- openldap-bugs - openldap.org

Re: (ITS#5200) Wrong maxderefdepth doc or default
by hyc＠symas.com 07 Nov '07

07 Nov '07

h.b.furuseth(a)usit.uio.no wrote: > Full_Name: Hallvard B Furuseth > Version: HEAD, RE23, RE24 > OS: > URL: > Submission from: (NULL) (129.240.6.233) > Submitted by: hallvard > slapd.conf(5) and slapd-config(5) say MaxDerefDepth defaults to 1, but > include/ldap_defaults.h says #define SLAPD_DEFAULT_MAXDEREFDEPTH 15. Seems it was wrong ever since it was checked in for ITS#1749. Oh well. Fixed in HEAD. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: ITS#5212 command that caused the crash
by hyc＠symas.com 07 Nov '07

07 Nov '07

tonni(a)hetnet.nl wrote: > > That's all very interesting, but you haven't provided the standard > > items needed in a crash report - a stack trace from the crash, > > Yes I have, but later than your reply on the ITS site. > > > and the actual client command that caused the crash. Also, the slapd > > configuration, plus any relevant schema if you've used any custom > > schema in relation to this failing command. > > Other details: > > Command: > > ldapsearch2.4 -x -D "cn=admin,dc=billy,dc=demon,dc=nl" -w secret > 'facsimileTelephoneNumber=+4753491111' facsimile TelephoneNumber That's all we needed. Fixed now in HEAD. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5215) Use of ln is hardcoded in some files
by hyc＠symas.com 07 Nov '07

07 Nov '07

emmanuel.duru(a)atosorigin.com wrote: > Full_Name: Emmanuel Duru > Version: 2.3.38 > OS: Windows > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (195.68.44.148) > > > configure allows the use of "cp" instead of "ln", but the build/shtool tool uses > a hardcoded "ln" (line 1266). > Some makefiles (libraries/liblunicode, libraries/libldap_r and > servers/slapd/back-hdb) use a hardcoded "-s" option. This is a problem on > Windows because in cygwin environment "cp -s" behaves the same way as "ln -s". > The use of "ln" is not welcome here because it creates a Windows shortcut, which > is not understood by mingw compiler. We only support the MSYS build environment on Windows. If you'd like to submit a patch to address this issue that doesn't break the other platforms, we can look at incorporating it. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5218) ber_get_next at /liblber/io.c:710
by quanah＠zimbra.com 07 Nov '07

07 Nov '07

--On November 6, 2007 10:21:45 PM +0000 dappleby(a)deakin.edu.au wrote: > Is anyone able to tell me how/why this occurs? You made the mistake of using the RH ldap packages, that's why. As to whether or not this has been fixed, please don't open up bug reports on obsolete versions of OpenLDAP. Send your question to openldap-software, and maybe someone can help you there. Personally I'd suggest using Buchan Milne's builds for RH or Symas's CDS packages. Odds are though, it has been fixed. 2.2.13 is quite old, with 2.4.6 being the current release. <http://staff.telkomsa.net/packages/> <http://www.symas.com/> --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#5217) refint overlay doc contribution
by ghenry＠OpenLDAP.org 06 Nov '07

06 Nov '07

<quote who="andreas(a)mandriva.com.br"> > Full_Name: Andreas Hasenack > Version: 2.3.39 > OS: linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (200.140.247.99) > > > Please find at > http://users.mandriva.com.br/~andreas/ldap-doc/doc-refint-patch/ > a patch and some image files for the admin guide. It adds documentation, > examples and figures for the referential integrity overlay. Looks good. Same comments as ITS#5216 I really appreciate your effort for this Andreas. Thanks. > Disclaimer (let me know if I got it right: I repeated it in the patch > file, but > obviously can't add it to the binary image files): > > This patch file is derived from OpenLDAP Software. All of the > modifications to > OpenLDAP Software represented in the following patch(es) were developed by > Andreas Hasenack <andreas(a)mandriva.com.br>. These modifications are not > subject > to any license of Mandriva. > I, Andreas Hasenack, hereby place the following modifications to OpenLDAP > Software (and only these modifications) into the public domain. Hence, > these > modifications may be freely used and/or redistributed for any purpose with > or > without attribution and/or other notice. > > >

1 0

Re: (ITS#5216) Dynamic Lists doc contribution to the admin guide
by ghenry＠OpenLDAP.org 06 Nov '07

06 Nov '07

<quote who="andreas(a)mandriva.com.br"> > Full_Name: Andreas Hasenack > Version: 2.3.39 > OS: Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (200.140.247.99) > > > Please find at > http://users.mandriva.com.br/~andreas/ldap-doc/doc-dynlist-patch/ > a patch and some image files for the admin guide. It adds documentation, > examples and figures for the Dynamic List overlay. Thanks! As discussed in #ldap all looks good. > Disclaimer (let me know if I got it right: I repeated it in the patch > file, but > obviously can't add it to the binary image files): I'll leave Kurt to check this. Once approved I'll commit it and then look forward to the other patches you've got in your queue ;-) > > This patch file is derived from OpenLDAP Software. All of the > modifications to > OpenLDAP Software represented in the following patch(es) were developed by > Andreas Hasenack <andreas(a)mandriva.com.br>. These modifications are not > subject > to any license of Mandriva. > I, Andreas Hasenack, hereby place the following modifications to OpenLDAP > Software (and only these modifications) into the public domain. Hence, > these > modifications may be freely used and/or redistributed for any purpose with > or > without attribution and/or other notice. > > >

1 0

(ITS#5218) ber_get_next at /liblber/io.c:710
by dappleby＠deakin.edu.au 06 Nov '07

06 Nov '07

Full_Name: Daniel Appleby Version: 3 OS: RHEL4 Update 5 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (128.184.138.7) Hi, I am getting a signal 6 (abort) in the samba logs which reports: [2007/11/06 19:01:06, 0, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_suffix(1155) smbldap_search_suffix: Problem during the LDAP search: (Local error) smbd: ../../../libraries/liblber/io.c:516: ber_get_next: Assertion `ber->ber_buf == ((void *)0)' failed. It dropped a core and here is the full backtrace: #0 0x003db7a2 in ?? () #1 0x0025f7a5 in raise () from /lib/tls/libc.so.6 #2 0x00261209 in abort () from /lib/tls/libc.so.6 #3 0x007f06f4 in smb_panic2 (why=0x0, decrement_pid_count=1) at lib/util.c:1565 #4 0x007f086c in smb_panic (why=0x0) at lib/util.c:1454 #5 0x007dcd8f in sig_fault (sig=0) at lib/fault.c:41 #6 <signal handler called> #7 0x003db7a2 in ?? () #8 0x0025f7a5 in raise () from /lib/tls/libc.so.6 #9 0x00261209 in abort () from /lib/tls/libc.so.6 #10 0x00258d91 in __assert_fail () from /lib/tls/libc.so.6 #11 0x0094c1f5 in ber_get_next (sb=0x99231b0, len=0xbfe4072c, ber=0x992d880) at ../../../libraries/liblber/io.c:710 #12 0x0011a6a2 in try_read1msg (ld=0x9923100, msgid=10, all=1, sb=0x99231b0, lcp=0xbfe407dc, result=0xbfe40d34) at ../../../libraries/libldap/result.c:473 #13 0x0011bb6f in ldap_result (ld=0x9923100, msgid=10, all=1, timeout=0x0, result=0xbfe40d34) at ../../../libraries/libldap/result.c:378 #14 0x0011d28b in ldap_search_s (ld=0x9923100, base=0x992a618 "dc=deakin,dc=edu,dc=au", scope=2, filter=0x992da08 "(&(uid=pfield)(objectclass=sambaSamAccount))", attrs=0x992c580, attrsonly=0, res=0xbfe40d34) at ../../../libraries/libldap/search.c:364 #15 0x0086a9ff in smbldap_search (ldap_state=0x9922e70, base=0x992a618 "dc=deakin,dc=edu,dc=au", scope=2, filter=0xbfe408f0 "(&(uid=pfield)(objectclass=sambaSamAccount))", attrs=0x992c580, attrsonly=0, res=0xbfe40d34) at lib/smbldap.c:1047 #16 0x0086b116 in smbldap_search_suffix (ldap_state=0x9922e70, filter=0xbfe408f0 "(&(uid=pfield)(objectclass=sambaSamAccount))", search_attr=0x992c580, result=0xbfe40d34) at lib/smbldap.c:1148 #17 0x007c1cda in ldapsam_search_suffix_by_name (ldap_state=0x9922e00, user=Variable "user" is not available. ) at passdb/pdb_ldap.c:227 #18 0x007c524d in ldapsam_getsampwnam (my_methods=0x9922d70, user=0x992c410, sname=0x992d928 "pfield") at passdb/pdb_ldap.c:1291 #19 0x007bbaea in context_getsampwnam (context=0x9922c20, sam_acct=0x992c410, username=0x992d928 "pfield") at passdb/pdb_interface.c:197 #20 0x007bdbcf in pdb_getsampwnam (sam_acct=0x992c410, username=0x992d928 "pfield") at passdb/pdb_interface.c:883 #21 0x0082b2ad in check_sam_security (auth_context=0x9878dd0, my_private_data=0x0, mem_ctx=0x9924808, user_info=0x992d8b8, server_info=0x992afc0) at auth/auth_sam.c:240 #22 0x0082c54a in check_samstrict_security (auth_context=0x9878dd0, my_private_data=0x0, mem_ctx=0x0, user_info=0x992d8b8, server_info=0x0) at auth/auth_sam.c:372 #23 0x00829789 in check_ntlm_password (auth_context=0x9878dd0, user_info=0x992d8b8, server_info=0x992afc0) at auth/auth.c:255 #24 0x0083372e in auth_ntlmssp_check_password (ntlmssp_state=0x992bd68, user_session_key=0x0, lm_session_key=0x0) at auth/auth_ntlmssp.c:108 #25 0x00710a36 in ntlmssp_server_auth (ntlmssp_state=0x992bd68, request={data = 0x992c358 "NTLMSSP", length = 176, free = 0x7edc20 <free_data_blob>}, reply=0xbfe41350) at libsmb/ntlmssp.c:663 #26 0x0070ff0a in ntlmssp_update (ntlmssp_state=0x992bd68, in={data = 0x992c358 "NTLMSSP", length = 176, free = 0x7edc20 <free_data_blob>}, out=0xbfe41350) at libsmb/ntlmssp.c:259 #27 0x00833aa6 in auth_ntlmssp_update (auth_ntlmssp_state=0x0, request={data = 0x992c358 "NTLMSSP", length = 176, free = 0x7edc20 <free_data_blob>}, reply=0x0) at auth/auth_ntlmssp.c:187 #28 0x006b17a1 in reply_sesssetup_and_X_spnego (conn=0x0, inbuf=0xb7bc2008 "", outbuf=0xb7ba1008 "", length=354, bufsize=131072) at smbd/sesssetup.c:504 #29 0x006b2eb2 in reply_sesssetup_and_X (conn=0x0, inbuf=0xb7bc2008 "", outbuf=0xb7ba1008 "", length=354, bufsize=131072) at smbd/sesssetup.c:669 #30 0x006d95e2 in switch_message (type=115, inbuf=0xb7bc2008 "", outbuf=0xb7ba1008 "", size=354, bufsize=0) at smbd/process.c:968 #31 0x006d9a1c in process_smb (inbuf=0xb7bc2008 "", outbuf=0xb7ba1008 "") at smbd/process.c:998 #32 0x006da744 in smbd_process () at smbd/process.c:1560 #33 0x0086d057 in main (argc=2, argv=0xbfe44664) at smbd/server.c:900 Our openldap version is openldap-2.2.13-7.4E. I know that this is a redhat package etc but I would like to know if this has already been fixed or not? If it has been fixed can you let me know what version it was fixed in as I will need to supply redhat with a patch. Is anyone able to tell me how/why this occurs? If you need more info please let me know Thanks In Advance Daniel

1 0

(ITS#5217) refint overlay doc contribution
by andreas＠mandriva.com.br 06 Nov '07

06 Nov '07

Full_Name: Andreas Hasenack Version: 2.3.39 OS: linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (200.140.247.99) Please find at http://users.mandriva.com.br/~andreas/ldap-doc/doc-refint-patch/ a patch and some image files for the admin guide. It adds documentation, examples and figures for the referential integrity overlay. Disclaimer (let me know if I got it right: I repeated it in the patch file, but obviously can't add it to the binary image files): This patch file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Andreas Hasenack <andreas(a)mandriva.com.br>. These modifications are not subject to any license of Mandriva. I, Andreas Hasenack, hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

(ITS#5216) Dynamic Lists doc contribution to the admin guide
by andreas＠mandriva.com.br 06 Nov '07

06 Nov '07

Full_Name: Andreas Hasenack Version: 2.3.39 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (200.140.247.99) Please find at http://users.mandriva.com.br/~andreas/ldap-doc/doc-dynlist-patch/ a patch and some image files for the admin guide. It adds documentation, examples and figures for the Dynamic List overlay. Disclaimer (let me know if I got it right: I repeated it in the patch file, but obviously can't add it to the binary image files): This patch file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Andreas Hasenack <andreas(a)mandriva.com.br>. These modifications are not subject to any license of Mandriva. I, Andreas Hasenack, hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

cache? of parent failes for hdb
by Dan Oscarsson 06 Nov '07

06 Nov '07

I have found that using hdb there is a bug that now prevents me from moving from my old commercial X.500 database to openldap. I need to use hdb as I move objects using rename. I am running openldap under SLES 10. The version there is 2.3.32 but I have compiled 2.3.38 and tried that too. Both have same bug. Also compiled and tried openldap-2.4.5beta. Same failure there too. I am using hdb as database. What I do is to run a job that moves around a lot of leaf nodes to other branches, sometimes creating new branches before moving the leaf node there. The job moves about 7000 nodes out of 20000 when the bug occurs. After having run this, some nodes cannot be found by searching starting at a subtree under database suffix. I have done a simple test program to see if the bug appears. It does two searches: 1) Search with search base = database suffix 2) Search with search base = a branch 2 nodes deep below database suffix. If everything is correct, same number of objects should be found. My tests show: - running test: ok - running job that moves nodes - running test: failes, many objects are missing in search starting at search base that is 2 nodes below database suffix. - stopping and starting slapd - running test again: ok >From this I suspect that it is the cache of which parent node belongs to that gets corrupted. Or can it be something else? What more could I do to trace down the bug? I do not know if the above information is enough for you to find what is wrong? I have looked at the code, but it takes some time to understand it when doing it for the first time. maybe som debugging code could be added find the place where the bug is. Regards, Dan

2 1

Re: (ITS#5213) LDAP detection failed
by quanah＠zimbra.com 06 Nov '07

06 Nov '07

--On Monday, November 05, 2007 1:56 PM +0000 harij2007(a)gmail.com wrote: The ITS system is for reporting bugs in OpenLDAP, not usage questions. Please send your questions on how to use and configure OpenLDAP to openldap-software(a)openldap.org --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#5187) test020-proxycache failing in RE_2_4
by rhafer＠suse.de 06 Nov '07

06 Nov '07

I think I have an idea what causes this bug. It is possible that the client closes the connection before the server had a chance to run the cleanup handler, the server sets op->o_abandon then (in connection_closing()). And after that the cleanup handler is started, which in case of op->o_abandon does not store the results in the cache. To make this race more reproduceable it is sufficient to insert a usleep(100) before the call to slap_cleanup_play() in send_ldap_response() in result.c. Any suggestions for possible ways to fix this? On Dienstag, 23. Oktober 2007, rhafer(a)suse.de wrote: > On Dienstag, 23. Oktober 2007, ando(a)sys-net.it wrote: > > For the records: I seem to be ble to consistently reproduce the issue > > when running slapd under valgrind; > > Thanks, that seems to do the trick for me as well. > > > I haven't seen it yet when running the test > > regularly (single CPU i386, recently). -- Ralf

1 0

Re: (ITS#5214) Compilation error with a non C++ compiler
by h.b.furuseth＠usit.uio.no 06 Nov '07

06 Nov '07

It has been fixed in OpenLDAP 2.3.39. -- Hallvard

1 0

(ITS#5215) Use of ln is hardcoded in some files
by emmanuel.duru＠atosorigin.com 06 Nov '07

06 Nov '07

Full_Name: Emmanuel Duru Version: 2.3.38 OS: Windows URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (195.68.44.148) configure allows the use of "cp" instead of "ln", but the build/shtool tool uses a hardcoded "ln" (line 1266). Some makefiles (libraries/liblunicode, libraries/libldap_r and servers/slapd/back-hdb) use a hardcoded "-s" option. This is a problem on Windows because in cygwin environment "cp -s" behaves the same way as "ln -s". The use of "ln" is not welcome here because it creates a Windows shortcut, which is not understood by mingw compiler.

1 0

(ITS#5214) Compilation error with a non C++ compiler
by emmanuel.duru＠atosorigin.com 06 Nov '07

06 Nov '07

Full_Name: Emmanuel Duru Version: 2.3.38 OS: Solaris 8 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (195.68.44.148) There is a compilation error in servers/slapd/backglue.c: line 624 : "int rc" should be before line 623 : "op->o_bd = glue_back_select( b0, dn );"

1 0

UNBINDINGS and CRASH
by Antonio Guirado Puerta 05 Nov '07

05 Nov '07

Hello, We are testing openldap-2.3.38 with db-4.5.20. Our tests are oriented to measure capacity and stability of LDAP daemon. 3 clients machines perform search queries against the ldap server. We have used two types of clients: library NET::LDAP in perl, and C LDAP library directly. The problem is reproduced whit both types of clients We are observed that the ldap server crash after 24-48 hours after working with high load (1000-2000 searches/second). In log file there is the following message: connection_read(24): no connection! connection_read(18): no connection! connection_read(20): no connection! connection_read(19): no connection! connection_read(23): no connection! connection_read(18): no connection! connection_read(16): no connection! connection_read(22): no connection! connection_read(19): no connection! Using TCPDump we have observed that clients do not finish the search witch an unbind operation. Simply TCP connection is closed by a FIN packet. We suppose that this is the cause than produces the message in the LDAP log. The main issue is than after 24-48 hours the LDAP daemon dies. We have also tested openldap-2.3.30. Our configures are: Berkeley DB config.status 4.5.20 configured by ../dist/configure, generated by GNU Autoconf 2.60, with options \"'--prefix=/opt/lib/db-4.5.20' '--enable-compat185' '--enable-cxx'\" configured by ./configure, generated by GNU Autoconf 2.59, with options \"'--prefix=/opt/openldap-2.3.38' '--exec-prefix=/opt/openldap-2.3.38' '--disable-syslog' '--disable-ipv6' '--enable-slapd' '--enable-crypt' '--enable-bdb' '--enable-syncprov' '--with-threads' '--with-tls' 'CPPFLAGS=-I/opt/lib/db/include -I/opt/lib/openssl/include' 'LDFLAGS=-L/opt/lib/db/lib -L/opt/lib/openssl/lib The machine is a linux Redhat Enterprise 4.5. -- ___________________________________________ Antonio M. Guirado Puerta Sistemas de Información y Comunicaciones Fundación Integra. http://www.f-integra.org Teléfono: +34 968 355161 Fax: +34 968 355131 Correo: antonio.guirado(a)f-integra.org ___________________________________________ Este mensaje y los posibles documentos adjuntos al mismo son confidenciales y dirigidos exclusivamente a los destinatarios de los mismos. Si por un error de transmisión, o equivocación en la dirección de envío, usted ha recibido este mensaje y no es el destinatario de la información, por favor, notifíqueselo al remitente y borre este mensaje, sin usar, informar, distribuir, imprimir, copiar o difundir el mensaje, total o parcialmente, por ningún medio. Gracias.

