openldap-software

openldap-software@openldap.org

2719 discussions

Re: Issue using ldapadd
by Gavin Henry 21 Dec '07

21 Dec '07

<quote who="Jonathan Wage"> > Here is my slapd.conf > > # > # See slapd.conf(5) for details on configuration options. > # This file should NOT be world readable. > # > include /private/etc/openldap/schema/core.schema > > # Define global ACLs to disable default read access. > > # Do not enable referrals until AFTER you have a working directory > # service AND an understanding of referrals. > #referral ldap://root.openldap.org > > pidfile /private/var/db/openldap/run/slapd.pid > argsfile /private/var/db/openldap/run/slapd.args > > # Load dynamic backend modules: > # modulepath /usr/libexec/openldap > # moduleload back_bdb.la > # moduleload back_ldap.la > # moduleload back_ldbm.la > # moduleload back_passwd.la > # moduleload back_shell.la > > # Sample security restrictions > # Require integrity protection (prevent hijacking) > # Require 112-bit (3DES or better) encryption for updates > # Require 63-bit encryption for simple bind > # security ssf=1 update_ssf=112 simple_bind=64 > > # Sample access control policy: > # Root DSE: allow anyone to read it > # Subschema (sub)entry DSE: allow anyone to read it > # Other DSEs: > # Allow self write access > # Allow authenticated users read access > # Allow anonymous users to authenticate > # Directives needed to implement policy: > # access to dn.base="" by * read > # access to dn.base="cn=Subschema" by * read > # access to * > # by self write > # by users read > # by anonymous auth > # > # if no access controls are present, the default policy > # allows anyone and everyone to read anything but restricts > # updates to rootdn. (e.g., "access to * by * read") > # > # rootdn can always read and write EVERYTHING! > > ####################################################################### > # BDB database definitions > ####################################################################### > > database bdb > suffix "dc=example,dc=com" > rootdn "cn=Manager,dc=example,dc=com" > # Cleartext passwords, especially for the rootdn, should > # be avoid. See slappasswd(8) and slapd.conf(5) for details. > # Use of strong authentication encouraged. > rootpw secret > # The database directory MUST exist prior to running slapd AND > # should only be accessible by the slapd and slap tools. > # Mode 700 recommended. > directory /private/var/db/openldap/openldap-data > # Indices to maintain > index objectClass eq > > > Which logs are you referring to? The openldap log? Start slapd by hand with -d -1 and then bind via ldapsearch.

1 0

Re: Issue using ldapadd
by Gavin Henry 21 Dec '07

21 Dec '07

<quote who="Jonathan Wage"> > Hmmm, that didn't help anything either: Check your logs and also paste your slapd.conf Thanks. > > dutchy:/usr/share/openldap jwage$ ldapadd -W -D > cn=Manager,dc=example,dc=com > -f example.ldif -x -H ldap://localhost > Enter LDAP Password: > ldap_bind: Invalid credentials (49) > > Tried this too: > > dutchy:/usr/share/openldap jwage$ ldapadd -W -D > cn=Manager,dc=example,dc=com > -f example.ldif -x -h 127.0.0.1 -p 389 > Enter LDAP Password: > ldap_bind: Invalid credentials (49) > > I have to be overlooking something simple about my setup. I followed all > the > instructions in the quick start guide. > > - Jon > > On Dec 21, 2007 9:42 AM, Gavin Henry <ghenry(a)suretecsystems.com> wrote: > >> <quote who="Jonathan Wage"> >> > Using the following command: >> > >> > ldapadd -x -D "cn=Manager,dc=example,dc=com" -f example.ldif -w secret >> >> Make sure you are pointing to the correct directory server by specifing: >> >> -H ldap://server_ip >> >> and see "man ldapadd" or ldapadd -? for more info. >> > > > > -- > Jonathan Wage > http://www.jwage.com > http://www.centresource.com >

1 0

authz-regexp in slapd.conf
by Jyotishmaan Ray 21 Dec '07

21 Dec '07

Hi All, For user having the dn: uid=jmaan,stornt=non-teach,bn=compcen,dc=nits,dc=ac,dc=in and base=nits.ac.in is this acl enough or i need to change this in my slapd.conf file # lenient auth-request DN to user-auth DN authz-regexp uid=([^,]*),dc=[^,]*,cn=auth uid=$1,stornt=non-teach,bn=compcen,dc=nits,dc=ac,dc=in Which way of mapping is the best:- direct or search based ? What can be the reason for unsuccesfull ldap authentication in my server machine, When i try to login using this uid (among others) through the console (GUI). my ldap server is running in fedora 7. With Thanks and Regards, Jyotishmaan Ray Moderator Of Paradise Groups http://yahoogroups.com/group/Spirituality-Paradise Are You Spiritually Aware !!! Are You Enjoying Yourself !!! See What All You Had Been Missing !!!! Please Join Immediately By Sending A Blank Mail @ Spirituality-Paradise-subscribe(a)yahoogroups.com ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

1 0

very slow queries sometimes with alias deref always and scope sub
by COMBES Julien - CETE Lyon/DI/ET/PAMELA 21 Dec '07

21 Dec '07

Hello, I have a strange problem on all of my openldap servers (master and slaves). In general, requests with alias always dereferenced and scope sub on an attribute indexed are working correctly and answers come in a few milliseconds. But sometimes , during some hours, on all my openldap servers, the same queries are taking a few seconds to be returned (between 10 to 45s). During this time all queries with alias never dereferenced are working correctly. For the openldap master, which is only used to write entries and for slurpd replication, the load average is between 0.2 and 0.5 during the problem. For others servers that have more requests, the load average is growing up. I don't find the reasons which cause the problem. All is coming back to normal performance after the night. I use debian etch openldap package wich provide openldap 2.3.30. My directory has around 150000 entries. I use bdb database. I have somes tuning on DB_CONFIG that I could give, if you think that it could have an interest. For exemple : -> During problem : - with alias deref *never* $ time ldapsearch -x -LLL -H ldap://master.my.domain -b "dc=my,dc=domain" -s sub -a never uid=jean.talus.i <ldap answer> real 0m0.007s user 0m0.004s sys 0m0.000s - with alias deref *always* $ time ldapsearch -x -LLL -H ldap://master.my.domain -b "dc=my,dc=domain" -s sub -a always uid=jean.talus.i <ldap answer> real 0m47.225s user 0m0.004s sys 0m0.000s $ time ldapsearch -x -LLL -H ldap://slave1.my.domain -b "dc=my,dc=domain" -s sub -a always uid=jean.talus.i Time limit exceeded (3) real 0m16.148s user 0m0.000s sys 0m0.004s and so on on all my openldap slaves servers. -> after the night, when it's working correctly again : $ time ldapsearch -x -LLL -H ldap://master.my.domain -b "dc=my,dc=domain" -s sub -a always uid=jean.talus.i <ldap answer> real 0m0.016s user 0m0.000s sys 0m0.004s $ time ldapsearch -x -LLL -H ldap://slave1.my.domain -b "dc=my,dc=domain" -s sub -a always uid=jean.talus.i <ldap answer> real 0m0.020s user 0m0.000s sys 0m0.004s I don't find anything that help me on internet. Do you know how can I correct this or what can it be the cause ? Is there some docs that could help me to tune my openldap servers to correct this ? Regards, Julien

3 3

Problems when following referrals with ldapsearch
by Antonio Alonso 21 Dec '07

21 Dec '07

Hi ! I have configured an slapd/back-meta (slapd_1) which redirects all LDAP messages to an slapd/back-bdb instance (slapd_2). This last slapd instance manages also some other referrals to other slapd/back-bdb instance (slapd_3) I have configured back-meta to follow the referrals. When sending an LDAPsearch to slapd_1 with a base that I have configured as a referral in slapd_2 (the acual data is stored in slapd_3) I see the "Referral (10)" result code in slapd_1 (I am tracing it) but the back-meta is NOT following that referral. I tried directly sending the LDAPsearch to slapd_2 using through the ldapsearch commnand (setting the ldap.conf option REFERRAL parameter to "yes") but I see exactely the same (the "10" resul code, the right "ref" parameter -pointing to the right entry in slapd_3) but the command is NOT following the referral. I tested it with the java LDAPBrowser tool (setting the "follow referrals" option) and it works properly (so now I am sure it is not a problem in the data stored in the backends involved). Do you know what I am missing? I do not know if I forgot some "configuration" option when compiling/creating the openldap libclient library (when installing openLDAP 2.4) as it is used in both ldapsearch and back-meta (so I am starting to think the problem is in that "common" component) ... NOTE: I have tried with referrals followng the "ldap://127.0.0.1: ...." and "ldap://localhost:..." patterns (as all slapd instances are running in the same machine) but I got the same error .... Thanks in advance Best regards / Antonio > Antonio Alonso Alarcón CUDB System Engineer > Ericsson España, S.A. Phone: +34 91339 3085 Via de los Poblados 13 Mobile: +34 609640579 (66215) 28033 Madrid, Spain Fax: +34 91339 1636 E-mail: Antonio.Alonso(a)ericsson.com

