openldap-software November 2008

openldap-software@openldap.org

43 participants
47 discussions

Using int ldap_sasl_interactive_bind_s with SASL/EXTERNAL and certificate
by Mathieu MILLET 05 Nov '08

05 Nov '08

Hi everyone, I'm trying to add support to SASL/EXTERNAL with certificate to NSSLDAP. For now, for testing, I'm implementing a very quick client in C. I'm able to perform starttls and client certificate verification. But, when using ldap_sasl_interactive_bind_s, I can't figure out what to pass to arguments server/client controls, sasl interact and <void *defaults>. the only parameter I have set yet is mechs which equal to "EXTERNAL". Does anyone have any documentation on how to perform this type of authentication ? Thanks in advance for any answer. Sincerely yours, Mathieu MILLET. -- Mathieu MILLET mailto:ldap@htam.net ----

2 1

Problem adding objectClass posixAccount using Novell's JLDAP
by Nuno 05 Nov '08

05 Nov '08

Hi everyone. I believe this is the correct mailing list to post my question. If not, please point me to the correct one. I'm using Novell's JLDAP Java library (available from http://www.openldap.org/jldap/) to talk to my OpenLDAP server from an application developed in-house. It's been a pretty straightforward ride: I can list users, change attributes, etc. There is, however, one thing I haven't yet been able to implement - create a new user that inherits the objectClass "posixAccount". According to Novell's code samples, to create such an entry, one would do: LDAPEntry entry = new LDAPEntry(cn); LDAPAttributeSet attrSet = new LDAPAttributeSet(); // Object class descriptions attrSet.add(new LDAPAttribute("objectclass", new String("inetOrgPerson"))); // add the other attributes until all required inetOrgPerson attributes are set ... // add the LDAPAttributeSet connection.add(new LDAPEntry(entry.getDN(), attrSet)); This snippet works only if the objectClass being added is an "inetOrgPerson". Trying to add an additional objectClass called "posixAccount" and its attributes ("gidNumber", "description", "gecos", "loginShell" and "userPassword") results in the following error: LDAPException: Object Class Violation (65) Object Class Violation LDAPException: Server Message: attribute 'uidNumber' not allowed Upon further testing, I concluded the posixAccount objectClass is never added, thus its attributes are in fact, not allowed. How should I proceed to correctly add the objectClass posixAccount?

3 3

bdb 4.6 issue with 2.4.12
by Guillaume Rousse 05 Nov '08

05 Nov '08

Since I upgraded one of my server from 2.4.11 to 2.4.12, I'm facing heavy database issues: [root@etoile ~]# slapcat -b dc=msr-inria,dc=inria,dc=fr ... bdb(dc=msr-inria,dc=inria,dc=fr): pthread lock failed: Invalid argument bdb(dc=msr-inria,dc=inria,dc=fr): PANIC: Invalid argument bdb(dc=msr-inria,dc=inria,dc=fr): PANIC: DB_RUNRECOVERY: Fatal error, run database recovery bdb(dc=msr-inria,dc=inria,dc=fr): PANIC: fatal region error detected; run recovery bdb_db_close: database "dc=msr-inria,dc=inria,dc=fr": close failed: DB_RUNRECOVERY: Fatal error, run database recovery (-30975) Even importing a backup ldiff file on a fresh installation triggers the same problems. I tested this problem on two different environment (mandriva 2008.1, mandriva cooker), and one user reported it against mandriva 2009.0 (https://qa.mandriva.com/show_bug.cgi?id=45034). This seems to either imply an openldap or a packaging issue. Should I report an ITS for this, or rather provide more informations ? -- Guillaume Rousse Moyens Informatiques - INRIA Futurs Tel: 01 69 35 69 62

4 8

delta-syncrepl and acl limitation
by COMBES Julien - CETE Lyon/DI/ET/PAMELA 05 Nov '08

05 Nov '08

Hello I use openldap 2.3.39. The Openldap admin guide indicates that (in chapter 15 for the openldap 2.3 and 17.2.1 for 2.4) : "Syncrepl supports both partial and sparse replications. The shadow DIT fragment is defined by a general search criteria consisting of base, scope, filter, and attribute list. The replica content is also subject to the access privileges of the bind identity of the syncrepl replication connection." So, I understand that, in syncrepl, I could do a partial replication on the slave with ACL limitation on the master. I have tried this with delta-syncrepl (with accesslog) but it doesn't seem to work with that kind of message on the slave : slapd : syncrepl_message_to_op: rid 252 be_modify cn=one_entry,ou=foo,ou=bar,dc=my,dc=domain (32) The slave doesn't have the entry (due to ACL limitations) but see modifications on it in the accesslog base and try to synchronize the entry. With delta-syncrepl, is it possible to do partial replication on slave with ACL limitation on master ? --------------------------------------------------------------------- master delta-syncrepl conf : # Accesslog database hdb suffix "cn=accesslog" rootdn "cn=accesslog" directory "/var/lib/ldap/accesslog" index entryCSN,objectClass,reqEnd,reqResult,reqStart eq overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE limits dn.regex="cn=syncuser\..*,ou=foo,ou=bar,dc=my,dc=domain" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited database hdb suffix "dc=my,dc=domain" rootdn "dc=my,dc=domain" [...] overlay syncprov syncprov-checkpoint 100 10 overlay accesslog logdb "cn=accesslog" logops writes logsuccess TRUE logpurge 07+00:00 01+00:00 --------------------------------------------------------------------- slave delta-syncrepl conf : syncrepl rid=252 provider=ldaps://ldapmaster.my.domain type=refreshAndPersist retry="60 10 300 +" searchbase="dc=my,dc=domain" filter="(objectClass=*)" scope=sub schemachecking=off updatedn="cn=replicsyncrepl,ou=foo,ou=bar,dc=my,dc=domain" bindmethod=simple binddn="cn=syncuser.slaveone,ou=foo,ou=bar,dc=my,dc=domain" credentials=<secret> logbase="cn=accesslog" syncdata=accesslog updateref ldaps://ldapmaster.my.domain --------------------------------------------------------------------- Regards, Julien

3 4

TLS problems with OpenLDAP
by LÉVAI Dániel 03 Nov '08

03 Nov '08

Hi! I've recreated my certificate/key pair, beacuse I can't seem get over this issue. I've changed the hostname in the certificate to the ip address of the server. OpenLDAP 2.4.11, Debian testing/lenny system. Could someone tell me why this would fail: $ ldapsearch -d 1 -ZZWx '(objectclass=*)' -H ldap://192.168.1.3 ldap_url_parse_ext(ldap://192.168.1.3) ldap_create ldap_url_parse_ext(ldap://192.168.1.3:389/??base) ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 192.168.1.3:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 192.168.1.3:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush2: 31 bytes to sd 3 ldap_result ld 0x6120a0 msgid 1 wait4msg ld 0x6120a0 msgid 1 (infinite timeout) wait4msg continue ld 0x6120a0 msgid 1 all 1 ** ld 0x6120a0 Connections: * host: 192.168.1.3 port: 389 (default) refcnt: 2 status: Connected last used: Fri Oct 31 22:36:46 2008 ** ld 0x6120a0 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x6120a0 request count 1 (abandoned 0) ** ld 0x6120a0 Response Queue: Empty ld 0x6120a0 response count 0 ldap_chkResponseList ld 0x6120a0 msgid 1 all 1 ldap_chkResponseList returns ld 0x6120a0 NULL ldap_int_select read1msg: ld 0x6120a0 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 12 contents: read1msg: ld 0x6120a0 msgid 1 message type extended-result ber_scanf fmt ({eAA) ber: read1msg: ld 0x6120a0 0 new referrals read1msg: mark request completed, ld 0x6120a0 msgid 1 request done: ld 0x6120a0 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ber_scanf fmt ({eAA) ber: ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (}) ber: ldap_msgfree TLS: hostname (192.168.1.3) does not match common name in certificate (192.168.1.3). ldap_err2string ldap_start_tls: Connect error (-11) That last "TLS:" prefixed message bothers me; it tells me that 192.168.1.3 doesn't match with 192.168.1.3?! Why? Daniel -- LEVAI Daniel PGP key ID = 0x4AC0A4B1 Key fingerprint = D037 03B9 C12D D338 4412 2D83 1373 917A 4AC0 A4B1

2 3

userPassword
by John Nietzsche 01 Nov '08

01 Nov '08

Dear gentleman, i have installed and configured a fully environment containg debian, openldap, cyrus-sasl and bdb. I am facing a curious problem in my environment: With a ldif file i had inserted a set of user (replacing nis with openldap). When i perform a ldapsearch on the tree whe field userPassword is not shown (or it was not added when importing with ldapadd). Did anybody already face such scenario? I am losing my hairs .... Thanks a lot for your time and cooperation. Best regards.

2 2

SASL
by John Nietzsche 01 Nov '08

01 Nov '08

Dear list members, i have just setted, in my environment, kerberos, cyrus-sasl and openldap. My host operational plataform is Debian. I am facing a situation like this: altough i configured cyrus SASL i can't see its mech with the following command: sioux@gustav:~/ldap$ ldapsearch -x -b "" -s base supportedSASLMechanisms # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: supportedSASLMechanisms # # dn: # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 sioux@gustav:~/ldap$ My ldap server ldd output is: gustav:/etc/ldap# ldd `which slapd` linux-gate.so.1 => (0xffffe000) libldap_r-2.3.so.0 => /usr/lib/libldap_r-2.3.so.0 (0xb7f1c000) liblber-2.3.so.0 => /usr/lib/liblber-2.3.so.0 (0xb7f10000) libiodbc.so.2 => /usr/lib/libiodbc.so.2 (0xb7ec8000) libslp.so.1 => /usr/lib/libslp.so.1 (0xb7eb9000) libsasl2.so.2 => /usr/lib/libsasl2.so.2 (0xb7ea3000) libssl.so.0.9.8 => /usr/lib/i686/cmov/libssl.so.0.9.8 (0xb7e64000) libcrypto.so.0.9.8 => /usr/lib/i686/cmov/libcrypto.so.0.9.8 (0xb7d2a000) libcrypt.so.1 => /lib/tls/i686/cmov/libcrypt.so.1 (0xb7cfc000) libresolv.so.2 => /lib/tls/i686/cmov/libresolv.so.2 (0xb7ce8000) libpthread.so.0 => /lib/tls/i686/cmov/libpthread.so.0 (0xb7cd6000) libltdl.so.3 => /usr/lib/libltdl.so.3 (0xb7ccf000) libwrap.so.0 => /lib/libwrap.so.0 (0xb7cc7000) libc.so.6 => /lib/tls/i686/cmov/libc.so.6 (0xb7b96000) libdl.so.2 => /lib/tls/i686/cmov/libdl.so.2 (0xb7b92000) libnsl.so.1 => /lib/tls/i686/cmov/libnsl.so.1 (0xb7b7b000) libz.so.1 => /usr/lib/libz.so.1 (0xb7b67000) /lib/ld-linux.so.2 (0xb7f6b000) gustav:/etc/ldap# May some one help with this stuff? Thanks a lot for your time and cooperation. Best regards.

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software November 2008