openldap-bugs

openldap-bugs@openldap.org

1 participants
20967 discussions

Re: (ITS#5514) Query about openLDAP on windows
by ando＠sys-net.it 15 May '08

15 May '08

sushmita_mishra(a)infosys.com wrote: > I want to use openLDAP for authentication, for this purpose I have gone > through the documents available at <www.openldap.org/doc/admin24/>. In all these > documents, I found the installation for openLDAP directory server is given for > LINUX or UNIX only and not for Windows. > > My query is Can we install openLDAP directory server on windows machine? If yes > can you please send me the steps for installing/configuring openLDAP directory > server on windows machine? Please direct OpenLDAP software usage questions to the openldap-software mailing lists; the ITS is to track bugs and issues. This ITS will be closed. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: (ITS#5511) SIGABRT in slapo-unique when setting uidNumber to 0
by h.b.furuseth＠usit.uio.no 15 May '08

15 May '08

Confirmed in HEAD. Unique makes too small buffer for filter "(uidNumber=0)", so build_filter() line 931: assert( len >= 0 && len < ks ); fails because len == ks == 13 == strlen(filter). slapd.conf: include ...core.schema include ...cosine.schema include ...nis.schema database bdb directory /tmp/db suffix uid=dwhite rootdn uid=dwhite rootpw secret overlay unique unique_attributes uidNumber 'ldapadd'ed ldif: dn: uid=dwhite objectClass: account objectClass: posixAccount uid: dwhite uidNumber: 0 cn: Dan White gidNumber: 1 homeDirectory: /home/dwhite -- Hallvard

1 0

Re: (ITS#5133) Synchronous replication on slave doesn't notice lost network connection
by stelios.xx.grigoriadis＠ericsson.com 15 May '08

15 May '08

We have created a patch that works for us. An updated version is available for 2.4.9 The patch is using the parameter "mastercheckint" in slapd.conf, if present. A separate thread then continously askes the master for the root DSE. An excerpt from the slapd.conf file: # from master ldapt1.roadrunner syncrepl rid=102 provider=ldap://ldapt1.roadrunner type=refreshAndPersist retry="10 10 60 +" searchbase="dc=example,dc=com" filter="(objectClass=*)" scope=sub schemachecking=off sizelimit=500000 timelimit=360000 bindmethod=simple mastercheckint=5 ### THIS is the new parameter. binddn="cn=admin,dc=example,dc=com" credentials=secret updateref ldap://ldapt1.roadrunner overlay syncprov If the master unexpectedly terminates (eg. due to a power failure) the replicas will get a new connection once it's up again. The patch is available at: http://www.freewebs.com/stigri/Stelios-Grigoriadis-its5133-080514.patch It must be run while in openlda-2.4.9 directory. /Stelios Grigoriadis

1 0

Re: (ITS#5507) Ldap clients leak file descriptors
by jsafrane＠redhat.com 15 May '08

15 May '08

Hallvard B Furuseth wrote: > I've no idea how SELinux works, so I'm not up to testing any of what > I'm saying here myself, but some notes follow anyway. Please clarify: > >> On system protected by SELinux, when an application with active LDAP >> connection tries to exec() binary with different security context, >> SELinux inspects all opened filedescriptors, including the ldap one, >> and denies access to the ones, which do not conform active policy (the >> executed binary is not authorized to contact LDAP servers). Users are >> then annoyed by security warnings in the logs. > > More to the point, some of those security warnings may indicate real > security problems. Bind with password, exec some application, and then > that application has the bound user's access to LDAP. That's exactly the case SELinux is trying to prevent. > The message could be indicating a bug in the app - that it should > release its resources (such as descriptors) before exec(). > Except, I presume this happens in system() as well? > I'd be unfortunate if LDAP apps could not use system() safely. I assume system() calls fork() and exec() internally, so yes, it's protected as well. SELinux can be extensively configured and if an admin thinks that executed application can safely use inherited ldap connection, he/she can allow it. But this is nearly impossible, because LDAP can be integrated into pam (via nss_ldap). If pam uses nss_ldap, then really lot of applications use ldap client indirectly. And nss_ldap can be configured to keep the connection open for certain time so it's reused, and the applications don't know, if the pam with nss_ldap has opened ldap connection and they can't close it. >> +#ifdef _GNU_SOURCE >> + fcntl(s, F_SETFD, FD_CLOEXEC); >> +#endif > > _GNU_SOURCE depends on the compiler flags. Please try > #ifdef FD_CLOEXEC > instead. Agreed.. > Also I expect the same should be done in os-local.c:ldap_pvt_socket(), Yes, it should. Again, please use fcntl(s, F_SETFD, FD_CLOEXEC); Jan

