generating an invalid request, perhaps it's not 64-bit aware. In st/dc/private/ldap/logs I see: >>> slap_listener(ldapi://%2Fhome%2Fsoftware%2FSAMBA_4_0%2Fsource%2Fst%2Fdc%2Fprivate%2Fldap%2Fldapi) daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: listen=7, new connection on 20 daemon: activity on 1 descriptor daemon: activity on: 20r daemon: read active on 20 daemon: added 20r (active) listener=(nil) daemon: epoll: listen=7 active_threads=0 tvp=NULL connection_get(20) connection_get(20): got connid=0 connection_read(20): checking for input on id=0 ber_get_next ldap_read: want=8, got=8 0000: 80 04 00 0a 01 00 0a 01 ........ ber_get_next on fd 20 failed errno=34 (Numerical result out of range) connection_read(20): input error=-2 id=0, closing. All LDAP requests should begin with 0x30, the BER Sequence tag. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5275) Poor LDAP performance when we reach 1000 connections
by hyc＠symas.com 13 Dec '07

13 Dec '07

The ITS is for tracking actual bugs. There is no evidence of anything other than a misconfiguration issue here. Use the OpenLDAP-software mailing list for questions about how to use the software. This ITS will be closed. hodson.chris(a)orbital.com wrote: > Full_Name: Chris Hodson > Version: 2.3.32 > OS: Red Hat EL 4 Rel 4 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (198.207.0.5) > > > We're using a Red Hat EL 4 release 4 box to run openLDAP version 2.3.32. > Every night we find ourselves reaching 1000+ (netstat | grep ldap | wc -l) > connections to our LDAP server and have found the only resolution to restart the > LDAP service daily. When we get to 1000+ connections performance takes a huge > hit and no one is able to login to any box utilizing LDAP. This server consists > of 2 dual core Opeterons with 8 GBs of memory, so its not a hardware performance > issue. > We're able to duplicate this issue on a RHEL 4 release 5 box also when we reach > 1000+ connections using the same config files. Is there a setting that needs > adjusting so connections timeout or some other config file misconfiguration? > > > Any help would be much appreciated. > Thank you. > > > . > -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#5276) include handler broken
by quanah＠zimbra.com 13 Dec '07

13 Dec '07

Full_Name: Quanah Gibson-Mount Version: 2.3.39 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (66.92.25.194) In discussions with a fellow on IRC, it looks like the include handler has some serious problems. For example with this slapd.conf, we get: #ucdata-path "/opt/zimbra/openldap/ucdata" include "/opt/zimbra/openldap/etc/openldap/schema/core.schema" include "/opt/zimbra/openldap/etc/openldap/schema/cosine.schema" include "/opt/zimbra/openldap/etc/openldap/schema/inetorgperson.schema" include "/opt/zimbra/openldap/etc/openldap/schema/amavisd.schema" include "/opt/zimbra/openldap/etc/openldap/schema/zimbra.schema" include "/opt/zimbra/lib/conf/zimbra-ext.schema" threads 8 pidfile "/opt/zimbra/openldap/var/run/slapd.pid" argsfile "/opt/zimbra/openldap/var/run/slapd.args" TLSCertificateFile /opt/zimbra/conf/slapd.crt TLSCertificateKeyFile /opt/zimbra/conf/slapd.key TLSVerifyClient never loglevel 32768 # Load dynamic backend modules: modulepath /opt/zimbra/openldap/libexec/openldap moduleload back_bdb.la moduleload back_monitor.la moduleload syncprov.la moduleload accesslog.la <acl lines snipped> database config rootpw {SSHA}+wKEnqbcbxssdGDKx1LeNsoL90Ha2Lzx database monitor rootdn "cn=config" access to dn.children="cn=monitor" by dn.children="cn=admins,cn=zimbra" read include /opt/zimbra/conf/bdb-conf include /opt/zimbra/conf/syncrepl-conf bdb-conf is: database bdb suffix "" rootdn "cn=config" cachesize 10000 idlcachesize 10000 checkpoint 64 5 directory "/opt/zimbra/openldap-data" index objectClass eq sizelimit unlimited timelimit unlimited And we can see it is clearly processed, so why is the syncrepl line getting tagged to the monitor backend? line 47 (index entryCSN eq) index entryCSN 0x0004 line 48 (sizelimit unlimited) line 49 (timelimit unlimited) line 154 (include /opt/zimbra/conf/syncrepl-conf) reading config file /opt/zimbra/conf/syncrepl-conf line 13 (syncrepl ***) /opt/zimbra/conf/syncrepl-conf: line 13: database monitor does not support operations required for syncrepl /opt/zimbra/conf/slapd.conf: line 154: <include> handler exited with 1! Another example of this problem can be seen at: http://pastebin.com/d16e9b905

1 0

Re: (ITS#5275) Poor LDAP performance when we reach 1000 connections
by quanah＠zimbra.com 13 Dec '07

13 Dec '07

So fix your file descriptors. --Quanah --On December 12, 2007 11:02:51 PM +0000 hodson.chris(a)orbital.com wrote: > Full_Name: Chris Hodson > Version: 2.3.32 > OS: Red Hat EL 4 Rel 4 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (198.207.0.5) > > > We're using a Red Hat EL 4 release 4 box to run openLDAP version 2.3.32. > Every night we find ourselves reaching 1000+ (netstat | grep ldap | wc > -l) connections to our LDAP server and have found the only resolution to > restart the LDAP service daily. When we get to 1000+ connections > performance takes a huge hit and no one is able to login to any box > utilizing LDAP. This server consists of 2 dual core Opeterons with 8 GBs > of memory, so its not a hardware performance issue. > We're able to duplicate this issue on a RHEL 4 release 5 box also when we > reach 1000+ connections using the same config files. Is there a setting > that needs adjusting so connections timeout or some other config file > misconfiguration? > > > Any help would be much appreciated. > Thank you. > > -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#5275) Poor LDAP performance when we reach 1000 connections
by hodson.chris＠orbital.com 13 Dec '07

13 Dec '07

Full_Name: Chris Hodson Version: 2.3.32 OS: Red Hat EL 4 Rel 4 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (198.207.0.5) We're using a Red Hat EL 4 release 4 box to run openLDAP version 2.3.32. Every night we find ourselves reaching 1000+ (netstat | grep ldap | wc -l) connections to our LDAP server and have found the only resolution to restart the LDAP service daily. When we get to 1000+ connections performance takes a huge hit and no one is able to login to any box utilizing LDAP. This server consists of 2 dual core Opeterons with 8 GBs of memory, so its not a hardware performance issue. We're able to duplicate this issue on a RHEL 4 release 5 box also when we reach 1000+ connections using the same config files. Is there a setting that needs adjusting so connections timeout or some other config file misconfiguration? Any help would be much appreciated. Thank you.

1 0

(ITS#5274) add search to online docs
by craig5＠pobox.com 12 Dec '07

12 Dec '07

Full_Name: Craig Sebenik Version: 2.3.35 OS: CentOS 4.5 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (209.220.152.66) It would be helpful if the admin documentation on the OpenLDAP web pages had some way to search. http://www.openldap.org/doc/admin24/ IMO, it would be fantastic if there was a simple search box on each page and an "advanced search page" with more options. However, a simple search box on just the main page would be a great start.

1 0

(ITS#5273) ldap.conf and TLS as a default
by cardoe＠gentoo.org 12 Dec '07

12 Dec '07

Full_Name: Douglas Klima Version: 2.3. OS: Linux URL: Submission from: (NULL) (216.155.111.10) I was looking for a way to make TLS the default in /etc/openldap/ldap.conf however it currently seems impossible. You can specify LDAP over clear text and LDAP over SSL but you can't specify LDAP over TLS (I'm talking about "start_tls"). It seems like ldaps:// is deprecated in favor of ldap:// + TLS, which is why I'm trying to configure this. Currently my /etc/openldap/ldap.conf looks like: BASE dc=example,dc=com URI ldap://srv1.example.com ldap://srv2.example.com TLS_REQCERT demand TLS_CACERTDIR /etc/ssl/certs If I do the following: $ ldapsearch ldap_bind: Confidentiality required (13) additional info: TLS confidentiality required If I change URI to have "ldaps://srv1.example.com:389", then $ ldapsearch just hangs until it times out. Clearly it's not using start_tls. Now if I change URI back to it's original setting and do: $ ldapsearch -Z .... # search result search: 3 result: 0 Success # numResponses: 54 # numEntries: 53 I get a successful lookup. I'm basically looking for a way to pass "-Z" in /etc/openldap/ldap.conf and in .ldaprc Initially I tried to send this to the OpenLDAP ML but was told by MacJobBz to submit this to ITS.

1 0

Re: (ITS#5261) Samba4 can 'hang' OpenLDAP slapd
by hyc＠symas.com 12 Dec '07

12 Dec '07

Andrew Bartlett wrote: > On Tue, 2007-12-11 at 14:22 -0800, Howard Chu wrote: >> Andrew Bartlett wrote: >>> I wonder if there is a known issue with db 4.6 and OpenLDAP, as Fedora's >>> OpenLDAP seems to include it's own libslapd_db-4.4.so (it has a >>> slapd_db_stat to match, for 4.4). >> I think they packaged that to avoid using BDB 4.3 which was known to be >> broken. I've been using OpenLDAP with BDB 4.6.1 thru 4.6.3, and 4.6.18 thru >> 4.6.21 without any trouble. > > Where there any further clues on my deadlock in the db_stat output? Yes, it showed a transaction waiting for a write lock on an object that was held by a non-transactional reader. Normally that sort of thing should never deadlock. I would have to dig with gdb to identify which threads owned the locks in question. I guess I may have to build your source to try to duplicate the problem, unless you're up for walking thru a debug session thru IM/etc. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5261) Samba4 can 'hang' OpenLDAP slapd
by abartlet＠samba.org 11 Dec '07

11 Dec '07

--=-5OIFeVOYW+hUABHuhQBa Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Tue, 2007-12-11 at 14:22 -0800, Howard Chu wrote: > Andrew Bartlett wrote: > > I wonder if there is a known issue with db 4.6 and OpenLDAP, as Fedora'= s > > OpenLDAP seems to include it's own libslapd_db-4.4.so (it has a > > slapd_db_stat to match, for 4.4). >=20 > I think they packaged that to avoid using BDB 4.3 which was known to be=20 > broken. I've been using OpenLDAP with BDB 4.6.1 thru 4.6.3, and 4.6.18 th= ru=20 > 4.6.21 without any trouble. Where there any further clues on my deadlock in the db_stat output? Andrew Bartlett --=20 Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. --=-5OIFeVOYW+hUABHuhQBa Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) iD8DBQBHXw8iz4A8Wyi0NrsRAsqOAJ44WnvMZZCXxu3KWaXpG80h98a9RQCfby5v h3+M0ny5D6JqcytP+00anRs= =huku -----END PGP SIGNATURE----- --=-5OIFeVOYW+hUABHuhQBa--

1 0

Re: (ITS#5261) Samba4 can 'hang' OpenLDAP slapd
by hyc＠symas.com 11 Dec '07

11 Dec '07

Andrew Bartlett wrote: > I wonder if there is a known issue with db 4.6 and OpenLDAP, as Fedora's > OpenLDAP seems to include it's own libslapd_db-4.4.so (it has a > slapd_db_stat to match, for 4.4). I think they packaged that to avoid using BDB 4.3 which was known to be broken. I've been using OpenLDAP with BDB 4.6.1 thru 4.6.3, and 4.6.18 thru 4.6.21 without any trouble. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5265) back-ldif flunks test004-modify
by h.b.furuseth＠usit.uio.no 11 Dec '07

11 Dec '07

Pierangelo Masarati writes: >> test017-syncreplication-refresh > > works for me (in HEAD) For me too. Likely you fixed it with ldapdelete. However now HEAD run -b ldif test011-glue-slapadd fails with differently sorted entries: cn=Manager,dc=example,dc=com is out of place. >> test025-limits [didn't bump into server-side unchecked limit] > > no notion of "unckecked" (should walk the tree to find out how many > entries are there...) Or backends could count down from sizelimit.unchecked while examining and returning entries/referrals. Then fail with adminLimitExceeded if they reach zero. Is it OK to return entries followed by adminLimitExceeded? I don't see any protest in the LDAP RFCs, but I remember vaguely that the code may be mimicing X.500 errors which should not be combined with result entries. (I'll need to reread X.500 soon, it's been too long...) -- Regards, Hallvard