2 1

(ITS#5213) LDAP detection failed
by harij2007＠gmail.com 05 Nov '07

05 Nov '07

Full_Name: harikrishna jalamanchili Version: 2.3.39 OS: rhel4 ws URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (65.57.245.11) i have configured the ldap server2.3.39. i could be able to create the user accounts using the ldapadd command. but i am having Google Search Appliance which in turn contains thE AIX server. i am connected to the internet. my ldap server is thrown with a dynamic ip address. now what is the problem is when i am trying to access the ldap server through the internet "LDAP detection failed" which is the message i am getting. step wise i display the configuration: step1: installed the RPM's - openldap-servers/openldap-server-sql/openldap-clients/openldap step2: extracted the openldap<version>.tgz from the net step3: cd openldap<version>/ ./configure step4: make depend step5: make step6: make test step7: su root -c 'make install' step8: then /usr/local/etc/openldap/sladp.conf file configured step9: then i edited /etc/openldap/slapd.conf file step10: then i edited /etc/openldap/ldap.conf file step11: i have created ldif file step12: according to the database i created ldif file format step13: i have edited ldap.conf file where i specified the URI i could be able to search the ldapaccounts but i was not been able to access it from the internet and as well as from gsa

1 0

ITS#5212 command that caused the crash
by tonni＠hetnet.nl 05 Nov '07

05 Nov '07

> That's all very interesting, but you haven't provided the standard > items needed in a crash report - a stack trace from the crash, Yes I have, but later than your reply on the ITS site. > and the actual client command that caused the crash. Also, the slapd > configuration, plus any relevant schema if you've used any custom > schema in relation to this failing command. Other details: Command: ldapsearch2.4 -x -D "cn=admin,dc=billy,dc=demon,dc=nl" -w secret 'facsimileTelephoneNumber=+4753491111' facsimile TelephoneNumber slapd.conf: 1386 [root:tru.leerlingen] /etc/openldap2.4 # grep '^[^#]' slapd.conf include /etc/openldap2.4/schema/core.schema include /etc/openldap2.4/schema/cosine.schema include /etc/openldap2.4/schema/corba.schema include /etc/openldap2.4/schema/inetorgperson.schema include /etc/openldap2.4/schema/java.schema include /etc/openldap2.4/schema/krb5-kdc.schema include /etc/openldap2.4/schema/kerberosobject.schema include /etc/openldap2.4/schema/misc.schema include /etc/openldap2.4/schema/nis.schema include /etc/openldap2.4/schema/nitrobit-ads.schema include /etc/openldap2.4/schema/openldap.schema include /etc/openldap2.4/schema/samba.schema include /etc/openldap2.4/schema/evolutionperson.schema include /etc/openldap2.4/schema/calendar.schema include /etc/openldap2.4/schema/qmail.schema include /etc/openldap2.4/schema/authldap.schema include /etc/openldap2.4/schema/dhcp.schema include /etc/openldap2.4/schema/pykota.schema include /etc/openldap2.4/schema/ppolicy.schema include /etc/openldap2.4/schema/DUAConfigProfile.schema include /etc/openldap2.4/schema/local.schema pidfile /var/run/ldap2.4/slapd.pid argsfile /var/run/ldap2.4/slapd.args allow bind_v2 password-hash {CLEARTEXT} TLSCACertificateFile /etc/certs/CA/CA.pem TLSCertificateFile /etc/certs/slapd/servercert.pem TLSCertificateKeyFile /etc/certs/slapd/serverkey.pem TLSVerifyClient never sasl-authz-policy to authz-regexp uid=(.*),cn=digest-md5,cn=auth "ldap:///dc=billy,dc=demon,dc=nl??sub?uid=$1" authz-regexp uid=(.*),cn=cram-md5,cn=auth "ldap:///dc=billy,dc=demon,dc=nl??sub?uid=$1" include /etc/openldap2.4/slapd.access modulepath /usr/lib/openldap2.4 moduleload back_ldap.la moduleload back_monitor.la moduleload accesslog.la moduleload ppolicy.so moduleload smbk5pwd.so plugin preoperation libaddrdnvalues-plugin.so addrdnvalues_preop_init backend monitor database monitor database config rootdn "cn=admin,dc=billy,dc=demon,dc=nl" database bdb suffix "dc=billy,dc=demon,dc=nl" directory /var/lib/ldap2.4/ rootdn "cn=admin,dc=billy,dc=demon,dc=nl" rootpw kopjekoffie overlay ppolicy ppolicy_default "cn=Standard,ou=Policies,dc=billy,dc=demon,dc=nl" ppolicy_use_lockout overlay smbk5pwd cachesize 1000 checkpoint 250 240 loglevel stats dbconfig set_cachesize 0 10240000 1 dbconfig set_lg_regionmax 2048000 dbconfig set_lg_bsize 2048000 dbconfig set_lk_max_locks 2000 dbconfig set_lk_max_lockers 2000 dbconfig set_lk_max_objects 2000 index entryCSN,entryUUID eq include /etc/openldap2.4/indices.conf indices.conf: 1385 [root:tru.leerlingen] /etc/openldap2.4 # grep '^[^#]' indices.conf index accountstatus pres,eq index anniversary pres,eq index assistantName pres,eq index assistantPhone pres,eq index birthDate pres,eq index businessRole pres,eq index calCalURI pres,eq index calFBURL pres,eq index callbackPhone pres,eq index carPhone pres,eq index category pres,eq index cn pres,eq,sub index companyPhone pres,eq index description pres,eq,sub index destinationIndicator pres,eq,sub index dhcpClassData pres,eq index dhcpHWAddress pres,eq index dhcpPrimaryDN pres,eq index dhcpRange pres,eq index displayName pres,eq,sub index fileAs pres,eq,sub index filtermember pres,eq,sub index gidNumber pres,eq index givenName pres,eq index homePhone pres,eq index homePostalAddress pres index krb5PrincipalName eq index labeledURI pres,eq index mail pres,eq,sub index mailer pres,eq index maillocaladdress pres,eq index mailroutingaddress pres,eq index mailsource pres,eq index managerName pres,eq index memberuid pres,eq index mobile pres,eq index note pres,eq index o pres,eq index objectClass pres,eq index otherPhone pres,eq index otherPostalAddress pres index ou pres,eq index pager pres,eq index postalAddress pres index primaryPhone pres,eq index pykotaUserName pres,eq,sub index pykotaGroupName pres,eq,sub index pykotaPrinterName pres,eq,sub index pykotaBillingCode pres,eq,sub index pykotaLastJobIdent eq index quota pres,eq index radio pres,eq index rfc822mailmember pres,eq index roomNumber pres,eq index sn pres,eq,sub index spouseName pres,eq index telephoneNumber pres,eq index facsimileTelephoneNumber pres index telex pres,eq index title pres,eq index tty pres,eq index uid pres,eq index uidNumber pres,eq index uniqueMember pres index userPassword pres,eq index sambaAcctFlags pres,eq index sambaAlgorithmicRidBase pres,eq index sambaDomainName pres,eq index sambaGroupType pres,eq index sambaHomeDrive pres,eq index sambaHomePath pres,eq index sambaKickoffTime pres,eq index sambaLMPassword pres,eq index sambaLogoffTime pres,eq index sambaLogonScript pres,eq index sambaLogonTime pres,eq index sambaNextGroupRid pres,eq index sambaNextRid pres,eq index sambaNextUserRid pres,eq index sambaNTPassword pres,eq index sambaPrimaryGroupSID pres,eq index sambaProfilePath pres,eq index sambaPwdCanChange pres,eq index sambaPwdLastSet pres,eq index sambaPwdMustChange pres,eq index sambaSID pres,eq,sub index sambaUserWorkstations pres,eq slapd.access: 1388 [root:tru.leerlingen] /etc/openldap2.4 # grep '^[^#]' slapd.access access to dn="cn=config" by dn=cn=admin,dc=billy,dc=demon,dc=nl write by * none access to dn.subtree="cn=config" by dn=cn=admin,dc=billy,dc=demon,dc=nl write by * none access to dn.subtree="cn=monitor" by dn.exact=cn=admin,dc=billy,dc=demon,dc=nl write by * read access to dn.subtree=dc=billy,dc=demon,dc=nl attrs=userPassword,sambaLMPassword,sambaNTPassword,accountStatus by dn=cn=admin,dc=billy,dc=demon,dc=nl write by group=cn=peoplemanagers,cn=katter,ou=groups,dc=billy,dc=demon,dc=nl write by self write by * auth access to dn.subtree=dc=billy,dc=demon,dc=nl attrs=registeredAddress,street,postalCode,postalAddress,localityName,homePhone attrs=mail,mobile,birthDate by dn=cn=admin,dc=billy,dc=demon,dc=nl write by group=cn=peoplemanagers,cn=katter,ou=groups,dc=billy,dc=demon,dc=nl write by self write access to dn.subtree=ou=contacts,dc=billy,dc=demon,dc=nl by dn=cn=admin,dc=billy,dc=demon,dc=nl write by group=cn=peoplemanagers,cn=katter,ou=groups,dc=billy,dc=demon,dc=nl write by * read access to dn.subtree=ou=pykota,dc=billy,dc=demon,dc=nl by dn=cn=admin,dc=billy,dc=demon,dc=nl write by dn=cn=pykotaadmin,ou=pykota,dc=billy,dc=demon,dc=nl write by dn=cn=pykotauser,ou=pykota,dc=billy,dc=demon,dc=nl read by * none access to dn.subtree=dc=billy,dc=demon,dc=nl attrs=pykotaLimitBy,pykotaUserName,pykotaOverCharge,pykotaLifeTimePaid,pykotaBalance,pykotaLifeTimePaid,pykotaPayments by dn=cn=admin,dc=billy,dc=demon,dc=nl write by dn=cn=pykotaadmin,ou=pykota,dc=billy,dc=demon,dc=nl write by dn=cn=pykotauser,ou=pykota,dc=billy,dc=demon,dc=nl read by * none access to dn=cn=admin,dc=billy,dc=demon,dc=nl by dn=cn=admin,dc=billy,dc=demon,dc=nl write by dn=cn=pykotaadmin,ou=pykota,dc=billy,dc=demon,dc=nl write by * search access to dn.subtree=dc=billy,dc=demon,dc=nl attrs=postalAddress,title,fileAs,telephoneNumber,description,homePhone,mobile,birthDate,mail attrs=accountstatus,confirmtext,maildrop,mailbox,mailMessageStore,homepostaladdress attrs=shadowLastChange,shadowMin,shadowMax,shadowWarning,shadowInactive,shadowFlag,shadowExpire attrs=sambaPwdCanChange,sambaPwdMustChange,sambaAcctFlags,sambaPwdLastSet attrs=sambaSID,sambaPrimaryGroupSID,sambaPasswordHistory,sambaKickoffTime attrs=sambaPwdMustChange,sambaAcctFlags,sambaPasswordHistory,sambaKickoffTime,sambaLogonHours attrs=sambaPwdCanChange,sambaPwdLastSet,sambaSID,sambaPrimaryGroupSID,sambaBadPasswordCount,sambaBadPasswordTime attrs=sambaLogonHours,sambaLogonScript,sambaHomeDrive,sambaDomainName attrs=mailhost,quota,member by dn=cn=admin,dc=billy,dc=demon,dc=nl write by dn=cn=pykotaadmin,ou=pykota,dc=billy,dc=demon,dc=nl write by group=cn=peoplemanagers,cn=katter,ou=groups,dc=billy,dc=demon,dc=nl write by self write by * none access to dn.base=cn=tru.leerlingen,dc=billy,dc=demon,dc=nl by dn=cn=admin,dc=billy,dc=demon,dc=nl write by dn=cn=pykotaadmin,ou=pykota,dc=billy,dc=demon,dc=nl write by group=cn=peoplemanagers,cn=katter,ou=groups,dc=billy,dc=demon,dc=nl write by * none access to dn.subtree=cn=System,dc=billy,dc=demon,dc=nl by dn=cn=admin,dc=billy,dc=demon,dc=nl write by group=cn=peoplemanagers,cn=katter,ou=groups,dc=billy,dc=demon,dc=nl write by * none access to dn.subtree=ou=mailaliases,ou=groups,dc=billy,dc=demon,dc=nl by dn=cn=admin,dc=billy,dc=demon,dc=nl write by group=cn=peoplemanagers,cn=katter,ou=groups,dc=billy,dc=demon,dc=nl write by * read access to dn.subtree="" by dn=cn=admin,dc=billy,dc=demon,dc=nl write by * read access to dn.subtree="dc=billy,dc=demon,dc=nl" by * read Relevant schema: core.schema --Tonni -- Tony Earnshaw Email: tonni at hetnet dot nl

