openldap-software

openldap-software@openldap.org

2719 discussions

Any problems with X.509v3 Extensions?
by Brian A. Seklecki 13 Feb '08

13 Feb '08

All: Does anyone know of any known-problems with OpenLDAP server/client-side certificates signed with X509 v3 Extensions? e.g., $ openssl x509 -text -in interface.crt.pem X509v3 extensions: X509v3 Subject Alternative Name: email:ldap@tld Netscape Cert Type: SSL Server, S/MIME, Object Signing X509v3 Extended Key Usage: TLS Web Server Authentication With openssl.cnf: [ v3_req_ext ] subjectAltName=email:copy nsCertType = server, email, objsign nsComment = "OpenSSL Generated Server Certificate" # .2 = Client, .1 = Server #extendedKeyUsage = 1.3.6.1.5.5.7.3.2 extendedKeyUsage = 1.3.6.1.5.5.7.3.1 This is the way Godaddy rocks out. Every year I go through suffer through hours of self abnegation trying to re-issue certificates for a dozen F/OSS applications that all have little caveats --- This year I'm writing that shit down >:} ~BAS

3 7

Solaris 10 OpenLDAP server message:
by Kick, Claus 12 Feb '08

12 Feb '08

Hello everyone, as we are investigating our performance problems, we noticed the following one: Feb 7 12:01:18 lakota-neu slapd[24815]: [ID 555073 local4.error] tid= 1: multiple threads per connection not supported Does this mean that currently only one thread per request connection is allowed? If so, how can this be changed? We used the openldap package from Blastwave, as we were unable to compile from the Sources. Does anyone have an idea for this? Regards, CLaus

4 5

slapd: warning: cannot open /etc/hosts.allow: Too many open files
by Amir Saad 12 Feb '08

12 Feb '08

I'm running OpenLDAP 2.3.30-5 on Debian 4. I checked the syslog and I found the following errors: slapd: warning: cannot open /etc/hosts.allow: Too many open files slapd: warning: cannot open /etc/hosts.deny: Too many open files Please advice. Thanks Amir _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

6 9

Re: Mirror Mode replication
by Gavin Henry 12 Feb '08

12 Feb '08

> Thanks in advance for any responses... What documentation did you follow? You are missing serverID: http://www.openldap.org/doc/admin24/replication.html#MirrorMode Thanks.

3 3

Caching queries
by Kick, Claus 12 Feb '08

12 Feb '08

Hello everyone, how can I check whether caching queries and so on works? Regards, Claus

