openldap-software

openldap-software@openldap.org

2719 discussions

ldapsearch is too slow after I deleted an entry
by Amir Saad 11 Feb '08

11 Feb '08

I setup OpenLDAP & MIT Kerberos successfully. I created a self-signed certificate for OpenLDAP and I configured the server to work only on ldaps. I migrated all existing users and groups to OpenLDAP. Everything was working just perfect till I added a new group object using ldapadd and then deleted it using ldapdelete, since then ldapsearch takes very long time to complete. It returns the correct results but after very long time. I tried ldapsearch -d8 to see what is going on and here are the errors I got: TLS certificate verification: Error, self signed certificate TLS certificate verification: depth: 0, err: 18, subject: [SOME INFORMATION HERE] TLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write change cipher spec A TLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL_connect:SSLv3 read finished A TLS trace: SSL3 alert write:warning:bad certificate TLS: unable to get peer certificate. Do you think the delay is related to the above? What is wrong with OpenLDAP? I did not touch any configuration, only ldapadd and ldapdelete! This piece of software is very unstable :( Please help. Thank you Amir _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

3 2

Debug output question
by Kick, Claus 11 Feb '08

11 Feb '08

Hello everyone, Changing settings for nscd did help a bit, although the system is very slow for a minute or so when especially the group cache is being refreshed (once every hour at the moment). Having slapd run at debug level -1 leads to the following error sometimes, for different user queries: ber_flush: 279 bytes to sd 14 0000: 30 82 01 13 02 02 16 8d 64 82 01 0b 04 2c 75 69 0.......d....,ui 0010: 64 3d 74 72 6f 65 64 75 6c 31 31 2c 6f 75 3d 50 d=troedul11,ou=P 0020: 65 6f 70 6c 65 2c 6f 3d 73 69 65 6d 65 6e 73 6d eople,o=siemensm 0030: 65 64 69 63 61 6c 2e 63 6f 6d 30 81 da 30 1a 04 edical.com0..0.. 0040: 0a 6c 6f 67 69 6e 53 68 65 6c 6c 31 0c 04 0a 2f .loginShell1.../ 0050: 62 69 6e 2f 66 61 6c 73 65 30 13 04 09 75 69 64 bin/false0...uid 0060: 4e 75 6d 62 65 72 31 06 04 04 31 34 31 37 30 12 Number1...14170. 0070: 04 09 67 69 64 4e 75 6d 62 65 72 31 05 04 03 35 ..gidNumber1...5 0080: 30 34 30 12 04 03 75 69 64 31 0b 04 09 74 72 6f 040...uid1...tro 0090: 65 64 75 6c 31 31 30 18 04 05 67 65 63 6f 73 31 edul110...gecos1 00a0: 0f 04 0d 55 6c 66 20 54 72 6f 65 64 73 73 6f 6e ...Ulf Troedsson 00b0: 30 15 04 02 63 6e 31 0f 04 0d 55 6c 66 20 54 72 0...cn1...Ulf Tr 00c0: 6f 65 64 73 73 6f 6e 30 22 04 0d 68 6f 6d 65 44 oedsson0"..homeD 00d0: 69 72 65 63 74 6f 72 79 31 11 04 0f 2f 68 6f 6d irectory1.../hom 00e0: 65 2f 74 72 6f 65 64 75 6c 31 31 30 2a 04 0b 64 e/troedul110*..d 00f0: 65 73 63 72 69 70 74 69 6f 6e 31 1b 04 19 72 67 escription1...rg 0100: 5f 6e 6f 74 69 66 69 63 61 74 69 6f 6e 20 75 73 _notification us 0110: 65 72 20 6f 6e 6c 79 er only ldap_write: want=279 error=Resource temporarily unavailable ber_flush failed errno=11 reason="Resource temporarily unavailable" daemon: activity on 1 descriptor daemon: waked What does this error mean? Is is even an error? Confused and asking for help, Claus

1 0

Re: (ITS#5354) slapd repeatedly hangs and stops reponding
by Howard Chu 11 Feb '08

