openldap-software November 2007

openldap-software@openldap.org

73 participants
92 discussions

Invalid DN syntax (34)
by stefek143 16 Nov '07

16 Nov '07

Hello why if i want to add user to base i have error: ldap_add: Invalid DN syntax (34) , i can't find where can be problem :/ , somebody know which mistake i do ? [root@HP openldap]# ldapsearch -x -b dc=aaa,dc=ws,dc=com' # extended LDIF # # LDAPv3 # base <dc=aaa,dc=ws,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # aaa.ws.com dn: dc=aaa,dc=ws,dc=com objectClass: organization objectClass: dcObject o: whatever dc: aaa # stud, aaa.ws.com dn: ou=stud,dc=aaa,dc=ws,dc=com objectClass: organizationalUnit ou: stud description: stud # prac, aaa.ws.com dn: ou=prac,dc=aaa,dc=ws,dc=com objectClass: organizationalUnit ou: prac description: prac # search result search: 2 result: 0 Success # numResponses: 4 # numEntries: 3 **************************** // tester.ldif // dn: cn=test_5,ou=stud,dc=aaa,dc=ws,dc=com" // probably, here is some set incorrenct but for me looks good :P objectclass: radiusprofile radiusTunnelType: VLAN radiusTunnelPrivateGroupId: 21 radiusTunnelMediumType: 6 cn: test_5 **************************** [root@HP openldap]# ldapadd -x -D "dc=aaa,dc=ws,dc=com" -w test -f tester.ldif adding new entry "cn=test_5,ou=stud,dc=aaa,dc=ws,dc=com"" ldap_add: Invalid DN syntax (34) additional info: invalid DN thx for advices

3 2

Inserting ACLs in CN=config
by Christian Marg 16 Nov '07

16 Nov '07

Hello, from reading the AdminGuide and a quick search through the FAQ-o-Matic I couldn't gather how I'd insert a new ACL between the existing rules 2 and 3... Do I have to replace the complete olcAccess-Attribute? Or can I somehow instruct an LDIF - "Modify/Add" to insert the Value in a specific place? If it isn't available now, maybe it could be done with using only even Weights for the rules, and when one adds a rule with an odd weight, it is inserted in the correct place and the remaining entries renumbered accordingly... bye Christian -- Christian Marg mail : mailto:marg@rz.tu-clausthal.de Dezernat 2 TU Clausthal web : http://www.tu-clausthal.de D-38678 Clausthal-Zellerfeld fon : 05323/72-2107 Germany jabber: ifcma(a)jabber.tu-clausthal.de

