openldap-software August 2007

openldap-software@openldap.org

77 participants
93 discussions

database meta question
by D'Arcy Smith 28 Aug '07

28 Aug '07

Hi all, I am having a terrible time trying to get the meta backend to work with my setup. If I do not have meta things work as expected. As soon as I add the meta backend thing go south. Partial slapd.conf: database ldap suffix "o=a.y.x,o=y" uri ldap://a.y.z:389/ idassert-authzFrom "dn:*" idassert-bind bindmethod=simple binddn="uid=foo,ou=people,o=a.y.z,o=y" credentials="**********" mode=none database bdb suffix "o=b.y.z,o=bcit" checkpoint 32 30 # <kbyte> <min> rootdn "cn=Manager,o=b.y.z,o=y" rootpw {MD5}********== directory /var/lib/openldap-data index objectClass eq database meta suffix "o=y.z,o=y" uri "ldap://foo.bar.star:389/o=a.y.z,o=y" rwm-rewriteEngine on rwm-rewriteContext default twm-rewriteRule "(.*)o=y.z,o=y" "%1o=a,y.z,o=y" rwm-rewriteContext searchResult rwm-rewriteRule "(.*)o=a.y.z,o=y" "%1o=y.z,o=y" rwm-map attribute * * uri "ldap://foo.bar.com:389/o=b.y.z,o=y" rwm-rewriteEngine on rwm-rewriteContext default twm-rewriteRule "(.*)o=y.z,o=y" "%1o=b,y.z,o=y" rwm-rewriteContext searchResult rwm-rewriteRule "(.*)o=b.y.z,o=y" "%1o=y.z,o=y" rwm-map attribute * * When I run slapd with -d -1 I get (in part): config_back_db_open backend_startup_one: starting "o=a.y.z,o=y" ldap_back_db_open: URI=ldap://a.y.z:389 backend_startup_one: starting "o=b.y.z,o=y" bdb_db_open: o=b.y.z,o=y bdb_db_open: dbenv_open(/var/lib/openldap-data) backend_startup_one: starting "o=y.z,o=y" meta_back_db_open: no targets defined backend_startup_one: bi_db_open failed! (1) So, it seems that "meta" is finding no targets... Any ideas? Thanks, ..darcy

3 3

Question about ldap backend
by Diego de Felice 28 Aug '07

28 Aug '07

Hi to all, I'm testing the backend ldap in order to make a proxy for an existing OpenLDAP instance (call it REAL). As stated in the manual, the ldap database is like a proxy. After configuring the "proxy" LDAP server (call it PROXY) I'm able to read the real content of REAL from PROXY, so the proxing is working well, but when I try to modify something on PROXY, instead of doing the change on REAL, OpenLDAP gives me this error: ldap_chase_referrals read1msg: V2 referral chased, mark request completed, id = 7 new result: res_errno: 8, res_error: <modifications require authentication>, res_matched: <> read1msg: 0 new referrals read1msg: mark request completed, id = 7 request 7 done res_errno: 8, res_error: <modifications require authentication>, res_matched: <> Following the documentation I configured the PROXY server, so this is the main configuration in slapd.conf of PROXY: database ldap uri "ldap://localhost:389" bindmethod=simple binddn="cn=root,o=Test,c=IT" credentials="password" suffix "o=Test,c=IT" rootdn "cn=root,o=Test,c=IT" rootpw password I've not touched the REAL slapd.conf. Where am I wrong ? -- Diego

2 2

slapd loses meta backends
by Hans Moser 28 Aug '07

28 Aug '07

Hi! After weeks of running slapd 2.3.27 suddenly quits answering requests, instead it says "no such objects" - where are objects. After a restart all data is back again. Is this a known error (to heal by update - what I will do anyway)? Hans ----------- conf: include /opt/mail/etc/openldap/schema/core.schema include /opt/mail/etc/openldap/schema/cosine.schema include /opt/mail/etc/openldap/schema/inetorgperson.schema include /opt/mail/etc/openldap/schema/dyngroup.schema include /opt/mail/etc/openldap/schema/openldap.schema include /opt/mail/etc/openldap/schema/nis.schema include /opt/mail/etc/openldap/schema/authldap.schema pidfile /opt/mail/var/slapd.pid argsfile /opt/mail/var/slapd.args loglevel 489 TLSCACertificateFile /opt/mail/etc/openldap/ssl/ca2006.pem TLSCertificateFile /opt/mail/etc/openldap/ssl/cert2006.pem TLSCertificateKeyFile /opt/mail/etc/openldap/ssl/key2006.pem defaultsearchbase "ou=Proxy,ou=foo,o=bla,c=de" ####################################################################### # BDB database definitions ####################################################################### database monitor access to dn.subtree="cn=monitor" by * read database meta suffix "ou=Proxy,ou=foo,o=bla,c=de" uri "ldap://edir.niedersachsen.de/ou=foobar,ou=Proxy,ou=foo,o=bla,c=de" suffixmassage "ou=foobar,ou=Proxy,ou=foo,o=bla,c=de" "ou=foobar,o=bla,c=de" uri "ldap://edir.niedersachsen.de/ou=AllgV,ou=Proxy,ou=foo,o=bla,c=de" suffixmassage "ou=AllgV,ou=Proxy,ou=foo,o=bla,c=de" "ou=Exchange-Verbund,o=bla,c=de" access to dn.subtree="ou=Proxy,ou=foo,o=bla,c=de" by * read

