openldap-software July 2008

openldap-software@openldap.org

72 participants
81 discussions

Help with ACL's for Users/Groups
by david stackis 31 Jul '08

31 Jul '08

Hi - First off, I want to apologize for posting to list when I really should have read more. Tonight I read all of Chapter 7.4 in the OpenLDAP Software 2.4 Admin Guide....and I'm still scratching my head wondering why this isn't working. Here's my structure... I have two Groups..."Home", and "Work" I have two Users..."Me", and "You" These users have passwords I can search my LDAP using the rootdn, and I'm able to add to each of the Group AddressBooks "Home", and "Group" using the rootdn. What I can't seem to do, is have user "Me" or "You" access any of the AddressBooks. The user "Me" has access to "Home and "You" has access to "Work" each have two different email addresses. Again...the rootdn can see everything in Thunderbird...but it's "Me" and "You" that seem to have no access/ Could someone please point me in the right direction. I'm also using Apache Directory Studio, and I verified that the four entries I added...two being place in the "Home" AddressBook, and the other two in the "Work" AddressBook. The ACL's I'm using are below...and further down is my LDIF I used to create my structure. I've tried attrs=userPassword, and attr=userPassword...I've seen both of these examples used Thank you for any help. # ACL1 access to attrs=userPassword by self write by anonymous auth # ACL2 access to dn.regex="o=(.+),ou=AddressBooks,dc=MyCompany,dc=com" by group.expand="cn=$1,ou=Groups,dc=MyCompany,dc=com" write # ACL3 access to dn.base="ou=AddressBooks,dc=MyCompany,dc=com" by * read access to dn.base="" by * read # ACL4 access to dn.base="cn=Subschema" by * read # ACL5 disallow bind_anon The LDIF I used... # Initialize the suffix entry defined in slapd.conf # dn: dc=MyCompany,dc=com objectclass: top objectclass: organization objectclass: dcObject dc: MyCompany o: cctr # # Initialize the AddressBooks heirarchy # dn: ou=AddressBooks,dc=MyCompany,dc=com objectclass: top objectclass: organizationalUnit ou: AddressBooks # # Define individual address books # dn: o=Home,ou=AddressBooks,dc=MyCompany,dc=com objectclass: top objectclass: organization o: Home dn: o=Work,ou=AddressBooks,dc=MyCompany,dc=com objectclass: top objectclass: organization o: Work # # Initialize the Users heirarchy # dn: ou=Users,dc=MyCompany,dc=com objectclass: top objectclass: organizationalUnit ou: Users # # Define individual users # dn: cn=Me,ou=Users,dc=MyCompany,dc=com objectclass: top objectclass: person cn: Me sn: My LastName userPassword: {crypt}XXXXXX dn: cn=You,ou=Users,dc=MyCompany,dc=com objectclass: top objectclass: person cn: You sn: You LastName userPassword: {crypt}XXXXXX # # Initialize the Groups heirarchy # dn: ou=Groups,dc=MyCompany,dc=com objectclass: top objectclass: organizationalUnit ou: Groups # # Group users into separate address books # dn: o=Home,ou=Groups,dc=MyCompany,dc=com objectclass: top objectclass: groupOfNames cn: Home member: cn=Me,ou=Users,dc=MyCompany,dc=com dn: o=Work,ou=Groups,dc=ucsb,dc=edu objectclass: top objectclass: groupOfNames cn: Work member: cn=You,ou=Users,dc=MyCompany,dc=com ------------------- david stackis

2 2

FW: slapd does not start, where do I find the error?
by Jorge Medina 31 Jul '08

31 Jul '08

Hi, I have narrowed the conditions under the server does not start. I can start the server if I only use the ldap protocol. Nevertheless, I compiled with support for ldaps (--with-tls option) I have created a Certificate Authority as well as a certificate for my server using openssl . If I attempt to start slapd using a URL with ldaps , it just dies. Any idea where I could look for log messages? Thanks -Jorge ________________________________ From: Jorge Medina Sent: Thursday, July 31, 2008 10:14 AM To: 'openldap-software(a)openldap.org' Subject: slapd does not start, where do I find the error? I got the sources (2.2.8), compiled and installed OpenLDAP in RedHat Enterprise Linux 5 ( 64-bit.) (I also got the sources and compiled BerkeleyDB 4.6) Now, I am trying to start the server. I don't get any error message in the console. In Ubuntu, the errors would show up in /var/log/syslog Where could I find what is wrong when I invoke slapd? Where do the errors get logged ?

1 0

overlay unique - multiple suffixes
by Andreas Schoe 31 Jul '08

31 Jul '08

Hello, I have two suffixes with two bdb backends, in the first suffix you find internal and in the second suffix you find external users. Is there a solution that every uid of each person is unique in both trees together? In slapd.conf.5 it is described, that every subtree needs a directive to use overlay unique ".. to enforce the uniqueness of some or all attributes within a subtree.". I'm running openldap version 2.3.41. Best regards Andreas

3 3

Re: N-way multimaster
by Gavin Henry 31 Jul '08

31 Jul '08

I'm top posting here for ease, but please keep replies *on list*. Tell tail signs something isn't working: "get_filter: unknown filter type=48" And pay attention to your ACLs and rootdn. <quote who="Miguel Jinez"> > Sorry > Here the logs... > Master A starting after the situation that cause the problem, masters B > and > C are working off > > root@tstlnxldap00:/root/ldap24/openldap-2.4.11/servers/slapd > /usr/local/etc/openldap/slapd.conf: line 137: rootdn is always granted > unlimited privileges. > /usr/local/etc/openldap/slapd.conf: line 155: rootdn is always granted > unlimited privileges. > /usr/local/etc/openldap/slapd.conf: line 160: rootdn is always granted > unlimited privileges. > slapd starting > slap_client_connect: URI=ldap://10.100.130.184 DN="cn=admin,dc=ar" > ldap_sasl_bind_s failed (-1) > slap_client_connect: URI=ldap://10.100.130.181 DN="cn=admin,dc=ar" > ldap_sasl_bind_s failed (-1) > do_syncrepl: rid=002 retrying (4 retries left) > do_syncrepl: rid=001 retrying (4 retries left) > conn=0 fd=24 ACCEPT from IP=10.100.130.185:1312 (IP=0.0.0.0:389) > conn=0 op=0 BIND dn="cn=admin,dc=ar" method=128 > conn=0 op=0 BIND dn="cn=admin,dc=ar" mech=SIMPLE ssf=0 > conn=0 op=0 RESULT tag=97 err=0 text= > conn=0 op=1 SRCH base="dc=ar" scope=2 deref=0 filter="(objectClass=*)" > conn=0 op=1 SRCH attr=* + > conn=0 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= > conn=0 op=2 UNBIND > conn=0 fd=24 closed > conn=1 fd=24 ACCEPT from IP=10.250.1.31:34413 (IP=0.0.0.0:389) > conn=1 op=0 BIND dn="cn=admin,dc=ar" method=128 > conn=1 op=0 BIND dn="cn=admin,dc=ar" mech=SIMPLE ssf=0 > conn=1 op=0 RESULT tag=97 err=0 text= > get_filter: unknown filter type=48 > conn=1 op=1 SRCH base="dc=ar" scope=1 deref=0 filter="(?=undefined)" > conn=1 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= > conn=1 op=2 UNBIND > conn=1 fd=24 closed > conn=2 fd=24 ACCEPT from IP=10.250.1.30:39831 (IP=0.0.0.0:389) > conn=2 op=0 BIND dn="cn=admin,dc=ar" method=128 > conn=2 op=0 BIND dn="cn=admin,dc=ar" mech=SIMPLE ssf=0 > conn=2 op=0 RESULT tag=97 err=0 text= > get_filter: unknown filter type=48 > conn=2 op=1 SRCH base="dc=ar" scope=1 deref=0 filter="(?=undefined)" > conn=2 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= > conn=2 op=2 UNBIND > conn=2 fd=24 closed > slap_client_connect: URI=ldap://10.100.130.184 DN="cn=admin,dc=ar" > ldap_sasl_bind_s failed (-1) > do_syncrepl: rid=002 retrying (3 retries left) > slap_client_connect: URI=ldap://10.100.130.181 DN="cn=admin,dc=ar" > ldap_sasl_bind_s failed (-1) > do_syncrepl: rid=001 retrying (3 retries left) > .... > > Master B starts > > fd=26 ACCEPT from IP=10.250.1.31:35484 (IP=0.0.0.0:389) > conn=0 op=0 BIND dn="cn=admin,dc=ar" method=128 > conn=0 op=0 BIND dn="cn=admin,dc=ar" mech=SIMPLE ssf=0 > conn=0 op=0 RESULT tag=97 err=0 text= > get_filter: unknown filter type=48 > conn=0 op=1 SRCH base="dc=ar" scope=1 deref=0 filter="(?=undefined)" > conn=0 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= > conn=0 op=2 UNBIND > conn=0 fd=26 closed > conn=1 fd=26 ACCEPT from IP=10.250.1.30:40925 (IP=0.0.0.0:389) > conn=1 op=0 BIND dn="cn=admin,dc=ar" method=128 > conn=1 op=0 BIND dn="cn=admin,dc=ar" mech=SIMPLE ssf=0 > conn=1 op=0 RESULT tag=97 err=0 text= > get_filter: unknown filter type=48 > conn=1 op=1 SRCH base="dc=ar" scope=1 deref=0 filter="(?