openldap-software

openldap-software@openldap.org

2719 discussions

slapo-chain
by manu＠netbsd.org 20 Oct '07

20 Oct '07

Hello I have the following setup: ldap0 is the LDAP master ldap1 and ldap2 are replicas using syncrepl. - Users can use simple authentication on the 3 servers. - ldap0 holds a bunch of ACL to handle modifications - ldap1 and ldap2 have minimal ACL and are there just for reading - Mutual authentication between master and replicas is done by TLS certificates. Now I'd like the replicas to follow updatedn referrals on behalf of the client. That way clients could ask ldap1 and ldap2 to perform modifications, and that would just work. As I understand, this is done through slapo-chain. The modification has to be done on behalf of the user that authenticated on the replica (else my ACL will block). I don't want to give replicas an universal write access to the master, because that will mean I'll have to duplicate the ACL between the master and the replicas. For performance and maintainability sake, I want to avoid that. In an ideal world, I'd like replicas to connect to the master using their certificates, and the master would trust the user identity, as it was authenticated on the replica. Is there an example of how this should be done? I had a look to the test suite, and it does not help very much, as I'm not familiar enough with the authz stuff to grasp enough of how it is supposed to work. I tried this on the replica, as global option: overlay chain chain-uri ldaps://ldap0 chain-idassert-bind bindmethod=sasl saslmech=EXTERNAL mode=self But the modification operation is done using the identity from the replica TLS certificate (which fails) and not from the initial user. Any hint? -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

3 9

"OpenLDAP 2.4 Highlights for 2.4" presentation
by Dustin Puryear 20 Oct '07

20 Oct '07

Howard- I read through your presentation "OpenLDAP Highlights for 2.4". Very informative, thanks. Now, a few questions: 1. re: "ldapadd performance". Can you briefly explain what exactly was done in "Optimized server and client in 2.4" to bring down the ldapadd time from 1:33:08 to 5:20. That's a huge a difference. 2. re: "The Road Ahead...", you note some useful configuration functionality, including: TLS certs as an LDAP object rather than as a file on disk, loadable modules as LDAP objects, and automatic creation of filesystem directories for DBs. Very cool. I do wonder about putting loadable modules into the directory. First, let me preface this by saying that obviously an administrator needs to ensure that the proper access rights are given out. That said, isn't there a real risk of someone running evil code on the LDAP server by simply having the ability to add a loadable module object in the directory? (Yes, this same admin may be able to just delete entries anyway, but that's different to me than actually being able to run code that can hook into slapd.) What is the driver for this developing this functionality? -- Puryear Information Technology, LLC Baton Rouge, LA * 225-706-8414 http://www.puryear-it.com Author, "Best Practices for Managing Linux and UNIX Servers" http://www.puryear-it.com/pubs/linux-unix-best-practices Identity Management, LDAP, and Linux Integration

2 1

extended characterset/binary/base64 support
by Naufal Sheikh 19 Oct '07

19 Oct '07

Hello, I used slapcat command to create an ldiff file. Now ehen I am using slapadd to import that ldiff file into my new server. it cannot parse entries wchih have an attribute (clientOrg) value in extended characterset/base64/binary... I am not sure what it is called. In ldiff file those attribute and attribute values are seperated by double colons, which I think is also pointing to the fact that the value is a extended character set. The original ldap server is running fine. Do i need to compile my new ldap server with some additional support module, or is their any option with slapaddd which I can use to convert the enrties in ldiff or some thing..... If some can pleae point me to the right direction. I have been reading many emails and articles, but I am still not sure what to do. Thanks and Regards Naufal

