openldap-software April 2008

openldap-software@openldap.org

77 participants
72 discussions

Supported RFC's and "features"
by Clowser, Jeff (Contractor) 13 Jul '09

13 Jul '09

I'm currently doing a review to see how OpenLDAP compares, *feature wise* ATM, to other directory servers and specifically to the Sun DS - i.e. to get a definitive list of features it's missing that Sun has and what it has that Sun doesn't have, etc. For brevity, I haven't included all the potentially useful features of OpenLDAP, but have just focused on those associated with 1) RFC compliance (of which Sun may or may not meet) and 2) features to match the Sun DS (which it would be replacing). So far, here's what I have for OpenLDAP: RFC 4510 (which includes 4511-4519). There was recent discussion on the list around this, such that in some cases, not everything that changed from 3377 (which includes 2251-2256, 2829, and 2830) to 4510 has been updated in OpenLDAP, but I think those issues are fairly minor. The following additional RFC's are supported in OpenLDAP: - RFC 2247 and RFC 3088 - RFC 2696 simple paged results - RFC 2849 ldif - RFC 3062 password mod op - RFC 3296 named referals, manageDSAit - RFC 3673 All Op attrs + feature - RFC 3687 Component matching rules - RFC 3866 Languange tag and range - RFC 3876 matched values control - RFC 4370 proxy auth - RFC 4522 binary encoding - RFC 4523 x.509 cert schema - RFC 4524 COSINE schema - RFC 4525 Mod-increment - RFC 4526 Absolute true/false filters - RFC 4527 pre/post read control - RFC 4528 assertion control - RFC 4529 request attrs by objectclass - RFC 4530 entryUUID - RFC 4532 whoamI - RFC 4533 Content Sync op (replication) RFC's NOT supported are: - RFC 2589 dds Seems with 2.4, this has gone from experimental to production quality? - RFC 2891 server side sorting - RFC 3671 collective attributes - RFC 3928 LCUP mainly for updating cached addressbooks, etc - not replication between servers - RFC 3384 looks like just reqs for replication, not an actual replication protocol - RFC 4533 is used instead Unknown: - RFC 3672 (subentries) - RFC 3698 and 3727 (additional matching rules) - RFC 3909 LDAP Cancel operation - RFC 5020 entryDN operational attribute (There are some other, often obscure, LDAP related RFC's that I didn't include, but this seems to be the major/useful ones) Other features not supported: - VLV browse indexes (per http://tools.ietf.org/html/draft-ietf-ldapext-ldapv3-vlv-09). Not an RFC, but supported by Sun and MS directories, and used by things like Outlook and Solaris. Other supported features: - dyngroup/dynlist/memberof overlay (A much more useful feature than Sun's groupOfURLs "dynamic" group and "roles" mechanism) - ppolicy overlay (matches Sun DS 5.x reasonably close, but is account lockout replicated to all servers? Sun DS 6.x claims to) - refint overlay (similar to Sun's referential integrity plugin) - unique overlay (similar to Sun's uniqueness plugin) - audit and accesslog overlays, syslog logging - much more useful/complete than Sun's access/audit/error logs. - live acl changes via LDAP Unknown features: - Per user resource limits (sizelimit, timelimit, idletimeout, etc). I think Howard Chu said OpenLDAP has some of this, but I haven't seen any reference to it or how to use it in the docs (does this functionality exist, and if so, is there any documentation?) - Tracking of last login (i.e. last successful ldap authentication) Is this still fairly accurate? The ones that are really problematic are the lack of: - VLV Browse indexes - RFC 2891 (server side sorting) - per user/entry resources limits (if they don't exist) Are there any unofficial updates/patches/overlays/plans for any of this functionality? Thanks, - Jeff

