openldap-devel October 2008

openldap-devel@openldap.org

20 participants
30 discussions

Re: RE24 final testing
by Brett ＠Google 09 Oct '08

09 Oct '08

> Ok, please proceed with testing RE24. Solaris 10 test OK using native gcc compiler in /usr/sfw/bin. had to use --disable-perl and --disable-slapi to solve compiler issues - but this is not unusual / or a regression, i think for Solaris 10 the build process still assumes a sun compiler in a few places (although CC=gcc and sun compiler not installed, so should not) -bash-3.00$ gcc -v Reading specs from /usr/sfw/lib/gcc/sparc-sun-solaris2.10/3.4.3/specs Configured with: /sfw10/builds/build/sfw10-patch/usr/src/cmd/gcc/gcc-3.4.3/configure --prefix=/usr/sfw --with-as=/usr/ccs/bin/as --without-gnu-as --with-ld=/usr/ccs/bin/ld --without-gnu-ld --enable-languages=c,c++ --enable-shared Thread model: posix gcc version 3.4.3 (csl-sol210-3_4-branch+sol_rpath) -bash-3.00$ uname -a SunOS mytesthost 5.10 Generic_127111-11 sun4v sparc SUNW,Sun-Fire-T200

1 1

Re: RE24 final testing
by Quanah Gibson-Mount 08 Oct '08

08 Oct '08

--On Tuesday, October 07, 2008 9:57 AM +1000 brett.maxfield(a)gmail.com wrote: > are all (test050 etc.,) changes comitted to RE24 cvs now? > > i was running on suse 10.3 dual core xen kernel about 12h ago and had > a failure.. i will re-test tonight > > checked out vanilla re24 with bdb 4.7 + patches. Hold off a little bit, the latest ITS fix has revealed some other long-standing bugs. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

7 11

StartTLS URL extension
by Howard Chu 07 Oct '08

07 Oct '08

We really ought to have a way to allow clients to make libldap use StartTLS without having to code their own calls into libldap for that purpose. I think it would be useful to allow specifying StartTLS in the extension field of the LDAP URL. Then at least it can be configured into ldap.conf forgotten about. The code for ldap_initialize() should look for the URL extension field, and act on it if StartTLS / 1.3.6.1.4.1.1466.20037 is present. Any comments? -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

6 15

RE24 final testing
by Quanah Gibson-Mount 06 Oct '08

06 Oct '08

RE24 has been tagged for OpenLDAP 2.4.12. The only major change since the previous testing request is the fix for the test050 issues that had been seen and ITS#5728. Unless someone turns up a major regression, current RE24 will got out as-is. All tests pass for me on CentOS 5.2 64-bit, using BDB 4.7.25+patches. --Quanah

1 1

Re: StartTLS URL extension
by Howard Chu 06 Oct '08

06 Oct '08

William A. Rowe, Jr. wrote: > Howard Chu wrote: >> We really ought to have a way to allow clients to make libldap use >> StartTLS without having to code their own calls into libldap for that >> purpose. I think it would be useful to allow specifying StartTLS in the >> extension field of the LDAP URL. Then at least it can be configured into >> ldap.conf forgotten about. >> >> The code for ldap_initialize() should look for the URL extension field, >> and act on it if StartTLS / 1.3.6.1.4.1.1466.20037 is present. >> >> Any comments? > > What would be the syntax and mechanism for defining client certificates > or permitted server CA chains? The same as currently exists. None of those details are parameters of the actual StartTLS exop so they're not relevant to this discussion. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Enforcing attribute ACL on add operations
by manu＠netbsd.org 04 Oct '08

04 Oct '08

Hello Right now, slapd ignore attribute ACL when performing an add operation. If you have privilegied users that can add entries, it means that you can prevent them from modifying attributes in existing entries, but you cannot prevent them from adding an entry with a read-only attribute. The problem can be interesting with an attribute such as authzTo, where the whole access control can be circumvented by any user that can create an entry in the tree. IMO this behavior was not intended, but if it was, then it should be clearly documented. Below is a patch that cause attribute ACL to be checked for add operations. It is done in the backend, so if it is acceptable, then I will have to do it for other backends. I wonder if the modrdn operation shoulnd't be subject to the same sanity checks. Any thought? Does it look right? diff -U2 -r1.174 add.c --- servers/slapd/back-bdb/add.c 26 Aug 2008 23:45:35 -0000 1.174 +++ servers/slapd/back-bdb/add.c 27 Sep 2008 15:54:58 -0000 @@ -300,4 +300,22 @@ } + /* + * Check ACL for attribute write access + */ + if (!acl_check_modlist(op, oe, op->ora_modlist)) { + switch( opinfo.boi_err ) { + case DB_LOCK_DEADLOCK: + case DB_LOCK_NOTGRANTED: + goto retry; + } + + Debug( LDAP_DEBUG_TRACE, + LDAP_XSTRING(bdb_add) ": no write access to attribute\n", + 0, 0, 0 ); + rs->sr_err = LDAP_INSUFFICIENT_ACCESS; + rs->sr_text = "no write access to attribute"; + goto return_results;; + } + if ( eid == NOID ) { rs->sr_err = bdb_next_id( op->o_bd, &eid ); -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

