openldap-software September 2008

openldap-software@openldap.org

60 participants
64 discussions

About the compatible version of openldap software for RHEL3
by sangeetha.ganesan＠wipro.com 16 Sep '08

16 Sep '08

Hi All, We are planning to implement Openldap in one of the RHEL 3 server. Could you please suggest me any version which works fine with RHEL 3. If there is no strict rule that only particular version of openldap has to be installed on RHEL3 or RHEL 4, Please let me know if anyone has idea on implementing a new openldap server in an existing environment of servers of all flavours. waiting for your inputs!! thanks!! regards, sangeetha. Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

slapd shuts itself down.
by Curt Blank 15 Sep '08

15 Sep '08

OpenLDAP 2.2.28 Found this: Sep 10 10:25:34 ldap03 slapd[2498]: conn=10878784 fd=57 ACCEPT from IP=nn.nn.nn.nn:63038 (IP=0.0.0.0:389) Sep 10 10:25:34 ldap03 slapd[2498]: connection_init(57, IP=nn.nn.nn.nn:63042): set nonblocking failed Sep 10 10:25:34 ldap03 slapd[2498]: conn=10878788 fd=57 ACCEPT from IP=nn.nn.nn.nn:63042 (IP=0.0.0.0:389) Sep 10 10:25:34 ldap03 slapd[2498]: slapd shutdown: waiting for 1 threads to terminate Sep 10 10:26:08 ldap03 slapd[2498]: slapd stopped. Is it shutting itself down because of the "set nonblocking failed"? Anything I can do about that to stop it? -- Curt Blank Systems Administrator Technical Services Specialist University Information Technology Services University of Wisconsin-Milwaukee e-mail: curt(a)uwm.edu phone : (414) 229-3814

2 1

Two samba related openldap overlays
by Joel Reed 15 Sep '08

15 Sep '08

Two openldap overlays that may be of interest to others. In the first, I've hacked up Howard Chu's smbk5pwd openldap overlay to include the automatic addition of sambaNTPassword, sambaLMPassword, and sambaPwdLastSet attributes to any sambaSamAccount entries that are being ADDED to the directory. WARNING: This overlay is ONLY useful with cleartext passwords. In the second, I've modified my automatic uidnumber generator overlay to also add sambaSID's to sambaSamAccount entries that are being added to the directory. The algorithm used to generate the SID is the same as employed by smbldap-tools (2*uidNumber+1000). Currently, the samba domain SID is hardcoded to "S-1-0-0-". If you want to use this overlay, change this variable accordingly or teach the overlay how to read from config. jr

3 3

Syncrepl issues in multi-versions environment
by Thibault Le Meur 15 Sep '08

15 Sep '08

Hi openldap Gurus, I'm sorry for the long post, but I try to give as much details as possible. We are having serious issues with syncrepl replication and our 3 openldap servers. These issues first occurred when one of the servers was upgraded to openldap 2.4.11 while the two others were (and still are) openldap-servers-2.3.39 and openldap-servers-2.3.30. My main goal in writing this email is to make sure our 3-servers architecture is supported and to check if my setup is correct. Just to let you know, the issues we've found so far include: * having the openldap 2.3.x servers unable to restart (with a crash report) [seems to be due to several contextCSN on the openlda2.4 server database] * sometimes the subtree obtained from the openldap2.4 by syncrepl processes in openldap2.3 servers disapears (by reading the log, with loglevel 16384,it seems that the NON PRESENT phase of the LdapSync protocol decides that entries are no more in the openldap2.4 provider [though they are still present]). Since I have a doubt about our replication structure which uses syncrepl and subordinate databases, I wonder if it is really supported by these versions of openldap. I would really appreciate if someone could have a look at this and say if the following scenario is supported: ------------------------ AllServers have the following DIT: dc=mycompany,dc=edu | |-dc=A,dc=mycompany,dc=edu | |-dc=B,dc=mycompany,dc=com | |-dc=B,dc=mycompany,dc=com Each server replicates 2 subtrees from {dc=A, dc=B, dc=C} and is the provider for the remaining one. Server A has the following setup: ================================= * a section used to glue the subordinate "dc=B,dc=mycompany,dc=com" subtree, with content replicated from the ldap.B.supelec.fr * section used to glue the subordinate "dc=C,dc=mycompany,dc=com" subtree, with content replicated from the ldap.C.supelec.fr * section having the root suffix "dc=mycompany,dc=com" and managing its own subtree dc=A,dc=mycompany,dc=com The configuration file looks like: * First section is used to get data from the B server, and set it in the dc=B,dc=mycompany,dc=com glued subtree (using subordinate keyword) database bdb suffix "dc=B,dc=mycompany,dc=com" rootdn "cn=mgr,dc=mycompany,dc=com" subordinate directory /openldap/openldap-data-B syncrepl rid=125 provider=ldaps://ldap.B.supelec.fr type=refreshOnly interval=00:00:03:00 retry="60 10 300 +" searchbase="dc=B,dc=mycompany,dc=com" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="cn=replicator,dc=mycompany,dc=com" credentials="password" * Second section is used to get data from the C server, and set it in the dc=C,dc=mycompany,dc=com glued subtree (using subordinate keyword) database bdb suffix "dc=C,dc=mycompany,dc=com" rootdn "cn=mgr,dc=mycompany,dc=com" subordinate directory /openldap/openldap-data-C syncrepl rid=120 provider=ldaps://ldap.C.supelec.fr type=refreshOnly interval=00:00:03:00 retry="60 10 300 +" searchbase="dc=C,dc=mycompany,dc=com" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="cn=replicator,dc=mycompany,dc=com" credentials="password" * Third section is used to define data from the A server, it has a root suffix of "dc=mycompany,dc=com" and owns his own subtree dc=A,dc=mycompany,dc=com database bdb suffix "dc=mycompany,dc=com" rootdn "cn=mgr,dc=mycompany,dc=com" rootpw THEPASS directory /openldap/openldap-data-A overlay syncprov syncprov-checkpoint 100 10 Server B has the symetric setup: ================================= * section used to glue the subordinate "dc=C,dc=mycompany,dc=com" subtree, with content replicated from the ldap.C.supelec.fr * section used to glue the subordinate "dc=A,dc=mycompany,dc=com" subtree, with content replicated from the ldap.A.supelec.fr * section having the root suffix "dc=mycompany,dc=com" and managing its own subtree dc=B,dc=mycompany,dc=com Server C has the symetric setup: ================================= * section used to glue the subordinate "dc=B,dc=mycompany,dc=com" subtree, with content replicated from the ldap.B.supelec.fr * section used to glue the subordinate "dc=A,dc=mycompany,dc=com" subtree, with content replicated from the ldap.A.supelec.fr * section having the root suffix "dc=mycompany,dc=com" and managing its own subtree dc=C,dc=mycompany,dc=com ------------------------ Do you think this structure is supported by these versions of openldap? Though not explicitely described in the "Upgrading from 2.3.x" section of the Administrator guide, I've read in the slapd.conf manpage (openldap2.4) that the "serverID" new parameter is required when using "separate masters contributing to a glued set of databases." which, I think, is a correct description of our structure. Thus I added a "serverID 20" parameter to the openldap2.4 server's configuration. Am I right in using serverID for our setup? Adding this parameter had a side effect though: we end up having two contextCSN cookies on the openldap2.4 database suffix entry. We managed to get rid of these by: * extracting the database content with "slapcat -g", * deleting contextCSN and entryCSN lines form the file, * then purging the bdb files and importing with 'slapadd -g -l'. Do you think this is a correct procedure to restart from scratch our openldap2.4 server ? I thank you in advance for any information and advice you could give me in order to get back to a working configuration. Regards, Thibault

3 3

SASL/GSSAPI authentication error
by Frederick Kramer 15 Sep '08

15 Sep '08

Hello, I have authentication problems while accessing the LDAP database. Each attempt to view or modify the DB leads to this error: [root@mysystem]~> ldapwhoami SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (No credentials cache found) On the other hand users can log on, change their passwords and so on - all that's working fine. I found some similar problems in the web but no answer to those helped me to solve this. I suppose it's not a big thing and apologize for my limited understanding of ldap and authentification procedures. Thanks for any help Best regards Fred

3 2

synchronization problems
by Grzegorz Marszałek 15 Sep '08

15 Sep '08

Hello! I'm using slapd 2.4.9 on ubuntu. I've got one master, and many read- only slaves. Last week I've seen something very strage - I was "playing" with acls, and there was small window of time, when one slave couldn't see all entries I should on master. Problem is, that after fixing this problem in acls slave haven't synchronized properly (I could do ldapsearch at master from slave's shell and gen all entries, but local replica haven't this data). Reestarting slapd haven't helped. I have to stop slapd, delete everything but DB_CONFIG in /var/lib/ldap and start it again. So my question is: what could create such a problem? And, more important: how can I monitor slapd slaves for such problems? Is there any ready solution for this (nagios plugins, or maybe just some script)? Cheers --- Grzegorz Marszałek graf0(a)post.pl

2 1

RE: ACL resolving
by JUNG, Christian 15 Sep '08

15 Sep '08

Hi Quanah, thanks for your help. You're right; it works as expected. I don't know what I've done exactly; maybe I had a typo in the DN of the uniqueMember... Bye Chris > -----Original Message----- > From: Quanah Gibson-Mount [mailto:quanah@zimbra.com] > Sent: Monday, September 15, 2008 7:19 AM > To: JUNG, Christian; OpenLDAP Software Mailinglist (E-Mail) > Subject: Re: ACL resolving > > > --On Wednesday, September 10, 2008 4:26 PM +0200 "JUNG, Christian" > <christian.jung(a)saarstahl.com> wrote: > > > Hi, > > > > does slapd resolve the ACLs only at start time? > > > > I have following ACL defined: > > Using groups in acls has always worked for me, without having > the results > cached. Have you run slapd with acl tracing to see what it reports? > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > >

1 0

ACL resolving
by JUNG, Christian 14 Sep '08

14 Sep '08

Hi, does slapd resolve the ACLs only at start time? I have following ACL defined: access to * by group/groupOfUniqueNames/uniqueMember="cn=admins,dc=example,dc=com" write by * read which should allow only members of the group cn=admins write access to the whole directory. Others may only read. The group looks like this: dn: cn=admins,dc=example,dc=com objectClass: groupOfUniqueNames cn: admins description: LDAP administrators uniqueMember: cn=manager,dc=example,dc=com uniqueMember: uid=chris,ou=user,dc=example,dc=com If I add a member to the group, it seems that I have to restart slapd to allow the new member write access to the directory. Is this correct or am I missing something? Bye Chris -- phone: +49 6898/10-4987 web : www.saarstahl.de mail : Hofstattstraße 106a D 66333 Voelklingen

2 1

Got Search entry without sync control
by Scott Briggs 12 Sep '08

12 Sep '08

Hi, I'm trying to figure out a problem I'm having with an ldap server that stopped replicating with log entries like: do_syncrep2: rid=002 got search entry without Sync State control do_syncrepl: rid=001 retrying So can anyone tell me what "got search entry without sync state control" means? I could only find 1 other reference to someone who had this error but nothing was mentioned about what this means. I'm running openldap ver. 2.4.9 in a multimaster setup (2 servers) on Ubuntu hardy. Thanks. Scott

3 3

Resetting entryCSN and timestamps
by Mathieu MILLET 10 Sep '08

10 Sep '08

Hi everyone, I would like to know if it is possible to make changes on the entryCSN and/or Timestamps ? I know they are operational attributes and I can't modify them through LDAP. I see one useful interest to this is if I want to restore the content of a directory and considered this content as autoritative in a mutli-master replication environment. For now, my main concerns are headaches with playing OpenLdap replication between virtual machines (and the "special" time management). And I would like to reset some of the CSN/Timestamps. I have for example a lot of messages : dn_callback : new entry is older than ours cn=schema,cn=config Does anybody have any idea how to do that ? I'm running OpenLDAP 2.4.11 from sources. Thank you in advance for any answer, Sincerely yours, Mathieu MILLET. -- Mathieu MILLET mailto:ldap@htam.net ----

1 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software September 2008