openldap-software May 2008

openldap-software@openldap.org

64 participants
55 discussions

Supported RFC's and "features"
by Clowser, Jeff (Contractor) 14 Jul '09

14 Jul '09

I'm currently doing a review to see how OpenLDAP compares, *feature wise* ATM, to other directory servers and specifically to the Sun DS - i.e. to get a definitive list of features it's missing that Sun has and what it has that Sun doesn't have, etc. For brevity, I haven't included all the potentially useful features of OpenLDAP, but have just focused on those associated with 1) RFC compliance (of which Sun may or may not meet) and 2) features to match the Sun DS (which it would be replacing). So far, here's what I have for OpenLDAP: RFC 4510 (which includes 4511-4519). There was recent discussion on the list around this, such that in some cases, not everything that changed from 3377 (which includes 2251-2256, 2829, and 2830) to 4510 has been updated in OpenLDAP, but I think those issues are fairly minor. The following additional RFC's are supported in OpenLDAP: - RFC 2247 and RFC 3088 - RFC 2696 simple paged results - RFC 2849 ldif - RFC 3062 password mod op - RFC 3296 named referals, manageDSAit - RFC 3673 All Op attrs + feature - RFC 3687 Component matching rules - RFC 3866 Languange tag and range - RFC 3876 matched values control - RFC 4370 proxy auth - RFC 4522 binary encoding - RFC 4523 x.509 cert schema - RFC 4524 COSINE schema - RFC 4525 Mod-increment - RFC 4526 Absolute true/false filters - RFC 4527 pre/post read control - RFC 4528 assertion control - RFC 4529 request attrs by objectclass - RFC 4530 entryUUID - RFC 4532 whoamI - RFC 4533 Content Sync op (replication) RFC's NOT supported are: - RFC 2589 dds Seems with 2.4, this has gone from experimental to production quality? - RFC 2891 server side sorting - RFC 3671 collective attributes - RFC 3928 LCUP mainly for updating cached addressbooks, etc - not replication between servers - RFC 3384 looks like just reqs for replication, not an actual replication protocol - RFC 4533 is used instead Unknown: - RFC 3672 (subentries) - RFC 3698 and 3727 (additional matching rules) - RFC 3909 LDAP Cancel operation - RFC 5020 entryDN operational attribute (There are some other, often obscure, LDAP related RFC's that I didn't include, but this seems to be the major/useful ones) Other features not supported: - VLV browse indexes (per http://tools.ietf.org/html/draft-ietf-ldapext-ldapv3-vlv-09). Not an RFC, but supported by Sun and MS directories, and used by things like Outlook and Solaris. Other supported features: - dyngroup/dynlist/memberof overlay (A much more useful feature than Sun's groupOfURLs "dynamic" group and "roles" mechanism) - ppolicy overlay (matches Sun DS 5.x reasonably close, but is account lockout replicated to all servers? Sun DS 6.x claims to) - refint overlay (similar to Sun's referential integrity plugin) - unique overlay (similar to Sun's uniqueness plugin) - audit and accesslog overlays, syslog logging - much more useful/complete than Sun's access/audit/error logs. - live acl changes via LDAP Unknown features: - Per user resource limits (sizelimit, timelimit, idletimeout, etc). I think Howard Chu said OpenLDAP has some of this, but I haven't seen any reference to it or how to use it in the docs (does this functionality exist, and if so, is there any documentation?) - Tracking of last login (i.e. last successful ldap authentication) Is this still fairly accurate? The ones that are really problematic are the lack of: - VLV Browse indexes - RFC 2891 (server side sorting) - per user/entry resources limits (if they don't exist) Are there any unofficial updates/patches/overlays/plans for any of this functionality? Thanks, - Jeff

11 29

enumeratin all ldap objects in a LDAP ?
by Michael Arndt 12 Jun '08

12 Jun '08

Hello *, what is a "good" way to enumerate all objects in an open ldap in order to get a total count of defined objects ? ( how many objects ..) TIA Michael PS: Sorry if i should know this by reading basic infos -- Vorstand/Board of Management: Dr. Bernd Finkbeiner, Dr. Florian Geyer, Dr. Roland Niemeier, Dr. Arno Steitz, Dr. Ingrid Zech Vorsitzender des Aufsichtsrats/ Chairman of the Supervisory Board: Prof. Dr. Hanns Ruder Sitz/Registered Office: Tuebingen Registergericht/Registration Court: Stuttgart Registernummer/Commercial Register No.: HRB 382196