4 5

syncrepl/sasl problems
by Lawrence Strydom 16 Nov '07

16 Nov '07

Hi List, I need to configure a master and slave ldap server with replication. I am running openSUSE10.2 and openldap2-2.3.27-25. Initially I was using slurpd but syncrepl was recommended to me as being more agreeable with my ldap version. I configured my master and slave according to the instructions from the openldap web site: http://www.openldap.org/doc/admin22/syncrepl.html Here is the slave slapd.conf: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ loglevel 256 TLSCertificateFile /etc/openldap/servercert.pem TLSCACertificateFile /etc/openldap/cacert.pem TLSCertificateKeyFile /etc/openldap/serverkey.pem database bdb suffix "dc=mydomain,dc=com" rootdn "cn=replica,dc=mydomain,dc=com" rootpw "{ssha}mypassword" directory /var/lib/ldap/ checkpoint 1024 5 cachesize 10000 index objectClass,uidNumber,gidNumber eq index member,mail eq,pres index cn,displayname,uid,sn,givenname sub,eq,pres #Entries for replication using sync-repl syncrepl rid=123 provider=ldap://ldap1.mydomain.com type=refreshAndPersist #interval=01:00:00:00 searchbase="dc=mydomain,dc=com" filter="(objectClass=organizationalPerson)" scope=sub attrs="cn,sn,ou,telephoneNumber,title,l" schemachecking=off updatedn="cn=replica,dc=mydomain,dc=com" bindmethod=sasl #saslmech=digest-md5 binddn="cn=Administrator,dc=mydomain,dc=com" credentials="{ssha}mypassword" ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ And here is my master slapd.conf ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ loglevel 256 TLSCertificateFile /etc/openldap/servercert.pem TLSCACertificateFile /etc/openldap/cacert.pem TLSCertificateKeyFile /etc/openldap/serverkey.pem database bdb suffix "dc=mydomain,dc=com" rootdn "cn=Administrator,dc=mydomain,dc=com" rootpw "{ssha}mypassword" directory /var/lib/ldap/ checkpoint 1024 5 cachesize 10000 index objectClass,uidNumber,gidNumber eq index member,mail eq,pres index cn,displayname,uid,sn,givenname sub,eq,pres #Entries for replication using sync-repl sessionlog 999 999 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ OK as you can see I am using bindmethod=sasl because when I was using bindmethod=simple, I got an error code 49 LDAP_INVALID_CREDENTIALS Now as far as I can detirmine from the log below, the connection is made so syncrepl is configured correctly but there is some sort of problem with sasl. It seems that the attribute "supportedSASLMechanisms" is not found on the master. I get the same error If I uncomment the "saslmech=digest-md5" entry. /var/log/messages on the master: +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Nov 14 18:52:28 ldap1 slapd[18695]: conn=35 fd=13 ACCEPT from IP= 192.168.2.246:9243 (IP=0.0.0.0:389) Nov 14 18:52:28 ldap1 slapd[18695]: conn=35 op=0 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" Nov 14 18:52:28 ldap1 slapd[18695]: conn=35 op=0 SRCH attr=supportedSASLMechanisms Nov 14 18:52:28 ldap1 slapd[18695]: conn=35 op=0 SEARCH RESULT tag=101 err=0 nentries=1 text= Nov 14 18:52:28 ldap1 slapd[18695]: conn=35 op=1 UNBIND Nov 14 18:52:28 ldap1 slapd[18695]: conn=35 fd=13 closed +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ and on the slave: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Nov 14 16:13:47 ldap2 slapd[8305]: @(#) $OpenLDAP: slapd 2.3.27 (Nov 25 2006 17:08:16) $ abuild@eisler:/usr/src/packages/BUILD/openldap-2.3.27 /servers/slapd Nov 14 16:14:07 ldap2 slapd[8305]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1: Can't contact LDAP server Nov 14 16:14:07 ldap2 slapd[8305]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1: Can't contact LDAP server Nov 14 16:14:07 ldap2 slapd[8305]: nss_ldap: could not search LDAP server - Server is unavailable Nov 14 16:14:07 ldap2 slapd[8312]: slapd starting Nov 14 16:14:07 ldap2 slapd[8312]: do_syncrep1: ldap_sasl_interactive_bind_s failed (16) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Am I on the right track looking for the errors in sasl, and if so, how do I set the attributes? Thanks in advance Lawrence

