openldap-software March 2007

openldap-software@openldap.org

68 participants
83 discussions

Syncrepl with SASL External
by Angela Gavazzi 05 Mar '07

05 Mar '07

Hallo! I'm trying to set up a replication with syncrepl and saslmech external and it wont succeed. I was reading a lot but I really don't see where the problem is now and don't know how to continue. So I really would appreciate if somebody could point me to the probable error. Please let me know if you need more infos. slapd is 2.3.31 master = erde.aag slave = mond.aag both compiled with: ./configure \ '--prefix=/usr/local/ldap' \ '--mandir=/usr/local/ldap/man' \ '--libexecdir=/usr/local/ldap/sbin' \ '--sysconfdir=/etc' \ '--with-configdir=/etc/ldap' \ '--with-subdir=ldap' \ '--enable-spasswd' \ '--enable-modules' \ '--enable-hdb' \ '--enable-overlays' \ '--enable-slurpd' \ (- will put this out when syncrepl works) '--with-cyrus-sasl' \ '--with-tls' Here the concerning parts of the slapd.conf: ***************************************************************** master: ... overlay syncprov syncprov-checkpoint 100 600 syncprov-sessionlog 100 ... authz-regexp "C=CH,ST=Switzerland,L=Dornach,O=Allgemeine Anthroposophische Gesellschaft,OU=Goetheanum,CN=mond.aag,emailAddress=edv(a)goetheanum.ch" "ldap:///dc=aag??one? (cn=repl)" limits dn.exact="cn=repl,dc=aag" size=unlimited time=unlimited access to * by dn.exact="cn=repl,dc=aag" read by * none break ... TLSCACertificateFile /etc/ldap/certs/cacert.pem TLSCACertificatePath /etc/ldap/certs TLSCertificateFile /etc/ldap/certs/erde.aag_cert.pem TLSCertificateKeyFile /etc/ldap/certs/erde.aag_key.pem TLSVerifyClient demand ***************************************************************** slave: ... overlay syncprov syncrepl rid=001 provider=ldap://erde.aag:389 searchbase="dc=aag" type=refreshOnly filter="objectClass=*" attrs="*,+" schemachecking=off scope=sub interval=00:00:01:00 updatedn "cn=repl,dc=aag" updateref="ldap://erde.aag:389" bindmethod=sasl saslmech=EXTERNAL authz-regexp "C=CH,ST=Switzerland,L=Dornach,O=Allgemeine Anthroposophische Gesellschaft,OU=Goetheanum,CN=mond.aag,emailAddress=edv(a)goetheanum.ch" "ldap:///dc=aag??one? (cn=repl)" access to * by dn="cn=repl,dc=aag" write by * read break TLSCACertificateFile /etc/ldap/certs/cacert.pem TLSCACertificatePath /etc/ldap/certs TLSCertificateFile /etc/ldap/certs/mond.aag_cert.pem TLSCertificateKeyFile /etc/ldap/certs/mond.aag_key.pem TLSVerifyClient demand ********** syncrepl with bindmethod simple works fine with user repl. ***************************************************************** manual connection from the slave as client with the same certs I will use for syncrepl works: ldapsearch -Y external -ZZ cn=repl -h erde.aag -LLL SASL/EXTERNAL authentication started SASL username: emailAddress=edv(a)goetheanum.ch,CN=mond.aag,OU=Goetheanum,O=Allgemeine Anthroposophische Gesellschaft,L=Dornach,ST=Switzerland,C=CH SASL SSF: 0 dn: cn=repl,dc=aag objectClass: simpleSecurityObject objectClass: organizationalRole cn: repl description: LDAP replicator ***************************************************************** When I start the slave for the firt replication with sasl external: snip... =>do_syncrepl rid 001 ldap_create ldap_url_parse_ext(ldap://erde.aag:389) ldap_sasl_interactive_bind_s: user selected: EXTERNAL ldap_int_sasl_bind: EXTERNAL ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP erde.aag:389 ldap_new_socket: 13 ldap_prepare_socket: 13 ldap_connect_to_host: Trying 192.168.100.72:389 ldap_connect_timeout: fd: 13 tm: -1 async: 0 ldap_int_sasl_open: host=192.168.100.72 do_syncrep1: rid 001 ldap_sasl_interactive_bind_s failed (-6) and on the master: daemon: activity on 1 descriptor daemon: activity on: >>> slap_listener(ldap:///)daemon: listen=8, new connection on 12 daemon: added 12r (active) listener=(nil) conn=21 fd=12 ACCEPT from IP=192.168.100.73:60625 (IP=0.0.0.0:389) daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: 12r daemon: read active on 12 connection_get(12) connection_get(12): got connid=21 connection_read(12): checking for input on id=21 ber_get_next ldap_read: want=8, got=7 0000: 30 05 02 01 01 42 00 0....B. ber_get_next: tag 0x30 len 5 contents: ber_dump: buf=0x082abc08 ptr=0x082abc08 end=0x082abc0d len=5 0000: 02 01 01 42 00 ...B. ber_get_next ldap_read: want=8, got=0 ber_get_next on fd 12 failed errno=0 (Success) connection_read(12): input error=-2 id=21, closing. connection_closing: readying conn=21 sd=12 for close connection_close: deferring conn=21 sd=12 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL do_unbind conn=21 op=0 UNBIND connection_resched: attempting closing conn=21 sd=12 connection_close: conn=21 sd=12 daemon: removing 12 conn=21 fd=12 closed () thank you very much angela