11 29

using slapo-pcache with an empty attr list
by Toby Blake 05 Jun '08

05 Jun '08

Hi all, I'm doing a bit of playing with slapo-pcache and have it working fairly well (particularly once I realised that an individual attr can live in only one proxyattrset). However, there's one bit that I can't get working - is there any way to define a template that will match a search which doesn't provide an attr list? i.e. I can see quite a few searches (presumably from amd) of the following form (spacing and formatting changed by me to make it more readable): Jul 23 14:54:16 host1 slapd[26671]: conn=49 op=1 SRCH base="dc=inf,dc=ed,dc=ac,dc=uk" scope=2 deref=0 filter="(&(objectClass=amdmap)(amdmapName=home)(amdmapKey=root))" Jul 23 14:54:16 host1 slapd[26671]: query template of incoming query = (&(objectClass=)(amdmapName=)(amdmapKey=)) Jul 23 14:54:16 host1 slapd[26671]: QUERY NOT ANSWERABLE Jul 23 14:54:16 host1 slapd[26671]: QUERY NOT CACHEABLE Jul 23 14:54:16 host1 slapd[26671]: conn=49 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Note that there's no 'SRCH attr=' line. I've tried proxyattrset of the following forms... proxyattrset 1 * proxyattrset 1 (both of which crash slapd) And also proxyattrset 1 <full list of attrs returned when none specified> .... but this didn't work either. Thanks in advance for any advice, Cheers Toby Blake School of Informatics University of Edinburgh

3 8

Re: TLS trace: SSL_accept:error in SSLv2/v3 read client hello A
by Dieter Kluenter 28 May '08

28 May '08

"Arkady Shoyhet" <Arkady.Shoyhet(a)aladdin.com> writes: > OK ,folks,it is really not simple… > > HELP ME PLEASE… [...] > TLS trace: SSL_accept:error in SSLv2/v3 read client hello A > TLS: can't accept. > > TLS: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol > s23_srvr.c:562 > > connection_read(11): TLS accept failure error=-1 id=1, closing > > connection_closing: readying conn=1 sd=11 for close > > connection_close: conn=1 sd=11 > > WHY ??? What I am missing ? one question mark should be sufficient. something is wrong either with your certificate or with your TLS configuration in slapd.conf and ldap.conf, please post the relevant parts. how did you create the certificates? -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6

3 2

Add attribute with static value to search results
by Andy Cobaugh 01 May '08

01 May '08

Is it possible to somehow add a statically defined attribute to all search results. For example, if I wanted to add "authAuthority: ;Kerberosv5;;" to all entries with "(objectClass=posixAccount)". I've looked at slapo-rwm, and its rwm-map directive, but that only seems to map one attribute to another. I'm thinking there must be a way to do this, or perhaps it would be simple enough add this functionality to slapo-rwm. It seems like this is something that could be fairly useful, so perhaps this should be considered a feature request. Note: I don't control the upstream ldap server in my organization (I'm using a local proxying server with the translucent overlay). I could add this attribute to every entry in the upstream server, but that's several tens of thousands of entries that I would need to locally modify. -- Andy Cobaugh

3 5

smbk5pwd causes seg fault/help compiling
by Bill Baird 29 Apr '08

29 Apr '08

I'm having some trouble trying to setup smbk5pwd. I am currently running CentOS 5 with the latest updates. OpenLDAP is version openldap-2.3.27-8.el5_1.3, I have it installed via RPM. To try to compile, I downloaded & installed the source rpm. That included a tgz file of the openldap's source. I extracted it and went to the contrib/slapd-modules/smbk5pwd directory. I edited the Makefile and set "SSL_INC=/usr/include/openssl", everything else appeared okay. I also had to run a "./configure" to get libtool created. **I think this might be where I screwed up...running a generic ./configure. How do I get the settings that the RPM was configured with? ** >From there, I ran make and got this error: *../../../include/ldap_defaults.h:35:25: error: ldap_config.h: No such file or directory* There was a ldap_config.hin file in that same directory, I renamed it ldap_config.h and was able to run make successfully. Did the following: *mkdir /usr/lib/ldap cp smbk5pwd.la /usr/lib/ldap cd .libs cp -r smbk5pwd.so* /usr/lib/ldap* Added it to my slapd.conf file: *moduleload /usr/lib/ldap/smbk5pwd.o overlay smbk5pwd* When I try to restart openldap, I get a segfault. If I comment out the "overlay..." line, it will start and work fine. The startup log looks fine until the segfault line: * slapd startup: initiated. /bin/bash: line 1: 27591 Segmentation fault /tmp/start-slapd.n27586* If anyone has any suggestions, that would great...thanks! --Bill