1 0

Re: (ITS#5209) Setting sasl-host in slapd.conf fails
by hyc＠symas.com 05 Nov '07

05 Nov '07

arjones(a)simultan.dyndns.org wrote: > Full_Name: Andrew Rucker Jones > Version: 2.4.6 > OS: Linux > URL: > Submission from: (NULL) (87.165.239.200) > > > I just upgraded from a working 2.3.39 installation to 2.4.6 without making > changes, but slapd does not start. Upon further investigation, i found that > slaptest claims my slapd.conf is clean, but slapd -d 100 says that sasl-host is > already set. That is, in my slapd.conf, i set sasl-host once and only once, but > slapd comes across that lines and claims that sasl-host had already been set > before that. Looking at the code, it seems that lines 354-358 in config.c > (servers/slapd/) fails to accurately check whether or not something with the > ARG_UNIQUE flag has really already been set from the configuration file. > > Commenting out the sasl-host line in slapd.conf lets slapd start, but i assume > from looking at bconfig.c that the value of sasl-host is wrong. Thanks for the report, this is now fixed in HEAD. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5212) OL 2.4.6 slapd crashes on ?undefined search string
by hyc＠symas.com 05 Nov '07

05 Nov '07

tonni(a)hetnet.nl wrote: > Full_Name: Tonni Earnshaw > Version: 2.4.6 > OS: Fedora FC6 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (213.10.163.78) > > > slapd built on FC6 from Buchan Milne's openldap2.4-2.4.6-1mdv2008.1.src.rpm > available on Mandriva Cooker mirrors and specifically composed to recognize Red > Hat-derived systems. Building the source results in a number of rpms, one of > which is openldap2.4-servers-2.4.6-1.fc6.i386.rpm and contains slapd2.4. > Running 'make test' in the rpm BUILD folder after the build resulted in all > (52?) tests passing. > > slapd2.4 normally runs stably and well. Although FC6 has native BDB 4.3.29, > Buchan has created slapds to use a discrete patched 4.2.52. Whilst checking a > question on the ML and searching on the rfc2256 core.schema attribute > facsimileTelephoneNumber slapd crashed repeatedly. Increasing log level output > to 1 and parsing slaps's log showed it doing this on returning a value of > ?undefined for the search. That's all very interesting, but you haven't provided the standard items needed in a crash report - a stack trace from the crash, and the actual client command that caused the crash. Also, the slapd configuration, plus any relevant schema if you've used any custom schema in relation to this failing command. - -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

ITS#5212 stack trace on unstripped slapd binary
by tonni＠hetnet.nl 05 Nov '07

05 Nov '07

(gdb) continue Continuing. Program received signal SIGSEGV, Segmentation fault. [Switching to Thread -1237890160 (LWP 3221)] 0x080774fb in filter2bv_x (op=0x9f3eea0, f=0xb58731dc, fstr=0x9f3eee4) at filter.c:610 610 if ( f->f_av_desc->ad_type->sat_equality->smr_usage & SLAP_MR_MUTATION_NORMALIZER ) { (gdb) bt #0 0x080774fb in filter2bv_x (op=0x9f3eea0, f=0xb58731dc, fstr=0x9f3eee4) at filter.c:610 #1 0x08074afb in do_search (op=0x9f3eea0, rs=0xb6374144) at search.c:138 #2 0x0807240c in connection_operation (ctx=0xb6374238, arg_v=0x9f3eea0) at connection.c:1145 #3 0x08072981 in connection_read_thread (ctx=0xb6374238, argv=0x13) at connection.c:1271 #4 0x00d4ee07 in ldap_int_thread_pool_wrapper (xpool=0x9dd9540) at tpool.c:619 #5 0x00be245b in start_thread () from /lib/libpthread.so.0 #6 0x00b2523e in clone () from /lib/libc.so.6 (gdb) quit --Tonni -- Tony Earnshaw Email: tonni at hetnet dot nl

1 0

(ITS#5212) OL 2.4.6 slapd crashes on ?undefined search string
by tonni＠hetnet.nl 05 Nov '07

