openldap-software

openldap-software@openldap.org

2719 discussions

Re: ldapsearch: not compiled with TLS support
by Dieter Kluenter 02 Apr '08

02 Apr '08

Hi, "Arkady Shoyhet" <Arkady.Shoyhet(a)aladdin.com> writes: > Hi, > > I have configured openldap 2.3.41 ,with the following command: ./configure > --prefix=/usr --with-tls --enable-cript --enable-syslog --sysconfdir=/etc > > Everything was OK. Then I called make depends and make install. Everything was > fine.Of course OPENSSL-0.9.8G configured and installed too. > > BerkleyDB 4.5.20 configured,installed and started by command ./slapd -h 'ldap: > // ldaps://' -d1. Everything fine. > > But when I try to run ldapsearch –Z then following error message is printed > out: ldapsearch: not compiled with TLS support. > > Why ? What can I do ? ldd slapd will show you wether it is linked with libssl. -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6

1 0

openldap on Centos 5.1 with TLS
by David Hláčik 02 Apr '08

02 Apr '08

Hi, sorry for the stupid question, but however i am following all howtos and tutorials it is not working 1) i have created CA certificate - /etc/pki/tls/misc/CA -newca 2) i have generated a new request - /etc/pki/tls/misc/CA -newreq 3) i have signed certificate /etc/pki/tls/misc/CA -signreq SO i have CA in /etc/pki/CA i have newkey.pem i have newcert.pem i have also cealrkey.pem (without passphrase) *$ openssl rsa < newkey.pem > clearkey.pem* What to do next?? What to put in slapd.conf in order to make it work?? What to put in ldap.conf in order to communicate Really thanks in advance!! David

3 4

Weird behavior
by Rick Stevens 01 Apr '08

01 Apr '08

Hi. I've got a weird one for you. System: CentOS 5, kernel 2.6.18-53.1.4 64-bit OpenLDAP: openldap-2.3.27 from RPM (openldap-servers-2.3.27-8.el5_1.3) I'm using OpenLDAP for authentication via pam_ldap and this is going to be the secondary server (if I can ever get replication to work). However, that's not the issue right now. This machine won't start LDAP unless I remove the "ldap" part from the "group" line of /etc/nsswitch.conf. Won't start: group: files ldap Will start: group: files There are no log messages indicating a problem. slapd simply won't start. Has anyone ever heard of such a screwup and if so, any ideas as to what the fark is going on? ---------------------------------------------------------------------- - Rick Stevens, Unix Geek rps2(a)socal.rr.com - - - - If this is the first day of the rest of my life... - - I'm in BIG trouble! - ----------------------------------------------------------------------

4 3

Problem with unsolicited notifications
by Tomas Hansut 01 Apr '08

01 Apr '08

Hi, I use OpenLDAP C API for my LDAP client library and also OpenLDAP server for my tests (both of version 2.4.7). I am now working on unsolicited notification support. My code looks like this: . . . struct timeval to; to.tv_sec = waitTime; to.tv_usec = 0; LDAPMessage *res = NULL; SW_CHAR *retOid = NULL; // // Check the notification // SW_INT32 rc = ldap_result(m_ldap, LDAP_RES_ANY, 1, &to, &res); . . . My problem is that I always get timeout result code and NULL response message. To simulate the unsolicited notification, I use a retcode overlay with this configuration: overlay retcode retcode-parent "ou=Example Codes,dc=example,dc=com" retcode-item "cn=Unsolicited" 0x00 unsolicited="0" retcode-item "cn=Notice of Disconnect" 0x00 unsolicited="1.3.6.1.4.1.1466.20036" To invoke it, I invoke search operation on "cn=Notice of Disconnect,ou=Example Codes,dc=example,dc=com". In slapd.log file, I can see something like this: conn=2 op=1 SRCH base="cn=Notice of Disconnect,ou=Example Codes,dc=example,dc=com" scope=0 deref=0 filter="(objectClass=*)" conn=2 op=1 SRCH attr=objectclass send_ldap_extended: err=0 oid=1.3.6.1.4.1.1466.20036 len=0 send_ldap_response: msgid=0 tag=120 err=0 ber_flush2: 38 bytes to sd 12 0000: 30 24 02 01 00 78 1f 0a 01 00 04 00 04 00 8a 16 0$...x.......... 0010: 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 31 34 36 36 1.3.6.1.4.1.1466 0020: 2e 32 30 30 33 36 .20036 ldap_write: want=38, written=38 0000: 30 24 02 01 00 78 1f 0a 01 00 04 00 04 00 8a 16 0$...x.......... 0010: 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 31 34 36 36 1.3.6.1.4.1.1466 0020: 2e 32 30 30 33 36 .20036 conn=2 op=1 RESULT oid=1.3.6.1.4.1.1466.20036 err=0 text= daemon: activity on 1 descriptor daemon: activity on: 12r daemon: read activity on 12 daemon: select: listen=7 active_threads=0 tvp=NULL connection_get(12) connection_get(12): got connid=2 connection_read(12): checking for input on id=2 ber_get_next ldap_read: want=8, got=7 0000: 30 05 02 01 03 42 00 0....B. ber_get_next: tag 0x30 len 5 contents: ber_dump: buf=1005d4290 ptr=1005d4290 end=1005d4295 len=5 0000: 02 01 03 42 00 ...B. ber_get_next ldap_read: want=8, got=0 This looks like the server sent the notification. However, in my client library, I can't get it. Can anyone help? Do I have wrong client code or is the problem in the way how I try to invoke the notification? I would appreciate any help. Regards, Tomas

1 0

Checking the database.....
by Padmavathi Dt 31 Mar '08

31 Mar '08

Dear List, Can anyone please tell me how to check which database is being used by our openLDAP?Please di Also please advice me whether we can use the openldap packages that come along with O.S. Because I have seen people advicing not to use openLDAP RPms that come with O.S Waiting for help..... Warm Regards, Padmavathi. =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

5 4

Doubt regarding slave OpenLDAP version?????
by Padmavathi Dt 31 Mar '08

31 Mar '08

Hii List, In the starting of our project we have installed openldap-2.4.7.It was working fine.But due to incompatibility with some other application,we have installed 2.2.13 according to documentation of that application.We used the same "bdb" (berkeley db-4.6.21) as recommended by the README of earlier one ( openldap-2.4.7) .It worked fine.... We have a working slapd of openldap-2.2.13..Now we are planning to implement replication on similar machine(Red Hat Linux). My doubt is about the version of slave LDAP.Should it be the same as Master? If so we already have the openldap-2.2.13 rpms installed on our target machine.So can we use them? What about the version of "bdb" to be installed on the slave.Should it match with the master? I am really new to all these things so please dont get annoyed at my questions........... Also please guide me where I can get the Admin guide for this version as I have the one for openLDAP-2.4.7 I am eagerly waiting for a response.........Loads of Thanx in advance. Regards, Padma.. Padmavathi =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

3 2

Slapd Not getting started after changing the "directory" value in slapd.conf!!!!!!!
by Padmavathi Dt 31 Mar '08

31 Mar '08

Hii List, I have changed the value of " directory" directive under database section of my slapd.conf file of openldap-2.2.13 (/var/lib/ldap) to the one previously used by our openldap-2.4.7(/usr/local/var/openldap-data). My berkeley db version is 4.6.21... I am not sure if the machine has some other versions of berkeley db already installed.(rpm -qa|grep berkeleydb* has not returned any value) The error when i start slapd is:( A part) /usr/sbin/slapd -d127 -h "ldap:///" slapd startup: initiated. bdb_db_open: dc=bsnl,dc=com bdb_db_open: dbenv_open(/usr/local/var/openldap-data) bdb(dc=bsnl,dc=com): Program version 4.2 doesn't match environment version bdb_db_open: dbenv_open failed: Invalid argument (22) backend_startup: bi_db_open(0) failed! (22) slapd shutdown: initiated ====> bdb_cache_release_all bdb(dc=bsnl,dc=com): DB_ENV->lock_id_free interface requires an environment conf igured for the locking subsystem slapd shutdown: freeing system resources. bdb(dc=bsnl,dc=com): txn_checkpoint interface requires an environment configured for the transaction subsystem bdb_db_destroy: txn_checkpoint failed: Invalid argument (22) slapd stopped. connections_destroy: nothing to destroy. Anyone please help me as soon as possible..... Thanx in advance Regards, Padmavathi Devi T =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

3 2

modify on the fly attributes sent to client
by Matthieu 29 Mar '08

29 Mar '08

Hello everybody, I'm front a problem with my openldap 2.3.30 server software and hope you can give me help to solve it. problem is the following one: I use a mozilla schema for my address book but need to make it compliant with another one (window's one) I have found some matching fields from my current model to windows model's one but don't wants to duplicate them and don't wants to define a schema for the window's model. Is there a way to rewrite answer to "add" a field with the value of one of the answer in the answer send to client? for example it's seems that "mozillaNickname" is equal to "surname" in the windows schema, but I don't wants to make a schema for the window's model and just want to send the mozillaNickName attribute and value with a copy of the value for an attribute surname. best regards, Matthieu

3 3

ACL for members of PosixGroup?
by Don Hoover 28 Mar '08

28 Mar '08

I was wondering if there was a way to write an ACL for a members of the PosixGroup. I have a simple directory structure of: ou=People,o=myorg (with posixusers) ou=Group,o=myorg (with posixgroups) I would like to create an ACL that allows users who have a gidNumber of X(say 101) that matches our systems admin group to have write access. And I guess one point is that they are not listed indivudually as "memberOf" entries in the ou=Group cn, they just have a gidNumber that matches a group in there. I tried: by group="cn=sysads,ou=Group,o=myorg" write and by group.expand="cn=sysads,ou=Group,o=myorg" write Neither one worked, and in fact I saw an error message of something line: => bdb_entry_get: found entry: "cn=sysads,ou=group,o=myorg" Mar 28 11:44:59 kyloulapp54dp slapd[5949]: <= bdb_entry_get: failed to find objectClass groupOfNames Does the group ACL's require a "groupofNames" instead of using posixGroups under an OrganizationUnit? I was wondering if maybe there some regex maybe I could use to check the gidNumber of the user trying to attempt access? I am not a regex genius so any help would be appreciated. Thanks!! --- Don Hoover dxh(a)yahoo.com

3 2

ACL troubles
by Julien Garnier 28 Mar '08

28 Mar '08

Hi, I have some problems to configure my aACL's and hope someone can help me. I want all my local subnet (A.A.A.x) have entire read acces, It's OK. I want some IP have acces only to one search : for example, I want that IP1 B.B.B.B can only do this search and that any other search return error : ldapsearch -x -b "ou=people,ou=compagnie,ou=com" "(ou=DIV1*)" -LLL I don't find how to configure that. I've tried : access to dn.base="" by peername.regex="IP=A\.A\.A\..+" read by peername.regex="IP=127\.0\.0\.1" read by * none access to dn.sub="ou=people,ou=compagnie,ou=com" filter=(ou=DIV1*) by peername.regex="IP=B\.B\.B\.B" read by * none but dosn't work, I have an insufficient acces 50 error. I anyone can help me... Thanks in advance

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software