openldap-software May 2007

openldap-software@openldap.org

85 participants
123 discussions

Linuxtag 2007
by Dieter Kluenter 08 May '07

08 May '07

Hello, same procedure as every year :-) OpenLDAP has a booth at Linuxtag 2007, manned with Peter Gietz Michael Stroeder and me. http://www.linuxtag.org/2007 We have some VIP tickets available, whoever wants to attand Linuxtag, please mail me, to get an VIP ticket. -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6

1 0

differend backends under one suffix
by Piotr Wadas 08 May '07

08 May '07

Hello, I'm experimenting with various backends. Is it possible to have different backends under the same suffix? e.g I have database with bdb backend, and suffix dc=foo now, I want dc=bar,dc=foo to be in another database, probably with other backend /ldap, bdb, shell../ In other words - I want two (or more) branches from different servers (or databases), to be available under suffixes of the same main suffix. I'm using newest stable of openldap I could find. Regards, Piotr

2 1

Overlay documentation
by Greg Martin 08 May '07

08 May '07

I spent a bit of time looking around openldap.org & google for documentation on the overlays for slapd (what's available, how they work, etc). I found man docs, but nothing else. Are there administrator docs for these or is the man pages all there is? Thanks \\Greg

4 3

Re: Chain Overlay and Syncrepl
by Pierangelo Masarati 08 May '07

08 May '07

Please keep replies on the list. Scott Sanders wrote: > Thank you for the rapid response. > > Even if I move the 7 lines defining the chain overlay above the database > definition I am seeing the same results. For testing, I moved those lines > between the argsfile directive and the password-hash directive. You should verify from the slave's and the master's logs that an attempt is made to chase the referral, and determine why it fails. All in all, if your build passes test007 and test018 the overlay is working fine, and I don't see anything odd in your configuration, at a first glance. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

2 1

Chain Overlay and Syncrepl
by Scott Sanders 08 May '07

08 May '07

Hello all, I am having problems with chasing referrals on my slave OpenLDAP server. I feel like I'm repeating an older thread here, but despite everything I have read I cannot find a solution. My setup is as follows: Both the master and the slave are OpenLDAP 2.3.32 builds with the follwing configure parameters, LD_LIBRARY_PATH="/usr/local/lib" ./configure --prefix=/usr/local --disable-ipv6 --with-tls --enable-dynamic --enable-slapd --enable-modules --enable-crypt --enable-bdb --enable-rewrite --enable-backends=yes --enable-rlookups --disable-shell --disable-sql --enable-overlays=yes --enable-slurpd=yes At the end of the email, I have attached both the master and the slave slapd.conf. The problem is that when I attempt an ldapadd against the slave server, I am returned a referral instead of having the slave forward the request to the master. I see no attempt to contact the master server in either the slave or master logs. Nor do I see any traffic between the two (other than syncrepl stuff) in a tcpdump. As far as I can tell the chain overlay is being ignored entirely. Any suggestions or fixes would be greatly appreciated. - Scott Sanders ############################################ # Master slapd.conf -- ldap://info.domain.com:389 ############################################ include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args password-hash {ssha} security tls=1 TLSCACertificateFile /etc/pki/CA/cacert.pem TLSCACertificatePath /etc/pki/CA TLSCertificateFile /usr/local/etc/openldap/security/ldap-master.crt TLSCertificateKeyFile /usr/local/etc/openldap/security/ldap-master.key TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSVerifyClient allow limits dn.exact="cn=syncuser,dc=domain,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited access to attrs=userPassword by self write by dn="cn=admin,dc=domain,dc=com" write by dn="cn=syncuser,dc=domain,dc=com" read by * auth access to * by dn="cn=admin,dc=domain,dc=com" write by dn="cn=syncuser,dc=domain,dc=com" read by dn="cn=syncuser,dc=domain,dc=com" read by * read database hdb suffix cn=accesslog directory /usr/local/var/openldap-accesslog rootdn cn=accesslog index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE database bdb suffix "dc=domain,dc=com" rootdn "cn=admin,dc=domain,dc=com" rootpw {SSHA}T2JGZSB3Q2x57s/O directory /usr/local/var/openldap-data index objectClass eq index entryCSN eq index entryUUID eq overlay syncprov syncprov-checkpoint 1000 60 overlay accesslog logdb cn=accesslog logops writes logsuccess true logpurge 07+00:00 01+00:00 ############################################ # Slave slapd.conf -- ldap://arch.domain.com ############################################ include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args password-hash {ssha} security tls=1 TLSCACertificateFile /etc/pki/CA/cacert.pem TLSCACertificatePath /etc/pki/CA TLSCertificateFile /usr/local/etc/openldap/security/ldap-slave.crt TLSCertificateKeyFile /usr/local/etc/openldap/security/ldap-slave.key TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSVerifyClient allow access to attrs=userPassword by self write by dn="cn=admin,dc=domain,dc=com" read by dn="cn=syncuser,dc=domain,dc=com" write by * auth access to * by dn="cn=admin,dc=domain,dc=com" read by dn="cn=syncuser,dc=domain,dc=com" write by * read database bdb suffix "dc=domain,dc=com" rootdn "cn=admin,dc=domain,dc=com" rootpw {SSHA}T2JGZkB3Q2x57s/O overlay chain chain-uri ldap://info.domain.com:389 chain-rebind-as-user TRUE chain-idassert-bind bindmethod=simple binddn="cn=admin,dc=domain,dc=com" credentials=secret mode=self directory /usr/local/var/openldap-data index objectClass eq index entryUUID eq syncrepl rid=0 provider=ldap://info.domain.com:389 starttls=yes bindmethod=simple binddn="cn=syncuser,dc=domain,dc=com" credentials=secretsyncpasswd searchbase="dc=domain,dc=com" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemaChecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog updateref ldap://info.domain.com:389

