openldap-software September 2007

openldap-software@openldap.org

74 participants
88 discussions

using slapo-pcache with an empty attr list
by Toby Blake 06 Jun '08

06 Jun '08

Hi all, I'm doing a bit of playing with slapo-pcache and have it working fairly well (particularly once I realised that an individual attr can live in only one proxyattrset). However, there's one bit that I can't get working - is there any way to define a template that will match a search which doesn't provide an attr list? i.e. I can see quite a few searches (presumably from amd) of the following form (spacing and formatting changed by me to make it more readable): Jul 23 14:54:16 host1 slapd[26671]: conn=49 op=1 SRCH base="dc=inf,dc=ed,dc=ac,dc=uk" scope=2 deref=0 filter="(&(objectClass=amdmap)(amdmapName=home)(amdmapKey=root))" Jul 23 14:54:16 host1 slapd[26671]: query template of incoming query = (&(objectClass=)(amdmapName=)(amdmapKey=)) Jul 23 14:54:16 host1 slapd[26671]: QUERY NOT ANSWERABLE Jul 23 14:54:16 host1 slapd[26671]: QUERY NOT CACHEABLE Jul 23 14:54:16 host1 slapd[26671]: conn=49 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Note that there's no 'SRCH attr=' line. I've tried proxyattrset of the following forms... proxyattrset 1 * proxyattrset 1 (both of which crash slapd) And also proxyattrset 1 <full list of attrs returned when none specified> .... but this didn't work either. Thanks in advance for any advice, Cheers Toby Blake School of Informatics University of Edinburgh

3 8

OpenLDAP 2.4
by Howard Chu 09 Nov '07

09 Nov '07

The Admin Guide still has not been updated with all of the relevant changes, so here are some notes on new features in the 2.4 release... I believe all of the manpages are up to date, so you can get specifics from them. More complete cn=config functionality: There is a new slapd-config(5) manpage for the cn=config backend. the original design called for auto-renaming of config entries when you insert or delete entries with ordered names, but that was not implemented in 2.3. It is now in 2.4. This means, e.g., if you have olcDatabase={1}bdb,cn=config olcSuffix: dc=example,dc=com and you want to add a new subordinate, now you can: ldapadd olcDatabase={1}bdb,cn=config olcSuffix: dc=foo,dc=example,dc=com this will insert a new BDB database in slot 1 and bump all following databases down one, so the original BDB database will now be named olcDatabase={2}bdb,cn=config olcSuffix: dc=example,dc=com In 2.3 you were only able to add new schema elements, not delete or modify existing elements. In 2.4 you can modify schema at will. (Except for the hardcoded system schema, of course.) More sophisticated syncrepl configurations: the original implementation of syncrepl in OpenLDAP 2.2 was intended to support multiple consumers within the same database, but that feature never worked and was removed from OpenLDAP 2.3. I.e., you could only configure a single consumer in any database. In 2.4 you can configure multiple consumers in a single database. The configuration possibilities here are quite complex and numerous. You can configure consumers over arbitrary subtrees of a database (disjoint or overlapping). Any portion of the database may in turn be provided to other consumers using the syncprov overlay. The syncprov overlay works with any number of consumers over a single database or over arbitrarily many glued databases. As a consequence of the work to support multiple consumer contexts, the syncrepl system now supports full N-way multimaster replication with entry-level conflict resolution. There are some important constraints, of course: In order to maintain consistent results across all servers, you must maintain tightly synchronized clocks across all participating servers (e.g., you must use NTP on all servers). The entryCSNs used for replication now record timestamps with microsecond resolution, instead of just seconds. The delta-syncrepl code has not been updated to support multimaster usage yet, that will come later in the 2.4 cycle. On a related note, syncrepl was explicitly disabled on cn=config in 2.3. It is now fully supported in 2.4; you can use syncrepl to replicate an entire server configuration from one server to arbitrarily many other servers. It's possible to clone an entire running slapd using just a small (less than 10 lines) seed configuration, or you can just replicate the schema subtrees, etc. Tests 049 and 050 in the test suite provide working examples of these capabilities. In 2.3 you could configure syncrepl as a full push-mode replicator by using it in conjunction with a back-ldap pointed at the target server. But because the back-ldap database needs to have a suffix corresponding to the target's suffix, you could only configure one instance per slapd. In 2.4 you can define a database to be "hidden" which means that its suffix is ignored when checking for name collisions, and the database will never be used to answer requests received by the frontend. Using this hidden database feature allows you to configure multiple databases with the same suffix, allowing you to set up multiple back-ldap instances for pushing replication of a single database to multiple targets. There may be other uses for hidden databases as well (e.g., using a syncrepl consumer to maintain a *local* mirror of a database on a separate filesystem). More extensive TLS configuration control: In 2.3, the TLS configuration in slapd was only used by the slapd listeners. For outbound connections used by e.g. back-ldap or syncrepl their TLS parameters came from the system's ldap.conf file. In 2.4 all of these sessions inherit their settings from the main slapd configuration but settings can be individually overridden on a per-config-item basis. This is particularly helpful if you use certificate-based authentication and need to use a different client certificate for different destinations. Various performance enhancements: Too many to list. Some notable changes - ldapadd used to be a couple of orders of magnitude slower than "slapadd -q". It's now at worst only about half the speed of slapadd -q. A few weeks ago I did some comparisons of all the 2.x OpenLDAP releases; the results are in the slides from my SCALE presentation and you can find a copy here: http://www.highlandsun.com/hyc/scale2007.pdf That compared 2.0.27, 2.1.30, 2.2.30, 2.3.33, and HEAD (as of a couple weeks ago). Toward the latter end of the "Cached Search Performance" chart it gets hard to see the difference because the runtimes are so small, but the new code is about 25% faster than 2.3, which was about 20% faster than 2.2, which was about 100% faster than 2.1, which was about 100% faster than 2.0, in that particular search scenario. That test basically searched a 1.3GB DB of 380836 entries (all in the slapd entry cache) in under 1 second. i.e., on a 2.4GHz CPU with DDR400 ECC/Registered RAM we can search over 500 thousand entries per second. The search was on an unindexed attribute using a filter that would not match any entry, forcing slapd to examine every entry in the DB, testing the filter for a match. Essentially the slapd entry cache in back-bdb/back-hdb is so efficient the search processing time is almost invisible; the runtime is limited only by the memory bandwidth of the machine. (The search data rate corresponds to about 3.5GB/sec; the memory bandwidth on the machine is only about 4GB/sec due to ECC and register latency.) I think it goes without saying that no other Directory Server in the world is this fast or this efficient. Couple that with the scalability, manageability, flexibility, and just the sheer know-how behind this software, and nothing else is even remotely comparable. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc Chief Architect, OpenLDAP http://www.openldap.org/project/

7 12

regarding custom schema
by Arunachalam Parthasarathy 21 Oct '07

21 Oct '07

Hello all, I derive an objectClass from organizationalUnit and make it AUXILIARY. I am getting this error Can any one please explain , me why this error comes user-defined ObjectClass has inappropriate SUPerior Thanks in advance, Arunachalam **************************************************************************** **************************** This e-mail and attachments contain confidential information from HUAWEI, which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction, or dissemination) by persons other than the intended recipient's) is prohibited. If you receive this e-mail in error, please notify the sender by phone or email immediately and delete it!

6 7

slapo-chain
by manu＠netbsd.org 21 Oct '07

21 Oct '07

Hello I have the following setup: ldap0 is the LDAP master ldap1 and ldap2 are replicas using syncrepl. - Users can use simple authentication on the 3 servers. - ldap0 holds a bunch of ACL to handle modifications - ldap1 and ldap2 have minimal ACL and are there just for reading - Mutual authentication between master and replicas is done by TLS certificates. Now I'd like the replicas to follow updatedn referrals on behalf of the client. That way clients could ask ldap1 and ldap2 to perform modifications, and that would just work. As I understand, this is done through slapo-chain. The modification has to be done on behalf of the user that authenticated on the replica (else my ACL will block). I don't want to give replicas an universal write access to the master, because that will mean I'll have to duplicate the ACL between the master and the replicas. For performance and maintainability sake, I want to avoid that. In an ideal world, I'd like replicas to connect to the master using their certificates, and the master would trust the user identity, as it was authenticated on the replica. Is there an example of how this should be done? I had a look to the test suite, and it does not help very much, as I'm not familiar enough with the authz stuff to grasp enough of how it is supposed to work. I tried this on the replica, as global option: overlay chain chain-uri ldaps://ldap0 chain-idassert-bind bindmethod=sasl saslmech=EXTERNAL mode=self But the modification operation is done using the identity from the replica TLS certificate (which fails) and not from the initial user. Any hint? -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

3 9

RE: ldapsearch on local attributes with slapo-translucent
by Srilakshmanan, Kumuthiny 11 Oct '07

11 Oct '07

Are you missing a bracket? "(&(object Class=AsteriskSIPUser)(AstAccountName=600))" -----Original Message----- From: openldap-software-bounces+kumuthiny.srilakshmanan=auspost.com.au(a)OpenLDAP.or g [mailto:openldap-software-bounces+kumuthiny.srilakshmanan=auspost.com.au@Ope nLDAP.org] On Behalf Of Gavin Henry Sent: Friday, 20 July 2007 7:26 AM To: openldap-software(a)openldap.org Subject: ldapsearch on local attributes with slapo-translucent Dear All, I'm doing some work with Asterisk and translucent, trying to overlay some attributes to an existing remote account, locally. These attributes have been added by entries in the local database before being presented to me via ldapsearch, whilst searching for attributes present in the remote directory: objectClass: AsteriskExtension objectClass: AsteriskSIPUser AstAccountName: 600 AstAccountType: friend AstAccountSecret: 600 AstAccountQualify: yes AstAccountPort: 5060 AstAccountNAT: never AstAccountMailbox: 600@device AstAccountHost: dynamic AstAccountDTMFMode: rfc2833 AstAccountContext: from-internal AstAccountCanReinvite: no AstAccountCallerID: Gavin <502> Should I expect to be able to search for the above attributes and get a result? Currently I am not. A filter like: "(&(objectClass=AsteriskSIPUser)(AstAccountName=600)" returns: ldapsearch: ldap_search_ext: Bad search filter (-7) So I guess that answers my question. If slapo-translucent did return results for searches against the local attributes, would this be defeating the purpose/design of the overlay? Thanks, Gavin. Australia Post is committed to providing our customers with excellent service. If we can assist you in any way please telephone 13 13 18 or visit our website. The information contained in this e-mail communication may be proprietary, confidential or legally professionally privileged. It is intended exclusively for the individual or entity to which it is addressed. You should only read, disclose, re-transmit, copy, distribute, act in reliance on or commercialise the information if you are authorised to do so. Australia Post does not represent, warrant or guarantee the integrity of this e-mail communication has been maintained nor that the communication is free of errors, virus or interference. If you are not the addressee or intended recipient please notify us by replying direct to the sender and then destroy any electronic or paper copy of this message. Any views expressed in this e-mail communication are taken to be those of the individual sender, except where the sender specifically attributes those views to Australia Post and is authorised to do so.

4 4

Rewrite searchDN based on searchFilter
by Andrew Bidwell 02 Oct '07

02 Oct '07

Hi everyone, I have a question regarding the best way to enable rewriting of the searchDN based on the searchFilter. I have searched through the archives, and I see that my question was expressed in this 2004 email: http://www.openldap.org/lists/openldap-software/200401/msg00612.html. I couldn't seem to find any other relevent posts. As this response is a number of years old, do those recommendations still stand? Is this operation slapd.conf configurable? Is the best way forward to develop a separate overlay to perform this operation? Any information greatly appreciated. Thanks, Andrew

3 3

slapo-unique. several unique_base with different unique_attributes sets
by Dmitriy Kirhlarov 02 Oct '07

02 Oct '07

Hi, list I have container in my tree 'ou=cyrus,ou=mail,o=domain' and I need check 'uniqueMember' attribute -- user can be membered only in one group. Also, for 'ou=web,ou=groups,o=domain' with same types of objects, as 'ou=cyrus,ou=mail,o=domain' user can be membered in several groups, but I need uniques check for 'gidNumber' inside 'ou=groups,o=domain'. I need something: unique_base ou=users,o=domain uidNumber mail mailLocalAddress unique_base ou=groups,o=domain gidNumber unique_base ou=cyrus,ou=mail,o=domain uniqueMember I'm using openldap 2.3.35 Is it possible with this version or, may be, with 2.4.x? WBR. Dmitriy

3 4

restricting attributes to become RDN , which objects are created
by Arunachalam Parthasarathy 02 Oct '07

02 Oct '07

Hello all, In objectclass, Is there a way to restrict (only) an attribute to be RDN? For ex: only uid needs to be RDN , in organizational Unit Thanks in advance, Arunachalam. **************************************************************************** **************************** This e-mail and attachments contain confidential information from HUAWEI, which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction, or dissemination) by persons other than the intended recipient's) is prohibited. If you receive this e-mail in error, please notify the sender by phone or email immediately and delete it!