6 10

Re: [JunkMail] LDAP Server bug?
by openldap 12 Feb '08

12 Feb '08

Hi i tried the following: [myuser@deskhost ~]$ ldapmodify -H "ldaps://ldaphost.mydom.com" -x -D"cn=config" -W -f klein.ldapmodify.ldif Enter LDAP Password: modifying entry "cn=schema,cn=config" ldapmodify: Internal (implementation specific) error (80) additional info: <olcAttributeTypes> handler exited with 1 [myuser@deskhost ~]$ and the LDAP log says: Feb 11 11:32:11 ldaphost slapd[8575]: conn=75 fd=31 ACCEPT from IP=xx.xx.xx.xx:60593 (IP=0.0.0.0 :636) Feb 11 11:32:12 ldaphost slapd[8575]: conn=75 fd=31 TLS established tls_ssf=256 ssf=256 Feb 11 11:32:12 ldaphost slapd[8575]: conn=75 op=0 BIND dn="cn=config" method=128 Feb 11 11:32:12 ldaphost slapd[8575]: conn=75 op=0 BIND dn="cn=config" mech=SIMPLE ssf=0 Feb 11 11:32:12 ldaphost slapd[8575]: conn=75 op=0 RESULT tag=97 err=0 text= Feb 11 11:32:12 ldaphost slapd[8575]: conn=75 op=1 MOD dn="cn=schema,cn=config" Feb 11 11:32:12 ldaphost slapd[8575]: conn=75 op=1 MOD attr=olcAttributeTypes Feb 11 11:32:12 ldaphost slapd[8575]: conn=75 op=1 RESULT tag=103 err=80 text=<olcAttributeTypes> handler exited with 1 Feb 11 11:32:12 ldaphost slapd[8575]: conn=75 op=2 UNBIND Feb 11 11:32:12 ldaphost slapd[8575]: conn=75 fd=31 closed the ldif file: dn: cn=schema,cn=config changetype: modify add: olcAttributeTypes olcAttributeTypes: ( 2.5.4.0 NAME 'olcObjectClasses' DESC 'RFC2256 object classes of the entity' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 ) what can i do now? does this say "wait for version 2.4.x of openldap"? i need these attributes and obejctclasses on an LDAP installation for a customer. suomi openldap wrote: > Hi every > > OpenBSD myserver.mydomain.tld 4.2 GENERIC#375 i386 > > openldap-server-2.3.33p1-bdb > > a week ago, i introduced a new schema, the horde.schema, adding it to > the new cn=config subtree using ldapadd... Hm, that's a bug that ldapadd succeeded. olcIncludeFile objects are only supposed to be in the cn=config tree when it was converted from a slapd.conf file. For a pure cn=config installation, you should be creating a olcSchema entry instead. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Mirror Mode replication
by Mark W Apperson 12 Feb '08

12 Feb '08

Hi, I am trying to setup and test the mirror mode replication using OpenLDAP 2.4.7. I setup a very simple test with two hosts running OpenLDAP servers (host openldap1 (port 1389) and host openldap2 (port 2389)). I set up the replication in the slapd.conf file so that openldap1 replicates to openldap2 and vice versa. I specified 'mirrormode on' for both hosts. I have not been able to get the simple mirrormode replication test to work. My test consisted of the following: 1. Both openldap hosts start with an empty database 2. Added a user on openldap1 using ldap_add 3. Waited a few minutes to ensure the new user was replicated to host openldap2. This was successful. 4. Added a second user and modified an attribute of the first user on host openldap1. This was successful. 5. After a few minutes, the 2nd user and the attribute change was removed from host openldap1. Since this very basic test failed, I am certain that I have misunderstood the configuration or setup of mirrormode replication. I would appreciate if someone could point out my configuration error. I have included the parts of the slapd.conf file where replication is configured. Host openldap1(port 1389) contains the following in its slapd.conf file: overlay syncprov syncrepl rid=1 provider=ldap://openldap2:2389 type=refreshOnly interval=00:00:05:00 searchbase="dc=domain,dc=com" bindmethod=simple binddn="cn=Manager,dc=domain,dc=com" credentials=secret retry="60 +" mirrormode on Host openldap2(port 2389) contains the following in its slapd.conf file: overlay syncprov syncrepl rid=2 provider=ldap://openldap1:1389 type=refreshOnly interval=00:00:05:00 searchbase="dc=domain,dc=com" bindmethod=simple binddn="cn=Manager,dc=domain,dc=com" credentials=secret retry="60 +" mirrormode on Thanks in advance for any responses... Mark Apperson

1 0

TLS Certificate Issue
by Jon Fink 12 Feb '08

12 Feb '08

After recently upgrading to a newer version of openldap I'm experiencing problems with start_tls on a connection to the slapd server. I'm fairly certain that the certificate is setup correctly. In fact the following command works properly from a remote client: ldapsearch -ZZ -LLL -x -W -h ldapserver.domain -D "cn=nss,dc=group" -b 'ou=People,dc=group' '(objectClass=*)' but when I run exactly the same command *on* the server I get the the following error (with debug flags turned on): TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 20, subject: /CN=ldapserver.domain /ST=PA/C=US/O=GRP, issuer: /CN=GROUP_CA/ST=PA/C=US/O=GROUP TLS certificate verification: Error, unable to get local issuer certificate TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed. ldap_err2string ldap_start_tls: Connect error (-11) I feel like this may be related somehow to the FQDN resolution on the server, but I've tried a few permutations of hostname setup to no avail (is there a way to confirm that this is the issue?) Any thoughts? Thanks, Jon Versions: slapd 2.4.7 openldap 2.4.7 openssl 0.9.8

