openldap-software

openldap-software@openldap.org

2719 discussions

Schema difficulties-Openldap 2.0.27 -> 2.3.34
by Scott Lacy 25 Aug '07

25 Aug '07

Hi all, I'm attempting to migrate an openldap implementation from a 2.0.27 server running the Red Hat Enterprise 3 rpm to a new box running the 2.3.34 Fedora 7 rpm. I'm a bit of an LDAP noob, but I've managed to account for most of the difficulties, but still have one I can't seem to get around: There are a handful of users in the old database that have errors being migrated via ldif. These users are erroring out in their uidNumber field. These users have uidNumbers beginning with leading zeros, for example, "0001111114". I'm assuming that's a syntax no-no. I believe uidNumber is one of the fields hardcoded into Openldap now (I don't see non-commented definitions for it in any of the schema files I have). Is there a way to doctor the syntax for this field short of editing and compiling via source? It is apparently important that the leading zeros be there, else I would just take them out. Thanks, Scott Lacy Mercer University

4 5

slapo-dynlist search member=value search?
by Aleksander Adamowski 25 Aug '07

25 Aug '07

Hi! From reading the FAQ entry on dynlist (http://www.openldap.org/faq/data/cache/1209.html) it would seem that dynlist with member DN expansion lets me operate in two directions: 1. have an attribute dynamically expanded (e.g. for mapping a group to its members), e.g. '(cn=somedynamicgroup)' -> { member: uid=someuser,ou=People,o=SomeOrg, member: uid=otheruser,ou=People,o=SomeOrg } 2. search for dynamic objects whose dynamic attribute expands to given DN (e.g. for location all groups a given user is a member of), e.g. '(member=uid=someuser,ou=People,o=SomeOrg)' -> { dn: cn=somedynamicgroup,ou=Groups,o=MyOrg, dn: cn=somestaticgroup,ou=Groups,o=MyOrg} To be specific, this fragment in the FAQ describes it: --- SNIP --- dynlist-attrset groupOfURLs memberURL member it behaves much like the dyngroup overlay; the <attrs> portion of the URI must be absent, and the DN of the entries resulting from the search is added as value of the member attribute defined above. *For compare operations on the member attribute, all the values of the memberURL attribute of groupOfURLs objects are compared until a match is found; this exploits slapd group caching capabilities. *--- SNIP --- Also, the slapo-dynlist manual states: --- SNIP --- Compares that assert the value of the <member-ad> attribute of entries with <group-oc> objectClass apply as if the DN of the entries resulting from the expansion of the URI were present in the <group-oc> entry as values of the <member-ad> attribute. --- SNIP --- I have the following configuration: --- fragment of BDB instance config --- index member eq,pres overlay dynlist dynlist-attrset groupOfURLs memberURL member --- end fragment of BDB instance config --- The member expansion works: ldapsearch -b 'o=MyOrg' -x -D 'cn=Manager,o=MyOrg' -H 'ldap://localhost' -y ~/ldappass 'cn=somedynamicgroup' .... member: uid=someuser,ou=People,o=SomeOrg member: uid=otheruser,ou=People,o=SomeOrg ... But searching for groups a user is a member of doesn't work for dynamic groups: ldapsearch -b 'o=MyOrg' -x -D 'cn=Manager,o=MyOrg' -H 'ldap://localhost' -y ~/ldappass 'member=uid=someuser,ou=People,o=SomeOrg' dn: cn=somestaticgroup,ou=Groups,o=SomeOrg .... As a result no dynamic groups are found, only static ones. Am I missing something in the configuration?* * -- Best Regards, Aleksander Adamowski GG#: 274614 ICQ UIN: 19780575 http://olo.org.pl -- Aleksander Adamowski Administrator systemów korporacyjnych; Instruktor Altkom Akademia S.A. http://www.altkom.pl Warszawa, ul. Chłodna 51 kom. 0-601-318-080 Sąd Rejonowy dla m.st. Warszawy w Warszawie, XII Wydział Gospodarczy Krajowego Rejestru Sądowego, KRS: 0000120139, NIP 118-00-08-391, Kapitał zakładowy: 1000 000 PLN. Adres rejestrowy Firmy - ul. Stawki 2, 00-193 Warszawa. Niniejsza wiadomość zawiera informacje zastrzeżone i stanowiące tajemnicę przedsiębiorstwa firmy Altkom Akademia S.A. Ujawnianie tych informacji osobom trzecim lub nieuprawnione wykorzystanie ich do własnych celów jest zabronione. Jeżeli otrzymaliście Państwo niniejszą wiadomość omyłkowo, prosimy o niezwłoczne skontaktowanie się z nadawcą oraz usunięcie wszelkich kopii niniejszej wiadomości. This message contains proprietary information and trade secrets of Altkom Akademia S.A. company. Unauthorized use or disclosure of this information to any third party is prohibited. If you received this message by mistake, please contact the sender immediately and delete all copies of this message.