05 Nov '07

Full_Name: Tonni Earnshaw Version: 2.4.6 OS: Fedora FC6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (213.10.163.78) slapd built on FC6 from Buchan Milne's openldap2.4-2.4.6-1mdv2008.1.src.rpm available on Mandriva Cooker mirrors and specifically composed to recognize Red Hat-derived systems. Building the source results in a number of rpms, one of which is openldap2.4-servers-2.4.6-1.fc6.i386.rpm and contains slapd2.4. Running 'make test' in the rpm BUILD folder after the build resulted in all (52?) tests passing. slapd2.4 normally runs stably and well. Although FC6 has native BDB 4.3.29, Buchan has created slapds to use a discrete patched 4.2.52. Whilst checking a question on the ML and searching on the rfc2256 core.schema attribute facsimileTelephoneNumber slapd crashed repeatedly. Increasing log level output to 1 and parsing slaps's log showed it doing this on returning a value of ?undefined for the search. Because Buchan's builds install discrete OL versions, OL 2.3.39 and 2.4.6 both exist on my system and can be run independently. Sopping slapd2.4 and starting slapd2.3 proved that this problem doees not exist with 2.3.39. An ldd on the slapd binary shows it uses its own libraries, not those of slapd2.3: linux-gate.so.1 => (0x00110000) libldap_r-2.4.so.2 => /usr/lib/libldap_r-2.4.so.2 (0x00d43000) liblber-2.4.so.2 => /usr/lib/liblber-2.4.so.2 (0x00b99000) libltdl.so.3 => /usr/lib/libltdl.so.3 (0x00d3a000) libslapd24_db-4.2.so => /usr/lib/libslapd24_db-4.2.so (0x00bf6000) libodbc.so.1 => /usr/lib/libodbc.so.1 (0x00cc9000) libsasl2.so.2 => /usr/lib/libsasl2.so.2 (0x041f5000) libdl.so.2 => /lib/libdl.so.2 (0x00bc2000) libssl.so.6 => /lib/libssl.so.6 (0x0073c000) libcrypto.so.6 => /lib/libcrypto.so.6 (0x0353c000) libcrypt.so.1 => /lib/libcrypt.so.1 (0x05599000) libresolv.so.2 => /lib/libresolv.so.2 (0x003da000) libwrap.so.0 => /usr/lib/libwrap.so.0 (0x001c1000) libpthread.so.0 => /lib/libpthread.so.0 (0x00bdd000) libc.so.6 => /lib/libc.so.6 (0x00a57000) /lib/ld-linux.so.2 (0x00a3a000) libgssapi_krb5.so.2 => /usr/lib/libgssapi_krb5.so.2 (0x0045d000) libkrb5.so.3 => /usr/lib/libkrb5.so.3 (0x00943000) libcom_err.so.2 => /lib/libcom_err.so.2 (0x00a2a000) libk5crypto.so.3 => /usr/lib/libk5crypto.so.3 (0x007b4000) libz.so.1 => /usr/lib/libz.so.1 (0x00bc8000) libnsl.so.1 => /lib/libnsl.so.1 (0x0036e000) libkrb5support.so.0 => /usr/lib/libkrb5support.so.0 (0x007aa000)

1 0

Re: (ITS#5207) Password checking: external program
by ghenry＠OpenLDAP.org 04 Nov '07

04 Nov '07

<quote who="Hadmut Danisch"> > Gavin Henry wrote: >> I don't read that as rude, merely advice. Don't take it personally please. > > > I do. His point was not to understand or answer my question. His point was to allege that I would not know what I am talking about and would not have understood the basic principles of LDAP just because my wording differed slightly from his expectations. The problem with e-mail is that a persons tone can't be portrayed. > > It was a personal attack and I take it as such. I don't care about, but I notice that the guys behind openldap tend to rather attack people personally than answering security relevant questions and that they None of our team do this. We all have limited time and do our best to reply to users questions or ITS reports. But you must understand, 99% of questions asked have been asked before with the answers being available in the mailing archives. 9 times out of 10 a user hasn't read any of our docs, so we politely ask, "have you read any of the docs?", that's not "have you *read* any of the docs?" implying an insult. So if we come across as attacking people, then I believe that this is an interpretation of the reader. > expect everyone to know what's not in the docs but hidden somewhere in some strange FAQ machine. Not really strange, pretty standard at the time and still used in many OSS projects. I've actually ported most of the relevant parts of our FAQ-O-Matic to the 2.4 Admin Guide, at present over 80 new pages of content over a 6-7 month period of unpaid commitment. So when I ask, as the OpenLDAP Project Documention Leader, have you read any of the docs, I think I'm entitled to put that question to a user. That's not being rude. > > Beyond the fact that this is not worth of further dispute, from my point of view this way of dealing with questions and handling authentication details disqualifies as software engineers for security relevant software. I disagree. Nothing in this thread can back up your claim here. > > Just for your information: I read the specs when they were issued as X.500 and X.509 in the CCITT Blue Book. But I am not rereading specs every day, LDAP is just a small detail of my daily work. Ok. > >> OpenLDAP supports SASL, SASL does have it's own documentation. Did you try to read any of that? > > Again, this offending way to assume that anyone who does not have exactly your point of view could not have read the specs. "try to read" is offensive. Maybe I should have asked, "Did you browse the SASL docs?", "Or did you take a quick look over at the SASL documentation?". They all mean the same thing, with no offence intended. It's all in how the reader sees it. <snip> > So before blaming me for not reading and understanding specs, tell me, where exactly this is specified. > > Do those particular specs you're blaming me for not having read at all exist? I don't know, I'm not a SASL expert. Maybe one of the Core team can answer this. If you do find the answer or implement something to solve your feature request, documentation patches are always welcome. We are an Open Source Community after all. Gavin.

1 0

(ITS#5211) syncrepl: server fails to sync on unknown cookie
by e.vanoosten＠grons.nl 02 Nov '07

02 Nov '07

Full_Name: Erik van Oosten Version: 2.3.36 OS: cygwin URL: Submission from: (NULL) (212.78.164.66) When I start sync operation with a made up cookie (just some random bytes), the server replies with a response with result code 2 (Protocol Error). RFC4533 specifies: "If the server does not recognize the request cookie or the request is made under different associations or non-equivalent protections, the server SHALL return the initial content as if no cookie had been provided or return an empty content with the e-syncRefreshRequired LDAP result code." RFC2119: "MUST This word, or the terms "REQUIRED" or "SHALL", mean that the definition is an absolute requirement of the specification." Expected behavior: either the initial content as if no cookie had been provided or an empty content with the e-syncRefreshRequired LDAP result code.

1 0

Re: (ITS#5210) SyncRepl: upon unchanged DIT expected only delete phase for refreshAndPersist
by hyc＠symas.com 02 Nov '07

02 Nov '07

e.vanoosten(a)grons.nl wrote: > Full_Name: Erik van Oosten > Version: 2.3.36 > OS: cygwin > URL: > Submission from: (NULL) (212.78.164.66) > > > When you start a refreshAndPersist sync operation with an initial cookie, and > the DIT has not changed since the cookie was issued, during the refresh phase I > expect to get a single message, namely a SyncInfoMessage of refreshDelete with > refreshDone equals to TRUE (no present phase, only the delete phase). > Observed behavior is that you get a single message, namely a SyncInfoMessage of > refreshPresent with refreshDone equals to TRUE (only the present phase, no > delete phase). > > Note: a refreshOnly operation in the same circumstances works as expected. > > Issue submitted as requested by Howard Chu. Thanks for the report. This is now fixed in HEAD. syncprov.c 1.207 and 1.208 contain the relevant changes. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#5210) SyncRepl: upon unchanged DIT expected only delete phase for refreshAndPersist
by e.vanoosten＠grons.nl 02 Nov '07

02 Nov '07

Full_Name: Erik van Oosten Version: 2.3.36 OS: cygwin URL: Submission from: (NULL) (212.78.164.66) When you start a refreshAndPersist sync operation with an initial cookie, and the DIT has not changed since the cookie was issued, during the refresh phase I expect to get a single message, namely a SyncInfoMessage of refreshDelete with refreshDone equals to TRUE (no present phase, only the delete phase). Observed behavior is that you get a single message, namely a SyncInfoMessage of refreshPresent with refreshDone equals to TRUE (only the present phase, no delete phase). Note: a refreshOnly operation in the same circumstances works as expected. Issue submitted as requested by Howard Chu.

1 0

Re: (ITS#5208) OpenLDAP w/ multiple bdb backends provides invalid paged result responses
by hyc＠symas.com 02 Nov '07

02 Nov '07

hume-ml(a)bofh.ca wrote: > On Fri, 2007-11-02 at 11:09 +0000, Gavin Henry wrote: >>> A search such as the following: >>> ldapsearch -h localhost -x -E pr=2 -b dc=dal,dc=ca '(objectclass=*)' > > >> Where is "dc=dal,dc=ca" set? > > That's a typo, sorry. Should be "dc=domain,dc=com". Missed that when > "redacting" the initial submission. This bug has been fixed in CVS HEAD. Also, this is a dup of ITS#5191 so it has already been closed. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5208) OpenLDAP w/ multiple bdb backends provides invalid paged result responses
by hume-ml＠bofh.ca 02 Nov '07

02 Nov '07

On Fri, 2007-11-02 at 11:09 +0000, Gavin Henry wrote: > > > > A search such as the following: > > ldapsearch -h localhost -x -E pr=2 -b dc=dal,dc=ca '(objectclass=*)' > Where is "dc=dal,dc=ca" set? That's a typo, sorry. Should be "dc=domain,dc=com". Missed that when "redacting" the initial submission.

1 0

Re: (ITS#5208) OpenLDAP w/ multiple bdb backends provides invalid paged result responses
by ghenry＠OpenLDAP.org 02 Nov '07

02 Nov '07

hume-ml(a)bofh.ca wrote: > Full_Name: Brandon Hume > Version: 2.3.38 > OS: OpenSolaris/Redhat Linux AS3 > URL: > Submission from: (NULL) (129.173.2.54) > > > When OpenLDAP is serving a tree split into multiple backends (for whatever > reasons someone might do so), searching with the paged result control against > the base DN and ranging across the subordinate trees causes a paged result > cursor to be provided for each backend. > > ie: With a config such as: > > database bdb > directory /opt/csw/var/openldap/people > suffix "ou=People,dc=example,dc=com" > subordinate > rootdn "cn=NOC,dc=example,dc=com" > > database bdb > directory /opt/csw/var/openldap/default > suffix "dc=domain,dc=com" > rootdn "cn=NOC,dc=domain,dc=com" > rootpw {SSHA}[...] > > > A search such as the following: > ldapsearch -h localhost -x -E pr=2 -b dc=dal,dc=ca '(objectclass=*)' > > ... will produce the following result/control response: > > [...] > # search result > search: 2 > result: 0 Success > control: 1.2.840.113556.1.4.319 false MAkCAQAEBAIAAAA= > control: 1.2.840.113556.1.4.319 false MAkCAQAEBP////8= > Press [size] Enter for the next {2|size} entries. > > > This has the effect of causing the next paged result to fail, since one of the > two values is not correct and is rejected by the server. > > Where is "dc=dal,dc=ca" set? -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