1 0

Re: (ITS#5504) ldapsearch hangs retrieving info
by Javier.Fernandez＠cern.ch 15 May '08

15 May '08

Thanks Quanah for your time. I have some answers/comments inline: Quanah Gibson-Mount escribió: > --On Wednesday, May 14, 2008 9:56 AM +0000 Javier.Fernandez(a)cern.ch > wrote: > >> unfortunately there?s no update for openladp under SL4, that?s why we >> are using such version. In fact I see no newer versions but for Fedora >> and Mandriva > <http://staff.telkomsa.net/packages/> > or > <http://www.symas.com> I have tried installing last 2.4 version for RH but I get the same result, since problem is not related to ldap version I'm afraid >> In fact, other sites are living nice with that version or older ones. >> In any case, I have compiled and built latest stable version from >> openldap project webpage (2.3.39) and I get the same problem. I'm not >> saying this is a bug from ldap, but something with local area network >> configuration. >> >> I'm asking for some support to debug this problem actually. > If the bug is not specifically in the OpenLDAP software, I suggest you > peruse: > > <http://www.openldap.org/support/> Well, this is the first thing I tried, but I got no solutions browsing through the pages and therefore I tried this mailing list referenced from that link. > I would note I don't see anything particular in what you provide > indicating the problem is with ldapsearch. What version of OpenLDAP > is the server in question running (I see it is OpenLDAP by querying > its rootDSE)? > > I'll note that a *limited* ldapsearch works just fine: > > [quanah@freelancer ~]$ ldapsearch -x -H ldap://exp-bdii.cern.ch:2170 > -b "" -s base + > # extended LDIF > # > # LDAPv3 snip > # search result > search: 2 > result: 0 Success > > # numResponses: 2 > # numEntries: 1 That works fine for me. > I would also note that for me, doing a dump of the entire server works > just fine: > > ldapsearch -x -H ldap://exp-bdii.cern.ch:2170 -b "o=grid" > > results in: > > # search result > search: 2 > result: 0 Success > > # numResponses: 43962 > # numEntries: 43961 I do not reach that point, in fact that is the problem: command gets stuck retrieving one of the entries, in particular today it hangs at: GlueCEAccessControlBaseRule: VO:ops GlueForeignKey: GlueClusterUniqueID=ce104.cern.ch GlueInformationServiceURL: ldap://ce104.cern.ch:2170/mds-vo-name=resource,o=gr id GlueSchemaVersionMajor: 1 GlueSchemaVersionMinor: 3 and after a long long time, the output gives/jumps to another entry... and it continues dripping entries from time to time for an indefinite period until the command gives timeout. A ping to exp-bdii.cern.ch gives an average delay of 40ms which I consider normal. From any other sites (e.g. any machine from CERN) the command works fine in any openldap version, although I do not see any summary at the end with such big number of entries and results as you do. > > Adding -d -1 to the query, I eventually see the same thing you do: > I just added it to perform some debugging but I do not know how to interpret the results. Once more: any hint on how to trace back this problem would be really apreciated. Thank you very much. -- +--------------------------------------------------------------+ Javier Fernandez Menendez Grupo de Fisica de AAEE Universidad de Oviedo C/ Calvo Sotelo, s/n 33005 Oviedo Phone: +34 985106252 mailto:Javier.Fernandez@cern.ch +---------------------------------------------------------------+

1 0

Re: (ITS#5512) Doc contribution for search privileges in 2.4
by ghenry＠suretecsystems.com 15 May '08

15 May '08

> Hello, > > ITS #5400 outlines a change in the privileges required by search > operations in > 2.4. I would like to suggest documentation for this in the admin guide > (the > slapd.access man page is already accurate). > > Please find propositions here: > 1) http://www.phillipoux.net/jonathan-clarke-20080515-upgrading.patch > Explanation and example in the "Upgrading from 2.3" appendix. > > 2) http://www.phillipoux.net/jonathan-clarke-20080515-access-control.patch > Detail of the required privileges on the "entry" pseudo-attribute in the > access > control section (static and dynamic config - same text is repeated twice). > > > As a side note, I encountered a "452 Error writing file: No space left on > device." error on ftp.openldap.org/incoming while trying to upload these > patches. > Thanks for this. I was hoping to do this tomorrow as I've been so busy this week, but now I don't need to! Will patch, review and provide feedback as soon as I can. Gavin. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP.

