openldap-software

openldap-software@openldap.org

2719 discussions

Inserting ACLs in CN=config
by Christian Marg 16 Nov '07

16 Nov '07

Hello, from reading the AdminGuide and a quick search through the FAQ-o-Matic I couldn't gather how I'd insert a new ACL between the existing rules 2 and 3... Do I have to replace the complete olcAccess-Attribute? Or can I somehow instruct an LDIF - "Modify/Add" to insert the Value in a specific place? If it isn't available now, maybe it could be done with using only even Weights for the rules, and when one adds a rule with an odd weight, it is inserted in the correct place and the remaining entries renumbered accordingly... bye Christian -- Christian Marg mail : mailto:marg@rz.tu-clausthal.de Dezernat 2 TU Clausthal web : http://www.tu-clausthal.de D-38678 Clausthal-Zellerfeld fon : 05323/72-2107 Germany jabber: ifcma(a)jabber.tu-clausthal.de

4 5

syncrepl/sasl problems
by Lawrence Strydom 16 Nov '07

16 Nov '07

Hi List, I need to configure a master and slave ldap server with replication. I am running openSUSE10.2 and openldap2-2.3.27-25. Initially I was using slurpd but syncrepl was recommended to me as being more agreeable with my ldap version. I configured my master and slave according to the instructions from the openldap web site: http://www.openldap.org/doc/admin22/syncrepl.html Here is the slave slapd.conf: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ loglevel 256 TLSCertificateFile /etc/openldap/servercert.pem TLSCACertificateFile /etc/openldap/cacert.pem TLSCertificateKeyFile /etc/openldap/serverkey.pem database bdb suffix "dc=mydomain,dc=com" rootdn "cn=replica,dc=mydomain,dc=com" rootpw "{ssha}mypassword" directory /var/lib/ldap/ checkpoint 1024 5 cachesize 10000 index objectClass,uidNumber,gidNumber eq index member,mail eq,pres index cn,displayname,uid,sn,givenname sub,eq,pres #Entries for replication using sync-repl syncrepl rid=123 provider=ldap://ldap1.mydomain.com type=refreshAndPersist #interval=01:00:00:00 searchbase="dc=mydomain,dc=com" filter="(objectClass=organizationalPerson)" scope=sub attrs="cn,sn,ou,telephoneNumber,title,l" schemachecking=off updatedn="cn=replica,dc=mydomain,dc=com" bindmethod=sasl #saslmech=digest-md5 binddn="cn=Administrator,dc=mydomain,dc=com" credentials="{ssha}mypassword" ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ And here is my master slapd.conf ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ loglevel 256 TLSCertificateFile /etc/openldap/servercert.pem TLSCACertificateFile /etc/openldap/cacert.pem TLSCertificateKeyFile /etc/openldap/serverkey.pem database bdb suffix "dc=mydomain,dc=com" rootdn "cn=Administrator,dc=mydomain,dc=com" rootpw "{ssha}mypassword" directory /var/lib/ldap/ checkpoint 1024 5 cachesize 10000 index objectClass,uidNumber,gidNumber eq index member,mail eq,pres index cn,displayname,uid,sn,givenname sub,eq,pres #Entries for replication using sync-repl sessionlog 999 999 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ OK as you can see I am using bindmethod=sasl because when I was using bindmethod=simple, I got an error code 49 LDAP_INVALID_CREDENTIALS Now as far as I can detirmine from the log below, the connection is made so syncrepl is configured correctly but there is some sort of problem with sasl. It seems that the attribute "supportedSASLMechanisms" is not found on the master. I get the same error If I uncomment the "saslmech=digest-md5" entry. /var/log/messages on the master: +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Nov 14 18:52:28 ldap1 slapd[18695]: conn=35 fd=13 ACCEPT from IP= 192.168.2.246:9243 (IP=0.0.0.0:389) Nov 14 18:52:28 ldap1 slapd[18695]: conn=35 op=0 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" Nov 14 18:52:28 ldap1 slapd[18695]: conn=35 op=0 SRCH attr=supportedSASLMechanisms Nov 14 18:52:28 ldap1 slapd[18695]: conn=35 op=0 SEARCH RESULT tag=101 err=0 nentries=1 text= Nov 14 18:52:28 ldap1 slapd[18695]: conn=35 op=1 UNBIND Nov 14 18:52:28 ldap1 slapd[18695]: conn=35 fd=13 closed +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ and on the slave: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Nov 14 16:13:47 ldap2 slapd[8305]: @(#) $OpenLDAP: slapd 2.3.27 (Nov 25 2006 17:08:16) $ abuild@eisler:/usr/src/packages/BUILD/openldap-2.3.27 /servers/slapd Nov 14 16:14:07 ldap2 slapd[8305]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1: Can't contact LDAP server Nov 14 16:14:07 ldap2 slapd[8305]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1: Can't contact LDAP server Nov 14 16:14:07 ldap2 slapd[8305]: nss_ldap: could not search LDAP server - Server is unavailable Nov 14 16:14:07 ldap2 slapd[8312]: slapd starting Nov 14 16:14:07 ldap2 slapd[8312]: do_syncrep1: ldap_sasl_interactive_bind_s failed (16) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Am I on the right track looking for the errors in sasl, and if so, how do I set the attributes? Thanks in advance Lawrence