5 4

using slapo-pcache with an empty attr list
by Toby Blake 06 Jun '08

06 Jun '08

Hi all, I'm doing a bit of playing with slapo-pcache and have it working fairly well (particularly once I realised that an individual attr can live in only one proxyattrset). However, there's one bit that I can't get working - is there any way to define a template that will match a search which doesn't provide an attr list? i.e. I can see quite a few searches (presumably from amd) of the following form (spacing and formatting changed by me to make it more readable): Jul 23 14:54:16 host1 slapd[26671]: conn=49 op=1 SRCH base="dc=inf,dc=ed,dc=ac,dc=uk" scope=2 deref=0 filter="(&(objectClass=amdmap)(amdmapName=home)(amdmapKey=root))" Jul 23 14:54:16 host1 slapd[26671]: query template of incoming query = (&(objectClass=)(amdmapName=)(amdmapKey=)) Jul 23 14:54:16 host1 slapd[26671]: QUERY NOT ANSWERABLE Jul 23 14:54:16 host1 slapd[26671]: QUERY NOT CACHEABLE Jul 23 14:54:16 host1 slapd[26671]: conn=49 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Note that there's no 'SRCH attr=' line. I've tried proxyattrset of the following forms... proxyattrset 1 * proxyattrset 1 (both of which crash slapd) And also proxyattrset 1 <full list of attrs returned when none specified> .... but this didn't work either. Thanks in advance for any advice, Cheers Toby Blake School of Informatics University of Edinburgh

3 8

OpenLDAP as proxy for another LDAP-Server [Virus checked]
by ems＠Sparkassen-Informatik.de 03 Jun '08

03 Jun '08

Hello, in the mailing list's archive is a lot of stuff about OpenLDAP as proxy for another LDAP-Server using the ldap/meta backend, but I didn't find an answere of my question (it's possible that I don't see the wood for the trees). I've the following problem: Our OpenLDAP get's an request which contained a User-ID and Password from a LDAP-Client. Our OpenLDAP propagate the authentification (User-ID, Password) of the request to another LDAP-Server using the ldap/meta backend. If the authentification is o.k. our OpenLDAP contributes the reamining attributes (tel. number, surname etc.) and gives they back to the requester. I need as a response of a request an interaction of two LDAP-Server. From the other LDAP-Server the authentification and if successfull from our LDAP-Server the attributes. Is there a fair chance to get a solution using the ldap/meta backend. Thanks in advance for your efforts Klaus

6 9

Use wildcard on ipHostNumber and gidNumber attribute
by Thibaut VdK 03 Jun '08

03 Jun '08

Hello, I'm using OpenLDAP 2.3.3 (debian etch package). I'm trying to use a wildcard in a ldapsearch like this : ldapsearch -x -W -D "cn=admin,dc=planetb,dc=fr" "ipHostNumber=10.10.*" This search return any results. I know that I can't use a wildcard on a ipHostNumber attribut because it don't have SUBSTR MatchingRules. So i try to change my nis.scema like this : attributetype ( 1.3.6.1.1.1.1.19 NAME 'ipHostNumber' DESC 'IP address' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) But, the seach always return any results. I would like know how to force substr search on this attribute ! It is possible ? And it is possible on attribute "gidNumber" too? Thanks ! Thibaut Vdk. (Sorry for my english)

