openldap-software July 2008

openldap-software@openldap.org

72 participants
81 discussions

How to initialize cn=schema,cn=config with the system schema
by Mathias Gug 13 Jul '08

13 Jul '08

Hi, I'm currently working on adding support for the config backend to the Ubuntu openldap package (2.4.10). While creating a new configuration, I run into the problem of loading the system schema into /etc/ldap/slapd.d/cn=config/cn=schema.ldif. Using the example from the slapd-config man page doesn't work: the system schema isn't created in cn=schema.ldif. Comparing with a slapd.conf conversion, cn=schema.ldif holds the system schema in the latter case. I haven't found any ldif file containing the system schema - it seems to be hardcoded in the source file. So how should I create a brand new slapd setup using the config backend without converting from an existing slapd.conf file ? How should cn=schema,cn=config be initialized with slapadd ? -- Mathias Gug Ubuntu Developer http://www.ubuntu.com

4 6

logical "AND" in slapd acl statement?
by Aaron Bennett 12 Jul '08

12 Jul '08

Hi, I'm sorry if this is a stupid question or one that's asked here often, but... I need to grant access to a few attributes to a specific dn, but ideally ALSO only if that DN is coming from a specific ip range. What I want to something like... access to attrs=myAttribute by ( peername.ip='192.168.1.0%255.255.255.0" AND dn = "cn=me,ou=us,dc=myco,dc=com" ) read I was pretty surprised that what I had above didn't work, and reading the man 5 slapd.access it seems like it might not be possible. Am I missing something? Is it actually possible to do this? Best, Aaron Bennett

2 1

Cannot contact LDAP server
by pendiala jaipal 11 Jul '08

11 Jul '08

Hi all, I built openldap-2.3.42 on HPUX IA 11.23 platform with aCC compiler. when i do gmake test it is giving as /**************************************************************************************/ cd tests; make test Initiating LDAP tests for BDB... Running ./scripts/all... >>>>> Executing all LDAP tests for bdb >>>>> Starting test000-rootdse ... running defines.sh Starting slapd on TCP/IP port 9111... Using ldapsearch to retrieve the root DSE... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... kill: 5499: The specified process does not exist. ldap_bind: Can't contact LDAP server (-1) >>>>> Test failed >>>>> ./scripts/test000-rootdse failed (exit 1) /*******************************************************************************/ i am able to start the slapd deamon successfully. when i do ldapsearch/ldapadd , it is automatically killing slapd deamon . when i started slapd deamon and used ldapadd command, the slapd deamon is terminating with this error /******************************************************/ daemon: activity on 1 descriptor >>> slap_listener(ldap:///) Bus error(coredump) /*********************************************************/ and ldapadd terminating with this error: ldap_result: Can't contact LDAP server (-1) can you help me out in this issue. Thanks in Advance, Jaipal P.

3 2

Access control: the "manage" privilege
by Vladimir Dzhuvinov 10 Jul '08

10 Jul '08

The admin guide mentions a "manage" privilege, but doesn't detail its purpose. It is listed as the top-level privilege, but what extra rights does it give over "write"? Vladimir -- Vladimir Dzhuvinov * www.valan.net * PGP key ID AC9A5C6C

3 2

OpenLDAP 2.4.10 inconsistent performance
by Howard Bryden 10 Jul '08

10 Jul '08

Folks, I'm using OpenLDAP under HPUX 11iv3 and am seeing inconsistent query response. Environment details: Host: HP rx6600 Processor: 2 x 2-core IA64 OS: HPUX 11iv3 March 2008 Data Center Environment OpenLDAP: 2.4.10 Prerequisite software: db 4.6.21 gdbm 1.8.3 gettext 0.17 libiconv 1.12 openssl A.09.08g.001 (HP distribution) perl D.5.8.8.B (HP distribution) Database: Backend bdb DN entries 870 CN entries 7807 DB_CONFIG contents: set_flags db_auto_commit set_flags db_log_autoremove set_lg_dir /var/adm/ldap/dvesv slapd.conf contents: include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /descl/dvesv2/openldap/etc/qgov.schema pidfile /descl/dvesv2/openldap/var/dvesv2-slapd.pid argsfile /descl/dvesv2/openldap/var/dvesv2-slapd.args sizelimit 100000 loglevel 3311 threads 16 database bdb lastmod on suffix "o=QLDGOV, c=au" rootdn "cn=manager, o=QLDGOV, c=au" directory /descl/dvesv2/openldap/bdb rootpw secret index objectClass,uniqueIdentifier eq index cn,sn,givenName,uid,title,displayName eq,sub access to attrs=userPassword by * auth access to dn.regex="(.+,)?ou=users,o=QLDGOV,c=au" by * auth access to dn.subtree="ou=Department of Emergency Services,o=QLDGOV,c=au" by anonymous none by dn.exact="cn=wl_ph_user,ou=users,o=QLDGOV,c=au" write by dn.regex=".+,ou=users,o=QLDGOV,c=au" write After building the database and starting the daemon, I used the following ldapsearch command to query the database (on the local host, so no remote network connection is involved): ldapsearch -v -D cn=manager,o=QLDGOV,c=au -x -w secret -H ldap://10.2.84.11:5021 -b o=QLDGOV,c=au -z 0 '(cn=Hall)' There were 22 responses. Now: 1) There are no other users operating on the database. 2) The database contents are static (but slapd is not operating in read-only mode). 3) I tested access automatically with a loop of the form i=1; while (( i <= 10 )) do timex ldapsearch ... | grep ^real let 'i += 1' sleep 5 done (i.e. I used timex(1) to report the real time response). 50.43, 17.41, 41.92, 19.16, 2.46, 27.63, 33.90, 0.15, 13.56, 34.11 Yet, after applying tusc -o /dev/null {slapd_pid}, the retrieval times immediately became 1.18, 0.40, 0.51, 0.40, 0.60, 0.40, 0.40, 0.40, 0.39, 0.38 Not only better, but uniformly better. Moreover, a similar (but to a lesser degree) effect was seen if I enabled LDAP debugging. Any ideas on how to resolve this would be much appreciated. Thanks. Howard Bryden, UNIX Administrator, Qld. Govt. Dept. of Emergency Services, Tel. 07 3109 5087 ------------------------------------------------------------------------ ---------------------------------- Rocket J. Squirrel: "... we're going to have to think!" Bullwinkle J. Moose: "There must be an easier way than that." This correspondence is for the named persons only. It may contain confidential or privileged information or both. No confidentiality or privilege is waived or lost by any mis transmission. If you receive this correspondence in error please delete it from your system immediately and notify the sender. You must not disclose, copy or relay on any part of this correspondence, if you are not the intended recipient. Any opinions expressed in this message are those of the individual sender except where the sender expressly, and with the authority, states them to be the opinions of the Department of Emergency Services, Queensland.

3 2

Emulating attribute enumeration
by Vladimir Dzhuvinov 10 Jul '08

10 Jul '08

Hello again, Since the LDAP attribute spec (RFC4512) doesn't appear to support enumerated types (probably for a good reason) I wanted to see whether this could be imitated using OpenLDAP's access control mechanisms. I have a custom attribute "transactionCenterAccountStatus" which should only have values "active", "suspended" or "closed". So I opened slapd.conf and defined the line access to attrs=transactionCenterAccountStatus val.regex="active|suspended|closed" by set="user/transactionCenterRole & [admin]" write by * read The "slaptest" command didn't complain, so then I restarted slapd. But when I login as the designated user and try to set the attribute to one of the three values I keep getting error 50 - "Insufficient access rights". Clearly, I must be missing something, but I can't see what? :) Vlad -- Vladimir Dzhuvinov * www.valan.net * PGP key ID AC9A5C6C

2 2

Access control by attribute value of bound user?
by Vladimir Dzhuvinov 10 Jul '08

10 Jul '08

Hello, I had a look at the OpenLDAP docs and it looks like it isn't possible to define access based on an attribute value of a bound user. Is this correct? I use slapd version 2.4.9 (Debian/Linux). -- Vladimir Dzhuvinov * www.valan.net * PGP key ID AC9A5C6C

3 3

slapd and multi core cpu's
by Jeronimo Zucco 09 Jul '08

09 Jul '08

I'm using openldap 2.4.10. slapd is only using one cpu core of my server. is it possible slapd use more cpu cores ? -- Jeronimo Zucco LPIC-1 Linux Professional Institute Certified Núcleo de Processamento de Dados Universidade de Caxias do Sul http://jczucco.blogspot.com

5 9

size limit problem in 2.4.10
by Jeronimo Zucco 09 Jul '08

09 Jul '08

Hi list. I'm trying to limit queries for one user in my slapd.conf, with this rules: limits dn.exact="cn=user1,dc=domain,dc=com" size.soft=50 size.hard=50 limits anonymous size.soft=50 size.hard=50 limits users size.soft=50 size.hard=50 sizelimit unlimited But "user1" isn't limited with this rules. If I set "sizelimit 50", the syncrepl doesn't work, even I set no limit in my syncrepl directive or setting limits for replicator user. This rules was working fine in openldap 2.3.35 until I upgrade to 2.4.10. :-( Somebody have tips, mans, or ideias to solve this issue ? Thanks. -- Jeronimo Zucco LPIC-1 Linux Professional Institute Certified Núcleo de Processamento de Dados Universidade de Caxias do Sul http://jczucco.blogspot.com

2 8

configure ACL: allow access until after a period of time?
by Zhang Weiwu 09 Jul '08

09 Jul '08

Hello. I've been looking for a solution to define time-based ACL. e.g. a user can access certain entries only since now on until after 3 months. Is it possible? Of course I can also set up a cron-job or simply mark on my calendar, to remove access of this entry after a period of time, e.g. 3 months. But I wonder if it's possible to let slapd manage it. e.g. I want to make certain group of users not able to access all contact records in certain department after 2008-08-08 (but still can access other records). Thank you very much in advance. Would be kind of you to just give me some links where I can get these knowledge myself (didn't seems to find related information in 2.4 admin manual)

3 3

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software July 2008