openldap-software

openldap-software@openldap.org

2719 discussions

US ECCN and AL Number/EU ECCN for OpenLDAP 2.3.31
by joerg.rockel＠nsn.com 11 Jun '08

11 Jun '08

Hi, We are using OpenLDAP 2.3.31 in one of our products, and are now in the process of collecting the information needed to export it to other countries. Can you tell me what the U.S. Export Control Classification Number(ECCN) for OpenLDAP 2.3.31 is, and whether a license exception may be used for it? If you don't know the US ECCN, can you tell me whether any US citizens or people living in the U.S.A. have contributed code to OpenLDAP 2.3.31 ? In addition to the U.S. ECCN, there is also a German "ECCN", which is called the AL Number or EU-ECCN. Can you tell me what the AL or EU-ECCN Number is for OpenLDAP 2.3.31? To better understand the meaning of the U.S. ECCN, please check the following webpage: http://www.bis.doc.gov/Licensing/Do_I_NeedAnECCN.html Many thanks, Jörg Rockel _______________________________________ www.nokiasiemensnetworks.com <http://www.nokiasiemensnetworks.com/> Nokia Networks GmbH Heltorfer Str.1 D-40472 Düsseldorf Germany Mobile: +49(0)151 5515 3554 Direct: +49 (0)151 5515 3554 Fax: +49 (0) 211 9412 3383 email: Jörg Rockel(a)nsn.com <mailto:joerg.rockel@nsn.com> Jörg Rockel Senior Software Design Engineer Research & Development _______________________________________ This message is confidential. If you have received this message in error, please delete it from your system. You should not copy it for any purpose, or disclose its contents to any other person. Internet communications are not secure and therefore Nokia GmbH does not accept legal responsibility for the contents of this message as it has been transmitted over a public network. Thank you. Nokia Networks GmbH Sitz der Gesellschaft: Bochum Amtsgericht Bochum: HRB 11180 Ust-Id.-Nr./ VAT ID: DE814765854 WEEE-Reg.-Nr. DE 51797011 Geschäftsführer: Dr. Ulrich Halka Nokia Networks GmbH arbeitet auf Rechnung der Nokia Siemens Networks Nokia Networks GmbH operates for the account of Nokia Siemens Networks

4 3

enumeratin all ldap objects in a LDAP ?
by Michael Arndt 11 Jun '08

11 Jun '08

Hello *, what is a "good" way to enumerate all objects in an open ldap in order to get a total count of defined objects ? ( how many objects ..) TIA Michael PS: Sorry if i should know this by reading basic infos -- Vorstand/Board of Management: Dr. Bernd Finkbeiner, Dr. Florian Geyer, Dr. Roland Niemeier, Dr. Arno Steitz, Dr. Ingrid Zech Vorsitzender des Aufsichtsrats/ Chairman of the Supervisory Board: Prof. Dr. Hanns Ruder Sitz/Registered Office: Tuebingen Registergericht/Registration Court: Stuttgart Registernummer/Commercial Register No.: HRB 382196

5 4

automatic uidnumber overlay
by Joel Reed 11 Jun '08

11 Jun '08

The attached uidnumber.c overlay intercepts ADD requests for entries with a posixAccount objectclass that do not have a uidNumber. When such ADD requests are found, the overlay searches the directory for the largest uidNumber, then automatically adds a uidNumber attribute of largest+1 to the entry being added. This overlay was made possible by copying and pasting lots of code from David Hawes' addpartial.c. This is my first time ever using the openldap API, so any feedback for improvement is greatly appreciated. jr OPENLDAP_SRC=/home/jreed/src/slapd/openldap2.3-2.4.7 CPPFLAGS+=-I${OPENLDAP_SRC}/include -I${OPENLDAP_SRC}/servers/slapd -I${OPENLDAP_SRC}/debian/build/include/ LDFLAGS+=-L/usr/local/openldap-2.4.9 CC=gcc all: uidnumber.so uidnumber.so: uidnumber.c $(CC) -shared $(CPPFLAGS) $(LDFLAGS) -Wall -o $@ $? clean: rm uidnumber.so ######################################################### # the rest of this makefile was used for testing purposes # YMMV TEST_ARGS=-x -D cn=admin,o=root -y ~/.ds.pwd install: uidnumber.so sudo /etc/init.d/slapd stop sudo cp -v $^ /usr/lib/ldap/ sudo /etc/init.d/slapd start uninstall: rm -fv /usr/lib/ldap/uidnumber.so test: ldapadd $(TEST_ARGS) -f test.ldif testclean: ldapdelete $(TEST_ARGS) "uid=jane2.doe(a)visn.biz,ou=users,dc=nviznit,dc=com,o=root" ldapdelete $(TEST_ARGS) "uid=jane3.doe(a)visn.biz,ou=users,dc=nviznit,dc=com,o=root" ldapdelete $(TEST_ARGS) "uid=jane4.doe(a)visn.biz,ou=users,dc=nviznit,dc=com,o=root"

9 10

Adding additional schema - objectClass: value #1 invalid per syntax
by Ed Greenberg 10 Jun '08

10 Jun '08

Hi folks, I added the following to my schema directory: dn: cn=schema attributeTypes: ( 1.3.6.1.4.1.15953.9.1.1 NAME 'sudoUser' DESC 'User(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' ) attributeTypes: ( 1.3.6.1.4.1.15953.9.1.2 NAME 'sudoHost' DESC 'Host(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' ) attributeTypes: ( 1.3.6.1.4.1.15953.9.1.3 NAME 'sudoCommand' DESC 'Command(s) to be executed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' ) attributeTypes: ( 1.3.6.1.4.1.15953.9.1.4 NAME 'sudoRunAs' DESC 'User(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' ) attributeTypes: ( 1.3.6.1.4.1.15953.9.1.5 NAME 'sudoOption' DESC 'Options(s) followed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' ) objectClasses: ( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' SUP top STRUCTURAL DESC 'Sudoer Entries' MUST ( cn ) MAY ( sudoUser$ sudoHost $ sudoCommand $ sudoRunAs $ sudoOption $ description ) X-ORIGIN 'SUDO' ) and referenced it in slapd.conf as: include /etc/openldap/schema/sudoers.schema When I try to add this: dn: cn=SU_WGADMIN,ou=SUDOers,dc=geni,dc=com sudoHost: +srv-web sudoHost: +srv-rs sudoHost: +srv-memc sudoHost: +srv-db sudoHost: +srv-admin sudoHost: +srv-office sudoHost: +srv-solr sudoHost: +srv-sn sudoCommand: /bin/su - wgadmin sudoCommand: /bin/su -l wgadmin sudoCommand: /bin/su -l qa sudoCommand: /bin/su - qa sudoOption: !authenticate objectClass: top objectClass: sudoRole cn: SU_WGADMIN sudoUser: +ppl-eng sudoUser: +fp-automation I get the error: add sudoHost: +srv-web +srv-rs +srv-memc +srv-db +srv-admin +srv-office +srv-solr +srv-sn add sudoCommand: /bin/su - wgadmin /bin/su -l wgadmin /bin/su -l qa /bin/su - qa add sudoOption: !authenticate add objectClass: top sudorole add cn: SU_WGADMIN add sudoUser: +ppl-eng +fp-automation adding new entry "cn=SU_WGADMIN,ou=SUDOers,dc=geni,dc=com" modify complete ldap_add: Invalid syntax (21) additional info: objectClass: value #1 invalid per syntax Trimming things down to just dn: cn=SU_WGADMIN,ou=SUDOers,dc=geni,dc=com objectClass: top objectClass: sudoRole cn: SU_WGADMIN produces the same error, which makes sense. Reversing top and sudoRole migrates the error from value #1 to value #0, which also makes sense. On reviewing the list of available objectClasses with the GQ application, I can't find the objectClass sudoRole, although I _can_ find the five attributes, in the attribute list. I can't find a log that might tell me what is being loaded, and slapd starts without error. I also can't figure out how to dump the schemas with ldapsearch or any other command, so I can check to see for myself what's in there. Can anybody tell me what might be wrong, or how to continue to investigate the problem? Thanks, </edg>

5 6

Re: Pls help:delete missing in multi-master environment
by Gavin Henry 10 Jun '08

10 Jun '08

ST Wong (ITSC) wrote: > Hi, > > Just upgraded to 2.4.10. Seems the problem persists. The problem can > be simulated by running copies of perl script to add/delete the same set > of users simultaneously, e.g. > > add a001 - a100 & > delete a001 - a100 & > > or > > add a100 - a100 & > add a100 - a100 & > > There is no problem if multiple threads of add/delete are running, when > operating on different sets of users. Thanks. > Can you please file an ITS with all your details etc. Thanks. -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

Don't proxy search references
by Andrew Graham 10 Jun '08

10 Jun '08

*** Before acting on this email or opening any attachment you are advised to read the disclaimer at the end of this email *** Hi All, When using the meta backend to amalgamate many ldap servers, is there an option I can set to stop openldap from propagating search references sent from the targets? Thanks is advance! Best Regards, Andrew Graham Andrew Graham AgustaWestland UK andrew.graham(a)agustawestland.com *** Disclaimer *** The information contained in this E-Mail and any subsequent correspondence may be subject to the Export Control Act (ECA) 2002. The content is private and is intended solely for the recipient(s). For those other than the recipient any disclosure, copying, distribution, or action taken, or omitted to be taken, in reliance on such information is prohibited and may be unlawful. If received in error please return to sender immediately. Under the laws of England misuse of information that is subject to the ECA 2002, is a criminal offence. Westland Helicopters Ltd Lysander Road Yeovil BA20 2YB England Registered in England under No 604352

1 0

does slapadd create a corrupt ldap-database?
by openldap 09 Jun '08

09 Jun '08

hi every upgrading to fedora 9, which comes with penldap-servers-2.4.8-3.fc9.i386 using sleepycat as backend db. from the last backup i took the slapcat of the ldap database for new creation on the fedora 9 server. ./slapadd -c -l slapcat.file.ldif /etc/init.d/ldap start first connections to the ldap-server were successful, searches also. then, i locally used the ldap-server for pam-ldap by changing the server uri in /etc/ldap.conf accordingly. and as far as pam-ladp is concerned, nothing worked as expected. it took me 6 hours to find out that the index in the ldap database for the attribute uidNumber had not been created. i stopped slapd ./slapindex -c i restarted slapd. now, pam-ldap works as expected. suomi

2 1

SIGSEV in slapd (ad.c) on Solaris 10
by Duncan Brannen 09 Jun '08

09 Jun '08

I'm still seeing SIGSEV's regularly on the busier of our ldap servers (800K connections/day, 20-20K search ops per connection) What I can't get is a reproducible case. It happens far more often on the busier server and not at all on the least loaded servers. It's only happening under SPARC, using the debian install on x86 hardware seems stable. Any pointers for getting a reproducable case, and what should I be trying to get out of the core files above the basic trace below? (Parse the logfiles with perl and replay?) If anyone else is using a recent 2.3.x or 2.4 build on Solaris, can they tell me if my build environment is sane before I try upgrading to 2.4.10? Cheers, Duncan DB_CONFIG # set_cachesize 0 209715200 1 set_lg_dir /trans_logs set_lg_regionmax 262144 set_lg_bsize 2097152 set_lg_max 16777216 set_tmp_dir /tmp set_flags DB_LOG_AUTOREMOVE --- Build Environment LDFLAGS=-R/usr/sfw/lib:/usr/local/ssl/lib:/usr/local/lib -L/usr/local/lib -L/usr/local/ssl/lib -L/usr/sfw/lib CPPFLAGS=-I/usr/local/include -I/usr/local/ssl/include -I/usr/sfw/include LD=/usr/ccs/bin/ld -R/usr/sfw/lib:/usr/local/ssl/lib:/usr/local/lib setenv PATH "/usr/ccs/bin/:/usr/bin:/bin:/usr/sbin:/opt/local/bin:/usr/sfw/bin:/usr/local/bin" setenv LDFLAGS "-R/usr/sfw/lib:/usr/local/ssl/lib:/usr/local/lib -L/usr/local/lib -L/usr/local/ssl/lib -L/usr/sfw/lib" setenv CPPFLAGS "-I/usr/local/include -I/usr/local/ssl/include -I/usr/sfw/include" setenv LD "/usr/ccs/bin/ld -R/usr/sfw/lib:/usr/local/ssl/lib:/usr/local/lib" --- Configured with ./configure --disable-ipv6 --with-cyrus-sasl --with-tls --enable-dynamic --enable-slapd --enable-modules --enable-spasswd --enable-rewrite --enable-rlookups --enable-wrappers --enable-hdb --enable-monitor --disable-shell --disable-sql --enable-overlays=mod --enable-crypt --- Compiled with gcc 3.4.3, I've tried Sun Studio as well but experienced similar crashes. dbx gives me the following output For information about new features see `help changes' To remove this message, put `dbxenv suppress_startup_message 7.4' in your .dbxrc Reading slapd core file header read successfully Reading ld.so.1 Reading libldap_r-2.4.so.2.0.4 Reading liblber-2.4.so.2.0.4 Reading libltdl.so.3.1.5 Reading libdb-4.6.so Reading librt.so.1 Reading libpthread.so.1 Reading libicuuc.so.2 Reading libicudata.so.2 Reading libsasl2.so.2.0.22 Reading libdl.so.1 Reading libssl.so.0.9.8 Reading libcrypto.so.0.9.8 Reading libresolv.so.2 Reading libgen.so.1 Reading libnsl.so.1 Reading libsocket.so.1 Reading libc.so.1 Reading libgcc_s.so.1 Reading libgcc_s.so.1 Reading libaio.so.1 Reading libmd5.so.1 Reading libm.so.2 Reading libCrun.so.1 Reading libc_psr.so.1 Reading libgssapiv2.so.2.0.22 Reading libgssapi.so.4.0.0 Reading libkrb5.so.17.4.0 Reading libasn1.so.6.1.0 Reading libroken.so.16.1.0 Reading libcom_err.so.1.1.3 Reading libncurses.so.5.4 Reading libdoor.so.1 Reading libscf.so.1 Reading libuutil.so.1 Reading libmd5_psr.so.1 Reading libmp.so.2 Reading liblogin.so.2.0.22 Reading libplain.so.2.0.22 Reading syncprov-2.4.so.2.0.4 t@1 (l@1) terminated by signal KILL (Killed) 0xfe4bd61c: __lwp_wait+0x0008: bcc,a,pt %icc,__lwp_wait+0x18 ! 0xfe4bd62c Current function is slapd_daemon 2644 ldap_pvt_thread_join( listener_tid, (void *)NULL ); (dbx) threads > t@1 a l@1 ?() LWP suspended in __lwp_wait() t@3 a l@3 slapd_daemon_task() LWP suspended in __pollsys() t@4 a l@4 ldap_int_thread_pool_wrapper() sleep on 0x1dad38 in __lwp_park() t@5 a l@5 ldap_int_thread_pool_wrapper() sleep on 0x1dad38 in __lwp_park() t@6 a l@6 ldap_int_thread_pool_wrapper() sleep on 0x1dad38 in __lwp_park() t@7 a l@7 ldap_int_thread_pool_wrapper() LWP suspended in ch_malloc() t@8 a l@8 ldap_int_thread_pool_wrapper() sleep on 0x1dad38 in __lwp_park() t@9 a l@9 ldap_int_thread_pool_wrapper() sleep on 0x1dad38 in __lwp_park() t@10 a l@10 ldap_int_thread_pool_wrapper() sleep on 0x1dad38 in __lwp_park() t@11 a l@11 ldap_int_thread_pool_wrapper() sleep on 0x1dad38 in __lwp_park() t@12 a l@12 ldap_int_thread_pool_wrapper() sleep on 0x1dad38 in __lwp_park() o t@13 a l@13 ldap_int_thread_pool_wrapper() signal SIGSEGV in is_ad_subtype() (dbx) thread t@13 t@13 (l@13) stopped in is_ad_subtype at line 489 in file "ad.c" 489 for ( a = sub->ad_type; a; a=a->sat_sup ) { (dbx) where current thread: t@13 =>[1] is_ad_subtype(sub = (nil), super = 0x1f81b0), line 489 in "ad.c" [2] attrs_find(a = 0x499014, desc = 0x1f81b0), line 647 in "attr.c" [3] test_ava_filter(op = 0x6645a90, e = 0x25738c, ava = 0x9eddee4, type = 163), line 615 in "filterentry.c" [4] test_filter(op = 0x6645a90, e = 0x25738c, f = 0x9eddf04), line 98 in "filterentry.c" [5] hdb_search(op = 0x6645a90, rs = 0xe87ffcb8), line 845 in "search.c" [6] overlay_op_walk(op = 0x6645a90, rs = 0xe87ffcb8, which = 32768, oi = 0x15c540, on = 0x8000), line 653 in "backover.c" [7] over_op_func(op = 0x6645a90, rs = 0xe87ffcb8, which = op_search), line 705 in "backover.c" [8] fe_op_search(op = 0x6645a90, rs = 0xe87ffcb8), line 368 in "search.c" [9] do_search(op = 0x6645a90, rs = 0xe87ffcb8), line 217 in "search.c" [10] connection_operation(ctx = 0xe87ffe08, arg_v = 0x6645a90), line 1084 in "connection.c" [11] connection_read_thread(ctx = 0xe87ffe08, argv = 0xe), line 1211 in "connection.c" [12] ldap_int_thread_pool_wrapper(xpool = 0x1dad18), line 625 in "tpool.c" (dbx) lsit lsit: not found (dbx) list 489 for ( a = sub->ad_type; a; a=a->sat_sup ) { 490 if ( a == super->ad_type ) break; 491 } 492 if( !a ) { 493 return 0; 494 } 495 496 /* ensure sub does support all flags of super */ 497 lr = sub->ad_tags.bv_len ? SLAP_DESC_TAG_RANGE : 0; 498 if(( super->ad_flags & ( sub->ad_flags | lr )) != super->ad_flags ) { (dbx) print *a dbx: reference through nil pointer (dbx) quit -- The University of St Andrews is a charity registered in Scotland : No SC013532

1 0

Re: can syncrepl do this?
by Michael Ströder 09 Jun '08

09 Jun '08

Stefano, please stay on the mailing list. Stefano Zanmarchi wrote: > On Fri, Jun 6, 2008 at 7:04 PM, Michael Ströder <michael(a)stroeder.com> wrote: >> Stefano Zanmarchi wrote: >>> I need to replicate in my local openldap server all the entries in a >>> given subtree of a >>> remote openldap server, but the two DITs differ. >>> That means I'd like to replicate all entries under >>> "dc=people,dc=A,dc=it" (remote server) >>> to "dc=employees,dc=B,dc=it" (local server). >>> >>> Can syncrepl do that? Or is there another way to obtain this? >> Some setup with slapo-rwm comes to mind. > so I believe this means syncrepl can't map a DIT fragment onto a DIT fragment > with a different suffix. Yes. But since syncrepl works with search requests one could try to map things with slapo-rwm. But note that it can get tricky. I didn't try that my self. Maybe it would be easier to consolidate name spaces. You could also replicate the original name space and then map search requests at your local server to the name spaces wanted. Ciao, Michael.

1 0

StartTLS with a host alias
by Robert Minsk 07 Jun '08

07 Jun '08

My cert on my LDAP server contains multiple commonName entries. > openssl x509 -noout -in s014-ldap-cert.pem -subject subject= /C=US/ST=California/O=FooBar/CN=s014.cgi.foobar.com/CN=ldap1.cgi.foobar.com/CN=s14.cgi.foobar.com The LDAP server FQHN is s014.cgi.foobar.com and has aliases of ldap1.cgi.foobar.com and s14.cgi.foobar.com. All hostname resolution is done with our internal DNS servers and they all have the correct FQHN and aliases. On my secondary mirror LDAP server I have syncrepl setup to use the hostname alias ldap1.cgi.foobar.com syncrepl ... provider=ldap://ldap1.cgi.foobar.com starttls=critical ... and that works fine. When I have my ldap.conf with: URI ldap://s014.cgi.foobar.com the command "ldapsearch -x -ZZ" works just fine. When I change my ldap.conf to: URI ldap://ldap1.cgi.foobar.com the command "ldapsearch -x -ZZ" returns ldap_start_tls: Connect error (-11) additional info: TLS: hostname does not match CN in peer certificate. It seems the openldap library is only checking the first CN in the certificate and not all the others. Is there any way to have it check the other CN entries in the cert?

3 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software