openldap-software February 2007

openldap-software@openldap.org

94 participants
112 discussions

Announce: Net-LDAPapi version 2.00 released
by Quanah Gibson-Mount 09 Feb '07

09 Feb '07

A new release of Net::LDAPapi module is now available for Perl via CPAN. This release includes compilation against OpenLDAP libraries from version 2.1 forward. It now supports LDAPv3, including SASL binds. Support for the Netscape (now Mozilla) C SDK has been kept, but not tested. I welcome feedback on the usability with the Mozilla C SDK. Many thanks to Howard Chu and Symas Corporation for the work done to realize LDAPv3 support with Net::LDAPapi. Net::LDAPapi can be obtained from: <http://search.cpan.org/~mishikal/Net-LDAPapi-2.00/> For those who have never used Net::LDAPapi, it uses the C interface for its LDAP operations. This means that it is much faster than the pure perl Net::LDAP module from the perl-ldap package. However, it also relies on having the C libraries it was linked against available. --Quanah -- Quanah Gibson-Mount Principal Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

6 13

Re: Announce: Net-LDAPapi version 2.00 released
by Chris Garrigues 09 Feb '07

09 Feb '07

> From: Quanah Gibson-Mount <quanah(a)stanford.edu> > Date: Fri, 09 Feb 2007 01:24:52 -0800 > > A new release of Net::LDAPapi module is now available for Perl via CPAN. > This release includes compilation against OpenLDAP libraries from version > 2.1 forward. It now supports LDAPv3, including SASL binds. I hate to sound critical, but... Who's responsible for the "object oriented" interface? It bugs me when a package claims to have an OO interface, yet there's no use of OO concepts in the interface. It took me a while to convince myself that the values returned by first_entry and next_entry aren't actually objects on which I would then use the get_values method. I'd rather just use the non-OO interface since it wouldn't mislead me into expecting OO behavior. I assume that still works even though it's no longer documented. Do I just stick "ldap_" on the front of all the method names? Chris -- Chris Garrigues Trinsic Solutions President 710-B West 14th Street Austin, TX 78701-1755 512-322-0180 http://www.trinsics.com Would you rather proactively pay for uptime or reactively pay for downtime? Trinsic Solutions Your Proactive IT Management Partner

2 1

replication. keepalive searching...
by Dmitriy Kirhlarov 09 Feb '07

09 Feb '07

Hi, list. I'm using openldap 2.3.33 on provider and consumer server on FreeBSD 6.x. Provider have real IP address. Consumer installed in local network with 172.16.x.x address behind Cisco Pix firewall with NAT. I'm using syncrepl replication (type=refreshAndPersist retry="500 +") and all work fine. But, time-to-time, after reconfiguration, we are reloading translation table on PIX. As result, all installed tcp connections silently drops. Consumer detect this situation after more them 1h (TCP timeout?). Is it possible decrease this time period? WBR -- Dmitriy Kirhlarov OILspace, 26 Leninskaya sloboda, bld. 2, 2nd floor, 115280 Moscow, Russia P:+7 495 105 7247 ext.208 F:+7 495 105 7246 E:DmitriyKirhlarov@oilspace.com Building Successful Supply Chains - One Solution At A Time. www.oilspace.com

4 6

Searching for entryUUIDs broken?
by Peter Mogensen 09 Feb '07

09 Feb '07

Hi, I'm experiencing something weird. I'm using slapd 2.3.32 on Ubuntu Dapper. First I add a couple of objects. Then I look them up by entryUUID: ldapsearch -h localhost -x -W -D 'cn=admin,dc=abook,dc=example,dc=com' -b 'uid=user1,o=NA,dc=abook,dc=example,dc=com' 'entryuuid=ef881802-496c-102b-9655-97b172d5724c' entryUUID The after a slapd restart I try the same, but now only some of the entries will show up as a result. That is, - when I first do: ldapsearch -h localhost -x -W -D 'cn=admin,dc=abook,dc=example,dc=com' -b 'uid=user1,o=NA,dc=abook,dc=example,dc=com' 'entryuuid=*' entryUUID ... then they all show up, but if I pick out one of the results and do the above search for a single entryUUID, then some work and some doesn't. (admin is the rootdn, so it shouldn't be a matter of ACLs) Is there a bug, or am I doing something wrong? regards, Peter

2 2

Changing rootdn password while it's in the db (not in slapd.conf)?
by m h 09 Feb '07

09 Feb '07

Hello- Thanks to the help of Michael and others I was able to migrate my root dn user from slapd.conf to the database. (BTW should I file a bug for bad documentation on example from 7.1 from [1]?) Here's how I did it (for the curious and benefit of future users/searchers):: Add rootdn user to ldif (/tmp/entries.ldif):: # Organization for Example Corporation dn: dc=example,dc=com objectClass: dcObject objectClass: organization dc: example o: Example Corporation description: The Example Corporation # Organizational Role for Directory Manager dn: cn=Manager,dc=example,dc=com objectClass: organizationalRole objectClass: simpleSecurityObject cn: Manager description: Directory Manager userPassword: secret load it:: ldapadd -x -D "cn=Manager,dc=example,dc=com" -w secret -f /tmp/entries.ldif stop ldap comment out "rootdn" and "rootpw" from slapd.conf start ldap test user from db:: ldapwhoami -x -D "cn=Manager,dc=example,dc=com" -w secret Yeah! It works! So, now back to my original issue. Updating the rootdn password. When I try the following it fails:: ldappasswd -x -v -S -w secret -D cn=Manager,dc=example,dc=com cn=Manager,dc=example,dc=com New password: Re-enter new password: ldap_initialize( <DEFAULT> ) Result: Insufficient access (50) I also have another user that I added and tried to update his password and got the same error:: ldappasswd -x -v -S -w secret -D cn=Manager,dc=example,dc=com cn=s2searchuser,ou=InternalPerson,cn=Manager,dc=example,dc=com New password: Re-enter new password: ldap_initialize( <DEFAULT> ) Result: Insufficient access (50) If I stop ldap, put rootdn/rootpw back in slapd, start ldap and re-run the above and it works:: $ ldappasswd -x -v -S -w secret -D cn=Manager,dc=example,dc=com cn=s2searchuser,ou=InternalPerson,cn=Manager,dc=example,dc=com New password: Re-enter new password: ldap_initialize( <DEFAULT> ) Result: Success (0) I'm sure I'm missing something that is probably obvious to the seasoned veterans, but frustrating to a newbie like me. If anyone can point me further in the right direction that'd be great. thanks much -matt 1 - http://www.openldap.org/doc/admin22/dbtools.html

4 5

RE: Schema Replication
by Mark Mcdonald 08 Feb '07

08 Feb '07

> READ THE ADMIN GUIDE. That'll learn me for skipping over the first paragraph :) Thanks Howard, everything's looking peachy now!

1 0

Maximum size of the primary thread pool
by Rajarshi Chaudhuri 08 Feb '07

08 Feb '07

Hi, Maximum size of the primary thread pool - the default is 16. Is it recommended to increase this value to higher ones like 32/64 etc. Is there any loose relation between the RAM and OS and the thread pool size that I need to consider. Simply, is there any guideline on this thread pool size and it's implications? Rajarshi Chaudhuri Genesys Telecommunications Lab, Inc rajarshi(a)genesyslab.com <mailto:rajarshi@genesyslab.com>

3 4

Can openldap locate "horizon data" on different servers ?
by Zhang William 08 Feb '07

08 Feb '07

for example, there are 1000 entries like this: sub=1,dc=root sub=..., dc=root sub=1000, dc=root i wanna sub=1..500 located on server1 and sub=501...1000 on server2 (no referal). can openldap do that ? i have tried backend meta but it seems cant work. thanks in advance -- Regards. William

3 2

RE: Invalid DN
by Ian Moroney 08 Feb '07

08 Feb '07

ldapadd -x -h localhost -D "cn=mailadmin,dc=global-drum,dc=com" -W -f /srv/ox/share/init_ldap.ldif works! why don't they tell you in the tutorial to have double quotes :P Thanks and Kind Regards, Ian Moroney Field Engineer T: 020 8891 3010 M: 07791 965924 F: 020 8288 2591 www.techdivision.co.uk <http://www.techdivision.co.uk/> TechDivision - Making IT Work ________________________________ From: David Damon [mailto:ddamon@Baxglobal.com] Sent: 07 February 2007 19:00 To: Ian Moroney Cc: openldap-software(a)openldap.org Subject: Re: Invalid DN Ian, Try ldapadd -x -h localhost -D "cn=mailadmin,dc=global-drum,dc=com" -W -f /srv/ox/share/init_ldap.ldif and see if this works. Notice the DN after the -D is in double quotes. Also, if you have the HOSTS (which is depreciated) or URI (which is the new way of defining providers) defined in your /etc/openldap/ldap.conf file you do not need to define the -h localhost in the ldapadd or ldapsearch commands. Regards, David Damon Senior Systems Integration Analyst "Ian Moroney" <ian.moroney(a)techdivision.co.uk> Sent by: openldap-software-bounces+ddamon=baxglobal.com(a)openldap.org 02/07/2007 07:09 AM To <openldap-software(a)openldap.org> cc Subject Invalid DN Hi again all! Just another brick wall i've ran into... I am running the following command: ldapadd -x -h localhost -D cn=mailadmin,dc=global-drum,dc=com -W -f /srv/ox/share/init_ldap.ldif I then get: ldap_bind: Invalid DN syntax (34) additional info: invalid DN This error happens if i have UID=mailadmin,dc=global-drum,dc=com, cn=root.... cn=mailadmin or whatever. if necessary, i can post the contents of the init_ldap.ldif and my slapd.conf files. ldapsearch -h localhost -D "UID=mailadmin,dc=global-drum,dc=com" -x -W (after password enter) comes back with: # extended LDIF # # LDAPv3 # base <> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 and when i look at slapd -d -1, it is showing the following, amongst other things: ldap_read: want=8, got=7 0000: 30 05 02 01 03 42 00 ber_get_next: tag 0x39 len 5 contents: ber_dump: buf=0x80268b80 ptr=0x80268b80 end=0x80268b85 len=5 0000: 02 01 03 42 00 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable ber_get_next on fd 16 failed errno=11 (Resource temporarily unavailable) The database is supposed to be empty, so maybe it should be reporting what it is reporting above. Thoughts? Thanks and Kind Regards, Ian Moroney Field Engineer T: 020 8891 3010 M: 07791 965924 F: 020 8288 2591 www.techdivision.co.uk <http://www.techdivision.co.uk/> TechDivision - Making IT Work

2 1

Salted passwords, further clarification please
by m h 08 Feb '07

08 Feb '07

Hi all. I'm trying to write a script to change the rootpw value in slapd.conf. Before allowing the user to change the password, I'm asking that they first verify the existing password. My question has to do with the random salt. How do I verify the existing password? Going through slappasswd doesn't appear to work, since it uses a random salt each time. ie: r52 ~ # slappasswd -s foo {SSHA}OBe71ShE85Wd8PINTJzunxazszPWpon1 r52 ~ # slappasswd -s foo {SSHA}OCK0lxJa+pfFqDfE39N3EZ8529IZIMhd It doesn't appear from the man page for slappasswd that you can specify the salt. Furthermore, how does the server know what the salt is? (I read through the FAQ on the website and it says the salt is added to the password before encryption). A little confused. Anything enlightening would be wonderful! Thanks much. matt

3 4

← Newer
1
...
5
6
7
8
9
10
11
12
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software February 2007