openldap-software May 2007

openldap-software@openldap.org

85 participants
123 discussions

help with meta backend
by Ulf Möller 11 May '07

11 May '07

Hello, I have a problem with OpenLDAP/back-meta in a certain setup. It sometimes stops responding to search requests. From trying to set a breakpoint in the debugger and from the syslog messages it seems that OpenLDAP doesn't jump into back-meta any more when the situation occurs. The system usually works ok for several days or weeks before the problem occurs. The setup it OpenLDAP 2.3.35 (with some code modifications in back-meta, but the same problem occurred with the unmodified code) which connects to another OpenLDAP/back-meta installation behind a firewall and one other directory. Both installations are on similar Linux machines, the second OpenLDAP installation has been running without problems since I upgraded it to OpenLDAP 2.3.34 as advised in ITS#4850. What can I do to track down the problem? Thanks Ulf Möller ____________________________________ Ulf Möller Senior Consultant Secardeo GmbH Office +49 (0)89 - 18 93 589-5 Fax +49 (0)89 - 18 93 589-9 E-mail ulf.moeller <mailto:ulf.moeller@secardeo.com> @secardeo.com Secardeo GmbH Betastrasse 9a D-85774 Unterföhring Web <http://www.secardeo.de/> http://www.secardeo.de Geschäftsführer: Dr. Gunnar Jacobson Amtsgericht München HRB 137969 ____________________________________

3 3

Delta-syncrepl and latency
by Sam Tran 11 May '07

11 May '07

Hi All, I am testing delta-syncrepl using OpenLDAP 2.3.35 (+ fixes ITS#4924 and fixes ITS#4925) and Berkeley DB 4.5.20 on Centos 5. I have a provider with the following configuration: #------------------------------------------------- # Accesslog DB definition (slapo-accesslog) #------------------------------------------------- # Access logging overlay database hdb suffix "cn=accesslog" rootdn "cn=root,cn=accesslog" directory /var/lib/ldap/accesslog index default eq index entryUUID,entryCSN,objectClass,reqEnd,reqResult,reqStart # Let the replica DN have limitless searches limits dn.exact="cn=syncrepl,ou=Accounts,ou=Apps,dc=example,dc=com time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited #------------------------------------------------- # End of Accesslog DB definition (slapo-accesslog) #------------------------------------------------- # Syncrepl overlay - Provider configuration for suffix "cn=accesslog" overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE #------------------------------------------------- # Primary database definition #------------------------------------------------- database hdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw secret directory /var/lib/ldap/example.com cachesize 5000 idlcachesize 2000 checkpoint 512 10 index objectClass,uidNumber,gidNumber,memberUid,employeeNumber eq,pres index employeeType,accountActive,ftpActive,mailActive,vacationActive,ou,mailRoutingAddress eq index cn,mail,surname,givenname eq,pres,subinitial index displayName,gecos,telephoneNumber sub,subany index uid,aliasUid eq,sub,subany index entryUUID,entryCSN eq # Let the replica DN have limitless searches limits dn.exact="cn=syncrepl,ou=Accounts,ou=Apps,dc=example,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited #------------------------------------------------- # End of primary database definition #------------------------------------------------- # Syncrepl - Provider configuration overlay syncprov syncprov-checkpoint 100 30 syncprov-sessionlog 100 # Access Logging overlay overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logpurge 28+00:00 01+00:00 Here is the configuration of the consumer: ############################################################# # Syncrepl - Consumer configuration ############################################################# syncrepl rid=006 provider=ldaps://provider.example.com:636 bindmethod=simple binddn="cn=syncrepl,ou=Accounts,ou=Apps,dc=example,dc=com" credentials=secret type=refreshAndPersist retry="5 +" searchbase="dc=example,dc=com" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on syncdata=accesslog I've been running some LDAP writes (batches of 10 to 10000 sequential writes) on the provider to test the replication on the consumer. Sometimes I observed some latency up to 35 sec. on the consumer with the following messages in the logs: May 8 16:52:08 info-ldap-006 slapd[24480]: do_syncrep2: rid 006 Can't contact LDAP server May 8 16:52:08 info-ldap-006 slapd[24480]: do_syncrepl: rid 006 retrying Some other times, there was not replication at all until I restarted the consumer. Am I missing something in the configuration? Please could you shed some light on the matter? Thanks in advance. Sam

2 9

ppolicy and admins
by Joseph Bruni 11 May '07

11 May '07

Hello, I am using openldap 2.3.30 with the ppolicy module enabled. I have configured the policy pwdMinAge to three days, and this works. However, I would like our administrators to be able to reset a password regardless of the policy, without resorting to the admins using the "rootdn" account. Is there a way to write the ACL's to allow admins to modify the userPassword regardless of the pwdPolicySubentry attached to the entry? Thanks Joe Bruni

1 0

{ldapsearch|ldapadd|ldapmodify} -y passwfile fails
by Mark Par 11 May '07

11 May '07

Hi, I'm getting an error using the -y switch for the ldapsearch, ldapadd, and ldapmodify programs when specifying the password. I do, however, get positive results when using the -w switch. Using ldapsearch, the exact command and error are: $ ldapsearch -H ldap://10.0.0.2 -x -D 'cn=manager,dc=company,dc=com' -y passwdfile -b 'ou=people,dc=company,dc=com' '(uid=mark.par)' ldap_bind: Invalid credentials (49) $ $ ldapsearch -H ldap://10.0.0.2 -x -D 'cn=manager,dc=company,dc=com' -w PassWord -b 'ou=people,dc=company,dc=com' '(uid=mark.par)' # extended LDIF # # LDAPv3 # base <ou=people,dc=company,dc=com> with scope subtree # filter: (uid=mark.par) # requesting: ALL # # mark.par, people, company.com dn: uid=mark.par,ou=people,dc=company,dc=com objectClass: top objectClass: account objectClass: posixAccount homeDirectory: /home/mark.par cn: mark par uid: mark.par loginShell: /bin/ksh userPassword:: aWFrem9rLkdyeW61 uidNumber: 1177 gidNumber: 1177 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 $ I am using NetBSD 3.1.0_PATCH and OpenLDAP 2.3.32 compiled from the packages collection (pkgsrc). Could anyone provide some hints? Thanks, Mark

2 2

simple ACL requirement, grant access to modify myself and my sub entries, not sure how to do it
by Zhang Weiwu 10 May '07

10 May '07

Dear all. In my installation it's required if someone logs in, he can modify his own entry and can modify & delete & create entries of his own entry, e.g. login as: dn: ou=Support,o=Real Softservice Then I should be able to modify & delete & create: dn: cn=Wang Penghui,ou=Suport,o=Real Softservice dn: cn=Zhang Weiwu,ou=Suport,o=Real Softservice dn: cn=Wolfgang Scheuing,ou=Suport,o=Real Softservice Looks like a simple requirement. Anyway I dug into ACL manual for days without a clue (maybe also because of my bad English). Can anyone provide a hint and simplified example? Thanks a lot in advance! -- Zhang Weiwu Real Softservice http://www.realss.com +86 592 2091112

4 4

mapping
by Raffaele Viola 10 May '07

10 May '07

Hi all, I have two database with a different schema hosted on two different ldap server front-ldap and back-ldap. How can I use the *rwm-map *option to include one back-ldap sub-tree as a front-ldap sub tree. Now I'm using these lines and seems doesn't work: database ldap suffix "ou=UK_grp,ou=people,dc=AEL,dc=IT" overlay rwm rwm-suffixmassage "ou=UK_grp,ou=people,dc=AEL,dc=IT" "o=people,dc=RAFFO,dc=ITA" uri "ldap://151.98.181.64/" idassert-bind bindmethod=simple binddn="cn=Manager,dc=RAFFO,dc=ITA" credentials=secret rwm-map objectclass top top rwm-map objectclass organizationalUnit organization rwm-map attribute ou o rwm-map objectclass cmmContact person rwm-map attribute sn sn rwm-map attribute cn cn subordinate _______________________________________________________ front-ldap schema: ou=UK_grp (l:UK_grp , ou:UK_grp , objectClass:top , objectClass organizationalUnit ) | |----cn=Raffo (objectClass:MyContact , sn:raffo , cn:raffo) _______________________________________________________ back-ldap schema: o=UK_grp(l:UK_grp, o:UK_grp, objectClass:top , objectClass organization ) | |----cn=Raffo (objectClass:person , sn:raffo , cn:raffo) Thanks Raffo

1 0

'idassert' feature support on 2.3 branch in back-meta
by Daniel Montero Motilla 09 May '07

09 May '07

Hi, I'm actually using openldap 2.3.27 with meta backend, and digging on 2.3.35 code I have found that 'idassert' feature seems to be recently ported to back-meta on branch 2.3, but there is no reference to this feature on man pages or changelog. Is that feature a work in progress in back-meta 2.3 or is it ready to be used? Thanks, Dani.

