openldap-software

openldap-software@openldap.org

2719 discussions

Start TLS
by Andy 14 Dec '07

14 Dec '07

Hello, I currently have a openldap installed on a debian etch box. I have setup a CA on the box and created the certificates and have ssl/tsl working. I have tested that ssl/tsl is working by preforming a search "# ldapsearch -x -W -D 'cn=admin,dc=test,dc=com' -H \ ldap://test.com -ZZ '(uid=users.1)' This search operation returns me with the correct user. When I try and preform a "startTLS" from another PC I recieve the following error ldap_start_tls: Connect error (-11) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Can anyone help me solve this problem? -- REGARDS, Andy Z

2 1

Missing attributes
by Michael Magua 14 Dec '07

14 Dec '07

Hi list, I'm in the process of migrating a Red Hat OpenLDAP setup to SLED 10. I've got most things working however I'm trying to import an ldif which has a "gecos" and "comment" attribute but when I import the ldif I get these errors: --snip--- adding new entry "cn=navsea,ou=addressbook,dc=domain,dc=com" ldap_add: Undefined attribute type (17) additional info: comment: attribute type undefined adding new entry "cn=Lee-ann Williams,ou=addressbook,dc=domain,dc=com" ldap_add: Object class violation (65) additional info: attribute 'gecos' not allowed --snip--- An example of the ldif: dn: cn=prealertplz,ou=addressbook,dc=domain,dc=com objectClass: top objectClass: inetOrgPerson mail: prealertplz(a)domain.com cn: prealertplz sn: prealertplz uid: prealertplz gecos: Distribution List comment: gordon,marianne,rene,charmainef,jeevan,marykev I'm not sure what I can do to fix this and I'll be honest that OpenLDAP is something new to me. Thanks Michael

3 3

Current preferred way to contribute new OpenLDAP schemas?
by Kari Mattsson 13 Dec '07

13 Dec '07

Hi list! What is the preferred way to contribute new OpenLDAP schema (attributes/object classes) with public OIDs, of course, to the community? I did not find appropriate FAQ entry on this. -Kari

2 2

openldap delete attributetypes
by fabrizio francavilla 13 Dec '07

13 Dec '07

Hi guys, i'have a problem. I have to delete an attribute and add another attribute on my openldap server schema. I'have to delete this entry attributetype ( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple' DESC 'Netgroup triple' SYNTAX 1.3.6.1.1.1.0.0 ) and change with this one attributetype ( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple' DESC 'Netgroup triple' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) I'm trying some ldapmodify but everytime i've received a syntax error.. cat delete.ldif dn:cn=schema changetype:modify delete:attributeTypes attributetypes ( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple' DESC 'Netgroup triple' SYNTAX 1.3.6.1.1.1.0.0 ) ldapmodify -x -H ldaps://slave-sv.sv.poste.it:636 -D "cn=admin,dc=slapd,dc=cs,dc=poste,dc=it" -w ****** -f delete.ldif ldapmodify: invalid format (line 4) entry: "cn=schema" Thanks in advance!! -- ----------------------------------- Fabrizio Francavilla Service Centers Unit - Servizi Sistemistici Postecom S.p.A---- -----------------------------------

2 1

syncrepl_message_to_op
by Digant C Kasundra 13 Dec '07

13 Dec '07

I noticed this in my logs when replication failed. Besides increasing the number of locks, is there something larger that is going on that might be causing a problem? Dec 12 15:06:01 ldap4 slapd[14212]: bdb(dc=stanford,dc=edu): Lock table is out of available locks Dec 12 15:06:01 ldap4 slapd[14212]: => bdb_idl_delete_key: c_get id failed: Cannot allocate memory (12) Dec 12 15:06:01 ldap4 slapd[14212]: Attribute index delete failure Dec 12 15:06:01 ldap4 slapd[14212]: null_callback: error code 0x50 Dec 12 15:06:01 ldap4 slapd[14212]: syncrepl_message_to_op: rid 000 be_modify suRegID=xxxx,cn=People,dc=Stanford,dc=edu (80)

3 2

Regarding distributed directory services : ldap_add_s: Insufficient access (50)
by Rakesh Yadav 12 Dec '07

12 Dec '07

Hi , my slapd.conf file on parent server is like this : include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/new_core.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Directives needed to implement policy: #access to dn.base="" by * read #access to dn.base="cn=Subschema" by * read # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! olcAccess: to * by * write access to * by * write by anonymous auth by * read ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=cdac,dc=in" rootdn "cn=Manager,dc=cdac,dc=in" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq ----------------------------------------------------------------------------------------------------------------------------------------- and slapd.conf on child server is like this : include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/new_core.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args allow update_anon #allow bind_anon_dn #allow bind_anon_cred #olcAccess: to dn.children="FileName=Development,dc=cdac,dc=in" by * write #bydn.subtree="FileName=Development,dc=cdac,dc=in" write olcAccess: to * by * write ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "FileName=Development,dc=cdac,dc=in" rootdn "cn=Manager,FileName=Development,dc=cdac,dc=in" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq ----------------------------------------------------------------------------------------- when i am trying to add entry under child server through parent server getting error this : bdb_dn2entry("FileName=imp_doc,FileName=rkyadav,FileName=development,dc=cdac,dc=in") => bdb_dn2id("FileName=rkyadav,FileName=development,dc=cdac,dc=in") <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30990) bdb_referrals: op=104 target="FileName=Imp_doc,FileName=rkyadav,FileName=Development,dc=cdac,dc=in" matched="FileName=Development,dc=cdac,dc=in" ldap_url_parse_ext(ldap://192.168.4.147/FileName=Development,dc=cdac,dc=in) send_ldap_result: conn=1 op=1 p=3 send_ldap_response: msgid=2 tag=105 err=10 ber_flush: 143 bytes to sd 11 ldap_add_s: Insufficient access (50) additional info: no write access to parent connection_get(11): got connid=1 connection_read(11): checking for input on id=1 ber_get_next ber_get_next on fd 11 failed errno=0 (Success) connection_closing: readying conn=1 sd=11 for close connection_close: conn=1 sd=11 Actually ldap_search is successfully done and we are able to get entries of child server from parent server. So, there is no connectivity error. Please reply me as soon as possible Thanks and Regards, Rakesh Yadav

4 6

rwm-overlay and ldap-backend do suit me ?
by Frava 12 Dec '07

12 Dec '07

Hi all, I'm trying to setup a ldap server with openldap 2.3 and I need some lights about how to do it. I explain: My company already have a central ldap server (openldap 2.2) on which I can find all users and authenticate them, but the corresponding attributes (homedir, shell, gidnumber) aren't relevant for my department. My problem is that I want to use the central ldap serveur for authentification purpose and store locally the other datas. Yeah, it seems easy to solve using the rwm overlay and a ldap backend, but it isn't, because the users are located on different OUs on the remote ldap server. So there is the relevant part of my slapd.conf, which works great for the first user unit : #################################### overlay rwm rwm-rewriteEngine on rwm-rewriteContext bindDN # path to the remote users : ou="unit_number",ou=people,dc=example,dc=com # path to the local users : cn=users,dc=local,dc=example,dc=com rwm-rewriteRule "^uid=([^,]+),cn=users,dc=local,dc=example,dc=com$" "uid=$1,ou=unit_1,ou=people,dc=example,dc=com" ":@" # Database for remote Authentification database ldap suffix "ou=people,dc=example,dc=com" uri "ldap://remote-ldap.example.com:389/" restrict read write extended # Local Database database bdb suffix "dc=local,dc=example,dc=com" #################################### I tried to complete my setup by adding a line like : uri "ldap://remote- ldap.example.com:389/ou=people,dc=example,dc=com??sub?(&(objectClass=posixAccount)(uid=$1)) " but the ldap backend isn't designed to do that ^^ So, is there a way to work around it ? Thanks for your help, Frava.

2 3

Regarding distributed directory services
by Anjali Arora 11 Dec '07

11 Dec '07

Hi, my slapd.conf file is like this : # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/new_core.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=cdac,dc=in" rootdn "cn=Manager,dc=cdac,dc=in" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq dn: FileName=home,dc=cdac,dc=in FileName: home ref: ldap://neo00/FileName=home,dc=cdac,dc=in objectClass: referral objectClass: extensibleObject and i have added these additional members in the default core.schema : objectclass ( 1.3.6.1.4.1.1466.101.120.111 NAME 'extensibleObject' DESC 'RFC2252: extensible object' SUP top AUXILIARY ) attributetype ( 2.16.840.1.113730.3.1.34 NAME 'ref' DESC 'named reference - a labeledURI' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE distributedOperation ) objectclass ( 2.16.840.1.113730.3.2.6 NAME 'referral' DESC 'named subordinate reference object' STRUCTURAL MUST ref ) and when i am going to start slapd it will give me error : root@neo05:/root/anjali/openldap/openldap-2.3.38/servers/slapd @(#) $OpenLDAP: slapd 2.3.38 (Dec 10 2007 16:07:48) $ root@neo05:/root/anjali/openldap/openldap-2.3.38/servers/slapd daemon_init: listen on ldap:/// daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap:///) daemon: listener initialized ldap:/// daemon_init: 1 listeners opened neo05 init: initiated server. slap_sasl_init: initialized! bdb_back_initialize: initialize BDB backend bdb_back_initialize: Sleepycat Software: Berkeley DB 4.2.52: (September 21, 2004) hdb_back_initialize: initialize HDB backend hdb_back_initialize: Sleepycat Software: Berkeley DB 4.2.52: (September 21, 2004) /usr/local/etc/openldap/schema/core.schema: line 597: attribute type " 2.16.840.1.113730.3.1.34" is operational neo05 destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. [1]+ Exit 1 /usr/local/libexec/slapd -V -n neo05 -4 -d 1 Please give me solution for this problem as soon as possible. Actually i want to do the communication between two ldap servers in chaining fasion Thanks and Regards, Anjali

3 2

slapd seg faults when 'ppolicy_default' is enabled
by R.B. 11 Dec '07

11 Dec '07

Hi; I'm in the process of configuring ppolicy for OpenLDAP using Buchan's RPMs and it seems that after adding my policy and enabling it in my slapd.conf file, slapd seg faults (see output below). If I uncomment the 'ppolicy_default' line, the server starts fine and continues to serve. Help? Thank you! Rafael OS: RHEL4 OpenLDAP: 2.3.38 - buchan's RPMs for RHEL4 Output: ######## -bash-3.00# slapd2.3 -u ldap -g ldap -l LOCAL0 -s 0 -f etc/slapd.conf -h ldap:/// -d 1 @(#) $OpenLDAP: slapd 2.3.38 (Aug 23 2007 12:54:24) $ bgmilne@build.telkomsa.net:/home/bgmilne/rpm/BUILD/openldap-2.3.38/servers/slapd daemon_init: listen on ldap:/// daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap:///) daemon: listener initialized ldap:/// daemon_init: 2 listeners opened slapd2.3 init: initiated server. slap_sasl_init: initialized! bdb_back_initialize: initialize BDB backend bdb_back_initialize: Sleepycat Software: Berkeley DB 4.2.52: (December 3, 2003) hdb_back_initialize: initialize HDB backend hdb_back_initialize: Sleepycat Software: Berkeley DB 4.2.52: (December 3, 2003) bdb_db_init: Initializing BDB database >>> dnPrettyNormal: <dc=swa,dc=com> <<< dnPrettyNormal: <dc=swa,dc=com>, <dc=swa,dc=com> >>> dnPrettyNormal: <cn=Manager,dc=swa,dc=com> <<< dnPrettyNormal: <cn=Manager,dc=swa,dc=com>, <cn=manager,dc=swa,dc=com> >>> dnPrettyNormal: <cn=swaPasswordPolicy,ou=Policies,dc=swa,dc=com> <<< dnPrettyNormal: <cn=swaPasswordPolicy,ou=Policies,dc=swa,dc=com>, <cn=swapasswordpolicy,ou=policies,dc=swa,dc=com> ==> ppolicy_cf_default ==> ppolicy_cf_default add >>> dnNormalize: <cn=Subschema> Segmentation fault ######## slapd.conf: ######## include /usr/share/openldap2.3/schema/core.schema include /usr/share/openldap2.3/schema/cosine.schema include /usr/share/openldap2.3/schema/inetorgperson.schema include /usr/share/openldap2.3/schema/nis.schema include /usr/share/openldap2.3/schema/misc.schema include /usr/share/openldap2.3/schema/corba.schema include /usr/share/openldap2.3/schema/openldap.schema include /usr/share/openldap2.3/schema/ppolicy.schema access to attrs=shadowLastChange,userPassword by self write by anonymous auth by * none access to * by * read pidfile /cluster/agis-ldap/ldap-master/var/run/slapd.pid argsfile /cluster/agis-ldap/ldap-master/var/run/slapd.args modulepath /usr/lib/openldap2.3 moduleload ppolicy.la loglevel 1 database bdb suffix "dc=swa,dc=com" rootdn "cn=Manager,dc=swa,dc=com" rootpw {SSHA}xxxxx directory /cluster/agis-ldap/ldap-master/var/lib/ldap overlay ppolicy ppolicy_default "cn=swaPasswordPolicy,ou=Policies,dc=swa,dc=com" ppolicy_use_lockout cachesize 100000 idlcachesize 100000 checkpoint 256 5 index objectClass eq index ou,cn,mail,givenname eq,subinitial index uidNumber,gidNumber,memberUid,loginShell eq index uid eq,subinitial ########

3 3

logging
by Craig 11 Dec '07

11 Dec '07

Hi, I was recently looking at our logs and trying to figure out what an appropriate logging level is for a stable, production system. What I would really like is a log (or logs) that contain: - the request made - the client (IP) that made the request - how much time it took to answer the request - any errors, with LDAP error codes including errors with configs - syncrepl info, eg: "sync completed added 2 entries, changed 4" The current log level scheme doesn't seem to support that. (Please correct me if I'm wrong.) I guess I am looking for something more like Apache's logging (access/request log and an error log). While openldap uses syslog, there is no mention of it supporting "debug/info/error/warn" type of log differentiation. Is it possible to do all of the above "today"? If not, is it "on the plan"? Is there any plan to move away from using syslog? Or at least, make it configurable which syslog facility to use? (Not having "local4" hardcoded.) Any comments would be appreciated. TIA! Craig

7 16

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software