11 Feb '08

Oren Laadan wrote: > Howard Chu wrote: >> You haven't provided any information to explain why you cannot structure >> your additional entries as a distinct subtree. You're still just >> handwaving when we ask for concrete examples of the entries involved. > > Clearly I'm new to LDAP. Please indicate what information is missing, > I'll be happy to provide, even the local database (my .ldif file) and > sample queries from the remote server. Just name it. > > Taking a step back: we have a departmental LDAP server for user auth, > (posix) groups, autofs maps and so on. In my group, we add to the DB > groups and autofs maps that do not exist on the remote server, so a > user on our machines can belong to additional groups. > > I am not arguing that I cannot structure it differently. I simply do > not know if I can structure it differently. Ideally I could add entries > to the remote database, but that is impossible. The remote server > gives DN dc=MAIN,dc=EXAMPLE,dc=COM, which is what I made the local > server give (via the meta backend) and which is what the clients are > using as their base DN. Since it appears that you just need to make your data work with pam_ldap/nss_ldap I suggest you (1) keep your local data in a distinct subtree and (2) read the pam/nss_ldap documentation regarding the use of multiple service search descriptors. There's no reason to be using suffixmassage here. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

how to extend a remote database with local entries ?
by Oren Laadan 11 Feb '08

11 Feb '08

Hi, I want to setup a local ldap server for my team that will extend a remote ldap server (whose database is inaccessible to me and I cannot simply replicate) with a small number (less than 100) of new (local) entries. For example, the local server may add entries for new users only in my team, but also support authentication of all users in the remote server. I tried to use back-meta, which seems most suitable for merging data from multiple targets. Assume the DN base is "dc=EXAMPLE,dc=COM", which is what the clients use. To set it up, I used the following config snippets: ... moduleload back_ldap moduleload back_meta moduleload back_bdb ... backend bdb backend meta ... # bdb backend, with a "local" DN base different than the main one\ # not intended to serve clients, but to serve the meta backend only database bdb suffix "dc=TMP,dc=EXAMPLE,dc=COM" readonly on ... # meta backend, with the right DN base, serving the clients database meta lastmod off suffix "dc=EXAMPLE,dc=COM" uri "ldaps://REMOTE_SERVER/dc=EXAMPLE,dc=COM" uri "ldaps:///dc=TMP,dc=EXAMPLE,dc=COM" suffixmassage "dc=EXAMPLE,dc=COM" "dc=TMP,dc=EXAMPLE,dc=COM" ... There is a local database for subtree dc=TMP,dc=EXAMPLE,dc=COM (which isn't used by the clients). This database holds the additional entries. (Clearly, I cannot have used the same DN base). The main database (used by the clients), dc=EXAMPLE,dc=COM is a meta- backend, which forwards queries to both the remote server and the local database. With the latter, is uses suffixmassage to convert from the real DN to the local database DN and back. There are two problems with this configuration: first it is suboptimal because it requires multiple threads to handle the self-referral to the local database. More importantly, due to a problem in the server this leads to random lockup of the server. The discussion in the -bugs lists (read the full thread here: http://www.openldap.org/lists/openldap-bugs/200802/msg00034.html) suggested alternatives: (1) use overlay translucent (2) use back-relay (3) use back-ldap to the remote server and subordinate glue for local db However .... (1) I tried the overlay translucent (see config below), and the local database entries didn't show up. When the overlay was turned if, they did show up (but without the remove entries ...). Indeed the man page says it should be used to override and/or modify attributes of entries coming from the remote server; it doesn't say anything about being able to add new entries. ... # bdb backend, local database, same DN base database bdb suffix "dc=EXAMPLE,dc=COM" readonly on overlay translucent translucent_no_glue uri "ldaps://REMOTE_SERVER/" lastmod off ... (2) back-relay does not merge two database, but instead makes the job of relaying to the same server internal and therefore much more efficient. (3) Tried the config below, but it wouldn't run... so I'm not sure what the right config should be. Again, I think the issue here is that a subordinate database is to be a subtree of the remote server, unlike the simple merge that I require (both remote and local at the same level) ... database ldap lastmod off suffix "dc=EXAMPLE,dc=COM" uri "ldaps://REMOTE_SERVER" ... database bdb suffix "dc=EXAMPLE,dc=COM" subordinate readonly on ... The only other solution I can think of is run two (!) separate ldap instances on the local server machine to avoid the lockup problem I've been experiencing. Ugly ... (Note: I tried both 2.3.39 and 2.4.7) Hopefully *someone* would know how to successfully get my setup to work. Thanks, Oren.

