April 2009 - openldap-software

dynlist overlay and ldapsearch
by ben thielsen 03 Feb '10

03 Feb '10

hi- i'm using the dynlist overlay and am not getting back the search results i expected. i'm using 2.4.11 courtesy of debian. here is my overlay config: >ldapsearch -xWLLLD 'cn=admin,cn=config' -b 'cn=config' "(objectclass=olcdynamiclist)" dn: olcOverlay={5}dynlist,olcDatabase={2}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcDynamicList olcOverlay: {5}dynlist olcDLattrSet: {0}groupOfNames memberURL member olcDLattrSet: {1}mailGroup labeledURI here is the entry in question: >ldapsearch -xWLLLD 'cn=admin,dc=groundnoise,dc=net' -s base -b 'cn=abuse,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail,dc=groundnoise,dc=net' dn: cn=abuse,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail,dc=groun dnoise,dc=net objectClass: mailGroup objectClass: top objectClass: extensibleObject cn: abuse member: cn=postmaster,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail ,dc=groundnoise,dc=net labeledURI: ldap:///ou=domains,ou=mail,dc=groundnoise,dc=net?host?sub?(objectC lass=mailDomain) host: phone.dipswitch.net host: luna.mpls.mn.us host: groundnoise.net host: thielsen.org host: sjva1991.org host: dipswitch.net host: bitrate.net searched for another way: >ldapsearch -xWLLLD 'cn=admin,dc=groundnoise,dc=net' '(&(objectclass=mailgroup)(cn=abuse))' host dn: cn=abuse,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail,dc=groun dnoise,dc=net host: phone.dipswitch.net host: luna.mpls.mn.us host: groundnoise.net host: thielsen.org host: sjva1991.org host: dipswitch.net host: bitrate.net however, the results from this search are missing that entry: >ldapsearch -xWLLLD 'cn=admin,dc=groundnoise,dc=net' '(host=dipswitch.net)' dn dn: host=dipswitch.net,ou=domains,ou=mail,dc=groundnoise,dc=net or another search: ldapsearch -xvWD 'cn=admin,dc=groundnoise,dc=net' '(&(objectclass=mailgroup)(host=*))' host ldap_initialize( <DEFAULT> ) Enter LDAP Password: filter: (&(objectclass=mailgroup)(host=*)) requesting: host # extended LDIF # # LDAPv3 # base <dc=groundnoise, dc=net> (default) with scope subtree # filter: (&(objectclass=mailgroup)(host=*)) # requesting: host # # search result search: 2 result: 0 Success # numResponses: 1 if i remove the labeledURI attribute and populate with static entries, things appear to work as expected: here's the entry: >ldapsearch -xWLLLD 'cn=admin,dc=groundnoise,dc=net' '(&(objectclass=mailgroup)(cn=abuse))' dn: cn=abuse,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail,dc=groun dnoise,dc=net objectClass: mailGroup objectClass: top objectClass: extensibleObject cn: abuse member: cn=postmaster,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail ,dc=groundnoise,dc=net host: foo host: bar host: com host: net host: org and a search: >ldapsearch -xWLLLD 'cn=admin,dc=groundnoise,dc=net' '(host=foo)' dn dn: cn=abuse,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail,dc=groun dnoise,dc=net what am i doing wrong? thanks -ben

3 3

Re: solaris compile options
by Brett ＠Google 24 Jan '10

24 Jan '10

i am using CFLAGS="-fast -xtarget=ultraT1 -xarch=sparcvis2 -xcode=pic32 -g -xs -O" one set of solaris docs i read implied that -xarch=sparcvis2 was equivalent to -xarch=v9 (which used to trigger 64 bit), but looking at the sun studio 12 compiler options, the more specific versions of -xarch (ie. other than -xarch=v9 or v9a or v9b) may no longer imply that the 64 bit memory model should be used. so maybe i need to add a -m64 to the above ? (compiling on a Sun T2000, with a homegenous build / execute environment, so favouring speed over cpu compatibility is ok) On Thu, Mar 12, 2009 at 1:31 AM, Aaron Richton <richton(a)nbcs.rutgers.edu>wrote: > On Wed, 11 Mar 2009, Brett @Google wrote: > > /data/openldap/backups/ldap_090302.ldif: Value too large for defined data >> type >> > > man lfcompile, and/or switch to 64-bit binaries? >

2 3

password policy - alternate lockout mechanism
by Aravind Gottipati 17 Jul '09

17 Jul '09

Hi, The current password policy module can lock folks out after some configurable number of failed attempts. The module currently does not differentiate between a user failing with the same wrong password a bunch of times versus a crack attempt where someone tries multiple different wrong passwords. Are there any modules that take into account if the same password is being used a bunch of times or if multiple different passwords are failing? Could this be a useful feature worth requesting (if it doesn't exist already)? Thank you, Aravind.

6 24

Supported RFC's and "features"
by Clowser, Jeff (Contractor) 13 Jul '09

13 Jul '09

I'm currently doing a review to see how OpenLDAP compares, *feature wise* ATM, to other directory servers and specifically to the Sun DS - i.e. to get a definitive list of features it's missing that Sun has and what it has that Sun doesn't have, etc. For brevity, I haven't included all the potentially useful features of OpenLDAP, but have just focused on those associated with 1) RFC compliance (of which Sun may or may not meet) and 2) features to match the Sun DS (which it would be replacing). So far, here's what I have for OpenLDAP: RFC 4510 (which includes 4511-4519). There was recent discussion on the list around this, such that in some cases, not everything that changed from 3377 (which includes 2251-2256, 2829, and 2830) to 4510 has been updated in OpenLDAP, but I think those issues are fairly minor. The following additional RFC's are supported in OpenLDAP: - RFC 2247 and RFC 3088 - RFC 2696 simple paged results - RFC 2849 ldif - RFC 3062 password mod op - RFC 3296 named referals, manageDSAit - RFC 3673 All Op attrs + feature - RFC 3687 Component matching rules - RFC 3866 Languange tag and range - RFC 3876 matched values control - RFC 4370 proxy auth - RFC 4522 binary encoding - RFC 4523 x.509 cert schema - RFC 4524 COSINE schema - RFC 4525 Mod-increment - RFC 4526 Absolute true/false filters - RFC 4527 pre/post read control - RFC 4528 assertion control - RFC 4529 request attrs by objectclass - RFC 4530 entryUUID - RFC 4532 whoamI - RFC 4533 Content Sync op (replication) RFC's NOT supported are: - RFC 2589 dds Seems with 2.4, this has gone from experimental to production quality? - RFC 2891 server side sorting - RFC 3671 collective attributes - RFC 3928 LCUP mainly for updating cached addressbooks, etc - not replication between servers - RFC 3384 looks like just reqs for replication, not an actual replication protocol - RFC 4533 is used instead Unknown: - RFC 3672 (subentries) - RFC 3698 and 3727 (additional matching rules) - RFC 3909 LDAP Cancel operation - RFC 5020 entryDN operational attribute (There are some other, often obscure, LDAP related RFC's that I didn't include, but this seems to be the major/useful ones) Other features not supported: - VLV browse indexes (per http://tools.ietf.org/html/draft-ietf-ldapext-ldapv3-vlv-09). Not an RFC, but supported by Sun and MS directories, and used by things like Outlook and Solaris. Other supported features: - dyngroup/dynlist/memberof overlay (A much more useful feature than Sun's groupOfURLs "dynamic" group and "roles" mechanism) - ppolicy overlay (matches Sun DS 5.x reasonably close, but is account lockout replicated to all servers? Sun DS 6.x claims to) - refint overlay (similar to Sun's referential integrity plugin) - unique overlay (similar to Sun's uniqueness plugin) - audit and accesslog overlays, syslog logging - much more useful/complete than Sun's access/audit/error logs. - live acl changes via LDAP Unknown features: - Per user resource limits (sizelimit, timelimit, idletimeout, etc). I think Howard Chu said OpenLDAP has some of this, but I haven't seen any reference to it or how to use it in the docs (does this functionality exist, and if so, is there any documentation?) - Tracking of last login (i.e. last successful ldap authentication) Is this still fairly accurate? The ones that are really problematic are the lack of: - VLV Browse indexes - RFC 2891 (server side sorting) - per user/entry resources limits (if they don't exist) Are there any unofficial updates/patches/overlays/plans for any of this functionality? Thanks, - Jeff

11 29

sync problem
by Leonardo Carneiro 05 May '09

05 May '09

Hi everyone, i'm no ldap expert at all. in fact i'm very noob. a few months ago i'd configured 2 ldap servers. they were set in 2 separated networks, and syncronized via a openvpn link. all was working ok when when about a month ago they stop syncing. the replogfile is empty. main server (piece of slapd.conf): replogfile /var/lib/ldap/openldap-master-replog replica host=192.168.0.2:389 binddn="cn=root,dc=dominio,dc=com,dc=br" bindmethod=simple credentials=[pass] secondary server (piece of slapd.conf) updatedn "cn=root,dc=dominio,dc=com,dc=br" updateref ldap://192.168.1.2:380 Sorry about my poor english, i'm from brasil. -- *Leonardo de Souza Carneiro* *Veltrac - Tecnologia em Logística.* lscarneiro(a)veltrac.com.br <mailto:lscarneiro@veltrac.com.br> http://www.veltrac.com.br <http://www.veltrac.com.br/> /Fone Com.: (43)2105-5600/ /Av. Higienópolis 1601 Ed. Eurocenter Sl. 803/ /Londrina- PR/ /Cep: 86015-010/ /Esta mensagem pode conter informação confidencial e/ou privilegiada./ /Se você recebeu esta mensagem por engano, por favor avise imediatamente o remetente, respondendo o e-mail e em seguida apague-o./ /This message may contain confidential and/or privileged information./ /If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message./

3 4

slapd leaking memory on i386?
by John Morrissey 01 May '09

01 May '09

2.4.16 (with BDB4.7 + patches and the POSIX threads build options) has been stable on amd64/x86_64 for us, but I'm encountering problems with 2.4.16 on i386. slapd will run happily for several hours at a RSS of ~1.2GB, but then will suddenly gobble memory until it hits the i386 address space limit of 3GB and dies due to random segfaults as memory allocation fails. BDB caches are set to ~1.25GB total and the entry cache to 10,000 entries. I'm not sure how long it takes slapd to consume the extra 2GB of memory, but it's definitely less than 20 minutes according to sar(1). I have a couple core files from when this happens. Are there structures that are likely suspects for unchecked growth (the entry and BDB caches, for example) that I can poke at with a debugger to get an idea what's going on? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

3 9

pwdPolicyAttribute not found any where
by Rahima Shaheen 30 Apr '09

30 Apr '09

Hi, I am facing a problem. I use openldap-2.2.29-db-4.3.29-openssl-0.9.8a-win32_Setup.exe and want to implement. I did 2 ou. a. ou= policies b. ou= developer 1 default password policy: cn=default,ou=policies,dc=my-domain,dc=com. Now I want to implement pwdPolicyAttribute. I make a ldif like: dn: cn=shaheen,ou=FPdeveloper,dc=my-domain,dc=com objectclass: top objectclass: person cn: shaheen sn: rahima title: FPdeveloper Developer userPassword: pass#123 pwdPolicySubentry: cn=default,ou=policies,dc=my-domain,dc=com but it gives error undefined attribute type. What is the wrong with me? My assumption is pwdPolicyAttribute is not Created. But whenever I want to create the schema an error attribute type is operational. What can I do. I also could not uncomment overlay in slapd. Please help me. -- Shaheen

2 1

rwn rewrite
by Adam Leach 29 Apr '09

29 Apr '09

All, I'm needing to use the rwn overlay to map a DN that uses uid= to a cn= so that when someone searches for cn=jsmith,dc=example,dc=com but the actual DN is uid=jsmith,dc=example,dc=com. Any ideas/suggestions? Thanks -- Adam Leach BS Computer/Electrical Engineering West Virginia University Systems Administrator - Raytheon

1 0

Valgrind reporting an invalid file descriptor
by Matthijs Mohlmann 29 Apr '09

29 Apr '09

Hello all, I'm writing an program with LDAP but probably something goes wrong when I try to shutdown the connection. First I call ldap_initialize, after that I call a bind operation. (Using function ldap_bind_ext) That goes all very well. Then I try to close the connection with ldap_unbind_ext. This goes according to the return value ok, but when running in valgrind I see a Warning: invalid file descriptor -1 in syscall close() ==4733== Warning: invalid file descriptor -1 in syscall close() ==4733== at 0x40007F2: (within /lib/ld-2.9.so) ==4733== by 0x4300BB0: ber_int_sb_close (in /usr/lib/liblber-2.4.so. 2.4.1) ==4733== by 0x43011AB: ber_sockbuf_free (in /usr/lib/liblber-2.4.so. 2.4.1) ==4733== by 0x404AEAE: ldap_ld_free (in /usr/lib/libldap_r-2.4.so. 2.4.1) ==4733== by 0x404AF55: ldap_unbind_ext (in /usr/lib/ libldap_r-2.4.so.2.4.1) ==4733== by 0x804A167: main (ldap.cpp:283) Is this a bug in the LDAP library, or did I forgot a call to something ? According to the documentation (man 3 ldap_unbind_ext) is this the only call I need to do. Can somebody enlighten me here ? Regards, Matthijs Mohlmann

1 0

how implement pwdpolicy
by Rahima Shaheen 28 Apr '09

28 Apr '09

Hi, I am very new to open ldap. I can run slap an add edit new entry. Now I want to implement pwdpolicy. I tried it several times. I like to describe what I said. 1. run slapd without modifying anything. 2. create an ou=policies. Script as following dn: ou=policies,dc=my-domain,dc=com objectClass: organizationalUnit objectClass: top ou: policies 3. write policy.schema. 4. include policy.schema; but overlay is not added. run slapd again. In the core.schema attributetype userpassword was comment out 5. Now I want to create policy.ldif. Script dn: cn=default,ou=policies,dc=my-domain,dc=com cn: default objectClass: pwdPolicy objectClass: person objectClass: top pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 2 pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 5 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 0 pwdMaxAge: 0 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 5 pwdMustChange: FALSE pwdSafeModify: FALSE #sn: 'dummy value' objectClass: organizationalUnit It gives an error "Invalid syntax (21) pwdAttribute: value #0 invalid per syntax. Why it gives such error? My assumption is ppolicy.schema attribute is not created successfully. Another point in core.schema attributeType; userPassword is comment out. If I uncomment it. slapd -d 1 gives an duplicate attribute type. Give a solution please. Now my question is a. how I am sure that my PPolicy.schema is created? I don't have any ppolicy.la b. what does do policy.la.

5 5

syntax of ldap_modify_s
by Adrian St. John-Bee 28 Apr '09

28 Apr '09

Hi, I am attempting to make an ldap_modify_s from an Objective C application running on a mac. When I attempt to make a test modification I get the error EXC_BAD_ACCESS which generally means that a variable has gone out of scope. However, I do not see how any of the variable involved could have fallen out of scope, so I'm not sure my mod syntax is correct... LDAP *ld; ld = ldap_init(host, PORTNUMBER); char *user = NULL; char *pass = NULL; int rc; rc = ldap_simple_bind_s( ld, user, pass ); LDAPMod *modM; char *dn = "uflEduUniversityId=28833300,ou=People,dc=ufl,dc=edu"; char** vals0; modM->mod_op = LDAP_MOD_REPLACE; modM->mod_type = "mail"; vals0[0] = "eric(a)ntu.ac.uk"; modM->mod_values = vals0; int i = ldap_modify_s(ld, dn, modM); Host and port number are defined earlier in the script. I know that I'm trying to do a modification with a null bind, but I would expect to see Invalid Credentials rather than an access error... Does the syntax of this modification look like it 'should' work? Many thanks, Ade -- Ade St John-Bee Year Three Software Engineering BSc N0115889 Mobile: +44 7736 301614

4 4

SASL OTP?
by manu＠netbsd.org 25 Apr '09

25 Apr '09

Hi Anyone had success with SASL OTP? A quick search yields attempts using sasldb or a cmusaslsecretOTP attribute. I tried both but with little success. If the authenticating user is in saslauthdb (inserted with saslpasswd2 -c user), slapd seems to fail finding it. I fo a ldapsearch -Y OTP -U user uid=user On the very first attempt: SASL [conn=40] Failure: no user in db SASL [conn=40] Failure: no user in db SASL [conn=40] Failure: Error putting OTP secret conn=40 op=0 RESULT tag=97 err=80 text=SASL(-1): generic failure: Error putting OTP secret On next attempts, the behavior is different: SASL [conn=33] Failure: no user in db SASL [conn=33] Failure: no user in db (many many more) SASL [conn=33] Failure: simultaneous OTP authentications not permitted conn=33 op=0 RESULT tag=97 err=52 text=SASL(-8): transient failure (e.g., weak key): simultaneous OTP authentications not permitted If I remove it from the database (saslpasswd2 -d user): SASL [conn=34] Failure: no user in db SASL [conn=34] Failure: no user in db SASL [conn=34] Failure: no user in db SASL [conn=34] Failure: no OTP secret in database conn=34 op=0 RESULT tag=97 err=49 text=SASL(-13): user not found: no OTP secret in database The cmusaslsecretOTP attribute does not seems to be used at all. I used a schema from draft-melnikov-sasl-auxprop-attrs-00.txt, is that wrong? attributetype ( 1.3.6.1.4.1.3.8.1.1.3 NAME 'cmusaslsecretOTP' DESC 'OTP secret' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 ) (...) objectclass ( 1.3.6.1.4.1.3.8.1.2.1 NAME 'cmuSaslUser' SUP top AUXILIARY MAY ( userPassword $ cmusaslsecretCRAM-MD5 $ cmusaslsecretDIGEST-MD5 $ cmusaslsecretOTP $ cmusaslsecretSRP) ) -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

1 2

Re: Directory migration
by Michael Ströder 22 Apr '09

22 Apr '09

Ian wrote: > On Wed, 22 Apr 2009 00:13:51 Michael Ströder wrote: >> Is this from your original data? > > Yes, taken from the original server's LDAP database. > >> Do all entries have password values like this? Check that. > > Yes, they do! > >> If yes, then you should not have a problem to migrate this data. > > Yet sadly I do have a problem :-/ > [..] > I have used ldapsearch to confirm that the password hashes are the same on the > old & new servers when I use ldapsearch or slapcat to view them. Yet I can't > login on the new server. Then the issue is something different maybe in your client configuration. If you transfer the userPassword values without altering them they are still the same. If the scheme is not {CRYPT} the platform-specific Unix crypt is *not* relevant. > And since the hashes are salted, I can't tell if the > actual password is really different. {MD5} is not salted. {SMD5} would be salted. This is a hashed MD-5 created by Unix crypt. As you can see this is completely different password format: {CRYPT}$2a$10$FThnBowyNXL.DwnXypAsR..ocCmfkZ023tH0wWNog8qwIz/P.3gwe >> You should also consult the fine articles in the FAQ-O-MATIC: >> >> http://www.openldap.org/faq/data/cache/419.html > > I'll give that a read tonight and do some more testing. Yes, please. After that you understand the differences much better. Ciao, Michael.

1 0

Problems in OpenLDAP 2.4.11
by John Du 21 Apr '09

21 Apr '09

Hi, We have been running OpenLDAP 2.2.13 on RHEL4 for a few years without problems. We recently upgraded OpenLDAP to 2.4.11 to use the multi-master capability. After upgrade, we are having 2 problems with the new version. 1. We have an attribute c in the ou=People sub-tree. The value can be either US or CA. Now if we search "c=US" or "c=CA", we do not get any matches. But if we do "c=U*", it finds all the c=US entries. Same thing happens to c=C*. 2. LAM 2.5.0 (LDAP Account Manager) cannot browse the schema on the new server. It says "Unable to retrieve schema". LAM worked fine with OpenLDAP 2.2.13. I would appreciate any information that would help us resolve the problem. Thanks! John

4 5

Syncrepl behavior when disk is full
by Alan Evans 20 Apr '09

20 Apr '09

I am using openldap-2.4.11 with syncrepl n-way multimaster replication and I am seeing some strange behavior if one of the masters runs out of disk space. I would expect this to be handled much the same way a master being offline would be handled but it behaves different. We are doing some failure testing on our new ldap infrastructure to prevent problems before they happen and to be able to improve our monitoring. On of the test cases I came up with is what happens on a master or slave if the disk the ldap database is stored on becomes full. Now granted we do monitor for this normally but if somehow it was missed or filled up very fast we would like to know now what will happen. So here's the setup: RHEL 5 i386 VMWare Guest openldap-2.4.11 (custom RPM, all backends, all overlays, monitor as module, back ldap as module) BDB backend overlay accesslog overlay ppolicy overlay syncprov overlay unique overlay dynlist overlay refint overlay memberof master1 and master2 replicate to one another with mirror mode slave2 uses master2 as its replica provider (load balancing later) master1 <-- mirror mode on --> master2 --> slave2 (updates chaned to master2) Scenario 1: master2 runs out of disk space, ldap modify request is issued against master2 Result: master2 performs the ldapmodify but master1 and slave2 are not notified Scenario 1a: disk space is freed up on master2 Result: change is not replicated to master1 and slave2 Scenario 1b: disk space is freed up on master2 and master2 is restarted Result: change is still not replicated to master1 and slave2 Scenario 1c: disk space is freed up on master2 and master1 or slave2 restarted Result: change is still not replicated to master1 and slave2 Scenario 2: master2 runs out of disk space, ldap modify request is issued against master1 Result: master1, master2 and slave2 are ALL updated It gets even worse as well. Additional changes against multiple objects on master2 do not get propogated to master1 and slave2. The only thing that seems to bring master2 back into sync is to write a change to any objects modified during the time when the disk was full. Scenario 3: master2 runs out of disk space, ldap modify request is issued against master2 for object1 Result: master2 performs modify but does not replicate it to master1 and slave2 Scenario 3a: disk space is freed on master2, ldap modify request is issued on master2 for object2 Result: object2 is modified but changes are not replicated to master1 and slave2 Scenario 3b: disk space is freed on master2, ldap modify is issued against master1 for object1 Result: master1 performs modify and replicates to master2, master2 replicates to slave2, changes to object1 on master2 are lost Scenario 3c: disk space is freed on master2, ldap modify is issued against master1 for object2 Result: master1 performs modify and replicates to master2, master2 replicates to slave2, changes to object2 on master2 are lost Its as if until a write to object1 which was committed by master2 while out of disk space, is modified on master1 and replicated to master2 that master2 is unable to replicate any changes out that originate on master2. In the case of a slave running out of disk space, if it didn't fall into sync right away the solution would be to blow away the ldap database and let it do a full sync from the masters. But in the case where one of the master servers runs out of disk space, what should be done to bring them back in sync without loosing any changes?

1 0

Syncrepl replication be_modify failed (18)
by Will Nowak 19 Apr '09

19 Apr '09

Howdy, I've been battling some issues with syncrepl for a while now, and I can't quite figure out what has gone wrong. I initially found http://www.openldap.org/lists/openldap-software/200812/msg00040.html which seemed to describe my issue, and it recommended upgrading to openldap 2.4.13. I tried that, and am still having issues (now at 2.4.15). I built the software for ubuntu hardy on i386, available at https://edge.launchpad.net/~compbrain/+archive/ppa/+sourcepub/566951/+listi… The situation involves a master with 3 slaves using syncrepl. A change comes into the master adding a member to a nisNetgroup/groupOfNames hybrid container: dn: cn=friends,ou=netgroup,dc=example,dc=com objectClass: groupOfNames objectClass: nisNetgroup objectClass: top cn: friends member: uid=bobby,ou=people,dc=example,dc=com nisNetgroupTriple: (,bobby,shadow) An incoming add for user james looks like dn: cn=friends,ou=netgroup,dc=example,dc=com changetype: modify delete: member - add: member member: uid=bobby,ou=people,dc=example,dc=com member: uid=james,ou=people,dc=example,dc=com - delete: nisNetgroupTriple - add: nisNetgroupTriple nisNetgroupTriple: (,bobby,shadow) nisNetgroupTriple: (,james,shadow) Up until this point, everything is fine -- all changes made on the master have replicated ok to the slaves. Now, james is not my friend anymore, so he gets removed from the container: dn: cn=friends,ou=netgroup,dc=example,dc=com changetype: modify delete: member - add: member member: uid=bobby,ou=people,dc=example,dc=com - delete: nisNetgroupTriple - add: nisNetgroupTriple nisNetgroupTriple: (,bobby,shadow) At this point, the most recent change gets applied to the master ok, but it does not get replicated to the slaves. They have a be_modify failed in their logs: Apr 13 23:05:43 sl1 slapd[30277]: syncrepl_entry: rid=049 be_search (0) Apr 13 23:05:43 sl1 slapd[30277]: syncrepl_entry: rid=049 cn=friends,ou=netgroup,dc=example,dc=com Apr 13 23:05:43 sl1 slapd[30277]: null_callback : error code 0x12 Apr 13 23:05:43 sl1 slapd[30277]: syncrepl_entry: rid=049 be_modify (18) Apr 13 23:05:43 sl1 slapd[30277]: syncrepl_entry: rid=049 be_modify failed Any thoughts? -Will

3 3

Stuck in ACL
by Wolf-Agathon Schaly 19 Apr '09

19 Apr '09

Fellows I'm trying to grant write access to the subtree using the following access directive access to dn.subtree="cn=OracleContext,ou=services,o=privat,c=de" by dn="cn=myusername,ou=users,o=privat,c=de" write by anonymous read by * auth this rule is working fine but for just one user. If I add another 'by dn' like by dn="cn=yourusername,ou=users,o=privat,c=de" write It is working as well. WhoHoo ! That would be fine if I wouldn't expect a huge number of users. Another unaccepable issue would be that the ldap instance would need a restart. That's why I decided to grant access to the dn.subtree to a group (i.e. dba) and have tried the following directive access to dn.regex="(.*,)cn=OracleContext,ou=services,o=privat,c=de" by group="cn=dba,ou=groups,o=privat,c=de" write by anonymous read But whenever I try as a member of the dba group to write an entry underneath the cn=OracleContext,.... I'm getting the error message Enter LDAP Password: adding new entry "cn=dgdb,cn=OracleContext,ou=services,o=privat,c=de" ldap_add: Insufficient access (50) additional info: no write access to parent :-( Any help is highly appreciated thank you Wolf-Agathon

3 2

ppolicy force account expiration
by Daniel Durgin 16 Apr '09

16 Apr '09

Hello, Does any one know how to force the expiration of an account within the slapo-ppolicy overlay? For instance, says that an employee's last day with the organization ends at 5PM, is there a flag I can set to deactivate an account at that time. I know that I could write a cronjob that would do this. Thanks, Dan

3 3

frequent slapd freeze with openldap 2.4.13
by Guillaume Rousse 16 Apr '09

16 Apr '09

Hello list. Since a recent upgrade 2.4.12 -> 2.4.13, I'm facing recurrent slapd hanging. On client side, ldapsearch requests receive this error: error.c:272: ldap_parse_result: Assertion `r != ((void *)0)' failed I'd expect in this case an automatic switch to slave server, but it doesn't work. Here is my ldap libraries configuration: BASE dc=msr-inria,dc=inria,dc=fr URI ldap://ldap1.msr-inria.inria.fr ldap://ldap2.msr-inria.inria.fr TLS_CACERTDIR /etc/pki/tls/certs TLS_REQCERT demand NETWORK_TIMEOUT 2 TIMEOUT 2 TIMELIMIT 2 On server side, slapd usually shows eating 100, 200 or 300% cpu, which make me think some specific repeated query trigger the issue, making the problem worse when several of them accumulates. strace on running slapd process shows it's waiting on a futex: [root@etoile main]# strace -p 2769 Process 2769 attached - interrupt to quit futex(0xb6bb4bd8, FUTEX_WAIT, 2774, NULL <unfinished ...> And gdb shows it waiting in __kernel_vsyscall (gdb) bt #0 0xffffe410 in __kernel_vsyscall () #1 0xb7d385c6 in pthread_join () from /lib/i686/libpthread.so.0 #2 0xb7f23d3f in ldap_pvt_thread_join () from /usr/lib/libldap_r-2.4.so.2 #3 0x0806e1b4 in slapd_daemon () #4 0x0805a507 in main () In both case, I think the lack of relevant information is caused by the multithreading nature of slapd, I don't know how to access the exact thread where the problem occurs. I already tried to regenerate indexes, without results. I dropped the base, and reconstructed it from latest backup, it made the problem temporarily disapear. I didn't found anything in the logs, even with debug level set to 'trace'. I'm using a bdb backend, with this configuration in slapd.conf: database bdb suffix "dc=msr-inria,dc=inria,dc=fr" rootdn "cn=root,dc=msr-inria,dc=inria,dc=fr" #rootpw root directory /var/lib/ldap/main cachesize 1000 idlcachesize 1000 checkpoint 256 5 And this one in DB_CONFIG: set_cachesize 0 1048576 0 set_lg_bsize 2097152 set_lg_max 10485760 set_flags DB_LOG_AUTOREMOVE The full slapd.conf is accessible at http://pastebin.mandriva.com/5801 db_stat -m output is accessible at http://pastebin.mandriva.com/5799 The main database itself is quite small, the ldiff backup is 1.4 only. I also have a log database for syncrepl purpose. I'm using openldap 2.4.13, with db 4.6.21, on mandriva linux 2008.1, 32 bits system. I'd be happy to provide additional informations if needed. -- Guillaume Rousse Service des Moyens Informatiques INRIA Saclay - Île-de-France Parc Orsay Université, 4 rue J. Monod 91893 Orsay Cedex France Tel: 01 69 35 69 62

5 8

Re: Compile problems with 2.4.16 and Fedora 10
by Quanah Gibson-Mount 15 Apr '09

15 Apr '09

--On Wednesday, April 15, 2009 10:08 AM -0700 Rick Stevens <rps2(a)socal.rr.com> wrote: > Quanah Gibson-Mount wrote: >> --On Wednesday, April 15, 2009 9:53 AM -0700 Rick Stevens >> <rps2(a)socal.rr.com> wrote: >> >>> Quanah Gibson-Mount wrote: >>>> --On Tuesday, April 14, 2009 3:25 PM -0700 Rick Stevens >>>> <rps2(a)socal.rr.com> wrote: >>>> >>>>> Hi, gang. >>>>> >>>>> Having a bit of trouble compiling OpenLDAP 2.4.16 under Fedora 10. >>>>> I've built Berkeley DB 4.7 and installed it. I run configure with: >>>>> >>>>> LDFLAGS="-L/usr/local/BerkeleyDB.4.7/lib" >>>>> CPPFLAGS="-I/usr/local/BerkeleyDB.4.7/include" ./configure >>>>> --enable-modules --enable-backends --enable-overlays=mod >>>>> --enable-sql=no >>>>> >>>>> (all one line). Despite what "./configure --help" says, it still >>>>> tries to include the MySQL NDB stuff by default (and can't find the >>>>> headers even if the mysql-devel RPM is installed, the "NdbApi.hpp" >>>>> file is in /usr/include/mysql/ndb/ndbapi), so I've appended >>>>> "--enable-ndb=no" as well to get past that (don't need MySQL anyway). >>>> >>>>> Hints? Suggestions? >>>> >>>> Back-sql and back-ndb are different backends. You need to add >>>> --disable-ndb to your configure flags. See the output of ./configure >>>> --help. >>> >>> I did, which is why I said '"Despite what ./configure --help" says': >>> >>> --enable-ndb enable MySQL NDB Cluster backend no|yes|mod [no] >>> >>> I read that as saying the default is "--enable-ndb=no". Am I wrong? >> >> No, you're quite correct. I missed that bit further down, so my >> mistake, sorry. ;) > > 'Sok, but that still leaves a question: Help says NDB will NOT be built > by default, yet it is. One must assume the help text needs to be > changed or configure's logic has to be fixed. > > Beyond that, if you do let NDB build on a Fedora 10 machine, the build > bombs when it can't find NdbApi.hpp. That file does exist if the > mysql-devel RPM has been installed. The full path to the file is > "/usr/include/mysql/ndb/ndbapi/NdbApi.hpp". Please keep replies on the list. I suggest filing bugs in the ITS system on these two issues. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

3 2

Any ways to release START_TLS's random file from Ldap API?
by chantra 15 Apr '09

15 Apr '09

Hi there, when using ldap_start_tls_s , /dev/urandom is opened but never seems to be close until the program exist, which causes issues when a program uses pam_ldap in such a way that openvpn does, e.g loop{ new connection; dlopen(pamldap); authenticate user using pam_ldap; // (open /dev/urandom); dlclose(pamldap); // /dev/urandom is still open } Unfortunately, I am not sure if there is a way to close the TLS context from the API, even when unbinding. For instance, when using the code below, stracing the code will show that /dev/urandom is not close even once finished with LDAP. ============ ... ... open("/etc/hosts", O_RDONLY) = 4 close(4) = 0 open("/etc/ld.so.cache", O_RDONLY) = 4 close(4) = 0 open("/lib/tls/i686/cmov/libnss_dns.so.2", O_RDONLY) = 4 close(4) = 0 close(4) = 0 open("/dev/urandom", O_RDONLY) = 4 open(NULL, O_RDONLY) = -1 EFAULT (Bad address) close(3) = 0 =========== the ldap tools (ldapsearch....) do close properly /dev/urandom, but they use tool_destroy()/ldap_pvt_tls_destroy() which has not effect when I attempt to forward declare it and use it. Any hints on how one could close TLS context? Thanks a mil, chantra /* * compile with * gcc -o start_tls start_tls.c -lldap */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <errno.h> #include <ldap.h> #include <unistd.h> void ldap_pvt_tls_destroy( void ); void usage(const char *name){ fprintf(stderr, "USAGE: %s ldap://host\n", name); } int main(int argc, char **argv){ char uri[BUFSIZ]; LDAP *ldp; int rc; int ldap_version = 3; LDAPControl *serverctrls; LDAPControl *clientctrls; if(argc!=2){ usage(argv[0]); exit(1); } strcpy(uri, argv[1]); rc = ldap_initialize(&ldp, uri); if(rc != LDAP_SUCCESS){ fprintf(stderr, "ERROR: ldap_initialize returned (%d) \"%s\" : %s\n", rc, ldap_err2string(rc), strerror(errno)); exit(1); } rc = ldap_set_option(ldp, LDAP_OPT_PROTOCOL_VERSION, &ldap_version); if(rc != LDAP_OPT_SUCCESS){ fprintf(stderr, "ERROR: ldap_set_option returned (%d) \"%s\"\n", rc, ldap_err2string(rc)); exit(1); } rc = ldap_start_tls_s(ldp, &serverctrls, &clientctrls); if(rc != LDAP_SUCCESS){ fprintf(stderr, "ERROR: ldap_start_tls_s returned (%d) \"%s\"\n", rc, ldap_err2string(rc)); exit(1); } fprintf(stdout, "Successfully started ldap_start_tls_s\n"); rc = ldap_unbind_ext_s(ldp, &serverctrls, &clientctrls); /* no effect ldap_pvt_tls_destroy(); */ sleep(100); exit(0); } -- http://www.debuntu.org Debuntu deb's repository !DSPAM:49e6334790401157261143!

1 0

Re: Compile problems with 2.4.16 and Fedora 10
by Quanah Gibson-Mount 15 Apr '09

15 Apr '09

--On Wednesday, April 15, 2009 9:53 AM -0700 Rick Stevens <rps2(a)socal.rr.com> wrote: > Quanah Gibson-Mount wrote: >> --On Tuesday, April 14, 2009 3:25 PM -0700 Rick Stevens >> <rps2(a)socal.rr.com> wrote: >> >>> Hi, gang. >>> >>> Having a bit of trouble compiling OpenLDAP 2.4.16 under Fedora 10. >>> I've built Berkeley DB 4.7 and installed it. I run configure with: >>> >>> LDFLAGS="-L/usr/local/BerkeleyDB.4.7/lib" >>> CPPFLAGS="-I/usr/local/BerkeleyDB.4.7/include" ./configure >>> --enable-modules --enable-backends --enable-overlays=mod --enable-sql=no >>> >>> (all one line). Despite what "./configure --help" says, it still tries >>> to include the MySQL NDB stuff by default (and can't find the headers >>> even if the mysql-devel RPM is installed, the "NdbApi.hpp" file is in >>> /usr/include/mysql/ndb/ndbapi), so I've appended "--enable-ndb=no" as >>> well to get past that (don't need MySQL anyway). >> >>> Hints? Suggestions? >> >> Back-sql and back-ndb are different backends. You need to add >> --disable-ndb to your configure flags. See the output of ./configure >> --help. > > I did, which is why I said '"Despite what ./configure --help" says': > > --enable-ndb enable MySQL NDB Cluster backend no|yes|mod [no] > > I read that as saying the default is "--enable-ndb=no". Am I wrong? No, you're quite correct. I missed that bit further down, so my mistake, sorry. ;) --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Externalize access to a partial replica
by Jehan PROCACCIA 15 Apr '09

15 Apr '09

hello I need to give acces to a partial replica of my ldap directory this replica only contain "white pages" attributes -> no userpassword ! syncrepl rid=001 filter="(|(objectClass=organizationalPerson) attrs="uid,cn,sn,ou,departmentNumber,GivenName I created a bind user in the master ldap to give external access to that replica but as I don't replicate userpassword, then that bind user doesn't have usperpasswd in the replicate and then cannot authenticate on it (egg and chiken pb !) then how can I have that partial replica whitout userpassword attributes, but still allow someone (at least one dn, but not the rootdn in slapd.conf that I want to keep secret) to bind to that replica !? I tested a binddn out of ldap database with SASL (digest-md5), but apparently (ldapsearch -Y) it requires a userpassword attribute for that binddn in the ldap database :-( I though that having a password only in /etc/salsdb2 would be enough ... to bad ;-( I also tested with a translucent in front of my replica, in that translucent I added the userpassword for the binddn so that he can bind , but the search addresed to that translucent that finally goes to my partial replica ends up in an anonymous bind, not as that binddn I expected :-( (so ACL cannot be match ) Please let me know how to let a user+password (binddn having correponding ACL) search my replica on a replica not containing userpassword attributes (or a least one for that binddn) . would it be possible to replicate userpassowrd attribute from the master only for that binddn ? Thanks.

3 2

openldap 2.4.11 slave update chaining
by Alan Evans 15 Apr '09

15 Apr '09

I have read through the docs over and over and I am still not quite able to wrap my head around idassert-bind and chaining. Can someone please help me figure this configuration out. I have a ldap master and ldap slave and I want the slave to chain updates to the master so the clients don't have to worry about following referrals. I am successful in getting the slave to follow the referral and return errors from the master however with various combinations of idassert-bind bindmethod=(none,simple) and mode=(self, legacy) I get errors about insufficent access or needing more rights. 1. Client binds with dn and password to slave 2. Client submits modify request to slave 3. Slave binds to master with binddn (bindmethod=simple) 4. Slave rebinds to master with dn and password provided by the client (mode=self, chain-rebind-as-user TRUE) 5. Slave submits modify to master as client (chain is global) 6. Master checks client's dn for access 7. Master performs update 8. Master returns result to slave 9. Slave returns result to client # ldapsearch cn=replicator authzTo -LLL Enter LDAP Password: dn: cn=replicator,dc=company,dc=com authzTo: dn:* You can see in the case of mode=legacy that I have given my replicator account authzTo # slave slapd.conf # Global Section overlay chain chain-tls start chain-chase-referrals yes chain-return-error true chain-uri "ldap://ldapmaster.company.net/" chain-rebind-as-user TRUE chain-idassert-bind bindmethod="simple" binddn="cn=replicator,dc=company,dc=com" credentials="secret" starttls="yes" tls_reqcert="allow" mode="self" # Database Sections database bdb suffix "dc=company,dc=com" rootdn "cn=manager,dc=company,dc=com" ... removed for brevity ... updateref ldap://ldapmaster.company.net/

2 1

back-sql Varchar2 Primary Key Support
by King, Leon C 15 Apr '09

15 Apr '09

Hi all, Is there a way to wrap oracle functions to where clauses passed into back-sql? I have a non-numeric primary key value of my users' table which in some cases is preceeded by a '0'. None of the data mapped via the ldap_entries.keyval and my table are being retrieve when I execute an ldap search. If I remove the preceeding '0' the values are retrieved. Thanks, Leon King

2 1

Compile problems with 2.4.16 and Fedora 10
by Rick Stevens 14 Apr '09

14 Apr '09

Hi, gang. Having a bit of trouble compiling OpenLDAP 2.4.16 under Fedora 10. I've built Berkeley DB 4.7 and installed it. I run configure with: LDFLAGS="-L/usr/local/BerkeleyDB.4.7/lib" CPPFLAGS="-I/usr/local/BerkeleyDB.4.7/include" ./configure --enable-modules --enable-backends --enable-overlays=mod --enable-sql=no (all one line). Despite what "./configure --help" says, it still tries to include the MySQL NDB stuff by default (and can't find the headers even if the mysql-devel RPM is installed, the "NdbApi.hpp" file is in /usr/include/mysql/ndb/ndbapi), so I've appended "--enable-ndb=no" as well to get past that (don't need MySQL anyway). Beyond that, compilation bombs when it hits libraries/liblutil/lutil_getpeerid.c: getpeereid.c: In function ‘lutil_getpeereid’: getpeereid.c:65: error: storage size of ‘peercred’ isn’t known "struct ucred" is defined in <asm/socket.h> and the compile doesn't seem to be picking that up. Never had this issue with 2.4.10 or 2.4.11. Hints? Suggestions? ---------------------------------------------------------------------- - Rick Stevens, Unix Geek rps2(a)socal.rr.com - - - - Polygon: A dead parrot (With apologies to John Cleese) - ----------------------------------------------------------------------

4 4

locking issue (again)
by Guillaume Rousse 14 Apr '09

14 Apr '09

Hello. I'm facing heavy ldap locking again, even after upgrading bdb 4.6 to latest patch level (4.6.21.3). When the problem occurs, any ldap query fails with this result: [root@etoile main]# ldapsearch -x ldapsearch: error.c:272: ldap_parse_result: Assertion `r != ((void *)0)' failed. Abandon gdb shows 18 active thread, apparently waiting a lock release (see bt and bt full output attached). I'm also joing output of db_stat -m and -c output. The only suspect trace I found in the log was some strange queries from an apparently wrongly host, such as: Apr 14 06:57:09 etoile slapd[24528]: conn=61313 op=2 SRCH base="dc=msr-inria,dc=inria,dc=fr" scope=2 deref=0 filter="(&(objectClass=posixAccount)(objectClass=posixAccount)(uid=<!--))" But I suffered from this kind of lockup before it was installed. I wonder however of the potential impact of such kind of queries, using exotic characters. I'm using openldap 2.4.15 on linux 32 bits. Beyond the problematic lockup, why does the client abort, instead of trying the slave server when the first one fails ? Here is my ldap.conf configuration file. BASE dc=msr-inria,dc=inria,dc=fr URI ldap://ldap1.msr-inria.inria.fr ldap://ldap2.msr-inria.inria.fr TLS_CACERTDIR /etc/pki/tls/certs TLS_REQCERT demand NETWORK_TIMEOUT 2 TIMEOUT 2 TIMELIMIT 2 -- Guillaume Rousse Service des Moyens Informatiques INRIA Saclay - Île-de-France Parc Orsay Université, 4 rue J. Monod 91893 Orsay Cedex France Tel: 01 69 35 69 62

2 2

ACL problem
by Guillaume CHARDIN 14 Apr '09

14 Apr '09

Hi, i'm a begginer with openldap and I would like some help about configuring a test directory (for now). I tought I set up correctly the base of the directory, but I encounter some issues with ACL to delegate rw access to some users/OU/groups. While I can do anything on the directory with the 'rootdn', I wasnt able to give rw access to another user (admintest) on the directory. To achieve this tasks I use several tools : phpldapadmin, ldapadd, ldapdelete. And everytime these tools return error about the rights of the user I bind to de Directory. here is an example : ]#ldapdelete -x -D 'uid=admintest,dc=brcorp,dc=local' -W ou=test,dc=brcorp,dc=local Enter LDAP Password: ldap_delete: Insufficient access (50) additional info: no write access to parent If i do the same with the rootdn user everything goes fine. I use a static configuration on the server side so i have to start/restart ldap to have new acl applied. Below are my access rules written in my sldap.conf file #in the global config : access to * by * read #in the "database" config : access to dn.subtree="dc=brcorp,dc=local" by dn.one="uid=admintest,dc=brcorp,dc=local" write by self write access to * by dn.exact="cn=Manager,dc=brcorp,dc=local" read by * none I read on the admin documentation the global directive are applied after the "database" access directives were read. So the 'access to * by * read' is applied after 'access to dn.subtree="dc=brcorp,dc=local" by dn.one="uid=admintest,dc=brcorp,dc=local" write' wich is the important line for my user. whats wrong with my configuration ? Someone can tell me ? Thanks for your help. -- Guillaume

3 3

log level to see details of MOD operations
by Scott Koranda 13 Apr '09

13 Apr '09

I am running OpenLDAP version 2.3.27 as distributed with CentOS 5.2. I want to set 'loglevel' in slapd.conf so that I will be able to see the details of what a client is sending to slapd when it modifies entries for a dn. Specifically I would like to see which attributes the client is requesting to modify for the dn and the values it is sending for those attributes. What value for 'loglevel' results in the least verbose logging but would still show me that information? Sincerely, Scott

3 5

OpenLDAP Password Encryption
by Myles Merrell 10 Apr '09

10 Apr '09

I'm working on our LDAP server, we want to be sure to encrypt the password. We also want to be able to decrypt the passwords if a user loses their passwords, and we need to send it to them. I've done a lot of research on encrypting the passwords, but none of the methods I have seen allow you to easily decrypt the password using a private key or something like that. Is this possible, if so how? thanks. myles.

3 2

openldap getting very slow
by Thomas van Oudenhove 09 Apr '09

09 Apr '09

hello, I have some problems with my ldap server. it worked perfectly until monday, march 30 : on every night, I used to extract all entries from the server, making a diff with some ldif file(s) and ldapmodify with the "diff ldif file". there was about 15,000 to 40,000 entries modified each night, and ldapmodify was running about 20 to 40 minutes (~1,000 entries per minute). on last monday, the extraction of ldap had some trouble, the extraction request never ended, and that made the server inaccessible; we had to restart it. since march 30, the update process (ldapmodify) is incredibly slow, it takes about several hours (~60 entries per minute), but the extraction request is "normal" again (about 2 seconds). we tried to restart from scratch (delete db, re-install openldap (and update) and start the process again, it is still slower than before (~400 entries per minute). we cannot figure out why it became so slow, so we are interested in any advice... we had openldap 2.3.27-8.el5_2.4 installed and tried with the update: openldap 2.3.43-3.el5 (both CentOS packages). log of the failed request: Mar 30 01:10:01 ldap slapd[27383]: conn=1772 fd=16 ACCEPT from IP=xxx.xxx.xxx.xxx:38263 (IP=0.0.0.0:389) Mar 30 01:10:01 ldap slapd[27383]: conn=1772 op=0 BIND dn="cn=Manager,dc=fr" method=128 Mar 30 01:10:01 ldap slapd[27383]: conn=1772 op=0 BIND dn="cn=Manager,dc=fr" mech=SIMPLE ssf=0 Mar 30 01:10:01 ldap slapd[27383]: conn=1772 op=0 RESULT tag=97 err=0 text= Mar 30 01:10:01 ldap slapd[27383]: conn=1772 op=1 SRCH base="dc=fr" scope=2 deref=0 filter="(objectClass=*)" [and no more traces until openldap restart about noon] log of a "normal" request: Mar 16 01:10:01 ldap slapd[23294]: conn=11 fd=15 ACCEPT from IP=xxx.xxx.xxx.xxx:53535 (IP=0.0.0.0:389) Mar 16 01:10:01 ldap slapd[23294]: conn=11 op=0 BIND dn="cn=Manager,dc=fr" method=128 Mar 16 01:10:01 ldap slapd[23294]: conn=11 op=0 BIND dn="cn=Manager,dc=fr" mech=SIMPLE ssf=0 Mar 16 01:10:01 ldap slapd[23294]: conn=11 op=0 RESULT tag=97 err=0 text= Mar 16 01:10:01 ldap slapd[23294]: conn=11 op=1 SRCH base="dc=fr" scope=2 deref=0 filter="(objectClass=*)" Mar 16 01:10:03 ldap slapd[23294]: conn=11 op=1 SEARCH RESULT tag=101 err=0 nentries=39741 text= Mar 16 01:10:03 ldap slapd[23294]: conn=11 op=2 UNBIND Mar 16 01:10:03 ldap slapd[23294]: conn=11 fd=15 closed thanks for any help, regards, -- Thomas van Oudenhove - Université de Toulouse tél: (+33) 5 61 36 60 45 jabberID: thomasvo(a)im.apinc.org

5 9

slapd-ldap and authentication
by Daniel Tiefnig 07 Apr '09

07 Apr '09

Hej, It's been a long time since I used OpenLDAP and read the lists, (like 7 years ago) so first: hello again! :-) I'm using "OpenLDAP: slapd 2.3.30" from debian/etch, trying to access two database shadows via a slapd-ldap proxy. The shadow contains these two databases holding NSS and addressbook entries: (passwords changed) ####################################################################### # The NSS databases contains NSS accounts and groups. database bdb suffix "dc=nss,dc=sipwise,dc=com" directory "/var/lib/ldap/nss" lastmod on rootdn "cn=root,dc=nss,dc=sipwise,dc=com" rootpw s1kkr1t dbconfig set_cachesize 0 20971520 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass,cn,uid,uidNumber,gidNumber eq syncrepl rid=002 provider=ldap://db1 bindmethod=simple binddn="cn=root,dc=nss,dc=sipwise,dc=com" credentials=s1kkr1t searchbase="dc=nss,dc=sipwise,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" ####################################################################### # The addressbook database contains contacts for e-mail and phone. database bdb suffix "dc=addressbook,dc=sipwise,dc=com" directory "/var/lib/ldap/addressbook" lastmod on rootdn "cn=root,dc=addressbook,dc=sipwise,dc=com" rootpw s1kkr1t dbconfig set_cachesize 0 20971520 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass,entryUUID eq index cn,sn,mail,givenName sub syncrepl rid=003 provider=ldap://db1 bindmethod=simple binddn="cn=root,dc=addressbook,dc=sipwise,dc=com" credentials=s1kkr1t searchbase="dc=addressbook,dc=sipwise,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" The simple ACL configuration is: ####################################################################### access to attrs=userPassword dn.subtree="ou=people,dc=nss,dc=sipwise,dc=com" by anonymous auth by * none access to dn.subtree="dc=nss,dc=sipwise,dc=com" by users read by * none access to dn.subtree="dc=addressbook,dc=sipwise,dc=com" by users write by * none Trying to access the two databases using ldapsearch (directly towards the shadow, not the local slapd) on the proxy machine works just fine. The slapd.conf on the proxy contains two "ldap" databases which forward requests to the shadow databases: ####################################################################### # The nss database contains NSS accounts. database ldap suffix "dc=nss,dc=sipwise,dc=com" uri "ldap://db/" ####################################################################### # The addressbook database contains contacts for e-mail and phone. database ldap suffix "dc=addressbook,dc=sipwise,dc=com" uri "ldap://db/" Now, trying to access the nss database using ldapsearch towards the proxy from a client works fine too, but I can't get any entries from the addressbook. Commandlines are: ldapsearch -x -D uid=dtiefnig,ou=people,dc=nss,dc=sipwise,dc=com \ -W -b dc=nss,dc=sipwise,dc=com cn=\* ldapsearch -x -D uid=dtiefnig,ou=people,dc=nss,dc=sipwise,dc=com \ -W -b dc=addressbook,dc=sipwise,dc=com cn=\* When running slapd with "-d 128" on the shadow, after the authentication stuff, I can see the following for the nss database: => acl_mask: access to entry "dc=nss,dc=sipwise,dc=com", attr "cn" \ requested => acl_mask: to all values by \ "uid=dtiefnig,ou=people,dc=nss,dc=sipwise,dc=com", (=0) And for the addressbook database I get: => acl_mask: access to entry "dc=addressbook,dc=sipwise,dc=com", \ attr "cn" requested => acl_mask: to all values by "", (=0) I.e. it looks like access to the addressbook database is done anonymously, even though authentication is performed right before. When doing the ldapsearches directly to the shadow, this does not happen. Am I missing something in the proxy configuration? Why does searching the nss database work? Because my bind user is within the same database? Sounds a little bit weird to me. Thanks a lot and best regards, daniel

2 2

make error
by McGranahan, Jamen 06 Apr '09

06 Apr '09

I'm trying to install OpenLDAP v. 2.4.11 on my Sun Solaris 10 box (SunOS libdig4 5.10 Generic_120011-14 sun4u sparc SUNW,Sun-Fire-V440) and I've done the following: ./configure --disable-slapd (status = seemed to complete successfully) make depend (status = seemed to complete successfully) make -> this terminates with the following: Entering subdirectory libldap make[2]: Entering directory `/home/jamen/openldap-2.4.11/libraries/libldap' /bin/sh ../..//libtool --mode=compile cc -g -I../../include -I../../include -I/usr/local/BerkeleyDB.4.2/include -DLDAP_LIBRARY -c tls.c cc -g -I../../include -I../../include -I/usr/local/BerkeleyDB.4.2/include -DLDAP_LIBRARY -c tls.c -KPIC -DPIC -o .libs/tls.o "tls.c", line 102: syntax error before or at: gnutls_kx_algorithm_t "tls.c", line 112: syntax error before or at: typedef "tls.c", line 114: syntax error before or at: gnutls_certificate_credentials_t "tls.c", line 127: syntax error before or at: typedef "tls.c", line 128: syntax error before or at: tls_ctx "tls.c", line 189: member cannot be function: ldap_pvt_tls_ctx_free "tls.c", line 189: warning: syntax requires ";" after last struct/union member "tls.c", line 189: syntax error before or at: { "tls.c", line 191: syntax error before or at: tls_ctx "tls.c", line 211: member cannot be function: tls_ctx_new "tls.c", line 211: warning: syntax requires ";" after last struct/union member "tls.c", line 211: syntax error before or at: { "tls.c", line 230: syntax error before or at: * "tls.c", line 231: member cannot be function: tls_ctx_ref "tls.c", line 231: warning: syntax requires ";" after last struct/union member "tls.c", line 242: warning: syntax requires ";" after last struct/union member "tls.c", line 262: warning: syntax requires ";" after last struct/union member "tls.c", line 275: syntax error before or at: * "tls.c", line 276: member cannot be function: tls_session_free "tls.c", line 276: warning: syntax requires ";" after last struct/union member "tls.c", line 285: syntax error before or at: * "tls.c", line 285: warning: undefined or missing type for: char "tls.c", line 286: member cannot be function: tls_parse_ciphers "tls.c", line 286: warning: syntax requires ";" after last struct/union member "tls.c", line 289: warning: syntax requires ";" after last struct/union member "tls.c", line 289: syntax error before or at: = "tls.c", line 292: syntax error before or at: num "tls.c", line 314: warning: syntax requires ";" after last struct/union member "tls.c", line 350: zero-sized struct/union "tls.c", line 352: warning: old-style declaration or incorrect type for: ptr "tls.c", line 352: warning: old-style declaration or incorrect type for: len "tls.c", line 352: warning: syntax error: empty declaration "tls.c", line 353: warning: old-style declaration or incorrect type for: end "tls.c", line 354: undefined symbol: nkx "tls.c", line 354: can not declare variably modified type at file scope "tls.c", line 354: warning: old-style declaration or incorrect type for: kx "tls.c", line 354: warning: {}-enclosed initializer required "tls.c", line 354: too many array initializers "tls.c", line 354: warning: variable length array can not be initialized: kx "tls.c", line 355: undefined symbol: ncipher "tls.c", line 355: can not declare variably modified type at file scope "tls.c", line 355: warning: old-style declaration or incorrect type for: cipher "tls.c", line 355: warning: {}-enclosed initializer required "tls.c", line 355: too many array initializers "tls.c", line 355: warning: variable length array can not be initialized: cipher "tls.c", line 356: undefined symbol: nmac "tls.c", line 356: can not declare variably modified type at file scope "tls.c", line 356: warning: old-style declaration or incorrect type for: mac "tls.c", line 356: warning: {}-enclosed initializer required "tls.c", line 356: too many array initializers "tls.c", line 356: warning: variable length array can not be initialized: mac "tls.c", line 357: warning: old-style declaration or incorrect type for: ctx "tls.c", line 357: syntax error before or at: -> "tls.c", line 357: warning: old-style declaration or incorrect type for: kx_list "tls.c", line 357: warning: improper pointer/integer combination: op "=" "tls.c", line 358: warning: old-style declaration or incorrect type for: ctx "tls.c", line 358: syntax error before or at: -> "tls.c", line 358: warning: old-style declaration or incorrect type for: cipher_list "tls.c", line 358: warning: improper pointer/integer combination: op "=" "tls.c", line 359: warning: old-style declaration or incorrect type for: ctx "tls.c", line 359: syntax error before or at: -> "tls.c", line 359: warning: old-style declaration or incorrect type for: mac_list "tls.c", line 359: warning: improper pointer/integer combination: op "=" "tls.c", line 360: syntax error before or at: return "tls.c", line 360: warning: syntax error: empty declaration "tls.c", line 532: cannot recover from previous errors cc: acomp failed for tls.c make[2]: *** [tls.lo] Error 1 make[2]: Leaving directory `/home/jamen/openldap-2.4.11/libraries/libldap' make[1]: *** [all-common] Error 1 make[1]: Leaving directory `/home/jamen/openldap-2.4.11/libraries' make: *** [all-common] Error 1 Now I am logged in as root and have the following environment variables set: LDFLAGS=-L/usr/local/lib -L/usr/local/BerkeleyDB.4.2/lib -R/usr/local/Berkeley.4.2/lib CPPFLAGS=-I/usr/local/BerkeleyDB.4.2/include LD_LIBRARY_PATH=/usr/local/BerkeleyDB.4.2/lib Can someone guide me as to what I am missing? I'm sure it's pretty obvious, but I've not been able to figure it out. Please, any help you can provide will be greatly appreciated. Thank you! ********************************* * Jamen McGranahan * Systems Services Librarian * Library Information Technology Services * Vanderbilt University * Suite 700 * 110 21st Avenue South * Nashville, TN 37240 * (615) 343-1614 * (615) 343-8834 (fax) * jamen.mcgranahan(a)vanderbilt.edu ***********************************

3 4

RE: make error
by Quanah Gibson-Mount 06 Apr '09

06 Apr '09

--On Monday, April 06, 2009 11:05 AM -0500 "McGranahan, Jamen" <jamen.mcgranahan(a)Vanderbilt.Edu> wrote: > We're using openssl 0.9.8k Please don't email me off the list. The errors you've submitted indicate that OpenSSL was not detected, so I'd guess that you didn't correctly point it at the location where you installed OpenSSL. Make sure your LDFLAGS and CPPFLAGS settings correctly direct OpenLDAP to find your installed version of OpenSSL. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Does ldap_parse_sasl_bind_result work with ldap_sasl_bind(LDAP_SASL_SIMPLE)?
by Lawrence Chan 03 Apr '09

03 Apr '09

Hi, I'm an openldap beginner and I've been experimenting with some simple openldap examples. Essentially, I had some sample code that tried to initiate an asynchronous bind to a slapd. My program made calls to the library using the following functions in this order. ldap_initialize(...); ldap_sasl_bind(..., LDAP_SASL_SIMPLE, ...); ldap_result(...); // check ldap_result return code == -1 and result pointer != NULL ldap_parse_sasl_bind_result(...); // check ldap_parse_sasl_bind_result return code ldap_unbind_ext(...); The code appears to work with a correct DN and password. But strangely enough I didn't get any errors either when I supplied an incorrect password. When I inspect the packet traffic between the client and the slapd, the slapd responds as expected to the two binds (invalid credentials -> incorrect password) and (success -> correct password). I spent hours debugging to no avail and then finally decided to try out ldapwhoami which catches the invalid credentials... Looking at the source code for ldapwhoami revealed that ldapwhoami uses ldap_parse_result when binding with ldap_sasl_bind(LDAP_SASL_SIMPLE). This practice wasn't immediately obvious to me. My questions: 1. Does ldap_parse_sasl_bind_result work for processing responses to ldap_sasl_bind(LDAP_SASL_SIMPLE)? 2. If the answer to (1.) is in fact no, wouldn't it be more intuitive to get ldap_parse_sasl_bind_result to also handle the LDAP_SASL_SIMPLE case? 3. Is there a simple way to determine whether or not a response received in ldap_result is a bind response to LDAP_SASL_SIMPLE or do I have to store my bind request type and correlate this using the message id when the response returns? Thanks, Lawrence _________________________________________________________________ Reinvent how you stay in touch with the new Windows Live Messenger. http://go.microsoft.com/?linkid=9650731

1 0

ldapsearch lower than timestamp
by Thorsten Kohlhepp 02 Apr '09

02 Apr '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, my LDAP server doesn't respond the entries when I'm trying to do a ldapsearch like this ldapsearch -x -D cn=Admin,o=netmldap -W -h ldap-dm "(netmzMRDBPortingDate<=20090310000000Z)" But it does respond the entries when I'm doing the LDAP search in reverse order ldapsearch -x -D cn=Admin,o=netmldap -W -h ldap-dm "(netmzMRDBPortingDate>=20090301000000Z)" the schema to netmzMRDBPortingDate is this: attributetype ( 1.3.6.1.4.1.13255.1.2.1.2 NAME 'netmzMRDBPortingDate' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE ) I've set an index on that attribute in slapd.conf as well. And I also ran several times a slapindex but it doesn't help. Does anybody know how to check if the indexing of this attribute worked and why it isn't responding the entries? Thanks for your help Ciao Thorsten - -- Systemadministrator First Telecom GmbH Lyoner Straße 15 60528 Frankfurt am Main Tel: +49 (0) 69 65006 577 Mob: +49 (0) 172 5397 083 thorsten.kohlhepp(a)first-telecom.de www.first-telecom.de Sitz der Gesellschaft: Frankfurt am Main Handelsregister: Amtsgericht Frankfurt am Main, HRB 56145 Geschäftsführer: Dieter Plassmann Diese E-Mail einschließlich ihrer Anhänge ist vertraulich. Wir bitten eine fehlgeleitete E-Mail unverzüglich vollständig zu löschen und uns eine Nachricht zukommen zu lassen. Wir haben die E-Mail vor dem Versenden auf Virenfreiheit geprüft. Eine Haftung für Virenfreiheit schließen wir aus. This email including its attachments are confidential. If you are not the intended recipient of this email, please delete it immediately and inform us accordingly. This email was checked for viruses when sent, however, we are not liable for any virus contamination. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAknUctoACgkQd7jm+sUEqbWcLACfcBv2dQx8MGPOxY1X5ZYiZPDH bysAnRQU2qWOiqxsgZQfIFAYeTyd4Gst =jEYR -----END PGP SIGNATURE-----

1 0

slapd syncrepl failure in OpenLDAP 2.3.43
by Magne Land 01 Apr '09

01 Apr '09

Hi, I am using OpenLDAP 2.3.43 with BDB 4.5.20. I wonder if anyone has seen this error before? It happened 37 times during a timespan of 6 hours or so (with the same missing key/data pair). The replica 001 would not replicate during this time. The "solution" was to shut it down and copy data over from another replica. Excerpt from syslog: Mar 27 08:42:57 accdir2 slapd[3810]: => bdb_idl_insert_key: c_get next_dup failed: DB_NOTFOUND: No matching key/data pair found (-30989) Mar 27 08:42:57 accdir2 slapd[3810]: null_callback: error code 0x50 Mar 27 08:42:57 accdir2 slapd[3810]: conn=79260530 fd=39 ACCEPT from IP=10.21.10.23:50796 (IP=0.0.0.0:389) Mar 27 08:42:57 accdir2 slapd[3810]: syncrepl_entry: rid 001 be_add failed (80) Mar 27 08:42:57 accdir2 slapd[3810]: do_syncrepl: rid 001 retrying I'm pretty sure that the first line is generated in OpenLDAP-2.3.43/servers/slapd/back-bdb/idl.c but the code is too tense for me to understand (or vice versa). Regards, Magne Land

1 0

Setup access rights via cn=config - segmentatin fault
by Michal Rejda 01 Apr '09

01 Apr '09

Hi, Im trying to setup access rights using cn=config. When I setup the rights and then try to connect to the server as non-rootdn user, the server often ends with segmentation fault. When I perform this as rootdn user, the server run correctly. When I setup the rights and the server didnt crash, the new rights arent used. If I restart the server, the rights are correct. Im using OpenLDAP version 2.4.11. I thing this behavior is a bug. Regards, Michal Last few lines from console, where the server was running: >>> slap_listener(ldap:///) connection_get(18): got connid=7 connection_read(18): checking for input on id=7 ber_get_next ldap_read: want=8, got=8 0000: 30 36 02 01 01 60 31 02 06...`1. ldap_read: want=48, got=48 0000: 01 03 04 25 63 6e 3d 6d 72 65 6a 64 61 2c 64 63 ...%cn=mrejda,dc 0010: 3d 6d 61 6a 2d 75 6b 2c 64 63 3d 6b 65 72 69 6f =maj-uk,dc=kerio 0020: 2c 64 63 3d 6c 6f 63 61 6c 80 05 68 65 73 6c 6f ,dc=local..heslo ber_get_next: tag 0x30 len 54 contents: ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=7 op=0 do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: >>> dnPrettyNormal: <cn=mrejda,dc=maj-uk,dc=kerio,dc=local> <<< dnPrettyNormal: <cn=mrejda,dc=maj-uk,dc=kerio,dc=local>, <cn=mrejda,dc=maj-uk,dc=kerio,dc=local> do_bind: version=3 dn="cn=mrejda,dc=maj-uk,dc=kerio,dc=local" method=128 bdb_dn2entry("cn=mrejda,dc=maj-uk,dc=kerio,dc=local") Segmentation fault __________ Informace od ESET NOD32 Antivirus, verze databaze 3979 (20090331) __________ Tuto zpravu proveril ESET NOD32 Antivirus. http://www.eset.cz

2 1

RE: can't delete bdb backend from cn=config
by Michal Rejda 31 Mar '09

31 Mar '09

> Am Montag 30 März 2009 09:41:30 schrieb Michal Rejda: > > > Am Freitag 27 März 2009 08:51:57 schrieb Michal Rejda: > > > > Hello, > > > > > > > > Im trying to delete olcDatabase={1}bdb,cn=config using > ldapmodify: > > > > > > > > dn: olcDatabase={1}bdb,cn=config > > > > changetype: delete > > > > > > > > But the server answer is: > > > > > > > > deleting entry "olcDatabase={1}bdb,cn=config" > > > > ldap_delete: Server is unwilling to perform (53) > > > > > > > > I'm performing this operation as rootdn why can I not delete the > entry? > > > > > > back-config does not support the deletion of complete database, > overlay > > > or schema entries by default. There is however experimental delete > > > support for databases and overlays. You can enable that by building > with > > > -DSLAP_CONFIG_DELETE. > > > > I'm able to delete the overlay now. But I cannot delete the database. > What > > I'm doing wrong? > The code for deleting databases is only available in HEAD currently it > seems. > If you really need that feature you might want to try backporting it. > IIRC it > is mostly in the config_back_delete() function in > servers/slapd/bconfig.c. But > this is experimental code, so you have been warned ;). Thank you Ralf, I will try it :) Michal

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software April 2009