4 22

Fwd: RE24 testing
by Brett ＠Google 03 Oct '08

03 Oct '08

On Thu, Sep 11, 2008 at 2:33 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > Please test RE24. > > Thanks! > > --Quanah on suse 10.2 SMP / xen kernel, ie : Linux suse 2.6.22.18-0.2-xen #1 SMP 2008-06-09 13:53:20 +0200 x86_64 x86_64 x86_64 GNU/Linux test failed - producer and consumer2 databases differ >>>>> ./scripts/test050-syncrepl-multimaster failed (exit 1) make[2]: *** [bdb-yes] Error 1 make[2]: Leaving directory `/home/maxfieb/keep-ldap/openldap-src-RE24/tests' make[1]: *** [test] Error 2 make[1]: Leaving directory `/home/maxfieb/keep-ldap/openldap-src-RE24/tests' make: *** [test] Error 2 compiling against bdb 4.7.25.NC (no patched applied) bdb options : ../dist/configure --disable-java --enable-posixmutexes --enable-largefile --enable-cxx --disable-compat185 make make install openldap configure : CFLAGS="-g -g3 -ggdb -ggdb3" CPPFLAGS="-I/usr/local/BerkeleyDB.4.7/include" \ LDFLAGS="-L/usr/local/BerkeleyDB.4.7/lib -R/usr/local/BerkeleyDB.4.7/lib" \ ./configure --enable-slapd --enable-backends --enable-shared \ --enable-overlays --disable-ipv6 --disable-sql --disable-ndb --with-threads \ --enable-ssl --enable-collect --enable-debug building HEAD with same openldap configure options and same bdb binaries above, all tests succeed (albeit much more slowly.. perhaps DB_CONFIG needs tweaking in head ?).. Cheers Brett

4 9

Please test RE24
by Quanah Gibson-Mount 03 Oct '08

03 Oct '08

Please test RE24. Issues remain with test050, but are not considered release blocking as they are not a regression. Thanks, Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

7 18

Re: commit: ldap/servers/slapd/overlays ppolicy.c
by Pierangelo Masarati 02 Oct '08

02 Oct '08

ando(a)OpenLDAP.org wrote: > Update of /repo/OpenLDAP/pkg/ldap/servers/slapd/overlays > > Modified Files: > ppolicy.c 1.116 -> 1.117 > > Log Message: > allow controls deletion to be deferred; pass response controls back to frontend in extops (ITS#5711) Please disregard, this patch is broken. A fix will appear shortly. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

3 3

groups, rfc
by Howard Chu 01 Oct '08

01 Oct '08

I was dusting off some of the last rfc2307bis revisions Luke sent me, and then remembered how much of a mess we still have with groups. Here are some ideas I'm toying with, would like some feedback before drafting for IETF-LDAPext. We already know that groupOfUniqueNames is misleading and should be avoided. The big problem with groupOfNames is that member is required. So my first thought was a new groupOfMembers objectclass where member is optional (MAY instead of MUST). Along the way I was thinking that perhaps a different concept was needed here, like setOfNames instead. The main thinking being: sets implicitly have unique membership sets may be empty sets may be comprised of other sets This presents a single solution to the whole static/dynamic/nested groups mess: setOfReferences. The (multivalued of course) "reference" attribute is a URI. if it's in the form of a plain DN, then it is the DN of a single member. if it's in the form of an absolute qualified URI (i.e., it begins with a "ldap:///" spec) then it dereferences the URI to derive the members. For a nested group, you would use ldap:///cn=foo,o=bar?reference?base which would join (union) the values of the referenced entry's reference attribute to this set. For a dynamic group you would use something like ldap:///ou=foo,o=bar?entryDN?subtree?(HasWhatIWant=TRUE) Obviously a "nested group" is now just a special case of a dynamic group. The main point here is that you can immediately tell by inspection whether a further dereference is needed or not. Furthermore we can incorporate specific Identity values into *each* dereference, using URI extensions: ldap:///ou=foo,o=bar?entryDN?subtree?(HasWhatIWant=TRUE)?X-refAuthID=cn=joe%2c,o=bar We could probably do the same for AuthZ although it would get awkward to specify a list of authorized proxiers. That would itself have to be another reference to accomodate multiple values. This gives us a clean, consistent syntax and semantic for grouping behavior. It doesn't make our lives any easier as far as indexing and optimizing the dynamic characteristics, but it's a start. Thoughts? -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-devel October 2008