3 4

Mixing Alias and posixAccount object class
by CheeYang Chau 10 Feb '08

10 Feb '08

Hi, I have a person object with the following entry in LDIF: dn: uid=ccy,ou=person,dc=estream,dc=com,dc=my objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top cn: ccy sn: ccy uid: ccy I then create another posix object for the above person using alias: dn: uid=ccy,ou=posix,dc=estream,dc=com,dc=my objectClass: alias objectClass: extensibleObject objectClass: posixAccount objectClass: top aliasedObjectName: uid=ccy,ou=person,dc=estream,dc=com,dc=my cn: ccy gidNumber: 500 homeDirectory: /home/ccy uid: ccy uidNumber: 500 I have another ou then use alias to refer to the posixAccount: dn: uid=ccy,ou=deer,dc=estream,dc=com,dc=my objectClass: alias objectClass: extensibleObject objectClass: top aliasedObjectName: uid=ccy,ou=posix,dc=estream,dc=com,dc=my uid: ccy But when I search the entry, I get nothing for the posixAccount: ldapsearch -a always -x -b "ou=deer,dc=estream,dc=com,dc=my" objectClass=posixAccount I expect the alias dereference will return correct result for me. It seems like the alias object class cannot mix with other object class in OpenLDAP. If I mix all the object classes into one object, the ldapsearch will success: dn: uid=ccy,ou=test,dc=estream,dc=com,dc=my objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: posixAccount objectClass: top ... The reason I refactor to that details is I wish to create more than one posixAccount for same person in different server. Please advice on how to achieve that or if it is not encourage to construct the DIT in such manner. Thank you very much -- Best regards, Chau Chee Yang E Stream Software Sdn Bhd URL: www.sql.com.my SQL Financial Accounting

1 0

Re: syncrepl with more that one database
by Quanah Gibson-Mount 09 Feb '08

09 Feb '08

--On Saturday, February 09, 2008 9:27 AM -0800 James Hartley <james.hartley(a)gmail.com> wrote: > ah very good.... The documentaion I read seems to imply the number was > tied to the replica, > ie if the slave one used rid 001 then slave2 would use rid002. > > According to your email > > I would need rid001 for database 1 and rid002 for database 2 in the > conf file for slave 1 and if I had another slave, say slave2 I would > need to have an rid003 and rid004. > > Thank you for clarifying this point. Keep replies on the list. And no, you are incorrect still. The RIDs need to be unique per database, on a given replica. So rid001 and rid002 on replica1, rid001 and rid002 on replica2, is just fine. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

2 5

help with ACLs
by Adam Williams 09 Feb '08

09 Feb '08

I'm trying to figure out what my ACL should be in slapd.conf. What I want is that a user can change his/her password, but they won't be able to read any other user's password. Right now what I have is not restrictive enough. I've read the OpenLDAP admin guide on ACLs but it was not clear to me what I should use. What I have currently is below. What do I need to change it to to have the results I want? access to attrs=userPassword,sambaLMPassword,sambaNTPassword by self write by anonymous auth by * read by * none access to * by * read

5 7

LDAP Authentication method(s)
by Curt Blank 09 Feb '08

09 Feb '08

I've got a situation that may be unique to our site and I'm wondering if anyone might have an idea on how to accomplish something. I'll have to set the ground work with a bit of an explanation first. A long time ago we chose to allow/deny authentication on the whole by allowing/denying access to the userPassword attribute. This is done by an accountActive attribute set to "Y" or "N" which is then used in an ACL filter statement for auth access to the userPassword attribute. This gave us the capability to allow/deny access across the board from a single point. As time went on we added application based attributes set to "Y" or "N" that would allow a DN to authenticate even though the accountActive attribute was set to "N". This again was accomplished by an ACL filter statement for auth access to the userPassword attribute when the requesting source was known server (DNS) running/hosting that application. This has worked well for us. But now we need to be able to authenticate a DN that has the accountActive attribute set to "N". We can't use the above method with an application based attribute in conjunction with a known server so we're looking for an alternative. Using a privileged admin type DN that is allowed auth access to the userPassword attribute along with an ACL filter statement seems like the way to go. But implementing this technique appears easier said then done. The original thought was to bind as the privileged admin DN and then do a, for lack of a better term, sub-bind as the users DN in hopes that the original bind as the privileged admin DN would then allow this restricted authentication to succeed. Well, we have not been able to accomplish this for probably one of two reasons. We're either doing something wrong, or it's just not possible. So anyone out there that knows of a possible way to accomplish this type of authentication or, for those that like a challenge, I like to hear any and all ideas on how to possibily accomplish this. It's already been purposed and a successful proof of concept was done were we encrypt the users password and then pass it to LDAP doing an ldapcompare and use the results to determine successful/failed authentication but that method was not warmly received, mainly due to having to do it in code. So I guess one of the constraints to accomplish this is to use only established LDAP calls and/or functions, i.e. pass the DN and password without any manipulation of the password. Thanks for taking the time to read this and considering this. -- Curt Blank

2 1

syncrepl with more that one database
by James Hartley 09 Feb '08

09 Feb '08

I see a lot of examples with syncrepl and one database in fact I am running one in that configuration with replication. Now I need to run and replicate two different databases... I have the databases running on the master without repl. I am wondering about the proper configuration on the slave should look like... from the documentation I see that syncrepl is a database directive, can someone give me a simple example of what the configuration file should look like with two or more databases. here is what I have now on the slave # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema # solaris.schema provides nisDomainObject, absent from nis.schema include /etc/openldap/schema/solaris.schema include /etc/openldap/schema/DUAConfigProfile.schema # samba.schema provides the samba information for samba clients include /etc/openldap/schema/samba.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org loglevel 4 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # TLS Configuration TLSCipherSuite HIGH:MEDIUM:+TLSv1:+SSLv2:+SSLv3 TLSCACertificateFile /etc/openldap/cacert.pem TLSCertificateFile /etc/openldap/slapd-cert-ldap2.pem TLSCertificateKeyFile /etc/openldap/slapd-key-ldap2.pem #Use the following if client authenication is required #TLSVerifyClient demand # ... or not desired at all #TLSVerifyClient never ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" directory /var/lib/openldap-data # Indices to maintain index entryCSN,entryUUID eq #Performance Tuning Directives sizelimit 5000 threads 8 idletimeout 14400 cachesize 10000 checkpoint 256 15 # synrepl parameters for the slave syncrepl rid=001 provider=ldap://server.example.com type=refreshOnly interval=00:00:05:00 searchbase="dc=example,dc=com" binddn="uid=syncrepl,ou=system,dc=example,dc=com" credentials=xxxxxx # referral line to update the master updateref ldap://server.example.com ##### # ACL's ##### ## Give Admins immediate write access access to dn.subtree="dc=example,dc=com" by group/groupOfUniqueNames/uniqueMember="cn=LDAP Admins,ou=Groups,dc=example,dc=com" write by * none break access to attrs=userPassword by self write by dn="cn=proxyagent,ou=profile,dc=example,dc=com" read by * auth access to * by self write by * read ######################################################################### # Database 2: ######################################################################### database bdb suffix "dc=wired,dc=hotdog,dc=com" rootdn "cn=Manager,dc=wired,dc=hotdog,dc=com" directory /var/lib/openldap-wired # Indices to maintain for this database index cn pres,sub,eq index sn pres,sub,eq index uid pres,sub,eq index displayName pres,sub,eq index uidNumber eq index gidNumber eq index objectClass eq index memberUid eq,subinitial index mail eq,subinitial index givenname eq,subinitial index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index entryCSN,entryUUID eq index default sub #password-hash #password-hash {MD5} - slave doesn't set passwords either. #security ssf=1 update_ssf=112 simple_bind=64 tls=1 security tls=1 #disallow bind_anon #disallow bind_simple_unprotected #disallow bind_simple # synrepl parameters for the slave syncrepl rid=001 provider=ldap://server.example.com type=refreshOnly interval=00:00:05:00 searchbase="dc=wired,dc=hotdog,dc=com" binddn="uid=syncrepl,ou=system,dc=example,dc=com" credentials=xxxxxx ##### # ACL's ##### ## Give Admins immediate write access access to dn.subtree="dc=wired,dc=hotdog,dc=com" by group/groupOfUniqueNames/uniqueMember="cn=LDAP Admins,ou=Groups,dc=example,dc=com" write by * none break access to dn.base="" by self write by * auth access to attrs=userPassword,sambaLMPassword,sambaNTPassword by self write by anonymous auth by * none access to * by * read by anonymous auth on the server I have index entryCSN,entryUUID eq overlay syncprov syncprov-checkpoint 50 100 syncprov=sessionlog 100 in each database section.... Is this the correct approach??? notice the the rid numbers are the same is that right? thanks james

2 1

Password Policy pwdHistory not being checked? -- answer found
by Ben Spencer 08 Feb '08

08 Feb '08

Thanks all -- the answer to my question was found in http://www.openldap.org/lists/openldap-software/200701/msg00164.html benji --- Benji Spencer System Administrator Ph: 312-329-2288

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software