openldap-bugs

openldap-bugs@openldap.org

1 participants
21509 discussions

Re: (ITS#5612) Contributing An Overlay which Submits Modification in LDAP to a Web-Page!
by quanah＠zimbra.com 15 Jul '08

15 Jul '08

--On Tuesday, July 15, 2008 6:43 AM +0000 fawadlateef(a)gmail.com wrote: > Thanks for your replies. > > By looking at RFC4533 AND slapo-accesslog I __don't__ think they can > be used against what my contributed overlay can do. > > The overlay actually monitors add/delete/modify operations based on > attributes/dn/classobject and if they matches it triggers event to the > URL (like interrupt). The accesslog DB writes out to the database add/delete/modify events, which logs attributes/dn/objectclasses. You could use any ldap sync listener to react to those, and do whatever it is you choose to have it do. This is exactly what Stanford University has used Net::LDAPapi to do, where it watches for group membership changes, and then performs actions on other enterprise applications based on those changes. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#5615) Unix based auth (SASL/External) not working on solaris 10(patch included)
by admin＠dmarkey.com 15 Jul '08

15 Jul '08

Full_Name: David Markey Version: 2.4 OS: Solaris URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (79.97.241.103) here's the bug in liblutil/getpeereid.c #if defined( HAVE_GETPEERUCRED ) ucred_t *uc = NULL; if( getpeerucred( s, &uc ) == 0 ) { *euid = ucred_geteuid( uc ); *egid = ucred_getegid( uc ); ucred_free( uc ); } it's missing a "return 0;" after ucred_free. Thanks to Howard for spotting this and fixing it. Its going perfectly now. Tested on Solaris 10 and Nevada X86

1 0

RE: (ITS#5392) Some traces are lost
by emmanuel.duru＠atosorigin.com 15 Jul '08

15 Jul '08

As these traces are the traces generated by Statslog macro, is it possible to replace the definition of Statslog in case LDAP_DEBUG is defined and LDAP_SYSLOG is not, to use lutil_debug instead of fprintf (stderr) ? That is, in slap.h, replace [...] #elif defined(LDAP_DEBUG) #define Statslog( level, fmt, connid, opid, arg1, arg2, arg3 ) \ do { \ if ( ldap_debug & (level) ) \ fprintf( stderr, (fmt), (connid), (opid), (arg1), (arg2), (arg3) );\ } while (0) [...] with [...] #elif defined(LDAP_DEBUG) #define Statslog( level, fmt, connid, opid, arg1, arg2, arg3 ) \ do { \ if ( ldap_debug & (level) ) \ { \ lutil_debug( ldap_debug, (level), (fmt), (connid), (opid), (arg1), (arg2), (arg3) ); \ }\ } while (0) [...]

1 0

Re: (ITS#5584)
by abartlet＠samba.org 15 Jul '08

15 Jul '08

--=-OCQI7+YC0WINty5M6nQu Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Tue, 2008-07-01 at 02:49 -0700, Howard Chu wrote: > abartlet(a)samba.org wrote: > > --=3D-GddVbqVLc61XV3X/kWQ/ > > Content-Type: text/plain > > Content-Transfer-Encoding: quoted-printable > > > > I've uploaded the patch to http://abartlet.net/memberof.patch >=20 > I committed a different patch to HEAD. Please test. I just wanted to note that I have looked at this, but it seems that some other change in the meantime has meant that the invalid DN check is missed - in setting member attributes (I doubt it was ever intentional, but it allowed the test to proceed to this point). I may have to write a validation module on the Samba side for this, until we get this validation in OpenLDAP. Andrew Bartlett --=20 Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. http://redhat.com --=-OCQI7+YC0WINty5M6nQu Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQBIfJXiz4A8Wyi0NrsRAtHRAJ9fY0s6fkAI0I8OmcQUL6NeHxPuFQCglAQT TlftIPNYEIqc1o1j31dgNF0= =qwa/ -----END PGP SIGNATURE----- --=-OCQI7+YC0WINty5M6nQu--

1 0

Re: (ITS#5612) Contributing An Overlay which Submits Modification in LDAP to a Web-Page!
by michael＠stroeder.com 15 Jul '08

15 Jul '08

fawadlateef(a)gmail.com wrote: > > By looking at RFC4533 AND slapo-accesslog I __don't__ think they can > be used against what my contributed overlay can do. Judging from your description using syncrepl is __exactly__ what you need. Especially since some HTTP requests might get lost. > Now the thing is: in our case, the web-page is not used to display > modifications to users or on the browser __rather__ it perform some > operations on other enterprise applications based on the event > triggered from LDAP overlay hence polling kind of mechanism can't work > for us. Use syncrepl's refreshAndPersist mode. Also write your sync component in such a fashion that if connection is down for some times you can catch up with changes happened in between. Ciao, Michael.

