openldap-software January 2007

openldap-software@openldap.org

98 participants
123 discussions

Re: sessionlog vs syncprov_sessionlog / missing delete phase
by Daniel Eckstein 26 Jan '07

26 Jan '07

Forgot to mention: its syncrepl synchronisation which is running over here... Diane Corcelle schrieb: > Check out if you have slurpd running on the master ldap server :3 > it is supposed to propagate the deletion > > 2007/1/26, Daniel Eckstein <de(a)it-eckstein.de > <mailto:de@it-eckstein.de>>: > > Dear listmember, > > I have a openldap setup consisting of 1 master (read/write) and 4 > replica, with around 370.000 entries, > ~200 reads/s at the replica and ~5 modifications/s on master. > > Replication is just working fine in terms of adding, modify > entries, but > not, when it comes to deletion of > entries. > > If I delete an entry at the master, the deletion seems not to be > synchronised to the replica. All the replica > do have the very same count of objects, but they differ to the masters > object count (master have less, because > deletions work there...) > > What I have found so far is that I only have syncprov_sessionlog > configured and the manual page is talking > about sessionlog too. Which directive should I use on the syncprov > master? > > Is there a problem with the delete phase? What else could I check? > > Thanks alot in advance! > > Best regards, > Daniel > >

1 0

How to force SSL (not STARTTLS) using environment variables in OpenLDAP 2.3.x
by Björn Wiberg 26 Jan '07

