openldap-software

openldap-software@openldap.org

2719 discussions

Start a nNew thread

openldap logs
by Raffaele Viola 09 May '07

09 May '07

Hi all, how can I activate the openldap logs and where I can see the logs? Thanks Raffo

5 7

ACL's and write permission.
by lauro＠npd.ufsc.br 09 May '07

09 May '07

I went thru slapd.access and slapacl manuals, read the FAQ but I'm stuck. I cannot give some user privilege to write to some parts of my LDAP tree. LDIF export of the relevant parts of my tree: ---------------------------- # Exportação LDIF para: cn=admin,dc=sub,dc=domain,dc=xyz,dc=xy # Servidor: ldap sub.domain.xyz.xy (127.0.0.1) # Abrangência da Busca: sub # Filtro de Busca: (objectClass=*) # Total de objetos: 1 dn: cn=admin,dc=sub,dc=domain,dc=xyz,dc=xy objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: Administrador LDAP # Exportação LDIF para: ou=moodleusers,dc=sub,dc=domain,dc=xyz,dc=xy # Servidor: ldap sub.domain.xyz.xy (127.0.0.1) # Abrangência da Busca: base # Filtro de Busca: (objectClass=*) # Total de objetos: 1 dn: ou=moodleusers,dc=sub,dc=domain,dc=xyz,dc=xy ou: moodleusers objectClass: organizationalUnit objectClass: top # Exportação LDIF para: uid=usuariomoodle-admin,dc=sub,dc=domain,dc=xyz,dc=xy # Servidor: ldap sub.domain.xyz.xy (127.0.0.1) # Abrangência da Busca: sub # Filtro de Busca: (objectClass=*) # Total de objetos: 1 dn: uid=usuariomoodle-admin,dc=sub,dc=domain,dc=xyz,dc=xy uid: usuariomoodle-admin userPassword: ... objectClass: account objectClass: simpleSecurityObject objectClass: top ---------------------------- and now slapd.conf: ---------------------------- # 1 access to dn.base="cn=Subschema" by * read # 2 access to attrs=userPKCS12 by self write by * auth # 3 access to attrs=shadowLastChange by self write by * read # 4 access to attrs=userPassword by dn="cn=admin,dc=sub,dc=domain,dc=xyz,dc=xy" write by anonymous auth by self write by * none # 5 access to dn.base="" by * read # 6 access to * by dn="cn=admin,dc=sub,dc=domain,dc=xyz,dc=xy" write by * read # 7 access to dn="ou=moodleusers,dc=sub,dc=domain,dc=xyz,dc=xy" by dn="uid=usuariomoodle-admin,dc=sub,dc=domain,dc=xyz,dc=xy" write # Previous tries #access to dn.subtree="ou=moodleusers,dc=sub,dc=domain,dc=xyz,dc=xy" # by dn.exact="uid=usuariomoodle-admin,dc=sub,dc=domain,dc=xyz,dc=xy" write #access to dn.children="dc=sub,dc=domain,dc=xyz,dc=xy" # by dn="uid=usuariomoodle-admin,dc=sub,dc=domain,dc=xyz,dc=xy" write #access to * (!) # by dn.exact="uid=usuariomoodle-admin,dc=sub,dc=domain,dc=xyz,dc=xy" write suffix "dc=sub,dc=domain,dc=xyz,dc=xy" rootdn "cn=admin,dc=sub,dc=domain,dc=xyz,dc=xy" rootpw ... ---------------------------- I also tried to set usuariomoodle-admin permissions to "=mwrscxd" since it's the exact output from slapacl for "cn=admin,dc=sub,dc=domain,dc=xyz,dc=xy". Following the acl's in that order I can't find where, if it exists, an acl breaks my acl number 7. I used phpldapadmin, logged as usuariomoodle-admin, could not create child objects, neither modify existing ones. Using the external application (that this acl refers to) to try to write on the ldap tree didn't work. Finally slapacl showed just "rscxd" as the permissions for that user, despite the fact that I set write permission on the slapd.conf for that resource/that user. What's wrong? thanks, lauro ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

2 1

Linuxtag 2007
by Dieter Kluenter 08 May '07

08 May '07

Hello, same procedure as every year :-) OpenLDAP has a booth at Linuxtag 2007, manned with Peter Gietz Michael Stroeder and me. http://www.linuxtag.org/2007 We have some VIP tickets available, whoever wants to attand Linuxtag, please mail me, to get an VIP ticket. -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6

1 0

differend backends under one suffix
by Piotr Wadas 08 May '07

08 May '07

Hello, I'm experimenting with various backends. Is it possible to have different backends under the same suffix? e.g I have database with bdb backend, and suffix dc=foo now, I want dc=bar,dc=foo to be in another database, probably with other backend /ldap, bdb, shell../ In other words - I want two (or more) branches from different servers (or databases), to be available under suffixes of the same main suffix. I'm using newest stable of openldap I could find. Regards, Piotr

2 1

Overlay documentation
by Greg Martin 08 May '07

08 May '07

I spent a bit of time looking around openldap.org & google for documentation on the overlays for slapd (what's available, how they work, etc). I found man docs, but nothing else. Are there administrator docs for these or is the man pages all there is? Thanks \\Greg

4 3

Re: Chain Overlay and Syncrepl
by Pierangelo Masarati 08 May '07

08 May '07

Please keep replies on the list. Scott Sanders wrote: > Thank you for the rapid response. > > Even if I move the 7 lines defining the chain overlay above the database > definition I am seeing the same results. For testing, I moved those lines > between the argsfile directive and the password-hash directive. You should verify from the slave's and the master's logs that an attempt is made to chase the referral, and determine why it fails. All in all, if your build passes test007 and test018 the overlay is working fine, and I don't see anything odd in your configuration, at a first glance. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

2 1

Chain Overlay and Syncrepl
by Scott Sanders 08 May '07

08 May '07

Hello all, I am having problems with chasing referrals on my slave OpenLDAP server. I feel like I'm repeating an older thread here, but despite everything I have read I cannot find a solution. My setup is as follows: Both the master and the slave are OpenLDAP 2.3.32 builds with the follwing configure parameters, LD_LIBRARY_PATH="/usr/local/lib" ./configure --prefix=/usr/local --disable-ipv6 --with-tls --enable-dynamic --enable-slapd --enable-modules --enable-crypt --enable-bdb --enable-rewrite --enable-backends=yes --enable-rlookups --disable-shell --disable-sql --enable-overlays=yes --enable-slurpd=yes At the end of the email, I have attached both the master and the slave slapd.conf. The problem is that when I attempt an ldapadd against the slave server, I am returned a referral instead of having the slave forward the request to the master. I see no attempt to contact the master server in either the slave or master logs. Nor do I see any traffic between the two (other than syncrepl stuff) in a tcpdump. As far as I can tell the chain overlay is being ignored entirely. Any suggestions or fixes would be greatly appreciated. - Scott Sanders ############################################ # Master slapd.conf -- ldap://info.domain.com:389 ############################################ include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args password-hash {ssha} security tls=1 TLSCACertificateFile /etc/pki/CA/cacert.pem TLSCACertificatePath /etc/pki/CA TLSCertificateFile /usr/local/etc/openldap/security/ldap-master.crt TLSCertificateKeyFile /usr/local/etc/openldap/security/ldap-master.key TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSVerifyClient allow limits dn.exact="cn=syncuser,dc=domain,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited access to attrs=userPassword by self write by dn="cn=admin,dc=domain,dc=com" write by dn="cn=syncuser,dc=domain,dc=com" read by * auth access to * by dn="cn=admin,dc=domain,dc=com" write by dn="cn=syncuser,dc=domain,dc=com" read by dn="cn=syncuser,dc=domain,dc=com" read by * read database hdb suffix cn=accesslog directory /usr/local/var/openldap-accesslog rootdn cn=accesslog index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE database bdb suffix "dc=domain,dc=com" rootdn "cn=admin,dc=domain,dc=com" rootpw {SSHA}T2JGZSB3Q2x57s/O directory /usr/local/var/openldap-data index objectClass eq index entryCSN eq index entryUUID eq overlay syncprov syncprov-checkpoint 1000 60 overlay accesslog logdb cn=accesslog logops writes logsuccess true logpurge 07+00:00 01+00:00 ############################################ # Slave slapd.conf -- ldap://arch.domain.com ############################################ include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args password-hash {ssha} security tls=1 TLSCACertificateFile /etc/pki/CA/cacert.pem TLSCACertificatePath /etc/pki/CA TLSCertificateFile /usr/local/etc/openldap/security/ldap-slave.crt TLSCertificateKeyFile /usr/local/etc/openldap/security/ldap-slave.key TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSVerifyClient allow access to attrs=userPassword by self write by dn="cn=admin,dc=domain,dc=com" read by dn="cn=syncuser,dc=domain,dc=com" write by * auth access to * by dn="cn=admin,dc=domain,dc=com" read by dn="cn=syncuser,dc=domain,dc=com" write by * read database bdb suffix "dc=domain,dc=com" rootdn "cn=admin,dc=domain,dc=com" rootpw {SSHA}T2JGZkB3Q2x57s/O overlay chain chain-uri ldap://info.domain.com:389 chain-rebind-as-user TRUE chain-idassert-bind bindmethod=simple binddn="cn=admin,dc=domain,dc=com" credentials=secret mode=self directory /usr/local/var/openldap-data index objectClass eq index entryUUID eq syncrepl rid=0 provider=ldap://info.domain.com:389 starttls=yes bindmethod=simple binddn="cn=syncuser,dc=domain,dc=com" credentials=secretsyncpasswd searchbase="dc=domain,dc=com" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemaChecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog updateref ldap://info.domain.com:389

2 1

Fwd: rewrite rule - turn groupOfNames into posixGroup
by Shane 08 May '07

08 May '07

Hi All, I'm looking for some help in writing a rewrite rule or some other back-ldap etc to "masquerade" some groupOfNames objects as posixGroups - the reason for this is to allow me to move forward with implementing "proper" groups within the LDAP server for use with ACL's etc but to provide backwards compatibility / inter-operability with clients that don't [yet] support groupOfNames I started some work on this a while ago but never got anywhere - only managed to ever get the server to tell me my rules were invalid and it wouldn't start - annoyingly I deleted the rules from the slapd file and now can't find test copy that had them around ...so starting afresh basically and hoping someone else has done this or similar so I don't need to re-invent the wheel. TIA Shane.

2 1

WARNING: No dynamic config support for overlay rwm.
by Raffaele Viola 08 May '07

08 May '07

Hi all, I want to make my ldap to ask request about one sub-tree to another ldap. I'm using these configuration lines: database ldap suffix "ou=UK_grp,ou=people,dc=SUNDAY,dc=IT" overlay rwm rwm-suffixmassage "ou=UK_grp,ou=people,dc=SUNDAY,dc=IT" "o=people,dc=RAFFO,dc=ITA" uri "ldap://151.98.181.64/" acl-bind bindmethod=simple binddn="cn=Manager,dc=RAFFO,dc=ITA" credentials=secret idassert-bind bindmethod=simple binddn="cn=Manager,dc=RAFFO,dc=ITA" credentials=secret rwm-map objectclass cmmContact person subordinate database bdb suffix "dc=SUNDAY, dc=IT" rootdn "cn=Manager,dc=SUNDAY,dc=IT" rootpw secret checkpoint 1024 5 cachesize 10000 but when I execute this command ./slapd -T test, this warning appears: WARNING: No dynamic config support for overlay rwm. Can someone help me? Thanks Raffo

3 2

add back-ldap modules
by Raffaele Viola 08 May '07

08 May '07

Hi all, I downloaded openldap-2.3.35.tgz now I have to add the back-ldap modules to my own installation under gentoo . How can I make it? Raffo

4 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software