1 0

(ITS#5514) Query about openLDAP on windows
by sushmita_mishra＠infosys.com 14 May '08

14 May '08

Full_Name: Sushmita Mishra Version: 2.3.41 OS: Windows XP URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (220.225.64.6) Hi, I want to use openLDAP for authentication, for this purpose I have gone through the documents available at <www.openldap.org/doc/admin24/>. In all these documents, I found the installation for openLDAP directory server is given for LINUX or UNIX only and not for Windows. My query is Can we install openLDAP directory server on windows machine? If yes can you please send me the steps for installing/configuring openLDAP directory server on windows machine? Thanks, Sushmita Mishra

1 0

(ITS#5513) back-ldap+ppolicy bind assertion failure
by mbackes＠symas.com 14 May '08

14 May '08

Full_Name: Matthew Backes Version: 2.3, 2.4 OS: linux URL: Submission from: (NULL) (76.88.99.93) A basic back-ldap configuration with the password policy overlay stacked on top results in an assertfail for the second bind. e.g. given a working (possibly empty db) on ldap://localhost:1389/... include ...../core.schema include ...../ppolicy.schema modulepath ..... moduleload back_ldap.la moduleload ppolicy.la database ldap suffix "" uri ldap://localhost:1389/ After performing a successful remote bind, the next bind attempt halts the back-ldap directory with: slapd: bind.c:905: ldap_back_getconn: Assertion `( li->li_idassert.si_flags & (0x02U) )' failed. where 0x02U here is LDAP_BACK_AUTH_OVERRIDE. This happens under both OpenLDAP 2.3 and 2.4.

1 0

(ITS#5512) Doc contribution for search privileges in 2.4
by jclarke＠linagora.com 14 May '08

14 May '08

Full_Name: Jonathan Clarke Version: 2.4 OS: URL: Submission from: (NULL) (88.167.76.100) Hello, ITS #5400 outlines a change in the privileges required by search operations in 2.4. I would like to suggest documentation for this in the admin guide (the slapd.access man page is already accurate). Please find propositions here: 1) http://www.phillipoux.net/jonathan-clarke-20080515-upgrading.patch Explanation and example in the "Upgrading from 2.3" appendix. 2) http://www.phillipoux.net/jonathan-clarke-20080515-access-control.patch Detail of the required privileges on the "entry" pseudo-attribute in the access control section (static and dynamic config - same text is repeated twice). As a side note, I encountered a "452 Error writing file: No space left on device." error on ftp.openldap.org/incoming while trying to upload these patches. Regards, Jonathan

1 0

(ITS#5511) SIGABRT in slapo-unique when setting uidNumber to 0
by dwhite＠olp.net 14 May '08