26 Jan '07

Hi! I'm wondering how one can force the usage of SSL (not STARTTLS) through environment variables for OpenLDAP 2.3.x? This is for a client application (FTP daemon run on a per-connection basis) which does not accept LDAP URIs in its configuration, and an LDAP server which does not support STARTTLS. In 2.1.x, one could set LDAPTLS and LDAPTLS_CACERT to get this working. An example using ldapsearch: ---8<--- root@spinus:/usr/local/src/openldap-2.1.29/clients/tools# LDAPTLS=hard LDAPTLS_CACERT=/hotel/apache/etc/ssl/certs/pcacert.pem ldapsearch -h ldapauth1.uu.se -p 636 -s sub -b ou=webUpdate-W2,ou=userRoleData,dc=uu,dc=se -D cn=root -w SECRET -x -v -d 10 -L -L uid=bwiberg_hotel sn ldap_init( ldapauth1.uu.se, 636 ) request 1 done filter: uid=bwiberg_hotel requesting: sn version: 1 dn: uid=bwiberg_hotel,ou=webUpdate-W2,ou=userRoleData,dc=uu,dc=se sn: Wiberg request 2 done root@spinus:/usr/local/src/openldap-2.1.29/clients/tools# --->8--- ...and if one did not set either one of those, one got: ---8<--- root@spinus:/usr/local/src/openldap-2.1.29/clients/tools# LDAPTLS_CACERT=/hotel/apache/etc/ssl/certs/pcacert.pem ldapsearch -h ldapauth1.uu.se -p 636 -s sub -b ou=webUpdate-W2,ou=userRoleData,dc=uu,dc=se -D cn=root -w SECRET -x -v -d 10 -L -L uid=bwiberg_hotel sn ldap_init( ldapauth1.uu.se, 636 ) ldap_bind: Local error (82) root@spinus:/usr/local/src/openldap-2.1.29/clients/tools# LDAPTLS=hard ldapsearch -h ldapauth1.uu.se -p 636 -s sub -b ou=webUpdate-W2,ou=userRoleData,dc=uu,dc=se -D cn=root -w SECRET -x -v -d 10 -L -L uid=bwiberg_hotel sn ldap_init( ldapauth1.uu.se, 636 ) TLS certificate verification: Error, self signed certificate in certificate chain TLS: can't connect. ldap_bind: Can't contact LDAP server (81) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed --->8--- However, OpenLDAP 2.3.32 does not recognize LDAPTLS=hard any longer: ---8<--- root@spinus:/usr/local/src/openldap-2.3.32/clients/tools# LDAPTLS=hard LDAPTLS_CACERT=/hotel/apache/etc/ssl/certs/pcacert.pem ./ldapsearch -h ldapauth1.uu.se -p 636 -s sub -b ou=webUpdate-W2,ou=userRoleData,dc=uu,dc=se -D cn=root -w SECRET -x -v -d 10 -L -L uid=bwiberg_hotel sn ldap_initialize( ldap://ldapauth1.uu.se:636 ) (hexdump cut out) ldap_read: want=8, got=5 0000: 80 03 00 00 01 ..... ldap_result: Local error (-2) --->8--- Setting LDAPTLS_REQCERT=hard + LDAPTLS_CACERT, or even LDAPTLS=hard + LDAPTLS_REQCERT=hard + LDAPTLS_CACERT, gives the same error. That is, LDAPTLS_REQCERT=hard does not force SSL as LDAPTLS=hard once did. Setting LDAPURI="ldaps://ldapauth1.uu.se:636/", not specifying a host name and port number (-h, -p), and optionally skipping LDAPTLS or LDAPTLS_REQCERT, works: ---8<--- root@spinus:/usr/local/src/openldap-2.1.29/clients/tools# LDAPURI="ldaps://ldapauth1.uu.se:636/" LDAPTLS_CACERT=/hotel/apache/etc/ssl/certs/pcacert.pem ./ldapsearch -s sub -b ou=webUpdate-W2,ou=userRoleData,dc=uu,dc=se -D cn=root -w SECRET -x -v -d 20 -L -L uid=bwiberg_hotel sn ldap_initialize( <DEFAULT> ) request 1 done filter: uid=bwiberg_hotel requesting: sn version: 1 dn: uid=bwiberg_hotel,ou=webUpdate-W2,ou=userRoleData,dc=uu,dc=se sn: Wiberg request 2 done root@spinus:/usr/local/src/openldap-2.3.32/clients/tools# LDAPURI="ldaps://ldapauth1.uu.se:636/" LDAPTLS_CACERT=/hotel/apache/etc/ssl/certs/pcacert.pem ./ldapsearch -s sub -b ou=webUpdate-W2,ou=userRoleData,dc=uu,dc=se -D cn=root -w SECRET -x -v -L -L uid=bwiberg_hotel sn ldap_initialize( <DEFAULT> ) filter: uid=bwiberg_hotel requesting: sn version: 1 dn: uid=bwiberg_hotel,ou=webUpdate-W2,ou=userRoleData,dc=uu,dc=se sn: Wiberg --->8--- ...but as soon as one adds -h and -p, ldapsearch and/or libldap ignores LDAPURI and tries ldap:// instead of ldaps://. This is true both for 2.1.29 and 2.3.32: ---8<--- root@spinus:/usr/local/src/openldap-2.1.29/clients/tools# LDAPURI="ldaps://ldapauth1.uu.se:636/" LDAPTLS_CACERT=/hotel/apache/etc/ssl/certs/pcacert.pem ./ldapsearch -h ldapauth1.uu.se -p 636 -s sub -b ou=webUpdate-W2,ou=userRoleData,dc=uu,dc=se -D cn=root -w SECRET -x -v -d 20 -L -L uid=bwiberg_hotel sn ldap_init( ldapauth1.uu.se, 636 ) ldap_bind: Local error (82) root@spinus:/usr/local/src/openldap-2.3.32/clients/tools# LDAPURI="ldaps://ldapauth1.uu.se:636/" LDAPTLS_CACERT=/hotel/apache/etc/ssl/certs/pcacert.pem ./ldapsearch -s sub -h ldapauth1.uu.se -p 636 -b ou=webUpdate-W2,ou=userRoleData,dc=uu,dc=se -D cn=root -w SECRET -x -v -L -L uid=bwiberg_hotel sn ldap_initialize( ldap://ldapauth1.uu.se:636 ) ldap_result: Local error (-2) --->8--- ...so "overriding" the specified hostname and port with a URI through environment variables seems impossible. Could anyone give some piece of advice on how to force SSL as in the older versions, i.e. without LDAPURI or its -H ldapsearch counterpart? As, sadly, my client application will always suggest a hostname and port number to connect to, in its calls to libldap, and does not have the ability to accept LDAP URIs in its configuration. The earlier environment variable solution was an easy work-around, and I would have hoped that this possibility would stay in future (> 2.1) versions... Many thanks in advance! Best regards, Björn Wiberg Uppsala University IT Support Department

1 0

database relay
by Douglas B. Jones 26 Jan '07

26 Jan '07

I am working on openldap-2.3.33 and have compiled it on RHEL4 with the following: --enable-crypt \ --enable-cleartext \ --enable-debug \ --enable-meta=yes \ --enable-monitor=yes \ --enable-relay=yes \ --enable-ldap=yes \ --enable-rewrite=yes \ --enable-overlays=yes (I have prefix, exec-prefix and BerkleyDB 4.5.20 NC in there also). My config file uses bdb and I have several of those in there. After all those, I have the monitor database then: database relay suffix "dc=old,dc=us" relay "dc=new,dc=gpc,dc=edu' When I start the server up, I get: Jan 25 19:31:54 mldap slapd[14401]: @(#) $OpenLDAP: slapd 2.3.33 (Jan 25 2007 18 :43:37) $ root@mldap.gpc.edu:/var/lib/ldap/src/openldap-2.3.33/servers/sla pd Jan 25 19:31:54 mldap slapd[14402]: WARNING: No dynamic config support for datab ase relay. Jan 25 19:31:54 mldap slapd[14402]: WARNING: No dynamic config support for overl ay rwm. Jan 25 19:31:54 mldap slapd[14402]: WARNING: The converted cn=config directory is incomplete and may not work. Jan 25 19:31:54 mldap slapd[14402]: slapd starting Where should I be looking concerning these error messages. I hope the info. I gave is enough, if not, please let me know what else I can include. Thanks!

2 2

Openldap on z/OS with XPLINK
by Juergen Weber 25 Jan '07

25 Jan '07

Hi, using the info from http://www.openldap.org/faq/data/cache/719.html I almost got OpenLDAP-2.3.33 to run on z/OS 1.7 with XPLINK and ASCII options. I used this compiler script acc: exec /bin/c89 -Wc,LANGLVL$EXTENDED$ -Wc,XPLINK,ASCII -Wl,XPLINK -D_XOPEN_SOURCE_EXTENDED=1 -D_OPEN_THREADS -D_OPEN_SYS_SOCK_IPV6 -D_ISOC99_SOURCE $* I got the server and tools to compile and link (z/OS 1.7). ldapsearch works against IBM's z/OS LDAP server. The openldap server starts, says it is listening, the bind address is OK (I added some more debug output), but the socket is closed and cannot be connected to. Have you ever seen this? Actually in daemon.c there seems to be no listen() call, so I wonder if the listen() call fails, I'll have to check tomorrow. Another source of problems might be that not all headers are included, e.g. daemon.c uses inet_ntop() which requires arpa/inet.h but is not included. I think the ASCII library functions versions are only pulled in if the header is included, so some magic preprocessor tricks that select ascii versions can trigger. #define _OPEN_SYS_SOCK_IPV6 #include <arpa/inet.h> const char *inet_ntop(int af, const void *src, char *dst, socklen_t size); Thanks very much, Juergen $ libexec/slapd -d 1 -h ldap://sh90:6989 @(#) $OpenLDAP: slapd 2.3.33 (Jan 25 2007 13:43:07) $ juergen@sh90:/u/entwicklung2/openldap-2.3.33/servers/slapd daemon_init: listen on ldap://sh90:6989 daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap://sh90:6989) daemon: getaddrinfo input host (sh90) output :s daemon: inet_ntop result: 192.168.0.153 daemon: l.sl_name.bv_val: IP=192.168.0.153:6989 daemon: listener initialized ldap://sh90:6989 daemon_init: 1 listeners opened slapd init: initiated server. $ netstat -s | grep 69 Stream 192.168.0.153..6989 0.0.0.0..0 Closed 00001513

2 1

ACL Question
by Alex Samad 25 Jan '07

25 Jan '07

Hi How do I write and acl to say something like access to someobject by this dn but only from this ip can that be done. do I have to use continue and write my access stuff as +rwd, but how do I make it an and of both statements ? alex

2 1

Using ldapi: and ldap:
by Johan Jönemo 25 Jan '07

25 Jan '07

I'm trying to get slapd to listen to a unix domain socket as well as TCP. Shouldn't this be possible? When I use: -h 'ldapi://%2Fusr%2Flocal%2Flis%2Fvar%2Frun%2Fldapi/????x-mod=0777' it listens to the correct socket. The same goes for the ldap:/// uri. When I use both, however, slapd just listens to the unix domain socket. I.e. I write: -h 'ldapi://%2Fusr%2Flocal%2Flis%2Fvar%2Frun%2Fldapi/????x-mod=0777' ldap:/// and doing netstat -anp (on linux) only gives the unix domain socket. I use OpenLDAP 2.3.24 Johan Jönemo

2 1

problem with set ACL
by Emmanuel Dreyfus 25 Jan '07

25 Jan '07

Hello I have a problem with the set keyword in ACL. Here is the setup. My directory has objects in two classes: persons and addresses A person look like this: dn: cn=jdoe,ou=sales,dc=example,dc=net cn: jdoe rfc822Mailbox: John.Doe(a)example.net An address look like this: dn: netExampleMail=John.Doe(a)example.net,dc=example,dc=net netExampleMail: John.Doe(a)example.net netExampleEnable: TRUE Now I want to give a user the right to modify the netExampleEnable attribute for an address if his rfc822Mailbox matches the netExampleMail of the address. After banging my head on the documentation for one day, I came to the conclusion that I had to use the set keyword. Here is what I tried: access to dn.regex="netExampleMail=([^,]+),dc=example,dc=net" by set.expand=[ldap://localhost/dc=example,dc=net?dn?sub?rfc822Mailbox=$1] write by * read The access is always granted, whatever address entry an user attempt to modify. Worse: the URI dereferencing is ignored: replacing the LDAP host by an IP address that has no LDAP service cause no error. Running tcpdump shows that no attempt was made to connect to the LDAP service. Here is the log output: => acl_mask: access to entry "netExampleMail=Random.User(a)example.net,dc=example,dc=net", attr "netExampleEnable" requested => acl_mask: to all values by "cn=jdoe,ou=sales,dc=example,dc=net", (=0) <= check a_set_pat: [ldap://example.net/dc=example,dc=net?dn?sub?rfc822mailbox=$1] <= acl_mask: [1] applying write(=wrscxd) (stop) <= acl_mask: [1] mask: write(=wrscxd) => access_allowed: delete access granted by write(=wrscxd) -- Emmanuel Dreyfus manu(a)netbsd.org

2 1

slow shutdowns
by matthew sporleder 25 Jan '07

25 Jan '07

I'm running a pretty large slapd 2.3.23 (3G-5G or so) and shutdown is taking anywhere from twenty minutes to an hour. (I'm still waiting for a shutdown and hoping for an hour) I was just wondering what exactly was happening. I suspect that it's something in bdb_db_close(), but I'm not sure what's really going on since truss is just sitting around and prstat reports the pid in sleep. My guess is that it's walking the entire cache and free-ing it, but I would expect the memory to change or the truss to return free's in that case. Any ideas? My last log messages are: daemon: shutdown requested and initiated. slapd shutdown: waiting for 0 threads to terminate Thanks, _Matt

4 5

overlay syncprov not found (which slapd version do I need?)
by Iñaki 24 Jan '07

24 Jan '07

Hi, using Debian Sarge (slapd 2.2.23-8) and Ubuntu Edgy (slapd 2.2.26-5). I'm trying to use "Syncrepl" for replication, but I get: syncprov not found (error) (using Debian or Ubuntu as master). There are no a "syncrep" called module in /usr/lib/ldap/modules so I thing that I need a newer sladp version including Syncrepl, is it? I read in the Roadmap: OpenLDAP 2.3 (released June 2005) ... Sync Provider Overlay ... but as client, if I configure my Debian Sarge (or Ubuntu) slapd as consumer: syncrepl rid=123 provider=ldap://192.168.1.100:389 ... I get no error starting it. I get: do_syncrep1: ldap_bind_s failed (-1) so I assume that this 2.2.X slapd version includes "syncrep" as consumer but nos as a master, is it? Thanks for any explanation. Regards. -- Iñaki Baz Castillo

2 3

Bug(?) With OpenLDAP 2.3.32
by daniel＠ncsu.edu 24 Jan '07

24 Jan '07

Hi folk! We upgraded to OpenLDAP 2.3.32 recently and I ran into something that, unless I have completely lost my mind, should not be occuring: /local/ldap/data # /local/ldap/bin/ldapmodify -x -h localhost -D "cn=ldapadmin,dc=ncsu,dc=edu" -w LDAPADMINPASSWORD dn: uid=STUDENTUSERNAME,ou=students,ou=people,dc=ncsu,dc=edu changetype: modify replace: ou ou: B A - Physics ou: B S - Philosophy - replace: ncsucurriculumcode ncsucurriculumcode: PYA ncsucurriculumcode: LSL modifying entry "uid=STUDENTUSERNAME,ou=students,ou=people,dc=ncsu,dc=edu" ldap_modify: Type or value exists (20) additional info: modify/replace: ou: value #1 already exists Obviously I replaced the user's username and my ldap admin password. ;D A replace should literally be replacing the ou and ignoring what it's currently set to, correct? And since those two ou's are not the same, it should be fine? What's even more bizarre is that I didn't run into this while populating the database in the first place. Is this, perchance, fixed in 2.3.33? Thanks! Daniel

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software January 2007