2 1

syntax
by Richard smith 19 Oct '07

19 Oct '07

Many thanks in advance. ldap_add returned invalid syntax (21) FAQ lists the following extraneous white space (especially trailing white space) improperly encoded characters (LDAPv3 uses UTF-8 encoded Unicode) empty values (few syntaxes allow empty values) Not sure how to proceed. Doesn't look like there are any trailing white spaces or empty values. Also, if I try to login, it seems to know if the correct password is given but then just closes the connection. I'm guessing this may be because all of the ldif file has not been added yet. slapd.log date time server slapd[psid]: conn=1 op=14 ADD dn="cn=config,dc=server,dc=name,dc=example,dc=com" date time server slapd[psid]: conn=1 op=14 RESULT tag=105 err=21 text=objectClass: value #0 invalid per syntax The messages log also included messages as follows: Invalid legacy unicast query packet. Recieved repsonse with invalid source port 2734 on interface 'eth0.0' __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Export/Import LDAP database with passwords
by Gilles Schlienger 19 Oct '07

19 Oct '07

Hi, I would like to export an existing Openldap database on a local new Openldap install? I exported the data in an LDIF file, but it does not contain the passwords What are my options ? 1. Can I export data with passwords ? 2. Can I set default passwords to all my person objects with a script ? 3. Other option ? Thanks a lot in advance ! Regards Gilles _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

4 3

Re: Problem to replace directory entries with ldapmodify
by matthew sporleder 19 Oct '07

19 Oct '07

I've never tried that method of updates, so I really couldn't say. It almost seems like you should try a full delete and then add. I'm putting your reply back on the list so someone else can comment. On 10/18/07, Gessy <gessycaetano(a)gmail.com> wrote: > Hi Matthew, > > > Reading ldif(5) manual, i saw two LDIF types: Entry Records and Change > Records. > LDIF entry records are used to represent directory entries and LDIF change > records are used to represent directory change requests. > > Let me explain with this example: > > Suppose i have on my directory a entry like: > > uid=test,ou=people,dc=example,dc=com > objectClass: account > objectClass: posixAccount > objectClass: SIPIdentity > objectClass: top > uid: test > loginShell: /bin/bash > uidNumber: 600 > gidNumber: 100 > homeDirectory: /home/test > gecos: test > userPassword: {SSHA}nswXaxRGB3jBPNnpYGzRiQrAt6k5eCyr > SIPIdentitySIPURI: sip:00011080@voip.example.com > SIPIdentityServiceLevel: AR > SIPIdentityUserName: 10811080 > SIPIdentityPassword: 8997e7a13ff2641ae6142f05b41efd6f > > If i create a LDIF with other password and without SIP attributes like: > > uid=test,ou=people,dc=example,dc=com > objectClass: account > objectClass: posixAccount > objectClass: SIPIdentity > objectClass: top > uid: test > loginShell: /bin/bash > uidNumber: 600 > gidNumber: 100 > homeDirectory: /home/test > gecos: test > userPassword: {SSHA}xLkfk/Lt5F5VG872wEqbC0H5+AlP6bIu > > And using ldapmodify to update the entry with LDIF above, i expect the all > entry be replaced by LDIF data. Am i wrong? > > if i use a Change record LDIF, it would be: > > uid=test,ou=people,dc=example,dc=com > changetype: modify > replace: userPassword > userPassword: {SSHA}xLkfk/Lt5F5VG872wEqbC0H5+AlP6bIu > - > delete: SIPIdentitySIPURI SIPIdentityServiceLevel SIPIdentityUserName > SIPIdentityPassword > SIPIdentitySIPURI: sip:00011080@voip.example.com > SIPIdentityServiceLevel: AR > SIPIdentityUserName: 10811080 > SIPIdentityPassword: 8997e7a13ff2641ae6142f05b41efd6f > > But i'd really use the entry record LDIF. > > > thanks a lot > Gessy Jr. > > > > On 10/17/07, matthew sporleder < msporleder(a)gmail.com> wrote: > > On 10/17/07, Gessy < gessycaetano(a)gmail.com> wrote: > > > Hi, > > > > > > I have tried replace entries on ldap directory with ldapmodify, my > server is > > > a gentoo linux running a OpenLDAP 2.3.35, but i realized a strange > behavior. > > > > > > When I try replace a entry with follow LDIF: > > > > > > # Test.ldif - test10 > > > dn: uid=test10,ou=people,dc=ufmg,dc=br > > > objectClass: top > > > objectClass: person > > > objectClass: organizationalPerson > > > objectClass: inetOrgPerson > > > objectClass: eduPerson > > > objectClass: brEduPerson > > > objectClass: posixAccount > > > objectClass: shadowAccount > > > objectClass: ufmgEduPerson > > > objectClass: SIPIdentity > > > eduPersonOrgDN: o=UFMG > > > eduPersonOrgUnitDN: ou=LCC > > > eduPersonAffiliation: employee > > > eduPersonPrimaryAffiliation: employee > > > cn: Test10 > > > givenName: Test > > > sn: 10 > > > mail: test10(a)ufmg.br > > > gecos: CN=Test 10 > > > uidNumber: 136617 > > > gidNumber: 100 > > > homeDirectory: /home/ufmg/test10 > > > loginShell: /bin/bash > > > uid: test10 > > > > > > ldapmodify -x -D"cn=manager,dc=ufmg,dc=br" -W -f test.ldif > > > > > > The LDIF above should replace fully a old entry that contains a SIP > > > attributes with only attributes shown in test.ldif , but it update the > entry > > > and keep the SIP attributes. I don't understant. Can someone help me? > > > > > > ldapsearch -x uid=test10 -LLL > > > dn: uid=test10,ou=people,dc=ufmg,dc=br > > > SIPIdentitySIPURI: sip:xxxxx@aaa.bbb.br > > > SIPIdentityServiceLevel: AR > > > SIPIdentityUserName: 10811080 > > > SIPIdentityPassword: 8997e7a13ff2641ae6142f05b41efd6f > > > objectClass: top > > > objectClass: person > > > objectClass: organizationalPerson > > > objectClass: inetOrgPerson > > > objectClass: eduPerson > > > objectClass: brEduPerson > > > objectClass: posixAccount > > > objectClass: shadowAccount > > > objectClass: ufmgEduPerson > > > objectClass: SIPIdentity > > > eduPersonOrgDN: o=UFMG > > > eduPersonOrgUnitDN: ou=LCC > > > eduPersonAffiliation: employee > > > eduPersonPrimaryAffiliation: employee > > > cn: Test10 > > > givenName: Test > > > sn: 10 > > > mail: test10(a)ufmg.br > > > gecos: CN=Test 10 > > > uidNumber: 136617 > > > gidNumber: 100 > > > homeDirectory: /home/ufmg/test10 > > > loginShell: /bin/bash > > > uid: test10 > > > > > > > Do you have a changetype defined somewhere that I'm missing? It looks > > like you want to do a changetype: modify, then add: someattribs, then > > someattribs: somevalues, repeat. > > > > http://tools.ietf.org/html/rfc2849 (see page 10 or so) > >

