openldap-software April 2008

openldap-software@openldap.org

77 participants
72 discussions

slapd crashes due to empty user password
by Simon Gao 18 Apr '08

18 Apr '08

Hi, I am seeing slapd crashing repeatedly when assigning empty password to a user account. The version is 2.3.39. Is this a known problem? Or another question is how do we disable a user account with OpenLDAP? Simon

3 2

BDB error
by Sumith Narayanan 17 Apr '08

17 Apr '08

Hi All, I installed OpenLDAP 2.3.39 & BDB 4.4.20 backend. Loaded data with slapadd. After that when I restart , I get the below error. Any pointers to help fix this would be great. Apr 17 09:44:43 dsx1 slapd[10206]: bdb_db_open: unclean shutdown detected; attempting recovery. Apr 17 09:44:44 dsx1 slapd[10206]: bdb(o=root dn): Log file corrupt at LSN: [10][10485679]\nApr 17 09:44:44 dsx1 slapd[10206]: bdb(o=root dn): PANIC: Invalid argument\nApr 17 09:45:04 dsx1 slapd[10206]: bdb(o=root dn): unable to join the environment\nApr 17 09:45:04 dsx1 slapd[10206]: bdb_db_open: Database cannot be recovered, err -30974. Restore from backup!\nApr 17 09:45:04 dsx1 slapd[10206]: bdb(o=root dn): DB_ENV->lock_id_free interface requires an environment configured for the locking subsystem\nApr 17 09:45:04 dsx1 slapd[10206]: bdb(o=root dn): txn_checkpoint interface requires an environment configured for the transaction subsystem\nApr 17 09:45:04 dsx1 slapd[10206]: bdb_db_close: txn_checkpoint failed: Invalid argument (22)\nApr 17 09:45:04 dsx1 slapd[10206]: backend_startup_one: bi_db_open failed! (-30974)\nApr 17 09:45:04 dsx1 slapd[10206]: bdb_db_close: alock_close failed\nApr 17 09:45:04 dsx1 slapd[10206]: slapd stopped.\n Thanks, Sumith.

3 2

syncrepl with accesslog database
by John Morrissey 17 Apr '08

17 Apr '08

I'm trying to replicate (with syncrepl) the bdb database generated by the accesslog overlay. This is with 2.3.41 on both provider and consumer. slapd complains: do_syncrep2: rid 002 got empty syncUUID do_syncrepl: rid 002 retrying (29 retries left) Sure enough, the entry for my accesslog database's suffix doesn't have an entryUUID: dn: cn=log objectClass: auditContainer cn: log structuralObjectClass: auditContainer contextCSN: 20080313163024Z#000000#00#000000 lastmod is not explicitly enabled for this database, but slapd.conf(5) says the default is on. I'm reasonably sure I didn't specify 'lastmod off' for that database at the time it would have been created. Given that my consumers are using delta-syncrepl (hence the accesslog), is there any reason I can't/shouldn't replicate the accesslog itself, too? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

3 6

PPolicy Questions
by Todd Merrill 17 Apr '08

17 Apr '08

Hello, I hope this is the place to send such questions. I'm having problems getting started with ppolicy. I am trying to specify a specific ppolicy entry for users without using the slapd.conf default policy. Our OpenLDAP deployment environment in Red Hat uses version 2.3.33. >From what I have read (elsewhere since the manual is missing the ppolicy config info), I must first add a new policy of objectclass 'pwdPolicy" in the policy list. I have done that without problem. I must then indicate for the users that use that policy, the DN of the new policy in the field 'pwdPolicySubentry'. My problem at this point is that I see no objectclass that contains this field. In reading the ppolicy.schema file I see that the type 'pwdPolicySubentry' is described there, but commented out. The odd thing though, is that even though it is commented out, I can see the type in my LDAP browser when I look for a list of types, and I see no description of it in the other .schema files. I did read on someone's site that the user entry should be an objectclass of 'pwdPolicy' and then the 'pwdPolicySubentry' field can be entered, but in the ppolicy.schema document, 'pwdPolicySubentry' is not described in the list of fields for objectclass 'pwdPolicy'. Do I have to edit the ppolicy.schema to get the overlay to work this way? I'm new to LDAP so perhaps I'm not understanding something basic. Any help or suggestions would be very helpful. -Todd Merrill

