openldap-software April 2009

openldap-software@openldap.org

47 participants
39 discussions

dynlist overlay and ldapsearch
by ben thielsen 03 Feb '10

03 Feb '10

hi- i'm using the dynlist overlay and am not getting back the search results i expected. i'm using 2.4.11 courtesy of debian. here is my overlay config: >ldapsearch -xWLLLD 'cn=admin,cn=config' -b 'cn=config' "(objectclass=olcdynamiclist)" dn: olcOverlay={5}dynlist,olcDatabase={2}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcDynamicList olcOverlay: {5}dynlist olcDLattrSet: {0}groupOfNames memberURL member olcDLattrSet: {1}mailGroup labeledURI here is the entry in question: >ldapsearch -xWLLLD 'cn=admin,dc=groundnoise,dc=net' -s base -b 'cn=abuse,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail,dc=groundnoise,dc=net' dn: cn=abuse,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail,dc=groun dnoise,dc=net objectClass: mailGroup objectClass: top objectClass: extensibleObject cn: abuse member: cn=postmaster,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail ,dc=groundnoise,dc=net labeledURI: ldap:///ou=domains,ou=mail,dc=groundnoise,dc=net?host?sub?(objectC lass=mailDomain) host: phone.dipswitch.net host: luna.mpls.mn.us host: groundnoise.net host: thielsen.org host: sjva1991.org host: dipswitch.net host: bitrate.net searched for another way: >ldapsearch -xWLLLD 'cn=admin,dc=groundnoise,dc=net' '(&(objectclass=mailgroup)(cn=abuse))' host dn: cn=abuse,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail,dc=groun dnoise,dc=net host: phone.dipswitch.net host: luna.mpls.mn.us host: groundnoise.net host: thielsen.org host: sjva1991.org host: dipswitch.net host: bitrate.net however, the results from this search are missing that entry: >ldapsearch -xWLLLD 'cn=admin,dc=groundnoise,dc=net' '(host=dipswitch.net)' dn dn: host=dipswitch.net,ou=domains,ou=mail,dc=groundnoise,dc=net or another search: ldapsearch -xvWD 'cn=admin,dc=groundnoise,dc=net' '(&(objectclass=mailgroup)(host=*))' host ldap_initialize( <DEFAULT> ) Enter LDAP Password: filter: (&(objectclass=mailgroup)(host=*)) requesting: host # extended LDIF # # LDAPv3 # base <dc=groundnoise, dc=net> (default) with scope subtree # filter: (&(objectclass=mailgroup)(host=*)) # requesting: host # # search result search: 2 result: 0 Success # numResponses: 1 if i remove the labeledURI attribute and populate with static entries, things appear to work as expected: here's the entry: >ldapsearch -xWLLLD 'cn=admin,dc=groundnoise,dc=net' '(&(objectclass=mailgroup)(cn=abuse))' dn: cn=abuse,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail,dc=groun dnoise,dc=net objectClass: mailGroup objectClass: top objectClass: extensibleObject cn: abuse member: cn=postmaster,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail ,dc=groundnoise,dc=net host: foo host: bar host: com host: net host: org and a search: >ldapsearch -xWLLLD 'cn=admin,dc=groundnoise,dc=net' '(host=foo)' dn dn: cn=abuse,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail,dc=groun dnoise,dc=net what am i doing wrong? thanks -ben

3 3

Re: solaris compile options
by Brett ＠Google 25 Jan '10

25 Jan '10

i am using CFLAGS="-fast -xtarget=ultraT1 -xarch=sparcvis2 -xcode=pic32 -g -xs -O" one set of solaris docs i read implied that -xarch=sparcvis2 was equivalent to -xarch=v9 (which used to trigger 64 bit), but looking at the sun studio 12 compiler options, the more specific versions of -xarch (ie. other than -xarch=v9 or v9a or v9b) may no longer imply that the 64 bit memory model should be used. so maybe i need to add a -m64 to the above ? (compiling on a Sun T2000, with a homegenous build / execute environment, so favouring speed over cpu compatibility is ok) On Thu, Mar 12, 2009 at 1:31 AM, Aaron Richton <richton(a)nbcs.rutgers.edu>wrote: > On Wed, 11 Mar 2009, Brett @Google wrote: > > /data/openldap/backups/ldap_090302.ldif: Value too large for defined data >> type >> > > man lfcompile, and/or switch to 64-bit binaries? >

2 3

password policy - alternate lockout mechanism
by Aravind Gottipati 17 Jul '09

17 Jul '09

Hi, The current password policy module can lock folks out after some configurable number of failed attempts. The module currently does not differentiate between a user failing with the same wrong password a bunch of times versus a crack attempt where someone tries multiple different wrong passwords. Are there any modules that take into account if the same password is being used a bunch of times or if multiple different passwords are failing? Could this be a useful feature worth requesting (if it doesn't exist already)? Thank you, Aravind.

6 24

Supported RFC's and "features"
by Clowser, Jeff (Contractor) 14 Jul '09

14 Jul '09

I'm currently doing a review to see how OpenLDAP compares, *feature wise* ATM, to other directory servers and specifically to the Sun DS - i.e. to get a definitive list of features it's missing that Sun has and what it has that Sun doesn't have, etc. For brevity, I haven't included all the potentially useful features of OpenLDAP, but have just focused on those associated with 1) RFC compliance (of which Sun may or may not meet) and 2) features to match the Sun DS (which it would be replacing). So far, here's what I have for OpenLDAP: RFC 4510 (which includes 4511-4519). There was recent discussion on the list around this, such that in some cases, not everything that changed from 3377 (which includes 2251-2256, 2829, and 2830) to 4510 has been updated in OpenLDAP, but I think those issues are fairly minor. The following additional RFC's are supported in OpenLDAP: - RFC 2247 and RFC 3088 - RFC 2696 simple paged results - RFC 2849 ldif - RFC 3062 password mod op - RFC 3296 named referals, manageDSAit - RFC 3673 All Op attrs + feature - RFC 3687 Component matching rules - RFC 3866 Languange tag and range - RFC 3876 matched values control - RFC 4370 proxy auth - RFC 4522 binary encoding - RFC 4523 x.509 cert schema - RFC 4524 COSINE schema - RFC 4525 Mod-increment - RFC 4526 Absolute true/false filters - RFC 4527 pre/post read control - RFC 4528 assertion control - RFC 4529 request attrs by objectclass - RFC 4530 entryUUID - RFC 4532 whoamI - RFC 4533 Content Sync op (replication) RFC's NOT supported are: - RFC 2589 dds Seems with 2.4, this has gone from experimental to production quality? - RFC 2891 server side sorting - RFC 3671 collective attributes - RFC 3928 LCUP mainly for updating cached addressbooks, etc - not replication between servers - RFC 3384 looks like just reqs for replication, not an actual replication protocol - RFC 4533 is used instead Unknown: - RFC 3672 (subentries) - RFC 3698 and 3727 (additional matching rules) - RFC 3909 LDAP Cancel operation - RFC 5020 entryDN operational attribute (There are some other, often obscure, LDAP related RFC's that I didn't include, but this seems to be the major/useful ones) Other features not supported: - VLV browse indexes (per http://tools.ietf.org/html/draft-ietf-ldapext-ldapv3-vlv-09). Not an RFC, but supported by Sun and MS directories, and used by things like Outlook and Solaris. Other supported features: - dyngroup/dynlist/memberof overlay (A much more useful feature than Sun's groupOfURLs "dynamic" group and "roles" mechanism) - ppolicy overlay (matches Sun DS 5.x reasonably close, but is account lockout replicated to all servers? Sun DS 6.x claims to) - refint overlay (similar to Sun's referential integrity plugin) - unique overlay (similar to Sun's uniqueness plugin) - audit and accesslog overlays, syslog logging - much more useful/complete than Sun's access/audit/error logs. - live acl changes via LDAP Unknown features: - Per user resource limits (sizelimit, timelimit, idletimeout, etc). I think Howard Chu said OpenLDAP has some of this, but I haven't seen any reference to it or how to use it in the docs (does this functionality exist, and if so, is there any documentation?) - Tracking of last login (i.e. last successful ldap authentication) Is this still fairly accurate? The ones that are really problematic are the lack of: - VLV Browse indexes - RFC 2891 (server side sorting) - per user/entry resources limits (if they don't exist) Are there any unofficial updates/patches/overlays/plans for any of this functionality? Thanks, - Jeff

11 29

sync problem
by Leonardo Carneiro 05 May '09

05 May '09

Hi everyone, i'm no ldap expert at all. in fact i'm very noob. a few months ago i'd configured 2 ldap servers. they were set in 2 separated networks, and syncronized via a openvpn link. all was working ok when when about a month ago they stop syncing. the replogfile is empty. main server (piece of slapd.conf): replogfile /var/lib/ldap/openldap-master-replog replica host=192.168.0.2:389 binddn="cn=root,dc=dominio,dc=com,dc=br" bindmethod=simple credentials=[pass] secondary server (piece of slapd.conf) updatedn "cn=root,dc=dominio,dc=com,dc=br" updateref ldap://192.168.1.2:380 Sorry about my poor english, i'm from brasil. -- *Leonardo de Souza Carneiro* *Veltrac - Tecnologia em Logística.* lscarneiro(a)veltrac.com.br <mailto:lscarneiro@veltrac.com.br> http://www.veltrac.com.br <http://www.veltrac.com.br/> /Fone Com.: (43)2105-5600/ /Av. Higienópolis 1601 Ed. Eurocenter Sl. 803/ /Londrina- PR/ /Cep: 86015-010/ /Esta mensagem pode conter informação confidencial e/ou privilegiada./ /Se você recebeu esta mensagem por engano, por favor avise imediatamente o remetente, respondendo o e-mail e em seguida apague-o./ /This message may contain confidential and/or privileged information./ /If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message./

3 4

slapd leaking memory on i386?
by John Morrissey 02 May '09

02 May '09

2.4.16 (with BDB4.7 + patches and the POSIX threads build options) has been stable on amd64/x86_64 for us, but I'm encountering problems with 2.4.16 on i386. slapd will run happily for several hours at a RSS of ~1.2GB, but then will suddenly gobble memory until it hits the i386 address space limit of 3GB and dies due to random segfaults as memory allocation fails. BDB caches are set to ~1.25GB total and the entry cache to 10,000 entries. I'm not sure how long it takes slapd to consume the extra 2GB of memory, but it's definitely less than 20 minutes according to sar(1). I have a couple core files from when this happens. Are there structures that are likely suspects for unchecked growth (the entry and BDB caches, for example) that I can poke at with a debugger to get an idea what's going on? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

3 9

pwdPolicyAttribute not found any where
by Rahima Shaheen 01 May '09

01 May '09

Hi, I am facing a problem. I use openldap-2.2.29-db-4.3.29-openssl-0.9.8a-win32_Setup.exe and want to implement. I did 2 ou. a. ou= policies b. ou= developer 1 default password policy: cn=default,ou=policies,dc=my-domain,dc=com. Now I want to implement pwdPolicyAttribute. I make a ldif like: dn: cn=shaheen,ou=FPdeveloper,dc=my-domain,dc=com objectclass: top objectclass: person cn: shaheen sn: rahima title: FPdeveloper Developer userPassword: pass#123 pwdPolicySubentry: cn=default,ou=policies,dc=my-domain,dc=com but it gives error undefined attribute type. What is the wrong with me? My assumption is pwdPolicyAttribute is not Created. But whenever I want to create the schema an error attribute type is operational. What can I do. I also could not uncomment overlay in slapd. Please help me. -- Shaheen

2 1

rwn rewrite
by Adam Leach 30 Apr '09

30 Apr '09

All, I'm needing to use the rwn overlay to map a DN that uses uid= to a cn= so that when someone searches for cn=jsmith,dc=example,dc=com but the actual DN is uid=jsmith,dc=example,dc=com. Any ideas/suggestions? Thanks -- Adam Leach BS Computer/Electrical Engineering West Virginia University Systems Administrator - Raytheon

1 0

Valgrind reporting an invalid file descriptor
by Matthijs Mohlmann 29 Apr '09

29 Apr '09

Hello all, I'm writing an program with LDAP but probably something goes wrong when I try to shutdown the connection. First I call ldap_initialize, after that I call a bind operation. (Using function ldap_bind_ext) That goes all very well. Then I try to close the connection with ldap_unbind_ext. This goes according to the return value ok, but when running in valgrind I see a Warning: invalid file descriptor -1 in syscall close() ==4733== Warning: invalid file descriptor -1 in syscall close() ==4733== at 0x40007F2: (within /lib/ld-2.9.so) ==4733== by 0x4300BB0: ber_int_sb_close (in /usr/lib/liblber-2.4.so. 2.4.1) ==4733== by 0x43011AB: ber_sockbuf_free (in /usr/lib/liblber-2.4.so. 2.4.1) ==4733== by 0x404AEAE: ldap_ld_free (in /usr/lib/libldap_r-2.4.so. 2.4.1) ==4733== by 0x404AF55: ldap_unbind_ext (in /usr/lib/ libldap_r-2.4.so.2.4.1) ==4733== by 0x804A167: main (ldap.cpp:283) Is this a bug in the LDAP library, or did I forgot a call to something ? According to the documentation (man 3 ldap_unbind_ext) is this the only call I need to do. Can somebody enlighten me here ? Regards, Matthijs Mohlmann

1 0

how implement pwdpolicy
by Rahima Shaheen 29 Apr '09

29 Apr '09

Hi, I am very new to open ldap. I can run slap an add edit new entry. Now I want to implement pwdpolicy. I tried it several times. I like to describe what I said. 1. run slapd without modifying anything. 2. create an ou=policies. Script as following dn: ou=policies,dc=my-domain,dc=com objectClass: organizationalUnit objectClass: top ou: policies 3. write policy.schema. 4. include policy.schema; but overlay is not added. run slapd again. In the core.schema attributetype userpassword was comment out 5. Now I want to create policy.ldif. Script dn: cn=default,ou=policies,dc=my-domain,dc=com cn: default objectClass: pwdPolicy objectClass: person objectClass: top pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 2 pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 5 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 0 pwdMaxAge: 0 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 5 pwdMustChange: FALSE pwdSafeModify: FALSE #sn: 'dummy value' objectClass: organizationalUnit It gives an error "Invalid syntax (21) pwdAttribute: value #0 invalid per syntax. Why it gives such error? My assumption is ppolicy.schema attribute is not created successfully. Another point in core.schema attributeType; userPassword is comment out. If I uncomment it. slapd -d 1 gives an duplicate attribute type. Give a solution please. Now my question is a. how I am sure that my PPolicy.schema is created? I don't have any ppolicy.la b. what does do policy.la.

5 5

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software April 2009