14 May '08

Full_Name: Dan White Version: 2.4.9 OS: Debian Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (2610:b8:1:0:21a:70ff:fe8f:e0b3) I'm experiencing SIGABRT crashes when the slapo-unique overlay is enabled, and I attempt to set one of the unique attributes to '0'. A configuration snippet: ... modulepath /usr/lib/ldap moduleload back_bdb moduleload smbk5pwd moduleload unique ... overlay unique #unique_base ou=People,dc=olp,dc=net unique_attributes uidNumber btcAltUID I'm triggering the crash while modifying the uidNumber attribute with the ldapmodify command: hiro:/var/lib/ldap# ldapsearch -LLL uid=dwhite(a)olp.net uidNumber dn: uid=dwhite(a)olp.net,ou=people,dc=olp,dc=net uidNumber: 497913425 hiro:/var/lib/ldap# ldapmodify dn: uid=dwhite(a)olp.net,ou=people,dc=olp,dc=net changeType: modify replace: uidNumber uidNumber: 0 modifying entry "uid=dwhite(a)olp.net,ou=people,dc=olp,dc=net" ldap_result: Can't contact LDAP server (-1) If I comment out all the unique overlay related configuration items and restart slapd, and rerun my ldapmodify command, the process completes normally. Details from the coredump: ... Core was generated by `/usr/sbin/slapd -h ldap:/// ldaps:/// ldapi:/// -g root -u root -f /etc/ldap/sl'. Program terminated with signal 6, Aborted. #0 0xb7eee410 in ?? () (gdb) thread apply all bt Thread 3 (process 9354): #0 0xb7eee410 in ?? () #1 0xbfdb51a8 in ?? () #2 0x0000248b in ?? () #3 0x00000000 in ?? () Thread 2 (process 9355): #0 0xb7eee410 in ?? () #1 0xb717a458 in ?? () #2 0x00000400 in ?? () #3 0x081c4148 in ?? () #4 0xb7bf2b0e in epoll_wait () from /lib/tls/i686/cmov/libc.so.6 #5 0x08075ca9 in slapd_daemon_task (ptr=0x0) at /usr/src/build/slapd.noopt/openldap-2.4.9/servers/slapd/daemon.c:2281 #6 0xb7c5d240 in start_thread () from /lib/tls/i686/cmov/libpthread.so.0 #7 0xb7bf249e in clone () from /lib/tls/i686/cmov/libc.so.6 Thread 1 (process 9359): #0 0xb7eee410 in ?? () #1 0xb6d77a38 in ?? () #2 0x00000006 in ?? () #3 0x0000248f in ?? () #4 0xb7b4f811 in raise () from /lib/tls/i686/cmov/libc.so.6 #5 0xb7b50fb9 in abort () from /lib/tls/i686/cmov/libc.so.6 #6 0xb7b48fbf in __assert_fail () from /lib/tls/i686/cmov/libc.so.6 #7 0xb7579032 in build_filter (domain=0x822f130, uri=0x822b748, ad=0x81e20b0, b=0x82bd980, kp=0xb6878266 "(uidNumber=0", ks=13, ctx=0x82bdab8) at /usr/src/build/slapd.noopt/openldap-2.4.9/servers/slapd/overlays/unique.c:931 #8 0xb7579d89 in unique_modify (op=0x82bd6f8, rs=0xb6d791c8) at /usr/src/build/slapd.noopt/openldap-2.4.9/servers/slapd/overlays/unique.c:1185 #9 0x080f1c69 in overlay_op_walk (op=0x82bd6f8, rs=0xb6d791c8, which=op_modify, oi=0x822cbc8, on=0x822f148) at /usr/src/build/slapd.noopt/openldap-2.4.9/servers/slapd/backover.c:636 #10 0x080f1ea0 in over_op_func (op=0x82bd6f8, rs=0xb6d791c8, which=op_modify) at /usr/src/build/slapd.noopt/openldap-2.4.9/servers/slapd/backover.c:698 #11 0x080f1f68 in over_op_modify (op=0x82bd6f8, rs=0xb6d791c8) at /usr/src/build/slapd.noopt/openldap-2.4.9/servers/slapd/backover.c:732 #12 0x08096290 in fe_op_modify (op=0x82bd6f8, rs=0xb6d791c8) at /usr/src/build/slapd.noopt/openldap-2.4.9/servers/slapd/modify.c:300 #13 0x08095cd4 in do_modify (op=0x82bd6f8, rs=0xb6d791c8) at /usr/src/build/slapd.noopt/openldap-2.4.9/servers/slapd/modify.c:175 #14 0x080795c2 in connection_operation (ctx=0xb6d792ac, arg_v=0x82bd6f8) at /usr/src/build/slapd.noopt/openldap-2.4.9/servers/slapd/connection.c:1084 #15 0x08079aaf in connection_read_thread (ctx=0xb6d792ac, argv=0x12) at /usr/src/build/slapd.noopt/openldap-2.4.9/servers/slapd/connection.c:1211 #16 0xb7ea812e in ldap_int_thread_pool_wrapper (xpool=0x81e38d0) at /usr/src/build/slapd.noopt/openldap-2.4.9/libraries/libldap_r/tpool.c:663 #17 0xb7c5d240 in start_thread () from /lib/tls/i686/cmov/libpthread.so.0 #18 0xb7bf249e in clone () from /lib/tls/i686/cmov/libc.so.6 (gdb) quit

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs