May 2009 - openldap-software

by ben thielsen

hi- i'm using the dynlist overlay and am not getting back the search results i expected. i'm using 2.4.11 courtesy of debian. here is my overlay config: >ldapsearch -xWLLLD 'cn=admin,cn=config' -b 'cn=config' "(objectclass=olcdynamiclist)" dn: olcOverlay={5}dynlist,olcDatabase={2}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcDynamicList olcOverlay: {5}dynlist olcDLattrSet: {0}groupOfNames memberURL member olcDLattrSet: {1}mailGroup labeledURI here is the entry in question: >ldapsearch -xWLLLD 'cn=admin,dc=groundnoise,dc=net' -s base -b 'cn=abuse,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail,dc=groundnoise,dc=net' dn: cn=abuse,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail,dc=groun dnoise,dc=net objectClass: mailGroup objectClass: top objectClass: extensibleObject cn: abuse member: cn=postmaster,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail ,dc=groundnoise,dc=net labeledURI: ldap:///ou=domains,ou=mail,dc=groundnoise,dc=net?host?sub?(objectC lass=mailDomain) host: phone.dipswitch.net host: luna.mpls.mn.us host: groundnoise.net host: thielsen.org host: sjva1991.org host: dipswitch.net host: bitrate.net searched for another way: >ldapsearch -xWLLLD 'cn=admin,dc=groundnoise,dc=net' '(&(objectclass=mailgroup)(cn=abuse))' host dn: cn=abuse,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail,dc=groun dnoise,dc=net host: phone.dipswitch.net host: luna.mpls.mn.us host: groundnoise.net host: thielsen.org host: sjva1991.org host: dipswitch.net host: bitrate.net however, the results from this search are missing that entry: >ldapsearch -xWLLLD 'cn=admin,dc=groundnoise,dc=net' '(host=dipswitch.net)' dn dn: host=dipswitch.net,ou=domains,ou=mail,dc=groundnoise,dc=net or another search: ldapsearch -xvWD 'cn=admin,dc=groundnoise,dc=net' '(&(objectclass=mailgroup)(host=*))' host ldap_initialize( <DEFAULT> ) Enter LDAP Password: filter: (&(objectclass=mailgroup)(host=*)) requesting: host # extended LDIF # # LDAPv3 # base <dc=groundnoise, dc=net> (default) with scope subtree # filter: (&(objectclass=mailgroup)(host=*)) # requesting: host # # search result search: 2 result: 0 Success # numResponses: 1 if i remove the labeledURI attribute and populate with static entries, things appear to work as expected: here's the entry: >ldapsearch -xWLLLD 'cn=admin,dc=groundnoise,dc=net' '(&(objectclass=mailgroup)(cn=abuse))' dn: cn=abuse,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail,dc=groun dnoise,dc=net objectClass: mailGroup objectClass: top objectClass: extensibleObject cn: abuse member: cn=postmaster,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail ,dc=groundnoise,dc=net host: foo host: bar host: com host: net host: org and a search: >ldapsearch -xWLLLD 'cn=admin,dc=groundnoise,dc=net' '(host=foo)' dn dn: cn=abuse,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail,dc=groun dnoise,dc=net what am i doing wrong? thanks -ben

13 years, 7 months

3
3
0 / 0

Re: solaris compile options

by Brett ＠Google

i am using CFLAGS="-fast -xtarget=ultraT1 -xarch=sparcvis2 -xcode=pic32 -g -xs -O" one set of solaris docs i read implied that -xarch=sparcvis2 was equivalent to -xarch=v9 (which used to trigger 64 bit), but looking at the sun studio 12 compiler options, the more specific versions of -xarch (ie. other than -xarch=v9 or v9a or v9b) may no longer imply that the 64 bit memory model should be used. so maybe i need to add a -m64 to the above ? (compiling on a Sun T2000, with a homegenous build / execute environment, so favouring speed over cpu compatibility is ok) On Thu, Mar 12, 2009 at 1:31 AM, Aaron Richton <richton(a)nbcs.rutgers.edu>wrote: > On Wed, 11 Mar 2009, Brett @Google wrote: > > /data/openldap/backups/ldap_090302.ldif: Value too large for defined data >> type >> > > man lfcompile, and/or switch to 64-bit binaries? >

13 years, 7 months

2
3
0 / 0

password policy - alternate lockout mechanism

by Aravind Gottipati

Hi, The current password policy module can lock folks out after some configurable number of failed attempts. The module currently does not differentiate between a user failing with the same wrong password a bunch of times versus a crack attempt where someone tries multiple different wrong passwords. Are there any modules that take into account if the same password is being used a bunch of times or if multiple different passwords are failing? Could this be a useful feature worth requesting (if it doesn't exist already)? Thank you, Aravind.

