openldap-software May 2008

openldap-software@openldap.org

64 participants
55 discussions

FYI: OpenLDAP booth, OpenExpo 2008
by Michael Ströder 19 May '08

19 May '08

HI! OpenLDAP will be presented by a team of volunteers (or simply me ;-) at OpenExpo 2008 in Karlsruhe, Germany from Sunday, 2008-05-25 until Monday, 2008-05-26 (or maybe longer) http://openexpo.de I will also present web2ldap and answer questions about python-ldap too. Looking forward to meet members of the community personally there. Ciao, Michael. P.S.: Volunteers welcome to help at the booth. Please contact me off-list. It's right before Linuxtag in Berlin, Germany. -- Michael Ströder E-Mail: michael(a)stroeder.com http://www.stroeder.com

1 0

--enable-bdb=no not working?
by Steve Birnie 17 May '08

17 May '08

I'm trying to install openldap on ubuntu. The reason is because we have multiple servers and would like to use ldap to reduce the userid management. I am already running mysql, so I thought I would use the existing db instead of installing bdb also. I tried using "apt-get install slapd", but I think that comes compiled without --enable-sql=yes because when I try to start it up I get "Unrecognized database type (sql)". So I downloaded version 2.4.9 to build it manually. I tried running "./configure --enable-bdb=no --enable-sql=yes", but that gives me the error message "configure: error: BDB/HDB: BerkeleyDB not available". I don't understand why I would get this message if I set --enable-bdb=no. Am I not including all the right configuration parameters?

3 2

[Fwd: How to Sync.....?????]
by musthafa 15 May '08

15 May '08

2 1

slapo-rwm and rewriteRules
by Raphaël 'SurcouF' Bordet 14 May '08

14 May '08

Hi, I've to convert a LDAP base from a suffix to another suffix. The backend and directive relay works fine. I've also to change RDN of some entries. The new RDN is based on mail attribut instead of uid. How can I do this, using slapo-rwm and rewriteRules ? Regards, -- Raphaël 'SurcouF' Bordet

5 11

Linuxtag 2008
by Dieter Kluenter 14 May '08

14 May '08

Hi, the OpenLDAP Project will have a booth at Linuxtag Berlin http://www.linuxtag.org/2008 Whoever wants to visit Linuxtag may contact me, as we have about 20 free 4 day tickets to give away. -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6

1 0

searching for attributes containing eg. german umlauts
by Christian Marg 13 May '08

13 May '08

Hello all, I'm not quite sure if my mind plays a trick on me, but was there a way to save eg. (for readability I'll use HTML-Entities, of course it should and will be UTF-8 in LDIF) dn: ... cn: Müller and find it with the filter (cn=Mueller) ? Or do I have to save all permutations of "Ascii-replacement"/"UTF-8" for each and every entry/attribute? (that seems rather cumbersome and rises the question: which attribute value is the "correct" one?) If this already is written in the FAQ, please excuse my shallow "googleing". Perhaps I just missed the right keywords. bye Christian -- Christian Marg mail : mailto:marg@rz.tu-clausthal.de Rechenzentrum TU Clausthal web : http://www.tu-clausthal.de D-38678 Clausthal-Zellerfeld fon : 05323/72-2626 Germany jabber: ifcma(a)jabber.tu-clausthal.de

3 2

Using syncrepl in a 2.2 master
by Torsten Schlabach (Tascel eG) 13 May '08

13 May '08

Hi! Here http://www.openldap.org/lists/openldap-software/200701/msg00315.html I read: > In general, the syncrepl provider in OpenLDAP 2.2 is not safe for use. What does "save" refer to: - It can easily be hacked? - It can easily crash the master server? - It might be that not everything gets replicated properly all the time? Regards, Torsten

2 1

"Hide" certain DNs
by Andrew Cobaugh 13 May '08

13 May '08

I'm looking for a way to prevent a specific DN from a remote server from showing up when being accessed through back-ldap (specifically, slapo-translucent). I have tried something like this: access to dn.base="cn=psu.facstaff,dc=psu,dc=edu" by * none This actually ended up preventing other dn's from showing up. If I prevent only attrs=member,memberUid, that mostly works, but I take it the ACLs are being applied after it has already searched, so it still takes forever to return (one of my mac clients is taking close to a minute to enumerate group membership because of this). For anyone that's curious, the reason for doing this is psu.facstaff is a group, and it has something around 64k attributes on it, which is bringing my local openldap server to its knees sadly. -- Andy Cobaugh

2 1

No Results from Ldapsearch
by The Hwyman 13 May '08

13 May '08

I'm running Red Hat Enterprise 5 (x86_64) and Openldap version 2.3.27 from official rpms. I have installed openldap, openldap-devel, openldap-clients, and openldap-servers. The following command: ldapsearch -x -b "dc=example,dc=com" '(uid=jsmith)' produces the following results: -- # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: (uid=jsmith) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 -- If I specify the jsmith user (or any other user) using -D -W, I get the same results. If I specify the rootdn user: ldapsearch -x -D "cn=manager,dc=example,dc=com" -W -b "dc=example,dc=com" '(uid=jsmith)' I get the following results: -- # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: (uid=jsmith) # requesting: ALL # # jsmith, users, example.com dn: uid=jsmith,ou=users,dc=example,dc=com uid: jsmith cn: jsmith homeDirectory: /home/jsmith uidNumber: xxx objectClass: posixAccount objectClass: shadowAccount objectClass: person gidNumber: xxx gecos: John Smith sn: Smith shadowLastChange: xxx userPassword:: xxx loginShell: /sbin/nologin # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 -- The problem is that I have not disabled annonymous or user access other than to set ACLs for the userPassword field. The user jsmith can't even do a search on himself. I've tried slapacl and confirmed that annonymous as well as the jsmith user can read the uid field. I even tried reindexing using slapindex, but that didn't work either. Here is my slapd.conf: include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba3.schema include /etc/openldap/schema/qmail.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args database bdb suffix "dc=example,dc=com" rootdn "cn=manager,dc=example,dc=com" rootpw xxx access to attrs=userPassword by anonymous auth by self write by * none access to attrs=uid by * read directory /var/lib/ldap index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub Am I missing something?? Thanks!

3 2

openldap linking attributes support
by Andy 13 May '08

13 May '08

Hello everyone, I was wondering if openldap can support the following. Currently I have a ldap directory with several branches. --Root ----ou=Samba accounts ----ou=Website accounts ----ou=VPN accounts ----ou=Email accounts and so on. Every object has a userPassword field which means that if a user changes his password under one of the systems (eg. websites), the password will not change on the others. Ultimately I would like to syncronise all the passwords between all the systems. Is there anyway of adding a new ou=passwords. Within the ou passwords I will have a simple-security-object which will contain the username+password. Is there anyway I can link the attribute userPassword attribute within samba schema, emailaccounts schema so on to the simple security object that resides in the ou=password. Does Openldap support this? -- REGARDS, Andy Z <andy.aegis666.com>

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software May 2008