Re: (ITS#5207) Password checking: external program
by ghenry＠OpenLDAP.org 02 Nov '07

02 Nov '07

hadmut(a)danisch.de wrote: > Howard Chu wrote: >> hadmut(a)danisch.de wrote: >>> But this opens other questions: >>> Does slapd support multiple password entries? >> Of course. The schema definition for userPassword says that it is a >> multivalued attribute. (Note: "values" not "entries". Seems you need to >> do some more reading on LDAP basics.) > > > Well, I don't think there's reason to get rude. Please understand that > english is not my first language, and I apologize if I did not meet your > expectations. I don't read that as rude, merely advice. Don't take it personally please. > > And I did not ask about LDAP in common, I asked about the slapd > implementation. So reading LDAP basics would not answer the question. > > As it was pointed out before, the details of this {SASL} authentication > scheme are _not_ documented in the slapd manual or any LDAP basics, but > somewhere hidden in the FAQs or even partly undocumented. OpenLDAP supports SASL, SASL does have it's own documentation. Did you try to read any of that? > > >> slappasswd doesn't know anything about that. slapd checks until it finds >> a match. > > That's what I wanted to know. Obviously, as you yourself point out, > that's an implementation detail. > > Does ldappasswd change all entries or just the one matching the given > password? > > > regards > Hadmut > > > > -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

Re: (ITS#5191) Corrupted control value when using pagedresults with subordinate database
by hyc＠symas.com 01 Nov '07

01 Nov '07

ando(a)sys-net.it wrote: >> I disagree. The fact that databases are glued should in no way prevent >> paged >> results from working. > > I mean: the current implementation prevents it from working (AFAIK); I see > disabling it in case of glued database a legitimate fix of the problem. OK. Well, it's working now in HEAD, we can roll that fix for RE24. I don't see much reason to backport to RE23 but am open. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#5209) Setting sasl-host in slapd.conf fails
by arjones＠simultan.dyndns.org 01 Nov '07

01 Nov '07

Full_Name: Andrew Rucker Jones Version: 2.4.6 OS: Linux URL: Submission from: (NULL) (87.165.239.200) I just upgraded from a working 2.3.39 installation to 2.4.6 without making changes, but slapd does not start. Upon further investigation, i found that slaptest claims my slapd.conf is clean, but slapd -d 100 says that sasl-host is already set. That is, in my slapd.conf, i set sasl-host once and only once, but slapd comes across that lines and claims that sasl-host had already been set before that. Looking at the code, it seems that lines 354-358 in config.c (servers/slapd/) fails to accurately check whether or not something with the ARG_UNIQUE flag has really already been set from the configuration file. Commenting out the sasl-host line in slapd.conf lets slapd start, but i assume from looking at bconfig.c that the value of sasl-host is wrong.

1 0

Re: (ITS#5191) Corrupted control value when using pagedresults with subordinate database
by ando＠sys-net.it 01 Nov '07

01 Nov '07

> I disagree. The fact that databases are glued should in no way prevent > paged > results from working. I mean: the current implementation prevents it from working (AFAIK); I see disabling it in case of glued database a legitimate fix of the problem. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: (ITS#5207) Password checking: external program
by hyc＠symas.com 01 Nov '07

01 Nov '07

Hadmut Danisch wrote: > Well, I don't think there's reason to get rude. Please understand that > english is not my first language, and I apologize if I did not meet your > expectations. Nothing rude, just stating a fact. If you don't know the difference between an "entry" and a "value" then you haven't read enough yet. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5207) Password checking: external program
by hadmut＠danisch.de 01 Nov '07

01 Nov '07

Howard Chu wrote: > hadmut(a)danisch.de wrote: >> But this opens other questions: > >> Does slapd support multiple password entries? > > Of course. The schema definition for userPassword says that it is a > multivalued attribute. (Note: "values" not "entries". Seems you need to > do some more reading on LDAP basics.) Well, I don't think there's reason to get rude. Please understand that english is not my first language, and I apologize if I did not meet your expectations. And I did not ask about LDAP in common, I asked about the slapd implementation. So reading LDAP basics would not answer the question. As it was pointed out before, the details of this {SASL} authentication scheme are _not_ documented in the slapd manual or any LDAP basics, but somewhere hidden in the FAQs or even partly undocumented. > slappasswd doesn't know anything about that. slapd checks until it finds > a match. That's what I wanted to know. Obviously, as you yourself point out, that's an implementation detail. Does ldappasswd change all entries or just the one matching the given password? regards Hadmut

1 0

Re: (ITS#5207) Password checking: external program
by hyc＠symas.com 01 Nov '07

01 Nov '07

hadmut(a)danisch.de wrote: > But this opens other questions: > Does slapd support multiple password entries? Of course. The schema definition for userPassword says that it is a multivalued attribute. (Note: "values" not "entries". Seems you need to do some more reading on LDAP basics.) > What does slap (and slappasswd) do if there are multiple entries for > userPassword? Does slapd check them all until one of them matches? slappasswd doesn't know anything about that. slapd checks until it finds a match. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5207) Password checking: external program
by hadmut＠danisch.de 01 Nov '07

01 Nov '07

Buchan Milne wrote: > So you are unaware of the {SASL} scheme for userPassword, where slapd receives > a simple bind, and tries to authenticate the user (as a SASL client) via the > SASL mechanism with the identity following the scheme identifier in the > userPassword attribute. Oh, yeah, I wasn't aware of such a beast. > It is documented to some degree in the FAQ-o-matic. Well, I didn't find a documentation about that, just an article about Kerberos that mentioned that {SASL} thing. FAQ-o-matic seems to be unable to search for '{' and '}'. Putting something in that FAQ-o-matic is certainly a good place to hide it since that FAQ-o-matic uses some really weird sort of ordering, and searching works - if at all - only if you already know what you are looking for. Would be great to put this into the administrator's documentation. However, if that {SASL} scheme does what I believe it does, the client indeed does not need a plugin or SASL support anymore. But this opens other questions: Does slapd support multiple password entries? If I put such a {SASL} thing into my LDAP record, would I still be able to authenticate with a plain password, e.g. by having two entries userPassword: {SSHA}... userPassword: {SASL}... The main problem is that I have to provide several authentication schemes, including good old password authentication (which the SASL daemon was configured to do against the LDAP with encrypted passwords) and some sorts of one time passwords. Storing regular passwords in SASL was no option because cyrus sasl stores passwords as plaintext. So that {SASL} thing could solve my problem as long as it coexists with regular LDAP authentication. What does slap (and slappasswd) do if there are multiple entries for userPassword? Does slapd check them all until one of them matches? regards Hadmut

1 0

Re: (ITS#5207) Password checking: external program
by bgmilne＠staff.telkomsa.net 01 Nov '07

01 Nov '07

On Thursday 01 November 2007 12:15:28 Hadmut Danisch wrote: > Buchan Milne wrote: > > So wouldn't the existing {SASL} scheme for userPassword (which allows a > > simple bind to be authenticated against a SASL identity) be sufficient? > > Not really, because SASL is not just a server plugin, it requires the > client to have SASL (and the plugins) as well. Unfortunately, this is > not the case in most scenarios. So you are unaware of the {SASL} scheme for userPassword, where slapd receives a simple bind, and tries to authenticate the user (as a SASL client) via the SASL mechanism with the identity following the scheme identifier in the userPassword attribute. It is documented to some degree in the FAQ-o-matic. Regards, Buchan

1 0

Re: (ITS#5191) Corrupted control value when using pagedresults with subordinate database
by hyc＠symas.com 01 Nov '07

01 Nov '07

ando(a)sys-net.it wrote: >> When using pagedresults with a subordinate database, the control value of >> the >> returned searchResDone is corrupted. > > AFAIK, paged results is not supposed to work with glued databases, as its > current implementation in both back-bdb/back-hdb and back-sql relies on > internal properties of the storage to keep track of the state of a > search. The most appropriate behavior would be to ignore the control, if > not critical, or reject the operation, if critical. > > I take this ITS as an action to prevent paged results from working when > impacting more than one glued database. I disagree. The fact that databases are glued should in no way prevent paged results from working. After all, the glue only talks to one database at a time. As such, the paged results control's relevance never spans more than a single database at a time. The bug is that after one database has provided all of its entries in response to a request, its response control should be nullified. I.e., a particular database's response control is only needed if that database isn't finished sending entries. Once it has sent all of its entries, it's no longer relevant. Overall the paged results implementation is a suboptimal design; the frontend should do all of the page counting/tracking. It should only ask the backend to provide a state cookie when the current page is full and there are more entries to return. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5207) Password checking: external program
by hadmut＠danisch.de 01 Nov '07

01 Nov '07

Buchan Milne wrote: > So wouldn't the existing {SASL} scheme for userPassword (which allows a simple > bind to be authenticated against a SASL identity) be sufficient? Not really, because SASL is not just a server plugin, it requires the client to have SASL (and the plugins) as well. Unfortunately, this is not the case in most scenarios. Actually, SASL would the the solution of choice if the client supported it, because SASL is able to transmit replies (challenges,...), but this is possible only if all clients support SASL and as long as you are able to install SASL clients on both sides. Reality is, that too many LDAP clients don't support SASL, and even if they do, you are in most cases not able to install SASL library on both sides. Furthermore, SASL mechanisms are limited to password handling. It is sort of tricky or impossible to pass other authentication methods through (e.g. any sort of cookie based authentication). Would be nice if the client could perform just the basic LDAP authentication and the password still be accepted even if it is a cookie, one time password, or any other strange thing. > Well, any implementation of this would have the same problems of the existing > {SASL} scheme, of losing some of the security SASL provides. Well, as I said it would be pretty similar to SASL except for the fact that SASL requires the client to a) support SASL (i.e. has SASL software) b) support the authentication SCHEME (i.e. has the particular SASL plugin) c) has to pass through SASL messages if between client and LDAP (e.g. IMAP servers) which is not the case at the moment. regards Hadmut