14 years, 2 months

6
24
0 / 0

Supported RFC's and "features"

by Clowser, Jeff (Contractor)

I'm currently doing a review to see how OpenLDAP compares, *feature wise* ATM, to other directory servers and specifically to the Sun DS - i.e. to get a definitive list of features it's missing that Sun has and what it has that Sun doesn't have, etc. For brevity, I haven't included all the potentially useful features of OpenLDAP, but have just focused on those associated with 1) RFC compliance (of which Sun may or may not meet) and 2) features to match the Sun DS (which it would be replacing). So far, here's what I have for OpenLDAP: RFC 4510 (which includes 4511-4519). There was recent discussion on the list around this, such that in some cases, not everything that changed from 3377 (which includes 2251-2256, 2829, and 2830) to 4510 has been updated in OpenLDAP, but I think those issues are fairly minor. The following additional RFC's are supported in OpenLDAP: - RFC 2247 and RFC 3088 - RFC 2696 simple paged results - RFC 2849 ldif - RFC 3062 password mod op - RFC 3296 named referals, manageDSAit - RFC 3673 All Op attrs + feature - RFC 3687 Component matching rules - RFC 3866 Languange tag and range - RFC 3876 matched values control - RFC 4370 proxy auth - RFC 4522 binary encoding - RFC 4523 x.509 cert schema - RFC 4524 COSINE schema - RFC 4525 Mod-increment - RFC 4526 Absolute true/false filters - RFC 4527 pre/post read control - RFC 4528 assertion control - RFC 4529 request attrs by objectclass - RFC 4530 entryUUID - RFC 4532 whoamI - RFC 4533 Content Sync op (replication) RFC's NOT supported are: - RFC 2589 dds Seems with 2.4, this has gone from experimental to production quality? - RFC 2891 server side sorting - RFC 3671 collective attributes - RFC 3928 LCUP mainly for updating cached addressbooks, etc - not replication between servers - RFC 3384 looks like just reqs for replication, not an actual replication protocol - RFC 4533 is used instead Unknown: - RFC 3672 (subentries) - RFC 3698 and 3727 (additional matching rules) - RFC 3909 LDAP Cancel operation - RFC 5020 entryDN operational attribute (There are some other, often obscure, LDAP related RFC's that I didn't include, but this seems to be the major/useful ones) Other features not supported: - VLV browse indexes (per http://tools.ietf.org/html/draft-ietf-ldapext-ldapv3-vlv-09). Not an RFC, but supported by Sun and MS directories, and used by things like Outlook and Solaris. Other supported features: - dyngroup/dynlist/memberof overlay (A much more useful feature than Sun's groupOfURLs "dynamic" group and "roles" mechanism) - ppolicy overlay (matches Sun DS 5.x reasonably close, but is account lockout replicated to all servers? Sun DS 6.x claims to) - refint overlay (similar to Sun's referential integrity plugin) - unique overlay (similar to Sun's uniqueness plugin) - audit and accesslog overlays, syslog logging - much more useful/complete than Sun's access/audit/error logs. - live acl changes via LDAP Unknown features: - Per user resource limits (sizelimit, timelimit, idletimeout, etc). I think Howard Chu said OpenLDAP has some of this, but I haven't seen any reference to it or how to use it in the docs (does this functionality exist, and if so, is there any documentation?) - Tracking of last login (i.e. last successful ldap authentication) Is this still fairly accurate? The ones that are really problematic are the lack of: - VLV Browse indexes - RFC 2891 (server side sorting) - per user/entry resources limits (if they don't exist) Are there any unofficial updates/patches/overlays/plans for any of this functionality? Thanks, - Jeff

14 years, 2 months

11
29
0 / 0

ldif.h

by Eric Nichols

I've spent the past few days rooting around the openldap site. I am developing currently on Debian lenny using the libldap2-dev package. My small goal is to try and write my own rootdse program to better understand the lib. I am stuck on one piece of code. I have no idea where to get an LDIF library to parse/write ldif files. Can anyone point me in the right direction on this? It's been a long time since I was coding in C and it took me a while just to gather that I needed -lldap to make what I have work. I believe this is the only piece I'm missing, the LDAP library calls work flawlessly. I also did learn that many of the depreciated functions are still documented as valid functions (ldap_get_values, ldap_count_values, ldap_value_free). I couldn't find anything that replaced these.. Many thanks Eric

14 years, 2 months

3
3
0 / 0

slapadd -q fails to close BDB on Windows

by Kyle Blaney

I am experiencing intermittent failures to close the Berkeley database when running slapadd using quick mode on Windows. I have reproduced the problem using OpenLDAP 2.4.16, 2.4.15, and 2.3.42. I am using BDB 4.4.20 with all applicable patches. The problem only occurs when quick mode is used. I have not seen the problem on Linux systems. Here are the steps that (sometimes) reproduce the problem: 1. Start slapd to create initial database files: slapd -f slapd.conf -d -1 2. Stop slapd using CTRL-C. 3. Add initial data: slapadd -f slapd.conf -l initialData.ldif -q When the problem occurs, slapadd displays the following error message: C:\openldap>slapadd -f slapd.conf -l initialData.ldif -q Closing DB... bdb_db_close: database "dc=Nortel,dc=com": alock_close failed Here is the weird part - the problem is difficult to reproduce, unless you set your system clock to certain times on May 25, 2009. For example, I can reproduce the problem 100% of the time when I set my system clock to May 25, 2009 at 2:00 PM. When my system clock has other dates, the problem is very difficult to reproduce. In fact, if I switch my system clock back and forth between May 25, 2009 at 2:00 PM and May 26, 2009 at 2:00 PM while repeatedly running slapadd with quick mode (-q) and continue-on-error (-c), the problem always occurs on May 25 but never on May 26. My slapd.conf and initialData.ldif are minimal: C:\openldap>more slapd.conf ucdata-path data include core.schema include cosine.schema backend bdb database bdb suffix "dc=Nortel,dc=com" directory data C:\openldap>more initialData.ldif dn: dc=Nortel,dc=com objectclass: top objectClass: organizationalUnit objectclass: dcObject ou: Nortel dc: Nortel Any help is appreciated. Kyle Blaney

14 years, 3 months

2
1
0 / 0

Re: Changing password with replicat and referal do nothing

by paulpierre.brun＠free.fr

Hello, I can load module overlay chain. I don't no if it's compile. For compiling I do that : ./configure —prefix= —enable-overlays —enable-ppolicy —enable-rwm —enable-bdb To test overlay chain I do ./run -b ldif test032 Cleaning up test run directory leftover from previous run. Running ./scripts/test032-chain... running defines.sh LDAP backend not available, test skipped I don't no how I can load module in slapd.conf, I put those ligne modulepath /usr/sbin/openldap moduleload back_ldap.la and when i do service ldap start , i have overlay "chain" not found. I can found file back_ldap.la, how i can compile module to use overlay chain ??? Thanks for help. ----- Mail Original ----- De: "Quanah Gibson-Mount" <quanah(a)zimbra.com> À: "paulpierre brun" <paulpierre.brun(a)free.fr> Cc: openldap-software(a)openldap.org Envoyé: Jeudi 28 Mai 2009 18h18:32 GMT +01:00 Amsterdam / Berlin / Berne / Rome / Stockholm / Vienne Objet: Re: Changing password with replicat and referal do nothing --On Thursday, May 28, 2009 2:27 PM +0200 paulpierre.brun(a)free.fr wrote: > Thanks for answers : > I try with (c) at service ldap start i have : > :overlay "chain" not found > > How I can load module overlay ??? > > configure parameters are : > > ./configure —prefix= —enable-overlays —enable-ppolicy —enable-rwm > —enable-bdb Hi Paul, Please keep replies on the list. Did you use the moduleload statement to load the chain module? I suggest you look at the test suite, particularly test032. You can run that test, and see the configs that are generated when it completes. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

14 years, 3 months

2
2
0 / 0

nssov support for group with spaces?

by Greek Ordono

is this is a known bug? ERROR: @(#) $OpenLDAP: slapd 2.4.11 (Mar 26 2009 08:14:38) $ daemon: IPv6 socket() failed errno=97 (Address family not supported by protocol) slapd starting nssov: group entry cn=Domain Admins,ou=Groups,dc=domain,dc=com contains invalid group name: "Domain Admins" -- grexk

14 years, 3 months

4
4
0 / 0

Re: SOLVED: nssov support for group with spaces?

by Greek Ordono

Ok, thanks. Anyway I'm planning to replace nss_ldap with nssov/nss-ldapd. -- grexk --- On Fri, 5/29/09, David <admin(a)dmarkey.com> wrote: From: David <admin(a)dmarkey.com> Subject: Re: nssov support for group with spaces? To: "Howard Chu" <hyc(a)symas.com> Cc: "Greek Ordono" <grexk(a)yahoo.com>, openldap-software(a)openldap.org Date: Friday, May 29, 2009, 7:49 PM Most of the samba groups have spaces(when using smbldap-populate) eg: "Domain Users" "Domain Admins" This will stop nssov replacing nss_ldap for most samba configurations On Fri, May 29, 2009 at 2:04 PM, Howard Chu <hyc(a)symas.com> wrote: Greek Ordono wrote: is this is a known bug? ERROR: @(#) $OpenLDAP: slapd 2.4.11 (Mar 26 2009 08:14:38) $ daemon: IPv6 socket() failed errno=97 (Address family not supported by protocol) slapd starting nssov: group entry cn=Domain Admins,ou=Groups,dc=domain,dc=com contains invalid group name: "Domain Admins" -- grexk No bug, group names in POSIX are not allowed to contain spaces. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

14 years, 3 months

1
0
0 / 0

Re: Changing password with replicat and referal do nothing

by Quanah Gibson-Mount

--On Thursday, May 28, 2009 2:27 PM +0200 paulpierre.brun(a)free.fr wrote: > Thanks for answers : > I try with (c) at service ldap start i have : > :overlay "chain" not found > > How I can load module overlay ??? > > configure parameters are : > > ./configure —prefix= —enable-overlays —enable-ppolicy —enable-rwm > —enable-bdb Hi Paul, Please keep replies on the list. Did you use the moduleload statement to load the chain module? I suggest you look at the test suite, particularly test032. You can run that test, and see the configs that are generated when it completes. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

14 years, 3 months

1
0
0 / 0

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software May 2009