3 2

Problem loading LDIF data in openldap 2.4.8
by benoitde＠sympatico.ca 16 Apr '08

16 Apr '08

Hi, I tried to load a slapcat dump from OpenLDAP 2.3.27 into OpenLDAP 2.4.8, and had problems with java entries. I narrowed down the problem with this simple test case: LDIF: dn: cn=REQUEST,dc=example,dc=com javaClassName: com.ibm.mq.jms.MQQueue objectClass: javaContainer objectClass: javaObject objectClass: javaNamingReference javaFactory: com.ibm.mq.jms.MQQueueFactory cn: REQUEST javaReferenceAddress: #0#VER#6 javaReferenceAddress: #1#EXP#-2 javaReferenceAddress: #2#PRI#-2 javaReferenceAddress: #3#PER#-2 javaReferenceAddress: #4#CCS#1208 javaReferenceAddress: #5#TC#1 javaReferenceAddress: #6#ENC#273 javaReferenceAddress: #7#FIQ#1 javaReferenceAddress: #8#QU#REQUEST javaReferenceAddress: #9#QMGR#QM Load of this LDIF in OpenLDAP 2.3.27: ldapadd -D"cn=Manager,dc=example,dc=com" -W -x -f /tmp/bug.ldif Enter LDAP Password: adding new entry "cn=REQUEST,dc=example,dc=com" Works, but in OpenLDAP 2.4.8: ldapadd -h sdco1cdba -p 1389 -D"cn=Manager,dc=example,dc=com" -W -x -f /tmp/bug.ldif Enter LDAP Password: adding new entry "cn=REQUEST,dc=example,dc=com" ldap_add: Object class violation (65) additional info: instanstantiation of abstract objectClass 'javaObject' not allowed And the entry is not loaded. I tried to define the entry with the JMSAdmin tool that comes with IBM MQ, but could not load it either in 2.4.8, it worked against 2.3.27. A wireshark dump showed that the tool received the same error as ldapadd. I performed a "diff" on the java.schema of 2.4.8 and 2.3.27, but the schemas are identical. Is there any way that I could circumvent this problem? Thanks!

2 2

fast slapcat and slow slapadd
by Piotr Wadas 16 Apr '08

16 Apr '08

Hello, Using openldap 2.3.38 on 2.6.24 with bdb/hdb backend. I got about 12-13 000 entries in my directory. Slapcat takes seconds, while slapadd takes 15 minutes or more. Is there any way to speed it up, which I've missed? to slapadd I do: /etc/init.d/slapd stop && cd /var/lib/ldap && ls |grep -v DB_CONFIG|xargs rm && cat slapcat-output-file|slapadd currently the best way to minimize downtime I found is to replace "directory" line in slapd.conf, then do slapadd "into" new physical location, and then just stop slapd, change dirname, change directory line back, and start again. I'm afraid it's actually not slapd issue, but just some file-reading/adding -related thing. Is it some better workaround for this with newer release? I'd be happy to jump to 2.4.7 series, but it still seems a little bit unstable, segfaults sometimes with some searches. Regards, PW

4 3

A question about pwdMinAge
by Ryan Steele 15 Apr '08

15 Apr '08

Hey List, I wanted to test the scenario where a user had forgotten his password, and needed to have it reset. I wanted to give this user the ability change this temporary password if they wanted. To do this, I: 1. Executed ldappasswd, binding as the rootdn, to change the user's password 2. Used ldapvi to reset the sambaPwdCanChange and sambaPwdLastSet attributes 3. Logged in to the domain as the user 4. Hit Ctrl+Alt+Delete and selected "Change Password" However, because my ppolicy pwdMinAge hadn't expired yet, the user was unable to change the password. So, it seems necessary to be able to change that value for the user so he/she can change their password. I couldn't find an attribute called pwdMinAge, but I'm assuming that's because it just looks at pwdChangedTime. I 'assume' because I couldn't find explicit documentation stating this, though the man page definition for pwdChangedTime says "[pwdChangedTime] is used by the password expiration policy to determine whether the password is too old to be allowed to be used for user authentication." Is this why I see a NT_STATUS_WRONG_PASSWORD returned from LDAP when a user tries to change a password that is being protected by pwdMinAge? And, is executing an ldapmodify the proper thing to do in this situation to change the pwdChangedTime and allow the user to change his/her password? E.g.: ldapmodify -D "cn=admin,dc=example,dc=com" -W dn: uid=someuser,ou=Users,dc=example,dc=com changetype: modify replace: pwdChangedTime pwdChangedTime: 1207690188Z Thanks as always, Ryan

4 6

BDB error while starting openldap.
by Sumith Narayanan 15 Apr '08

15 Apr '08

Hi, I am getting the below error while starting openLDAP. bdb_db_open: alock package is unstable backend_startup_one: bi_db_open failed! (-1) slapd shutdown: initiated ====> bdb_cache_release_all ====> bdb_cache_release_all ====> bdb_cache_release_all slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. However, if I am using sudo access, I get no error and could successfully start the server and search the DB. Could anyone please help let me know what the cause for this error is ? I am using Berkeley DB 4.4.20 OpenLDAP version : 2.3.39 Thanks, Sumith.

2 2

insecure, convenient use of SSL
by Jason Dusek 15 Apr '08

15 Apr '08

I'd like to set up LDAP command line tools to point to a server -- say localhost -- that has a certificate with an arbitrary name in it -- say `my-domain.com`. I'm not entirely sure how to my LDAP tools to do that, though -- or if it's possible. By default, OpenLDAP is wound up pretty tight. -- _jsn

5 7

Not able to get GSSAPI in supportedSASLMechanisms list
by Padmavathi Dt 15 Apr '08

15 Apr '08

Hii List, I am trying to get LDAP with SASL-GSSAPI mechanism. I have openldap-2.4.7 on RHEL 4. I have installed Cyrus sasl-2.1.21. I have compiled LDAP with cyrus SASL support as: [root@as3 libexec]# env LD_LIBRARY_PATH="/usr/local/BerkeleyDB.4.6/lib:/usr/loc al/lib/sasl2:/usr/local/ssl/lib" CPPFLAGS="-I/usr/local/BerkeleyDB.4.6/include -I/usr/local/ssl/include -I/usr/local/include" LDFLAGS="-L/usr/local/ssl/lib -L /usr/local/BerkeleyDB.4.6/lib -L/usr/local/lib/sasl2 " LIBS=-ldl ./configure --with-tls=openssl --with-cyrus-sasl It was fine. SASL was compiled as: $ ./configure --disable-cram --disable-digest --disable-krb4 --disable-otp --enable-gssapi --with-gss_impl=mit In /usr/lib/sasl2,it has [root@as3 sasl2]# ls libgssapi* libgssapiv2.la libgssapiv2.so libgssapiv2.so.2 libgssapiv2.so.2.0.19 When I run : [root@as3 libexec]# saslauthd -V saslauthd 2.1.21 authentication mechanisms: getpwent rimap shadow I also have a working kerberos .I am able to get tickets from kerberos.I have added ldap host principal to kerberos database. I have my slapd.conf as: (sasl related part) sasl-host as3 sasl-realm BSNL.COM authz-regexp uid=([^,]*),cn=bsnl.com,cn=gssapi,cn=auth uid=$1,ou=people,dc=bsnl,dc=com (Also,I have added the first two lines after seing some mailing list.In the admin guide nothing was mentioned about adding the two lines.Please tell me whether it is correct?) According to HOWTO doc from www.bayour.com,when we query ldap for supportedSASLMechanisms,it should show GSSAPI(my whole purpose).But when I give the following: [root@as3 openldap]# /usr/bin/ldapsearch -H "ldaps://:12345" -x -b "" -s base -LLL supportedSASLMechanisms dn: supportedSASLMechanisms: NTLM supportedSASLMechanisms: PLAIN supportedSASLMechanisms: LOGIN Does it mean that LDAP was not built with SASL support? I have slapd.conf in /usr/lib/sasl2 as: pwcheck_method: /usr/sbin/saslauthd saslauthd_path: /var/run/saslauthd/mux mech_list: plain login ntlm kerberos5 I am not able to get SASL-GSSAPI as supportedSASLMechanism.From where does the LDAP get this list? What should I do to add one more mechanism to supportedSASLMechanisms list? What may be the problem.....? Please guide me....I was struck at this point and not able to come out Thanx a lot in advance..... Thanx and Regards, Padmavathi =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software April 2008