openldap-software

openldap-software@openldap.org

2719 discussions

delta-syncrepl contextCSN update timing, schema checking
by John Morrissey 05 May '08

05 May '08

Recently, a fluke in our configuration distribution system caused one of our consumers (running 2.3.41) to have stale schema information. slapd at debuglevel 16384 emitted: syncrepl_message_to_op: rid 001 mods check (objectClass: value #0 invalid per syntax) We had *not* specified schemachecking in this syncrepl stanza, and slapd.conf(5) says: The schema checking can be enforced at the LDAP Sync consumer site by turning on the schemachecking parameter. The default is off. Should this error have been raised in this case? I tried explicitly disabling schemachecking ("schemachecking=off" in the syncrepl stanza), but this error was still raised. Once the schema was updated appropriately, I started slapd (again at debuglevel 16384) and saw syncrepl operations being successfully executed: syncrepl_message_to_op: rid 001 be_modify uid=example,[...],o=org (0) Thinking all was well, I ^C'd slapd, and slapd shut itself down successfully. I restarted slapd using an init script, but the backend's contextCSN didn't start incrementing. Once again at debuglevel 16384: null_callback: error code 0x10 syncrepl_message_to_op: rid 001 be_modify uid=bad-objectclass,[...],o=org (16) do_syncrepl: rid 001 retrying (29 retries left) uid=bad-objectclass is the same entry that triggered the schemachecking error in the first place. Error 0x10 is LDAP_NO_SUCH_ATTRIBUTE, and this seems a lot like the symptoms described in this thread: http://www.openldap.org/lists/openldap-software/200801/msg00126.html To make a long story short, it seems that syncrepl doesn't update the backend's contextCSN until it's processed its backlog? To check, I stopped another consumer and let a backlog build, then started it at debuglevel 16384 and watched the backend's contextCSN with ldapsearch(1). contextCSN didn't increment until the backlog was completely processed, even though I could see the changes it was processing with ldapsearch(1) as soon as they were processed. If a consumer processes replication without updating the backend's contextCSN, it will try to re-process the same replication entries when it starts up again, which will generally fail. This seems to leave one in a bind, either having to manually determine the correct value for contextCSN and update it manually, or remove the backend's data files and let syncrepl rebuild them from scratch. If this assessment is correct, this behavior doesn't seem desirable. john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

3 7

result: 32 No such object
by Arjan Hulshoff 05 May '08

05 May '08

Hi all, I am trying to learn how to use OpenLDAP in combination with Cyrus SASL and MIT Kerberos 5. While testing I got the following error: result: 32 No such object. Below you can see that the response with simple bind works flawless, but as soon as I am trying to use SASL and Kerberos I get the previous mentioned response. Everything I could find on google didn't help. So I hope someone can point me in the right direction. I am not sure what extra information you need. I am clueless as you might have understood. TIA, Arjan. [root@ldapserver ~]# ldapsearch -ZZ -W -D 'cn=Manager,dc=example,dc=com' -s base -x Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=example,dc=com> (default) with scope baseObject # filter: (objectclass=*) # requesting: ALL # # example.com dn: dc=example,dc=com description: Example.Com, your trusted non-existent corporation. dc: example o: Example.Com objectClass: top objectClass: dcObject objectClass: organization # search result search: 3 result: 0 Success # numResponses: 2 # numEntries: 1 [root@ldapserver ~]# ldapsearch -ZZ -W -D 'cn=Manager,dc=example,dc=com' -s base Enter LDAP Password: SASL/GSSAPI authentication started SASL username: matt(a)EXAMPLE.COM SASL SSF: 56 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <dc=example,dc=com> (default) with scope baseObject # filter: (objectclass=*) # requesting: ALL # # search result search: 5 result: 32 No such object # numResponses: 1

2 2

Re: Tony Earnshaw, 29/02/40 - 29/04/08]
by Dieter Kluenter 05 May '08

05 May '08

Hello, the following has been posted on the postfix-users mailinglist. -Dieter > From: Ace Suares <ace(a)suares.an> > Subject: Tony Earnshaw, 29/02/40 - 29/04/08 > To: postfix-users(a)postfix.org > Date: Sun, 4 May 2008 09:24:59 -0400 > Reply-To: ace(a)suares.an > > > > Dear List, > > Tony Earnshaw, active member of this list, has passed away last Tuesday. > > About a month ago he was diagnosed with stage 5 lung cancer and within a > very short time Tony left us. > > Tony's body will be cremated Monday 5th of May in Amsterdam. > > For those who want to express their feelings, please visit > > http://www.xs4all.nl/~snore/tony > > If among you there are people who want to have more information, send me > an email at ace(a)suares.an and I will forward it to the kind people that > take care of his affairs. > > With Sadness, > > Ace Suares > > > ---------- -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6