1 0

Re: (ITS#5207) Password checking: external program
by hyc＠symas.com 01 Nov '07

01 Nov '07

bgmilne(a)staff.telkomsa.net wrote: > On Tuesday 30 October 2007 12:40:38 hadmut(a)danisch.de wrote: >> Full_Name: Hadmut Danisch >> Version: 2.3.38 >> OS: Linux >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (85.180.64.93) >> >> >> Hi, >> >> that's a feature request: >> >> Sometimes it is necessary to use other authentication methods than the >> regular password login. E.g. when using an insecure computer in an internet >> cafe to login into a web mail frontend, which accesses an imap server, >> which authenticates against LDAP. It would require to authenticate trough >> one-time-passwords, HTTP-Cookies or other unusual methods. >> >> Actually,SASL provides a way to use other methods like One-time-passwords, >> but is still too limited and there are too many programs (LDAP clients) out >> there that don't support sasl authentication. > > So wouldn't the existing {SASL} scheme for userPassword (which allows a simple > bind to be authenticated against a SASL identity) be sufficient? Simple Bind actually doesn't lend itself well to most one-time-password schemes, because they require the ability for a server to send a challenge string to a client so the client can select/generate the correct OTP. You could kludge this by introducing a new Bind-in-Progress error code but no existing clients would recognize it or know what to do with it. (Too bad the LDAP_SASL_BIND_IN_PROGRESS error code is so specific; it really would have been smarter to minimize differences between SASL Binds and Simple Binds, rather than widen the differences even further.) (The idea being, you could still implement the OTP mech with Simple Bind if the client first sends a Bind request with DN and bogus password - the OTP mech can return an error at that point with the Challenge string in the message text. Then the client can provide that challenge to the user, reprompt for a password, and carry on.) >> Therefore it would be nice if slapd could be configured to do the password >> checking over some external plugin or program, which could do any sort of >> unusual checking. >> This way a user could enter a one time password just as a normal LDAP login >> password, and pass it through the chain of programs, e.g. mailclient - >> maildaemon - LDAP or >> browser - webmailer - imap - LDAP. > > Well, any implementation of this would have the same problems of the existing > {SASL} scheme, of losing some of the security SASL provides. True, but not really an issue for an OTP mechanism; since the password is single-use it doesn't really need any protection. Anyway, slapd *can* be configured to do password checking with external plugins. And there's already several plugins provided in the contrib section of the source tree. Feel free to write more plugins to do whatever kind of checking you want, and submit your plugins back to the ITS. This particular ITS will be closed, the feature already exists. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5207) Password checking: external program
by bgmilne＠staff.telkomsa.net 01 Nov '07

01 Nov '07

On Tuesday 30 October 2007 12:40:38 hadmut(a)danisch.de wrote: > Full_Name: Hadmut Danisch > Version: 2.3.38 > OS: Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (85.180.64.93) > > > Hi, > > that's a feature request: > > Sometimes it is necessary to use other authentication methods than the > regular password login. E.g. when using an insecure computer in an internet > cafe to login into a web mail frontend, which accesses an imap server, > which authenticates against LDAP. It would require to authenticate trough > one-time-passwords, HTTP-Cookies or other unusual methods. > > Actually,SASL provides a way to use other methods like One-time-passwords, > but is still too limited and there are too many programs (LDAP clients) out > there that don't support sasl authentication. So wouldn't the existing {SASL} scheme for userPassword (which allows a simple bind to be authenticated against a SASL identity) be sufficient? > Therefore it would be nice if slapd could be configured to do the password > checking over some external plugin or program, which could do any sort of > unusual checking. > This way a user could enter a one time password just as a normal LDAP login > password, and pass it through the chain of programs, e.g. mailclient - > maildaemon - LDAP or > browser - webmailer - imap - LDAP. Well, any implementation of this would have the same problems of the existing {SASL} scheme, of losing some of the security SASL provides. Regards, Buchan

1 0

Re: (ITS#5199) slapd sometimes hangs with back-sql
by h.b.furuseth＠usit.uio.no 31 Oct '07

31 Oct '07

h.b.furuseth(a)usit.uio.no writes: > It looks like thread 5 runs amok in sql_dbconn_mutex() while locking > sql_dbconn_mutex. Oops, cut&paste error. I meant in backsql_free_db_conn(). Anyway, does your log contain that message some time before? > "backsql_open_db_conn(...): duplicate connection ID". The (...) is the (connection id). -- Hallvard

1 0

Re: (ITS#5199) slapd sometimes hangs with back-sql
by h.b.furuseth＠usit.uio.no 31 Oct '07

31 Oct '07

It looks like thread 5 runs amok in sql_dbconn_mutex() while locking sql_dbconn_mutex. That mutex lacks an unlock operation in 2.3.38 where slapd logs "backsql_open_db_conn(...): duplicate connection ID". (Which doesn't sound too good to me either, but then I don't know back-sql.) If that's the problem, it was fixed in OpenLDAP 2.3.39 for ITS#5095. -- Regards, Hallvard

1 0

Re: (ITS#5199) slapd sometimes hangs with back-sql
by david＠schmitt.edv-bus.at 31 Oct '07