7 9

ACCESS LIST
by Isaac Gonzalez 01 Oct '07

01 Oct '07

Hi, > I've this estructure > > dc=empresa,dc=com > | > Dep1 > | > |---------User1 > |---------User11 > Dep2 > | > |---------User2 > |---------User22 > Dep3 > | > |---------User3 > |---------User33 > > > I want that User1 and User11 (users under Dep1) can only access to Dep1, > User1 and User11 data. --> Dep1 Subtree > I want that User2 and User22 (users under Dep2) can only access to Dep2, > User2 and User22 data. --> Dep2 Subtree > I want that User3 and User33 (users under Dep3) can only access to Dep3, > User3 and User33 data. --> Dep3 Subtree > > It's correct this ACL? Can't be more simple? > > #DEP1 ONLY ACCESS TO DEP1 > access to dn.subtree="ou=Dep1,dc=empresa,dc=com" > by dn.children="ou=Dep1,dc=empresa,dc=com" read > by anonymous auth > by * none > > #DEP2 ONLY ACCESS TO DEP2 > access to dn.subtree="ou=Dep2,dc=empresa,dc=com" > by dn.children="ou=Dep2,dc=empresa,dc=com" read > by anonymous auth > by * none > > #DEP3 ONLY ACCESS TO DEP3 > access to dn.subtree="ou=Dep3,dc=empresa,dc=com" > by dn.children="ou=Dep3,dc=empresa,dc=com" read > by anonymous auth > by * none > > #ADMIN > access to * > by dn="cn=admin,dc=empresa,dc=com" write > by anonymous auth > by * none > > > Thanks and bye. > > >

3 3

Error 32 and 65 - why?
by Keryx Info 01 Oct '07

01 Oct '07

Hi again! I get error 32, having restarted using this slapd.conf: ----------- include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/misc.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args database bdb suffix "dc=labbnet,dc=ne,dc=keryx,dc=se" rootdn "uid=root,dc=labbnet,dc=ne,dc=keryx,dc=se" # Preliminary password rootpw secret directory /var/lib/ldap index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub ------------ This ldap.conf: ------------- BASE dc=labbnet,dc=ne,dc=keryx,dc=se URI ldap://localhost ------------ And this org.ldif: ------------ dn: dc=teknik,dc=labbnet,dc=ne,dc=keryx,dc=se objectclass: dcobject objectclass: organization o: Teknikprogrammet dc: teknik ------------ And - finally - this command: ldapadd -x -f org.ldif -W -D \ "uid=root,dc=labbnet,dc=ne,dc=keryx,dc=se" -v --------------------- Result: --------------------- ldap_initialize( <DEFAULT> ) Enter LDAP Password: add objectclass: dcobject organization add o: Teknikprogrammet add dc: teknik adding new entry "dc=teknik,dc=labbnet,dc=ne,dc=keryx,dc=se" modify complete ldap_add: No such object (32) ---------------------- WHY????? Lars Gunther P.S this also fails: gunther.ldif: ------------- dn: uid=gunther,dc=labbnet,dc=ne,dc=keryx,dc=se uid: gunther cn: Lars Gunther objectClass: account ------------- Result: ------------- ldapadd -x -f gunther.ldif -W -D "uid=root,dc=labbnet,dc=ne,dc=keryx,dc=se" -v ldap_initialize( <DEFAULT> ) Enter LDAP Password: add uid: gunther add cn: "Lars Gunther" add objectClass: account adding new entry "uid=gunther,dc=labbnet,dc=ne,dc=keryx,dc=se" modify complete ldap_add: Object class violation (65) additional info: attribute 'cn' not allowed ------------- As does this: root@ne ldap # cat people.ou.ldif dn: ou=people, dc=labbnet,dc=ne,dc=keryx,dc=se ou: people description: All people in organisation objectclass: organizationalunit root@ne ldap # ldapadd -x -f people.ou.ldif -W -D \ "uid=root,dc=labbnet,dc=ne,dc=keryx,dc=se" -v ldap_initialize( <DEFAULT> ) Enter LDAP Password: add ou: people add description: All people in organisation add objectclass: organizationalunit adding new entry "ou=people, dc=labbnet,dc=ne,dc=keryx,dc=se" modify complete ldap_add: No such object (32) Frustrated? YES!

5 7

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software September 2007