1 0

A question about {CLEARTEXT} hash
by Anderson Medeiros Gomes 02 May '08

02 May '08

I am using OpenLDAP 2.4.7 in an Ubuntu 8.04 server. I have in my tree an user whose "userPassword" attribute is "{CLEARTEXT}testpass". This command works: $ ldapwhoami -U testuser -w testpass SASL/DIGEST-MD5 authentication started SASL username: testuser SASL SSF: 128 SASL data security layer installed. dn:uid=testuser,ou=people,dc=cefetrs,dc=tche,dc=br But I don't know why this one doesn't work... $ ldapwhoami -x -D 'uid=testuser,ou=people,dc=cefetrs,dc=tche,dc=br' -w testpass ldap_bind: Invalid credentials (49) The command above works only after removing the "{CLEARTEXT}" string before the real password: $ ldapmodify -U testuser -w testpass SASL/DIGEST-MD5 authentication started SASL username: testuser SASL SSF: 128 SASL data security layer installed. dn: uid=testuser,ou=people,dc=cefetrs,dc=tche,dc=br changetype: modify replace: userPassword userPassword: testpass modifying entry "uid=testuser,ou=people,dc=cefetrs,dc=tche,dc=br" $ ldapwhoami -x -D 'uid=testuser,ou=people,dc=cefetrs,dc=tche,dc=br' -w testpass dn:uid=testuser,ou=people,dc=cefetrs,dc=tche,dc=br ------------------- My doubt is: if an user have his password set to "{CLEARTEXT}<real password>", it should be able to authenticate itself either with simple authentication or with SASL, doesn't it? -- Anderson Medeiros Gomes amg1127(a)cefetrs.tche.br Coordenadoria de Manutenção e Redes Centro Federal de Educação Tecnológica de Pelotas http://www.cefetrs.tche.br/

1 0

overlay "syncprov" not found
by Jonathan Dobbie 01 May '08

01 May '08

I'm trying to set up syncprov on Ubuntu's 2.4.7, but slaptest returns: root@higgsboson:~# slaptest overlay "syncprov" not found slaptest: bad configuration file! As far as I can tell, the module is there: root@higgsboson:~# ls /usr/lib/ldap/syncprov* /usr/lib/ldap/syncprov-2.4.so.2 /usr/lib/ldap/syncprov-2.4.so.2.0.3 / usr/lib/ldap/syncprov.la /usr/lib/ldap/syncprov.so Below is a slightly trimmed version of slapd.conf: allow bind_v2 readonly off include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /usr/local/etc/ldap/schema/samba.schema include /usr/local/etc/ldap/schema/apple.schema include /usr/local/etc/ldap/schema/mcadmail.schema include /usr/local/etc/ldap/schema/mcad.schema include /usr/local/etc/ldap/schema/mcad.radmind.schema TLSCACertificateFile /etc/ldap/ssl/higgsboson.pem TLSCertificateFile /etc/ldap/ssl/higgsboson.pem TLSCertificateKeyFile /etc/ldap/ssl/higgsboson.pem authz-regexp uid=([^,]*),cn=PLAIN,cn=auth uid= $1,dc=users,dc=accounts,dc=mcad,dc=edu sasl-secprops none pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 128 threads 10 modulepath /usr/lib/ldap moduleload back_bdb defaultsearchbase "dc=accounts,dc=ldap,dc=mcad,dc=edu" idletimeout 600 password-hash {SSHA} backend bdb database bdb suffix "dc=mcad,dc=edu" checkpoint 512 30 cachesize 2000 idlcachesize 6000 directory "/var/lib/ldap" index objectClass eq index cn,sn,uid pres,eq,approx,sub index givenName eq,sub index displayName eq,sub index mail,mailAlias eq,sub index activePopImap eq index activeSmtp eq index ceridianID eq index jenzabarID eq index ou eq index employeeNumber eq index employeeType eq index uidNumber,gidNumber eq index memberUid eq index macAddress eq index apple-generateduid eq index apple-group-realname eq index apple-computers eq index apple-mcxflags sub index apple-category eq index apple-networkview eq index apple-group-memberguid eq index apple-group-nestedgroup eq index entryUUID eq index entryCSN eq index mailbox eq overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 lastmod on And then all of the ACLs

