openldap-software

openldap-software@openldap.org

2719 discussions

Testing the state of replicates
by Marantz, Roy 05 Mar '08

05 Mar '08

I'm using OpenLDAP 2.4.7 on Solaris-10. I have a database that is part of 2 master servers running in mirror mode and (eventually) some slaves servers too. I'm looking for way to tell if a particular server is "up to date". By that I mean is synchronized within X seconds with the master that gets updates. The masters will be behind a load-balancer (level 4 switch) and look like a single IP address. I can have the slaves access them directly if need be, but will try to have them talk the the virtual master server. This is mostly a concern when talking to a slave server since they may not always be able to talk to the master servers because of network partitioning. Is there something I can query, like contextCSN, to indicate the last time syncrepl successfully finished resyncing the particular database? Any other way to do this or am I just trying to do something that is impossible? Any help or pointers would be appreciated. Thanks. Roy

6 11

problem with enabling TLS
by Padmavathi Dt 05 Mar '08

05 Mar '08

Hii List, We have installed and configured our openLDAP-2.4.7 on RedHat LINUX machine using simple configure( . /configure) without any options. It has been working fine.Now we want to use SSL with that we are using openssl-0.9.7g package.We got all the required certificates. Now the problem is that,when I run the following command: /usr/local/etc/openldap/slapd.conf -d127 -h "ldap:/// ldaps:///" It is giving the following error message: ldap_pvt_gethostbyname_a: host=as3, r=0 daemon_init: ldap:/// ldaps:/// daemon_init: listen on ldap:/// daemon_init: listen on ldaps:/// daemon_init: 2 listeners to open... ldap_url_parse_ext(ldap:///) daemon: listener initialized ldap:/// ldap_url_parse_ext(ldaps:///) daemon: TLS not supported (ldaps:///) slapd stopped. connections_destroy: nothing to destroy. >From this I can understand that ,TLS is not supported.what should I do now? One more question.Is there any difference between enabling SSL and TLS ? please help me( It is difficult to rebuild openldap again,as there are many applications that are using our current LDAP) THANX IN ADVANCE TO ALL. =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

5 5

translucent local search bug ?
by Julien Garnier 05 Mar '08

05 Mar '08

Hi, I've configure a ldap server with translucent. I add my own attribute like "Poste" and with the last release of openldap I can search my local attribute (like Poste) or my remote attributes (like mail, ou, Deleg): # ldapsearch -x -b "ou=People,dc=compagnie,dc=com" "(Poste=*)" return all the datas : dn: uid=julien.garnier.1,ou=per,ou=People,dc=compagnie,dc=com businessCategory: E - Informatique, statistique et calcul scientifique displayName: GARNIER Julien employeeType: E4X01 - Technicien d'exploitation et de maintenance Poste: 3550 CorCom: moy1300 cnrsGrade: TCN GXlabTSEDR: 1 roomNumber: 7 CorSecu: 0 CorInfo: 1 GXlab: 0 CorValo: 0 CorForm: 0 ACMO: 0 Service: SSI Now, if I juste want to return some attributes with a simple request, it work : #ldapsearch -x -b "ou=People,dc=compagnie,dc=com" "(Poste=*)" mail Poste # julien.garnier.1, cnrs, People, cnrs.fr dn: uid=julien.garnier.1,ou=per,ou=People,dc=compagnie,dc=com mail: Julien.Garnier(a)compagnie.com Poste: 3550 Now I want to make a search mixing local and remote attributes : # ldapsearch -x -b "ou=People,dc=compagnie,dc=com" "(&(Deleg=DR*)(ou=MOY*)(Poste=*))" It's OK, I have the same result as the first test. But if I want to make the last search and only show some attributes, it doesn't work : # ldapsearch -x -b "ou=People,dc=compagnie,dc=com" "(&(Deleg=DR*)(ou=MOY*)(Poste=*))" Poste or # ldapsearch -x -b "ou=People,dc=compagnie,dc=com" "(&(Deleg=DR*)(ou=MOY*)(Poste=*))" mail return no values : # extended LDIF # # LDAPv3 # base <ou=People,dc=compagnie,dc=com> with scope subtree # filter: (&(Deleg=DR*)(ou=MOY*)(Poste=*)) # requesting: mail # # search result search: 2 result: 0 Success # numResponses: 1 Is it a bug or did I have read the man in the wrong way ??? Thanks, Julien

1 0

Ldap crashes with "too many executing" errors
by ram 05 Mar '08

05 Mar '08

I am using Berkeleydb4.2 and openldap version 2.3.39 on a Centos 5 box with a bdb backend The ldap server is used for backend authentication of users of imap server using sasl. Even though we have a similar setup working in many locations on a particular location I see ldap server hanging , apparently anytime and cannot be reproduced I kept ldap running in the debug mode I could see something like -- connection_input: conn=5097 deferring operation: too many executing ber_get_next ber_get_next: tag 0x30 len 6 contents: connection_input: conn=5097 deferring operation: too many executing ber_get_next ---- When the ldap server hung. I restart ldap and thing start working fine How can I debug further Thanks Ram

1 0

ppolicy: unlock users who are locked out with pwdMaxFailure?
by Zhang Weiwu 05 Mar '08

05 Mar '08

Dear all By googling around I saw a lot of questions were asked for this, but either not answered or gets answered without practical how-to: http://archives.devshed.com/forums/networking-100/question-pertaining-to-pp… http://www.mail-archive.com/openldap-software@openldap.org/msg08718.html http://www.openldap.org/lists/openldap-software/200509/msg00219.html Let's say, the admin user wishes to unlock an user, without changing his password or resetting his password, what should he do? should he deletes all pwdLockedTime for the locked user? should he deletes pwdAccountLockedTime for the locked user? Thanks in advance! My version is OL 2.3.30 Best regards Zhang Weiwu -- Real Softservice Huateng Tower, Unit 1788 Jia 302 3rd area of Jinsong, Chao Yang Tel: +86 (10) 8773 0650 ext 603 Mobile: 135 9950 2413 http://www.realss.com

2 1

Re: Testing the state of replicates
by Quanah Gibson-Mount 05 Mar '08

05 Mar '08

--On Tuesday, March 04, 2008 2:49 PM -0800 Howard Chu <hyc(a)symas.com> wrote: > Use ldapsearch to retrieve the contextCSN attributes from all of the > servers. If they match, they are in sync. Except when they aren't (contextCSN's match but the DBs do not). Which was certainly possible in some of the 2.3 releases. ;) I'd also highly advise setting syncprov-checkpoint if one's going to be doing hot slapcat's of a DB (it would actually be nice if perhaps slapcat could force that before doing a dump). That'd be fairly useful for delta-syncrepl in light of ITS#5378. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Account Locked message?
by Zhang Weiwu 04 Mar '08

04 Mar '08

Hello. I've been working on a system with low security requirement and high usability requirement. I uses ppolicy overlay and enabled ppolicy_use_lockout to avoid people gets confused when they failed to login too many times: suffix "st=jiangxi,o=LGOP" rootdn "userid=admin,st=jiangxi,o=LGOP" rootpw [...] overlay ppolicy ppolicy_default "st=jiangxi,o=LGOP" ppolicy_use_lockout Restart openldap server and test again by trying to bind with the wrong password enough times (in my case, 20 times). Then try to bind with the right password: ldapsearch -H ldap://gtz.ods.org/ -xD ou=江西省,st=jiangxi,o=LGOP -W ou=*余干* areacode ldap_bind: Invalid credentials (49) Here I still got error 49. I thought I could get something like "Account Locked" and a different error code. According to man page: ppolicy_use_lockout A client will always receive an LDAP InvalidCredentials response when Binding to a locked account. By default, when a Password Policy control was provided on the Bind request, a Password Pol‐ icy response will be included with no special error code set. This option changes the Password Policy response to include the AccountLocked error code. Note that sending the AccountLocked error code provides useful information to an attacker; sites that are sensitive to security issues should not enable this option. Well I checked related RFC (http://www.ietf.org/rfc/rfc4511.txt) and didn't find "Account Locked error code". In fact, http://www.willeke.com:9080/wikildap/Wiki.jsp?page=LDAPResultCodes listed a list of error code, non of them is "Account Locked" error code. My questions: Is my setting working? How can I tell? The web application needs to tell if an account is locked, this to improve user usability; Thanks a lot in advance! Best regards Zhang Weiwu -- Real Softservice Huateng Tower, Unit 1788 Jia 302 3rd area of Jinsong, Chao Yang Tel: +86 (10) 8773 0650 ext 603 Mobile: 135 9950 2413 http://www.realss.com

2 1

Re: add local entries to a master database.
by Howard Chu 03 Mar '08

03 Mar '08

Please keep replies on the list, so that everyone can see the resolution of the thread. Julien Garnier wrote: > Howard Chu a écrit : >> Julien Garnier wrote: >>> Howard Chu a écrit : >>>> Julien Garnier wrote: >>>>> * I've tried to use translucent overlay between ldap_relay and >>>>> ldap1 but >>>>> the problem is tha it's not possible to search local entries with >>>>> translucent. >>>> It is in 2.4.8. >>> Hi, >>> >>> Juste a minute after post my message I download the 2.4.8 and I've read >>> in the chanlog that local entries search is working. >>> >>> I trie to make that working but nothings change, it doesn't work. >> Nothing changes because you haven't changed your configuration. Read >> the slapo-translucent(5) manpage. > Thanks for your help, > I just add translucent_local ACMO,... in my slapd.cof and it works ! You're welcome. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

add local entries to a master database.
by Julien Garnier 03 Mar '08

03 Mar '08

Hi, I want to setup a local ldap server that will add my local entries to the master server. The config is this one : A central server that is replicate on my "ldap_relay" server (I have access to the configuration of this server) . This one replicate from a central ldap (I have no access to this one) via classical syncrepl. So I can read my ldap_relay but I can't add my own attributes. I try several configurations : * I've tried to setup multimaster replication between ldap_relay and a local ldap server (ldap1). In this config I can update users and add my own attributes but if someone is deleted from de central ldap, he is delete from the "ldap_relay" server and not delete in the ldap1 server * I've tried to use translucent overlay between ldap_relay and ldap1 but the problem is tha it's not possible to search local entries with translucent. * I read the config from Oren Laadan ( http://www.openldap.org/lists/openldap-software/200802/msg00128.html). This seems to be what I need, but I don't realy understand how to configure that. If someone can help me to set up this solution with my servers. Thanks in advance. Julien

2 4

Re: Not able to load the LDIF file onto the LDAP server
by Michael Ströder 02 Mar '08

02 Mar '08

Please stay on the list so others can answer and learn as well. divya shree wrote: > > could u plz elaborate on the solution as i am a starter...i mean is it > enough if a add the option > "-h" in the staement > > ldapadd -x -D "cn=Manager,dc=example,dc=net" -W -f example.ldif > > or should i do something more... Just add -h (or -H if needed). Otherwise the LDAP server is contacted which is configured in ldap.conf or another local LDAP client configuration file. Ciao, Michael.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software