=undefined)" > conn=1 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= > conn=1 op=2 UNBIND > conn=1 fd=26 closed > slap_client_connect: URI=ldap://10.100.130.184 DN="cn=admin,dc=ar" > ldap_sasl_bind_s failed (-1) > do_syncrepl: rid=002 retrying (2 retries left) > slap_client_connect: URI=ldap://10.100.130.184 DN="cn=admin,dc=ar" > ldap_sasl_bind_s failed (-1) > do_syncrepl: rid=002 retrying (1 retries left) > conn=2 fd=26 ACCEPT from IP=10.250.1.31:35556 (IP=0.0.0.0:389) > conn=2 op=0 BIND dn="cn=admin,dc=ar" method=128 > conn=2 op=0 BIND dn="cn=admin,dc=ar" mech=SIMPLE ssf=0 > conn=2 op=0 RESULT tag=97 err=0 text= > get_filter: unknown filter type=48 > conn=2 op=1 SRCH base="dc=ar" scope=1 deref=0 filter="(?=undefined)" > conn=2 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= > conn=2 op=2 UNBIND > conn=2 fd=26 closed > conn=3 fd=26 ACCEPT from IP=10.250.1.30:40997 (IP=0.0.0.0:389) > conn=3 op=0 BIND dn="cn=admin,dc=ar" method=128 > conn=3 op=0 BIND dn="cn=admin,dc=ar" mech=SIMPLE ssf=0 > conn=3 op=0 RESULT tag=97 err=0 text= > get_filter: unknown filter type=48 > conn=3 op=1 SRCH base="dc=ar" scope=1 deref=0 filter="(?=undefined)" > conn=3 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= > conn=3 op=2 UNBIND > conn=3 fd=26 closed > ... > > Master C starts > > root@tstlnxldap00:/root/ldap24/openldap-2.4.11/servers/slapd > /usr/local/etc/openldap/slapd.conf: line 139: rootdn is always granted > unlimited privileges. > /usr/local/etc/openldap/slapd.conf: line 156: rootdn is always granted > unlimited privileges. > /usr/local/etc/openldap/slapd.conf: line 160: rootdn is always granted > unlimited privileges. > bdb_db_open: warning - no DB_CONFIG file found in directory > /usr/local/var/access: (2). > Expect poor performance for suffix "cn=accesslog". > slapd starting > conn=0 fd=27 ACCEPT from IP=10.250.1.31:36153 (IP=0.0.0.0:389) > conn=0 op=0 BIND dn="cn=admin,dc=ar" method=128 > conn=0 op=0 BIND dn="cn=admin,dc=ar" mech=SIMPLE ssf=0 > conn=0 op=0 RESULT tag=97 err=0 text= > get_filter: unknown filter type=48 > conn=0 op=1 SRCH base="dc=ar" scope=1 deref=0 filter="(?=undefined)" > conn=0 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= > conn=0 op=2 UNBIND > conn=0 fd=27 closed > conn=1 fd=27 ACCEPT from IP=10.250.1.30:41586 (IP=0.0.0.0:389) > conn=1 op=0 BIND dn="cn=admin,dc=ar" method=128 > conn=1 op=0 BIND dn="cn=admin,dc=ar" mech=SIMPLE ssf=0 > conn=1 op=0 RESULT tag=97 err=0 text= > get_filter: unknown filter type=48 > conn=1 op=1 SRCH base="dc=ar" scope=1 deref=0 filter="(?=undefined)" > conn=1 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= > conn=1 op=2 UNBIND > conn=1 fd=27 closed > conn=2 fd=27 ACCEPT from IP=10.250.1.31:36227 (IP=0.0.0.0:389) > conn=2 op=0 BIND dn="cn=admin,dc=ar" method=128 > conn=2 op=0 BIND dn="cn=admin,dc=ar" mech=SIMPLE ssf=0 > conn=2 op=0 RESULT tag=97 err=0 text= > get_filter: unknown filter type=48 > conn=2 op=1 SRCH base="dc=ar" scope=1 deref=0 filter="(?=undefined)" > conn=2 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= > conn=2 op=2 UNBIND > conn=2 fd=27 closed > conn=3 fd=27 ACCEPT from IP=10.250.1.30:41657 (IP=0.0.0.0:389) > conn=3 op=0 BIND dn="cn=admin,dc=ar" method=128 > conn=3 op=0 BIND dn="cn=admin,dc=ar" mech=SIMPLE ssf=0 > conn=3 op=0 RESULT tag=97 err=0 text= > get_filter: unknown filter type=48 > conn=3 op=1 SRCH base="dc=ar" scope=1 deref=0 filter="(?=undefined)" > conn=3 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= > conn=3 op=2 UNBIND > conn=3 fd=27 closed > .... > > 2008/7/30 Gavin Henry <ghenry(a)openldap.org> > >> Hi again, >> >> This isn't what I asked for: >> >> "Can we see your actual logs, not the accesslog ones after the test >> when/if it fails." >> >> From a clean import from slapadd into *one* node, with the other nodes >> untouched. Start them up and let them sync, or: >> >> slappadd into one node, slapcat the data once imported so it has the >> correct CSN values, then slapadd that export into the other nodes, then >> start them all up. >> >> Then try and deleting in like you originally posted and post the logs, >> *not* the accesslog logs. >> >> Thanks. >> >> -- >> Kind Regards, >> >> Gavin Henry. >> OpenLDAP Engineering Team. >> >> E ghenry(a)OpenLDAP.org >> >> Community developed LDAP software. >> >> http://www.openldap.org/project/ >> >