2 1

posixGroup
by Karen R McArthur 09 May '07

09 May '07

Annoyingly, some applications require the entire dn of a user be in the memberUid field and others only require the memberUid. On some posixGroups, I end up having the following: cn: grpname objectClass: top objectClass: posixGroup gidNumber: 550 memberUid: uid=user1,ou=People,dc=example,dc=com memberuid: user1 memberUid: uid=user2,ou=People,dc=example,dc=com memberuid: user2 Is there any way to map one to the other so I do not end up having "duplicate" entries? Thank you, -- Karen R. McArthur <kmcarthu(a)bates.edu> Systems Administrator Information and Library Services, Bates College Lewiston, Maine 04240 USA ph:(207)786-8236 fax:(207)786-6057

3 3

openldap logs
by Raffaele Viola 09 May '07

09 May '07

Hi all, how can I activate the openldap logs and where I can see the logs? Thanks Raffo

5 7

ACL's and write permission.
by lauro＠npd.ufsc.br 09 May '07

09 May '07

I went thru slapd.access and slapacl manuals, read the FAQ but I'm stuck. I cannot give some user privilege to write to some parts of my LDAP tree. LDIF export of the relevant parts of my tree: ---------------------------- # Exportação LDIF para: cn=admin,dc=sub,dc=domain,dc=xyz,dc=xy # Servidor: ldap sub.domain.xyz.xy (127.0.0.1) # Abrangência da Busca: sub # Filtro de Busca: (objectClass=*) # Total de objetos: 1 dn: cn=admin,dc=sub,dc=domain,dc=xyz,dc=xy objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: Administrador LDAP # Exportação LDIF para: ou=moodleusers,dc=sub,dc=domain,dc=xyz,dc=xy # Servidor: ldap sub.domain.xyz.xy (127.0.0.1) # Abrangência da Busca: base # Filtro de Busca: (objectClass=*) # Total de objetos: 1 dn: ou=moodleusers,dc=sub,dc=domain,dc=xyz,dc=xy ou: moodleusers objectClass: organizationalUnit objectClass: top # Exportação LDIF para: uid=usuariomoodle-admin,dc=sub,dc=domain,dc=xyz,dc=xy # Servidor: ldap sub.domain.xyz.xy (127.0.0.1) # Abrangência da Busca: sub # Filtro de Busca: (objectClass=*) # Total de objetos: 1 dn: uid=usuariomoodle-admin,dc=sub,dc=domain,dc=xyz,dc=xy uid: usuariomoodle-admin userPassword: ... objectClass: account objectClass: simpleSecurityObject objectClass: top ---------------------------- and now slapd.conf: ---------------------------- # 1 access to dn.base="cn=Subschema" by * read # 2 access to attrs=userPKCS12 by self write by * auth # 3 access to attrs=shadowLastChange by self write by * read # 4 access to attrs=userPassword by dn="cn=admin,dc=sub,dc=domain,dc=xyz,dc=xy" write by anonymous auth by self write by * none # 5 access to dn.base="" by * read # 6 access to * by dn="cn=admin,dc=sub,dc=domain,dc=xyz,dc=xy" write by * read # 7 access to dn="ou=moodleusers,dc=sub,dc=domain,dc=xyz,dc=xy" by dn="uid=usuariomoodle-admin,dc=sub,dc=domain,dc=xyz,dc=xy" write # Previous tries #access to dn.subtree="ou=moodleusers,dc=sub,dc=domain,dc=xyz,dc=xy" # by dn.exact="uid=usuariomoodle-admin,dc=sub,dc=domain,dc=xyz,dc=xy" write #access to dn.children="dc=sub,dc=domain,dc=xyz,dc=xy" # by dn="uid=usuariomoodle-admin,dc=sub,dc=domain,dc=xyz,dc=xy" write #access to * (!) # by dn.exact="uid=usuariomoodle-admin,dc=sub,dc=domain,dc=xyz,dc=xy" write suffix "dc=sub,dc=domain,dc=xyz,dc=xy" rootdn "cn=admin,dc=sub,dc=domain,dc=xyz,dc=xy" rootpw ... ---------------------------- I also tried to set usuariomoodle-admin permissions to "=mwrscxd" since it's the exact output from slapacl for "cn=admin,dc=sub,dc=domain,dc=xyz,dc=xy". Following the acl's in that order I can't find where, if it exists, an acl breaks my acl number 7. I used phpldapadmin, logged as usuariomoodle-admin, could not create child objects, neither modify existing ones. Using the external application (that this acl refers to) to try to write on the ldap tree didn't work. Finally slapacl showed just "rscxd" as the permissions for that user, despite the fact that I set write permission on the slapd.conf for that resource/that user. What's wrong? thanks, lauro ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

2 1

← Newer
1
...
7
8
9
10
11
12
13
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software May 2007