openldap-bugs

openldap-bugs@openldap.org

1 participants
20996 discussions

(ITS#5043) double free in slapo-rwm when rewriting search filters
by ando＠sys-net.it 12 Jul '07

12 Jul '07

Full_Name: Pierangelo Masarati Version: HEAD/re23 OS: irrelevant URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (81.72.89.40) Submitted by: ando See subject; a fix is coming.

1 0

(ITS#5042) Contribution: Active Directory Password Cache
by s.hetze＠linux-ag.de 12 Jul '07

12 Jul '07

Full_Name: Sebastian Hetze Version: 2.3.30 OS: Linux URL: ftp://ftp.openldap.org/incoming/Sebastian-Hetze-pgk-070712.tgz Submission from: (NULL) (212.21.78.130) Hi *, in your FTP incoming you find a piece of software that we would like to contribute to the slapd-modules collection. We hope you find it useful and we would very much like to receive feedback about useability, ideas for improvements and (in the very unlikely case of occurance ;-) bugreports and fixes. Best regards Sebastian Hetze ------------------------------------------------------------------------------------ Active Directory Password Cache =============================== Active Directory does not provide any means to read user credentials on any public API. It is possible, to install additional libraries as password sniffer to catch and forward cleartext passwords on changes. In case you cannot or simply dont want to install such libraries, the Active Directory Password Cache overlay is your option. The Active Directory Password Cache overlay allows to mirror user account credentials without any modification on the AD server. It only takes one occasional simple bind authentication against the OpenLDAP server. If the credential has not been mirrored yet, the overlay uses the krbPrincipalName and the password provided by the user to perform a Kerberos init against the Active Directory. A successful Kerberos init guarantees a correct password for this principal, and therefor the bind finally succeeds. Within this overlay operation, the password gets encrypted with the default OpenLDAP hash alorithm and stored as userPassword attribute. There is an option to update the sambaNTPassword also (using code borrowed from Howard Chu's smbk5pwd overlay). All following simple bind authentications will first try these cached credentials, making the OpenLDAP server independent from AD. In case the user changes its password on the Active Directory server, the old password stays valid in OpenLDAP until the user first presents the new password for an simple bind. Within this bind operation, the overlay performs another Kerberos init and updates the cached credentials in OpenLDAP.

1 0

Can't delete user using DN (Error 32) or add user using DN (Error 68)
by Chase Putans 12 Jul '07

12 Jul '07

I am not sure this is actually a bug, but I figure I will submit this anyways. We had a power outage some time ago, and the bdb files got corrupted. I ran a slapindex after shutting down and it seems one entry is now missing. I have tried re-adding it, but when I do that, I get an error that this entry already exists. When I try and delete with that particular DN, it says that it does not exist. This is openldap 2.2.29-1 installed via Yum on FC4. [root@PDC]# ldapadd -D "<ROOT DN>" -x -W -f entrymods Enter LDAP Password: adding new entry "uid=<username>,ou=People,dc=3sixtygroup,dc=com" ldap_add: Already exists (68) [root@PDC]# ldapdelete -D "<ROOT DN>" -x -W -f entrymods2 Enter LDAP Password: Delete Result: No such object (32) Matched DN: ou=People,dc=3sixtygroup,dc=com Contents of entrymods is as follows: dn: uid=<username>,ou=People,dc=3sixtygroup,dc=com uid: <username> objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: sambaSamAccount cn: <username> sn: <username> givenName: <username> uidNumber: <uidnumber> gidNumber: <gidnumber> homeDirectory: /home/<username> loginShell: /bin/bash gecos: System User sambaLogonTime: 0 sambaLogoffTime: 2147483647 displayName: <username> sambaSID: <> sambaPrimaryGroupSID: <> sambaLogonScript: scripts\logon.bat sambaHomePath: \\PDC\<username> sambaHomeDrive: H: sambaAcctFlags: [U] Contents of entrymods2: uid=<username>,ou=People,dc=3sixtygroup,dc=com changetype: delete Any help would be much appreciated. Thanks. -- Chase Putans Systems Administrator / Programmer / Web Developer / Support The 3Sixty Group http://3sixtygroup.com Ph: 800-440-3967 Fax: 800-453-9683