4 5

Add attribute with static value to search results
by Andy Cobaugh 01 May '08

01 May '08

Is it possible to somehow add a statically defined attribute to all search results. For example, if I wanted to add "authAuthority: ;Kerberosv5;;" to all entries with "(objectClass=posixAccount)". I've looked at slapo-rwm, and its rwm-map directive, but that only seems to map one attribute to another. I'm thinking there must be a way to do this, or perhaps it would be simple enough add this functionality to slapo-rwm. It seems like this is something that could be fairly useful, so perhaps this should be considered a feature request. Note: I don't control the upstream ldap server in my organization (I'm using a local proxying server with the translucent overlay). I could add this attribute to every entry in the upstream server, but that's several tens of thousands of entries that I would need to locally modify. -- Andy Cobaugh

3 5

smbk5pwd causes seg fault/help compiling
by Bill Baird 29 Apr '08

29 Apr '08

I'm having some trouble trying to setup smbk5pwd. I am currently running CentOS 5 with the latest updates. OpenLDAP is version openldap-2.3.27-8.el5_1.3, I have it installed via RPM. To try to compile, I downloaded & installed the source rpm. That included a tgz file of the openldap's source. I extracted it and went to the contrib/slapd-modules/smbk5pwd directory. I edited the Makefile and set "SSL_INC=/usr/include/openssl", everything else appeared okay. I also had to run a "./configure" to get libtool created. **I think this might be where I screwed up...running a generic ./configure. How do I get the settings that the RPM was configured with? ** >From there, I ran make and got this error: *../../../include/ldap_defaults.h:35:25: error: ldap_config.h: No such file or directory* There was a ldap_config.hin file in that same directory, I renamed it ldap_config.h and was able to run make successfully. Did the following: *mkdir /usr/lib/ldap cp smbk5pwd.la /usr/lib/ldap cd .libs cp -r smbk5pwd.so* /usr/lib/ldap* Added it to my slapd.conf file: *moduleload /usr/lib/ldap/smbk5pwd.o overlay smbk5pwd* When I try to restart openldap, I get a segfault. If I comment out the "overlay..." line, it will start and work fine. The startup log looks fine until the segfault line: * slapd startup: initiated. /bin/bash: line 1: 27591 Segmentation fault /tmp/start-slapd.n27586* If anyone has any suggestions, that would great...thanks! --Bill

2 2

slow ldapsearch when binddn is not root
by Alexandre Biancalana 29 Apr '08

29 Apr '08

Hi list! My master ldapserver is a FreeBSD 6.2-STABLE running OpenLDAP 2.3.38 the directory have ~ 5000 entries that are users from samba and qmail. I experiencing a strange behavior with the search response time, here are two searches, one done with root dn and another with a user dn. # time ldapsearch -D uid=user,ou=Users,dc=mydomain,dc=com,dc=br -b ou=Users,dc=mydomain,dc=com,dc=br -W -x > /dev/null Enter LDAP Password: 101.71s real 0.59s user 0.11s system # time ldapsearch -D cn=root,dc=tempopar,dc=com,dc=br -b ou=Users,dc=mydomain,dc=com,dc=br -W -x > /dev/null Enter LDAP Password: 3.13s real 0.53s user 0.08s system Follow my slapd.conf: ##################### # slapd.conf start # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/samba.schema include /usr/local/etc/openldap/schema/qmail.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args #loglevel any #loglevel 160 sizelimit unlimited # Load dynamic backend modules: modulepath /usr/local/libexec/openldap moduleload back_hdb moduleload back_monitor moduleload smbk5pwd.so # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates limits dn.exact="cn=replicator,dc=mydomain,dc=com,dc=br" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited #limits dn.exact="cn=sambaadmin,dc=mydomain,dc=com,dc=br" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited access to attrs=sambaLogonTime by dn.exact="cn=logintimeupdator,dc=mydomain,dc=com,dc=br" write by * read access to * by dn.exact="cn=replicator,dc=mydomain,dc=com,dc=br" read by dn.exact="cn=qmail-ldap,dc=mydomain,dc=com,dc=br" read by * none break access to attrs=userPassword by self write by group.exact="cn=Sysadmins,dc=mydomain,dc=com,dc=br" write by * auth access to attrs=shadowLastChange by group.exact="cn=SysAdmins,dc=mydomain,dc=com,dc=br" write by self write by * read access to dn.regex="^(.*,)?ou=Computers,dc=mydomain,dc=com,dc=br$" by dn.exact="cn=sambaadmin,dc=mydomain,dc=com,dc=br" write by * read access to dn.regex="^(.*,)?ou=Domains,dc=mydomain,dc=com,dc=br$" by dn.exact="cn=sambaadmin,dc=mydomain,dc=com,dc=br" write by * read access to dn.regex="^(.*,)?ou=Idmap,dc=mydomain,dc=com,dc=br$" by dn.exact="cn=sambaadmin,dc=mydomain,dc=com,dc=br" write by * read access to dn.regex="^(.*,)?ou=Users,dc=mydomain,dc=com,dc=br$" by group.exact="cn=SysAdmins,dc=mydomain,dc=com,dc=br" write by self write by * read access to dn.regex="^(.*,)?ou=Groups,dc=mydomain,dc=com,dc=br$" by group.exact="cn=SysAdmins,dc=mydomain,dc=com,dc=br" write by self write by * read access to dn.regex="^(.*,)?cn=SysAdmins,dc=mydomain,dc=com,dc=br$" by group.exact="cn=SysAdmins,dc=mydomain,dc=com,dc=br" write #access to dn.regex="^(.+,)?uid=([^,]+),ou=addressbook,associatedDomain=([^,]+),ou=domains,o=<basedn>$" #access to dn.regex="^(.+,)?ou=Users,dc=mydomain,dc=com,dc=br$" # by group.exact="cn=SysAdmins,ou=Groups,dc=mydomain,dc=com,dc=br" write # by * read access to * by group.exact="cn=SysAdmins,dc=mydomain,dc=com,dc=br" write by anonymous auth by * read ####################################################################### # # database definitions # ####################################################################### # # access log # database hdb suffix cn=log cachesize 10000 checkpoint 128 5 rootdn "cn=root,dc=mydomain,dc=com,dc=br" directory "/var/db/openldap/cn=log/data" index reqStart eq index reqDN pres,eq index reqAuthzID pres,eq # # dc=mydomain,dc=com,dc=br # database hdb suffix "dc=mydomain,dc=com,dc=br" cachesize 10000 checkpoint 128 5 rootdn "cn=root,dc=mydomain,dc=com,dc=br" directory /var/db/openldap/dc=mydomain/data # # Overlays # overlay smbk5pwd smbk5pwd-enable samba overlay accesslog logdb cn=log logops writes logold (objectClass=posixAccount) logpurge 30+00:00 1+00:00 overlay syncprov syncprov-checkpoint 100 5 syncprov-sessionlog 200 # Indices to maintain index objectClass eq index cn pres,sub,eq index sn pres,sub,eq index uid pres,sub,eq index displayName pres,sub,eq index uidNumber eq index gidNumber eq index memberUID eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub index entryCSN,entryUUID eq index mailAlternateAddress pres,eq index mail pres,eq database monitor # # slapd.conf end ##################### Can my acl slowing the search too much ?? How can I improve then ? Any help is very appreciated Best Regards, Alexandre

4 4

make install makes bad binaries
by Pieter Donche 28 Apr '08

28 Apr '08

I want to update my OpenLDAP to 2.3.39 on my Sun Solaris 10 last year I installed OpenLDAP 2.3.32 without problem. All software requirements as specified in the README file are met (default prefix /usr/local used) # ./configure # make # make depend # make # make test # make install all succeed but $ /usr/local/bin/ldapsearch answers: Killed on the other hand, if I use the ldapsearch binary from my openldap-2.3.39 build directory: # ./clients/tools/ldapsearch succeeds and I can perform a search on my LDAP database returning the correct results.. I noticed a big difference in size between: -rwxr-xr-x 1 root root 457772 Apr 28 09:02 ./clients/tools/ldapsearch and -rwxr-xr-x 1 root root 1023664 Apr 28 09:27 /usr/local/bin/ldapsearch All the clients tools have that same size difference between the compiled versions in ./openldap-2.3.39/clients/tools/ldap* and the ones in /usr/local/bin/ldap* I also noted (from my notes of last year), that the installed versions of the 2.3.32 did not have such size differences... What changed in make install between 2.3.32 and 2.3.39 and how to fix this?

4 5

translucent_bind
by Julien Garnier 28 Apr '08

28 Apr '08

Hi, I have a translucent overlay on my ldap server (that add attributes to my ldap_relay server) I'd like to authenticate with password stored in my translucent server because I have no write acecs in ldap_relay. When I try to authenticate with my account, I got a ldap_bind: Invalid credentials (49) error I've tried all the encryptions method to encrypt userpassword I've tried to set userpassword serch in local server ( If I search for (userpassword=*) I have a correct answer, so user password search is realy do in the local server) but authentication doesn't work, I can see in log that request is send to the remote server. I there a way to tell local server to not send authentication request to remote server ? Sample of my local slapd.conf is at the end of this message Thanks Juju ################### # slapd.conf overlay translucent translucent_no_glue translucent_local ACMO,Service,corinfo,corcom,corform,corvalo,gxlab,corsecu,userPassword,Poste,shadowLastChange translucent_remote sn,GivenName,mail,street,Postalcode,l,ou uri ldap://ldap.cp.fr lastmod off acl-bind binddn="cn=admin,..." credentials="password"

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software