4 4

Setting up producer consumer with Syncrepl
by Ishklight 11 Feb '08

11 Feb '08

Hi, I am a LDAP newbie. I am trying to set up LDAP producer and consumer. The producer cannot start when I include the overlay syncprov. I get the following when I debug and the server stops. Can any say, what is going wrong here? I see that there is module syncprov.la in the path given by "modulepath". Thanks in advance, Imran slapd init: initiated server. slap_sasl_init: initialized! bdb_back_initialize: initialize BDB backend bdb_back_initialize: Berkeley DB 4.6.21: (September 27, 2007) hdb_back_initialize: initialize HDB backend hdb_back_initialize: Berkeley DB 4.6.21: (September 27, 2007) bdb_db_init: Initializing BDB database >>> dnPrettyNormal: <o=example> <<< dnPrettyNormal: <o=example>, <o=example> >>> dnPrettyNormal: <cn=root, o=example> <<< dnPrettyNormal: <cn=root,o=example>, <cn=root,o=example> overlay "syncprov" not found slapd destroy: freeing system resources. slapd stopped. -------------------------------------------------------------------------- producer slapd.conf ---------------------------------------------------------------------------- include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema include /u/hello/local.schema pidfile /tmp/imran-slapd.pid argsfile /tmp/imran-slapd.args loglevel 0 modulepath /usr/local/openldap-2.4/libexec/openldap moduleload back_bdb.la moduleload syncprov.la access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to * by self write by users read by anonymous auth by dn="cn=replica,o=example" read database bdb suffix "o=deshaw" readonly off rootdn "cn=root, o=example" rootpw secret lastmod on directory /var/openldap-data/pid1 index objectClass,entryCSN,entryUUID eq overlay syncprov syncprov-checkpoint 10 5 syncprov-sessionlog 100 ----------------------------------------------------------------------- Consumer slapd.conf -------------------------------------------------------------------------- include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema include /u/hello/local.schema pidfile /tmp/imran-slapd-slave.pid argsfile /tmp/imran-slapd-slave.args loglevel 0 database bdb suffix "o=example" readonly off rootdn "cn=replica, o=example" index default pres,eq index objectClass,entryCSN,entryUUID eq syncrepl rid=1 provider=ldap://127.0.0.1:3089 type=refreshAndPersist searchbase="o=example" filter="(objectClass=*) scope=sub attrs="" schemachecking=off updatedn="cn=replica,o=example" bindmethod=simple binddn="cn=replica,o=example" credentials="secret" updateref ldap:/127.0.0.1:3089

3 3

Re: syncrepl with more that one database
by Gavin Henry 11 Feb '08

11 Feb '08

Who is this Quanah guy who keeps coming out with the wrong info? ;) On 2/9/08, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Saturday, February 09, 2008 9:27 AM -0800 James Hartley > <james.hartley(a)gmail.com> wrote: > > > ah very good.... The documentaion I read seems to imply the number was > > tied to the replica, > > ie if the slave one used rid 001 then slave2 would use rid002. > > > > According to your email > > > > I would need rid001 for database 1 and rid002 for database 2 in the > > conf file for slave 1 and if I had another slave, say slave2 I would > > need to have an rid003 and rid004. > > > > Thank you for clarifying this point. > > Keep replies on the list. And no, you are incorrect still. The RIDs need > to be unique per database, on a given replica. So rid001 and rid002 on > replica1, rid001 and rid002 on replica2, is just fine. > > --Quanah > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Sent from Google Mail for mobile | mobile.google.com http://www.suretecsystems.com/services/openldap/

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software