3 3

slapd 2.4.7-2.4.9 segfaults with some specific search
by Piotr Wadas 03 Jun '08

03 Jun '08

Hello, I build openldap 2.4.7 a few weeks ago, and 2.4.9 yesterday, with 2.4.7 and 2.4.9, without any my patches, just a clean build. After adding my custom schema, uploading my data from production version, and indexing, I still have it crash with some specific search - I was hoping 2.4.9 have this resolved, seems not, so posting this. I distracted example search which always causes segfault, each time, 100% reproductible. Have nice reading.. :) I'd be glad to report I replaced my production with 2.4.x series, thanx upwards for any hint :) Should I perform some gdb-enabled build, and post some core? I'm currently ahead to do this. Details: ============== ============== slapd.conf: include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/dnsdomain2.schema include /etc/ldap/schema/sendmail.pw.schema include /etc/ldap/schema/misc.schema include /etc/ldap/schema/ISPEnv2.schema include /etc/ldap/schema/mod_vhost_ldap.schema include /etc/ldap/schema/local.schema include /etc/ldap/schema/hpl.schema include /etc/ldap/schema/apache_ext.schema include /etc/ldap/schema/apache_alias.schema include /etc/ldap/schema/autofs.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_bdb backend bdb loglevel 0 database bdb cachesize 300000 concurrency 256 threads 32 lastmod on suffix "dc=ROOT" checkpoint 128 60 directory "/var/lib/ldap" sizelimit unlimited timelimit 16 include /etc/ldap/indexes rootdn "cn=Directory Manager,dc=ROOT" access to * by dn="cn=Read Only,dc=ROOT" read by * auth access to attrs=userPassword by anonymous auth by self write by * auth access to dn.base="dc=ROOT" by * auth access to dn.base="" by * auth ============== ============== /var/lib/ldap/DB_CONFIG is as follows: set_cachesize 0 2097152 0 set_lg_regionmax 1048576 set_lg_max 1048576 set_lk_max_objects 5000 set_lk_max_locks 5000 set_lk_max_lockers 5000 ============== ============== the database is loaded with slapadd (no -q) just before search, and after indexing, with or without any changes before fatal search slapd is started as follows: root@gnp34:~# slaptest config file testing succeeded root@gnp34:~# slapd -u root -g root \ -h ldap://192.168.0.221:389/ ldapi:/// \ -d $((1+2+4+8+16+32+64+128+256+512+1024+2048+4096+8192+16384)) ============== ============== the search parameters are: root@gnp34:~# ldapsearch -vvv -xh 192.168.0.221 \ -WD "cn=Directory Manager,dc=ROOT" -b "dc=dns,dc=nameservers,dc=ROOT" '(&(objectClass=dNSDomain)(associatedDomain=*fakedomain.com)(customerID=10125)(SOARecord=*)(NSRecord=*)(topLevelDomain=TRUE))' ldap_initialize( ldap://192.168.0.221 ) Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=dns,dc=nameservers,dc=ROOT> with scope subtree # filter: (&(objectClass=dNSDomain)(associatedDomain=*fakedomain.com)(customerID=10125)(SOARecord=*)(NSRecord=*)(topLevelDomain=TRUE)) # requesting: ALL # ldap_result: Can't contact LDAP server (-1) ================================================================== The same search on 2.3.x (production, old stable) with the same data, same indexing, same DB_CONFIG etc. returns the following object: (all my custom attributes are SUP of some standard text/bool attrs, no custom syntaxes nor other advanced customizing ) # fakedomain.com.dns.nameservers.ROOT dn: dc=fakedomain.com,dc=dns,dc=nameservers,dc=ROOT objectClass: top objectClass: dNSDomain objectClass: domainRelatedObject objectClass: managedAccessObject associatedDomain: fakedomain.com dc: fakedomain.com aRecord: AA.BB.CC.DD nSRecord: ns0.otherfakedomain.com nSRecord: ns1.otherfakedomain.com sOARecord: ns0.otherfakedomain.com hostmaster.otherfakedomain.com 2008011307 300 150 2592000 300 mXRecord: 10 mx10.fakedomain.com mXRecord: 20 mx20.fakedomain.com mXRecord: 30 mx10.otherfakedomain.com mXRecord: 40 mx20.otherfakedomain.com customerID: 10125 topLevelDomain: TRUE isActive: TRUE isBlocked: FALSE # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 ==================== ==================== build configuration is: --prefix=/usr --libexecdir='${prefix}/lib' --sysconfdir=/etc --localstatedir=/var --mandir='${prefix}/share/man' --enable-debug --enable-dynamic --enable-syslog --enable-proctitle --enable-ipv6 --enable-local --enable-slapd --enable-aci --enable-cleartext --enable-crypt --disable-lmpasswd --enable-spasswd --enable-modules --enable-rewrite --enable-rlookups --enable-slapi --enable-slp --enable-wrappers --enable-backends=mod --enable-ldbm=no --enable-overlays=mod --with-subdir=ldap --with-cyrus-sasl --with-threads --with-tls=gnutls --with-odbc=unixodbc ==================== ==================== and finally debug log collected contains (1000+ lines of initialization skipped ) as follows: slapd starting daemon: added 4r listener=(nil) daemon: added 7r listener=0x8199078 daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(7): daemon: epoll: listen=7 busy >>> slap_listener(ldap://192.168.0.221:389/) daemon: listen=7, new connection on 12 daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: added 12r (active) listener=(nil) daemon: activity on 1 descriptor conn=0 fd=12 ACCEPT from IP=XX.YY.ZZ.MM:53598 (IP=192.168.0.221:389) daemon: activity on: 12r daemon: read active on 12 connection_get(12) daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero connection_get(12): got connid=0 connection_read(12): checking for input on id=0 ber_get_next ldap_read: want=8, got=8 0000: 30 30 02 01 01 60 2b 02 00...`+. ldap_read: want=42, got=42 0000: 01 03 04 1c 63 6e 3d 44 69 72 65 63 74 6f 72 79 ....cn=Directory 0010: 20 4d 61 6e 61 67 65 72 2c 64 63 3d 52 4f 4f 54 Manager,dc=ROOT 0020: 80 08 6b 7a 64 70 6d 31 6f 75 ..SECRET ber_get_next: tag 0x30 len 48 contents: ber_dump: buf=0x8263190 ptr=0x8263190 end=0x82631c0 len=48 0000: 02 01 01 60 2b 02 01 03 04 1c 63 6e 3d 44 69 72 ...`+.....cn=Dir 0010: 65 63 74 6f 72 79 20 4d 61 6e 61 67 65 72 2c 64 ectory Manager,d 0020: 63 3d 52 4f 4f 54 80 08 6b 7a 64 70 6d 31 6f 75 c=ROOT..SECRET ber_get_next ldap_read: want=8 error=Resource temporarily unavailable daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero conn=0 op=0 do_bind ber_scanf fmt ({imt) ber: ber_dump: buf=0x8263190 ptr=0x8263193 end=0x82631c0 len=45 0000: 60 2b 02 01 03 04 1c 63 6e 3d 44 69 72 65 63 74 `+.....cn=Direct 0010: 6f 72 79 20 4d 61 6e 61 67 65 72 2c 64 63 3d 52 ory Manager,dc=R 0020: 4f 4f 54 80 08 6b 7a 64 70 6d 31 6f 75 OOT..SECRET ber_scanf fmt (m}) ber: ber_dump: buf=0x8263190 ptr=0x82631b6 end=0x82631c0 len=10 0000: 00 08 6b 7a 64 70 6d 31 6f 75 ..SECRET >>> dnPrettyNormal: <cn=Directory Manager,dc=ROOT> => ldap_bv2dn(cn=Directory Manager,dc=ROOT,0) <= ldap_bv2dn(cn=Directory Manager,dc=ROOT)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Directory Manager,dc=ROOT)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=directory manager,dc=root)=0 <<< dnPrettyNormal: <cn=Directory Manager,dc=ROOT>, <cn=directory manager,dc=root> conn=0 op=0 BIND dn="cn=Directory Manager,dc=ROOT" method=128 do_bind: version=3 dn="cn=Directory Manager,dc=ROOT" method=128 ==> bdb_bind: dn: cn=Directory Manager,dc=ROOT bdb_dn2entry("cn=directory manager,dc=root") => bdb_dn2id("dc=root") <= bdb_dn2id: got id=0x1 => bdb_dn2id("cn=directory manager,dc=root") <= bdb_dn2id: got id=0x2 entry_decode: "cn=Directory Manager,dc=ROOT" <= entry_decode(cn=Directory Manager,dc=ROOT) => access_allowed: auth access to "cn=Directory Manager,dc=ROOT" "userPassword" requested => acl_get: [1] attr userPassword => slap_access_allowed: result not in cache (userPassword) => acl_mask: access to entry "cn=Directory Manager,dc=ROOT", attr "userPassword" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: cn=nobody,dc=root <= check a_dn_pat: * <= acl_mask: [2] applying auth(=xd) (stop) <= acl_mask: [2] mask: auth(=xd) => slap_access_allowed: auth access granted by auth(=xd) => access_allowed: auth access granted by auth(=xd) conn=0 op=0 BIND dn="cn=Directory Manager,dc=ROOT" mech=SIMPLE ssf=0 do_bind: v3 bind: "cn=Directory Manager,dc=ROOT" to "cn=Directory Manager,dc=ROOT" send_ldap_result: conn=0 op=0 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=1 tag=97 err=0 ber_flush2: 14 bytes to sd 12 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ daemon: activity on 1 descriptor daemon: activity on: 12r daemon: read active on 12 daemon: epoll: listen=7 active_threads=0 tvp=zero ldap_write: want=14, written=14 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ conn=0 op=0 RESULT tag=97 err=0 text= connection_get(12) connection_get(12): got connid=0 connection_read(12): checking for input on id=0 ber_get_next ldap_read: want=8, got=8 0000: 30 81 b7 02 01 02 63 81 0.....c. ldap_read: want=178, got=178 0000: b1 04 1d 64 63 3d 64 6e 73 2c 64 63 3d 6e 61 6d ...dc=dns,dc=nam 0010: 65 73 65 72 76 65 72 73 2c 64 63 3d 52 4f 4f 54 eservers,dc=ROOT 0020: 0a 01 02 0a 01 03 02 01 00 02 01 00 01 01 00 a0 ................ 