2 4

Re: (ITS#4986) manageDSAit might control cause problems in database selection
by hyc＠symas.com 12 Jul '07

12 Jul '07

hyc(a)symas.com wrote: > Thinking back, I think the idea here is that you might have a set of nested > databases connected by referral entries. E.g., > > database ldbm > suffix dc=sub,dc=example,dc=com > > database ldbm > suffix dc=example,dc=com > > If you had an referral entry in the superior DB that pointed to the sub > database, you would need the manageDSAit control to be able to operate on the > referral entry. > > None of this really makes sense post 2.1 since subordinate/glue makes it > superfluous. > I'm going to rip all of that out. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#4981) Try -lpthread before -pthread
by rra＠stanford.edu 12 Jul '07

12 Jul '07

Quanah Gibson-Mount <quanah(a)zimbra.com> writes: > I believe the circumstances that caused this ITS to be opened have > changed, is that correct? Yes, the underlying toolchain bug is now fixed and the ITS can be closed. Thanks for the check! -- Russ Allbery (rra(a)stanford.edu) <http://www.eyrie.org/~eagle/>

1 0

Re: (ITS#4981) Try -lpthread before -pthread
by quanah＠zimbra.com 12 Jul '07

12 Jul '07

Russ, I believe the circumstances that caused this ITS to be opened have changed, is that correct? --Quanah --On May 24, 2007 2:37:49 AM +0000 kurt(a)OpenLDAP.org wrote: > > On May 23, 2007, at 10:16 PM, rra(a)stanford.edu wrote: >> libtool does not pass -pthread through > > Our libtool does. But gcc might not do the right thing with it. > In that case, it's a gcc bug which should be reported to the gcc > folks. > > I believe using -lpthread over -pthread will cause more problems > than its worth. That is, the problems caused by the missing link > on some platforms is not nearly as bad as the caused by using > -lc instead of -lc_r on other platforms. > > -- Kurt > > -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Solaris Client
by daniel perez del campo 10 Jul '07

10 Jul '07

Hi, I have configurated openLdap in Debian, and it works well with Linux clients. But I want to authenticate a Solaris client against the Ldap server. I don't know how to do this. Could someone tell me what have I have to do?? Or some guide? I have looked for information in Google and I don't find anything clear. Thanks a lot, and sorry for my english. Dani _________________________________________________________________ Grandes éxitos, superhéroes, imitaciones, cine y TV... http://es.msn.kiwee.com/ Lo mejor para tu móvil.

3 2

Re: imporvement to slapo-constraint (ITS#4987)
by manu＠netbsd.org 07 Jul '07

07 Jul '07

Gavin Henry <ghenry(a)suretecsystems.com> wrote: > It would be best to move this dicussion to openldap-devel(a)openldap.org now. Let's go... Summarry: I've added a new feature to slapo-constraint for constraining a value attribute the the existing values of another attribute. The idea is that you can have a catalog of allowed values (eg: for titles: Mr, Mrs, Miss) and constraint an attribute to these values Before working further on this patch (style, dod), I'd like some feeback on: 1) the way it's implemented: is there rought bugs, or is the logic fine? 2) configuration syntax: do we keep this one or do we swtich to something else? Could someone comment on the patch? -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

1 0

Re: imporvement to slapo-constraint (ITS#4987)
by ghenry＠suretecsystems.com 07 Jul '07

07 Jul '07

<quote who="manu(a)netbsd.org"> >> Did you see http://www.openldap.org/devel/contributing.html > > Right, but before moving foward with appropriate style, documentation, > and so on, I'd like to have some input about the config syntax and the > way it's implemented. I had no feedback at all yet on that. It would be best to move this dicussion to openldap-devel(a)openldap.org now. Try raising a question again there. Gavin. > > -- > Emmanuel Dreyfus > http://hcpnet.free.fr/pubz > manu(a)netbsd.org > > >

1 0

Re: imporvement to slapo-constraint (ITS#4987)
by manu＠netbsd.org 07 Jul '07

07 Jul '07

> Did you see http://www.openldap.org/devel/contributing.html Right, but before moving foward with appropriate style, documentation, and so on, I'd like to have some input about the config syntax and the way it's implemented. I had no feedback at all yet on that. -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs