openldap-software January 2010

openldap-software@openldap.org

35 participants
33 discussions

Re: searching using component matching feature
by med s 11 Jan '10

11 Jan '10

I am using openLDAP 2.4.20 and BDB 4.8.24 On 1/11/10, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Friday, January 08, 2010 1:41 AM -0800 med s <medinaseid(a)gmail.com> > wrote: > >> hello. >> I have successfully compiled openldap and the comp_match module >> but when seraching it outputs the following error on the server > > What OpenLDAP Version? > > What BDB version? Is the BDB version fully patched? > > --Quanah > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

searching using component matching feature
by med s 11 Jan '10

11 Jan '10

hello. I have successfully compiled openldap and the comp_match module but when seraching it outputs the following error on the server connection_get(12): got connid=0 connection_read(12): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 147 contents: op tag 0x63, time 1262943244 ber_get_next conn=0 op=1 do_search ber_scanf fmt ({miiiib) ber: >>> dnPrettyNormal: <o=insa,c=et> <<< dnPrettyNormal: <o=insa,c=et>, <o=insa,c=et> ber_scanf fmt ({t) ber: ber_scanf fmt (m) ber: ber_scanf fmt (t) ber: ber_scanf fmt (m) ber: ber_scanf fmt (t) ber: ber_scanf fmt (m) ber: ber_scanf fmt (}) ber: daemon: activity on 1 descriptor ber_scanf fmt ({M}}) ber: ==> limits_get: conn=0 op=1 self="[anonymous]" this="o=insa,c=et" => bdb_search bdb_dn2entry("o=insa,c=et") => bdb_dn2id("o=insa,c=et") daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL <= bdb_dn2id: got id=0x1 entry_decode: "o=insa,c=et" <= entry_decode(o=insa,c=et) search_candidates: base="o=insa,c=et" (0x00000001) scope=2 => bdb_dn2idl("o=insa,c=et") => bdb_equality_candidates (objectClass) => key_read <= bdb_index_read: failed (-30988) <= bdb_equality_candidates: id=0, first=0, last=0 bdb_search_candidates: id=-1 first=1 last=7 bdb_search: 1 does not match filter entry_decode: "ou=certs,o=insa,c=et" <= entry_decode(ou=certs,o=insa,c=et) => bdb_dn2id("ou=certs,o=insa,c=et") <= bdb_dn2id: got id=0x2 bdb_search: 2 does not match filter entry_decode: "uid=abc,ou=certs,o=insa,c=et" <= entry_decode(uid=abc,ou=certs,o=insa,c=et) => bdb_dn2id("uid=abc,ou=certs,o=insa,c=et") <= bdb_dn2id: got id=0x3 Segmentation fault and exits the server what could be the cause of the error?

2 1

LDAP Dereferencing
by Nacho Díaz Asenjo 11 Jan '10

11 Jan '10

Hi! I have a problem since I've updated my openldap server to 2.4.19 version (from 2.3.33). If I do a ldapsearch operation with dereferring "always" from my root base dn, i can't obtain any results because it's too slow. I think the performance of this kind of operation against the OpenLDAP directory is getting worst in last versions (2.4.x). Which could be the reason? Only with dereferencing always (in debug mode 1, i can see the operation reference a lot of index content) Thanks

4 3

back-sql and oracle and uid
by Nikethan Nagula Raja 08 Jan '10

08 Jan '10

There is an old unanswered post by Mark Adamson from Carnegie Mellon. Right now I'm facing the same issue. Here is the Post URL: http://www.openldap.org/lists/openldap-software/200209/msg00724.html Oracle has reserved the word "uid", so I can't use it as a column name in a table or as a "name" in ldap_attr_mappings. I named my column "userid" , the LDAP query still puts in "select username uid ", and the "AS uid" makes the query fail. Essentially, I can't have an LDAP attribute named "uid". Has anyone else seen this or found a workaround? ==>backsql_get_attr_vals(): oc="NetAcadPerson" attr="uid" keyval=295107 backsql_get_attr_vals(): number of values in query: 1 backsql_get_attr_vals(): error executing attribute query "SELECT NetacadPersons.username uid FROM NetacadPersons WHERE NetacadPersons.NetAcadUserID=? ORDER BY uid" Return code: -1 nativeErrCode=923 SQLengineState=S1000 msg="[unixODBC][Oracle][ODBC][Ora]ORA-00923: FROM keyword not found where expected If you look at the above log for Object Class = "NetAcadPerson" , its trying to query attribute uid. But I have not defined any attribute with name "uid" in the ldap_attr_mappings or in the schema containg Object class. Any work around on this is appreciated. -Nikethan Nagula Raja

1 0

Admin Guide: Tuning 21.1.2 Disks and virtual servers
by Francis Swasey 08 Jan '10

08 Jan '10

Is the info in this section intended for only physical LDAP servers or for servers that are virtual (such as VMware) as well? Frank Swasey Sent from my iPhone

1 0

Password Policy setting
by Saavedra, Gisella 07 Jan '10

07 Jan '10

I read the entry in Chapter 6 http://www.zytrax.com/books/ldap/ch6/ppolicy.html#examples regarding setting the Password Policy Control. I have installed OpenLDAP through Cygwin. OpenLDAP is version 2.3.43 I created my db and included the Password Policy control schema, but I am getting the following error when I try to load my default and user policies: $ ldapadd -H ldap://localhost:666 -x -D "cn=Manager,dc=zes_example,dc=com" -w secret -f /etc/openldap/data/ppolicy.ldif adding new entry "ou=pwdpolicies,dc=zes_example,dc=com" adding new entry "cn=default,ou=pwdpolicies,dc=zes_example,dc=com" ldapadd: Object class violation (65) additional info: no structural object class provided Any idea why I am getting this error? Am I missing an objectClass in the policy definition? Do I need to add the password policy (ldif file) before I give the directive in slapd.conf? Any help is appreciated. The output from the server is: <= index_entry_add( 12, "ou=pwdpolicies,dc=zes_example,dc=com" ) success => entry_encode(0x0000000c): ou=pwdpolicies,dc=zes_example,dc=com bdb_add: added id=0000000c dn="ou=pwdpolicies,dc=zes_example,dc=com" send_ldap_result: conn=7 op=1 p=3 send_ldap_response: msgid=2 tag=105 err=0 ber_flush: 14 bytes to sd 9 connection_get(9): got connid=7 connection_read(9): checking for input on id=7 ber_get_next ber_get_next: tag 0x30 len 369 contents: ber_get_next do_add ber_scanf fmt ({m) ber: >>> dnPrettyNormal: <cn=default,ou=pwdpolicies,dc=zes_example,dc=com> <<< dnPrettyNormal: <cn=default,ou=pwdpolicies,dc=zes_example,dc=com>, <cn=default,ou=pwdpolicies,dc=zes_example,dc=com> ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt (}) ber: bdb_dn2entry("cn=default,ou=pwdpolicies,dc=zes_example,dc=com") => bdb_dn2id("cn=default,ou=pwdpolicies,dc=zes_example,dc=com") <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) bdb_referrals: op=104 target="cn=default,ou=pwdpolicies,dc=zes_example,dc=com" matched="ou=pwdpolicies,dc=zes_example,dc =com" bdb_add: entry failed op attrs add: no structural object class provided (65) send_ldap_result: conn=7 op=2 p=3 send_ldap_response: msgid=3 tag=105 err=65 ber_flush: 49 bytes to sd 9 connection_get(9): got connid=7 connection_read(9): checking for input on id=7 ber_get_next ber_get_next: tag 0x30 len 5 contents: ber_get_next do_unbind ber_get_next on fd 9 failed errno=0 (No error) connection_closing: readying conn=7 sd=9 for close connection_close: deferring conn=7 sd=9 connection_resched: attempting closing conn=7 sd=9 connection_close: conn=7 sd=9 ------------------------------------------- The policy.ldif: dn: ou=pwdpolicies,dc=zes_example,dc=com ou: pwdpolicies description: All password Policies objectClass: organizationalUnit # Default Password Policy dn: cn=default,ou=pwdpolicies,dc=zes_example,dc=com objectClass: pwdPolicy cn: default pwdAllowUserChange: TRUE pwdExpireWarning: 259200 pwdFailureCountInterval: 100 pwdGraceAuthNLimit: 0 pwdInHistory: 3 pwdLockout: TRUE pwdLockoutDuration: 0 pwdMaxFailure: 5 pwdMaxAge: 77760000 pwdMinLength: 6 # # Short-lived Password Policy (to be used for testing purposes - 1-day pwd live) # dn: cn=short_lived,ou=pwdpolicies,dc=example,dc=com objectClass: pwdPolicy cn: short_lived pwdMaxAge: 86400 pwdInHistory: 3 pwdMaxFailure: 5 pwdLockout: TRUE pwdLockoutDuration: 0 pwdGraceAuthNLimit: 0 pwdFailureCountInterval: 0 pwdMinLength: 6 pwdAllowUserChange: TRUE The commands in my slapd.conf are: ... include /etc/openldap/schema/ppolicy.schema ... (not usre if I need the next line) loadmodule ppolicy.la # invokes password policies for this DIT only overlay ppolicy # Default ppolicy ppolicy_default "cn=default,ou=pwdpolicies,dc=zes_example,dc=com" # Some ppolicy directives ppolicy_use_lockout ------------------------------------------------------------------------------ Gisella Saavedra Sr. Software Engineer gsaavedra(a)zebra.com<mailto:gsaavedra@zebra.com> [cid:image001.gif@01CA8EBD.44929260] 1000 Broadway, Suite 150, Oakland, CA 94607 | T+1 510 267 5123 T Main+1 510 267 5000 F+1 510 267 5100 | http://www.zebra.com/zes ________________________________ - CONFIDENTIAL- This email and any files transmitted with it are confidential, and may also be legally privileged. If you are not the intended recipient, you may not review, use, copy, or distribute this message. If you receive this email in error, please notify the sender immediately by reply email and then delete this email.

3 3

Re: openldap logging setup as a non-root user
by Aaron Richton 07 Jan '10

07 Jan '10

Please keep replies on the list. On Thu, 7 Jan 2010, Konstantinos Tripolitis wrote: > Thank you very much for your quick input! You've been most helpful. > > "slapd -d 256 > logfile 2>&1 &" does work, but I do not get timestamps: > [...cut...] > Any idea/suggestion on how I can get timestamps as well? The timestamps are added by the syslog daemon, not by slapd. To imitate that functionality with a flat file, you'd have to write a program that prepends them, and change the redirection operator to a pipe. Again, IMO, you'd be much better off just using syslog in the first place...a lot of features like these are all completely solved in the common syslog implementations.

1 0

openldap logging setup as a non-root user
by Konstantinos Tripolitis 07 Jan '10

07 Jan '10

I was wondering whether it is possible to create an openldap log file as a regular user. I have already tried editing syslog.conf with local4.* and restarting syslogd. This works fine, but requires root access and I am interested in enabling ldap logging as a non-root user. I have compiled openldap 2.3.27 as a regular user on Redhat Enterprise Linux 5.2 with the following configuration: ./configure --prefix=/home/myuser/local/ --enable-syslog --sysconfdir=/home/myuser/local I found some information about a "logfile" directive that can be used in slapd.conf (http://www.zytrax.com/books/ldap/ch6/#logfile), but I do not know if it is valid. I added the following in my slapd.conf and restarted slapd (I had already created the slapd.log file before restarting slapd): #define the logfile logfile /home/myuser/local/openldap/slapd.log #define the level of detail in the logs loglevel 256 However this configuration does not seem to work. Any advise on this issue would be more than welcomed. Thank you and best regards, Kostas

3 2

Problem: ldap_bind: Invalid credentials (49)
by Chatree Srichart 05 Jan '10

05 Jan '10

Hi all.. I try to add ldif file but I found error: ldap_bind: Invalid credentials (49) I use Ubuntu 9.04 /etc/ldap/slapd.conf ============== # Make sure you edit or add these directives after the first 'database' directive. suffix "dc=example,dc=com" directory "/var/lib/ldap" rootdn "cn=admin,dc=example,dc=com" rootpw {SSHA}b7Jy+ 04HxRvtDWbsZwsYuQrU7YTzFrWl admin.ldif ============== dn: dc=ceenet,dc=example,dc=com objectclass: dcObject objectclass: organization dc: ceenet o: CEENET Workshop 2001 dn:cn=Manager,dc=ceenet,dc=example,dc=com objectclass: organizationalRole cn: Manager I following command: =============== $ ldapadd -x -h localhost -D cn=admin,dc=example,dc=com -W -f admin.ldif Enter LDAP Password: xxxxx ldap_bind: Invalid credentials (49) Can any one help me?

2 1

openldap-2.4.19 backsql with oracle and slap_sl_malloc of 56 bytes failed, using ch_malloc error
by Nikethan Raja 05 Jan '10

05 Jan '10

We have installed openldap-2.4.19 backsql and oracle as RDMS. Everthing works fine when I search for a specific entry. But If I open a LDAP beowser and expand the tree. It tries to run the following query to load all the entries for ObjectClass NetAcadPerson . Unfortunately this query (this Objectclass has) returns almost one million records. SELECT DISTINCT ldap_entries.id,NetacadPersons.NetAcadUserID,'NetAcadPerson' objectClass,ldap_entries.dn dn FROM ldap_entries,NetacadPersons WHERE NetacadPersons.NetAcadUserID=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND ldap_entries.parent=? AND 3=3 It was able to load 1000+ records with the following info in the logs .... backsql_oc_get_candidates(): added entry id=471024, keyval=470924 dn="uid=xxxxx,ou=people,dc=netacad,dc=net" >>> dnPrettyNormal: <uid=xxxxx,ou=people,dc=netacad,dc=net> <<< dnPrettyNormal: <uid=xxxxx,ou=people,dc=netacad,dc=net>, <uid=xxxxxx,ou=people,dc=netacad,dc=net> backsql_oc_get_candidates(): added entry id=471024, keyval=470924 dn="uid=xxxxx,ou=people,dc=netacad,dc=net" >>> dnPrettyNormal: <uid=xxxxx,ou=people,dc=netacad,dc=net> <<< dnPrettyNormal: <uid=xxxxx,ou=people,dc=netacad,dc=net>, <uid=xxxxxx,ou=people,dc=netacad,dc=net> But after loaading some of them I get the following error ...telling me that the memory allocation falied.... slap_sl_malloc of 16 bytes failed, using ch_malloc slap_sl_malloc of 32 bytes failed, using ch_malloc slap_sl_malloc of 56 bytes failed, using ch_malloc My questions is - is it possible to restrict number of rows by using "rownum" special ORACLE feature. By appending some thing like below to the query above. "AND rownum < 100 " If it is possible to configure above query, please let me know what slapd configuration I should use. I read all the options in the following man page - http://linux.die.net/man/5/slapd-sql Let me know if I have any other options to prevent this from happening. Thanks a lot in advance. -Nikethan

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software January 2010