0030: 7f a3 18 04 0b 6f 62 6a 65 63 74 43 6c 61 73 73 .....objectClass 0040: 04 09 64 4e 53 44 6f 6d 61 69 6e a4 21 04 10 61 ..dNSDomain.!..a 0050: 73 73 6f 63 69 61 74 65 64 44 6f 6d 61 69 6e 30 ssociatedDomain0 0060: 0d 82 0b 63 6f 72 73 61 72 69 6f 2e 70 6c a3 13 ...fakedomain.com.. 0070: 04 0a 63 75 73 74 6f 6d 65 72 49 44 04 05 31 30 ..customerID..10 0080: 31 32 35 87 09 53 4f 41 52 65 63 6f 72 64 87 08 125..SOARecord.. 0090: 4e 53 52 65 63 6f 72 64 a3 16 04 0e 74 6f 70 4c NSRecord....topL 00a0: 65 76 65 6c 44 6f 6d 61 69 6e 04 04 54 52 55 45 evelDomain..TRUE 00b0: 30 00 0. ber_get_next: tag 0x30 len 183 contents: ber_dump: buf=0x8273e80 ptr=0x8273e80 end=0x8273f37 len=183 0000: 02 01 02 63 81 b1 04 1d 64 63 3d 64 6e 73 2c 64 ...c....dc=dns,d 0010: 63 3d 6e 61 6d 65 73 65 72 76 65 72 73 2c 64 63 c=nameservers,dc 0020: 3d 52 4f 4f 54 0a 01 02 0a 01 03 02 01 00 02 01 =ROOT........... 0030: 00 01 01 00 a0 7f a3 18 04 0b 6f 62 6a 65 63 74 ..........object 0040: 43 6c 61 73 73 04 09 64 4e 53 44 6f 6d 61 69 6e Class..dNSDomain 0050: a4 21 04 10 61 73 73 6f 63 69 61 74 65 64 44 6f .!..associatedDo 0060: 6d 61 69 6e 30 0d 82 0b 63 6f 72 73 61 72 69 6f main0...corsario 0070: 2e 70 6c a3 13 04 0a 63 75 73 74 6f 6d 65 72 49 .pl....customerI 0080: 44 04 05 31 30 31 32 35 87 09 53 4f 41 52 65 63 D..10125..SOARec 0090: 6f 72 64 87 08 4e 53 52 65 63 6f 72 64 a3 16 04 ord..NSRecord... 00a0: 0e 74 6f 70 4c 65 76 65 6c 44 6f 6d 61 69 6e 04 .topLevelDomain. 00b0: 04 54 52 55 45 30 00 .TRUE0. ber_get_next ldap_read: want=8 error=Resource temporarily unavailable daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero conn=0 op=1 do_search ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x8273e80 ptr=0x8273e83 end=0x8273f37 len=180 0000: 63 81 b1 04 1d 64 63 3d 64 6e 73 2c 64 63 3d 6e c....dc=dns,dc=n 0010: 61 6d 65 73 65 72 76 65 72 73 2c 64 63 3d 52 4f ameservers,dc=RO 0020: 4f 54 0a 01 02 0a 01 03 02 01 00 02 01 00 01 01 OT.............. 0030: 00 a0 7f a3 18 04 0b 6f 62 6a 65 63 74 43 6c 61 .......objectCla 0040: 73 73 04 09 64 4e 53 44 6f 6d 61 69 6e a4 21 04 ss..dNSDomain.!. 0050: 10 61 73 73 6f 63 69 61 74 65 64 44 6f 6d 61 69 .associatedDomai 0060: 6e 30 0d 82 0b 63 6f 72 73 61 72 69 6f 2e 70 6c n0...fakedomain.com 0070: a3 13 04 0a 63 75 73 74 6f 6d 65 72 49 44 04 05 ....customerID.. 0080: 31 30 31 32 35 87 09 53 4f 41 52 65 63 6f 72 64 10125..SOARecord 0090: 87 08 4e 53 52 65 63 6f 72 64 a3 16 04 0e 74 6f ..NSRecord....to 00a0: 70 4c 65 76 65 6c 44 6f 6d 61 69 6e 04 04 54 52 pLevelDomain..TR 00b0: 55 45 30 00 UE0. >>> dnPrettyNormal: <dc=dns,dc=nameservers,dc=ROOT> => ldap_bv2dn(dc=dns,dc=nameservers,dc=ROOT,0) <= ldap_bv2dn(dc=dns,dc=nameservers,dc=ROOT)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=dns,dc=nameservers,dc=ROOT)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=dns,dc=nameservers,dc=root)=0 <<< dnPrettyNormal: <dc=dns,dc=nameservers,dc=ROOT>, <dc=dns,dc=nameservers,dc=root> SRCH "dc=dns,dc=nameservers,dc=ROOT" 2 3 0 0 0 begin get_filter AND begin get_filter_list begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0x8273e80 ptr=0x8273eb6 end=0x8273f37 len=129 0000: a3 18 04 0b 6f 62 6a 65 63 74 43 6c 61 73 73 04 ....objectClass. 0010: 09 64 4e 53 44 6f 6d 61 69 6e a4 21 04 10 61 73 .dNSDomain.!..as 0020: 73 6f 63 69 61 74 65 64 44 6f 6d 61 69 6e 30 0d sociatedDomain0. 0030: 82 0b 63 6f 72 73 61 72 69 6f 2e 70 6c a3 13 04 ..fakedomain.com... 0040: 0a 63 75 73 74 6f 6d 65 72 49 44 04 05 31 30 31 .customerID..101 0050: 32 35 87 09 53 4f 41 52 65 63 6f 72 64 87 08 4e 25..SOARecord..N 0060: 53 52 65 63 6f 72 64 a3 16 04 0e 74 6f 70 4c 65 SRecord....topLe 0070: 76 65 6c 44 6f 6d 61 69 6e 04 04 54 52 55 45 30 velDomain..TRUE0 0080: 00 . end get_filter 0 begin get_filter SUBSTRINGS begin get_ssa ber_scanf fmt ({m) ber: ber_dump: buf=0x8273e80 ptr=0x8273ed0 end=0x8273f37 len=103 0000: 00 21 04 10 61 73 73 6f 63 69 61 74 65 64 44 6f .!..associatedDo 0010: 6d 61 69 6e 30 0d 82 0b 63 6f 72 73 61 72 69 6f main0...corsario 0020: 2e 70 6c a3 13 04 0a 63 75 73 74 6f 6d 65 72 49 .pl....customerI 0030: 44 04 05 31 30 31 32 35 87 09 53 4f 41 52 65 63 D..10125..SOARec 0040: 6f 72 64 87 08 4e 53 52 65 63 6f 72 64 a3 16 04 ord..NSRecord... 0050: 0e 74 6f 70 4c 65 76 65 6c 44 6f 6d 61 69 6e 04 .topLevelDomain. 