openldap-software

openldap-software@openldap.org

2719 discussions

cn=config crashes on modification
by Dieter Kluenter 18 Sep '07

18 Sep '07

Hi, I am experiencing weird errors with 2.4.5beta, i.e. modifying config backand for example I get => access_allowed: read access to "olcDatabase={1}hdb,cn=config" "olcDbDNcacheSize" requested <= root access granted => access_allowed: read access granted by manage(=mwrscxd) <= acl_access_allowed: granted to database root filter_free: unknown filter type=1168 *** glibc detected *** double free or corruption (out): 0x085c46c0 *** Abgebrochen Is this a bug. a corrupted cn=config database or is glibc-2.3.4-23.4 the reason? -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6

3 2

secure ldap remotely (TLS handshake error)
by Éliás Tamás 18 Sep '07

18 Sep '07

Udv / Greetings! I have revised the prevoious list postings, but unfortunately I'm in deeper trouble with openldap as before. On a debian etch machine, I'm running a simple slapd instance with HDB. I have to connect to this from the internet. Still this time it was working only locally and quite fine. So I've started to look afte r if I can manage security somehow. I have read about the differences between LDAPS, STARTTLS and so. The facts I've collected: - by using the TLSCertificateFile and other options I can use my own selfigned cert. - ldaps is a non standard method and works only locally originated connections. - ldap and starttls command can be managed to work non locally. now the questions. So if I connect from a remote machine to the standard port, how to tell the ldap client to start tls? - Also, I've looked for other ways. there are security ssf options, that must work. By using any form the security ssf options, other softwares or even the ldapsearch function can not connect, tough slapd is running. So I want to achieve the following: - access the ldap remotely on a secure manner, I do not care if it is TLS or some ldap managed stuff. I do not want to use sasl, I have my accounts defined in the ldap directory, I do not need some kinda outsider auth mechanism. IS THIS possible? I've already have the client cert, the tls options set in the config, and ldap is listening on ldap://host, and no "security ssf" options defined. I want to secure all transfers (passwords already MD5 or SHA) If TLS does not work, what to do now? Thank you for the answer. sw info: latest stable openldap compiled from source, with latest openssl. -- Thomas Elias Title: *NIX System administrator, Certified Cisco Network Engineer, Pascal/Bash/C++ programmer, Certified IBM UDB DB2 Database Administrator mailto: elias.tamas(a)uni-pen.hu, elias.tamas(a)pszinfo.hu, elias.tamas(a)vagyok.eu, eliast(a)nagykanizsa.hu Tel.: +3630/4971626 ICQ UIN: 206-714-459 ; SKYPE: "elias.tamas" OpenPGP public key: http://pszinfo.hu/elias.tamas.asc Quote: "Too many people making too many problems (InFlames)"

3 2

Error: ldap_simple_bind_s...failed: Invalid credentials
by Pantejo Barbara-XJC864 18 Sep '07

18 Sep '07

Hi everyone, I'm a newbie at OpenLDAP; just 3 weeks into installing my first LDAP master server and now trying set up a replica server. I've followed these instructions, http://www.openldap.org/doc/admin23/replication.html, but whenever I execute "/usr/lib/openldap/slurpd -d 3 -t /var/lib/slurpd" on the master server for debugging, the following error message appears: Error: ldap_simple_bind_s for flcsdev1-1.comm.mot.com:389 failed: Invalid credentials It's probably a simple configuration issue, but not sure. Do you see anything out of place? Here are my slapd configuration files: ############################### # Master (flcsdev1-2) - slapd.conf ############################### ... access to * by dn="cn=Manager,dc=ace,dc=mot,dc=com" write by * read ####################################################################### # BDB database definitions ####################################################################### loglevel 768 database bdb checkpoint 1024 5 cachesize 10000 suffix "dc=ace,dc=mot,dc=com" rootdn "cn=Manager,dc=ace,dc=mot,dc=com" rootpw {SSHA}G7ZqsHqlROcDMX1tuV/mUZ6XuVNBAlt6 lastmod on # Replication log file to which slapd will log changes replogfile /var/log/slapd.replog # Replication sites for this database replica uri=ldap://flcsdev1-1.comm.mot.com:389 binddn="uid=Replica,ou=People,dc=ace,dc=mot,dc=com" bindmethod=simple credentials={SSHA}fLayPK23k5YEDV5skWHw/51RH7x1YWTV tls=yes A Replica userid was created in the database: flcsdev1-2:/ # ldapsearch -x -W -D "uid=Replica,ou=People,dc=ace,dc=mot,dc=com" -h flcsdev1-2.comm.mot.com "uid=Replica" Enter LDAP Password: # extended LDIF # # LDAPv3 # base <> with scope sub # filter: uid=Replica # requesting: ALL # # Replica, People, ace.mot.com dn: uid=Replica,ou=People,dc=ace,dc=mot,dc=com uid: Replica cn: Replica objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword:: e1NTSEF9ZkxheVBLMjNrNVlFRFY1c2tXSHcvNTFSSDd4MVlXVFY= shadowLastChange: 13761 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 22222 gidNumber: 100 homeDirectory: /tmp gecos: Replica userid for slave LDAP servers # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 flcsdev1-2:/ # ############################### # Replica (flcsdev1-1) - slapd.conf ############################### ... access to * by dn="cn=Manager,dc=ace,dc=mot,dc=com" write by dn="uid=Replica,ou=People,dc=ace,dc=mot,dc=com" write by * read ####################################################################### # BDB database definitions ####################################################################### loglevel 768 database bdb checkpoint 1024 5 cachesize 10000 suffix "dc=ace,dc=mot,dc=com" rootdn "uid=Replica,ou=People,dc=ace,dc=mot,dc=com" rootpw {SSHA}fLayPK23k5YEDV5skWHw/51RH7x1YWTV lastmod on # Specify the DN allowed to make changes to the replica updatedn "uid=Replica,ou=People,dc=ace,dc=mot,dc=com" # Master LDAP's URL updateref ldap://flcsdev1-2.comm.mot.com:389 <ldap://flcsdev1-2.comm.mot.com:389> Any advice and feedback is very much appreciated. If more information is required, please let me know. Thank you very much, Barbara