2 1

Compiling OpenLDAP with static SASL library
by Zohar Lev Shani 18 Oct '07

18 Oct '07

Hello list Has anyone tried compiling OpenLDAP with static SASL library? If so, what were the necessary changes you did (Makefile.in, configure, ...)? Thanks in advance Zohar

2 3

Syncrepl - force replication after replica being down
by Luka 18 Oct '07

18 Oct '07

Hi, haven't been able to find any answers regarding this question. If my replica is shut down and some changes are made to master (inside ou=access,o=example.net, which is set as a searchbase in syncrepl configuration) replica doesn't notice them on startup. Besides that replication works as expected. My syncrepl confifuration: syncrepl rid=2 provider=ldap://10.10.10.10:389 type=refreshAndPersist retry="30 3 60 +" searchbase="ou=access,o=example.net" filter="(objectClass=*)" scope=sub attrs="*,+" schemachecking=off bindmethod=simple binddn="uid=synrep,ou=admin,o=example.net" credentials=password updateref ldap://10.10.10.10 Thank you in advance. Regards, Luka

3 3

push-mode syncrepl and structuralObjectClass
by Alex Bramley 18 Oct '07

18 Oct '07

Hi, I'm setting up push-mode replication using syncrepl and back-ldap as per advice from searching the list archives. The proxy slapd is correctly binding to the slave slapd, and I can see the replication begin to occur, but all the ADD operations are failing with the following result: tag=105 err=19 text=structuralObjectClass: no user modification allowed I've googled around a bit and searched the mailing list archives, but i've not found anything more relevant than this post: http://www.openldap.org/lists/openldap-software/200706/msg00296.html My current proxy and slave configurations are below. Any advice on what I'm doing wrongly or what I need to do to avoid this problem would be greatly appreciated. Many Thanks, Alex ======================================================================== proxy: database ldap suffix "dc=transitives,dc=com" rootdn "cn=jabber,dc=transitives,dc=com" rootpw "" uri ldap://jabber.transitives.com/ tls start idle-timeout 600 network-timeout 10 acl-bind bindmethod=simple binddn="cn=jabber,dc=transitives,dc=com" credentials="" syncrepl rid=051 provider=ldap://ldap-master.transitives.com/ type=refreshAndPersist retry="10 6 60 9 300 +" searchbase="ou=users,dc=transitives,dc=com" scope=sub filter="(objectClass=inetOrgPerson)" schemachecking=on bindmethod=simple binddn="cn=syncjabber,ou=roles,ou=auth,dc=transitives,dc=com" starttls=critical credentials="" ======================================================================== slave: backend bdb database bdb suffix "dc=transitives,dc=com" directory "/var/lib/ldap/db/transitives/" mode 0600 index objectClass,entryCSN,entryUUID pres,eq index cn,sn,uid,displayName pres,eq,sub index givenName,mail pres,eq,sub index default eq,sub lastmod on rootdn "cn=jabber,dc=transitives,dc=com" rootpw "" # ACL's; access to dn.base="" by * read access to * by * read

5 9

Problem to replace directory entries with ldapmodify
by Gessy 18 Oct '07

18 Oct '07

Hi, I have tried replace entries on ldap directory with ldapmodify, my server is a gentoo linux running a OpenLDAP 2.3.35, but i realized a strange behavior. When I try replace a entry with follow LDIF: # Test.ldif - test10 dn: uid=test10,ou=people,dc=ufmg,dc=br objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: eduPerson objectClass: brEduPerson objectClass: posixAccount objectClass: shadowAccount objectClass: ufmgEduPerson objectClass: SIPIdentity eduPersonOrgDN: o=UFMG eduPersonOrgUnitDN: ou=LCC eduPersonAffiliation: employee eduPersonPrimaryAffiliation: employee cn: Test10 givenName: Test sn: 10 mail: test10(a)ufmg.br gecos: CN=Test 10 uidNumber: 136617 gidNumber: 100 homeDirectory: /home/ufmg/test10 loginShell: /bin/bash uid: test10 ldapmodify -x -D"cn=manager,dc=ufmg,dc=br" -W -f test.ldif The LDIF above should replace fully a old entry that contains a SIP attributes with only attributes shown in test.ldif, but it update the entry and keep the SIP attributes. I don't understant. Can someone help me? ldapsearch -x uid=test10 -LLL dn: uid=test10,ou=people,dc=ufmg,dc=br SIPIdentitySIPURI: sip:xxxxx@aaa.bbb.br SIPIdentityServiceLevel: AR SIPIdentityUserName: 10811080 SIPIdentityPassword: 8997e7a13ff2641ae6142f05b41efd6f objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: eduPerson objectClass: brEduPerson objectClass: posixAccount objectClass: shadowAccount objectClass: ufmgEduPerson objectClass: SIPIdentity eduPersonOrgDN: o=UFMG eduPersonOrgUnitDN: ou=LCC eduPersonAffiliation: employee eduPersonPrimaryAffiliation: employee cn: Test10 givenName: Test sn: 10 mail: test10(a)ufmg.br gecos: CN=Test 10 uidNumber: 136617 gidNumber: 100 homeDirectory: /home/ufmg/test10 loginShell: /bin/bash uid: test10 Thanks a lot Gessy -- (o< Avoid the Gates of hell! //\ Use GNU Linux. V_/_

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software