openldap-software

openldap-software@openldap.org

2719 discussions

Re: OpenLDAP 2.3.38 and Berkeley DB 4.6.19
by Sam Tran 28 Aug '07

28 Aug '07

On 8/28/07, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, August 28, 2007 4:10 PM +0100 Gavin Henry > <gavin.henry(a)gmail.com> wrote: > > > On 28/08/07, Sam Tran <stlist(a)gmail.com> wrote: > >> Hi All, > >> > >> Does OpenLDAP 2.3.38 support the new Berkeley DB 4.6.19? > > > > Nope, only CVS HEAD does just now. > > I suggest reading the discussion about 4.6.19 on the -devel list. > Especially, note the serious degradation to performance that occurs when > using it. > Thanks for you input.

1 0

OpenLDAP 2.3.38 and Berkeley DB 4.6.19
by Sam Tran 28 Aug '07

28 Aug '07

Hi All, Does OpenLDAP 2.3.38 support the new Berkeley DB 4.6.19? Thanks, Sam

3 2

database meta question
by D'Arcy Smith 28 Aug '07

28 Aug '07

Hi all, I am having a terrible time trying to get the meta backend to work with my setup. If I do not have meta things work as expected. As soon as I add the meta backend thing go south. Partial slapd.conf: database ldap suffix "o=a.y.x,o=y" uri ldap://a.y.z:389/ idassert-authzFrom "dn:*" idassert-bind bindmethod=simple binddn="uid=foo,ou=people,o=a.y.z,o=y" credentials="**********" mode=none database bdb suffix "o=b.y.z,o=bcit" checkpoint 32 30 # <kbyte> <min> rootdn "cn=Manager,o=b.y.z,o=y" rootpw {MD5}********== directory /var/lib/openldap-data index objectClass eq database meta suffix "o=y.z,o=y" uri "ldap://foo.bar.star:389/o=a.y.z,o=y" rwm-rewriteEngine on rwm-rewriteContext default twm-rewriteRule "(.*)o=y.z,o=y" "%1o=a,y.z,o=y" rwm-rewriteContext searchResult rwm-rewriteRule "(.*)o=a.y.z,o=y" "%1o=y.z,o=y" rwm-map attribute * * uri "ldap://foo.bar.com:389/o=b.y.z,o=y" rwm-rewriteEngine on rwm-rewriteContext default twm-rewriteRule "(.*)o=y.z,o=y" "%1o=b,y.z,o=y" rwm-rewriteContext searchResult rwm-rewriteRule "(.*)o=b.y.z,o=y" "%1o=y.z,o=y" rwm-map attribute * * When I run slapd with -d -1 I get (in part): config_back_db_open backend_startup_one: starting "o=a.y.z,o=y" ldap_back_db_open: URI=ldap://a.y.z:389 backend_startup_one: starting "o=b.y.z,o=y" bdb_db_open: o=b.y.z,o=y bdb_db_open: dbenv_open(/var/lib/openldap-data) backend_startup_one: starting "o=y.z,o=y" meta_back_db_open: no targets defined backend_startup_one: bi_db_open failed! (1) So, it seems that "meta" is finding no targets... Any ideas? Thanks, ..darcy

3 3

Question about ldap backend
by Diego de Felice 28 Aug '07

28 Aug '07

Hi to all, I'm testing the backend ldap in order to make a proxy for an existing OpenLDAP instance (call it REAL). As stated in the manual, the ldap database is like a proxy. After configuring the "proxy" LDAP server (call it PROXY) I'm able to read the real content of REAL from PROXY, so the proxing is working well, but when I try to modify something on PROXY, instead of doing the change on REAL, OpenLDAP gives me this error: ldap_chase_referrals read1msg: V2 referral chased, mark request completed, id = 7 new result: res_errno: 8, res_error: <modifications require authentication>, res_matched: <> read1msg: 0 new referrals read1msg: mark request completed, id = 7 request 7 done res_errno: 8, res_error: <modifications require authentication>, res_matched: <> Following the documentation I configured the PROXY server, so this is the main configuration in slapd.conf of PROXY: database ldap uri "ldap://localhost:389" bindmethod=simple binddn="cn=root,o=Test,c=IT" credentials="password" suffix "o=Test,c=IT" rootdn "cn=root,o=Test,c=IT" rootpw password I've not touched the REAL slapd.conf. Where am I wrong ? -- Diego

2 2

slapd loses meta backends
by Hans Moser 28 Aug '07

28 Aug '07

Hi! After weeks of running slapd 2.3.27 suddenly quits answering requests, instead it says "no such objects" - where are objects. After a restart all data is back again. Is this a known error (to heal by update - what I will do anyway)? Hans ----------- conf: include /opt/mail/etc/openldap/schema/core.schema include /opt/mail/etc/openldap/schema/cosine.schema include /opt/mail/etc/openldap/schema/inetorgperson.schema include /opt/mail/etc/openldap/schema/dyngroup.schema include /opt/mail/etc/openldap/schema/openldap.schema include /opt/mail/etc/openldap/schema/nis.schema include /opt/mail/etc/openldap/schema/authldap.schema pidfile /opt/mail/var/slapd.pid argsfile /opt/mail/var/slapd.args loglevel 489 TLSCACertificateFile /opt/mail/etc/openldap/ssl/ca2006.pem TLSCertificateFile /opt/mail/etc/openldap/ssl/cert2006.pem TLSCertificateKeyFile /opt/mail/etc/openldap/ssl/key2006.pem defaultsearchbase "ou=Proxy,ou=foo,o=bla,c=de" ####################################################################### # BDB database definitions ####################################################################### database monitor access to dn.subtree="cn=monitor" by * read database meta suffix "ou=Proxy,ou=foo,o=bla,c=de" uri "ldap://edir.niedersachsen.de/ou=foobar,ou=Proxy,ou=foo,o=bla,c=de" suffixmassage "ou=foobar,ou=Proxy,ou=foo,o=bla,c=de" "ou=foobar,o=bla,c=de" uri "ldap://edir.niedersachsen.de/ou=AllgV,ou=Proxy,ou=foo,o=bla,c=de" suffixmassage "ou=AllgV,ou=Proxy,ou=foo,o=bla,c=de" "ou=Exchange-Verbund,o=bla,c=de" access to dn.subtree="ou=Proxy,ou=foo,o=bla,c=de" by * read

2 3

Can't add Organizational Unit
by Daniel Guerrero 28 Aug '07

28 Aug '07

Hi all, I'm trying to add an ldif with the definition of a organizational unit, and an error message appears: bdb_db_open: database already in use backend_startup_one: bi_db_open failed! (-1) slap_startup failed I search for some solution on the web and i found these: http://www.openldap.org/lists/openldap-software/200511/msg00143.html Where was told to me that some instance of slapd was already using the database. So, i try to stop (and/or reboot) the slapd process. Then another error appears: bdb_db_open: Warning - No DB_CONFIG file found in directory /usr/local/var/openldap-data: (2) Expect poor performance for suffix dc=intranet,dc=techno,dc=com. => bdb_tool_entry_put: id2entry_add failed: DB_KEYEXIST: Key/data pair already exists (-30996) => bdb_tool_entry_put: txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) slapadd: could not add entry dn="ou=h350,dc=intranet,dc=techno,dc=com" (line=6): txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) I think i must not stop the slapd process, but restarting it the first error appears again. Can anyone guide me? Thank you very much, Daniel.

2 6

Re: successful ldapsearch -- need to turn it into a working slapd configuration for an LDAP proxy
by Pierangelo Masarati 27 Aug '07

27 Aug '07

DePriest, Jason R. wrote: > idassert-bind bindmethod=simple > binddn="cn=LDAP-proxy,ou=Service Accounts,dc=subdomain,dc=domain,dc=com" > credentials="{SHA}Ww4fMMtpcdtvJKh2wyC8t/3gu7E=" > mode=self > flags=non-prescriptive If you use simple bind, credentials need to go in cleartext. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

3 6

slapadd: dn="dc=test, dc=ekool, dc=ee" (line=6): (64) value of naming attribute 'dc' is not present in entry
by Villem Alari 27 Aug '07

27 Aug '07

Hi! I have error slapadd: dn="dc=test,dc=ekool,dc=ee" (line=6): (64) value of naming attribute 'dc' is not present in entry. What is wrong? Here is my slapd.conf: # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=test,dc=ekool,dc=ee" rootdn "cn=admin,dc=test,dc=ekool,dc=ee" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. #rootpw {SSHA}wSazqIGcA2pdI5/qTKTIswD+sFp66HKV # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq and my ldif: n: dc=test,dc=ekool,dc=ee objectclass: dcObject objectclass: organization o: Koolitoode AS dc: test.ekool dn: cn=admin,dc=test,dc=ekool,dc=ee objectclass: organizationalRole cn: admin Regards, Villem Alari e-post: villem(a)ekool.ee mobiil: +37253939163

3 2

allow changing userPassword only through extended operations?
by manu＠netbsd.org 27 Aug '07

27 Aug '07

Hello Is there a way to write an ACL so that userPassword could only be changed by an extended operation, and not by a simple attribute modification? -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

3 2

Re: database meta question
by Pierangelo Masarati 25 Aug '07

25 Aug '07

> Hi Pierangelo , > > I hope you don't mind the direct mail... Yes, I do. My employer also does, since I'm using their IT resources to answer private mails about what they usually ask me to do for business, and you're not one of their customers. > I just don't want to make > public the names bing used. Since you sent them by unencrypted email, they're already public. Moreover, I don't see anything really confidential in what you sent. And, I don't feel bound to any confidentiality, since we didn't sign any NDA. However, I'm removing anything you considered sensitive from this response, by now. > I am using openldap-2.3.35. Good. Not the latest, but the proxy backends should be safe. However, you need to understand that there is a trivial error in your configuration. If you enable config log level, slapd (or slaptest) will tell you where the error is. It is not clear what you want to do. Asking why a configuration is not correct is usually the wrong question, because it only leaves room for partial answers, like "fix syntax errors" (which are usually already answered by man pages, FAQs & co., BTW). If you explain what you want to obtain, perhaps someone can tell you how to obtain it. Perhaps, from the multiple answers you might get, you can learn how things work, and how to make them work best. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software