1 0

Re: (ITS#5612) Contributing An Overlay which Submits Modification in LDAP to a Web-Page!
by fawadlateef＠gmail.com 14 Jul '08

14 Jul '08

Thanks for your replies. By looking at RFC4533 AND slapo-accesslog I __don't__ think they can be used against what my contributed overlay can do. The overlay actually monitors add/delete/modify operations based on attributes/dn/classobject and if they matches it triggers event to the URL (like interrupt). Now the thing is: in our case, the web-page is not used to display modifications to users or on the browser __rather__ it perform some operations on other enterprise applications based on the event triggered from LDAP overlay hence polling kind of mechanism can't work for us. We are going to use this overlay in our open-source-product "Zivios - Open Source Enterprise Management". Zivios will be used for management of all enterprise applications (like OpenLDAP, Kerberos, Mail-Server, Network Time Server etc) from a single web-based panel, so all modifications done through Zivios on LDAP will be made/reflected on other applications/servers at the same time. Now if somebody perform some operation on OpenLDAP directly (means by skipping Zivios) then Zivios should be triggered for such a change and then it can act on other servers accordingly. Thus event received by Zivios is __not__ for displaying data; rather its for doing some background processing although this overlay can be used to display LDAP operations on web too. Please suggest me someother way which can work on scenario mentioned above if my overlay isn't good enough. Let me know if overlay name or description isn't clear and is creating misundestanding about the functionality of the overlay. -- Fawad Lateef

1 0

Re: (ITS#5614) Ignore invalid search filters
by ando＠sys-net.it 14 Jul '08

14 Jul '08

hyc(a)symas.com wrote: > I don't think ldap_munge_filter() is adequate any more. Note that filter2bv > doesn't use (?=undefined) for unknown attributeTypes or illegal values any > more, it uses (?<attr>=<value>). This change was made to allow the log > messages to show what the actual offending values were. A better strategy here > may be to walk the Filter tree and look for > (f->f_choice&SLAPD_FILTER_UNDEFINED) before making the search request, so that > no retries are needed. That's what the new patch does, for example, for back-meta. However, we still need somehow to "unparse" the filter to allow those substitutions the proxy must honor, like "(?=true)", "(?=false)". p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5614) Ignore invalid search filters
by hyc＠symas.com 14 Jul '08

14 Jul '08

ando(a)sys-net.it wrote: > andrew.graham(a)agustawestland.com wrote: > >> In line with the behavious specified in ITS 3785, any invalid search filter >> applied against back-meta will force a query including the search filter >> (!(objectClass=*)). As this filter can result in slow performance for certain >> brands of LDAP server, please provide an option to ignore invalid search filters >> in back-meta. > > A patch is in HEAD for back-ldap& back-meta. Use the "noundeffilter > {true|FALSE}" statement. Please test. p. I don't think ldap_munge_filter() is adequate any more. Note that filter2bv doesn't use (?=undefined) for unknown attributeTypes or illegal values any more, it uses (?<attr>=<value>). This change was made to allow the log messages to show what the actual offending values were. A better strategy here may be to walk the Filter tree and look for (f->f_choice&SLAPD_FILTER_UNDEFINED) before making the search request, so that no retries are needed. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5612) Contributing An Overlay which Submits Modification in LDAP to a Web-Page!
by quanah＠zimbra.com 14 Jul '08

14 Jul '08

--On Monday, July 14, 2008 9:04 PM +0000 hyc(a)symas.com wrote: > ando(a)sys-net.it wrote: >> fawadlateef(a)gmail.com wrote: >> >>> Contributing an overlay which submits modification in LDAP to a >>> web-page through libcurl. >> >> Thanks for the contribution. Without having looked too much into the >> solution you designed, however, I believe you moved too much effort at >> the DSA side. An alternative approach to your problem consists in using >> the RFC4533 LDAP Sync to design a client that is persistently returned >> any change in data matching a search request, letting the client adapt >> the results into the desired form for the web page. The client could be >> easily embedded in a web server, e.g. using the scripting capabilities >> that most web servers have, or even coded using those scripting >> capabilities, provide they support the capability to implement the LDAP >> extensions used by RFC 4533. > > Actually, even without RFC4533, all that's needed is to use > slapo-accesslog and let the web server query the log DB whenever a user > accesses the page. -- Along Pierangelo's answer, I'll note that Net::LDAPapi perl module can be an LDAP sync client, and thus used to drive any number of things based off changes made to an accesslog DB. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#5612) Contributing An Overlay which Submits Modification in LDAP to a Web-Page!
by hyc＠symas.com 14 Jul '08

14 Jul '08

ando(a)sys-net.it wrote: > fawadlateef(a)gmail.com wrote: > >> Contributing an overlay which submits modification in LDAP to a web-page through >> libcurl. > > Thanks for the contribution. Without having looked too much into the > solution you designed, however, I believe you moved too much effort at > the DSA side. An alternative approach to your problem consists in using > the RFC4533 LDAP Sync to design a client that is persistently returned > any change in data matching a search request, letting the client adapt > the results into the desired form for the web page. The client could be > easily embedded in a web server, e.g. using the scripting capabilities > that most web servers have, or even coded using those scripting > capabilities, provide they support the capability to implement the LDAP > extensions used by RFC 4533. Actually, even without RFC4533, all that's needed is to use slapo-accesslog and let the web server query the log DB whenever a user accesses the page. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs