openldap-software

openldap-software@openldap.org

2719 discussions

Problem with adding country attribute
by Simon Gao 18 May '07

18 May '07

Hi, I am having problem with adding "c" country attribute. The error I got is: ldap_add: Internal (implementation specific) error (80) additional info: no structuralObjectClass operational attribute I'm running OpenLDAP 2.3.30. Here is related parts: street: 123 Short St. l: Big Town st: Some State c: US .... objectClass: friendlyCountry objectClass: Country objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: top objectClass: inetOrgPersonAccount objectClass: inetLocalMailRecipient ...... Is there something I need to add or change? Simon

3 2

file name normalization
by Dieter Kluenter 17 May '07

17 May '07

Hi, I'm testing OpenLDAP-2.4.4alpha with cn=config database. I have some schema files with mixed characters i.e. upper and lower cases. When initializing the database with -F -f options, the cn=schema directory contains following files -rw------- 1 ldap ldap 15428 2007-04-01 15:53 cn={0}core.ldif -rw------- 1 ldap ldap 11290 2007-04-01 15:53 cn={1}cosine.ldif -rw------- 1 ldap ldap 2784 2007-04-01 15:53 cn={2}inetorgperson.ldif -rw------- 1 ldap ldap 6420 2007-04-01 15:53 cn={3}nis.ldif -rw------- 1 ldap ldap 7369 2007-05-17 14:09 cn={4}combiCalendar.ldif -rw------- 1 ldap ldap 4664 2007-04-01 15:53 cn={5}dnszone.ldif -rw------- 1 ldap ldap 9678 2007-04-01 15:53 cn={6}samba.ldif -rw------- 1 ldap ldap 1606 2007-04-01 15:53 cn={7}MailingListen.ldif -rw------- 1 ldap ldap 926 2007-04-01 15:53 cn={8}dyngroup.ldif please note cn={7}MailingListen.ldif trying to modify a schema element fails slapd[12181]: failed to open file "/usr/local/etc/openldap/slapd.d/cn=config/cn=schema/cn={7}mailinglisten.ldif": No such file or directory please note the lower case file name mailinglisten.ldif Is this expected behaviour, or is this a bug? -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6

1 0

[Rivendell] idassert-bind not working as expected?
by Federico Grau 17 May '07

17 May '07

With minimal information as requested by the moderators multiple times. Why doesn't idassert-bind work as expected? When I try an anonymous query to an "LDAP" server via an OpenLDAP server configured as a proxy (backend meta , or backend ldap), the query fails because the OpenLDAP server does not bind (even when I try setting the "idassert-bind" option). # sample failed anonymous query to AD via OpenLDAP ldapsearch -H "ldap://localhost/" -b "ou=windows,dc=rfa,dc=org" -x # expected query to be performed by ldap server ldapsearch -H "ldap://dc1.rfa.org/" -b "cn=users,dc=rfa,dc=org" \ -D "CN=LDAP Proxy user account,OU=Windows,DC=rfa,DC=org" -W \ -x # using (tcpdump -x -s0 port 389) I never see a bind sent from OpenLDAP, # and instead I see an error returned from the "LDAP" server because a # bind not successful. # backend meta portion of the slapd.conf file ##database ldap database meta suffix "ou=windows,dc=rfa,dc=org" uri "ldap://dc1.rfa.org/ou=windows,dc=rfa,dc=org" suffixmassage ou=windows,dc=rfa,dc=org cn=users,dc=rfa,dc=org idassert-authzFrom "dn:*" #Xidassert-bind bindmethod=simple binddn="ldap-proxy(a)rfa.org" credentials="222222" idassert-bind bindmethod=simple binddn="CN=LDAP Proxy user account,OU=Windows,DC=rfa,DC=org" credentials="222222" mode=none dncache-ttl 60 My environment is made up of Debian stable (4.0 Etch) on the workstations and OpenLDAP server, OpenLDAP 2.3.30-5 on the server. "LDAP" Server on the remote end. thank you, donfede -- Federico Grau Free Software Developer and Sysadmin Radio Free Asia 2025 M Street, NW Suite 300 Washington, DC 20036 202-587-2046 Telephone 202-721-7468 Facsimile CONFIDENTIAL COMMUNICATION This e-mail message is intended only for the use of the addressee and may contain information that is privileged and confidential. Any unauthorized dissemination, distribution, or copying is strictly prohibited. If you receive this transmission in error, please contact network(a)rfa.org. _______________________________________________ Rivendell mailing list Rivendell(a)techweb.rfa.org http://techweb.rfa.org/mailman/listinfo/rivendell

2 3

LDAP replications for dummies ;)
by Antuan Avdioukhine 17 May '07

17 May '07

Greetengs. About two years ago I theoreticaly learned with docs and this forum, but had no practice at all. Now I have to resolv some problems with OpenLDAP in a rush, and, unforunatelly, I have no much time to search archives and documentation and make experimental works. So I will be very greatfull if you share your experience. URLs for FAQs and examples are welcome. So. We have an e-mail MTA distributed system based on sendmail, courier imap, and OpenLDAP as user database and authentication backend. Our ex-sysadmin installed master LDAP and two slave OL-servers on relays, using SLURP technique. I beleive that it is not right choice, so I want to migrate replication scheme to better one. So some questions I have for now. 1. I know SLURP and LDAP sync techniques, is there another ones? 2. LDAP sync looks for me much better than SLURP. Is there any "compare chart" or "best practice" tips which helps to choose right way? 3. Is there any version restrictions for replications schemes? E.g. if I setup new OpenLDAP server have I install exactly same version as other LDAP servers? 4. Some days ago my master LDAP was dead for good, so I'd changed software configuration and now it uses one of my ex-slaves. It works fine but as a result I lost backup LDAP server -- now my slaves out of sync. I guess that the simplest way is setup another OpenLDAP, copy base and make it master ldap server using SLURP. But if sync scheme better than SLURP I prefer to setup LDAP sync scheme. So if I choose sync, I want to make my today's master 'provider' and stand-alone-today-ex-slave 'consumer'. Am I right? 5. Can I perform any setup steps but setup consumer to syncronize my LDAPs? -- Antuan Avdioukhine (DEKA-RIPE). Convey Plus Telecommunications St.Petersburg, Russia.

2 3

using syncrepl to create a backup
by Maria McKinley 17 May '07

17 May '07

Hi there, Couldn't find this addressed anywhere in the manual or the mailing list, so please forgive me if this is a silly question. I am looking to use syncrepl to create a backup of my ldap server. I was wondering how difficult it is to change setups between consumers and producers. Is it enough to just change the slapd config file on the consumer to a copy of what was on the producer when the producer goes down for some reason, and just have the clients configured with both ips (I'm assuming they will just go down the list until they find one working, and the consumer will otherwise just point them to the producer)? A related question, can ldap.conf always point to localhost if localhost is always either a consumer or a producer, or do consumer ldap.conf need to be pointed to the producer? thanks a bunch, Maria

3 2

openldap proxy bind username
by Federico Grau 16 May '07

16 May '07

Is it possible to configure slapd(8) to proxy a simple bind operation where the username provided by the client is not a LDAP DN string? Right now this query works: ldapsearch -H "ldap://localhost/" \ -b "ou=windows,dc=rfa,dc=org" \ -D "CN=LDAP Proxy user account,OU=Windows,DC=rfa,DC=org" \ -W -x Now how can I get a query like this to work: ldapsearch -H "ldap://localhost/" \ -b "ou=windows,dc=rfa,dc=org" \ -D "ldap-proxy(a)rfa.org" \ -W -x My environment is made up of Debian stable (4.0 Etch) on the workstations and OpenLDAP server, OpenLDAP 2.3.30-5 on the server. MS Windows 2003 Server Enterprise edition for the AD server with Services For Unix 3.5 NIS server (and corresponding schema changes) applied. thank you, donfede -- Federico Grau Free Software Developer and Sysadmin Radio Free Asia 2025 M Street, NW Suite 300 Washington, DC 20036 202-587-2046 Telephone 202-721-7468 Facsimile CONFIDENTIAL COMMUNICATION This e-mail message is intended only for the use of the addressee and may contain information that is privileged and confidential. Any unauthorized dissemination, distribution, or copying is strictly prohibited. If you receive this transmission in error, please contact network(a)rfa.org.

2 1

chain-overlay question
by Markus Krause 16 May '07

16 May '07

Hi list! i have several consumer and one provider (lets call them ldapconX and ldapprov). syncrepl works fine, but i actually do not want any clients to contact the provider directly (and i have in addition some clients which would not understand referrals anyway), so reading through the admin guide and man pages i thought slapo-chain would be the solution! (correct me if i am wrong ;-)) But somehow a can not get it working... the slapd.conf of the provider is untouched, the consumer have (simplified in some places; please tell me if you need it in more details): ----- /etc/openldap/slapd.conf # consumer include ... acls ... databse bdb suffix ... rootdn "cn=manager,o=test" rootpw xxx index ... overlay smbk5pwd syncrepl ... updateref ldaps://ldapprov overlay chain chain-rebind-as-user FALSE chain-uri "ldaps://ldapprov" chain-rebind-as-user TRUE chain-idassert-bind bindmethod="simple" binddn="cn=manager,o=test" credentials="secret" mode="self" ---- end of slapd.conf but when trying to change the password via ldappasswd i get: ldappasswd -x -h localhost <...> New password: Re-enter new password: Enter LDAP Password: Result: Referral (10) Referral: ldaps://ldapprov i also tried to remove the line "updateref ...", but then i get: Result: Server is unwilling to perform (53) Additional info: shadow context; no update referral i also read different postings and the man pages but maybe overlooked or did not understand something. what am i am doing wrong? or do i missunderstand some conceptual basics? thanks in advance for any hints! regards markus +-----------------------------------------------------------------+ | Markus Krause, Mogli-Soft | | Support for Mac OS X, Webmail/Horde, LDAP, RADIUS, MySQL | | by order of the | | Computing Center of the Max-Planck-Institute of Biochemistry | +--------------------------------+--------------------------------+ | E-Mail: krause(a)biochem.mpg.de | Tel.: 089 - 89 40 85 99 | | markus.krause(a)mac.com | Fax.: 089 - 89 40 85 98 | | Skype: markus.krause | iChat: markus.krause(a)mac.com | +--------------------------------+--------------------------------+ ---------------------------------------------------------------------- This message was sent using https://webmail2.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 10

should I modify attribute definition in core.schema to suit my need?
by Zhang Weiwu 16 May '07

16 May '07

Generally I think I should not touch the attribute definition in system schema file like core.schema. However I got a problem here: our web application is designed to understand LDAP schema and provider proper user interface for each syntax. Our web application can understand syntax 1.3.6.1.4.1.1466.115.121.1.11 which is "Country String", two printable string characters as listed in ISO 3166. For this syntax the web application pops up a nice country selector. However when user enter 'c' (for country, defined in core.schema as *Directory String*) the web application treat it as all other Directory String, which is an input box. The users, being confused, typed their country name manually (like "American" or "U.S.A."), breaking compatibility because 'c' should be two printable string characters as listed in ISO 3166. We can update our web application to treat 'c' specially, but it's much easier to just modify syntax definition of 'c' in core.schema. Can I do that? Am I going to get more trouble from doing so? -- Zhang Weiwu Real Softservice http://www.realss.com +86 592 2091112

5 8

logleven pcache
by Dieter Kluenter 16 May '07

16 May '07

Hi, I'm testing HEAD with back-ldap, rwm and pcache. I have some issues with pcache and want to debug, but loglevel pcache is not known anymore, is there a particular reason why ist has been removed? -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6

2 1

Solaris MP Library Instead of GNU MP Library?
by ssoo＠siliconfile.com 16 May '07

16 May '07

Solaris 10 has a MP library. OpenLDAP-2.3.35 does not configure it. Will OpenLDAP support it near future?

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software