4 4

Slurpd problems
by Lawrence Strydom 16 Nov '07

16 Nov '07

Hi List. I have been trying to set up replication between two LDAP servers running OpenSuSE10.2 and Openldap 2-2.3.27-25 but unfortunately I am not having a lot of success :( The master server is called ldap1. This is slapd.conf: +++++++++++++++++++++++++++++++++++++++++++++++++++++++ loglevel -1 TLSCertificateFile /etc/openldap/servercert.pem TLSCACertificateFile /etc/openldap/cacert.pem TLSCertificateKeyFile /etc/openldap/serverkey.pem database bdb suffix "dc=mydomain,dc=com" rootdn "cn=Administrator,dc=mydomain,dc=com" rootpw "{ssha}mypassword" directory /var/lib/ldap/ checkpoint 1024 5 cachesize 10000 index objectClass,uidNumber,gidNumber eq index member,mail eq,pres index cn,displayname,uid,sn,givenname sub,eq,pres #Entries for replication replica uri=ldap://192.168.2.246.1:389 binddn="cn=replica,dc=mydomain,dc=com" bindmethod=simple credentials="{ssha}mypassword" replogfile /var/lib/ldap/slurpd.replog +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ As you can see the loglevel is set to -1 as I have been trying to troubleshoot this for the last two days... The slave server is ldap2 and here is slapd.conf: +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ loglevel -1 database bdb suffix "dc=mydomain,dc=com" rootdn "cn=replica,dc=mydomain,dc=com" rootpw "{ssha}mypassword" directory /var/lib/ldap/ checkpoint 1024 5 cachesize 10000 index objectClass,uidNumber,gidNumber eq index member,mail eq,pres index cn,displayname,uid,sn,givenname sub,eq,pres #Entries for replication updatedn="cn=replica,dc=mydomain,dc=com" updateref=ldap://ldap1.mydomain.com replogfile /var/lib/ldap/slurpd.replog ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ OK so slapd starts without error on both servers and slurpd on ldap1. /var/lib/ldap/slurpd.replog is created successfully and there is also another replog file created in /var/lib/slurpd/replica/slurpd.replog which the man page tells me is a working directory to which slurpd copies the replog before processing it. Ok so now all seems normal up to here but this is where the trouble starts. I update an entry in the database on ldap1 and the following is written to /var/lib/slurpd/replica/slurpd.replog: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ replica: 192.168.2.246 time: 1194939780 dn: uid=user.three,ou=people,dc=mydomain,dc=com changetype: modify replace: sn sn: Tres - replace: entryCSN entryCSN: 20071113074300Z#000000#00#000000 - replace: modifiersName modifiersName: cn=Administrator,dc=mydomain,dc=com - replace: modifyTimestamp modifyTimestamp: 20071113074300Z +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ but /var/lib/ldap/slurpd.replog remains empty and the updated entry is not replicated to ldap2 The permissions on /var/lib/ldap/slurpd.replog: -rw-r--r-- 1 ldap ldap 0 2007-11-13 11:43 /var/lib/ldap/slurpd.replog I don't see any other errors in /var/log/messages but there is a LOT of output and I most of it seems quite cryptic. I am really at a loss here and would appreciate it if anybody can point out a mistake in my configuration or any other glaringly obvious errors. Thanks Lawrence