1 0

Clearing the entire ldap directory
by Fin.Tang＠TeleCity.com 31 Jul '08

31 Jul '08

Hi - is there a way (dangerous though) to clear a directory and start again? I am having an issue by which I can search for an entry, but not delete it. Eg [root@First-Line lib]# ldapsearch -x -W -D "cn=Manager,dc=TelecityGroup,dc=com" "cn=Sabayon user" Enter LDAP Password: # extended LDIF # # LDAPv3 # base <> with scope subtree # filter: cn=Sabayon user # requesting: ALL # # sabayon, People, TelecityGroup.com dn: uid=sabayon,ou=People,dc=TelecityGroup,dc=com uid: sabayon cn: Sabayon user givenName: Sabayon sn: user mail: sabayon(a)TelecityGroup.com objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword:: e2NyeXB0fSEh shadowLastChange: 14088 shadowMax: 99999 shadowWarning: 7 loginShell: /sbin/nologin uidNumber: 86 gidNumber: 86 homeDirectory: /home/sabayon gecos: Sabayon user # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 [root@First-Line lib]# ldapdelete -x -D "cn=Manager,dc=TelecityGroup,dc=com" -W "cn=Sabayon user,dc=TelecityGroup,dc=com" Enter LDAP Password: ldap_delete: No such object (32) matched DN: dc=TelecityGroup,dc=com I can supply any config info that is required. Thanks Fin Tang -- Fin Tang - Unix Systems Administrator TelecityGroup UK Limited 10th Floor, 6&7 Harbour Exchange Square, London, E14 9GE, United Kingdom T: +44 (0)207 531 8738 F: +44 20 7005 6060 www.telecitygroup.com TelecityGroup - where content meets connectivity. Winner Best Pan European Data Centre Operator Award 2007, Data Centres Europe Awards. TelecityGroup UK Limited. Registered in England 3607764 Registered Office: Masters House, 107 Hammersmith Road, London W14 0QH UK. VAT No. 766825682 No binding contract will be made between an employee of TelecityGroup and a third party either verbally or by email, until a written document has been signed on behalf of TelecityGroup.

5 4

Slurpd sync problem
by Sven Buchstaller 30 Jul '08

30 Jul '08

Hi List Samba Version 3.0.28 Openldap 2.3.27 i hope im right here, i found some weird errors in my slurpd log. I use a samba PDC und sync with slurpd to my samba BDC. here the log file in /var/lib/slurpd/replica/192.168.10.1:389.rej ERROR: No such attribute: modify/delete: sambaNTPassword: no such value replica: 192.168.10.6:389 time: 1217401186.0 dn: uid=pc130$,ou=hosts,dc=server,dc=intern changetype: modify delete: sambaNTPassword sambaNTPassword: ED2DCAD9927AAA74E8038C42A377BA1B - add: sambaNTPassword sambaNTPassword: 282ADC9EFE0B5CB588469895E5417A51 - delete: sambaPwdLastSet sambaPwdLastSet: 1213687116 - add: sambaPwdLastSet sambaPwdLastSet: 1217401186 - replace: entryCSN entryCSN: 20080730065946Z#000000#00#000000 - replace: modifiersName modifiersName: cn=manager,dc=server,dc=intern - replace: modifyTimestamp modifyTimestamp: 20080730065946Z ______________________________________________________________ in the slurpd.replog i found at the last line this: replica: 192.168.10.6:389 time: 1217401186 dn: uid=pc130$,ou=hosts,dc=server,dc=intern changetype: modify delete: sambaNTPassword sambaNTPassword: ED2DCAD9927AAA74E8038C42A377BA1B - add: sambaNTPassword sambaNTPassword: 282ADC9EFE0B5CB588469895E5417A51 - delete: sambaPwdLastSet sambaPwdLastSet: 1213687116 - add: sambaPwdLastSet sambaPwdLastSet: 1217401186 - replace: entryCSN entryCSN: 20080730065946Z#000000#00#000000 - replace: modifiersName modifiersName: cn=manager,dc=server,dc=intern - replace: modifyTimestamp modifyTimestamp: 20080730065946Z - is this a slurp problem or looks like ldap db problem? THx for supporting me -- ---- MFG Sven

2 1

Re: overlay chain
by Gavin Henry 29 Jul '08

29 Jul '08

<quote who="edg(a)greenberg.org"> > An excellent reference, thank you. That's why we write it ;-) Any issue or corrections needed, please file a biug report at: http://www.openldap.org/its -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

ppolicy pwdReset
by greek ordono 28 Jul '08

28 Jul '08

Hello, I getting the following error: "LDAP password information update failed: Insufficient access Operations are restricted to bind/unbind/abandon/StartTLS/modify password" when I try to add pwdReset on users. LDAP: 2.4.9 SLAPD ACL: http://pastebin.com/m45ad1781 Thanks, grexk

3 5

Dynamic Groups - GroupofURLs
by James 28 Jul '08

28 Jul '08

Can Openldap do dynamic groups with groupofurls or not? and if it can from which version did it start being able to do this. and is the schema built into openldap by default. Thanks -James

2 1

Re: Client says Can't contact LDAP server, but it can!
by Michael Ströder 28 Jul '08

28 Jul '08

John Oliver wrote: > At some point, when > I have time, I'd love to learn enough about this to create a working CA, > and generate certificates with it, and do everything "right". But if I > try to do this "right", right now, I'm far more likely to wind up with > no working authentication at all. It's simply waste of time to mess around with self-signed server certs if you have several of them. There are small CA open source software packages and script collections out there. Ciao, Michael.

1 0

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software July 2008