2 1

Fwd: rewrite rule - turn groupOfNames into posixGroup
by Shane 08 May '07

08 May '07

Hi All, I'm looking for some help in writing a rewrite rule or some other back-ldap etc to "masquerade" some groupOfNames objects as posixGroups - the reason for this is to allow me to move forward with implementing "proper" groups within the LDAP server for use with ACL's etc but to provide backwards compatibility / inter-operability with clients that don't [yet] support groupOfNames I started some work on this a while ago but never got anywhere - only managed to ever get the server to tell me my rules were invalid and it wouldn't start - annoyingly I deleted the rules from the slapd file and now can't find test copy that had them around ...so starting afresh basically and hoping someone else has done this or similar so I don't need to re-invent the wheel. TIA Shane.

2 1

WARNING: No dynamic config support for overlay rwm.
by Raffaele Viola 08 May '07

08 May '07

Hi all, I want to make my ldap to ask request about one sub-tree to another ldap. I'm using these configuration lines: database ldap suffix "ou=UK_grp,ou=people,dc=SUNDAY,dc=IT" overlay rwm rwm-suffixmassage "ou=UK_grp,ou=people,dc=SUNDAY,dc=IT" "o=people,dc=RAFFO,dc=ITA" uri "ldap://151.98.181.64/" acl-bind bindmethod=simple binddn="cn=Manager,dc=RAFFO,dc=ITA" credentials=secret idassert-bind bindmethod=simple binddn="cn=Manager,dc=RAFFO,dc=ITA" credentials=secret rwm-map objectclass cmmContact person subordinate database bdb suffix "dc=SUNDAY, dc=IT" rootdn "cn=Manager,dc=SUNDAY,dc=IT" rootpw secret checkpoint 1024 5 cachesize 10000 but when I execute this command ./slapd -T test, this warning appears: WARNING: No dynamic config support for overlay rwm. Can someone help me? Thanks Raffo

3 2

add back-ldap modules
by Raffaele Viola 08 May '07

08 May '07

Hi all, I downloaded openldap-2.3.35.tgz now I have to add the back-ldap modules to my own installation under gentoo . How can I make it? Raffo

4 4

RE: add back-ldap modules
by Mark Mcdonald 07 May '07

07 May '07

Tony Earnshaw <mailto:tonni@hetnet.nl> wrote on Tuesday, May 08, 2007 7:47 AM: > pkoelle(a)gmail.com skrev, on 07-05-2007 16:57: > >>> I downloaded openldap-2.3.35.tgz now I have to add the back-ldap >>> modules to my own installation under gentoo . >>> How can I make it? Rather than compiling your own modules from source and trying to insert them into a running system compiled from other source (which is generally a Bad Thing) you could try the steps below. >> If you don't have the "minimal" use flag set, back-ldap should be there, >> see the 2.3.35-r1 ebuild for details. Additionally, you have to >> uncomment the modulepath and moduleload directive for back_ldap.la in >> slapd.conf. > > OP's asking how to stuff gained from an OpenLDAP tarball build into a > patent Gentoo setup (Gentoo is derived from Debian, IIRC). You're probably thinking of Ubuntu, Gentoo is closer to BSD than Debian but derived from neither. > The correct answer would be that it can't be done (by a novice). > Alternatively that it *can* be done by someone who has no > need to ask how. However a novice could achieve it by building from source: * Remove your distributions copy of OpenLDAP (emerge --unmerge openldap) * Build the entire thing from source (see http://www.openldap.org/doc/admin23/quickstart.html) Also, if you wish to use 2.3.35 (with the back-ldap modules) on Gentoo, you may need to unmask the package (see http://packages.gentoo.org/packages/?category=net-nds;name=openldap and http://gentoo-wiki.com/Masked).

1 0

No such object error after converting from 2.0.27 to 2.3.32
by Brian Gaber 07 May '07

07 May '07

Took the slapcat output from version 2.0.27 (ldbm) to version 2.3.32 (bdm). Used slapadd on 2.3.32 and am using Berkeley 4.2.52. The slapadd works fine. Then I issued chown ldap:ldap on the /var/lib/ldap-2.3.32 directory and files. Any type of ldapsearch results in a 32 no such object. The identical ldapsearch on the old ldap works fine. Thanks.

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software May 2007