openldap-software April 2010

openldap-software@openldap.org

47 participants
48 discussions

problems replicating deleted entries after slave comes up.
by Lior Goikhburg 23 Apr '10

23 Apr '10

Hello, I'm having problem with 2 OpenLDAP (ver 2.4.21) servers acting as "master" and "slave" using "refresh and persist" synchronization. When both servers are up, all changes get replicated (including deletes), however when slave is down and objects get deleted on master, they are not deleted on the slave after it comes up. Also, an interesting issue I noticed, deleting object on master doesn't change the servers contextCSN, so this could be related to the problem I have. What can be done about this situation ? Configs follow: Master: dn: cn=module{0} objectClass: olcModuleList cn: module{0} olcModuleLoad: {0}syncprov.la olcModuleLoad: {1}memberof.la structuralObjectClass: olcModuleList creatorsName: cn=config entryUUID: b4dec246-8d67-102d-9827- 65d8858906d8 createTimestamp: 20090212154358Z entryCSN: 20090212154358.261980Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20090212154358Z dn: olcOverlay={1}syncprov objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov olcSpSessionlog: 100 entryUUID: ad98aace-8b05-102d-8b73-fd81f30554e6 creatorsName: cn=config createTimestamp: 20090209145713Z structuralObjectClass: olcSyncProvConfig olcSpCheckpoint: 100 1 entryCSN: 20091104130358.860872Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20091104130358Z dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: slapd.conf.1 olcConfigDir: slapd.d olcArgsFile: /var/run/openldap/slapd.args olcAttributeOptions: lang- olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcLocalSSF: 71 olcPidFile: /var/run/openldap/slapd.pid olcReadOnly: FALSE olcReverseLookup: FALSE olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCRLCheck: none olcTLSVerifyClient: never olcToolThreads: 1 structuralObjectClass: olcGlobal creatorsName: cn=config entryUUID: b4deb404-8d67-102d-9826-65d8858906d8 createTimestamp: 20090212154358Z olcSaslHost: ldap-test1.carina.griddynamics.net olcLogLevel: 0 olcAuthzPolicy: to olcAuthzRegexp: {0}uid=([^@]*)[@,].*cn=digest-md5,cn=auth ldap:///dc=griddynam ics,dc=net??sub?(uid=$1) olcSizeLimit: 10000 olcServerID: 1 ldap://ldap-test1.carina.griddynamics.net entryCSN: 20091121171118.965511Z#000000#002#000000 modifiersName: cn=config modifyTimestamp: 20091121171118Z contextCSN: 20100121080100.534901Z#000000#001#000000 dn: olcDatabase={2}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcDbDirectory: /var/lib/ldap/griddynamics.net olcSuffix: dc=griddynamics,dc=net olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=Manager,dc=griddynamics,dc=net olcMonitoring: TRUE olcDbDirtyRead: FALSE olcDbLinearIndex: FALSE olcDbMode: 384 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 entryUUID: acc152ea-8b05-102d-8b71-fd81f30554e6 creatorsName: cn=config createTimestamp: 20090209145711Z structuralObjectClass: olcBdbConfig olcRootPW:: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx= olcAccess: {0}to attrs=userPassword,userPKCS12,sambaLMPassword,sambaNTPassword by sockurl.regex="^ldapi:///$" write by group.exact="cn=noc,ou=groups,dc=gr iddynamics,dc=net" write by self write by anonymous auth olcAccess: {1}to attrs=shadowLastChange by sockurl.regex="^ldapi:///$" write by group.exact="cn=noc,ou=groups,dc=griddynamics,dc=net" write by self wri te by * read olcAccess: {2}to * by sockurl.regex="^ldapi:///$" write by group.exact="cn=n oc,ou=groups,dc=griddynamics,dc=net" write by self write by * read olcDbIndex: default eq olcDbIndex: objectClass,entryUUID,entryCSN olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: uidNumber pres,eq olcDbIndex: gidNumber pres,eq olcDbIndex: memberOf pres,eq olcDbIndex: ou pres,eq,sub olcDbIndex: mail pres,eq,sub olcDbIndex: loginShell pres,eq olcDbIndex: sn pres,eq,sub olcDbIndex: givenName pres,eq,sub olcDbIndex: memberUid pres,eq olcDbIndex: nisMapName pres,eq,sub olcDbIndex: nisMapEntry pres,eq,sub olcDbIndex: uniqueMember pres,eq olcDbIndex: gosaObject pres,eq olcDbIndex: zoneName pres,eq olcDbIndex: relativeDomainName pres,eq olcDbIndex: member pres,eq olcDbIndex: dhcpPrimaryDN pres,eq olcDbIndex: dhcpSecondaryDN pres,eq olcDbIndex: dhcpServerDN pres,eq olcDbIndex: dhcpFailOverPeerDN pres,eq olcDbIndex: dhcpHWAddress pres,eq olcDbNoSync: TRUE olcDbCheckpoint: 1024 5 olcDbCacheSize: 5000 olcDbIDLcacheSize: 5000 olcSyncrepl: {0}rid=001 provider=ldap://ldap-test1.carina.griddynamics.net bindmetho d=simple timeout=1 network-timeout=0 binddn="cn=manager,dc=griddynamics,dc=ne t" credentials="xxxxxxxxxxx" starttls=no filter="(objectclass=*)" searchbase="dc =griddynamics,dc=net" scope=sub schemachecking=off type=refreshAndPersist ret ry="10 +" olcDbConfig: {0}set_flags DB_LOG_AUTOREMOVE olcDbConfig: {1}set_cachesize 0 33554432 0 entryCSN: 20091121172900.646924Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20091121172900Z Slave: dn: cn=module{0} objectClass: olcModuleList cn: module{0} olcModuleLoad: {0}syncprov.la olcModuleLoad: {1}memberof.la structuralObjectClass: olcModuleList creatorsName: cn=config entryUUID: b4dec246-8d67-102d-9827-65d8858906d8 createTimestamp: 20090212154358Z entryCSN: 20090212154358.261980Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20090212154358Z dn: olcOverlay={1}syncprov objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov olcSpSessionlog: 100 entryUUID: ad98aace-8b05-102d-8b73-fd81f30554e6 creatorsName: cn=config createTimestamp: 20090209145713Z structuralObjectClass: olcSyncProvConfig olcSpCheckpoint: 100 1 entryCSN: 20091104130358.860872Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20091104130358Z dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: slapd.conf.1 olcConfigDir: slapd.d olcArgsFile: /var/run/openldap/slapd.args olcAttributeOptions: lang- olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcLocalSSF: 71 olcPidFile: /var/run/openldap/slapd.pid olcReadOnly: FALSE olcReverseLookup: FALSE olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCRLCheck: none olcTLSVerifyClient: never olcToolThreads: 1 structuralObjectClass: olcGlobal creatorsName: cn=config entryUUID: b4deb404-8d67-102d-9826-65d8858906d8 createTimestamp: 20090212154358Z olcSaslHost: ldap-test1.carina.griddynamics.net olcLogLevel: 0 olcAuthzPolicy: to olcAuthzRegexp: {0}uid=([^@]*)[@,].*cn=digest-md5,cn=auth ldap:///dc=griddynam ics,dc=net??sub?(uid=$1) olcSizeLimit: 10000 olcServerID: 1 ldap://ldap-test1.carina.griddynamics.net entryCSN: 20091121171118.965511Z#000000#002#000000 modifiersName: cn=config modifyTimestamp: 20091121171118Z contextCSN: 20100121080100.534901Z#000000#001#000000 dn: olcDatabase={2}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcDbDirectory: /var/lib/ldap/griddynamics.net olcSuffix: dc=griddynamics,dc=net olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=Manager,dc=griddynamics,dc=net olcMonitoring: TRUE olcDbDirtyRead: FALSE olcDbLinearIndex: FALSE olcDbMode: 384 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 entryUUID: acc152ea-8b05-102d-8b71-fd81f30554e6 creatorsName: cn=config createTimestamp: 20090209145711Z structuralObjectClass: olcBdbConfig olcRootPW:: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx= olcAccess: {0}to attrs=userPassword,userPKCS12,sambaLMPassword,sambaNTPassword by sockurl.regex="^ldapi:///$" write by group.exact="cn=noc,ou=groups,dc=gr iddynamics,dc=net" write by self write by anonymous auth olcAccess: {1}to attrs=shadowLastChange by sockurl.regex="^ldapi:///$" write by group.exact="cn=noc,ou=groups,dc=griddynamics,dc=net" write by self wri te by * read olcAccess: {2}to * by sockurl.regex="^ldapi:///$" write by group.exact="cn=n oc,ou=groups,dc=griddynamics,dc=net" write by self write by * read olcDbIndex: default eq olcDbIndex: objectClass,entryUUID,entryCSN olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: uidNumber pres,eq olcDbIndex: gidNumber pres,eq olcDbIndex: memberOf pres,eq olcDbIndex: ou pres,eq,sub olcDbIndex: mail pres,eq,sub olcDbIndex: loginShell pres,eq olcDbIndex: sn pres,eq,sub olcDbIndex: givenName pres,eq,sub olcDbIndex: memberUid pres,eq olcDbIndex: nisMapName pres,eq,sub olcDbIndex: nisMapEntry pres,eq,sub olcDbIndex: uniqueMember pres,eq olcDbIndex: gosaObject pres,eq olcDbIndex: zoneName pres,eq olcDbIndex: relativeDomainName pres,eq olcDbIndex: member pres,eq olcDbIndex: dhcpPrimaryDN pres,eq olcDbIndex: dhcpSecondaryDN pres,eq olcDbIndex: dhcpServerDN pres,eq olcDbIndex: dhcpFailOverPeerDN pres,eq olcDbIndex: dhcpHWAddress pres,eq olcDbNoSync: TRUE olcDbCheckpoint: 1024 5 olcDbCacheSize: 5000 olcDbIDLcacheSize: 5000 olcSyncrepl: {0}rid=001 provider=ldap://ldap-test1.carina.griddynamics.net bindmetho d=simple timeout=1 network-timeout=0 binddn="cn=manager,dc=griddynamics,dc=ne t" credentials="xxxxxxxxxxx" starttls=no filter="(objectclass=*)" searchbase="dc =griddynamics,dc=net" scope=sub schemachecking=off type=refreshAndPersist ret ry="10 +" olcDbConfig: {0}set_flags DB_LOG_AUTOREMOVE olcDbConfig: {1}set_cachesize 0 33554432 0 entryCSN: 20091121172900.646924Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20091121172900Z

1 0

Exception handling!!!
by Pratima Shet 23 Apr '10

23 Apr '10

Sorry, this is the first time posting to any forum, So, am missing important data. Below is the, part of code where am initializing and binding connection with the server. res = ldap_initialize(&ld, ldapuri); if( res != LDAP_SUCCESS ) { char *errorM = NULL; errorM = ldap_err2string(res); if(errorM != NULL) // Print Error return NULL; } if(ld != NULL) { res = ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &protocol ); if(res == LDAP_OPT_SUCCESS) { if(ld != NULL) { res = ldap_start_tls_s(ld, NULL, NULL); if(res == LDAP_SUCCESS) { if(ld != NULL) { res = ldap_sasl_interactive_bind_s( ld, NULL,"NTLM", NULL, NULL, sasl_flags, saslInteract, &auth ); } } } else { //ld is null } } } And below is the backtrace of the crash. 0 liblber-2.3.0.dylib 0x007b9583 ber_sockbuf_ctrl + 147 1 libldap-2.3.0.dylib 0x007d25ad ldap_host_connected_to + 93 2 libldap-2.3.0.dylib 0x007c67f1 ldap_int_sasl_bind + 177 3 libldap-2.3.0.dylib 0x007c9064 ldap_sasl_interactive_bind_s + 84 4 myApp 0x003f54fb 0x1000 + 4146427 5 myApp 0x003f7e50 0x1000 + 4157008 6 com.apple.Foundation 0x94176ff1 __NSFireMachPort + 325 7 com.apple.CoreFoundation 0x94c03402 __CFMachPortPerform + 338 8 com.apple.CoreFoundation 0x94bff16b __CFRunLoopRun + 6523 9 com.apple.CoreFoundation 0x94bfd0f4 CFRunLoopRunSpecific + 452 10 com.apple.CoreFoundation 0x94bfcf21 CFRunLoopRunInMode + 97 11 com.apple.Foundation 0x9414f380 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 279 12 com.apple.Foundation 0x9414f25d -[NSRunLoop(NSRunLoop) run] + 76 13 com.polycom.CMADesktop 0x003f4c53 0x1000 + 4144211 14 com.apple.Foundation 0x941158dc -[NSThread main] + 45 15 com.apple.Foundation 0x9411588c __NSThread__main__ + 1499 16 libSystem.B.dylib 0x965d5a19 _pthread_start + 345 17 libSystem.B.dylib 0x965d589e thread_start + 34

3 2

Exception handling!!!
by Pratima Shet 22 Apr '10

22 Apr '10

Hi, Sorry for insufficient information. In brief,am trying to connect to LDAP server using following api's res = ldap_initialize(&ld, ldapuri); res = ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &protocol ); res = ldap_start_tls_s(ld, NULL, NULL); res = ldap_sasl_interactive_bind_s( ld, NULL, "NTLM", NULL, NULL,sasl_flags, saslInteract, &auth ); My code normally works fine, but in one senario after TLS, it crashed inside ldap_sasl_interactive_bind_s() API. Crash report says it crashed in "ber_sockbuf_ctrl + 147" inside "liblber" library. I think, it is possible to avoid the crash, If I could catch exceptions from library. Any idea? Thanks and regards, Pratima

2 3

ppolicy
by Frank Swasey 22 Apr '10

22 Apr '10

We are setting up a new service that is going to actually hold passwords in the OpenLDAP database instead of using Kerberos (via sasl and saslauthd). To that end, I'm investigating ppolicy. However, what I haven't found in the man page (slapo-ppolicy), or the Admin Guide, or the FAQ-O-Matic is whether I need to configure ppolicy on the master and the replicas or just the master. My assumption is that I need to set up ppolicy on the replicas as well as the master -- otherwise those pwd* operational attributes are not going to be legal on the replica and I'll get in trouble. I haven't set up a test environment with a replica yet -- so, I'm asking here. I also see in the FAQ that ppolicy only works on OpenLDAP versions greater than 2.3 (item 2 of the ppolicy checklist). So, I'm sensing that ppolicy in OpenLDAP v2.3.x is not really completely functional? Am I reading too much into the entry in the FAQ? -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

3 2

Re: syncrepl's "retry" option
by Quanah Gibson-Mount 21 Apr '10

21 Apr '10

--On Tuesday, April 20, 2010 5:34 PM -0400 Ryan Steele <ryans(a)aweber.com> wrote: > The FAQ indicates that the 'retry' option should be a comma-separated > list: http://www.openldap.org/faq/data/cache/1118.html > > > However, all of the examples from the section on replication in the Admin > Guide seem to show them as being space-delimited values: > http://www.openldap.org/doc/admin24/replication.html#Syncrepl > > > Which is correct? Both. If you examine the source, you find: slap_str2clist( &retry_list, val, " ,\t" ); i.e., it accepts a space, a comma, or a tab, as delimiters. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

4 8

syncrepl's "retry" option
by Ryan Steele 20 Apr '10

20 Apr '10

The FAQ indicates that the 'retry' option should be a comma-separated list: http://www.openldap.org/faq/data/cache/1118.html However, all of the examples from the section on replication in the Admin Guide seem to show them as being space-delimited values: http://www.openldap.org/doc/admin24/replication.html#Syncrepl Which is correct? Thanks, Ryan

1 0

Exception handling!!!
by Pratima Shet 20 Apr '10

20 Apr '10

Hi all, I am using openldap library in Mac os ( Snow leopard). Some time, my code crashes inside the "liblber". I am using ldap_start_tls_s(). I think ldap_start_tls_s() is corrupting the ldap handle. How can I catch the exceptions from the library? In some link I found out that It supports exception handling. thanks and regards, Pratima

2 1

ldapsearch and international coded characters
by Luis Neves 20 Apr '10

20 Apr '10

Hi there, This is my first post on this list, please if be gentle if I make any mistake agains the list rules, but I think it will not be the case Iam trying to use mod_authz_ldap in apache to authenticate users against an openldap directory which contains some fields from a X.509 users certificates. Theres a subjetDN field on the directory that contains this data: issuerDN: /C=PT/O=Cart\xC3\xA3o de Cidad\xC3\xA3o/OU=subECEstado/CN=EC de Aute ntica\xC3\xA7\xC3\xA3o do Cart\xC3\xA3o de Cidad\xC3\xA3o 0003 Its a base64 coded string, equivalent to "Cartão de Cidadão" and "Autenticação do Cartão de Cidadão 0003" the problem is that, mod_authz_ldap is returning "bad search filter" when it tries to query the ldap directory with this data Testing using ldapsearch I have exactly the same problem so I thing they are related: if i make this search: ldapsearch -x -h ****** -p 389 -D "cn=******" -w **** -s sub -b "ou=AuthzLDAPCertmap,dc=cm-lisboa,dc=pt" "(issuerDN=/C=PT/O=Cart\xC3\xA3o de Cidad\xC3\xA3o/OU=subECEstado/CN=EC de Autentica\xC3\xA7\xC3\xA3o do Cart\xC3\xA3o de Cidad\xC3\xA3o 0003)" I get the (-7) Bad Search Filter error if i strip all the '\x' from the search filter, i dont get the error but of course it returns nothing as well. Can somebody help me? how can i do this kind of search with ldapsearch and how can I use mod_authz_ldap when theres users outhere who has accented characters on their certificates?? Regards Luis _________________________________________________________________ Hotmail: Powerful Free email with security by Microsoft. https://signup.live.com/signup.aspx?id=60969

1 0

Re: ACLs - match FDN to portion of attribute
by Sergiy Stepanenko 19 Apr '10

19 Apr '10

On 04/19/2010 04:04 PM, masarati(a)aero.polimi.it wrote: >> Hi Andrew >> I finally figured it out and here is what I did: >> >> ACL >> ----- >> access to attrs=uofsGroupRole val.regex="^([^:]+):.+$" >> by dn.exact,expand="${v1}" read >> by * none >> >> Only attribute that contains users' dn within its value is available to >> said user. It works exactly the way I want it. Only difference from >> documentation is "${v1}" which explained here: >> http://www.openldap.org/lists/openldap-bugs/200811/msg00078.html if you >> are interested... > > I've documented this feature in slapd.access(5), as part of ITS#5804. > > Thanks, p. > > My pleasure. -- Sergiy Stepanenko Systems Administrator Information Technology Services University of Saskatchewan ----------------------------------- phone: (306) 966-2762 email:sergiy.stepanenko@usask.ca

1 0

ACLs - match FDN to portion of attribute
by Sergiy Stepanenko 19 Apr '10

19 Apr '10

Hello everybody, I am in need of a good advice. I have a problematic spot in my ACL and so far i can not figure out what to do with it. This is what needs to be accomplished: an Entry has attribute uofsGroupRole that may contain values like : uid=some_user, ou=nsids,ou=people,dc=usask,dc=ca:some_role only user with matching uid may see this attribute and its value. I tried : access to attrs=uofsGroupRole val.regex="uid=([^,]+),ou=nsids,ou=people,dc=usask,dc=ca.*$" by dn.regex="uid=$1,ou=nsids,ou=people,dc=usask,dc=ca$" read And it did not work as required. I know the problem in regex, but I can not find it. Any suggestions are greatly appreciated. Cheers -- Sergiy Stepanenko Systems Administrator Information Technology Services University of Saskatchewan ----------------------------------- phone: (306) 966-2762 email:sergiy.stepanenko@usask.ca

3 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software April 2010