openldap-software February 2007

openldap-software@openldap.org

94 participants
112 discussions

ACIs and OL 2.3
by Turbo Fredriksson 16 Feb '07

16 Feb '07

I got my 2.3.32 compiled and working on saturday, and I've been playing with it since. One thing that I stumbled on was the ACI's. I make heavy usage of that (ever since 2.0 - as a third party patch I think - or early 2.1 at least). But my database from 2.2 didn't want to load because of OpenLDAPaci problems... This is what my aci looks like on the root object: ----- s n i p ----- OpenLDAPaci: 0#entry#grant;r,s,c;objectClass,userReference,[entry]#public# OpenLDAPaci: 1#entry#grant;r,s,c;useControls,useEzmlm,useBind9,useWebSrv,autoR eload,allowServerChange,whoAreWe,language,hostMaster,ezmlmBinaryPath,krb5Real mName,krb5AdminServer,krb5PrincipalName,krb5AdminKeytab,krb5AdminCommandPath, controlBaseDn,ezmlmAdministrator,controlsAdministrator,useACI#users# OpenLDAPaci: 2#entry#grant;w,r,s,c,x;[all]#access-id#uid=turbo,ou=People,o=Fre driksson,c=SE ----- s n i p ----- This is aparently not allowed, in many ways! You can't seem to 'stack' the attributes any more. Well, since I don't have 'Net access in my apartment in Lisbon, I had to figure this out by trial and error. I ended up with something like this: ----- s n i p ----- OpenLDAPaci: 0#entry#grant;r,s,c;objectClass#public# OpenLDAPaci: 1#entry#grant;r,s,c;userReference#public# OpenLDAPaci: 2#entry#grant;r,s,c;[entry]#public# OpenLDAPaci: 3#entry#grant;r,s,c;useControls#users# OpenLDAPaci: 4#entry#grant;r,s,c;useEzmlm#users# OpenLDAPaci: 5#entry#grant;r,s,c;useBind9#users# OpenLDAPaci: 6#entry#grant;r,s,c;useWebSrv#users# OpenLDAPaci: 7#entry#grant;r,s,c;autoReload#users# OpenLDAPaci: 8#entry#grant;r,s,c;allowServerChange#users# OpenLDAPaci: 9#entry#grant;r,s,c;whoAreWe#users# OpenLDAPaci: 10#entry#grant;r,s,c;language#users# OpenLDAPaci: 11#entry#grant;r,s,c;hostMaster#users# OpenLDAPaci: 12#entry#grant;r,s,c;ezmlmBinaryPath#users# OpenLDAPaci: 13#entry#grant;r,s,c;krb5RealmName#users# OpenLDAPaci: 14#entry#grant;r,s,c;krb5AdminServer#users# OpenLDAPaci: 15#entry#grant;r,s,c;krb5PrincipalName#users# OpenLDAPaci: 16#entry#grant;r,s,c;krb5AdminKeytab#users# OpenLDAPaci: 17#entry#grant;r,s,c;krb5AdminCommandPath#users# OpenLDAPaci: 18#entry#grant;r,s,c;controlBaseDn#users# OpenLDAPaci: 19#entry#grant;r,s,c;ezmlmAdministrator#users# OpenLDAPaci: 20#entry#grant;r,s,c;controlsAdministrator#users# OpenLDAPaci: 21#entry#grant;r,s,c;useACI#users# OpenLDAPaci: 22#entry#grant;w,r,s,c,x;[all]#access-id#uid=turbo,ou=People,o=Fre driksson,c=SE ----- s n i p ----- which is much uglier... But still, and this is a reall show stopper - have not been able to work around this, this don't seemed to work propperly either! It's the OID 2 that's problem here. The '[entry]' isn't allowed and I can't seem to find it in the code either. The check for it any way - all the code say is: could be "[all]" or an attribute description This means that i can't don't have enough access for _creating_ an object, only to _modify_ an existing one... Creating a simple object like this: ----- s n i p ----- dn: o=phpQLAdmin_Branch_Test,c=se objectclass: top objectclass: organization o: phpQLAdmin_Branch_Test openldapaci: 0#entry#grant;w,r,s,c;[all]#access-id#uid=turbo,ou=people,o=fredriksson,c=se ----- s n i p ----- Fails because of: ----- s n i p ----- adding new entry "o=phpQLAdmin_Branch_Test,c=se" ldap_add: Insufficient access (50) additional info: no write access to entry ----- s n i p ----- Adding the line: ----- s n i p ----- openldapaci: 1#entry#grant;w,r,s,c;[entry]#access-id#uid=turbo,ou=people,o=fredriksson,c=se ----- s n i p ----- Will only give me: ----- s n i p ----- ldap_add: Invalid syntax (21) additional info: openldapaci: value #1 invalid per syntax ----- s n i p ----- So... Is there a document that describes the _changes_ to previous workings of OpenLDAPaci? Or exactly how it's supposed to work now? Also, is my initial findings that there now have to be one attribute per 'line' true? Seems very .. complicated ways of doing it... ?

9 31

Re: ACIs and OL 2.3
by Piotr Wadas 14 Feb '07

14 Feb '07

> I think this is the very important part here -- deprecated and discouraged. > I'd argue that long term, ACI support should be removed entirely (perhaps for > 2.5?). The entire concept of ACI's is broken. > Is it really so bad? I mean, I actually don't now, you're probably right if you say so, anyway I'd really regret such feature to be discontinued. I was testing it very long ago, and, nevertheless its complexity and its experimental flavour, the concept itself was very exciting. I was hoping someday this will be implemented in tested/documented and stable version. Dynamic ACL would be probably really useful thing. Anyway the actual implementation is another point, maybe ACI's is not really best of possible, I don't know. Commercial directory service implementation does have such feature or not? I bet they have. Maybe some concept based on special-kind db like cn=config, or cn=Monitor should do the work better than keeping dynacl with the entries themselves? Actually, regarding - conceptually - unix/posix standard, if we compare ldap entries simply to a "virtual files" (note the "file" original meaning), isn't it somekind of "dynamic acl", the way classic Unix file priviledges are stored? there are some bits describing priviledges and ownerships, which are actually stored _with_ files, aren't they? Imagine that someone could say, that "the entire priviledges and ownerships concept in Unix is broken", wouldn't that sound a little bit em. weird? :) Of course, there are concept limitations we all know, and there are better or worse workarounds for them, actually hundreds of extended acl things for various local and network filesystems, anyway, despite limitations, what could do the work better than such (actually simple in its basics) concept ? Back to the ACIs - is it to be discontinued, because people like me didn't test it enough, and didn't provide enough of feedback? :) This would make me sad :/ Regards, Piotr

2 1

Re: AW: AW: slapcat hangs without error message
by Aaron Richton 14 Feb '07

14 Feb '07

Please keep replies on the list. In that case, you're completely out of luck unless you have some sort of filesystem dumps to restore. Count yourself fortunate that you've recovered small amount of data that you do have, and consider it a lesson for configuration next time. On Wed, 14 Feb 2007, Voigtlaender(a)hansenet.com wrote: > I have not a single logfile, we run our slapd without transaction logs > because the recovery routines never worked for us. But thanks anyway for > the advice. > >> -----Ursprüngliche Nachricht----- >> Von: Aaron Richton [mailto:richton@nbcs.rutgers.edu] >> Gesendet: Mittwoch, 14. Februar 2007 15:22 >> An: Voigtländer, Marcella HTK >> Cc: openldap-software(a)openldap.org >> Betreff: Re: AW: slapcat hangs without error message >> >> >> If you have enough log files lying around, you could try the >> catastrophic >> recovery mode of db_recover. But that's a long shot, to put it nicely. >> >> On Wed, 14 Feb 2007, Voigtlaender(a)hansenet.com wrote: >> >>> It seems you are right. I did try db_recover, after that >> slapcat runs, >>> but the data is not complete. Furthermore my slapd doesn't >> start anymore >>> after the recover. Is there anything else I could try to >> get my data ? >>> >>> Marcella >> >

1 0

slapcat hangs without error message
by Voigtlaender＠hansenet.com 14 Feb '07

14 Feb '07

Hi, I am running a slapd 2.2.23 (debian package) with a bdb Backend on a Debian Sarge system. I want to use slapcat for backing up my database, but it does never dump the complete data. After running a while it just stops and is doing nothing anymore. I am a bit nervous right now, is there another way to get a ldif dump, or some way of debugging to find the error ? I did try slapcat -d 256, but that did not show anything unnormal, it just stopped. Thank you, Marcella

4 6

Building OpenLDAP with MSVC 6
by Rajarshi Chaudhuri 14 Feb '07

14 Feb '07

Hi, I see a few references of building OpenLDAP in Windows using MSVC6 - but I don't see any updated and comprehensive document. Can somebody help? Regds, Rajarshi Chaudhuri Genesys Telecommunications Lab, Inc rajarshi(a)genesyslab.com <mailto:rajarshi@genesyslab.com>

5 12

Slapd config for heavy and medium load
by Rajarshi Chaudhuri 13 Feb '07

13 Feb '07

Hi, I would highly appreciate if someone can provide the following - a. A sample bdb section for slapd.conf that shows what parameters need to be configured and to what values [may be a range] for withstanding a relatively heavy load [about 50 - 150 concurrent users each pumping a lot of data]. Also if some parameters should be configured in a DB_CONFIG file. Also - the thread pool size is important. b. A sample bdb section for slapd.conf that shows what parameters need to be configured and to what values [may be a range] for withstanding a medium load [about 10 - 15 concurrent users each pumping some data]. Also if some parameters should be configured in a DB_CONFIG file. Also - the thread pool size is important. There are lots of material in the archive regarding this - but not with much specificity. So if someone summarizes this in one place that would be of great help. Rajarshi Chaudhuri Genesys Telecommunications Lab, Inc rajarshi(a)genesyslab.com <mailto:rajarshi@genesyslab.com> 650.466.4860

4 8

RE: Schema Replication
by Mark Mcdonald 13 Feb '07

13 Feb '07

> -----Original Message----- > From: Howard Chu [mailto:hyc@symas.com] > > In OpenLDAP 2.3 you can add new schema definitions on the fly, but you > cannot > modify existing definitions. In OpenLDAP 2.4 you can do full schema > modifications on the fly. Are they replicated from master to slaves in 2.3? > Read the Admin Guide. I think you'll be better off using OpenLDAP 2.4 for > this project. We should be pushing out a new 2.4 alpha release pretty > soon. Is version 2.4 likely to become stable in the near future? Does anyone have any stories from a production environment? We've just updated to 2.3 stable & HDB (from 2.1/LDBM) and would rather not repeat the process so soon! I'm playing around with cn=schema,cn=config now, and my changes are not preserved after slapd is restarted, is there a way around this? Any recommended methods to take (excluding minor revision increments)? My current thoughts are to push the schema updates as both LDIF and schema files so a restart will pick up the changes from disk, although an alternative I'd like would be to build the schema dynamically. I've noticed also that schema updates done dynamically don't pick up data already recorded, for example (the testTwo attribute is the only one defined through the dynamic schema): $ ldapsearch [blah] dn: cn=test,o=base cn: test objectClass: device objectClass: testObject testTwo: w00t [restart slapd] $ ldapsearch [blah] dn: cn=test,o=base cn: test objectClass: device objectClass: testObject $ ldapadd [blah] dn: cn=test,cn=schema,cn=config objectClass: olcSchemaConfig cn: test olcAttributeTypes: ( 1.1.1 NAME 'testAttr' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) olcAttributeTypes: ( 1.1.2 NAME 'testTwo' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44 ) olcObjectClasses: ( 1.1.3 NAME 'testObject' MAY ( testAttr $ testTwo ) AUXILIARY ) adding new entry "cn=test,cn=schema,cn=config" $ ldapsearch [blah] dn: cn=test,o=base cn: test objectClass: device objectClass: testObject Does this mean the schema needs to be present before the database is loaded to pick up these attributes? And to pre-empt the inevitable response, I'm guessing this all works beautifully in 2.4?

4 6

sched_yield messages
by Sepp 13 Feb '07

13 Feb '07

Hello, one of our slapd daemons take 99.9% of CPU time (openldap 2.3.11, bdb 4.3.29, SuSE Linux SLES-8 (i386), Kernel 2.4.21-273-smp) With strace we detect: sched_yield() = 0 sched_yield() = 0 .. I found a lot about the sched_yield problem in openldap, but I'm still not sure what to do. Any suggestions ? Thanks ! Sepp

3 2

Re: ldap client can't contact server with SubjectAltName used
by Seed, Steven 13 Feb '07

13 Feb '07

OK, thanks. I'll try that. Unfortunately, I don't have control of the CA. Our corporate division manages that, and yes it is Entrust. I will ask them to regenerate the cert. Niels Frimodt Sørensen wrote: > Hi, > > It seems to me that you are using an Entrust PKI to generate the > certificate? If this is the case ensure that you set the > subjectAltName in SMA with "" surrounding it - if not SMA prepends the > e-mail qualifier... > > > Venlig hilsen/Kind regards > > Niels Frimodt Sørensen > > Signaturgruppen A/S > www.signaturgruppen.dk > +45 40207496 > > > > Howard Chu skrev: >> Seed, Steven wrote: >>> Sending again, because I'm not sure if the first message got through >>> since I had not acknowledged my membership... >>> >>> Steven Seed wrote: >>>> I have an ldap server set up with a SSL certificate such that the >>>> CN=hostname.fqdn. In the same certificate I have created a >>>> SubjectAltName with several DNS aliases. With everything configured >>>> properly in my ldap.conf file, I can make TLS connections to my >>>> ldap server as long as I use the hostname that matches the CN, but >>>> if I change my connection to use one of the aliases in the >>>> SubjectAltName I get: >>>> >>>> ldap_start_tls: Can't contact LDAP server (-1) >>>> additional info: TLS: hostname does not match CN in peer >>>> certificate >> >>>> An openssl dump of the certificate yields the following in the >>>> SubjectAltName section: >>>> >>>> Certificate: >>>> Data: >>>> CN=Proton.fas.fa.disney.com >>>> X509v3 Extended Key Usage: >>>> TLS Web Server Authentication >>>> X509v3 Subject Alternative Name: >>>> >>>> email:dns:faldap,dns:fatestldap,dns:faldap.fas.fa.disney.com,dns:fatestldap… >>>> >>>> X509v3 CRL Distribution Points: >>>> DirName:/DC=com/DC=disney/OU=PKI/CN=The Walt Disney >>>> Company Enterprise CA/CN=CRL27 >>>> URI:http://cdp.disney.pvt/CRL/EnterpriseCRL.crl >>>> URI:http://cdp.disney.com/CRL/EnterpriseCRL.crl >>>> >>>> Can anyone help me figure out what is going wrong? This is the same >>>> with both version 2.2.13 and 2.3.32 of openldap. Does the >>>> SubjectAltName format look correct? >> >> Your subjectAltName appears to have encoded an email extension with >> the string "dns:....." as its value, instead of an actual dns >> extension. So basically, your subjectAltName is wrong. >> -- Steven L. Seed Sr. Systems Administrator Walt Disney Feature Animation Steven.Seed(a)disney.com ================================================================= () __/\__ |\ .-"` `"-. /| I HAVE BEEN CHOSEN... | \.'( ') (' ) (. )`./ | FAREWELL MY FRIENDS... \_ _/ I GO ONTO A BETTER PLACE! \ `~"'=::='"~` / `-.__ __.-' ( `""~~""` ) [_____[##]_____] =================================================================

1 0

deferring operation: too many executing (2nd try)
by Sepp 13 Feb '07

13 Feb '07

Hello, sorry when this is a FAQ. What is the exact meaning of: connection_input: conn=4412677 deferring operation: too many executing and what could be done against it ? Thanks Sepp

2 1

← Newer
1
2
3
4
5
6
7
8
9
...
12
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software February 2007