openldap-software

openldap-software@openldap.org

2719 discussions

Minimal OpenLDAP server source
by Joe Flowers 11 May '07

11 May '07

Sorry for the OpenLDAP noob question: Analogous to the OpenSSL "minimal ssleay server" (minimal SSL server) at /openssl-0.9.8e.tar/openssl-0.9.8e/demos/ssl/serv.cpp, is there a "minimal" OpenLDAP server source code snippet as well? Thank you! Joe

4 10

backend relay with empty suffix
by Nikos Voutsinas 11 May '07

11 May '07

Hi all, I tried the following (please note the empty suffix in relay's database definition) with an openldap-2.3.35: #------------- database bdb suffix "dc=real,dc=naming,dc=context" access to * attrs=userPassword by anonymous auth by * none # other database specific ACLs access to * by * none #-------------- database relay suffix "" relay "dc=real,dc=naming,dc=context" massage access to * attrs=userPassword by anonymous auth by * none # translated the previous set of ACLs as slapd-relay manual indicates access to * by * none #----------------- Access to the real naming context (using BindDN and BasedDN on top of dc=real,dc=naming,dc=context) fails with the following error => bdb_search bdb_dn2entry("dc=real,dc=naming,dc=context,dc=real,dc=naming,dc=context") => bdb_dn2id("dc=real,dc=naming,dc=context") <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) at the same time access to the virtual naming context (binddn: uid=myuid, basedn: uid=myuid) operates as expected. Normal access to the real naming context is restored by removing the declaration of relay database. Questions: 1. What is the status with the usage of empty suffixes? Is this the cause of the problem here? 2. How the relay,massage pair differs from overlay,suffixmassage in relay database? 3. Could slapo-rwm be used as a workaround to this problem? BTW: slapd segfaults when I replace the relay,massage pair with overlay,suffixmassage. Thanks,

2 1

help with meta backend
by Ulf Möller 11 May '07

11 May '07

Hello, I have a problem with OpenLDAP/back-meta in a certain setup. It sometimes stops responding to search requests. From trying to set a breakpoint in the debugger and from the syslog messages it seems that OpenLDAP doesn't jump into back-meta any more when the situation occurs. The system usually works ok for several days or weeks before the problem occurs. The setup it OpenLDAP 2.3.35 (with some code modifications in back-meta, but the same problem occurred with the unmodified code) which connects to another OpenLDAP/back-meta installation behind a firewall and one other directory. Both installations are on similar Linux machines, the second OpenLDAP installation has been running without problems since I upgraded it to OpenLDAP 2.3.34 as advised in ITS#4850. What can I do to track down the problem? Thanks Ulf Möller ____________________________________ Ulf Möller Senior Consultant Secardeo GmbH Office +49 (0)89 - 18 93 589-5 Fax +49 (0)89 - 18 93 589-9 E-mail ulf.moeller <mailto:ulf.moeller@secardeo.com> @secardeo.com Secardeo GmbH Betastrasse 9a D-85774 Unterföhring Web <http://www.secardeo.de/> http://www.secardeo.de Geschäftsführer: Dr. Gunnar Jacobson Amtsgericht München HRB 137969 ____________________________________

3 3

Delta-syncrepl and latency
by Sam Tran 11 May '07

11 May '07

Hi All, I am testing delta-syncrepl using OpenLDAP 2.3.35 (+ fixes ITS#4924 and fixes ITS#4925) and Berkeley DB 4.5.20 on Centos 5. I have a provider with the following configuration: #------------------------------------------------- # Accesslog DB definition (slapo-accesslog) #------------------------------------------------- # Access logging overlay database hdb suffix "cn=accesslog" rootdn "cn=root,cn=accesslog" directory /var/lib/ldap/accesslog index default eq index entryUUID,entryCSN,objectClass,reqEnd,reqResult,reqStart # Let the replica DN have limitless searches limits dn.exact="cn=syncrepl,ou=Accounts,ou=Apps,dc=example,dc=com time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited #------------------------------------------------- # End of Accesslog DB definition (slapo-accesslog) #------------------------------------------------- # Syncrepl overlay - Provider configuration for suffix "cn=accesslog" overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE #------------------------------------------------- # Primary database definition #------------------------------------------------- database hdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw secret directory /var/lib/ldap/example.com cachesize 5000 idlcachesize 2000 checkpoint 512 10 index objectClass,uidNumber,gidNumber,memberUid,employeeNumber eq,pres index employeeType,accountActive,ftpActive,mailActive,vacationActive,ou,mailRoutingAddress eq index cn,mail,surname,givenname eq,pres,subinitial index displayName,gecos,telephoneNumber sub,subany index uid,aliasUid eq,sub,subany index entryUUID,entryCSN eq # Let the replica DN have limitless searches limits dn.exact="cn=syncrepl,ou=Accounts,ou=Apps,dc=example,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited #------------------------------------------------- # End of primary database definition #------------------------------------------------- # Syncrepl - Provider configuration overlay syncprov syncprov-checkpoint 100 30 syncprov-sessionlog 100 # Access Logging overlay overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logpurge 28+00:00 01+00:00 Here is the configuration of the consumer: ############################################################# # Syncrepl - Consumer configuration ############################################################# syncrepl rid=006 provider=ldaps://provider.example.com:636 bindmethod=simple binddn="cn=syncrepl,ou=Accounts,ou=Apps,dc=example,dc=com" credentials=secret type=refreshAndPersist retry="5 +" searchbase="dc=example,dc=com" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on syncdata=accesslog I've been running some LDAP writes (batches of 10 to 10000 sequential writes) on the provider to test the replication on the consumer. Sometimes I observed some latency up to 35 sec. on the consumer with the following messages in the logs: May 8 16:52:08 info-ldap-006 slapd[24480]: do_syncrep2: rid 006 Can't contact LDAP server May 8 16:52:08 info-ldap-006 slapd[24480]: do_syncrepl: rid 006 retrying Some other times, there was not replication at all until I restarted the consumer. Am I missing something in the configuration? Please could you shed some light on the matter? Thanks in advance. Sam

2 9

ppolicy and admins
by Joseph Bruni 11 May '07

11 May '07

Hello, I am using openldap 2.3.30 with the ppolicy module enabled. I have configured the policy pwdMinAge to three days, and this works. However, I would like our administrators to be able to reset a password regardless of the policy, without resorting to the admins using the "rootdn" account. Is there a way to write the ACL's to allow admins to modify the userPassword regardless of the pwdPolicySubentry attached to the entry? Thanks Joe Bruni

1 0

{ldapsearch|ldapadd|ldapmodify} -y passwfile fails
by Mark Par 11 May '07

11 May '07

Hi, I'm getting an error using the -y switch for the ldapsearch, ldapadd, and ldapmodify programs when specifying the password. I do, however, get positive results when using the -w switch. Using ldapsearch, the exact command and error are: $ ldapsearch -H ldap://10.0.0.2 -x -D 'cn=manager,dc=company,dc=com' -y passwdfile -b 'ou=people,dc=company,dc=com' '(uid=mark.par)' ldap_bind: Invalid credentials (49) $ $ ldapsearch -H ldap://10.0.0.2 -x -D 'cn=manager,dc=company,dc=com' -w PassWord -b 'ou=people,dc=company,dc=com' '(uid=mark.par)' # extended LDIF # # LDAPv3 # base <ou=people,dc=company,dc=com> with scope subtree # filter: (uid=mark.par) # requesting: ALL # # mark.par, people, company.com dn: uid=mark.par,ou=people,dc=company,dc=com objectClass: top objectClass: account objectClass: posixAccount homeDirectory: /home/mark.par cn: mark par uid: mark.par loginShell: /bin/ksh userPassword:: aWFrem9rLkdyeW61 uidNumber: 1177 gidNumber: 1177 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 $ I am using NetBSD 3.1.0_PATCH and OpenLDAP 2.3.32 compiled from the packages collection (pkgsrc). Could anyone provide some hints? Thanks, Mark

2 2

simple ACL requirement, grant access to modify myself and my sub entries, not sure how to do it
by Zhang Weiwu 10 May '07

10 May '07

Dear all. In my installation it's required if someone logs in, he can modify his own entry and can modify & delete & create entries of his own entry, e.g. login as: dn: ou=Support,o=Real Softservice Then I should be able to modify & delete & create: dn: cn=Wang Penghui,ou=Suport,o=Real Softservice dn: cn=Zhang Weiwu,ou=Suport,o=Real Softservice dn: cn=Wolfgang Scheuing,ou=Suport,o=Real Softservice Looks like a simple requirement. Anyway I dug into ACL manual for days without a clue (maybe also because of my bad English). Can anyone provide a hint and simplified example? Thanks a lot in advance! -- Zhang Weiwu Real Softservice http://www.realss.com +86 592 2091112

4 4

mapping
by Raffaele Viola 10 May '07

10 May '07

Hi all, I have two database with a different schema hosted on two different ldap server front-ldap and back-ldap. How can I use the *rwm-map *option to include one back-ldap sub-tree as a front-ldap sub tree. Now I'm using these lines and seems doesn't work: database ldap suffix "ou=UK_grp,ou=people,dc=AEL,dc=IT" overlay rwm rwm-suffixmassage "ou=UK_grp,ou=people,dc=AEL,dc=IT" "o=people,dc=RAFFO,dc=ITA" uri "ldap://151.98.181.64/" idassert-bind bindmethod=simple binddn="cn=Manager,dc=RAFFO,dc=ITA" credentials=secret rwm-map objectclass top top rwm-map objectclass organizationalUnit organization rwm-map attribute ou o rwm-map objectclass cmmContact person rwm-map attribute sn sn rwm-map attribute cn cn subordinate _______________________________________________________ front-ldap schema: ou=UK_grp (l:UK_grp , ou:UK_grp , objectClass:top , objectClass organizationalUnit ) | |----cn=Raffo (objectClass:MyContact , sn:raffo , cn:raffo) _______________________________________________________ back-ldap schema: o=UK_grp(l:UK_grp, o:UK_grp, objectClass:top , objectClass organization ) | |----cn=Raffo (objectClass:person , sn:raffo , cn:raffo) Thanks Raffo

1 0

'idassert' feature support on 2.3 branch in back-meta
by Daniel Montero Motilla 09 May '07

09 May '07

Hi, I'm actually using openldap 2.3.27 with meta backend, and digging on 2.3.35 code I have found that 'idassert' feature seems to be recently ported to back-meta on branch 2.3, but there is no reference to this feature on man pages or changelog. Is that feature a work in progress in back-meta 2.3 or is it ready to be used? Thanks, Dani.

2 1

posixGroup
by Karen R McArthur 09 May '07

09 May '07

Annoyingly, some applications require the entire dn of a user be in the memberUid field and others only require the memberUid. On some posixGroups, I end up having the following: cn: grpname objectClass: top objectClass: posixGroup gidNumber: 550 memberUid: uid=user1,ou=People,dc=example,dc=com memberuid: user1 memberUid: uid=user2,ou=People,dc=example,dc=com memberuid: user2 Is there any way to map one to the other so I do not end up having "duplicate" entries? Thank you, -- Karen R. McArthur <kmcarthu(a)bates.edu> Systems Administrator Information and Library Services, Bates College Lewiston, Maine 04240 USA ph:(207)786-8236 fax:(207)786-6057

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software