openldap-bugs

openldap-bugs@openldap.org

1 participants
21065 discussions

Re: (ITS#6830) slapo-ppolicy.5 has incorrect schema fragments
by michael＠stroeder.com 01 Jul '11

01 Jul '11

hyc(a)symas.com wrote: > Andrew Findlay wrote: >> On Thu, Jun 09, 2011 at 01:45:17AM -0700, Howard Chu wrote: >> >>> I note that in ppolicy.c we have: >>> >>> { "( 1.3.6.1.4.1.42.2.27.8.1.17 " >>> "NAME ( 'pwdAccountLockedTime' ) " >>> "DESC 'The time an user account was locked' " >>> "EQUALITY generalizedTimeMatch " >>> "ORDERING generalizedTimeOrderingMatch " >>> "SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 " >>> "SINGLE-VALUE " >>> #if 0 >>> /* Not until Relax control is released */ >>> "NO-USER-MODIFICATION " >>> #endif >>> "USAGE directoryOperation )", >>> >>> We have in fact released support for the Relax control, so it's >>> probably time to unifdef these bits and go back to the documented >>> behavior. >> >> That seems reasonable in the long term, though it will break many sites' >> existing password management procedures. The change will have to be >> mentioned in the updated manpage, noting the version at which it takes >> effect. >> >> Should I produce an updated version of the manpage patch? > > Well since you raise the question, what do you think is the more sensible > approach to all of this? I was the one who argued in ldapext that these > attributes should be no-user-modification but perhaps that makes them too > inconvenient to administer. Given the fact that the Relax Rules control still has .666 OID it cannot be used (see my related messages to openldap-devel and ietf-ldapext). At least what's always being said about .666 OIDs... Ciao, Michael.

1 0

Re: ITS#6873
by michael＠stroeder.com 01 Jul '11

01 Jul '11

masarati(a)aero.polimi.it wrote: > Fixed in master, please test. Sorry, last message went to wrong ITS. But also seems to work now...thanks... :-) $ ldapmodify -x -H ldap://localhost:2071 -D "uid=diradm,ou=schulung,dc=stroeder,dc=local" -e relax -w testsecret -f authtime_mod.ldif modifying entry "cn=test1,ou=schulung,dc=stroeder,dc=local" -------------------------- authtime_mod.ldif -------------------------- dn: cn=test1,ou=schulung,dc=stroeder,dc=local changetype: modify replace: authTimestamp authTimestamp: 20110701165029Z

1 0

ITS#6886
by michael＠stroeder.com 01 Jul '11

01 Jul '11

masarati(a)aero.polimi.it wrote: > Fixed in master, please test. Seems to work now...thanks... :-) *** ldap://localhost:2071 - SimpleLDAPObject.extop (('1.3.6.1.4.1.1466.101.119.1', '0/\x80)cn=test1,ou=schulung,dc=stroeder,dc=local\x81\x02\x1c ', None, None),{}) => result: 2 *** ldap://localhost:2071 - SimpleLDAPObject.result4 ((2, 1, -1, 1, 1, 1),{}) => result: (120, [], 2, [], '1.3.6.1.4.1.1466.101.119.1', '0\x04\x81\x02\x1c ') Response TTL: 7200

1 0

Re: ITS#6873
by michael＠stroeder.com 01 Jul '11

01 Jul '11

1 0

(ITS#6982) libutil md5 incorrect sizeof
by quanah＠OpenLDAP.org 01 Jul '11

01 Jul '11

Full_Name: Quanah Gibson-Mount Version: 2.4.25 OS: NA URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (75.111.45.108) Line 188 in liblutil/md5.c is wrong. It has: memset(ctx, '\0', sizeof(ctx)); /* In case it's sensitive */ It should be: memset(ctx, '\0', sizeof(*ctx)); /* In case it's sensitive */

1 0

ITS#6886
by masarati＠aero.polimi.it 30 Jun '11

30 Jun '11

(should be) fixed in master, please test. p.

1 0

ITS#6873
by masarati＠aero.polimi.it 30 Jun '11

30 Jun '11

Fixed in master, please test. p.

1 0

Re: (ITS#6925) [PATCH] Use inet_ntop for server when available
by Pierangelo Masarati 30 Jun '11

30 Jun '11

Please provide patch as a file, not embedded in email. Upload instructions here <http://www.openldap.org/devel/contributing.html#submitting>. p.

1 0

"database monitor" documentation
by Dan Pritts 30 Jun '11

30 Jun '11

Hi, Looking for docs for the monitor datbase backend, i found this: http://www.openldap.org/devel/admin/monitoringslapd.html Like most other database backends, the monitor backend does honor slapd(8) access and other administrative controls. As some monitor information may be sensitive, it is generally recommend access to cn=monitor be restricted to directory administrators and their monitoring agents. Adding an access directive immediately below the database monitor directive is a clear and effective approach for controlling access. For instance, the addition of the following access directive immediately below the database monitor directive restricts access to monitoring information to the specified directory manager. access to * by dn.exact="cn=Manager,dc=example,dc=com by * none I have misunderstood acl and database config before, but I assume that the ACL here is in error, and something like this from slapd-monitor(5) is appropriate: access to dn.subtree="cn=Monitor" by dn.exact="uid=Admin,dc=my,dc=org" write by users read by * none Assuming I'm correct please update the web docs & let me know. thanks! danno -- Dan Pritts, Sr. Systems Engineer Internet2 office: +1-734-352-4953 | mobile: +1-734-834-7224

2 1

Re: (ITS#6830) slapo-ppolicy.5 has incorrect schema fragments
by andrew.findlay＠skills-1st.co.uk 30 Jun '11

30 Jun '11

On Thu, Jun 30, 2011 at 03:11:05AM -0700, Howard Chu wrote: > Well since you raise the question, what do you think is the more > sensible approach to all of this? I was the one who argued in > ldapext that these attributes should be no-user-modification but > perhaps that makes them too inconvenient to administer. I think that the best approach would be to make no change in 2.4 code but to flag in the docs that the behaviour will change for 2.5. The NO-USER-MODIFICATION flags have been in draft-behera since 2005, but draft-zeilenga-ldap-relax has only been around since 2007. The latter document says that rules may not be relaxed unless there is a document saying that they may be. pwdAccountLockedTime is not mentioned in draft-zeilenga-ldap-relax and the relax control is not mentioned in draft-behera-ldap-password-policy, so one of those docs needs updating to make the behaviour legal. It would be interesting to survey other LDAP implementations to see how they currently treat the password-policy attributes. This is already a minefield due to uncertainties and variations in the replication process. Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs