openldap-software August 2009

openldap-software@openldap.org

27 participants
29 discussions

Proxy cache privateDB control
by Dieter Kluenter 17 Aug '09

17 Aug '09

Hi, I just want to understand the function of pcache privateDB control, could someone enlighten me? If I do a search with the control enabled, bound as user, I get Server is unwilling to perform: pcachePrivDB: operation not allowed, bound as rootdn I get Critical extension is unavailable: critical control unavailable in context What are the operations allowed with this control enabled? -Dieter -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID:8EF7B6C6 53°37'09,95"N 10°08'02,42"E

2 1

Re: OpenLDAP Overlay modules load problem
by Jonathan Clarke 17 Aug '09

17 Aug '09

On 16/08/2009 13:46, Jittinan Suwanrueangsri wrote: > I have compiled OpenLDAP 2.4.16 from source by using following command > > *CC=gcc CPPFLAGS=-I/usr/local/BerkeleyDB.4.7/include > LDFLAGS=-L/usr/local/BerkeleyDB.4.7/lib > LD_LIBRARY_PATH=/usr/local/BerkeleyDB.4.7/lib ./configure --enable-bdb > --enable-hdb --with-cyrus-sasl --with-tls --enable-ldap --enable-overlays > * > > After that I configure slapd.conf to load denyop overlay module but > slapd can not load it .I have not seen any file name denyop or similar > one in file sysem.Where is a path of openldap overlay moudules? Hi, Given the command line you used to configure OpenLDAP, all overlays are built statically into the slapd executable. You don't need to load them, you can just use them. If you want to use dynamic modules, configure with --enable-modules and --enable-overlays=mod. The default path for modules is $PREFIX/libexec/openldap/. Hope this helps, Jonathan -- -------------------------------------------------------------- Jonathan Clarke - jonathan(a)phillipoux.net -------------------------------------------------------------- Ldap Synchronization Connector (LSC) - http://lsc-project.org --------------------------------------------------------------

2 1

need help about rwm
by Gennady G. Marchenko 16 Aug '09

16 Aug '09

Good day sirs! Please help me with understanding rwm functionality, is it real with rwm get with one search filter some fields from one dn and some field from another? I have 2 DNs: cn=test,ou=mail,dc=exapmle,dc=org mail: test(a)example.org uid=test,ou=users,dc=example,dc=org uidNumber: 11 mailhost: bla-bla I want to get merge of these DNs i.e. something like this: uid=test,dc=example,dc=org cn=test mail: test(a)example.org uidNumber: 11 mailhost: bla-bla Can I done it with rwm or no? Thanks for help, Gennady.

1 0

LDAP_OPT_X_SASL_AUTHCID and LDAP_OPT_X_SASL_AUTHZID
by Michael Ströder 16 Aug '09

16 Aug '09

HI! what is returned by ldap_get_options(LDAP_OPT_X_SASL_AUTHCID,[..]) ldap_get_options(LDAP_OPT_X_SASL_AUTHZID,[..]) I'm getting results with python-ldap which look strange to me after doing a SASL bind. But I'm not sure what should be returned. Ciao, Michael.

3 8

Determine Kerberbos principal name used with SASL/GSSAPI
by Michael Ströder 12 Aug '09

12 Aug '09

HI! Is there any way in libldap to determine which Kerberbos principal name was actually used after a successful SASL/GSSAPI bind? Ciao, Michael.

1 0

Re: Openldap Group ACL
by Jonathan Clarke 09 Aug '09

09 Aug '09

On 07/08/2009 22:36, Jittinan Suwanrueangsri wrote: > Hi all > > I have tested acl of OpenLdap 2.4 by using following code in > slapd.conf > > > access to dn.subtree="ou=System,dc=example,dc=com" > by > group/groupOfUniqueNames/uniqueMember.regex="cn=[^,]+,ou=Groups,dc=example,dc=com" > write > by users read > > > In my directory there is a dn: cn=LdapAdmins,ou=Groups,dc=example,dc=com > but from log message which is shown below a dn does not match pattern > cn=[^,]+,ou=Groups,dc=example,dc=com because it get read > permission.After that I change acl to > > access to dn.subtree="ou=System,dc=example,dc=com" > by > group/groupOfUniqueNames/uniqueMember.regex="cn=LdapAdmins,ou=Groups,dc=example,dc=com" > write > by users read > > It work correctly by get write permission > > Because I use group/groupOfUniqueNames/uniqueMember.regex .It should > treat "cn=[^,]+,ou=Groups,dc=example,dc=com" as regular expression > pattern but seem that it just exact pattern.Why? Who can explain? According to slapd.access(5), regex expansion is not supported for the group clause in ACLs. Only submatch replacement is possible. To implement this access policy, you may want to check out sets. See http://www.openldap.org/faq/data/cache/1133.html Regards, Jonathan > Log level 128 > > => access_allowed: read access to > "uid=authenticate,ou=System,dc=example,dc=com" "objectClass" requested > => dn: [2] ou=system,dc=example,dc=com > => acl_get: [2] matched > => acl_get: [2] attr objectClass > => slap_access_allowed: result not in cache (objectClass) > => acl_mask: access to entry > "uid=authenticate,ou=System,dc=example,dc=com", attr "objectClass" requested > => acl_mask: to value by "uid=matt,ou=users,dc=example,dc=com", (=0) > <= check a_group_pat: cn=[^,]+,ou=Groups,dc=example,dc=com > /=> acl_string_expand: pattern: cn=[^,]+,ou=Groups,dc=example,dc=com > => acl_string_expand: expanded: cn=[^,]+,ou=Groups,dc=example,dc=com/ > <= check a_dn_pat: users > <= acl_mask: [2] applying read(=rscxd) (stop) > <= acl_mask: [2] mask: read(=rscxd) > => slap_access_allowed: read access granted by read(=rscxd) > => access_allowed: read access granted by read(=rscxd) > -- -------------------------------------------------------------- Jonathan Clarke - jonathan(a)phillipoux.net -------------------------------------------------------------- Ldap Synchronization Connector (LSC) - http://lsc-project.org --------------------------------------------------------------

1 0

Add DSML interface to OpenLDAP
by Roberto Barrero 06 Aug '09

06 Aug '09

Hi all, I'm beginner in OpenLDAP and I've a question... I've an OpenLDAP server installed, and I want enable DSML interface to access data using it since my client. How I can install this interface? Thanks in advance -- ----------------------------------- Roberto Barrero de Uña ----------------------------------- Experience Ingenieria y Servicios Parque Tecnológico de Boecillo Edificio Centro, módulo 202 47151 Boecillo (Valladolid) ---------------------------------- correo: rbarrero(a)experienceis.com Tfno: +34 983 54 98 48 Móvil: +34 670 86 64 79

3 2

ldapsearch with password always returns invalid credentials
by Subbarao Karanam 05 Aug '09

05 Aug '09

hello, When I did a ldapsearch always gives me "Invalid credentials Error". Really fed up about this as I'm not getting any help.. When I did a ldapsearch with ldapsearch -x -h crmsldap.agilent -p 389 -s base -b 'ou=people,dc=crmsldap,dc=company' "(&(objectClass=*))" # extended LDIF # # LDAPv3 # base <ou=people,dc=crmsldap,dc=company> with scope base # filter: (&(objectClass=*)) # requesting: ALL # # people, crmsldap.agilent dn: ou=people,dc=crmsldap,dc=company objectClass: top objectClass: organizationalUnit ou: people # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Second Command ldapsearch -x -h crmsldap.agilent -p 389 -s base -b 'ou=people,dc=crmsldap,dc=company "(&(objectClass=*))" -w admin + ldap_bind: Invalid credentials (49) Can you please help me where is the problem...Attached is the slapd.conf, my users ldif file... Thanks Subbarao

4 3

Stability of autogroup overlay with OpenLDAP < 2.4.18
by Ryan Steele 01 Aug '09

01 Aug '09

Is the autogroup overlay considered stable for use with versions of OpenLDAP earlier than 2.4.18? I know it's being used on earlier versions (as 2.4.18 is not considered stable yet), but I've also seen some reports of basic search functionality getting clobbered after doing so. According to ITS#6227, that bug was fixed, but I'd like to confirm that the overlay does at least work before investing the time (however short it may be) to compile it and package it in with OpenLDAP locally for internal use. I appreciate any feedback. Regards, Ryan

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software August 2009