4 4

Slurpd problems
by Lawrence Strydom 16 Nov '07

16 Nov '07

Hi List. I have been trying to set up replication between two LDAP servers running OpenSuSE10.2 and Openldap 2-2.3.27-25 but unfortunately I am not having a lot of success :( The master server is called ldap1. This is slapd.conf: +++++++++++++++++++++++++++++++++++++++++++++++++++++++ loglevel -1 TLSCertificateFile /etc/openldap/servercert.pem TLSCACertificateFile /etc/openldap/cacert.pem TLSCertificateKeyFile /etc/openldap/serverkey.pem database bdb suffix "dc=mydomain,dc=com" rootdn "cn=Administrator,dc=mydomain,dc=com" rootpw "{ssha}mypassword" directory /var/lib/ldap/ checkpoint 1024 5 cachesize 10000 index objectClass,uidNumber,gidNumber eq index member,mail eq,pres index cn,displayname,uid,sn,givenname sub,eq,pres #Entries for replication replica uri=ldap://192.168.2.246.1:389 binddn="cn=replica,dc=mydomain,dc=com" bindmethod=simple credentials="{ssha}mypassword" replogfile /var/lib/ldap/slurpd.replog +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ As you can see the loglevel is set to -1 as I have been trying to troubleshoot this for the last two days... The slave server is ldap2 and here is slapd.conf: +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ loglevel -1 database bdb suffix "dc=mydomain,dc=com" rootdn "cn=replica,dc=mydomain,dc=com" rootpw "{ssha}mypassword" directory /var/lib/ldap/ checkpoint 1024 5 cachesize 10000 index objectClass,uidNumber,gidNumber eq index member,mail eq,pres index cn,displayname,uid,sn,givenname sub,eq,pres #Entries for replication updatedn="cn=replica,dc=mydomain,dc=com" updateref=ldap://ldap1.mydomain.com replogfile /var/lib/ldap/slurpd.replog ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ OK so slapd starts without error on both servers and slurpd on ldap1. /var/lib/ldap/slurpd.replog is created successfully and there is also another replog file created in /var/lib/slurpd/replica/slurpd.replog which the man page tells me is a working directory to which slurpd copies the replog before processing it. Ok so now all seems normal up to here but this is where the trouble starts. I update an entry in the database on ldap1 and the following is written to /var/lib/slurpd/replica/slurpd.replog: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ replica: 192.168.2.246 time: 1194939780 dn: uid=user.three,ou=people,dc=mydomain,dc=com changetype: modify replace: sn sn: Tres - replace: entryCSN entryCSN: 20071113074300Z#000000#00#000000 - replace: modifiersName modifiersName: cn=Administrator,dc=mydomain,dc=com - replace: modifyTimestamp modifyTimestamp: 20071113074300Z +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ but /var/lib/ldap/slurpd.replog remains empty and the updated entry is not replicated to ldap2 The permissions on /var/lib/ldap/slurpd.replog: -rw-r--r-- 1 ldap ldap 0 2007-11-13 11:43 /var/lib/ldap/slurpd.replog I don't see any other errors in /var/log/messages but there is a LOT of output and I most of it seems quite cryptic. I am really at a loss here and would appreciate it if anybody can point out a mistake in my configuration or any other glaringly obvious errors. Thanks Lawrence

5 6

Howto extend LDAP in java with JLDAP
by Erik van Oosten 16 Nov '07

16 Nov '07

Hi, Based on my experiences with implementing a RFC4533 (synchronization) client with JLDAP I created a small howto. You can find it on my blog: http://day-to-day-stuff.blogspot.com/2007/11/howto-extend-ldap-in-java-with…. Have fun, Erik. -- Erik van Oosten http://2008.rubyenrails.nl/ http://www.day-to-day-stuff.blogspot.com/

1 0

Mirror Mode
by Clowser, Jeff (Contractor) 15 Nov '07

15 Nov '07

I have a question about mirror mode, and how it's different from "multimaster". In servers like Sun or Red Hat's directory server, a simplified description of what they term multimaster is that more than one server can accept writes simultaneously, and it will then propogate all changes to other servers. If there is a conflicting change, some form of conflict resolution logic is implemented. If I understand Mirror Mode correctly, the major difference is that it does not contain code for conflict resolution. I.e. both masters are live, and will accept changes, and try to replicate them to the other master (the hot standby master does not reject changes when the other master is the "live" master). If a conflict occurs, bad things happen. It depends on some third resource (a load balancer, slapd in proxy mode, etc) ensuring that all writes go to only one master server at a time, and that all clients doing writes use that frontend to send writes to. At the same time, the individual masters don't do anything to enforce the fact that writes are coming through that load balancer/proxy/etc, so it's possible to write to both masters concurrently (though not desirable). So.. a couple of questions: 1. Is this understanding a correct one? Have I missed any key points (or completely gotten it wrong)? 2. If so, and I write conflicting changes to both master servers directly, what happens when they try to sync? (What does it do with the conflicting changes, does it prevent any future changes from being replicated or can it "skip" the conflicting change, how do I detect a conflict to manually fix it, and what do I need to do actually fix it (can I just resolve the data issue, or do I have to remove something from a replication queue and how, etc)?) 3. I can envision an HA configuration having 2 sites. At each site I have a proxy and a master, with one site having the primary master, the other having a hot standby. Both proxies direct traffic to the primary master if it's available, or redirect to the hot standby master if not. Connection between sites goes down, so one proxy is directing writes to the primary master, but the other now can't get to the primary, so sends writes to the hot standby master, thinking it is down. Assuming this happens, and NO conflicting modifications are made, when the connection between sites comes back up, will everything sync up properly so everything has the same content (if a conflicting change occurs, it would be covered by the previous point). Thanks, - Jeff