1 0

Re: (ITS#5265) back-ldif flunks test004-modify
by ando＠sys-net.it 11 Dec '07

11 Dec '07

h.b.furuseth(a)usit.uio.no wrote: test004 & test008: fixed (incorrect handling of file deletion) > While I'm checking this - other tests that fail with back-ldif: > test027-emptydn [cannot slapadd to a database with suffix ""] fixed > Unsupported operations, I guess: > test016-subref todo > test017-syncreplication-refresh works for me (in HEAD) > test025-limits [didn't bump into server-side unchecked limit] no notion of "unckecked" (should walk the tree to find out how many entries are there...) > test037-manage manage not supported > OK failure - compare fails because of entry order from ldapsearch: > test012-glue-populate todo > test026-dn fixed (search results not sorted by DN, thus insertion order not preserved by fs) > test004, test008 and test017 succeed in 2.3.38. Maybe the fix to > ITS#4627 (back-ldif issues) was bad? > Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: (ITS#5272) facsimileNumber matching rules status
by ando＠sys-net.it 11 Dec '07

11 Dec '07

anders(a)anduras.de wrote: > I'm filing this new bug report, because I cannot add the question to the real > issue with number 2571 (it's always "Rejected; blocked by automated review > system"). Just send a message to openldap-its(a)openldap.org with ITS#2571 in the subject. > > So, take a look at: > http://www.openldap.org/its/index.cgi/Contrib?id=2571 > > My questions are: > > - What is the current status of this issue / patch? > (I want to see it supported as soon as possible.) Just edit the schema files, adding the desired matching rules. > - What does "Await IETF action" mean?? Presumably, there's an action open with IETF about modifying that schema item. As soon as it's officially modified, OpenLDAP will modify the schema files accordingly. In the meanwhile, all we can do is release schema files that comply with the current standard. This ITS will be closed. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

(ITS#5272) facsimileNumber matching rules status
by anders＠anduras.de 11 Dec '07

11 Dec '07

Full_Name: Sven Anders Version: 2.3.35 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (84.145.248.173) Hello! I'm filing this new bug report, because I cannot add the question to the real issue with number 2571 (it's always "Rejected; blocked by automated review system"). So, take a look at: http://www.openldap.org/its/index.cgi/Contrib?id=2571 My questions are: - What is the current status of this issue / patch? (I want to see it supported as soon as possible.) - What does "Await IETF action" mean?? Regards S.

1 0

(ITS#5271) size limit by ip (feature request)
by phr2101＠columbia.edu 10 Dec '07

10 Dec '07

Full_Name: Patrick Radtke Version: 2.3.24 OS: RHEL4 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (68.145.98.209) The limits 'who' clause should be extended to allow control by ip address. Pierangelo Masarati said "Your problem sounds general enough to deserve an extension of the limits "who" clause semantics (I don't see it quite high-priority, though). In any case, the modification should be trivial enough. I suggest you file an ITS for a feature request." in response to my problem > Basically we have software running on a host that is > unable to authenticate (due to 3rd party software) > and we need to increase the size limits for queries coming from it, > without increasing that limit for all anonymous binds.

1 0

(ITS#5270) admin24/replication.html spelling
by msporleder＠gmail.com 10 Dec '07

10 Dec '07

Full_Name: Matthew Sporleder Version: 2.4 OS: netbsd URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (24.248.74.254) Try accepted here: As long as one Master is operational, writes can safely be excepted

1 0

Re: (ITS#5267) slapo-dds prevents slapd from starting in case of an empty DB
by michael＠stroeder.com 09 Dec '07

09 Dec '07

Pierangelo Masarati wrote: >> Pierangelo Masarati wrote: >>> Should be fixed in HEAD. Please test. p. >> Nope. Synced head, make distclean and re-installed. But still it does >> not start (see log below). > > Should be fixed now (no need to distclean; just make sure dds is re-built > and re-installed!). Please, re-test. Yupp. Works as expected now. Thank you. Ciao, Michael.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs