October 2007 - openldap-software

Support of LDAP assertions in openLDAP backends

by Antonio Alonso

Hi ! We are interested in deploying an openLDAP-based directory supporting the assertions control extension as defined in RFC 4528. According to http://www.openldap.org/faq/data/cache/645.html (list of LDAPv3 features/extensions supported by the OpenLDAP server) openLDAP 2.3 already supports the assertion contol (we only need to use it in the LDAPModify operation) but I am not sure about the backends taking care of it (back-ndb and/or back-ldbm would be ok for us). Could any of you provide us this info? I was checking the mail archives, but I did not find the answer .... Thanks in advance Best regards / Antonio > Antonio Alonso Alarcón CUDB System Engineer > Ericsson España, S.A. Phone: +34 91339 3085 Via de los Poblados 13 Mobile: +34 609640579 (66215) 28033 Madrid, Spain Fax: +34 91339 1636 E-mail: Antonio.Alonso(a)ericsson.com

15 years, 7 months

5
7
0 / 0

syncrepl with empty database fails

by Dieter Kluenter

Hi, I am testing HEAD and try to sync a consumer with an empty database but this fails, it seems that the root entry should be deleted bdb_dn2entry("o=avci,c=de") => access_allowed: delete access to "o=avci,c=de" "entry" requested <= root access granted => access_allowed: delete access granted by manage(=mwrscxd) <=- bdb_delete: non-leaf o=avci,c=de send_ldap_result: conn=-1 op=0 p=3 send_ldap_result: err=66 matched="" text="subordinate objects must be deleted first" syncrepl_del_nonpresent: rid=003 be_delete o=avci,c=de (66) bdb_modify: o=avci,c=de bdb_dn2entry("o=avci,c=de") bdb_modify_internal: 0x00000002: o=avci,c=de <= acl_access_allowed: granted to database root bdb_modify_internal: replace objectClass slapd: mods.c:64: modify_add_values: Assertion `mod->sm_numvals == i' failed. Abgebrochen database bdb suffix "o=avci,c=de" rootdn "cn=admin,o=avci,c=de" rootpw checkpoint 1024 5 cachesize 2000 idlcachesize 6000 directory /tmp/slapd2 index objectClass eq index default pres,eq index mail,telephoneNumber index cn,sn,uid eq,sub index entryUUID,entryCSN eq syncrepl rid=03 provider="ldap://localhost:9007" binddn="cn=replicator,o=avci,c=de" bindmethod=simple credentials=replicator searchbase="o=avci,c=de" scope=sub type=refreshAndPersist retry="5 5 300 5" logbase="cn=log" syncdata=accesslog -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6

15 years, 7 months

2
1
0 / 0

Re: Support of LDAP assertions in openLDAP backends

by Howard Chu

Kari Mattsson wrote: > Howard Chu wrote: >> Michael Ströder wrote: >>> Howard Chu wrote: >>>> No. Assertion is only supported by back-bdb and back-sql. >>> And what about back-hdb? >> Of course, back-hdb too. Aside from subtree rename (which back-hdb >> supports and back-bdb does not) the two backends are functionally >> identical; I've gotten tired of writing "back-bdb/back-hdb" all the time. > > How about regex to shorten it? ;-) Heh. Is that "back-[bh]db" or "back-(b|h)db" ? -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

15 years, 7 months

1
0
0 / 0

RE: Export/Import LDAP database with passwords

by Srilakshmanan, Kumuthiny

Hi, Try to log in as a root dn and export the data , you will find that passwords will be in the exported ldif file. Regards, Kumuthiny -----Original Message----- From: openldap-software-bounces+kumuthiny.srilakshmanan=auspost.com.au(a)OpenLDAP.or g [mailto:openldap-software-bounces+kumuthiny.srilakshmanan=auspost.com.au@Ope nLDAP.org] On Behalf Of Gilles Schlienger Sent: Friday, 19 October 2007 6:38 PM To: openldap-software(a)openldap.org Subject: Export/Import LDAP database with passwords Hi, I would like to export an existing Openldap database on a local new Openldap install? I exported the data in an LDIF file, but it does not contain the passwords What are my options ? 1. Can I export data with passwords ? 2. Can I set default passwords to all my person objects with a script ? 3. Other option ? Thanks a lot in advance ! Regards Gilles ____________________________________________________________________________ _ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail Australia Post is committed to providing our customers with excellent service. If we can assist you in any way please telephone 13 13 18 or visit our website. The information contained in this e-mail communication may be proprietary, confidential or legally professionally privileged. It is intended exclusively for the individual or entity to which it is addressed. You should only read, disclose, re-transmit, copy, distribute, act in reliance on or commercialise the information if you are authorised to do so. Australia Post does not represent, warrant or guarantee the integrity of this e-mail communication has been maintained nor that the communication is free of errors, virus or interference. If you are not the addressee or intended recipient please notify us by replying direct to the sender and then destroy any electronic or paper copy of this message. Any views expressed in this e-mail communication are taken to be those of the individual sender, except where the sender specifically attributes those views to Australia Post and is authorised to do so.