0060: 04 54 52 55 45 30 00 .TRUE0. ber_scanf fmt (m) ber: ber_dump: buf=0x8273e80 ptr=0x8273ee6 end=0x8273f37 len=81 0000: 82 0b 63 6f 72 73 61 72 69 6f 2e 70 6c a3 13 04 ..fakedomain.com... 0010: 0a 63 75 73 74 6f 6d 65 72 49 44 04 05 31 30 31 .customerID..101 0020: 32 35 87 09 53 4f 41 52 65 63 6f 72 64 87 08 4e 25..SOARecord..N 0030: 53 52 65 63 6f 72 64 a3 16 04 0e 74 6f 70 4c 65 SRecord....topLe 0040: 76 65 6c 44 6f 6d 61 69 6e 04 04 54 52 55 45 30 velDomain..TRUE0 0050: 00 . FINAL end get_ssa end get_filter 0 begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0x8273e80 ptr=0x8273ef3 end=0x8273f37 len=68 0000: 00 13 04 0a 63 75 73 74 6f 6d 65 72 49 44 04 05 ....customerID.. 0010: 31 30 31 32 35 87 09 53 4f 41 52 65 63 6f 72 64 10125..SOARecord 0020: 87 08 4e 53 52 65 63 6f 72 64 a3 16 04 0e 74 6f ..NSRecord....to 0030: 70 4c 65 76 65 6c 44 6f 6d 61 69 6e 04 04 54 52 pLevelDomain..TR 0040: 55 45 30 00 UE0. end get_filter 0 begin get_filter PRESENT ber_scanf fmt (m) ber: ber_dump: buf=0x8273e80 ptr=0x8273f08 end=0x8273f37 len=47 0000: 00 09 53 4f 41 52 65 63 6f 72 64 87 08 4e 53 52 ..SOARecord..NSR 0010: 65 63 6f 72 64 a3 16 04 0e 74 6f 70 4c 65 76 65 ecord....topLeve 0020: 6c 44 6f 6d 61 69 6e 04 04 54 52 55 45 30 00 lDomain..TRUE0. end get_filter 0 begin get_filter PRESENT ber_scanf fmt (m) ber: ber_dump: buf=0x8273e80 ptr=0x8273f13 end=0x8273f37 len=36 0000: 00 08 4e 53 52 65 63 6f 72 64 a3 16 04 0e 74 6f ..NSRecord....to 0010: 70 4c 65 76 65 6c 44 6f 6d 61 69 6e 04 04 54 52 pLevelDomain..TR 0020: 55 45 30 00 UE0. end get_filter 0 begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0x8273e80 ptr=0x8273f1d end=0x8273f37 len=26 0000: 00 16 04 0e 74 6f 70 4c 65 76 65 6c 44 6f 6d 61 ....topLevelDoma 0010: 69 6e 04 04 54 52 55 45 30 00 in..TRUE0. end get_filter 0 end get_filter_list end get_filter 0 filter: (&(objectClass=dNSDomain)(associatedDomain=*fakedomain.com)(customerID=10125)(sOARecord=*)(nSRecord=*)(topLevelDomain=TRUE)) ber_scanf fmt ({M}}) ber: ber_dump: buf=0x8273e80 ptr=0x8273f35 end=0x8273f37 len=2 0000: 00 00 .. attrs: conn=0 op=1 SRCH base="dc=dns,dc=nameservers,dc=ROOT" scope=2 deref=3 filter="(&(objectClass=dNSDomain)(associatedDomain=*fakedomain.com)(customerID=10125)(sOARecord=*)(nSRecord=*)(topLevelDomain=TRUE))" => bdb_search bdb_dn2entry("dc=dns,dc=nameservers,dc=root") => bdb_dn2id("dc=nameservers,dc=root") <= bdb_dn2id: got id=0x4 => bdb_dn2id("dc=dns,dc=nameservers,dc=root") <= bdb_dn2id: got id=0x5 entry_decode: "dc=dns,dc=nameservers,dc=ROOT" <= entry_decode(dc=dns,dc=nameservers,dc=ROOT) => access_allowed: search access to "dc=dns,dc=nameservers,dc=ROOT" "entry" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) search_candidates: base="dc=dns,dc=nameservers,dc=root" (0x00000005) scope=2 => bdb_filter_candidates EQUALITY => bdb_equality_candidates (objectClass) => key_read bdb_idl_fetch_key: [01872a84] <= bdb_index_read: failed (-30990) <= bdb_equality_candidates: id=0, first=0, last=0 <= bdb_filter_candidates: id=0 first=0 last=0 => bdb_dn2idl("dc=dns,dc=nameservers,dc=root") bdb_idl_fetch_key: @dc=dns,dc=nameservers,dc=root <= bdb_dn2idl: id=4010 first=5 last=13487 => bdb_filter_candidates AND => bdb_list_candidates 0xa0 => bdb_filter_candidates OR => bdb_list_candidates 0xa1 => bdb_filter_candidates EQUALITY => bdb_equality_candidates (objectClass) => key_read bdb_idl_fetch_key: [b49dA1940] <= bdb_index_read: failed (-30990) <= bdb_equality_candidates: id=0, first=0, last=0 <= bdb_filter_candidates: id=0 first=0 last=0 => bdb_filter_candidates AND => bdb_list_candidates 0xa0 => bdb_filter_candidates EQUALITY => bdb_equality_candidates (objectClass) => key_read bdb_idl_fetch_key: [a45a345e] <= bdb_index_read 4049 candidates <= bdb_equality_candidates: id=4049, first=6, last=13487 <= bdb_filter_candidates: id=4049 first=6 last=13487 => bdb_filter_candidates SUBSTRINGS => bdb_substring_candidates (associatedDomain) => key_read bdb_idl_fetch_key: [612e9033] <= bdb_index_read 1127 candidates => key_read bdb_idl_fetch_key: [0ba8920a] <= bdb_index_read 46 candidates => key_read bdb_idl_fetch_key: [003a7d56] <= bdb_index_read 63 candidates => key_read bdb_idl_fetch_key: [d9fbeb39] <= bdb_index_read 63 candidates => key_read bdb_idl_fetch_key: [5eaf4814] <= bdb_index_read 29 candidates <= bdb_substring_candidates: 29, first=5287, last=12929 <= bdb_filter_candidates: id=29 first=5287 last=12929 => bdb_filter_candidates EQUALITY => bdb_equality_candidates (customerID) => key_read bdb_idl_fetch_key: [8000278d] <= bdb_index_read 125 candidates => key_read bdb_idl_fetch_key: [0ba8920a] <= bdb_index_read: failed (-30990) Segmentation fault =============================================== =================================================

