openldap-software November 2006

openldap-software@openldap.org

81 participants
81 discussions

Re: Problem with replica.
by Pierangelo Masarati 15 Nov '06

15 Nov '06

Please keep replies on the mailing list. Paul Shevtsov wrote: > On Tue, Nov 14, 2006 at 06:12:18PM +0100, Pierangelo Masarati wrote: > >> Apparently, your client tries to chase referrals anonymously, and this >> fails as expected. I don't see any software malfunction here (on the >> OpenLDAP side, at least); there might be a missing or misimplemented >> feature in the client, though. >> > > Ok. I try on slave side > Client message > ------------------------------------------------------------------------- > #ldapadd -W -x -D "cn=root,dc=dgb,dc=local" -f bbb1.ldif > #Enter password: > adding new entry "uid=bbb1,ou=users,dc=dgb,dc=local" > ldap_add: Referral (10) > refferals: > ldap://ldap.dgb.local/uid=bbb1,ou=users,dc=dgb,dc=local > ------------------------------------------------------------------------- > Server message (loglevel stats sycn) > ------------------------------------------------------------------------- > Nov 15 09:10:51 casablanca slapd[63235]: conn=863 fd=12 ACCEPT from IP=127.0.0.1:61526 (IP=0.0.0.0:389) > Nov 15 09:10:51 casablanca slapd[63235]: conn=863 op=0 BIND dn="cn=root,dc=dgb,dc=local" method=128 > Nov 15 09:10:51 casablanca slapd[63235]: conn=863 op=0 BIND dn="cn=root,dc=dgb,dc=local" mech=SIMPLE ssf=0 > Nov 15 09:10:51 casablanca slapd[63235]: conn=863 op=0 RESULT tag=97 err=0 text= > Nov 15 09:10:51 casablanca slapd[63235]: conn=863 op=1 ADD dn="uid=bbb1,ou=users,dc=dgb,dc=local" > Nov 15 09:10:51 casablanca slapd[63235]: conn=863 op=1 RESULT tag=105 err=10 text= > Nov 15 09:10:51 casablanca slapd[63235]: conn=863 op=2 UNBIND > Nov 15 09:10:51 casablanca slapd[63235]: conn=863 fd=12 closed > --------------------------------------------------------------------------- > And from master side i look tcmpdump and not received any > packets. > This is native ldapadd. :( > This question has been asked (and answered!) so many times... OpenLDAP tools solve the problem of authenticated referral chasing by delegating it to the user. They simply return a referral and don't even try to chase it anonymously (as supposed to be useless for writes) nor by propagating credentials to the referred DSA (it would be a very poor decision, as the client has no means to determine whether the referred DSA is trusted or not; or, whenever distributed authentication is implemented, it is very likely that the referred DSA has no means to authenticate an otherwise valid user for the initially contacted DSA. > > When i try use smbldap-useradd i got: > ------------------------client message------------------------------------- > smbldap-useradd bbb2 > Error: Referral received at /usr/local/lib/perl5/site_perl/5.8.8/smbldap_tools.pm line 1056 > ---------------------------------------------------------------------------- > > --------------------------server message------------------------------------ > Nov 15 09:40:24 casablanca slapd[63235]: conn=885 fd=21 ACCEPT from IP=127.0.0.1:50523 (IP=0.0.0.0:389) > Nov 15 09:40:24 casablanca slapd[63235]: conn=885 op=0 BIND dn="cn=root,dc=dgb,dc=local" method=128 > Nov 15 09:40:24 casablanca slapd[63235]: conn=885 op=0 BIND dn="cn=root,dc=dgb,dc=local" mech=SIMPLE ssf=0 > Nov 15 09:40:24 casablanca slapd[63235]: conn=885 op=0 RESULT tag=97 err=0 text= > Nov 15 09:40:24 casablanca slapd[63235]: conn=885 op=1 SRCH base="dc=dgb,dc=local" scope=2 deref=2 filter="(&(objectClass=posixAccount)(uid=bbb2))" > Nov 15 09:40:24 casablanca slapd[63235]: conn=885 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= > Nov 15 09:40:24 casablanca slapd[63235]: conn=885 op=2 SRCH base="sambaDomainName=dgb,dc=dgb,dc=local" scope=0 deref=2 filter="(objectClass=sambaUnixIdPool)" > Nov 15 09:40:24 casablanca slapd[63235]: conn=885 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= > Nov 15 09:40:24 casablanca slapd[63235]: conn=885 op=3 MOD dn="sambaDomainName=dgb,dc=dgb,dc=local" > Nov 15 09:40:24 casablanca slapd[63235]: conn=885 op=3 MOD attr=uidNumber > Nov 15 09:40:24 casablanca slapd[63235]: conn=885 op=3 RESULT tag=103 err=10 text= > Nov 15 09:40:24 casablanca slapd[63235]: conn=885 fd=21 closed (connection lost) > ------------------------------------------------------------------------------ > > And again any packets on master side. > > I should solve a problem of synchronization of passwords > for samba from slave to master LDAP. > And not find the decision. :( > > Help me please.... :) > Where i am mistaken? > > I think OpenLDAP has little to do with smbldap-useradd; however, it looks like that that tool is working as expected, since it behaves the same as ldapadd... p.

2 1

several replication questions (2nd try)
by Sepp 14 Nov '06

14 Nov '06

Hello, here is our three-level concept for replication, 1 provider, 2 subproviders, 10 consumers: * the provider should replicate most of his subtrees to both subproviders * a few subtrees should be replicated from the 2 subproviders to the provider * subprovider no1 should replicate his whole tree to 5 consumers * subprovider no2 should replicate his whole tree to the other 5 consumers * a few user entries (eg. the replication manager) should be replicated from subprovider no.1 to subprovider no.2, and from 1 consumer to the other 9 comsumers Here are the questions concerning this config: 1.) Is the best (and perhaps only ?) way for an implementation to devide the DITs in subordinate databases with the according syncrepl statements (similar to openldap-2.3.28/tests/data/slapd-glue-syncrepl*.conf, we have a successful test config for that) 2.) Do we need the glue overlay in this context (I don't think so) ? 3.) Is it necessary that one subordinate have all indexes from all other subordinates (I do think so, to prevent "index_param failed" error messages when searching from top level) 4.) Sorry, when that's a FAQ: Is it a must that the updatedn is not the same like the rootdn or is it only a recommendation ? Is this for security reasons or why ? 5.) With slurpd it is possible to replicate more than one subtrees from one database with several "suffix"-statements. How can I do that with syncrepl ? I didn't find a way to define more than one "searchbase" per "syncrepl rid" or to define more than one "syncrepl rid" per "database". I thank you for help in advance ! Regards Sepp

2 3

Problem with replica. (SLURP).
by Paul Shevtsov 14 Nov '06

14 Nov '06

I have 3 ldap server's. One master and two slave. From master to one slave replica passes successeful, but to another slave replica not pass. Config slapd on both slave the same, but version openldap different. (2.3.19 and 2.3.27). Version master openldap - 2.3.11. Problem with version? P.S. During replica i have next error message: "ERROR: Constraint violation: entryCNS: no user modification allowed" -- Paul Shevtsov <> 380-62-3327312 <Dongorbank> <> paul(a)dongorbank.com

2 5

Re: syncrepl & OpenLDAP 2.3.27 & Backend Issue
by Howard Chu 13 Nov '06

13 Nov '06

Doug Goldstein wrote: > Howard Chu wrote: >> The examples in the Admin Guide are just that - examples. The doc states >> that it will work with any backend type, and uses a different backend >> type merely to illustrate that the backend type on the consumer does not >> need to agree with the type on the producer. > > The Admin Guide says that only hdb and bdb will work due to the indexing > and other data needs. It says no such thing: 15.3.2. Set up the consumer slapd The syncrepl replication is specified in the database section of slapd.conf (5) for the replica context. The syncrepl engine is backend independent and the directive can be defined with any database type. > The example it gives is a master with "bdb" and > the consumers with "hdb" and my issue is that the example provided does > not work as such. The example works perfectly well for me. There is no way that just changing the database type would affect it. You must have changed something else as well. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc OpenLDAP Core Team http://www.openldap.org/project/

2 1

cross compiling client tools
by Robert Carter 13 Nov '06

13 Nov '06

Hi list, I wish to use the openldap client tools in an embedded environment where I cross compile openldap package against uclibc. These are tools such as ldapsearch, ldapdelete. Because I don't need any of the server software i'm using a configure line like this: ./configure \ --target=$(GNU_TARGET_NAME) \ --host=$(GNU_TARGET_NAME) \ --build=$(GNU_HOST_NAME) \ --prefix=/ \ --with-tls \ --disable-slapd \ --disable-slurpd \ --without-yielding-select \ --without-rewrite \ --without-overlays \ --with-gnu-ld make depend make CC=$(TARGET_CC) -C $(OPENLDAP_DIR) Assume that the GNU_ type variables have reasonable values. The complilation proceeds normally, util the linking phase. At this point libtool fails with: /bin/sh ../..//libtool --mode=link /home/imageuser/buildroot/buildroot/trunk/build_i686/staging_dir/bin/i686-linux-uclibc-gcc -static -Os -pipe -o rewrite rewrite.o parse.o librewrite.a ../../libraries/liblutil/liblutil.a ../../libraries/libldap_r/libldap_r.la ../../libraries/liblber/liblber.la -lssl -lcrypto -pthread /home/imageuser/buildroot/buildroot/trunk/build_i686/staging_dir/bin/i686-linux-uclibc-gcc -Os -pipe -o rewrite rewrite.o parse.o -pthread librewrite.a ../../libraries/liblutil/liblutil.a ../../libraries/libldap_r/.libs/libldap_r.a /home/imageuser/buildroot/buildroot/trunk/build_i686/openldap-2.3.28/libraries/liblber/.libs/liblber.a ../../libraries/liblber/.libs/liblber.a -lssl -lcrypto -pthread ../../libraries/libldap_r/.libs/libldap_r.a(tls.o): In function `ldap_pvt_tls_check_hostname': tls.c:(.text+0x9ca): undefined reference to `lutil_memcmp' collect2: ld returned 1 exit status Can anyone throw any light on this problem? Rob

1 0

syncrepl & OpenLDAP 2.3.27 & Backend Issue
by Doug Goldstein 13 Nov '06

13 Nov '06

I have been attempting to setup OpenLDAP for the past couple of days with syncrepl and have been able to get it to work. The configs work resolve find with "slaptest -d config" and the master would work but the consumers would never have any data in them. After spending some time and reconfiguring a bunch of times with the help of the guys in #ldap on Freenode. I switched by consumers from "hdb" to "bdb" and it just started to work. My master had always been "bdb". No idea why this happens like this but the guys from #ldap told me to e-mail this info out. I was just following the guide from OpenLDAP Administrator's Guide which said to set it up with bdb on the master and hdb on the consumers. If anyone wants any more info to track this down let me know and I'll provide it. -- Doug Goldstein cardoe(a)gentoo.org

2 1

hdb stops checkpointing....
by johan.jonemo＠hep.lu.se 13 Nov '06

13 Nov '06

I try to modify a hdb periodically (often). After a while the underlying database seems to be swamped down. If I look in the directory log files are piling up. I run db_archive periodically to clean up the log files and I also run db_deadlock in parallel. I do not run db_checkpoint as this as far as I understand is done by the backend. Strangely the problem seems to start after about 2 h if I start from a clean database. When I try to lower the frequency of the updates it still seems to happen after 2 h. I use openLDAP v2.3.24 with Sleepycat Software: Berkeley DB 4.4.20 Johan Jönemo

3 3

LDAP+TLS
by Net Warrior 13 Nov '06

13 Nov '06

Hi there guys. Well, I'm making some progress securing my ldap server by reading the list and the oficial how-to, but I'm facing a new problem. So, I've created the certificates using this link. http://www.openldap.org/faq/index.cgi?_highlightWords=self%20signed&file=185 Then in my slapd.conf I've got. (server side ) #security ssf=128 update_ssf=128 simple_bind=128 #TLSCipherSuite HIGH:MEDIUM:+SSLv3:+SSLv2:+RSA:+TLSv1 security ssf=1 update_ssf=112 simple_bind=64 TLSCipherSuite HIGH:MEDIUM:+SSLv3 TLSCACertificateFile /etc/ssl/cacert.pem TLSCertificateFile /etc/ssl/servercrt.pem TLSCertificateKeyFile /etc/ssl/serverkey.pem TLSVerifyClient never ldap.conf (server side ) /etc/openldap/ldap.conf BASE dc=netwarrior,dc=com URI ldaps://linux:636 HOST linux:636 #BINDDN dc=netwarrior,dc=netwarrior #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never TLS_CACERT /etc/ssl/cacert.pem TLS_REQCERT never With this configuration everything seems to work fine, but now, what I want to do is to force my clients to use a certificate to connect, so, if I did not misundestrand it wrong, the demand options is a must. So, when I change TLSVerifyClient never to demand. I've get the following ( alway on my server ) linux:/etc/ssl # openssl s_client -connect localhost:636 -state -showcerts -CAfile cacert.pem CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv2/v3 write client hello A SSL_connect:SSLv3 read server hello A depth=1 /C=AU/ST=Some State/L=City/O=Internet Widgits Pty Ltd/OU=Section/CN=localhost/emailAddress= test(a)company.com verify return:1 depth=0 /C=AU/ST=Some Even State/L=City/O=Internet Widgits Pty Ltd/OU=Section/CN=localhost/emailAddress=test(a)company.com verify return:1 SSL_connect:SSLv3 read server certificate A SSL_connect:SSLv3 read server certificate request A SSL_connect:SSLv3 read server done A SSL_connect:SSLv3 write client certificate A SSL_connect:SSLv3 write client key exchange A SSL_connect:SSLv3 write change cipher spec A SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data SSL3 alert read:fatal:handshake failure SSL_connect:failed in SSLv3 read finished A 6274:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1052:SSL alert number 40 6274:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:226: Making some searches in the mailing list I found a guy who had the same problem, and he was told that with the demand option we force slapd to ask for a client certificate, and that the client certificate is a must. Well, now, I do not get it, cuz I'm authenticating against myself, with teh certificates I generated before, maybe ai have to generate a separate pair of certificates, do not know. With never, and always it works as suggested by someone in the list, who said that first we need try a lower option (never, allow ) to test if the server works ) my problem is with the demand option. What am I mising here? Sorry for my stupidity, I do not get it yet. Thanks in advance and or your valuable time. Greets.

2 2

slapo-accesslog configuration puzzle
by 王鹏辉 13 Nov '06

13 Nov '06

Hello, list. I have enabled accesslog feature in my openldap server 2.3.27 in a gentoo box. During the configuration, i found something unclearly to me. I found that if the accesslog database definiation section located in any place except the first one in the slapd.conf file. When i want to start the openldap deamon. the follow error will come out: Nov 13 10:10:13 (none) slapd[2141]: @(#) $OpenLDAP: slapd 2.3.27 (Sep 20 2006 17:09:57) $ ^Iroot@monster:/tmp/buildd/openldap2.3-2.3 .27/debian/build/servers/slapd Nov 13 10:10:13 (none) slapd[2142]: backend_startup_one: bi_db_open failed! (32768) Nov 13 10:10:13 (none) slapd[2142]: slapd stopped. Nov 13 10:10:13 (none) slapd[2142]: connections_destroy: nothing to destroy. If i put the accesslog database definiation section is the first database section, the openldap daemon could start correctly. Does some one know the details of this condition? Every response is appreciated. Wang Penghui -- Wang Penghui +86 592 8389 650

1 0

Lock table is out of available locks
by vadim 12 Nov '06

12 Nov '06

Hi all, I have tried to add some entries to OpenLDAP server 2.3.29. Everything crashes with following error message: bdb(o=bla): Lock table is out of available locks => bdb_idl_insert_key: c_get failed: Not enough space(12) Do you know what am I doing wrong? thanx a lot and best regards, vadim tarassov

3 2

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software November 2006