2 3

Can't add Organizational Unit
by Daniel Guerrero 28 Aug '07

28 Aug '07

Hi all, I'm trying to add an ldif with the definition of a organizational unit, and an error message appears: bdb_db_open: database already in use backend_startup_one: bi_db_open failed! (-1) slap_startup failed I search for some solution on the web and i found these: http://www.openldap.org/lists/openldap-software/200511/msg00143.html Where was told to me that some instance of slapd was already using the database. So, i try to stop (and/or reboot) the slapd process. Then another error appears: bdb_db_open: Warning - No DB_CONFIG file found in directory /usr/local/var/openldap-data: (2) Expect poor performance for suffix dc=intranet,dc=techno,dc=com. => bdb_tool_entry_put: id2entry_add failed: DB_KEYEXIST: Key/data pair already exists (-30996) => bdb_tool_entry_put: txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) slapadd: could not add entry dn="ou=h350,dc=intranet,dc=techno,dc=com" (line=6): txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) I think i must not stop the slapd process, but restarting it the first error appears again. Can anyone guide me? Thank you very much, Daniel.

2 6

Re: successful ldapsearch -- need to turn it into a working slapd configuration for an LDAP proxy
by Pierangelo Masarati 27 Aug '07

27 Aug '07

DePriest, Jason R. wrote: > idassert-bind bindmethod=simple > binddn="cn=LDAP-proxy,ou=Service Accounts,dc=subdomain,dc=domain,dc=com" > credentials="{SHA}Ww4fMMtpcdtvJKh2wyC8t/3gu7E=" > mode=self > flags=non-prescriptive If you use simple bind, credentials need to go in cleartext. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

3 6

slapadd: dn="dc=test, dc=ekool, dc=ee" (line=6): (64) value of naming attribute 'dc' is not present in entry
by Villem Alari 27 Aug '07

27 Aug '07

Hi! I have error slapadd: dn="dc=test,dc=ekool,dc=ee" (line=6): (64) value of naming attribute 'dc' is not present in entry. What is wrong? Here is my slapd.conf: # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=test,dc=ekool,dc=ee" rootdn "cn=admin,dc=test,dc=ekool,dc=ee" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. #rootpw {SSHA}wSazqIGcA2pdI5/qTKTIswD+sFp66HKV # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq and my ldif: n: dc=test,dc=ekool,dc=ee objectclass: dcObject objectclass: organization o: Koolitoode AS dc: test.ekool dn: cn=admin,dc=test,dc=ekool,dc=ee objectclass: organizationalRole cn: admin Regards, Villem Alari e-post: villem(a)ekool.ee mobiil: +37253939163

3 2

allow changing userPassword only through extended operations?
by manu＠netbsd.org 27 Aug '07

27 Aug '07

Hello Is there a way to write an ACL so that userPassword could only be changed by an extended operation, and not by a simple attribute modification? -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

3 2

Re: database meta question
by Pierangelo Masarati 25 Aug '07

25 Aug '07

> Hi Pierangelo , > > I hope you don't mind the direct mail... Yes, I do. My employer also does, since I'm using their IT resources to answer private mails about what they usually ask me to do for business, and you're not one of their customers. > I just don't want to make > public the names bing used. Since you sent them by unencrypted email, they're already public. Moreover, I don't see anything really confidential in what you sent. And, I don't feel bound to any confidentiality, since we didn't sign any NDA. However, I'm removing anything you considered sensitive from this response, by now. > I am using openldap-2.3.35. Good. Not the latest, but the proxy backends should be safe. However, you need to understand that there is a trivial error in your configuration. If you enable config log level, slapd (or slaptest) will tell you where the error is. It is not clear what you want to do. Asking why a configuration is not correct is usually the wrong question, because it only leaves room for partial answers, like "fix syntax errors" (which are usually already answered by man pages, FAQs & co., BTW). If you explain what you want to obtain, perhaps someone can tell you how to obtain it. Perhaps, from the multiple answers you might get, you can learn how things work, and how to make them work best. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Schema difficulties-Openldap 2.0.27 -> 2.3.34
by Scott Lacy 25 Aug '07