5 5

syncrepl works only once
by Wolfgang Hennerbichler 05 Mar '07

05 Mar '07

Hi LDAP Folks, don't know why that happens, but my syncrepl only works, when I start slapd. olcSyncrepl: syncrepl rid=1 provider=ldaps://my.ldap.server type=refreshOnly interval=00:00:10:00 searchbase="dc=my,dc=domain" bindmethod=simple binddn="cn=user,dc=my,dc=domain" retry="60 10 300 3" schemachecking=off credentials=mypasswd my loglevel: olcLogLevel: Parse Sync I see the syncrepl-logs when I fire up slapd, but after that just nothing. I honestly don't know why syncrepl wouldn't loop. I'd appreciate your help; wogri -- wogri(a)wogri.com http://www.wogri.com http://www.einradfilm.at

1 1

dynamic list questions
by Dieter Kluenter 03 Mar '07

03 Mar '07

Hi, i want to create dynamic lists of ipHostnumber. This is the dynamic Group entry ,----[ dynamic Group entry ] | dn: cn=dynamicHosts,o=avci,c=de | cn: dynamicGroup | memberURL: ldap:///ou=benchmark,o=avci,c=de?ipHostNumber?sub?(objectclass=ipHost) | objectClass: groupOfURLs `---- The relevant parts of slapd.conf are ,----[ slapd.conf ] | include /etc/openldap/schema/dyngroup.schema | modulepath /opt/openldap/libexec/openldap | moduleload dynlist.la | database bdb | suffix o=avci,c=de | overlay dynlist | dynlist-attrset groupOfURLs memberURL `---- A ldapsearch -x -H ldap://localhost -b "o=avci,c=de" -s one \ "(objectclass=groupOfUrls)" only presents the DN, that is member: host=abc,ou=benchmark,o=avci,c=de member: host=cde,ou=benchmark,o=avci,c=de ... but I would like a presentation of attribut ipHostNumber like member: ipHostNumber=192.168.100.31 member: ipHostNumber=192.168.100.32 The slapd.conf is based on the example in man slapo-dynlist(5), which says "This example collects all the email addresses of a database into a sin- gle entry;..." What is wrong with my setup? -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de N 53°37'10.08" E 10°08'02.82" GPG Key ID:8EF7B6C6

2 2

ACL problem
by Bernhard D Rohrer 03 Mar '07

03 Mar '07

Hi I am using openLDAP with eGroupware and am currently trying to implement eGroupware's acl_addressbook.conf, which I have adapted to the way my directory is built: # Access to users personal addressbooks # allow read of addressbook by owner and egwadmin account access to dn.regex="^cn=([^,]+),ou=personal,ou=contacts,dc=graylion,dc=net$" attrs=entry by dn.regex="uid=$1,ou=accounts,dc=graylion,dc=net" read by dn.regex="cn=egwadmin,dc=graylion,dc=net" write by users none # allow user to create entries in own addressbook; no-one else can access it # needs write access to the entries ENTRY attribute ... access to dn.regex="cn=([^,]+),ou=personal,ou=contacts,,dc=graylion,dc=net$" attrs=children by dn.regex="uid=$1,ou=accounts,dc=graylion,dc=net" write by users none # ... and the entries CHILDREN access to dn.regex="cn=([^,]+),ou=personal,ou=contacts,dc=graylion,dc=net$" attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha by dn.regex="uid=$1,ou=accounts,dc=graylion,dc=net" write by users none # Access to groups addressbooks # allow read of addressbook by members and egwadmin account access to dn.regex="^cn=([^,]+),ou=shared,ou=contacts,dc=graylion,dc=net$" attrs=entry by group.expand="cn=$1,ou=groups,dc=graylion,dc=net" read by dn.regex="cn=egwadmin,o=$2,dc=graylion,dc=net" write by users none # allow members to create entries in there group addressbooks; no-one else can access it # needs write access to the entries ENTRY attribute ... access to dn.regex="cn=([^,]+),ou=shared,ou=contacts,dc=graylion,dc=net$" attrs=children by group.expand="cn=$1,ou=groups,dc=graylion,dc=net" write by users none # ... and the entries CHILDREN access to dn.regex="cn=([^,]+),ou=shared,ou=contacts,dc=graylion,dc=net$" attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha by group.expand="cn=$1,ou=groups,dc=graylion,dc=net" write by users none when I try to add a user I get a 503 failure and the log reads somewhat like this: Mar 3 16:29:28 diskslave slapd[12582]: daemon: removing 15 Mar 3 16:29:28 diskslave slapd[12582]: conn=8 fd=15 closed Mar 3 16:29:28 diskslave slapd[12582]: do_bind Mar 3 16:29:28 diskslave slapd[12582]: >>> dnPrettyNormal: <cn=admin,dc=graylion,dc=net> Mar 3 16:29:28 diskslave slapd[12582]: <<< dnPrettyNormal: <cn=admin,dc=graylion,dc=net>, <cn=admin,dc=graylion,dc=net> Mar 3 16:29:28 diskslave slapd[12582]: do_bind: version=3 dn="cn=admin,dc=graylion,dc=net" method=128 Mar 3 16:29:28 diskslave slapd[12582]: conn=9 op=0 BIND dn="cn=admin,dc=graylion,dc=net" method=128 Mar 3 16:29:28 diskslave slapd[12582]: bdb_dn2entry("cn=admin,dc=graylion,dc=net") Mar 3 16:29:28 diskslave slapd[12582]: => access_allowed: auth access to "cn=admin,dc=graylion,dc=net" "userPassword" requested Mar 3 16:29:28 diskslave slapd[12582]: => acl_get: [1] attr userPassword Mar 3 16:29:28 diskslave slapd[12582]: => acl_mask: access to entry "cn=admin,dc=graylion,dc=net", attr "userPassword" requested Mar 3 16:29:28 diskslave slapd[12582]: => acl_mask: to all values by "", (=n) Mar 3 16:29:28 diskslave slapd[12582]: <= check a_dn_pat: cn=admin,dc=graylion,dc=net Mar 3 16:29:28 diskslave slapd[12582]: <= check a_dn_pat: anonymous Mar 3 16:29:28 diskslave slapd[12582]: <= acl_mask: [2] applying auth(=x) (stop) Mar 3 16:29:28 diskslave slapd[12582]: <= acl_mask: [2] mask: auth(=x) Mar 3 16:29:28 diskslave slapd[12582]: => access_allowed: auth access granted by auth(=x) Mar 3 16:29:28 diskslave slapd[12582]: conn=9 op=0 BIND dn="cn=admin,dc=graylion,dc=net" mech=SIMPLE ssf=0 Mar 3 16:29:28 diskslave slapd[12582]: do_bind: v3 bind: "cn=admin,dc=graylion,dc=net" to "cn=admin,dc=graylion,dc=net" Mar 3 16:29:28 diskslave slapd[12582]: send_ldap_result: conn=9 op=0 p=3 Mar 3 16:29:28 diskslave slapd[12582]: send_ldap_response: msgid=1 tag=97 err=0 Mar 3 16:29:28 diskslave slapd[12582]: conn=9 op=0 RESULT tag=97 err=0 text= Mar 3 16:29:28 diskslave slapd[12582]: daemon: activity on 1 descriptors Mar 3 16:29:28 diskslave slapd[12582]: daemon: activity on: Mar 3 16:29:28 diskslave slapd[12582]: 14r Mar 3 16:29:28 diskslave slapd[12582]: Mar 3 16:29:28 diskslave slapd[12582]: daemon: read activity on 14 Mar 3 16:29:28 diskslave slapd[12582]: connection_get(14): got connid=7 Mar 3 16:29:28 diskslave slapd[12582]: connection_read(14): checking for input on id=7 Mar 3 16:29:28 diskslave slapd[12582]: ber_get_next on fd 14 failed errno=11 (Resource temporarily unavailable) Mar 3 16:29:28 diskslave slapd[12582]: daemon: select: listen=6 active_threads=0 tvp=NULL Mar 3 16:29:28 diskslave slapd[12582]: daemon: select: listen=7 active_threads=0 tvp=NULL Mar 3 16:29:28 diskslave slapd[12582]: do_unbind Mar 3 16:29:28 diskslave slapd[12582]: conn=7 op=1 UNBIND Mar 3 16:29:28 diskslave slapd[12582]: connection_closing: readying conn=7 sd=14 for close Mar 3 16:29:28 diskslave slapd[12582]: connection_resched: attempting closing conn=7 sd=14 Mar 3 16:29:28 diskslave slapd[12582]: connection_close: conn=7 sd=14 Mar 3 16:29:28 diskslave slapd[12582]: daemon: removing 14 Mar 3 16:29:28 diskslave slapd[12582]: conn=7 fd=14 closed Mar 3 16:29:28 diskslave slapd[12582]: daemon: activity on 1 descriptors Mar 3 16:29:28 diskslave slapd[12582]: daemon: select: listen=6 active_threads=0 tvp=NULL Mar 3 16:29:28 diskslave slapd[12582]: daemon: select: listen=7 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on 1 descriptors Mar 3 16:29:29 diskslave slapd[12582]: daemon: new connection on 12 Mar 3 16:29:29 diskslave slapd[12582]: conn=10 fd=12 ACCEPT from IP=127.0.0.1:59758 (IP=0.0.0.0:389) Mar 3 16:29:29 diskslave slapd[12582]: daemon: added 12r Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on: Mar 3 16:29:29 diskslave slapd[12582]: Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=6 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=7 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on 1 descriptors Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on: Mar 3 16:29:29 diskslave slapd[12582]: 12r Mar 3 16:29:29 diskslave slapd[12582]: Mar 3 16:29:29 diskslave slapd[12582]: daemon: read activity on 12 Mar 3 16:29:29 diskslave slapd[12582]: connection_get(12): got connid=10 Mar 3 16:29:29 diskslave slapd[12582]: connection_read(12): checking for input on id=10 Mar 3 16:29:29 diskslave slapd[12582]: ber_get_next on fd 12 failed errno=11 (Resource temporarily unavailable) Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=6 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=7 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: do_bind Mar 3 16:29:29 diskslave slapd[12582]: >>> dnPrettyNormal: <uid=graylion,ou=users,dc=graylion,dc=net> Mar 3 16:29:29 diskslave slapd[12582]: <<< dnPrettyNormal: <uid=graylion,ou=users,dc=graylion,dc=net>, <uid=graylion,ou=users,dc=graylion,dc=net> Mar 3 16:29:29 diskslave slapd[12582]: do_bind: version=3 dn="uid=graylion,ou=users,dc=graylion,dc=net" method=128 Mar 3 16:29:29 diskslave slapd[12582]: conn=10 op=0 BIND dn="uid=graylion,ou=users,dc=graylion,dc=net" method=128 Mar 3 16:29:29 diskslave slapd[12582]: bdb_dn2entry("uid=graylion,ou=users,dc=graylion,dc=net") Mar 3 16:29:29 diskslave slapd[12582]: => access_allowed: auth access to "uid=graylion,ou=users,dc=graylion,dc=net" "userPassword" requested Mar 3 16:29:29 diskslave slapd[12582]: => acl_get: [1] attr userPassword Mar 3 16:29:29 diskslave slapd[12582]: => acl_mask: access to entry "uid=graylion,ou=users,dc=graylion,dc=net", attr "userPassword" requested Mar 3 16:29:29 diskslave slapd[12582]: => acl_mask: to all values by "", (=n) Mar 3 16:29:29 diskslave slapd[12582]: <= check a_dn_pat: cn=admin,dc=graylion,dc=net Mar 3 16:29:29 diskslave slapd[12582]: <= check a_dn_pat: anonymous Mar 3 16:29:29 diskslave slapd[12582]: <= acl_mask: [2] applying auth(=x) (stop) Mar 3 16:29:29 diskslave slapd[12582]: <= acl_mask: [2] mask: auth(=x) Mar 3 16:29:29 diskslave slapd[12582]: => access_allowed: auth access granted by auth(=x) Mar 3 16:29:29 diskslave slapd[12582]: conn=10 op=0 BIND dn="uid=graylion,ou=users,dc=graylion,dc=net" mech=SIMPLE ssf=0 Mar 3 16:29:29 diskslave slapd[12582]: do_bind: v3 bind: "uid=graylion,ou=users,dc=graylion,dc=net" to "uid=graylion,ou=users,dc=graylion,dc=net" Mar 3 16:29:29 diskslave slapd[12582]: send_ldap_result: conn=10 op=0 p=3 Mar 3 16:29:29 diskslave slapd[12582]: send_ldap_response: msgid=1 tag=97 err=0 Mar 3 16:29:29 diskslave slapd[12582]: conn=10 op=0 RESULT tag=97 err=0 text= Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on 1 descriptors Mar 3 16:29:29 diskslave slapd[12582]: daemon: new connection on 13 Mar 3 16:29:29 diskslave slapd[12582]: conn=11 fd=13 ACCEPT from IP=127.0.0.1:59759 (IP=0.0.0.0:389) Mar 3 16:29:29 diskslave slapd[12582]: daemon: added 13r Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on: Mar 3 16:29:29 diskslave slapd[12582]: Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=6 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=7 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on 1 descriptors Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on: Mar 3 16:29:29 diskslave slapd[12582]: 13r Mar 3 16:29:29 diskslave slapd[12582]: Mar 3 16:29:29 diskslave slapd[12582]: daemon: read activity on 13 Mar 3 16:29:29 diskslave slapd[12582]: connection_get(13): got connid=11 Mar 3 16:29:29 diskslave slapd[12582]: connection_read(13): checking for input on id=11 Mar 3 16:29:29 diskslave slapd[12582]: ber_get_next on fd 13 failed errno=11 (Resource temporarily unavailable) Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=6 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=7 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: do_bind Mar 3 16:29:29 diskslave slapd[12582]: >>> dnPrettyNormal: <uid=graylion,ou=users,dc=graylion,dc=net> Mar 3 16:29:29 diskslave slapd[12582]: <<< dnPrettyNormal: <uid=graylion,ou=users,dc=graylion,dc=net>, <uid=graylion,ou=users,dc=graylion,dc=net> Mar 3 16:29:29 diskslave slapd[12582]: do_bind: version=3 dn="uid=graylion,ou=users,dc=graylion,dc=net" method=128 Mar 3 16:29:29 diskslave slapd[12582]: conn=11 op=0 BIND dn="uid=graylion,ou=users,dc=graylion,dc=net" method=128 Mar 3 16:29:29 diskslave slapd[12582]: bdb_dn2entry("uid=graylion,ou=users,dc=graylion,dc=net") Mar 3 16:29:29 diskslave slapd[12582]: => access_allowed: auth access to "uid=graylion,ou=users,dc=graylion,dc=net" "userPassword" requested Mar 3 16:29:29 diskslave slapd[12582]: => acl_get: [1] attr userPassword Mar 3 16:29:29 diskslave slapd[12582]: => acl_mask: access to entry "uid=graylion,ou=users,dc=graylion,dc=net", attr "userPassword" requested Mar 3 16:29:29 diskslave slapd[12582]: => acl_mask: to all values by "", (=n) Mar 3 16:29:29 diskslave slapd[12582]: <= check a_dn_pat: cn=admin,dc=graylion,dc=net Mar 3 16:29:29 diskslave slapd[12582]: <= check a_dn_pat: anonymous Mar 3 16:29:29 diskslave slapd[12582]: <= acl_mask: [2] applying auth(=x) (stop) Mar 3 16:29:29 diskslave slapd[12582]: <= acl_mask: [2] mask: auth(=x) Mar 3 16:29:29 diskslave slapd[12582]: => access_allowed: auth access granted by auth(=x) Mar 3 16:29:29 diskslave slapd[12582]: conn=11 op=0 BIND dn="uid=graylion,ou=users,dc=graylion,dc=net" mech=SIMPLE ssf=0 Mar 3 16:29:29 diskslave slapd[12582]: do_bind: v3 bind: "uid=graylion,ou=users,dc=graylion,dc=net" to "uid=graylion,ou=users,dc=graylion,dc=net" Mar 3 16:29:29 diskslave slapd[12582]: send_ldap_result: conn=11 op=0 p=3 Mar 3 16:29:29 diskslave slapd[12582]: send_ldap_response: msgid=1 tag=97 err=0 Mar 3 16:29:29 diskslave slapd[12582]: conn=11 op=0 RESULT tag=97 err=0 text= Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on 1 descriptors Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on: Mar 3 16:29:29 diskslave slapd[12582]: 13r Mar 3 16:29:29 diskslave slapd[12582]: Mar 3 16:29:29 diskslave slapd[12582]: daemon: read activity on 13 Mar 3 16:29:29 diskslave slapd[12582]: connection_get(13): got connid=11 Mar 3 16:29:29 diskslave slapd[12582]: connection_read(13): checking for input on id=11 Mar 3 16:29:29 diskslave slapd[12582]: ber_get_next on fd 13 failed errno=11 (Resource temporarily unavailable) Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=6 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=7 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: do_search Mar 3 16:29:29 diskslave slapd[12582]: >>> dnPrettyNormal: <cn=graylion,ou=personal,ou=contacts,dc=graylion,dc=net> Mar 3 16:29:29 diskslave slapd[12582]: <<< dnPrettyNormal: <cn=graylion,ou=personal,ou=contacts,dc=graylion,dc=net>, <cn=graylion,ou=personal,ou=contacts,dc=graylion,dc=net> Mar 3 16:29:29 diskslave slapd[12582]: conn=11 op=1 SRCH base="cn=graylion,ou=personal,ou=contacts,dc=graylion,dc=net" scope=1 deref=0 filter="(&(objectClass=inetOrgPerson))" Mar 3 16:29:29 diskslave slapd[12582]: conn=11 op=1 SRCH attr=uidnumber uid cn givenname sn audio description labeleduri o ou title street l st postalcode telephonenumber homephone facsimiletelephonenumber mobile pager mail roomnumber jpegphoto displayname postaladdress userSMIMECertificate mozillaworkstreet2 c mozillahomestreet mozillahomestreet2 mozillahomelocalityname mozillahomestate mozillahomepostalcode mozillahomecountryname mozillasecondemail mozillahomeurl mozillapostaladdress2 co mozillahomepostaladdress2 birthdate note carphone primaryphone category businessrole assistantphone assistantname fileas homefacsimiletelephonenumber freeBusyuri calendaruri otherphone callbackPhone entryUUID uid uidNumber objectClass createTimestamp modifyTimestamp creatorsName modifiersName Mar 3 16:29:29 diskslave slapd[12582]: ==> limits_get: conn=11 op=1 dn="uid=graylion,ou=users,dc=graylion,dc=net" Mar 3 16:29:29 diskslave slapd[12582]: => bdb_search Mar 3 16:29:29 diskslave slapd[12582]: bdb_dn2entry("cn=graylion,ou=personal,ou=contacts,dc=graylion,dc=net") Mar 3 16:29:29 diskslave slapd[12582]: search_candidates: base="cn=graylion,ou=personal,ou=contacts,dc=graylion,dc=net" (0x00000019) scope=1 Mar 3 16:29:29 diskslave slapd[12582]: => bdb_dn2idl( "cn=graylion,ou=personal,ou=contacts,dc=graylion,dc=net" ) Mar 3 16:29:29 diskslave slapd[12582]: <= bdb_dn2idl: id=1 first=28 last=28 Mar 3 16:29:29 diskslave slapd[12582]: => bdb_equality_candidates (objectClass) Mar 3 16:29:29 diskslave slapd[12582]: => key_read Mar 3 16:29:29 diskslave slapd[12582]: <= bdb_index_read: failed (-30990) Mar 3 16:29:29 diskslave slapd[12582]: <= bdb_equality_candidates: id=0, first=0, last=0 Mar 3 16:29:29 diskslave slapd[12582]: => bdb_equality_candidates (objectClass) Mar 3 16:29:29 diskslave slapd[12582]: => key_read Mar 3 16:29:29 diskslave slapd[12582]: <= bdb_index_read 7 candidates Mar 3 16:29:29 diskslave slapd[12582]: <= bdb_equality_candidates: id=7, first=9, last=28 Mar 3 16:29:29 diskslave slapd[12582]: bdb_search_candidates: id=1 first=28 last=28 Mar 3 16:29:29 diskslave slapd[12582]: entry_decode: "uid=325b9c76485ab753ed53ed9f496793c6,cn=graylion,ou=personal,ou=contacts,dc=graylion,dc=net" Mar 3 16:29:29 diskslave slapd[12582]: <= entry_decode(uid=325b9c76485ab753ed53ed9f496793c6,cn=graylion,ou=personal,ou=contacts,dc=graylion,dc=net) Mar 3 16:29:29 diskslave slapd[12582]: => bdb_dn2id( "uid=325b9c76485ab753ed53ed9f496793c6,cn=graylion,ou=personal,ou=contacts,dc=graylion,dc=net" ) Mar 3 16:29:29 diskslave slapd[12582]: <= bdb_dn2id: got id=0x0000001c Mar 3 16:29:29 diskslave slapd[12582]: => access_allowed: search access to "uid=325b9c76485ab753ed53ed9f496793c6,cn=graylion,ou=personal,ou=contacts,dc=graylion,dc=net" "objectClass" requested Mar 3 16:29:29 diskslave slapd[12582]: => dn: [2] Mar 3 16:29:29 diskslave slapd[12582]: => acl_get: [3] attr objectClass Mar 3 16:29:29 diskslave slapd[12582]: => acl_mask: access to entry "uid=325b9c76485ab753ed53ed9f496793c6,cn=graylion,ou=personal,ou=contacts,dc=graylion,dc=net", attr "objectClass" requested Mar 3 16:29:29 diskslave slapd[12582]: => acl_mask: to value by "uid=graylion,ou=users,dc=graylion,dc=net", (=n) Mar 3 16:29:29 diskslave slapd[12582]: <= check a_dn_pat: cn=admin,dc=graylion,dc=net Mar 3 16:29:29 diskslave slapd[12582]: <= acl_mask: no more <who> clauses, returning =n (stop) Mar 3 16:29:29 diskslave slapd[12582]: => access_allowed: search access denied by =n Mar 3 16:29:29 diskslave slapd[12582]: bdb_search: 28 does not match filter Mar 3 16:29:29 diskslave slapd[12582]: send_ldap_result: conn=11 op=1 p=3 Mar 3 16:29:29 diskslave slapd[12582]: send_ldap_response: msgid=2 tag=101 err=0 Mar 3 16:29:29 diskslave slapd[12582]: conn=11 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on 1 descriptors Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on: Mar 3 16:29:29 diskslave slapd[12582]: 13r Mar 3 16:29:29 diskslave slapd[12582]: Mar 3 16:29:29 diskslave slapd[12582]: daemon: read activity on 13 Mar 3 16:29:29 diskslave slapd[12582]: connection_get(13): got connid=11 Mar 3 16:29:29 diskslave slapd[12582]: connection_read(13): checking for input on id=11 Mar 3 16:29:29 diskslave slapd[12582]: ber_get_next on fd 13 failed errno=11 (Resource temporarily unavailable) Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=6 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=7 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: do_unbind Mar 3 16:29:29 diskslave slapd[12582]: conn=11 op=2 UNBIND Mar 3 16:29:29 diskslave slapd[12582]: connection_closing: readying conn=11 sd=13 for close Mar 3 16:29:29 diskslave slapd[12582]: connection_resched: attempting closing conn=11 sd=13 Mar 3 16:29:29 diskslave slapd[12582]: connection_close: conn=11 sd=13 Mar 3 16:29:29 diskslave slapd[12582]: daemon: removing 13 Mar 3 16:29:29 diskslave slapd[12582]: conn=11 fd=13 closed Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on 1 descriptors Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=6 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=7 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on 1 descriptors Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on: Mar 3 16:29:29 diskslave slapd[12582]: 10r Mar 3 16:29:29 diskslave slapd[12582]: Mar 3 16:29:29 diskslave slapd[12582]: daemon: read activity on 10 Mar 3 16:29:29 diskslave slapd[12582]: connection_get(10): got connid=9 Mar 3 16:29:29 diskslave slapd[12582]: connection_read(10): checking for input on id=9 Mar 3 16:29:29 diskslave slapd[12582]: ber_get_next on fd 10 failed errno=11 (Resource temporarily unavailable) so this looks like the cinch to me: Mar 3 16:29:29 diskslave slapd[12582]: bdb_search: 28 does not match filter any idea what is wrong? thanks Bernhard -- Graylion's Fetish & Fashion Store Goth and Kinky Boots, Clothing and Jewellery http://www.graylion.net

1 0

ldbm bdb Conversion
by Net Warrior 01 Mar '07

01 Mar '07

Hi there guys. I was just wondering if there is a tool to convert an ldbm database to the new bdb backend. Thanks in advance.

3 4

"error in SSLv3 flush data" when connecting from network
by Antonis Christofides 01 Mar '07

01 Mar '07

Hi, Summary: A tls connection between a client and a 2.3.30 slapd hangs while the server is giving the certificate; but this does not happen if the server is run with -d 2 or higher, or if the client is the server itself. Details: (A seemingly similar issue has been reported before, without satisfactory reply, 4 years ago: http://www.openldap.org/lists/openldap-software/200210/msg00459.html) My slapd is the Debian-etch-packaged 2.3.30. If I run a ldapsearch -ZZ on the server, it runs fine. If I try to run the same thing from a client through the network, then the connection hangs (I tried this from three clients). After I hit Enter, the client stays there and it appears to wait forever until interrupted. If I use -d 1 on both the client and the server, then the client hangs after it has displayed TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 0, subject: /C=GR/L=Athens/O=National Technical University of Athens/OU=ITIA Research Team/CN=www.itia.ntua.gr/emailAddress=sysadmins(a)itia.ntua.gr, issuer: /C=GR/L=Athens/O=National Technical University of Athens/OU=ITIA Research Team/CN=www.itia.ntua.gr/emailAddress=sysadmins(a)itia.ntua.gr TLS trace: SSL_connect:SSLv3 read server certificate A and the server has displayed TLS trace: SSL_accept:before/accept initialization TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write certificate request A TLS trace: SSL_accept:error in SSLv3 flush data TLS trace: SSL_accept:error in SSLv3 flush data But if I use -d 2 or higher on the server, then the connection succeeds. (Increasing -d on the client does not appear to affect it.) Could you suggest how to search into it next? Because I'm lost. I thought it might have to do with networking hardware, but ping -f from one client to the server runs fine, with no packet loss, and nfs (which I've noticed to be most sensitive to networking hardware issues) also runs fine. The three clients where through Gigabit, 100 MBits, and 10 MBits. Two of them were running ubuntu-edgy-packaged ldap-utils 2.2.26, one was running debian-etch-packaged 2.3.30. All had identical behaviour.

2 5

ldapsearch across back-sql and non-back-sql tree
by Robert Brooks 01 Mar '07

01 Mar '07

I have a back-sql portion of my ldap tree, I can search within the back-sql part of the tree (and within the ldbm), but searches do not cross from the ldbm tree into the back-sql part of the tree. Should I make a referal in the ldbm tree at the point the back-sql tree is mounted, or is there a better way to do this? Regarrds, Rob

5 5

LDAP 'virtual' operations
by Mark Mcdonald 01 Mar '07

01 Mar '07

Is there a way to perform a change operation in OpenLDAP that does not commit the final data? Essentially I want to do a dry insert, where I can find out if the data to insert conforms to the defined schema without actually writing to the DB. Technically I know it can be done by other mechanisms but this is more of an academic question I guess. Thanks, Mark Mark McDonald iiNet Limited

3 2

reg OpenLdap installation
by shilpa muramkar 01 Mar '07

01 Mar '07

I have installed openldap on my machine. In the slapd.conf file i have included all the schema files. I need to import our directory server data into OpenLdap now. Hence i have done the below things.... 1) Created a schema file containing our data and included it in the slapd.conf. 2) Created an ldif file, and tried importing our data using "ldapmodify" command. I am facing few problems. Looks like my schema file isnt being referred by openldap as....even when i comment my schema file and run, the service is starting. That shows my schema file isnt creating any impact there. What i did is,,,,,i took some of our required ObjectClasses and included them in the "misc.schema" file of OpenLdap just for a trial. Few of them worked properly and my data from ldif got added into the server. I still have few attributes and ObjectClasses which i am neither able to add into any of OpenLdap's schema files nor create a new schema file and add( as OpenLdap isnt referring to it). Can someone guide me as to how to easily get my schema and data added to the server. If i have to create a schema file of my own.....in that case..how do i make the server refer to that as well........... Eagerly awaiting the reply....... Thanks Shilpa

3 2

Beginners question
by Jan Mostert 01 Mar '07

01 Mar '07

5 4

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software March 2007