4 10

2.4 and MMR examples?
by Kimmo Koivisto 15 Nov '07

15 Nov '07

Hello I'm now using RHEL4 and Fedora DS with it's N-way multimaster replication feature. I'm not totally happy with it and I would like to try Openldap 2.4 instead. I would like to install at least three way MMR, with servers A,B and C. Replication should be SSL-protected, but can manage without SSL too. Is there any example configuration files available that I could start with? Could not find example from FAQ and Administrator's Guide, could someone provide links to the examples? Regards, Kimmo Koivisto

2 1

Re: 2.4 and MMR examples?
by Gavin Henry 15 Nov '07

15 Nov '07

>quote who="Kimmo Koivisto"> > Hello > > I'm now using RHEL4 and Fedora DS with it's N-way multimaster replication > feature. I'm not totally happy with it and I would like to try Openldap > 2.4 > instead. > > I would like to install at least three way MMR, with servers A,B and C. > Replication should be SSL-protected, but can manage without SSL too. > > Is there any example configuration files available that I could start > with? See test050-syncrepl-multimaster in tests/scripts/ Pretty simple. > > Could not find example from FAQ and Administrator's Guide, could someone > provide links to the examples? I'm working on it for the next release. > > Regards, > Kimmo Koivisto >

1 0

pwdMustChange Does not work
by Aghor, Shriwallabh (Sachin) 15 Nov '07

15 Nov '07

Hello, We are using openldap 2.3.37 , We have set up ppolicy with following attributes : <ppolicy.lidf> dn: cn=basicPwdPolicy,dc=avaya,dc=com cn: basicPwdPolicy objectClass: device objectClass: pwdPolicy objectClass: top pwdAttribute: 2.5.4.35 pwdMaxAge: 86400 pwdAllowUserChange: TRUE pwdMustChange: TRUE </ppolicy.lidf> We have added this policy in slapd.conf file as below : overlay ppolicy ppolicy_default "cn=basicPwdPolicy,dc=avaya,dc=com" For users we are adding we are able to see password expiry, however ("pwdMustChange") user is not forced to change the password for first login. We want to force user to change its password on the first login. Any help in this context will be appreciated Regards, Shriwallabh Aghor(Sachin) | CSAD R&D | Avaya India Pvt. Ltd | Level # 2,Tower # 1 | Cybercity, Magarpattacity,Hadapsar | Pune,Maharashtra,India 411028 | Voice: 91-20-30412611 | E-mail: ashriwallabh(a)avaya.com

2 1

no such object (32)
by Adam Williams 15 Nov '07

15 Nov '07

Can someone help me to understand why I am getting this error? I'm wanting to modify 2 lines. I have: ldapsearch -D 'cn=Manager,dc=gomer,dc=mdah,dc=state,dc=ms,dc=us' -b "cn=NextFreeUnixId,dc=gomer,dc=mdah,dc=state,dc=ms,dc=us" -w xxxxxxxx -x # extended LDIF # # LDAPv3 # base <cn=NextFreeUnixId,dc=gomer,dc=mdah,dc=state,dc=ms,dc=us> with scope subtree # filter: (objectclass=*) # requesting: ALL # # NextFreeUnixId, gomer.mdah.state.ms.us dn: cn=NextFreeUnixId,dc=gomer,dc=mdah,dc=state,dc=ms,dc=us objectClass: inetOrgPerson objectClass: sambaUnixIdPool cn: NextFreeUnixId sn: NextFreeUnixId uidNumber: 10019 gidNumber: 10000 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 so I create: cat NextFreeUnuxID.ldif dn: cn=NextFreeUnixIdPool,dc=gomer,dc=mdah,dc=state,dc=ms,dc=us changetype: modify gidNumber: 105 uidNumber: 517 but when I run it: ldapmodify -D "cn=Manager,dc=gomer,dc=mdah,dc=state,dc=ms,dc=us" -w xxxxxxxxx -x -v -f NextFreeUnuxID.ldif ldap_initialize( <DEFAULT> ) replace gidNumber: 105 replace uidNumber: 517 modifying entry "cn=NextFreeUnixIdPool,dc=gomer,dc=mdah,dc=state,dc=ms,dc=us" modify complete ldapmodify: No such object (32) matched DN: dc=gomer,dc=mdah,dc=state,dc=ms,dc=us and I'm just stumped. why am I getting that error? cn=NextFreeUnixIdPool exists according to the ldapsearch.

4 4

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software November 2007