openldap-software March 2008

openldap-software@openldap.org

65 participants
66 discussions

modify on the fly attributes sent to client
by Matthieu 29 Mar '08

29 Mar '08

Hello everybody, I'm front a problem with my openldap 2.3.30 server software and hope you can give me help to solve it. problem is the following one: I use a mozilla schema for my address book but need to make it compliant with another one (window's one) I have found some matching fields from my current model to windows model's one but don't wants to duplicate them and don't wants to define a schema for the window's model. Is there a way to rewrite answer to "add" a field with the value of one of the answer in the answer send to client? for example it's seems that "mozillaNickname" is equal to "surname" in the windows schema, but I don't wants to make a schema for the window's model and just want to send the mozillaNickName attribute and value with a copy of the value for an attribute surname. best regards, Matthieu

3 3

ACL for members of PosixGroup?
by Don Hoover 28 Mar '08

28 Mar '08

I was wondering if there was a way to write an ACL for a members of the PosixGroup. I have a simple directory structure of: ou=People,o=myorg (with posixusers) ou=Group,o=myorg (with posixgroups) I would like to create an ACL that allows users who have a gidNumber of X(say 101) that matches our systems admin group to have write access. And I guess one point is that they are not listed indivudually as "memberOf" entries in the ou=Group cn, they just have a gidNumber that matches a group in there. I tried: by group="cn=sysads,ou=Group,o=myorg" write and by group.expand="cn=sysads,ou=Group,o=myorg" write Neither one worked, and in fact I saw an error message of something line: => bdb_entry_get: found entry: "cn=sysads,ou=group,o=myorg" Mar 28 11:44:59 kyloulapp54dp slapd[5949]: <= bdb_entry_get: failed to find objectClass groupOfNames Does the group ACL's require a "groupofNames" instead of using posixGroups under an OrganizationUnit? I was wondering if maybe there some regex maybe I could use to check the gidNumber of the user trying to attempt access? I am not a regex genius so any help would be appreciated. Thanks!! --- Don Hoover dxh(a)yahoo.com

3 2

ACL troubles
by Julien Garnier 28 Mar '08

28 Mar '08

Hi, I have some problems to configure my aACL's and hope someone can help me. I want all my local subnet (A.A.A.x) have entire read acces, It's OK. I want some IP have acces only to one search : for example, I want that IP1 B.B.B.B can only do this search and that any other search return error : ldapsearch -x -b "ou=people,ou=compagnie,ou=com" "(ou=DIV1*)" -LLL I don't find how to configure that. I've tried : access to dn.base="" by peername.regex="IP=A\.A\.A\..+" read by peername.regex="IP=127\.0\.0\.1" read by * none access to dn.sub="ou=people,ou=compagnie,ou=com" filter=(ou=DIV1*) by peername.regex="IP=B\.B\.B\.B" read by * none but dosn't work, I have an insufficient acces 50 error. I anyone can help me... Thanks in advance

3 3

ldapmodify error
by Naufal Sheikh 27 Mar '08

27 Mar '08

Hey list, I have openlldap running on one box with replog enabled. I am trying to propagate the generated replog on the production and when using the ldapmodify command I get the following: ldap_modify: Constraint violation (19) additional info: entryCSN: no user modification allowed test server is exact mirror of the production in every sense apart from the platforms they are running on which I believe showuld not be the issue. They have same configuration and everything. Any pointer will be appreciated . Thanks! NZ

3 6

Real alternatives to BDB?
by Marten Lehmann 27 Mar '08

27 Mar '08

Hello, we are currently running openldap 2.2.13 with a bdb-4.2.52 backend as it comes with RHEL4. We have about 50.000 cn's each having about 5-10 attributes with a length of no longer than 100 characters. So our dataset is not very big. We have a lot of concurrent reads since or ldap provides the data for incoming and pop3/imap servers. But we have only about 100 changes/adds a day, not more. Yesterday we had the second bdb problem in our 1 year ldap setup. The problem is, that we cannot really detect the crash, since ldap queries just hang, but neither they timeout nor openldap is crashing. We just notice the mailserver issues and have to track it down to openldap and bdb. As with last time, we had to shutdown openldap and recover bdb. Fortunately we have been able to recover the data-directory both times using dv_recover. But in fact, we want to have a backend, that doesn't crash twice a year. And as our setup is growing and we want to start with replication, we want a backend to whom we can trust. I read through the backend documentation of openldap and berkeley db is praised as very fast and efficient. Amazing, that berkeleydb is not called stable anywhere in the documentation. And from my experience, bdb is not stable. Whenever you here about bdb, you here about it because a database went corrupt. bdb is just a key/value database that seems to work fine as long it is read-only. Different projects, e.g. subversion, have turned away from bdb and use a different backend. Often they use SQLite. Since SQLite handles complete table layouts, it would also be possible to create one table with two columns (key and value as in bdb). SQLite shall also be transactional. But why is openldap sticking on bdb? Does bdb have any other important features the SQLite doesn't have? Benchmark issues? Replication? I have to admit, that I'm not using the latest releases of bdb. But I'm using and watching bdb for years and I hardly believe, that it has become stable in the latest release. Regards Marten

9 9

Replication appears to vanish, sometimes.
by Jorgen Lundman 26 Mar '08

26 Mar '08

Hello list, SunOS ldapmaster01.unix 5.10 Generic_118844-26 i86pc i386 i86pc openldap-2.3.19 db-4.2.52.NC-sol10-intel-local ./configure LDFLAGS=-L/usr/local/lib --enable-crypt Generally, Openldap is working well, and replication is working. I get no .rej files, and the replog file itself is frequently drained. But, ldapmaster and ldapslave frequently get out of sync. I thought it was initially just on the modrdn operations, but we have had "simpler" operations vanish. I realise this isn't much to go on, but perhaps I can get suggestions which may lead to more clues. The important looking sections in slapd.conf: loglevel none database bdb suffix "dc=company,dc=jp" rootdn "cn=admin,dc=company,dc=jp" access to attr=userPassword by self write by anonymous auth by * none access to * by self write by dn="cn=admin,dc=company,dc=jp" write by * read password-hash {CRYPT} checkpoint 128 15 directory /usr/local/var/openldap-data index objectClass eq index uid eq index uidNumber eq index mail eq index mailAlternateAddress pres,eq index deliveryMode eq index accountStatus eq index gecos eq index radiusGroupName eq index o pres,eq replogfile /usr/local/var/openldap-slurp/replica/slurpd.replog replica host=172.20.12.23:389 binddn="cn=admin,dc=company,dc=jp" bindmethod=simple credentials="<secret>" ldapslave slapd.conf is identical (it really is scp'ed) but with the last two lines removed (replogfile, replica). # /usr/local/bin/ldapsearch -h ldapmaster01 -D cn=admin,dc=company,dc =jp -x -w secret -b ou=mail,dc=company,dc=jp mail=test01(a)cs-sd01.com # extended LDIF # # LDAPv3 # base <ou=mail,dc=company,dc=jp> with scope subtree # filter: mail=test01(a)cs-sd01.com # requesting: ALL # # test01, cs-sd01.com, mail, company.jp dn: uid=test01,o=cs-sd01.com,ou=mail,dc=company,dc=jp objectClass: top objectClass: account objectClass: posixAccount objectClass: shadowAccount objectClass: qmailUser objectClass: amavisAccount uid: test01 cn: test01 [snip] # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 # /usr/local/bin/ldapsearch -h ldapslave01 -D cn=admin,dc=company,dc=jp -x -w <secret> -b ou=mail,dc=company,dc=jp mail=test01(a)cs-sd01.com # extended LDIF # # LDAPv3 # base <ou=mail,dc=secret,dc=jp> with scope subtree # filter: mail=test01(a)cs-sd01.com # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 The various slapdlogs appear to contain little of interest, but perhaps "loglevel none" is the wrong setting? ldapmaster usually gives lines like: Mar 25 09:51:23 ldapmaster01.unix slapd[1319]: [ID 458966 local4.debug] do_search: invalid dn (uid=a.user, o=, ou=mail, dc=company, dc=jp) Mar 25 09:51:25 ldapmaster01.unix slapd[1319]: [ID 458966 local4.debug] do_search: invalid dn (uid=user4447, o=, ou=mail, dc=company, dc=jp) Mar 25 09:51:29 ldapmaster01.unix slapd[1319]: [ID 458966 local4.debug] do_search: invalid dn (uid=6201535, o=, ou=mail, dc=company, dc=jp) Which is just users entering their usernames wrong. ldapslave01 has no real log entries: Mar 24 22:42:41 ldapslave01.unix slapd[25495]: [ID 854361 local4.debug] bdb_db_open: unclean shutdown detected; attempting recovery. Mar 24 22:42:41 ldapslave01.unix slapd[25495]: [ID 100111 local4.debug] slapd starting When things are out of sync, I stop ldapslave01, stop provisioning (the only thing writing to ldap), then rsync everything from ldapmaster, and start it again. We are considering running without ldapslave until it can be resolved, it will just a bit slower. As I said, it is not all replication that fails, just some. There was a period where ldapslave was experiencing "too many files open error", but we increased file descriptors since then (6 weeks ago). I do also have a DBCONFIG file. Lund -- Jorgen Lundman | <lundman(a)lundman.net> Unix Administrator | +81 (0)3 -5456-2687 ext 1017 (work) Shibuya-ku, Tokyo | +81 (0)90-5578-8500 (cell) Japan | +81 (0)3 -3375-1767 (home)

4 7

memberof overlay 2.4.08
by LALOT Dominique 25 Mar '08

25 Mar '08

Hello, I'm testing memberof overlay and I'd like to get it working properly for a database migration My tests showed me that's it's working when adding members in groups, but for an initial loading, it does not work. I tested slapadd -q or slapadd without success. Could you tell us, or write something in the documentation to explain, the right way for an initial loading. Should we write some script, or is there an easier way? When we will be in production, I imagine that sometimes, we can get out of sync between members and memberof. What can we do in such case. Thanks Dominique

2 1

Compilation 2.3.39 on SunOS 5.8.
by vincent.blondel＠ing.be 25 Mar '08

25 Mar '08

Hello, I am trying to compile OpenLDAP 2.3.39 on my sun box. Below details on my compilation environment : SunOS 5.8 Generic_117350-49 sun4u sparc SUNW,Sun-Fire-V210 gcc : 3.4.6 binutils : 2.17 make 3.80 autoconf : 2.59 OpenSSL 0.9.8d I try to get OpenLDAP compiled only for client usage ( binaries, libraries ), statically including GCC object files and OpenSSL libraries because these are not present on any of our Sun servers. Below, you can find script I developped to compile this version. As you can see I disabled all what concern slapd, slurpd, Berkeley DB and I enabled SSL libraries. This is the way I usely compile my packages on SunOS platform (SQUID, ISC Bind, ...) PATH=/usr/local/bin:/usr/local/sbin:/bin:/sbin:/usr/bin:/usr/sbin LD_LIBRARY_PATH=/usr/local/lib PKG=openldap-2.3.39 PREFIX=/usr/local export PATH PKG PREFIX LD_LIBRARY_PATH /usr/bin/env \ CC="/usr/local/bin/cc" \ CXX="/usr/local/bin/c++" \ CFLAGS="-O2 -pipe" \ LDFLAGS="-L/usr/local/ssl/lib/libssl.a -L/usr/local/ssl/lib/libcrypto.a -L/usr/local/ssl/lib -L/usr/local/lib -R/usr/local/lib" \ CPPFLAGS="-I/usr/local/ssl/include -I/usr/local/include" \ AUTOCONF="/usr/local/bin/autoconf" \ AUTOHEADER="/usr/local/bin/autoheader" \ AUTOIFNAMES="/usr/local/bin/ifnames" \ AUTOM4TE="/usr/local/bin/autom4te" \ AUTORECONF="/usr/local/bin/autoreconf" \ AUTOSCAN="/usr/local/bin/autoscan" \ AUTOUPDATE="/usr/local/bin/autoupdate" \ SHELL=/bin/sh \ CONFIG_SHELL=/bin/sh \ ./configure \ --prefix=/usr/local \ --sysconfdir=/etc \ --enable-crypt \ --enable-dynamic \ --with-tls \ --with-threads=posix \ --without-cyrus-sasl \ --disable-debug \ --disable-slapd \ --disable-slurpd \ --disable-monitor \ --disable-bdb \ --disable-hdb \ --disable-relay \ --disable-glue \ --disable-syncprov make depend make make install Now I get problems with it because binaries always give me 'Killed' message. # /usr/local/bin/ldapsearch Killed Concerning libraries, these ones seem to compile but not statically including ssl libraries and/or libgcc, the other ones are okay and can be linked dynamically. # ldd /usr/local/lib/libldap.so warning: ldd: /usr/local/lib/libldap.so: is not executable libssl.so.0.9.8 => (file not found) libcrypto.so.0.9.8 => (file not found) libgcc_s.so.1 => /usr/local/lib/libgcc_s.so.1 liblber-2.3.so.0 => /usr/local/openldap/lib/liblber-2.3.so.0 libresolv.so.2 => /lib/libresolv.so.2 libgen.so.1 => /lib/libgen.so.1 libnsl.so.1 => /lib/libnsl.so.1 libsocket.so.1 => /lib/libsocket.so.1 libc.so.1 => /lib/libc.so.1 libdl.so.1 => /lib/libdl.so.1 libmp.so.2 => /lib/libmp.so.2 /usr/platform/SUNW,Sun-Blade-100/lib/libc_psr.so.1 After many times, I tried to link binaries with SunOS built-in linker '/usr/ccs/bin/ld' but always get the same problem. If you want have a look compilation with /usr/local/bin/ld, click on this link http://ks31203.kimsufi.com/openldap-2.3.39-local_ld.log If you want have a look at compilation with /usr/ccs/bin/ld (LD="/usr/ccs/bin/ld"), click on this link http://ks31203.kimsufi.com/openldap-2.3.39-ccs_ld.log So, finally, maybe my problem is something really stupid but I do not find the solution to get my binaries valid with requested libraries statically compiled. Help is really appreciated in this case. Vincent. ----------------------------------------------------------------- ATTENTION: The information in this electronic mail message is private and confidential, and only intended for the addressee. Should you receive this message by mistake, you are hereby notified that any disclosure, reproduction, distribution or use of this message is strictly prohibited. Please inform the sender by reply transmission and delete the message without copying or opening it. Messages and attachments are scanned for all viruses known. If this message contains password-protected attachments, the files have NOT been scanned for viruses by the ING mail domain. Always scan attachments before opening them. -----------------------------------------------------------------

5 6

Selecting TLS Cipher problem
by Pat Riehecky 24 Mar '08

24 Mar '08

I am trying to limit the cipher list for TLS negotiations, but I don't seem to be able to do this..... ... output from -d -1.... 2.5.13.0 (objectIdentifierMatch): matchingRuleUse: ( 2.5.13.0 NAME 'objectIdentifierMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ supportedApplicationContext ) ) TLS: could not set cipher list !ALL:HIGH:+SSLv3:+TLSv1:MEDIUM:+SSLv2:! aNULL:!NULL:+SHA:+MD5. main: TLS init def ctx failed: -1 slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. </-d -1 snip> Here is all of my TLS data from my slapd.conf # SSL TLSCertificateFile /etc/ldap/certificate.pem TLSCertificateKeyFile /etc/ldap/private.key TLSCipherSuite !ALL:HIGH:+SSLv3:+TLSv1:MEDIUM:+SSLv2:!aNULL:!NULL:+SHA: +MD5 </slapd.conf snip> OpenLDAP 2.4.7-5 on Debian x86 installed from apt What did I do wrong? I would swear the cipher list is good, but.... Pat

4 6

valsort not sorting?
by Pat Riehecky 21 Mar '08

21 Mar '08

I have the valsort overlay in place database hdb suffix "dc=mytest,dc=com" overlay valsort valsort-attr uid ou=People,dc=mytest,dc=com weighted alpha-ascend but when I do an ldapsearch results are not sorted by uid # ldapsearch -x -b "ou=People,dc=mytest,dc=com" uid dn: uid=btest,ou=People,dc=mytest,dc=com uid: btest dn: uid=mytest,ou=People,dc=mytest,dc=com uid: mytest dn: uid=atest,ou=People,dc=atest,dc=com uid: atest What did I do wrong? Pat

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software March 2008