3 9

Delta-syncrepl issue
by Kieran JOYEUX 03 Jun '08

03 Jun '08

Hi guys, I got an issue setting up a delta-syncrepl replication. It's Here is my provider and consumer syslog output. Do you have any ideas of what's going on, or a clue to lead my search, i'll be really grateful... I kind have a headache right now... Thanks a lot for your help. Regards, Kin -------------------------------------------------------------- Provider's syslog------------------------------------- May 30 18:02:35 bom-ldap1 slapd[17515]: conn=68 op=1 SRCH base="cn=accesslog" scope=2 deref=0 filter="(&(objectClass=auditWriteObject)(reqResult=0))" May 30 18:02:35 bom-ldap1 slapd[17515]: conn=68 op=1 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN May 30 18:02:35 bom-ldap1 slapd[17515]: findbase failed! 32 May 30 18:02:35 bom-ldap1 slapd[17515]: conn=68 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text= May 30 18:02:35 bom-ldap1 slapd[17515]: conn=68 op=2 UNBIND May 30 18:02:35 bom-ldap1 slapd[17515]: conn=68 fd=19 closed May 30 18:03:35 bom-ldap1 slapd[17515]: conn=69 fd=19 ACCEPT from IP=192.168.3.62:38515 (IP=192.168.3.61:636) May 30 18:03:35 bom-ldap1 slapd[17515]: conn=69 fd=19 TLS established tls_ssf=256 ssf=256 May 30 18:03:35 bom-ldap1 slapd[17515]: conn=69 op=0 BIND dn="cn=admin,dc=*********,dc=com" method=128 May 30 18:03:35 bom-ldap1 slapd[17515]: conn=69 op=0 BIND dn="cn=admin,dc=*********,dc=com" mech=SIMPLE ssf=0 May 30 18:03:35 bom-ldap1 slapd[17515]: conn=69 op=0 RESULT tag=97 err=0 text= ----------------------------------------------------------------------------------------------------------------------------------------------- ------------------------------------------Consumer's syslog ------------------------------------------------------------------- May 30 17:58:50 bom-ldap2 slapd[25741]: do_syncrep2: rid=000 (32) No such object May 30 17:58:50 bom-ldap2 slapd[25741]: do_syncrepl: rid=000 retrying ----------------------------------------------------------------------------------------------------------------------------------------------- ------------------------------------Provider's slapd.conf ---------------------------------- access to * by dn.base="cn=replicator,ou=admins,dc=*****,dc=com" read by * break # Accesslog database definitions --------------------------------------------- database hdb suffix cn=accesslog directory /usr/local/openldap-2.4.9//var/accesslog rootdn cn=accesslog rootpw ***** index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE # Let the replica DN have limitless searches limits dn.exact="cn=replicator,ou=admins,dc=*****,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited ####################################################################### # BDB database definitions ####################################################################### ........... ************************************ database config ************************************ ............ index entryCSN eq index entryUUID eq #syncrepl Provider for primary db overlay syncprov syncprov-checkpoint 1000 60 #accesslog overlay definitions for primary db overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE #scan the accesslog DB every day, and purge entries older than 7 days logpurge 07+00:00 01+00:00 #Let the replica DN have limitless searches limits dn.exact="cn=replicator,ou=admins,dc=*****,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited --------------------------------------------------------------------------------------------------------------------------------- ----------------------------------------------Consumer's slapd.conf -------------------------------------------- index entryUUID eq # syncrepl specific indices syncrepl rid=0 provider=ldaps://bom-ldap1.*****.com:636 bindmethod=simple binddn="cn=admin,dc=*****,dc=com" credentials=***** searchbase="dc=*****,dc=com" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog # Refer updates to the master updateref ldaps://bom-ldap1.*****:636 ---------------------------------------------------------------------------------------------------------------------------------

2 1

ldapsearch and slapd unrelated
by Jacky Wu 31 May '08

31 May '08

I have been confused by following symptoms for two days. openldap version: 2.3.38 os: redhat linux problem: when I do not start slapd, I can still run "ldapsearch -x", but it shows "result: 32 No such object". Then I start slapd, the "ldapsearch -x" has the same symptom. Then I use the slapd admin user and password to do the ldapsearch. It surprised me by reporting "bad username or password". Then I do the ldapsearch in another server by "-h" pointing to the server, it reports "cann't contact ldap server (-1)", but slapd is running in the server. These results completely confuse me! The /usr/local/etc/openldap/ldap.conf is ====================== BASE dc=mycompany,dc=com HOST 127.0.0.1 ====================== The access control list in /usr/local/etc/openldap/slapd.conf is ====================== access to * by * read ====================== Do you ever encounter the problem? any hints are appreciated! Thank you! Bests, Jacky -- John 3:16 For God so loved the world, that He gave His only begotten Son, that whoever believes in Him shall not perish, but have eternal life. http://www.hkccc.org/flash2.htm

1 1

TLS over ldap not working properly on debian etch - slapd 2.3.30]
by Ingard Mevåg 31 May '08

31 May '08

Hi. Seems the previous mail didnt go through (sent 24 hours ago), if it did - sorry for dupe. Im having a problem getting TLS over ldap to work on my setup. Normal LDAP operations work fine, ldaps works fine, but TLS over ldap does not. I've tried following various guides from debian-administration, gentoo wiki, openldap.org docs etc but I could never get this last bit to work. On my last effort i followed this guide: http://www.bayour.com/LDAPv3-HOWTO.html and create my certificate with: openssl req -new -x509 -nodes -out server.pem -keyout server.pem -days 365 (and yes, i did make sure the common name matches the host.network.com for the ldapserver) and in slapd.conf: TLSCertificateFile /etc/ldap/server.pem TLSCertificateKeyFile /etc/ldap/server.pem TLSCACertificateFile /etc/ldap/server.pem and started the server with: slapd -h 'ldap:// ldaps://' -g openldap -u openldap -d127 Now to test the encryption on the ldaps port with: openssl s_client -connect <ldaphost>:636 -showcerts -state -CAfile /etc/ldap/server.pem which results in the following output: CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv2/v3 write client hello A SSL_connect:SSLv3 read server hello A depth=0 /C=NO/ST=Some-State/L=Oslo/O=company AS/CN=<ldaphost>/emailAddress=mail@company verify return:1 SSL_connect:SSLv3 read server certificate A SSL_connect:SSLv3 read server done A SSL_connect:SSLv3 write client key exchange A SSL_connect:SSLv3 write change cipher spec A SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data SSL_connect:SSLv3 read finished A --- Certificate chain . . -----BEGIN CERTIFICATE----- . . . FeTrw4B8 -----END CERTIFICATE----- --- Server certificate subject=/C=NO/ST=Some-State/<certificate info> issuer=/C=NO/ST=Some-State/<certificate info> --- No client certificate CA names sent --- SSL handshake has read 1080 bytes and written 316 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 1024 bit Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : AES256-SHA Session-ID: CBE0DD206D44248AAC8766578CFEDCD5205ECAF2D466F87827432D870A2A6209 Session-ID-ctx: Master-Key: F4794B77D23C66E40CB80A25B3E270A7B474B4A6F3A1942C9184FFE3948135AA4449F9BC5DAE442ADA4FA9EAC6471D32 Key-Arg : None Start Time: 1211962435 Timeout : 300 (sec) Verify return code: 0 (ok) --- BUT, when I try the same for the ldap port: openssl s_client -connect <ldaphost>:389 -showcerts -state -CAfile /etc/ldap/server.pem CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv2/v3 write client hello A 2135:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188: According to the various guides I read i thought this should be working with my current setup. Maybe I am missing something? regards ingard

2 1

SubEntry behaviour in OpenLDAP
by Andrew Findlay 31 May '08

31 May '08

I am trying to implement a set of password policies that vary for different groups of users. Each group is conveniently contained in a subtree of the DIT, so it seems that this should work easily. At the root of each subtree I have created a pwdPolicy subentry of the form: dn: cn=ppolicy,ou=some-group,dc=example,dc=com objectclass: subentry objectclass: pwdPolicy cn: ppolicy pwdAttribute: userPassword pwdMinLength: 6 pwdCheckQuality: 2 subtreeSpecification: { } OpenLDAP (version 2.3.39 in this case) recognises the subentry and gives it the special treatment specified for searches etc, but does not seem to be applying the policy it contains to users in the subtree. I have a default password policy stored elsewhere in the DIT and referenced in the ppolicy overlay config: this does take effect, but its name does not show up in the pwdPolicySubentry operational attribute of any user. If I force the name of the policy into pwdPolicySubentry then it does take effect, but that is not the point: the subentry should set this attribute automatically. The problem may be that the root of the subtree is not marked as an administration point: OpenLDAP 2.3.39 knows about the administrativeRole attribute but seems to have 'not implemented' hard-wired into the result code. Are subentries expected to work, or am I mis-reading something here? Thanks Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

2 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software May 2008