openldap-software October 2009

openldap-software@openldap.org

44 participants
45 discussions

2.4.18 refint getting "no such attribute" in bdb_modify_internal with removal; works with rename
by Andreas Hasenack 07 Oct '09

07 Oct '09

[apologies if you get this twice: I originally sent this from the wrong non-subscribed address] Hi, I'm using the refint overlay with a few attributes, but I can't get it to work with krbPwdPolicyReference from MIT kerberos 1.7. I get the error from the subject when deleting the entry this attribute references. If, however, I *rename* the entry, the krbPwdPolicyReference attribute gets updated correctly. It seems to fail only when I remove the entry. This is the config: dn: olcOverlay={1}refint,olcDatabase={1}hdb,cn=config objectClass: olcRefintConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {1}refint olcRefintAttribute: krbObjectReferences olcRefintAttribute: member olcRefintAttribute: krbPwdPolicyReference olcRefintNothing: cn=localroot,cn=config This is the entry which has the attribute pointing to the entry I will remove (some attributes omitted for brevity): dn: krbPrincipalName=andreas(a)EXAMPLE.COM,cn=EXAMPLE.COM,ou=Kerberos Realms,dc= example,dc=com krbPrincipalName: andreas(a)EXAMPLE.COM objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux krbObjectReferences: uid=andreas,ou=people,dc=example,dc=com krbPwdPolicyReference: cn=default,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example ,dc=com This is the entry I'm deleting. I would expect the krbPwdPolicyReference attribute from my entry above to be deleted. If I rename this cn=default, then krbPwdPolicyReference gets updated correctly. dn: cn=default,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example,dc=com cn: default objectClass: krbPwdPolicy krbMaxPwdLife: 36000 krbMinPwdLife: 0 krbPwdMinDiffChars: 1 krbPwdMinLength: 1 krbPwdHistoryLength: 1 These are the relevant logs (level 16383): Oct 7 16:55:33 maestro slapd[6381]: refint_search_cb <NOTHING> Oct 7 16:55:33 maestro slapd[6381]: ==> unique_modify <krbPrincipalName=andreas(a)EXAMPLE.COM,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example,dc=com> Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: ndn: "krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: oc: "(null)", at: "(null)" Oct 7 16:55:33 maestro slapd[6381]: bdb_dn2entry("krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com") Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: found entry: "krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: bdb_entry_get: rc=0 Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: ndn: "krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: oc: "(null)", at: "(null)" Oct 7 16:55:33 maestro slapd[6381]: bdb_dn2entry("krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com") Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: found entry: "krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: bdb_entry_get: rc=0 Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: ndn: "cn=default,ou=password policies,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: oc: "(null)", at: "(null)" Oct 7 16:55:33 maestro slapd[6381]: bdb_dn2entry("cn=default,ou=password policies,dc=example,dc=com") Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: found entry: "cn=default,ou=password policies,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: bdb_entry_get: rc=0 Oct 7 16:55:33 maestro slapd[6381]: hdb_modify: krbPrincipalName=andreas(a)EXAMPLE.COM,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example,dc=com Oct 7 16:55:33 maestro slapd[6381]: bdb_dn2entry("krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com") Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: 0x00000042: krbPrincipalName=andreas(a)EXAMPLE.COM,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example,dc=com Oct 7 16:55:33 maestro slapd[6381]: <= acl_access_allowed: granted to database root Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: delete krbPwdPolicyReference Oct 7 16:55:33 maestro slapd[6381]: dnMatch 0#012#011"cn=default,cn=example.com,ou=kerberos realms,dc=example,dc=com"#012#011"cn=default,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: replace modifiersName Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: delete krbPwdPolicyReference Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: 16 modify/delete: krbPwdPolicyReference: no such attribute Oct 7 16:55:33 maestro slapd[6381]: hdb_modify: modify failed (16) Oct 7 16:55:33 maestro slapd[6381]: send_ldap_result: conn=-1 op=0 p=0 Oct 7 16:55:33 maestro slapd[6381]: send_ldap_result: err=16 matched="" text="modify/delete: krbPwdPolicyReference: no such attribute" Oct 7 16:55:33 maestro slapd[6381]: refint_repair: dependent modify failed: 16 Any hints?

1 0

logging to accesslog
by Evgeniy 07 Oct '09

07 Oct '09

Hello Now on our Ldap servers (OpenLdap 2.4.16) we logging all write operations to accesslog: database bdb suffix "cn=accesslog" rootdn "cn=root,cn=accesslog" rootpw password directory /usr/local/var/accesslog-data index reqStart eq overlay accesslog logdb "cn=accesslog" logops writes logold (objectclass=person) logpurge 1+00:00 1+00:00 logsuccess TRUE In case of Multi-Master replication, 2 Masters, how I can wrote to accesslog only local write operations, without replication write ops ? -- ---______________________________________________--- with deference, Evgeniy

1 0

openldap and kerberos auth-to-local rules
by Guillaume Rousse 05 Oct '09

05 Oct '09

Hello list. I successfuly configured OpenLDAP for kerberos autentication, and user mapping: authz-regexp "uid=([^,]+),cn=gssapi,cn=auth" "ldap:///ou=users,dc=futurs,dc=inria,dc=fr??sub?(uid=$1)" However, mapping doesn't work when autenticating with a user from a different realm than the one from the server. The logs show the realm is not stripped from username, as it should be: Oct 5 17:30:45 babaorum slapd[28598]: conn=24 op=2 BIND authcid="rousse(a)SACLAY.INRIA.FR" authzid="rousse(a)SACLAY.INRIA.FR" Oct 5 17:30:45 babaorum slapd[28598]: conn=24 op=2 BIND dn="uid=rousse(a)saclay.inria.fr,cn=gssapi,cn=auth" mech=GSSAPI sasl_ssf=56 ssf=56 authcid should be 'rousse', not 'rousse(a)SACLAY.INRIA.FR'. This is a classic problem, and kerberos provides mapping rules for users of external domains, such as described here: http://www.fnal.gov/docs/strongauth2003/html/krb5conf.html I used those rules succesfully with mod_krb, for instance. However, openldap seems to ignore them. I had to change the previous regexp to: authz-regexp "uid=([^,@]+)(@[^,]+)?,cn=gssapi,cn=auth" "ldap:///ou=users,dc=futurs,dc=inria,dc=fr??sub?(uid=$1) Is this intentional ? -- BOFH excuse #58: high pressure system failure

2 1

virtual attribute
by Liu, Michael 05 Oct '09

05 Oct '09

Hi, We are using OpenLDAP as a frontend proxy for another LDAP server on the backend. On the backend server, "displayname" attribute is not populated but cn is populated. We like to fake out a virtual "displayname" attribute on the frontend proxy OpenLDAP server, and the value of that attribute needs to come from "cn" attribute. Is there a way to do this? Any help is highly appricated. Thanks, Michael

3 3

ACL to allow add/remove of a specific objectclass value?
by Brandon Hume 05 Oct '09

05 Oct '09

I'm tuning my ACLs, and noting that we have several pieces of software that require the presence of a specific objectclass. Up to this point, they have write access to the objectclass attribute and can add the specific auxiliary class if needed and then modify the attributes that come with it. I'd like to pare down their access. It'd be nice to be able to allow them to add and remove the specific objectclass that they work with (in this case, posixAccount) but not touch the other objectclasses they have no business modifying (person, etc). Can an ACL work at this fine-grained a level? I'm going over the 2.4 docs and the FAQ-o-matic, but not coming across anything. (Though I'm certainly building a very nice "Ooo, I should do <x> that way..." list...)

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software October 2009