2 2

slow ldapsearch when binddn is not root
by Alexandre Biancalana 28 Apr '08

28 Apr '08

Hi list! My master ldapserver is a FreeBSD 6.2-STABLE running OpenLDAP 2.3.38 the directory have ~ 5000 entries that are users from samba and qmail. I experiencing a strange behavior with the search response time, here are two searches, one done with root dn and another with a user dn. # time ldapsearch -D uid=user,ou=Users,dc=mydomain,dc=com,dc=br -b ou=Users,dc=mydomain,dc=com,dc=br -W -x > /dev/null Enter LDAP Password: 101.71s real 0.59s user 0.11s system # time ldapsearch -D cn=root,dc=tempopar,dc=com,dc=br -b ou=Users,dc=mydomain,dc=com,dc=br -W -x > /dev/null Enter LDAP Password: 3.13s real 0.53s user 0.08s system Follow my slapd.conf: ##################### # slapd.conf start # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/samba.schema include /usr/local/etc/openldap/schema/qmail.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args #loglevel any #loglevel 160 sizelimit unlimited # Load dynamic backend modules: modulepath /usr/local/libexec/openldap moduleload back_hdb moduleload back_monitor moduleload smbk5pwd.so # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates limits dn.exact="cn=replicator,dc=mydomain,dc=com,dc=br" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited #limits dn.exact="cn=sambaadmin,dc=mydomain,dc=com,dc=br" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited access to attrs=sambaLogonTime by dn.exact="cn=logintimeupdator,dc=mydomain,dc=com,dc=br" write by * read access to * by dn.exact="cn=replicator,dc=mydomain,dc=com,dc=br" read by dn.exact="cn=qmail-ldap,dc=mydomain,dc=com,dc=br" read by * none break access to attrs=userPassword by self write by group.exact="cn=Sysadmins,dc=mydomain,dc=com,dc=br" write by * auth access to attrs=shadowLastChange by group.exact="cn=SysAdmins,dc=mydomain,dc=com,dc=br" write by self write by * read access to dn.regex="^(.*,)?ou=Computers,dc=mydomain,dc=com,dc=br$" by dn.exact="cn=sambaadmin,dc=mydomain,dc=com,dc=br" write by * read access to dn.regex="^(.*,)?ou=Domains,dc=mydomain,dc=com,dc=br$" by dn.exact="cn=sambaadmin,dc=mydomain,dc=com,dc=br" write by * read access to dn.regex="^(.*,)?ou=Idmap,dc=mydomain,dc=com,dc=br$" by dn.exact="cn=sambaadmin,dc=mydomain,dc=com,dc=br" write by * read access to dn.regex="^(.*,)?ou=Users,dc=mydomain,dc=com,dc=br$" by group.exact="cn=SysAdmins,dc=mydomain,dc=com,dc=br" write by self write by * read access to dn.regex="^(.*,)?ou=Groups,dc=mydomain,dc=com,dc=br$" by group.exact="cn=SysAdmins,dc=mydomain,dc=com,dc=br" write by self write by * read access to dn.regex="^(.*,)?cn=SysAdmins,dc=mydomain,dc=com,dc=br$" by group.exact="cn=SysAdmins,dc=mydomain,dc=com,dc=br" write #access to dn.regex="^(.+,)?uid=([^,]+),ou=addressbook,associatedDomain=([^,]+),ou=domains,o=<basedn>$" #access to dn.regex="^(.+,)?ou=Users,dc=mydomain,dc=com,dc=br$" # by group.exact="cn=SysAdmins,ou=Groups,dc=mydomain,dc=com,dc=br" write # by * read access to * by group.exact="cn=SysAdmins,dc=mydomain,dc=com,dc=br" write by anonymous auth by * read ####################################################################### # # database definitions # ####################################################################### # # access log # database hdb suffix cn=log cachesize 10000 checkpoint 128 5 rootdn "cn=root,dc=mydomain,dc=com,dc=br" directory "/var/db/openldap/cn=log/data" index reqStart eq index reqDN pres,eq index reqAuthzID pres,eq # # dc=mydomain,dc=com,dc=br # database hdb suffix "dc=mydomain,dc=com,dc=br" cachesize 10000 checkpoint 128 5 rootdn "cn=root,dc=mydomain,dc=com,dc=br" directory /var/db/openldap/dc=mydomain/data # # Overlays # overlay smbk5pwd smbk5pwd-enable samba overlay accesslog logdb cn=log logops writes logold (objectClass=posixAccount) logpurge 30+00:00 1+00:00 overlay syncprov syncprov-checkpoint 100 5 syncprov-sessionlog 200 # Indices to maintain index objectClass eq index cn pres,sub,eq index sn pres,sub,eq index uid pres,sub,eq index displayName pres,sub,eq index uidNumber eq index gidNumber eq index memberUID eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub index entryCSN,entryUUID eq index mailAlternateAddress pres,eq index mail pres,eq database monitor # # slapd.conf end ##################### Can my acl slowing the search too much ?? How can I improve then ? Any help is very appreciated Best Regards, Alexandre