25 Aug '07

Hi all, I'm attempting to migrate an openldap implementation from a 2.0.27 server running the Red Hat Enterprise 3 rpm to a new box running the 2.3.34 Fedora 7 rpm. I'm a bit of an LDAP noob, but I've managed to account for most of the difficulties, but still have one I can't seem to get around: There are a handful of users in the old database that have errors being migrated via ldif. These users are erroring out in their uidNumber field. These users have uidNumbers beginning with leading zeros, for example, "0001111114". I'm assuming that's a syntax no-no. I believe uidNumber is one of the fields hardcoded into Openldap now (I don't see non-commented definitions for it in any of the schema files I have). Is there a way to doctor the syntax for this field short of editing and compiling via source? It is apparently important that the leading zeros be there, else I would just take them out. Thanks, Scott Lacy Mercer University

4 5

slapo-dynlist search member=value search?
by Aleksander Adamowski 25 Aug '07

25 Aug '07

Hi! From reading the FAQ entry on dynlist (http://www.openldap.org/faq/data/cache/1209.html) it would seem that dynlist with member DN expansion lets me operate in two directions: 1. have an attribute dynamically expanded (e.g. for mapping a group to its members), e.g. '(cn=somedynamicgroup)' -> { member: uid=someuser,ou=People,o=SomeOrg, member: uid=otheruser,ou=People,o=SomeOrg } 2. search for dynamic objects whose dynamic attribute expands to given DN (e.g. for location all groups a given user is a member of), e.g. '(member=uid=someuser,ou=People,o=SomeOrg)' -> { dn: cn=somedynamicgroup,ou=Groups,o=MyOrg, dn: cn=somestaticgroup,ou=Groups,o=MyOrg} To be specific, this fragment in the FAQ describes it: --- SNIP --- dynlist-attrset groupOfURLs memberURL member it behaves much like the dyngroup overlay; the <attrs> portion of the URI must be absent, and the DN of the entries resulting from the search is added as value of the member attribute defined above. *For compare operations on the member attribute, all the values of the memberURL attribute of groupOfURLs objects are compared until a match is found; this exploits slapd group caching capabilities. *--- SNIP --- Also, the slapo-dynlist manual states: --- SNIP --- Compares that assert the value of the <member-ad> attribute of entries with <group-oc> objectClass apply as if the DN of the entries resulting from the expansion of the URI were present in the <group-oc> entry as values of the <member-ad> attribute. --- SNIP --- I have the following configuration: --- fragment of BDB instance config --- index member eq,pres overlay dynlist dynlist-attrset groupOfURLs memberURL member --- end fragment of BDB instance config --- The member expansion works: ldapsearch -b 'o=MyOrg' -x -D 'cn=Manager,o=MyOrg' -H 'ldap://localhost' -y ~/ldappass 'cn=somedynamicgroup' .... member: uid=someuser,ou=People,o=SomeOrg member: uid=otheruser,ou=People,o=SomeOrg ... But searching for groups a user is a member of doesn't work for dynamic groups: ldapsearch -b 'o=MyOrg' -x -D 'cn=Manager,o=MyOrg' -H 'ldap://localhost' -y ~/ldappass 'member=uid=someuser,ou=People,o=SomeOrg' dn: cn=somestaticgroup,ou=Groups,o=SomeOrg .... As a result no dynamic groups are found, only static ones. Am I missing something in the configuration?* * -- Best Regards, Aleksander Adamowski GG#: 274614 ICQ UIN: 19780575 http://olo.org.pl -- Aleksander Adamowski Administrator systemów korporacyjnych; Instruktor Altkom Akademia S.A. http://www.altkom.pl Warszawa, ul. Chłodna 51 kom. 0-601-318-080 Sąd Rejonowy dla m.st. Warszawy w Warszawie, XII Wydział Gospodarczy Krajowego Rejestru Sądowego, KRS: 0000120139, NIP 118-00-08-391, Kapitał zakładowy: 1000 000 PLN. Adres rejestrowy Firmy - ul. Stawki 2, 00-193 Warszawa. Niniejsza wiadomość zawiera informacje zastrzeżone i stanowiące tajemnicę przedsiębiorstwa firmy Altkom Akademia S.A. Ujawnianie tych informacji osobom trzecim lub nieuprawnione wykorzystanie ich do własnych celów jest zabronione. Jeżeli otrzymaliście Państwo niniejszą wiadomość omyłkowo, prosimy o niezwłoczne skontaktowanie się z nadawcą oraz usunięcie wszelkich kopii niniejszej wiadomości. This message contains proprietary information and trade secrets of Altkom Akademia S.A. company. Unauthorized use or disclosure of this information to any third party is prohibited. If you received this message by mistake, please contact the sender immediately and delete all copies of this message.

3 7

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software August 2007