openldap-software March 2008

openldap-software@openldap.org

65 participants
66 discussions

openldap 2.4.8 and autogroup contrib
by Guy Deleeuw 08 Mar '08

08 Mar '08

Hello, I just compile the openldap 2.4.8 version and I try the overlay autogroup from the contrib On my own schema I create 2 attributes description : attributeType ( 1.3.6.1.4.1.13175.1.62 NAME 'ezMemberURL' SUP memberURL ) attributeType ( 1.3.6.1.4.1.13175.1.63 NAME 'ezMember' SUP member ) And a new objectClass : objectClass ( 1.3.6.1.4.1.13175.2.13 NAME 'ezDynGroup' SUP top MUST ( ou ) MAY ( ezMemberURL $ description $ ezMember ) ) In slapd.conf : overlay autogroup autogroup-attrset ezDynGroup ezMemberURL ezMember overlay dynlist dynlist-attrset groupOfURLs memberURL First question : the ezMember is required on the class definition ? I cannot return the ezMember : root@nova:~# ldapsearch -x -LLL -b "ou=dynLists,o=Eurofer,c=be" -s sub "(&(&(objectClass=ezDynGroup)))" dn: ou=ezDynList1,ou=dynLists,o=Eurofer,c=be objectClass: top objectClass: ezDynGroup ou: ezDynList1 ezMemberURL: ldap:///br=Internal,o=Eurofer,c=be??sub?(&(uid=*)) description: testgroup Could you help me or give me a link to more informations ? Thanks in advance Guy

1 2

Getting LDAP and SASL (digest-md5) to play nice
by Rick Stevens 07 Mar '08

07 Mar '08

I'm sure I'm not the only person having this issue, but I absolutely cannot seem to get SASL and LDAP to work. I want SASL to authenticate using the passwords in LDAP, but in the classic chicken-and-egg scenario, you can't talk to LDAP without having SASL working first. I have the authz-regexp stuff set up and the ldapwhoami seems to show me as being converted from the "uid=username,cn=digest-md5,cn=auth" thing to "uid=username,ou=people,dc=mydomain,dc=com", but ONLY if I've put a user and password into the saslpasswd2 database. If I don't do that, I get invalid SASL credentials on the ldapwhoami. I'm sure this is really farking simple, but I've googled the kapok out this thing and gotten nowhere. ---------------------------------------------------------------------- - Rick Stevens, Unix Geek rps2(a)socal.rr.com - - - - Reality: A crutch for those who can't handle science fiction - ----------------------------------------------------------------------

6 17

How is the intention to change config?
by openldap 07 Mar '08

07 Mar '08

Hi LDAPers [cvs@myhost ~]$ rpm -q openldap-servers openldap-servers-2.3.39-1.fc8 [cvs@myhost ~]$ As far as i have understood, the openldap config is moving towards beeing fully LDAP integrated, i.e. you will change the config using ldapmodify, you will add to the config using ldapadd, you will view the config using ldapsearch. That created me a problem: i had to add a schema. what i did: i created a new olcInclude object into cn=config. This object, however, was not stable, it got lost at the next slapd restart. When i consulted this discussion list, i was informed that adding a new olcInclude object is not the correct way to add a new schema. But i was not informed on how the intention is to do it. I imagine that another way would be to convert the schema from the schema file manually/directly into olcAtttributeTypes, olcObjectClasses, olcObjectIdentifier and insert them into the cn=schema,cn=config. This, however, would be a very error prone action. Also, the handling of the access rights in the future is far from clear. When i consulted the openldap docu, i found put me in front of a fait-accompli: that is how it is, help yourself. could someone shed some light on the evolution process from file-based config into LDAP-based config? thanks in advance. suomi

3 2

Testing the state of replicates
by Marantz, Roy 05 Mar '08

05 Mar '08

I'm using OpenLDAP 2.4.7 on Solaris-10. I have a database that is part of 2 master servers running in mirror mode and (eventually) some slaves servers too. I'm looking for way to tell if a particular server is "up to date". By that I mean is synchronized within X seconds with the master that gets updates. The masters will be behind a load-balancer (level 4 switch) and look like a single IP address. I can have the slaves access them directly if need be, but will try to have them talk the the virtual master server. This is mostly a concern when talking to a slave server since they may not always be able to talk to the master servers because of network partitioning. Is there something I can query, like contextCSN, to indicate the last time syncrepl successfully finished resyncing the particular database? Any other way to do this or am I just trying to do something that is impossible? Any help or pointers would be appreciated. Thanks. Roy

6 11

problem with enabling TLS
by Padmavathi Dt 05 Mar '08

05 Mar '08

Hii List, We have installed and configured our openLDAP-2.4.7 on RedHat LINUX machine using simple configure( . /configure) without any options. It has been working fine.Now we want to use SSL with that we are using openssl-0.9.7g package.We got all the required certificates. Now the problem is that,when I run the following command: /usr/local/etc/openldap/slapd.conf -d127 -h "ldap:/// ldaps:///" It is giving the following error message: ldap_pvt_gethostbyname_a: host=as3, r=0 daemon_init: ldap:/// ldaps:/// daemon_init: listen on ldap:/// daemon_init: listen on ldaps:/// daemon_init: 2 listeners to open... ldap_url_parse_ext(ldap:///) daemon: listener initialized ldap:/// ldap_url_parse_ext(ldaps:///) daemon: TLS not supported (ldaps:///) slapd stopped. connections_destroy: nothing to destroy. >From this I can understand that ,TLS is not supported.what should I do now? One more question.Is there any difference between enabling SSL and TLS ? please help me( It is difficult to rebuild openldap again,as there are many applications that are using our current LDAP) THANX IN ADVANCE TO ALL. =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

5 5

translucent local search bug ?
by Julien Garnier 05 Mar '08

05 Mar '08

Hi, I've configure a ldap server with translucent. I add my own attribute like "Poste" and with the last release of openldap I can search my local attribute (like Poste) or my remote attributes (like mail, ou, Deleg): # ldapsearch -x -b "ou=People,dc=compagnie,dc=com" "(Poste=*)" return all the datas : dn: uid=julien.garnier.1,ou=per,ou=People,dc=compagnie,dc=com businessCategory: E - Informatique, statistique et calcul scientifique displayName: GARNIER Julien employeeType: E4X01 - Technicien d'exploitation et de maintenance Poste: 3550 CorCom: moy1300 cnrsGrade: TCN GXlabTSEDR: 1 roomNumber: 7 CorSecu: 0 CorInfo: 1 GXlab: 0 CorValo: 0 CorForm: 0 ACMO: 0 Service: SSI Now, if I juste want to return some attributes with a simple request, it work : #ldapsearch -x -b "ou=People,dc=compagnie,dc=com" "(Poste=*)" mail Poste # julien.garnier.1, cnrs, People, cnrs.fr dn: uid=julien.garnier.1,ou=per,ou=People,dc=compagnie,dc=com mail: Julien.Garnier(a)compagnie.com Poste: 3550 Now I want to make a search mixing local and remote attributes : # ldapsearch -x -b "ou=People,dc=compagnie,dc=com" "(&(Deleg=DR*)(ou=MOY*)(Poste=*))" It's OK, I have the same result as the first test. But if I want to make the last search and only show some attributes, it doesn't work : # ldapsearch -x -b "ou=People,dc=compagnie,dc=com" "(&(Deleg=DR*)(ou=MOY*)(Poste=*))" Poste or # ldapsearch -x -b "ou=People,dc=compagnie,dc=com" "(&(Deleg=DR*)(ou=MOY*)(Poste=*))" mail return no values : # extended LDIF # # LDAPv3 # base <ou=People,dc=compagnie,dc=com> with scope subtree # filter: (&(Deleg=DR*)(ou=MOY*)(Poste=*)) # requesting: mail # # search result search: 2 result: 0 Success # numResponses: 1 Is it a bug or did I have read the man in the wrong way ??? Thanks, Julien

1 0

Ldap crashes with "too many executing" errors
by ram 05 Mar '08

05 Mar '08

I am using Berkeleydb4.2 and openldap version 2.3.39 on a Centos 5 box with a bdb backend The ldap server is used for backend authentication of users of imap server using sasl. Even though we have a similar setup working in many locations on a particular location I see ldap server hanging , apparently anytime and cannot be reproduced I kept ldap running in the debug mode I could see something like -- connection_input: conn=5097 deferring operation: too many executing ber_get_next ber_get_next: tag 0x30 len 6 contents: connection_input: conn=5097 deferring operation: too many executing ber_get_next ---- When the ldap server hung. I restart ldap and thing start working fine How can I debug further Thanks Ram

1 0

ppolicy: unlock users who are locked out with pwdMaxFailure?
by Zhang Weiwu 04 Mar '08

04 Mar '08

Dear all By googling around I saw a lot of questions were asked for this, but either not answered or gets answered without practical how-to: http://archives.devshed.com/forums/networking-100/question-pertaining-to-pp… http://www.mail-archive.com/openldap-software@openldap.org/msg08718.html http://www.openldap.org/lists/openldap-software/200509/msg00219.html Let's say, the admin user wishes to unlock an user, without changing his password or resetting his password, what should he do? should he deletes all pwdLockedTime for the locked user? should he deletes pwdAccountLockedTime for the locked user? Thanks in advance! My version is OL 2.3.30 Best regards Zhang Weiwu -- Real Softservice Huateng Tower, Unit 1788 Jia 302 3rd area of Jinsong, Chao Yang Tel: +86 (10) 8773 0650 ext 603 Mobile: 135 9950 2413 http://www.realss.com

2 1

Re: Testing the state of replicates
by Quanah Gibson-Mount 04 Mar '08

04 Mar '08

--On Tuesday, March 04, 2008 2:49 PM -0800 Howard Chu <hyc(a)symas.com> wrote: > Use ldapsearch to retrieve the contextCSN attributes from all of the > servers. If they match, they are in sync. Except when they aren't (contextCSN's match but the DBs do not). Which was certainly possible in some of the 2.3 releases. ;) I'd also highly advise setting syncprov-checkpoint if one's going to be doing hot slapcat's of a DB (it would actually be nice if perhaps slapcat could force that before doing a dump). That'd be fairly useful for delta-syncrepl in light of ITS#5378. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Account Locked message?
by Zhang Weiwu 04 Mar '08

04 Mar '08

Hello. I've been working on a system with low security requirement and high usability requirement. I uses ppolicy overlay and enabled ppolicy_use_lockout to avoid people gets confused when they failed to login too many times: suffix "st=jiangxi,o=LGOP" rootdn "userid=admin,st=jiangxi,o=LGOP" rootpw [...] overlay ppolicy ppolicy_default "st=jiangxi,o=LGOP" ppolicy_use_lockout Restart openldap server and test again by trying to bind with the wrong password enough times (in my case, 20 times). Then try to bind with the right password: ldapsearch -H ldap://gtz.ods.org/ -xD ou=江西省,st=jiangxi,o=LGOP -W ou=*余干* areacode ldap_bind: Invalid credentials (49) Here I still got error 49. I thought I could get something like "Account Locked" and a different error code. According to man page: ppolicy_use_lockout A client will always receive an LDAP InvalidCredentials response when Binding to a locked account. By default, when a Password Policy control was provided on the Bind request, a Password Pol‐ icy response will be included with no special error code set. This option changes the Password Policy response to include the AccountLocked error code. Note that sending the AccountLocked error code provides useful information to an attacker; sites that are sensitive to security issues should not enable this option. Well I checked related RFC (http://www.ietf.org/rfc/rfc4511.txt) and didn't find "Account Locked error code". In fact, http://www.willeke.com:9080/wikildap/Wiki.jsp?page=LDAPResultCodes listed a list of error code, non of them is "Account Locked" error code. My questions: Is my setting working? How can I tell? The web application needs to tell if an account is locked, this to improve user usability; Thanks a lot in advance! Best regards Zhang Weiwu -- Real Softservice Huateng Tower, Unit 1788 Jia 302 3rd area of Jinsong, Chao Yang Tel: +86 (10) 8773 0650 ext 603 Mobile: 135 9950 2413 http://www.realss.com

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software March 2008