4 4

make install makes bad binaries
by Pieter Donche 28 Apr '08

28 Apr '08

I want to update my OpenLDAP to 2.3.39 on my Sun Solaris 10 last year I installed OpenLDAP 2.3.32 without problem. All software requirements as specified in the README file are met (default prefix /usr/local used) # ./configure # make # make depend # make # make test # make install all succeed but $ /usr/local/bin/ldapsearch answers: Killed on the other hand, if I use the ldapsearch binary from my openldap-2.3.39 build directory: # ./clients/tools/ldapsearch succeeds and I can perform a search on my LDAP database returning the correct results.. I noticed a big difference in size between: -rwxr-xr-x 1 root root 457772 Apr 28 09:02 ./clients/tools/ldapsearch and -rwxr-xr-x 1 root root 1023664 Apr 28 09:27 /usr/local/bin/ldapsearch All the clients tools have that same size difference between the compiled versions in ./openldap-2.3.39/clients/tools/ldap* and the ones in /usr/local/bin/ldap* I also noted (from my notes of last year), that the installed versions of the 2.3.32 did not have such size differences... What changed in make install between 2.3.32 and 2.3.39 and how to fix this?

4 5

translucent_bind
by Julien Garnier 28 Apr '08

28 Apr '08

Hi, I have a translucent overlay on my ldap server (that add attributes to my ldap_relay server) I'd like to authenticate with password stored in my translucent server because I have no write acecs in ldap_relay. When I try to authenticate with my account, I got a ldap_bind: Invalid credentials (49) error I've tried all the encryptions method to encrypt userpassword I've tried to set userpassword serch in local server ( If I search for (userpassword=*) I have a correct answer, so user password search is realy do in the local server) but authentication doesn't work, I can see in log that request is send to the remote server. I there a way to tell local server to not send authentication request to remote server ? Sample of my local slapd.conf is at the end of this message Thanks Juju ################### # slapd.conf overlay translucent translucent_no_glue translucent_local ACMO,Service,corinfo,corcom,corform,corvalo,gxlab,corsecu,userPassword,Poste,shadowLastChange translucent_remote sn,GivenName,mail,street,Postalcode,l,ou uri ldap://ldap.cp.fr lastmod off acl-bind binddn="cn=admin,..." credentials="password"

1 0

cn=config does not generate DB_CONFIG
by Mike Johnston 26 Apr '08

26 Apr '08

While I have my olcDatabase={1}hdb.ldif in cn=config directory, I can't seem to get slapd to generate the DB_CONFIG file. My options include olcDbCacheSize, olcDbNoSync etc.. For my reading, if these are specified and DB_CONFIG file exists, (it doesn't as slapd complains about it missing with -d 99), it should generate a DB_CONFIG from these settings. Any ideas? --------------------------------- Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. --------------------------------- Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now.

3 3

with DB_CONFIG, ldap slave won't start
by Adam Williams 26 Apr '08

26 Apr '08

I have an openldap slave server that works fine without a DB_CONFIG file, operating system is Fedora 8. With a DB_CONFIG file it won't start. And this is the exact same DB_CONFIG i'm using on the master server. [root@archives3 ldap]# /etc/rc.d/init.d/ldap restart Stopping slapd: [ OK ] Checking configuration files for slapd: [WARNING] bdb_db_open: Warning - No DB_CONFIG file found in directory /var/lib/ldap: (2) Expect poor performance for suffix dc=mdah,dc=state,dc=ms,dc=us. Starting slapd: [ OK ] [root@archives3 ldap]# cp ../DB_CONFIG . [root@archives3 ldap]# /etc/rc.d/init.d/ldap restart Stopping slapd: [ OK ] Checking configuration files for slapd: [FAILED] bdb_db_open: DB_CONFIG for suffix dc=mdah,dc=state,dc=ms,dc=us has changed. Performing database recovery to activate new settings. bdb_db_open: Recovery skipped in read-only mode. Run manual recovery if errors are encountered. bdb(dc=mdah,dc=state,dc=ms,dc=us): unrecognized name-value pair: 19:26:45 bdb_db_open: Database cannot be opened, err 22. Restore from backup! bdb(dc=mdah,dc=state,dc=ms,dc=us): DB_ENV->lock_id_free interface requires an environment configured for the locking subsystem backend_startup_one: bi_db_open failed! (22) slap_startup failed (test would succeed using the -u switch) stale lock files may be present in /var/lib/ldap [WARNING] [root@archives3 ldap]# ps ax|grep slapd 18193 pts/0 S+ 0:00 grep slapd [root@archives3 ldap]# rm DB_CONFIG rm: remove regular file `DB_CONFIG'? y [root@archives3 ldap]# /etc/rc.d/init.d/ldap restart Stopping slapd: [FAILED] Checking configuration files for slapd: [WARNING] bdb_db_open: Warning - No DB_CONFIG file found in directory /var/lib/ldap: (2) Expect poor performance for suffix dc=mdah,dc=state,dc=ms,dc=us. Starting slapd: [ OK ] [root@archives3 ldap]# cat ../DB_CONFIG # $OpenLDAP: pkg/ldap/servers/slapd/DB_CONFIG,v 1.1.2.1 2005/11/29 19:26:45 kurt Exp $ # Example DB_CONFIG file for use with slapd(8) BDB/HDB databases. # # See Sleepycat Berkeley DB documentation # <http://www.sleepycat.com/docs/ref/env/db_config.html> # for detail description of DB_CONFIG syntax and semantics. # # Hints can also be found in the OpenLDAP Software FAQ # <http://www.openldap.org/faq/index.cgi?file=2> # one 0.25 GB cache set_cachesize 0 268435456 1 # Data Directory #set_data_dir db # Transaction Log settings set_lg_regionmax 262144 set_lg_bsize 2097152 #set_lg_dir logs # Note: special DB_CONFIG flags are no longer needed for "quick" # slapadd(8) or slapindex(8) access (see their -q option). #DB_LOG_AUTOREMOVE set_flags DB_LOG_AUTOREMOVE

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software April 2008