31 Oct '07

--Boundary-00=_O6HKHoQQJlEsW1J Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Content-Disposition: inline Hi! Please find attached the output of "thread apply all bt full". Regards, David -- The primary freedom of open source is not the freedom from cost, but the free- dom to shape software to do what you want. This freedom is /never/ exercised without cost, but is available /at all/ only by accepting the very different costs associated with open source, costs not in money, but in time and effort. -- http://www.schierer.org/~luke/log/20070710-1129/on-forks-and-forking --Boundary-00=_O6HKHoQQJlEsW1J Content-Type: application/octet-stream; name="bt_full" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="bt_full" Thread 5 (Thread 1082132832 (LWP 10915)): #0 0x00002b5a2fb75eeb in __lll_mutex_lock_wait () from /lib/libpthread.so.0 No symbol table info available. #1 0x00000000407fc9c0 in ?? () No symbol table info available. #2 0x00000000006088d0 in ?? () No symbol table info available. #3 0x00002b5a2fb72d9f in pthread_mutex_lock () from /lib/libpthread.so.0 No symbol table info available. #4 0x0000003000000030 in ?? () No symbol table info available. #5 0x00000000407fc8a0 in ?? () No symbol table info available. #6 0x00000000407fc7b0 in ?? () No symbol table info available. #7 0x00002b5a2feba0e0 in __after_morecore_hook () from /lib/libc.so.6 No symbol table info available. #8 0x00000000000001c9 in ?? () No symbol table info available. #9 0x0000000000000002 in ?? () No symbol table info available. #10 0x00000000004a12bd in lt_preloaded_symbols () No symbol table info available. #11 0x0000000000000004 in ?? () No symbol table info available. #12 0x00000000004a1b35 in __PRETTY_FUNCTION__.12118 () No symbol table info available. #13 0x0000000000000005 in ?? () No symbol table info available. #14 0x00000000007238f0 in ?? () No symbol table info available. #15 0x0000000000646b60 in ?? () No symbol table info available. #16 0x0000000000646a20 in ?? () No symbol table info available. #17 0x00000000407fc860 in ?? () No symbol table info available. #18 0x00000000005fdf90 in style_strings () No symbol table info available. #19 0x0000000000603600 in aclbuf () No symbol table info available. #20 0x0000000000000002 in ?? () No symbol table info available. #21 0x00002b5a30a054bd in backsql_free_db_conn (op=3D0x407fc860) at /root/t= mp/openldap2.3-2.3.38/servers/slapd/back-sql/sql-wrap.c:439 bi =3D (backsql_info *) 0x689910 tmp =3D {ldap_cid =3D 469, dbh =3D 0x0} conn =3D <value optimized out> #22 0x00002b5a309f7047 in backsql_connection_destroy (bd=3D<value optimized= out>, c=3D0x0) at /root/tmp/openldap2.3-2.3.38/servers/slapd/back-sql/init= =2Ec:590 opbuf =3D { buffer =3D "=C0=C9\177@\000\000\000\000=D9T=A6/Z+\000\000=A0=C8\177@\000\= 000\000\000\235s=A6/Z+\000\000p\227h\000\000\000\000\000\003\000\000\000\00= 0\000\000\0005\033J\000\000\000\000\000\000\000\000\000Z+\000\000=FF=FF=FF= =FFunknown", '\0' <repeats 93 times>, "]vB\000\000\000\000\000p=CA\177@\000= \000\000\000P", '\0' <repeats 175 times>, "=D5\001", '\0' <repeats 174 time= s>, "=D5\001\000\000\000\000\000\000=C0xf1Z+", '\0' <repeats 185 times>, ia= lign =3D 1082116544, lalign =3D 1082116544,=20 falign =3D 3.99668884, dalign =3D 5.3463660918685768e-315, palign =3D 0x4= 07fc9c0 ""} op =3D (Operation *) 0x689a50 #23 0x000000000043219c in backend_connection_destroy (conn=3D0x2b5a316678c0= ) at /root/tmp/openldap2.3-2.3.38/servers/slapd/backend.c:770 be =3D (BackendDB *) 0x689770 #24 0x0000000000427973 in connection_close (c=3D0x2b5a316678c0) at /root/tm= p/openldap2.3-2.3.38/servers/slapd/connection.c:690 sd =3D -1 __PRETTY_FUNCTION__ =3D "connection_close" #25 0x00000000004289c6 in connection_read (s=3D10) at /root/tmp/openldap2.3= =2D2.3.38/servers/slapd/connection.c:1458 err =3D <value optimized out> sd =3D 10 rc =3D -2 c =3D (Connection *) 0x2b5a316678c0 __PRETTY_FUNCTION__ =3D "connection_read" #26 0x00000000004254db in slapd_daemon_task (ptr=3D<value optimized out>) a= t /root/tmp/openldap2.3-2.3.38/servers/slapd/daemon.c:2468 fd =3D 10 l =3D <value optimized out> last_idle_check =3D 0 ebadf =3D 0 #27 0x00002b5a2fb70f1a in start_thread () from /lib/libpthread.so.0 No symbol table info available. #28 0x00002b5a2fd4a6c2 in clone () from /lib/libc.so.6 No symbol table info available. #29 0x0000000000000000 in ?? () No symbol table info available. Thread 4 (Thread 1090525536 (LWP 10930)): #0 0x00002b5a2fb75eeb in __lll_mutex_lock_wait () from /lib/libpthread.so.0 No symbol table info available. #1 0x0000000041000bd0 in ?? () No symbol table info available. #2 0x0000000000000000 in ?? () No symbol table info available. Thread 3 (Thread 1098918240 (LWP 26084)): #0 0x00002b5a2fb73b3a in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpt= hread.so.0 No symbol table info available. #1 0x00002b5a2eb7a888 in ldap_int_thread_pool_wrapper (xpool=3D0x62a050) a= t /root/tmp/openldap2.3-2.3.38/libraries/libldap_r/tpool.c:490 ctx =3D (ldap_int_thread_ctx_t *) 0x0 ltc_key =3D {{ltk_key =3D 0x46bf90, ltk_data =3D 0x70e340, ltk_free =3D 0x= 46baf0 <slap_sl_mem_destroy>}, {ltk_key =3D 0x0, ltk_data =3D 0x0, ltk_free= =3D 0} <repeats 31 times>} tid =3D 1098918240 i =3D 330 hash =3D <value optimized out> #2 0x00002b5a2fb70f1a in start_thread () from /lib/libpthread.so.0 No symbol table info available. #3 0x00002b5a2fd4a6c2 in clone () from /lib/libc.so.6 No symbol table info available. #4 0x0000000000000000 in ?? () No symbol table info available. Thread 2 (Thread 1107310944 (LWP 12906)): #0 0x00002b5a2fb75eeb in __lll_mutex_lock_wait () from /lib/libpthread.so.0 No symbol table info available. #1 0x0000000042002bd0 in ?? () No symbol table info available. #2 0x0000000000000000 in ?? () No symbol table info available. Thread 1 (Thread 47666352182560 (LWP 10908)): #0 0x00002b5a2fb720f5 in pthread_join () from /lib/libpthread.so.0 No symbol table info available. #1 0x00000000004230d2 in slapd_daemon () at /root/tmp/openldap2.3-2.3.38/s= ervers/slapd/daemon.c:2579 listener_tid =3D 1082132832 rc =3D 0 #2 0x000000000041665f in main (argc=3D5, argv=3D0x7fff7c053a58) at /root/t= mp/openldap2.3-2.3.38/servers/slapd/main.c:859 save_errno =3D <value optimized out> fp =3D (FILE *) 0x6a4f70 i =3D <value optimized out> no_detach =3D 0 rc =3D 1 urls =3D <value optimized out> username =3D 0x605030 "gidNumber" groupname =3D 0x605010 "\226{=D9/Z+" sandbox =3D 0x0 syslogUser =3D 160 configfile =3D <value optimized out> configdir =3D <value optimized out> serverName =3D <value optimized out> scp =3D <value optimized out> scp_entry =3D <value optimized out> debug_unknowns =3D (char **) 0x0 syslog_unknowns =3D (char **) 0x0 l =3D <value optimized out> slapd_pid_file_unlink =3D 1 slapd_args_file_unlink =3D 1 __PRETTY_FUNCTION__ =3D "main" #0 0x00002b5a2fb720f5 in pthread_join () from /lib/libpthread.so.0 --Boundary-00=_O6HKHoQQJlEsW1J--

1 0

(ITS#5208) OpenLDAP w/ multiple bdb backends provides invalid paged result responses
by hume-ml＠bofh.ca 30 Oct '07

30 Oct '07

Full_Name: Brandon Hume Version: 2.3.38 OS: OpenSolaris/Redhat Linux AS3 URL: Submission from: (NULL) (129.173.2.54) When OpenLDAP is serving a tree split into multiple backends (for whatever reasons someone might do so), searching with the paged result control against the base DN and ranging across the subordinate trees causes a paged result cursor to be provided for each backend. ie: With a config such as: database bdb directory /opt/csw/var/openldap/people suffix "ou=People,dc=example,dc=com" subordinate rootdn "cn=NOC,dc=example,dc=com" database bdb directory /opt/csw/var/openldap/default suffix "dc=domain,dc=com" rootdn "cn=NOC,dc=domain,dc=com" rootpw {SSHA}[...] A search such as the following: ldapsearch -h localhost -x -E pr=2 -b dc=dal,dc=ca '(objectclass=*)' ... will produce the following result/control response: [...] # search result search: 2 result: 0 Success control: 1.2.840.113556.1.4.319 false MAkCAQAEBAIAAAA= control: 1.2.840.113556.1.4.319 false MAkCAQAEBP////8= Press [size] Enter for the next {2|size} entries. This has the effect of causing the next paged result to fail, since one of the two values is not correct and is rejected by the server.

1 0

(ITS#5207) Password checking: external program
by hadmut＠danisch.de 30 Oct '07

30 Oct '07

Full_Name: Hadmut Danisch Version: 2.3.38 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (85.180.64.93) Hi, that's a feature request: Sometimes it is necessary to use other authentication methods than the regular password login. E.g. when using an insecure computer in an internet cafe to login into a web mail frontend, which accesses an imap server, which authenticates against LDAP. It would require to authenticate trough one-time-passwords, HTTP-Cookies or other unusual methods. Actually,SASL provides a way to use other methods like One-time-passwords, but is still too limited and there are too many programs (LDAP clients) out there that don't support sasl authentication. Therefore it would be nice if slapd could be configured to do the password checking over some external plugin or program, which could do any sort of unusual checking. This way a user could enter a one time password just as a normal LDAP login password, and pass it through the chain of programs, e.g. mailclient - maildaemon - LDAP or browser - webmailer - imap - LDAP. regards Hadmut

1 0

Re: (ITS#5195) ssf not available during sasl bind
by h.b.furuseth＠usit.uio.no 30 Oct '07

30 Oct '07

[Resending, I forgot Russell wasn't in the to/cc list of your reply. Don't know if that means he didn't receive it or if ITS did something clever.] quanah(a)zimbra.com writes: > --On Monday, October 29, 2007 11:45 PM +0000 russell-openldap(a)stuart.id.au > wrote: >> Secondly, just out of curiosity, are there SASL methods >> that check a shared secret of some kind and don't use >> userPassword? What are they? > > GSSAPI And all SASL methods that use passwords, if SASL is configured to use another password store than slapd. Like Cyrus SASL's default sasldb. -- Regards, Hallvard

1 0

Re: (ITS#5195) ssf not available during sasl bind
by h.b.furuseth＠usit.uio.no 30 Oct '07

30 Oct '07

quanah(a)zimbra.com writes: > --On Monday, October 29, 2007 11:45 PM +0000 russell-openldap(a)stuart.id.au > wrote: >> Secondly, just out of curiosity, are there SASL methods >> that check a shared secret of some kind and don't use >> userPassword? What are they? > > GSSAPI And all SASL methods that use passwords, if SASL is configured to use another password store than slapd. Like Cyrus SASL's default sasldb. -- Regards, Hallvard

1 0

Re: (ITS#5195) ssf not available during sasl bind
by hyc＠symas.com 30 Oct '07

30 Oct '07

russell-openldap(a)stuart.id.au wrote: > On Mon, 2007-10-29 at 18:07 +0100, Hallvard B Furuseth wrote: >> No, you've forced users who authenticate against userPassword >> to be encrypted. Not all SASL methods, nor auth with rootpw. > > Thats a worry. Rootpw aside, the intended objective of > the ACL was to ensure passwords were never sent in the > clear. Either a protocol like CRAM-MD5 was used, or the > entire link is encrypted. By the way, CRAM-MD5 has a few known weaknesses. Should use DIGEST-MD5 instead. http://www.ietf.org/rfc/rfc2831.txt (For what that's worth. Given that methods exist to create MD5 collisions, it's not clear how much longer DIGEST-MD5 will be useful.) > Does it not do that? (Actually > it doesn't. It should have been sasl_ssf=71. But bugs > aside ...) > > Secondly, just out of curiosity, are there SASL methods > that check a shared secret of some kind and don't use > userPassword? What are they? > > The "security" option may produce better error messages > by it appears to apply to all connections, including > lookups done by SASL to dn="" to discover what mechanisms > are allowed. It wasn't at all obvious to a newbie like me > that this sentence from "man 1 ldapsearch" only applies > if you don't use the "security" option: > > "-Y mech .... If it's not specified, the program will > choose the best mechanism the server knows." Perhaps we should add a security option to separately specify the SSF for anonymous sessions. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs