openldap-software March 2007

openldap-software@openldap.org

68 participants
83 discussions

Error: Objectclass: value #1 invalid per syntax
by shilpa muramkar 22 Mar '07

22 Mar '07

hi, i had recently applied for OIDs with IANA. and they have sent me a Personal Enterprise Number(PEN) (consider it as "pqrs"). The prefix they have sent is 1.3.6.1.4.1 "for attributes i have used-----"1.3.6.1.4.1.pqrs.1 "for objectclasses i have used----"1.3.6.1.4.1.pqrs.2 Using that i have created OIDs for my purpose. my schema file looks like below. attributetype( 1.3.6.1.4.1.pqrs.1.12 NAME 'outofofficeon' DESC 'Specifies if the user is out of office or not' SYNTAX 'cis' SINGLE-VALUE ) attributetype( 1.3.6.1.4.1.pqrs.1.13 NAME 'timezone' DESC 'Time zone of the entry' SYNTAX 'cis' SINGLE-VALUE ) attributetype( 1.3.6.1.4.1.pqrs.1.14 NAME 'shippingaddress' DESC 'Shipping address of the entry' SYNTAX 'cis' MULTI-VALUE ) objectclass( 1.3.6.1.4.1.pqrs.2.1 NAME 'ssausergroup' DESC 'SSA Usergroup' SUP groupofuniquenames STRUCTURAL MAY( ssarole $ ssaugtype ) ) objectclass( 1.3.6.1.4.1.pqrs.2.2 NAME 'ssabase' DESC 'SSA Base' SUP top STRUCTURAL MUST( uid $ cn $ sn ) ............................. ......................... ........................... now i am trying to run an LDIF file which contains a sample data like dn: uid=admin,ou=ssausers,dc=ssainternal,dc=net changetype: add objectClass: top objectClass: ssauser objectClass: ssantuser uid: admin cn: admin userpassword: admin ssarole: administrator ssarole: superadministrator sn: admin preferredlanguage: en_US ntuserdomainid: ssainternal using the ldapadd command....all the data gets added except for the above one. It gives me an error saying ldap_add: Invalid syntax(21) additional info: objectClass: value #1 invalid per syntax. Does it mean that the objectclasses i have mentioned in the above ldif entry are causing the problem?? i.e "ssauser", "ssantuser"????? Is it that the definitions of these objectclasses in schema is not proper?? Or has it got anything to do with the way i have arranged the OIDs? kindly help me out with this.......... waiting fo rur reply shilpa

4 6

Re: connection lost
by Dave Horsfall 21 Mar '07

21 Mar '07

On Wed, 21 Mar 2007, koenigsmann(a)gutenberg-rz.de wrote: > Bis Dienstag, den 2. April bin ich leider nicht erreichbar. Sollte Ihr > Anliegen nicht so lange warten können, wenden Sie sich bitte an unsere > Hotline unter der Rufnummer 0511-5181188. [...] Can anyone translate this, or is it just another of those stupid Out-of-Office responders? -- Dave Horsfall DTM VK2KFU daveh(a)ci.com.au Ph: +61 2 9552-5509 (d) -5500 (sw) Corinthian Eng'ng P/L, Ste 54 Jones Bay Whf, 26-32 Pirrama Rd, Pyrmont 2009, AU

2 2

connection lost
by Hans Moser 21 Mar '07

21 Mar '07

Hi! Can anyone tell from the log extract why "connection lost" happened? Is there a server error visible or did the client close the connection? The server (2.3.27) is a pure proxy with only a meta backend. Mar 21 08:01:28 exts098 local4:debug slapd[430186]: daemon: activity on 1 descriptor Mar 21 08:01:28 exts098 local4:debug slapd[430186]: daemon: listen=6, new connection on 7 Mar 21 08:01:28 exts098 local4:debug slapd[430186]: daemon: added 7r Mar 21 08:01:28 exts098 local4:debug slapd[430186]: conn=29179 fd=7 ACCEPT from IP=10.17.99.14:47825 (IP=0.0.0.0:3389) Mar 21 08:01:28 exts098 local4:debug slapd[430186]: daemon: select: listen=6 active_threads=0 tvp=NULL Mar 21 08:01:29 exts098 local4:debug slapd[430186]: daemon: activity on 1 descriptor Mar 21 08:01:29 exts098 local4:debug slapd[430186]: daemon: activity on: Mar 21 08:01:29 exts098 local4:debug slapd[430186]: 7r Mar 21 08:01:29 exts098 local4:debug slapd[430186]: Mar 21 08:01:29 exts098 local4:debug slapd[430186]: daemon: read activity on 7 Mar 21 08:01:29 exts098 local4:debug slapd[430186]: connection_get(7): got connid=29179 Mar 21 08:01:29 exts098 local4:debug slapd[430186]: connection_read(7): checking for input on id=29179 Mar 21 08:01:29 exts098 local4:debug slapd[430186]: ber_get_next on fd 7 failed errno=0 (Error 0) Mar 21 08:01:29 exts098 local4:debug slapd[430186]: connection_read(7): input error=-2 id=29179, closing. Mar 21 08:01:29 exts098 local4:debug slapd[430186]: connection_closing: readying conn=29179 sd=7 for close Mar 21 08:01:29 exts098 local4:debug slapd[430186]: connection_close: conn=29179 sd=7 Mar 21 08:01:29 exts098 local4:debug slapd[430186]: =>meta_back_conn_destroy: fetching conn=29179 DN="" Mar 21 08:01:29 exts098 local4:debug slapd[430186]: daemon: removing 7 Mar 21 08:01:29 exts098 local4:debug slapd[430186]: conn=29179 fd=7 closed (connection lost) Mar 21 08:01:29 exts098 local4:debug slapd[430186]: daemon: select: listen=6 active_threads=0 tvp=NULL Mar 21 08:01:29 exts098 local4:debug slapd[430186]: daemon: activity on 1 descriptor Mar 21 08:01:29 exts098 local4:debug slapd[430186]: daemon: waked Mar 21 08:01:29 exts098 local4:debug slapd[430186]: daemon: select: listen=6 active_threads=0 tvp=NULL Thanks! Hans

2 1

AVA_Sort function in slapd/dn.c
by Bret Lambert 20 Mar '07

20 Mar '07

Doing some lint(1) sweeps (some of which ando@ has committed), I got a message stating that the end of the loop in this function was never reached. Looking into it, I think that the code as it currently is is incorrect: static void AVA_Sort( LDAPRDN rdn, int iAVA ) { int i; LDAPAVA *ava_in = rdn[ iAVA ]; assert( rdn != NULL ); assert( ava_in != NULL ); for ( i = 0; i < iAVA; i++ ) { LDAPAVA *ava = rdn[ i ]; int a, j; assert( ava != NULL ); a = strcmp( ava_in->la_attr.bv_val, ava->la_attr.bv_val ); if ( a > 0 ) { break; } while ( a == 0 ) { int v, d; d = ava_in->la_value.bv_len - ava->la_value.bv_len; v = memcmp( ava_in->la_value.bv_val, ava->la_value.bv_val, d <= 0 ? ava_in->la_value.bv_len : ava->la_value.bv_len ); if ( v == 0 && d != 0 ) { v = d; } if ( v <= 0 ) { /* * got it! */ break; } if ( ++i == iAVA ) { /* * already sorted */ return; } ava = rdn[ i ]; a = strcmp( ava_in->la_attr.bv_val, ava->la_attr.bv_val ); } /* * move ahead */ for ( j = iAVA; j > i; j-- ) { rdn[ j ] = rdn[ j - 1 ]; } rdn[ i ] = ava_in; return; } } It's that unconditional return at the end of the for() loop that caused lint(1) to hiccup (also, insofar as I can see, invalidates the entire function). It's easy to see that the intent of the code is to take the element indicated by iAVA and compare it to all previous items in rdn[]. However, all it does is compare it to the first item, and it does the correct thing in that case, but then terminates. So, I whipped up what looks to me to be a better, functioning, and more legible chunk of code. Please flame or reward with cash as appropriate: static void AVA_Sort( LDAPRDN rdn, int iAVA ) { int i = 0; LDAPAVA *ava_in = rdn[ iAVA ]; assert( rdn != NULL ); assert( ava_in != NULL ); LDAPAVA *ava = rdn[ i ]; int a, j; assert( ava != NULL ); while ( ( a = strcmp( ava_in->la_attr.bv_val, ava->la_attr.bv_val ) ) < 0 ) { ava = rdn[ ++i ]; } if ( a > 0 ) { return; } do { int v, d; d = ava_in->la_value.bv_len - ava->la_value.bv_len; v = memcmp( ava_in->la_value.bv_val, ava->la_value.bv_val, min( ava_in->la_value.bv_len, ava->la_value.bv_len ) ); if ( v < 0 || ( v == 0 && d <= 0 ) ) { /* * got it! */ break; } if ( ++i == iAVA ) { /* * already sorted */ return; } ava = rdn[ i ]; } while ( strcmp( ava_in->la_attr.bv_val, ava->la_attr.bv_val ) == 0); /* * move ahead */ for ( j = iAVA; j > i; j-- ) { rdn[ j ] = rdn[ j - 1 ]; } rdn[ i ] = ava_in; }

1 0

OL2.4 provider && OL2.2 consumer?
by Turbo Fredriksson 20 Mar '07

20 Mar '07

Is there any known issues between having a 2.4 provider and a 2.2 consumer? My 2.2 (using SASL) doesn't seem to be binding. I get the connect, but no bind etc (running the provider with '-d -1')... And the log on the consumer just say: do_syncrep1: ldap_sasl_interactive_bind_s failed (-2) This is the syncrepl on the consumer: ----- s n i p ----- syncrepl rid=0 provider=ldap://provider.domain.tld:3389 type=refreshOnly interval=00:00:00:30 searchbase="c=SE" filter="(objectClass=*)" attrs="*,+" scope=sub schemachecking=off updatedn="cn=Administrator,cn=auth" binddn="cn=consumer,ou=LDAP,ou=System,o=Domain,c=SE" bindmethod=sasl saslmech=gssapi realm=BAYOUR.COM authcId=consumer updateref ldap://provider.domain.tld:3389 ----- s n i p ----- And this is the provier syncprov config: ----- s n i p ----- overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 ----- s n i p ----- On the provider machine, I also have a 2.4 consumer and that works correctly (with almost the exact config as the 2.2 consumer - without the 'updatedn' and 'authcId' - which isn't allowed - though). I noticed that there is no 'rid' thingie on the provider any more (or in slapadd) but the 2.4 provider/consumer works any way... ?

2 2

ldap_start_tls: Connect error (-11)
by JOYDEEP 20 Mar '07

20 Mar '07

Dear list, I have self signed certificate. Now the command * ldpasearch -x -ZZ -d 255* shows TLS: hostname (127.0.0.1) does not match common name in certificate (linux.kolkatainfoservices.in). ldap_perror ldap_start_tls: Connect error (-11) additional info: TLS: hostname does not match CN in peer certificate I have checked with the *hostname* command in linux and it shows the hostname as linux.kolkatainfoservices.in I am really confused here. could any one suggest any solution please ?

3 3

libldap_r thread-safety problems
by manu＠netbsd.org 19 Mar '07

19 Mar '07

Hello I have thread-safety problems with libldap_r. My program uses libcurl to access a LDAP URL. When I attempt to fetch LDAP URL from multiple threads at once, I crash. I suspect there could be thread-safety issues with libldap_r. for instance, a nm shows it references gethostbyname, and not gethostname_r. Does it has any chance to be thread-safe if it uses gethostbyname? -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

3 8

overlay order important and not documented?
by Francis Swasey 19 Mar '07

19 Mar '07

I have found using OpenLDAP 2.3.34 on a RHEL4 system (a locally built RPM) that the order of the overlays can lead to a problem (slapd locks up and doesn't do anything). I have found that using syncprov, accesslog, auditlog, unique will work fine. But, adding refint to the end of that chain and then do a modrdn that triggers refint to want to change an attribute in another entry and your slapd is locked up. There is now one thread that will not end and you will only be able to shutdown slapd with a "kill -9". However, if I change the order so that the refint is prior to the accesslog overlay, then it works. Is this interaction between the two overlays and the importance of their relative order a known (or at least expected) -- or should I open an ITS? -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

4 12

addressbook ACLs - cannot create contact in group address book.
by Bernhard D Rohrer 19 Mar '07

19 Mar '07

hi folks I have the following ACL for my groups: # Access to groups addressbooks # allow read of addressbook by members and egwadmin account access to dn.regex="^cn=([^,]+),ou=shared,ou=contacts,dc=graylion,dc=net$" attrs=entry by group.expand="cn=$1,ou=groups,dc=graylion,dc=net" read by dn.regex="cn=admin,dc=graylion,dc=net" write by users none # allow members to create entries in there group addressbooks; no-one else can access it # needs write access to the entries ENTRY attribute ... access to dn.regex="cn=([^,]+),ou=shared,ou=contacts,dc=graylion,dc=net$" attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha by group.expand="cn=$1,ou=groups,dc=graylion,dc=net" write by users none # ... and the entries CHILDREN access to dn.regex="cn=([^,]+),ou=shared,ou=contacts,dc=graylion,dc=net$" attrs=children by group.expand="cn=$1,ou=groups,dc=graylion,dc=net" write by users none the LDIF of one of my groups is: dn: cn=GraylionEnterprises,ou=groups,dc=graylion,dc=net cn: GraylionEnterprises gidNumber: 7 memberUid: user1 memberUid: user2 memberUid: user3 memberUid: ... objectClass: top objectClass: posixGroup and the log shows this error: Mar 15 17:20:27 diskslave slapd[6657]: => bdb_entry_get: found entry: "cn=graylionenterprises,ou=groups,dc=graylion,dc=net" Mar 15 17:20:27 diskslave slapd[6657]: <= bdb_entry_get: failed to find objectClass while eGW shoes this error: Error saving the contact !!! Insufficient access: so_ldap: 503 what is wrong? Anybody have any ideas? cheers Bernhard PS: this works for personal address books -- Graylion's Fetish & Fashion Store Goth and Kinky Boots, Clothing and Jewellery http://www.graylion.net

3 2

Migrating openldap db backend from ibdm to bdb
by Asrai khn 17 Mar '07

17 Mar '07

Hi I want to migrate our openldap db backend which currently using idbm to bdb, Matt have suggested following steps, would you please kind enough to put some more light on few steps <snip> Migrate to BDB or HDB. Here's the rough idea: shutdown slapd slapcat -f /path/to/slapd.conf -l mydb.ldif vi /path/to/slapd.conf Change your database to a new directory. Read about tuning, cache sizing, and other stuff. Read openldap man pages. ( what to read ;) Read oracle's tuning docs for bdb. (we are not using any oracle things) Re-Read openldap man pages. (re-read for what :-S :wq slapadd -f /path/to/slapd.conf -l mydb.ldif Fix permissions on /var/run so the slapd user can write there -- this one is pretty easy </snip> Secondly, to be safe side, if something goes wrong, taking backup of ... directory /var/lib/ldap/mydomain.com cp -r /var/lib/ldap/mydomain.com /TosomeSafePlace is enough to fallback to ibdm? I want minimum downtime, heh frankly I can't aford my ass on fire :P Thanks. Askar

12 20

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software March 2007