3 3

connection hangup -inference and solution?
by Arunachalam Parthasarathy 18 Sep '07

18 Sep '07

Hello all, I am using openldap 2.3.36 and bdb 4.5.20 I am using delta syncrepl for synchronization and the configuration files are same as the examples provided in the test folder of package (for master and slave) I started the master and added some entries (I had already some 50,000 entries) I started the slave and it was synchronizing. When I stopped the slave and client which was adding entries, in the master I am getting connection hangup on a descriptor and the master is not responding to any client which are searching Can I know , why it is happening, and whats the way to get rid of this problem Thanks a lot in advance, Arunachalam **************************************************************************** **************************** This e-mail and attachments contain confidential information from HUAWEI, which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction, or dissemination) by persons other than the intended recipient's) is prohibited. If you receive this e-mail in error, please notify the sender by phone or email immediately and delete it!

5 11

Creating create and delete procedures with back-sql
by Kevin Burnett 17 Sep '07

17 Sep '07

I am using back-sql with mysql as the database. In my ldap_oc_mappings and ldap_attr_mappings tables, there are columns for create and delete procedures. Are there any examples for how to write these procedures? Any and all samples would be greatly appreciated. kevin

1 0

openldap client - detect paging and count number of entries search return
by Anoob Backer 17 Sep '07

17 Sep '07

hi all, i would like to know best way to accomplish the below given operations; considering both time and memory * detect whether LDAP server has enabled paging (without making an ldap_search call; preferably) currently i am doing a ldap_search and detecting the error code LDAP_NOT_SUPPORTED, then reverting back * counting the number of entries satisfying particular filter i am planning to do an asynchronous LDAP search and do a ldap_count_entries on the result thanks bekz

2 1

replog rejection file
by Pantejo Barbara-XJC864 17 Sep '07

17 Sep '07

Does anyone know how the replication rejection file get created and what directory is it supposed to be written to? My slurpd replog is located in /var/log/slapd.replog. Is the rejection file supposed to be created and stored there? Thank you, Barbara

2 1

krb5PrincipalName and userPassword
by Turbo Fredriksson 17 Sep '07

17 Sep '07

I've just been playing with the ppolicy overlay and noticed that I wasn't locked out! Took a while to figure out, but I was only locked out if I was using a simple bind! I've always used: userPassword: {SASL}turbo(a)INT.DOMAIN.TLD krb5PrincipalName: turbo(a)INT.DOMAIN.TLD But before testing ppolicy, I changed the userPassword to '{MD5}Xr4ilOzQ4PCOq3aQ0qbuaQ==' (=> 'secret'). I always thought that these two went hand in hand, but my tests now shows that they are not. Is this so?! Can this have something to do with my sasl-regexp? ----- s n i p ----- sasl-regexp uid=(.*),cn=int.domain.tld,cn=gssapi,cn=auth ldap:///c=SE??sub?krb5PrincipalName=$1@INT.DOMAIN.TLD ----- s n i p ----- So the result of this is that I can have one password for simple binds and one for SASL binds... Not a bad thing, but still... Is it possible to apply the ppolicy on SASL binds?

5 9

ldap replication
by Mauricio Paulo de Sousa 16 Sep '07

16 Sep '07

with what can I make a replication on a LDAP server? -- Mauricio Paulo de Sousa

4 4

Re: LDAP error code 32
by Pierangelo Masarati 16 Sep '07

16 Sep '07

> Hello, I am trying to configure openldap on a mac pro dual quad core 3ghz > xeon processor, 4gb ram, 500gb sata hd, Mac OS X 10.4.10 and ldap version > /opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_ports_databases_openldap/work/openldap- > 2.3.35/servers/slapd. I believe I have configured everything correctly so > far but I am unable to connect to the server with ldapsearch for > configuration as it gives an error code 32. Output when slapd is started: Thanks for providing all of us a spare copy of the schema, both in cleartext and in BER-encoded form, dumped in hex pairs, for a total of 1.6 MB. The only relevant information in what you sent is: > SRCH "dc=10.0.1.220,dc=com" 0 2 0 0 0 > => bdb_dn2id("dc=10.0.1.220,dc=com") > <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found > (-30989) > database bdb > suffix "dc=10.0.1.220,dc=com" > rootdn "cn=Manager,dc= 10.0.1.220,dc=com" which means that the server is willing to serve requests for the searchBase "dc=10.0.1.220,dc=com", but the database appears to be empty. Note that error 32 is explained in the FAQ, 2 clicks away from the root: <http://www.openldap.org/faq/data/cache/343.html> > any clues as to what's wrong? thanks! :) you're welcome! p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software