15 years, 7 months

1
0
0 / 0

Re: syntax

by Richard smith

My slapd.conf file contains the following includes: include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

15 years, 7 months

2
1
0 / 0

strange issue with pwdAccountLockedTime

by Guillaume Rousse

The following ldif fragment: dn: uid=melancon,ou=saclay,ou=futurs,ou=users,dc=futurs,dc=inria,dc=fr changetype: modify replace: userpassword userpassword: XXXXX - replace: gidnumber gidnumber: 5050 - replace: homedirectory homedirectory: /home/gravite/melancon - delete: pwdAccountLockedTime causes the server to choke with error: ldapmodify: No such attribute (16) additional info: modify/delete: pwdAccountLockedTime: no such attribute However, when removing other changes, and keeping only pwdAccountLockedTime deletion, everything works OK.... So, it is an expected behaviour than modificating operational attributes at the same time than normal attributes should fail, or is it a bug ? openldap version is 2.3.27. -- Guillaume Rousse Moyens Informatiques - INRIA Futurs Tel: 01 69 35 69 62

15 years, 7 months

3
4
0 / 0

regarding custom schema

by Arunachalam Parthasarathy

Hello all, I derive an objectClass from organizationalUnit and make it AUXILIARY. I am getting this error Can any one please explain , me why this error comes user-defined ObjectClass has inappropriate SUPerior Thanks in advance, Arunachalam **************************************************************************** **************************** This e-mail and attachments contain confidential information from HUAWEI, which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction, or dissemination) by persons other than the intended recipient's) is prohibited. If you receive this e-mail in error, please notify the sender by phone or email immediately and delete it!

15 years, 7 months

6
7
0 / 0

Structural Object Classes

by ldap

We currently run a ldap server to authenticate our systems. It uses openldap 2.0.27-23 on redhat 3 or earlier. We recently tried to to upgrade the servers to Redhat 4 which uses openldap 2.2.13-7. We were unable to get it to function with the exact setup, configs and database we used in the earlier versions. As I understand it, strict checking was enforced in the later version of openldap and was not in the previous versions. The entries in the ldap directory have the following object classes: top, person, organizationalperson, inetorgperson, posixaccount, shadowaccount, account. Person and Account are both structural classes. I could be off base, but I thought that only one structural class is allowed and since this wasn't enforced in earlier versions it worked. Now since it is enforced it may be at least one of the issues. The main reason the account object class is used is for the host attribute which we use with the ldap.conf "pam_check_host_attr" directive to limit who can log into certain machines. If my assumptions above are correct, are there any suggestions on how to upgrade to the newer version of openldap and get around the above issues? Thanks

15 years, 7 months

3
2
0 / 0

slapo-chain

by manu＠netbsd.org

Hello I have the following setup: ldap0 is the LDAP master ldap1 and ldap2 are replicas using syncrepl. - Users can use simple authentication on the 3 servers. - ldap0 holds a bunch of ACL to handle modifications - ldap1 and ldap2 have minimal ACL and are there just for reading - Mutual authentication between master and replicas is done by TLS certificates. Now I'd like the replicas to follow updatedn referrals on behalf of the client. That way clients could ask ldap1 and ldap2 to perform modifications, and that would just work. As I understand, this is done through slapo-chain. The modification has to be done on behalf of the user that authenticated on the replica (else my ACL will block). I don't want to give replicas an universal write access to the master, because that will mean I'll have to duplicate the ACL between the master and the replicas. For performance and maintainability sake, I want to avoid that. In an ideal world, I'd like replicas to connect to the master using their certificates, and the master would trust the user identity, as it was authenticated on the replica. Is there an example of how this should be done? I had a look to the test suite, and it does not help very much, as I'm not familiar enough with the authz stuff to grasp enough of how it is supposed to work. I tried this on the replica, as global option: overlay chain chain-uri ldaps://ldap0 chain-idassert-bind bindmethod=sasl saslmech=EXTERNAL mode=self But the modification operation is done using the identity from the replica TLS certificate (which fails) and not from the initial user. Any hint? -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

15 years, 7 months

3
9
0 / 0

"OpenLDAP 2.4 Highlights for 2.4" presentation

by Dustin Puryear

Howard- I read through your presentation "OpenLDAP Highlights for 2.4". Very informative, thanks. Now, a few questions: 1. re: "ldapadd performance". Can you briefly explain what exactly was done in "Optimized server and client in 2.4" to bring down the ldapadd time from 1:33:08 to 5:20. That's a huge a difference. 2. re: "The Road Ahead...", you note some useful configuration functionality, including: TLS certs as an LDAP object rather than as a file on disk, loadable modules as LDAP objects, and automatic creation of filesystem directories for DBs. Very cool. I do wonder about putting loadable modules into the directory. First, let me preface this by saying that obviously an administrator needs to ensure that the proper access rights are given out. That said, isn't there a real risk of someone running evil code on the LDAP server by simply having the ability to add a loadable module object in the directory? (Yes, this same admin may be able to just delete entries anyway, but that's different to me than actually being able to run code that can hook into slapd.) What is the driver for this developing this functionality? -- Puryear Information Technology, LLC Baton Rouge, LA * 225-706-8414 http://www.puryear-it.com Author, "Best Practices for Managing Linux and UNIX Servers" http://www.puryear-it.com/pubs/linux-unix-best-practices Identity Management, LDAP, and Linux Integration

15 years, 7 months

2
1
0 / 0

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software October 2007