3 7

FW: running DB on different machine than slapd
by Kelly, Terence P 25 Aug '07

25 Aug '07

> -----Original Message----- > From: Howard Chu [mailto:hyc@symas.com] > Sent: Friday, August 24, 2007 1:04 AM > To: Kelly, Terence P > Cc: openldap-software(a)openldap.org > Subject: Re: running DB on different machine > than slapd > > Kelly, Terence P wrote: > > > For a variety of reasons I would like to run > > the back-end database beneath slapd on a > > different machine than slapd. > > > > This appears to be difficult using the > > Berkeley DB. > > Makes no sense at all, given that BerkeleyDB is > an *embedded* database. I.e., it doesn't run in > a separate process, it is designed to run in the > same process as the application that uses it. Yes, I know. I was hoping it would be easier if I used some other database. > > Can anyone offer suggestions on how to run > > slapd and the database --- any database --- > > on separate machines? > > Why? I think if you provide more details about > your motivation it would be easier to suggest > usable alternatives. I'm a researcher and one of my interests is in the trade-offs between performance and other properties (e.g., fault isolation/security) that various software architectures offer. Furthermore I want to include OpenLDAP in an apples-to-apples comparison involving other applications with multi-tier architectures in which the various tiers run on separate physical machines. Therefore I'm interested in any way of running the underlying database on a different physical machine then the slapd application, even if the performance overhead is substantial. Does that make sense? Thanks in advance for any suggestions you can offer.

2 1

Fwd: Maximum size of the database.
by Sumith Narayanan 24 Aug '07

24 Aug '07

Hello , Any suggessions ? Thanks, Sumith. ---------- Forwarded message ---------- From: Quanah Gibson-Mount <quanah(a)zimbra.com> Date: Aug 24, 2007 12:51 PM Subject: Re: Maximum size of the database. To: Sumith Narayanan <sumith.narayanan(a)gmail.com> --On Friday, August 24, 2007 12:02 PM -0700 Sumith Narayanan <sumith.narayanan(a)gmail.com> wrote: > Hi Quanah, > > I am running $OpenLDAP: slapd 2.3.27 and I have restarted slapd after > making this change. I am running Berkeley DB (Version: 4.4.20). > > Is there some other configuration that I should make. I am running on > MacOSX 10.4 Ah, I dunno on MAC OS X 10.4... I've only every played with this under Linux, and with BDB 4.2.52+patches. I wonder if there's a bug. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

syncrepl - out of sync scenario
by Arunachalam Parthasarathy 24 Aug '07

24 Aug '07

Hello all, I am using openldap 2.3.36 and using syncrepl feature. I had configured a server as a master and another server as a slave. I am using refreshOnly mode in slave. When I start the slave, I am getting all the entries from the master under the particular DN , in slave. Now I stop the slave, make it normal server add some entries. Again , I made it as slave, and try to sync with the master (as 3rd line above) Now the entries which I had added, when it was normal server, is not getting deleted when I sync, the second time (the above line) I mean now the slave and master are out of sync Please say me, is this way is correct and why the slave is not deleting the entries , which are not in master (I mean, extra entries, which I added , when it was in normal server) Thanks a lot in advance, Arunachalam. **************************************************************************** **************************** This e-mail and attachments contain confidential information from HUAWEI, which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction, or dissemination) by persons other than the intended recipient's) is prohibited. If you receive this e-mail in error, please notify the sender by phone or email immediately and delete it!

2 1

Strange error during TLS handshake
by Fabian Steiner 24 Aug '07

24 Aug '07

Heute 17:09:11 Hello! For some time now we are using OpenLDAP in order to provide a stable network-wide authentication service. Of course, we also enabled TLS-Support so that any connection is encrypted. However, we encounter some problems which are definitely subject of SSL as they also occur when we try to test our setup using "openssl s_client" and "openssl s_server". Most of the time TLS/SSL works perfect, but it may happen that we get the following error when we restart slapd: $ ldapsearch -x -ZZ -d1 [...] TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 1, err: 0, subject: /C=DE/ST=Bavaria/L=Marquartstein/O=Staatliches Landschulheim Marquartstein/CN=lsh-marquartstein.de, issuer: /C=DE/ST=Bavaria/L=Marquartstein/O=Staatliches Landschulheim Marquartstein/CN=lsh-marquartstein.de TLS certificate verification: depth: 0, err: 0, subject: /C=DE/ST=Bavaria/L=Marquartstein/O=Staatliches Landschulheim Marquartstein/CN=uranos.lsh-marquartstein.de, issuer: /C=DE/ST=Bavaria/L=Marquartstein/O=Staatliches Landschulheim Marquartstein/CN=lsh-marquartstein.de TLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write change cipher spec A TLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL3 alert read:fatal:handshake failure TLS trace: SSL_connect:failed in SSLv3 read finished A TLS: can't connect. ldap_perror ldap_start_tls: Connect error (-11) additional info: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure [...] If this is the case we can't get it to work anymore and the whole server has to be switched off in order to make it work again. What might cause this problem? OS is Ubuntu Linux 6.06.1 Dapper Server-Edition. Looking forward to your answer! Thanks, Fabian P.S. We are using self-signed certificates of our own CA.

2 2

running DB on different machine than slapd
by Kelly, Terence P 24 Aug '07

24 Aug '07

For a variety of reasons I would like to run the back-end database beneath slapd on a different machine than slapd. This appears to be difficult using the Berkeley DB. Can anyone offer suggestions on how to run slapd and the database --- any database --- on separate machines? Thanks in advance for any advice you can offer.

4 3

Re: successful ldapsearch -- need to turn it into a working slapd configuration for an LDAP proxy
by Quanah Gibson-Mount 23 Aug '07

23 Aug '07

----- "Jason R. DePriest" <jrdepriest(a)gmail.com> wrote: > > Originally, it was database meta only and didn't work. Adding in the > backend bdb is just one of the things I have tried to change in the > config. Without it, the errors look the same. I just double-checked > to make sure. Keep replies to the list please. I didn't necessarily expect it to change the result, but it was definitely a misconfiguration, and best to remove it. ;) --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

successful ldapsearch -- need to turn it into a working slapd configuration for an LDAP proxy
by DePriest, Jason R. 23 Aug '07

23 Aug '07

I can run ldapsearch from my OpenLDAP server and successfully query a remote LDAP server. My command-line looks like this (broken into lines for readability): ldapsearch -u -v -x -D 'cn=LDAP-proxy,ou=Service Accounts,dc=subdomain,dc=domain,dc=com' -w '<password>' -H 'ldap://server.subdomain.domain.com' -b 'ou=Department,dc=subdomain,dc=domain,dc=com' -s one -P 3 '(&(objectCategory=person)(objectClass=user)(cn=DeP*))' + It returns: # extended LDIF # # LDAPv3 # base <ou=Data Security,dc=subdomain,dc=domain,dc=com> with scope subtree # filter: (&(objectCategory=person)(objectClass=user)(cn=DeP*)) # requesting: + # # DePriest\2C Jason R., Department, subdomain.domain.com dn: CN=DePriest\, Jason R.,OU=Department,DC=subdomain,DC=domain,DC=com ufn: DePriest\2C Jason R., Department, subdomain.domain.com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Hey, look! It found me! I have tried using the ldap backend, but I'm leaning toward using the meta backend now. I cannot seem to figure out how to take the successful ldapsearch and turn it into a configuration that will proxy requests to the remote server. I have what I think looks good, but I get an error while trying to do a query and it crashes with this: slapd: symbol lookup error: /usr/lib/ldap/back_meta-2.3.so.0: undefined symbol: ldap_back_proxy_authz_ctrl I am running OpenLDAP 2.3.35 on a 2.6.21 kernel Debian GNU/Linux system. I hate to post the entire gigantic debug log or the entire config when I don't really know what parts are important to you. Let me know if you need more information. Thanks! -Jason -- NOTICE: This email is being sent in clear-text across the public Internet. Therefore, any attempts to include unenforceable legalese restrictions are ridiculous and pointless. If you can read this, consider yourself authorized (whether I like it or not).

2 5

ldap_bind: Can't contact LDAP server (-1)
by Villem Alari 23 Aug '07

23 Aug '07

When I write ldapdelete I get answer like that from my terminal: ldap_bind: Can't contact LDAP server (-1) What should I do to connect to LDAP server? Villem Alari e-post: villem(a)ekool.ee mobiil: +37253939163

4 5

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software