1 0

ldap.conf between /etc/openldap or /etc/openldap2.3?
by R.B. 21 Dec '07

21 Dec '07

Hi; I've finally completed my server setup and now I'm focusing on the client configurations (with TLS). I'm using the Buchan RPMs (openldap 2.3.39) for RHEL4 and it creates an /etc/openldap2.3 directory. I also have the base openldap (2.2.x) rpms installed (originally) and it creates the base /etc/openldap directory. After doing an strace, I see that /etc/openldap/ldap.conf is used.... but I want use /etc/openldap2.3/ldap.conf file, how do I switch my ldap client to look here? Thanks, Rafael

5 5

Re: Overlay chain formatting
by Chris Sellers 21 Dec '07

21 Dec '07

I agree. The man pages offer content that is not in the admin guide and are generally well written. Use the man pages if the admin guide leaves you wondering ----- Original Message ----- From: openldap-software-bounces+chris.sellers=nitle.org(a)OpenLDAP.org <openldap-software-bounces+chris.sellers=nitle.org(a)OpenLDAP.org> To: Justin Lambert <jlambert(a)ften.com> Cc: openldap-software(a)openldap.org <openldap-software(a)openldap.org> Sent: Thu Dec 20 19:10:55 2007 Subject: Re: Overlay chain formatting Justin Lambert wrote: > I have spent the last week off and on trying to figure out why my chain > overlay was not working correctly. I tried all combinations of it that I > could find and finally found out that the parser of the slapd.conf file > is picky about spacing. I was trying to make my config file look nice by > indenting the options under "overlay chain" only to find after many > frustrating hours that you cannot do that! I didn't find anywhere that > that was explicitly documented (even though all of the examples were not > formatted that way). Apparently you haven't read the slapd.conf(5) manpage: If a line begins with white space, it is considered a continuation of the previous line. No physical line should be over 2000 bytes long. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

slapcat messages in 2.4
by Michael Ströder 20 Dec '07

20 Dec '07

HI! Can anybody shed some light on what these messages actually mean: back-bdb/back-hdb monitor: "olmBDBAttributes" previously defined "1.3.6.1.4.1.4203.666.1.55.0.1.1" back-bdb/back-hdb monitor: "olmBDBObjectClasses" previously defined "1.3.6.1.4.1.4203.666.3.16.0.1.1" Ciao, Michael.

3 4

Test047 fails if "rwm" not configured
by Dave Horsfall 20 Dec '07

20 Dec '07

Just been playing with 2.4.7, and test047 was failing. It seems that it assumes that "rwm" is present; should I file an ITS? -- Dave Horsfall DTM VK2KFU Ph: +61 2 9552-5509 (direct) +61 2 9552-5500 (switch) Corinthian Eng'ng P/L, Ste 54 Jones Bay Whf, 26-32 Pirrama Rd, Pyrmont 2009, AU

2 2

Client timeout dumps core
by Dave Horsfall 20 Dec '07

20 Dec '07

2.4.7 on FreeBSD 4.10-STABLE On setting the general client timeout with LDAP_OPT_TIMEOUT and performing a search on a simulated hung server ("nc -l 389"), I get a coredump: assertion "r != NULL" failed: file "error.c", line 272 GDB: (gdb) bt #0 0x28136748 in kill () from /usr/lib/libc.so.4 #1 0x2817803e in abort () from /usr/lib/libc.so.4 #2 0x28154033 in __assert () from /usr/lib/libc.so.4 #3 0x280bf519 in ldap_parse_result (ld=0x8050000, r=0x0, errcodep=0xbfbfdb2c, matcheddnp=0x0, errmsgp=0x0, referralsp=0x0, serverctrls=0x0, freeit=0) at error.c:272 #4 0x280bf455 in ldap_result2error (ld=0x8050000, r=0x0, freeit=0) at error.c:222 #5 0x280c016d in ldap_search_s (ld=0x8050000, base=0x0, scope=2, filter=0xbfbff450 "(uid=daveh)", attrs=0xbfbfdbd8, attrsonly=0, res=0xbfbfdbe0) at search.c:392 #6 0x8049e9b in main (argc=0, argv=0xbfbff8b8) at lget.c:662 Known problem? Should I file an ITS? -- Dave Horsfall DTM VK2KFU Ph: +61 2 9552-5509 (direct) +61 2 9552-5500 (switch) Corinthian Eng'ng P/L, Ste 54 Jones Bay Whf, 26-32 Pirrama Rd, Pyrmont 2009, AU

2 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software