5 6

Howto extend LDAP in java with JLDAP
by Erik van Oosten 16 Nov '07

16 Nov '07

Hi, Based on my experiences with implementing a RFC4533 (synchronization) client with JLDAP I created a small howto. You can find it on my blog: http://day-to-day-stuff.blogspot.com/2007/11/howto-extend-ldap-in-java-with…. Have fun, Erik. -- Erik van Oosten http://2008.rubyenrails.nl/ http://www.day-to-day-stuff.blogspot.com/

1 0

Mirror Mode
by Clowser, Jeff (Contractor) 16 Nov '07

16 Nov '07

I have a question about mirror mode, and how it's different from "multimaster". In servers like Sun or Red Hat's directory server, a simplified description of what they term multimaster is that more than one server can accept writes simultaneously, and it will then propogate all changes to other servers. If there is a conflicting change, some form of conflict resolution logic is implemented. If I understand Mirror Mode correctly, the major difference is that it does not contain code for conflict resolution. I.e. both masters are live, and will accept changes, and try to replicate them to the other master (the hot standby master does not reject changes when the other master is the "live" master). If a conflict occurs, bad things happen. It depends on some third resource (a load balancer, slapd in proxy mode, etc) ensuring that all writes go to only one master server at a time, and that all clients doing writes use that frontend to send writes to. At the same time, the individual masters don't do anything to enforce the fact that writes are coming through that load balancer/proxy/etc, so it's possible to write to both masters concurrently (though not desirable). So.. a couple of questions: 1. Is this understanding a correct one? Have I missed any key points (or completely gotten it wrong)? 2. If so, and I write conflicting changes to both master servers directly, what happens when they try to sync? (What does it do with the conflicting changes, does it prevent any future changes from being replicated or can it "skip" the conflicting change, how do I detect a conflict to manually fix it, and what do I need to do actually fix it (can I just resolve the data issue, or do I have to remove something from a replication queue and how, etc)?) 3. I can envision an HA configuration having 2 sites. At each site I have a proxy and a master, with one site having the primary master, the other having a hot standby. Both proxies direct traffic to the primary master if it's available, or redirect to the hot standby master if not. Connection between sites goes down, so one proxy is directing writes to the primary master, but the other now can't get to the primary, so sends writes to the hot standby master, thinking it is down. Assuming this happens, and NO conflicting modifications are made, when the connection between sites comes back up, will everything sync up properly so everything has the same content (if a conflicting change occurs, it would be covered by the previous point). Thanks, - Jeff

4 10

2.4 and MMR examples?
by Kimmo Koivisto 15 Nov '07

15 Nov '07

Hello I'm now using RHEL4 and Fedora DS with it's N-way multimaster replication feature. I'm not totally happy with it and I would like to try Openldap 2.4 instead. I would like to install at least three way MMR, with servers A,B and C. Replication should be SSL-protected, but can manage without SSL too. Is there any example configuration files available that I could start with? Could not find example from FAQ and Administrator's Guide, could someone provide links to the examples? Regards, Kimmo Koivisto

2 1

Re: 2.4 and MMR examples?
by Gavin Henry 15 Nov '07

15 Nov '07

>quote who="Kimmo Koivisto"> > Hello > > I'm now using RHEL4 and Fedora DS with it's N-way multimaster replication > feature. I'm not totally happy with it and I would like to try Openldap > 2.4 > instead. > > I would like to install at least three way MMR, with servers A,B and C. > Replication should be SSL-protected, but can manage without SSL too. > > Is there any example configuration files available that I could start > with? See test050-syncrepl-multimaster in tests/scripts/ Pretty simple. > > Could not find example from FAQ and Administrator's Guide, could someone > provide links to the examples? I'm working on it for the next release. > > Regards, > Kimmo Koivisto >

1 0

pwdMustChange Does not work
by Aghor, Shriwallabh (Sachin) 15 Nov '07

15 Nov '07

Hello, We are using openldap 2.3.37 , We have set up ppolicy with following attributes : <ppolicy.lidf> dn: cn=basicPwdPolicy,dc=avaya,dc=com cn: basicPwdPolicy objectClass: device objectClass: pwdPolicy objectClass: top pwdAttribute: 2.5.4.35 pwdMaxAge: 86400 pwdAllowUserChange: TRUE pwdMustChange: TRUE </ppolicy.lidf> We have added this policy in slapd.conf file as below : overlay ppolicy ppolicy_default "cn=basicPwdPolicy,dc=avaya,dc=com" For users we are adding we are able to see password expiry, however ("pwdMustChange") user is not forced to change the password for first login. We want to force user to change its password on the first login. Any help in this context will be appreciated Regards, Shriwallabh Aghor(Sachin) | CSAD R&D | Avaya India Pvt. Ltd | Level # 2,Tower # 1 | Cybercity, Magarpattacity,Hadapsar | Pune,Maharashtra,India 411028 | Voice: 91-20-30412611 | E-mail: ashriwallabh(a)avaya.com

2 1

no such object (32)
by Adam Williams 15 Nov '07

15 Nov '07

Can someone help me to understand why I am getting this error? I'm wanting to modify 2 lines. I have: ldapsearch -D 'cn=Manager,dc=gomer,dc=mdah,dc=state,dc=ms,dc=us' -b "cn=NextFreeUnixId,dc=gomer,dc=mdah,dc=state,dc=ms,dc=us" -w xxxxxxxx -x # extended LDIF # # LDAPv3 # base <cn=NextFreeUnixId,dc=gomer,dc=mdah,dc=state,dc=ms,dc=us> with scope subtree # filter: (objectclass=*) # requesting: ALL # # NextFreeUnixId, gomer.mdah.state.ms.us dn: cn=NextFreeUnixId,dc=gomer,dc=mdah,dc=state,dc=ms,dc=us objectClass: inetOrgPerson objectClass: sambaUnixIdPool cn: NextFreeUnixId sn: NextFreeUnixId uidNumber: 10019 gidNumber: 10000 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 so I create: cat NextFreeUnuxID.ldif dn: cn=NextFreeUnixIdPool,dc=gomer,dc=mdah,dc=state,dc=ms,dc=us changetype: modify gidNumber: 105 uidNumber: 517 but when I run it: ldapmodify -D "cn=Manager,dc=gomer,dc=mdah,dc=state,dc=ms,dc=us" -w xxxxxxxxx -x -v -f NextFreeUnuxID.ldif ldap_initialize( <DEFAULT> ) replace gidNumber: 105 replace uidNumber: 517 modifying entry "cn=NextFreeUnixIdPool,dc=gomer,dc=mdah,dc=state,dc=ms,dc=us" modify complete ldapmodify: No such object (32) matched DN: dc=gomer,dc=mdah,dc=state,dc=ms,dc=us and I'm just stumped. why am I getting that error? cn=NextFreeUnixIdPool exists according to the ldapsearch.

4 4

Re: Unexpected Attribute Behavior
by Gavin Henry 15 Nov '07

15 Nov '07

<quote who="Kevin Burnett"> > Gavin, Hi, Best keep replies on list for others to benefit. > Sorry for the delay. I have tried the stable version 2.3.38 along with > 2.3.39 and 2.4.6. All of these versions exhibit the same behavior of > the malformed SQL statement. All of the errors only occur with the > three attributes I previously mentioned. OK. > > I also replied to Buchan, letting him know that I had tested on these > versions. What would you suggest I do to further debug the problem? Try setting up a normal 2.3.39 with bdb backend, populate and then test. I have a feeling maybe something is wrong with your schema. Also run slaptest. > > OpenLDAP is a great product and I would use no other. ;-) > > Regards, > > Kevin > > On Nov 12, 2007 12:58 AM, Gavin Henry <ghenry(a)openldap.org> wrote: >> <quote who="Kevin Burnett"> >> > Sorry... >> > >> > slapd version: 2.3.32 >> > on RHEL4 i386 >> >> The usual story applies here, please try with our latest version and get >> back to us. >> >> Gavin. >> >> >> > >> > Thanks, >> > >> > Kevin >> > >> > On Nov 11, 2007 1:17 PM, Gavin Henry <ghenry(a)openldap.org> wrote: >> >> >> >> Kevin Burnett wrote: >> >> > I am implementing an OpenLDAP installation that utilizes >> inetOrgPerson >> >> > as the main user structure with roughly forty attributes that may >> be >> >> > used with each user. Of the forty attributes, I have added a custom >> >> > schema which includes 15 custom attributes. I am using MySQL 5 as >> the >> >> > backend via backsql. >> >> > >> >> > The problem I am seeing is that for a given user, if I write values >> to >> >> > all 40 attributes and then read them back using an LDAP browser, >> three >> >> > of the attributes do not return their values. The three attributes >> >> > are: cn, userPassword, and employeeType. >> >> > >> >> > I have run slapd with the debug level of -1 (all) to capture a >> trace >> >> > of what happens when I read an attribute that correctly returns its >> >> > value and also a trace of reading an attribute that does not return >> >> > its value (cn, userPassword, or employeeType). Comparing the two >> >> > traces, the only appreciable difference between the two is as >> follows, >> >> > which is in the failing trace: >> >> > >> >> > ==>backsql_id2entry() >> >> > backsql_id2entry(): custom attribute list >> >> > ==>backsql_get_attr_vals(): oc="inetOrgPerson" attr="employeeType" >> >> keyval=8 >> >> > backsql_get_attr_vals(): error executing attribute count query >> 'SELECT >> >> > COUNT(*) FROM users WHERE users.id=? AND ' >> >> > Return code: -1 >> >> > nativeErrCode=1064 SQLengineState=37000 msg="[MySQL][ODBC 3.51 >> >> > Driver][mysqld-5.0.45-community-log]You have an error in your SQL >> >> > syntax; check the manual that corresponds to your MySQL server >> version >> >> > for the right syntax to use near '' at line 1" >> >> > ==>backsql_get_attr_vals(): oc="inetOrgPerson" attr="objectClass" >> >> keyval=8 >> >> > >> >> > I also set up a MySQL error trace and ran the two attribute reads >> and >> >> > came up with the only appreciable difference being the SQL >> statement, >> >> > as above: >> >> > >> >> > 43 Query SELECT COUNT(*) FROM users WHERE users.id=8 AND >> >> > >> >> > It appears to me that the SQL statement is not being completed for >> >> > some reason, since in the slapd trace where the attribute read is >> >> > successful, the backsql_get_attr_vals(); just prints out, number of >> >> > values in query: 1, followed by, number of values in query: 0, >> >> > followed by the actual data packets containing the value of the >> >> > attribute. >> >> > >> >> > I can provide additional information if needed. I was unable to >> find >> >> > information about this problem on the OpenLDAP site. >> >> > >> >> > Kevin Burnett >> >> >> >> You don't say what slapd version you are using. Please provide the >> >> basics. >> >> >> >> -- >> >> Kind Regards, >> >> >> >> Gavin Henry. >> >> OpenLDAP Engineering Team. >> >> >> >> E ghenry(a)OpenLDAP.org >> >> >> >> Community developed LDAP software. >> >> >> >> http://www.openldap.org/project/ >> >> >> > >> >> >

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software