openldap-software

openldap-software@openldap.org

2719 discussions

AVA_Sort function in slapd/dn.c
by Bret Lambert 20 Mar '07

20 Mar '07

Doing some lint(1) sweeps (some of which ando@ has committed), I got a message stating that the end of the loop in this function was never reached. Looking into it, I think that the code as it currently is is incorrect: static void AVA_Sort( LDAPRDN rdn, int iAVA ) { int i; LDAPAVA *ava_in = rdn[ iAVA ]; assert( rdn != NULL ); assert( ava_in != NULL ); for ( i = 0; i < iAVA; i++ ) { LDAPAVA *ava = rdn[ i ]; int a, j; assert( ava != NULL ); a = strcmp( ava_in->la_attr.bv_val, ava->la_attr.bv_val ); if ( a > 0 ) { break; } while ( a == 0 ) { int v, d; d = ava_in->la_value.bv_len - ava->la_value.bv_len; v = memcmp( ava_in->la_value.bv_val, ava->la_value.bv_val, d <= 0 ? ava_in->la_value.bv_len : ava->la_value.bv_len ); if ( v == 0 && d != 0 ) { v = d; } if ( v <= 0 ) { /* * got it! */ break; } if ( ++i == iAVA ) { /* * already sorted */ return; } ava = rdn[ i ]; a = strcmp( ava_in->la_attr.bv_val, ava->la_attr.bv_val ); } /* * move ahead */ for ( j = iAVA; j > i; j-- ) { rdn[ j ] = rdn[ j - 1 ]; } rdn[ i ] = ava_in; return; } } It's that unconditional return at the end of the for() loop that caused lint(1) to hiccup (also, insofar as I can see, invalidates the entire function). It's easy to see that the intent of the code is to take the element indicated by iAVA and compare it to all previous items in rdn[]. However, all it does is compare it to the first item, and it does the correct thing in that case, but then terminates. So, I whipped up what looks to me to be a better, functioning, and more legible chunk of code. Please flame or reward with cash as appropriate: static void AVA_Sort( LDAPRDN rdn, int iAVA ) { int i = 0; LDAPAVA *ava_in = rdn[ iAVA ]; assert( rdn != NULL ); assert( ava_in != NULL ); LDAPAVA *ava = rdn[ i ]; int a, j; assert( ava != NULL ); while ( ( a = strcmp( ava_in->la_attr.bv_val, ava->la_attr.bv_val ) ) < 0 ) { ava = rdn[ ++i ]; } if ( a > 0 ) { return; } do { int v, d; d = ava_in->la_value.bv_len - ava->la_value.bv_len; v = memcmp( ava_in->la_value.bv_val, ava->la_value.bv_val, min( ava_in->la_value.bv_len, ava->la_value.bv_len ) ); if ( v < 0 || ( v == 0 && d <= 0 ) ) { /* * got it! */ break; } if ( ++i == iAVA ) { /* * already sorted */ return; } ava = rdn[ i ]; } while ( strcmp( ava_in->la_attr.bv_val, ava->la_attr.bv_val ) == 0); /* * move ahead */ for ( j = iAVA; j > i; j-- ) { rdn[ j ] = rdn[ j - 1 ]; } rdn[ i ] = ava_in; }

1 0

OL2.4 provider && OL2.2 consumer?
by Turbo Fredriksson 20 Mar '07

20 Mar '07

Is there any known issues between having a 2.4 provider and a 2.2 consumer? My 2.2 (using SASL) doesn't seem to be binding. I get the connect, but no bind etc (running the provider with '-d -1')... And the log on the consumer just say: do_syncrep1: ldap_sasl_interactive_bind_s failed (-2) This is the syncrepl on the consumer: ----- s n i p ----- syncrepl rid=0 provider=ldap://provider.domain.tld:3389 type=refreshOnly interval=00:00:00:30 searchbase="c=SE" filter="(objectClass=*)" attrs="*,+" scope=sub schemachecking=off updatedn="cn=Administrator,cn=auth" binddn="cn=consumer,ou=LDAP,ou=System,o=Domain,c=SE" bindmethod=sasl saslmech=gssapi realm=BAYOUR.COM authcId=consumer updateref ldap://provider.domain.tld:3389 ----- s n i p ----- And this is the provier syncprov config: ----- s n i p ----- overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 ----- s n i p ----- On the provider machine, I also have a 2.4 consumer and that works correctly (with almost the exact config as the 2.2 consumer - without the 'updatedn' and 'authcId' - which isn't allowed - though). I noticed that there is no 'rid' thingie on the provider any more (or in slapadd) but the 2.4 provider/consumer works any way... ?

2 2

ldap_start_tls: Connect error (-11)
by JOYDEEP 20 Mar '07

20 Mar '07

Dear list, I have self signed certificate. Now the command * ldpasearch -x -ZZ -d 255* shows TLS: hostname (127.0.0.1) does not match common name in certificate (linux.kolkatainfoservices.in). ldap_perror ldap_start_tls: Connect error (-11) additional info: TLS: hostname does not match CN in peer certificate I have checked with the *hostname* command in linux and it shows the hostname as linux.kolkatainfoservices.in I am really confused here. could any one suggest any solution please ?

3 3

libldap_r thread-safety problems
by manu＠netbsd.org 19 Mar '07

19 Mar '07

Hello I have thread-safety problems with libldap_r. My program uses libcurl to access a LDAP URL. When I attempt to fetch LDAP URL from multiple threads at once, I crash. I suspect there could be thread-safety issues with libldap_r. for instance, a nm shows it references gethostbyname, and not gethostname_r. Does it has any chance to be thread-safe if it uses gethostbyname? -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

3 8

overlay order important and not documented?
by Francis Swasey 19 Mar '07

19 Mar '07

I have found using OpenLDAP 2.3.34 on a RHEL4 system (a locally built RPM) that the order of the overlays can lead to a problem (slapd locks up and doesn't do anything). I have found that using syncprov, accesslog, auditlog, unique will work fine. But, adding refint to the end of that chain and then do a modrdn that triggers refint to want to change an attribute in another entry and your slapd is locked up. There is now one thread that will not end and you will only be able to shutdown slapd with a "kill -9". However, if I change the order so that the refint is prior to the accesslog overlay, then it works. Is this interaction between the two overlays and the importance of their relative order a known (or at least expected) -- or should I open an ITS? -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

4 12

addressbook ACLs - cannot create contact in group address book.
by Bernhard D Rohrer 19 Mar '07

19 Mar '07

hi folks I have the following ACL for my groups: # Access to groups addressbooks # allow read of addressbook by members and egwadmin account access to dn.regex="^cn=([^,]+),ou=shared,ou=contacts,dc=graylion,dc=net$" attrs=entry by group.expand="cn=$1,ou=groups,dc=graylion,dc=net" read by dn.regex="cn=admin,dc=graylion,dc=net" write by users none # allow members to create entries in there group addressbooks; no-one else can access it # needs write access to the entries ENTRY attribute ... access to dn.regex="cn=([^,]+),ou=shared,ou=contacts,dc=graylion,dc=net$" attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha by group.expand="cn=$1,ou=groups,dc=graylion,dc=net" write by users none # ... and the entries CHILDREN access to dn.regex="cn=([^,]+),ou=shared,ou=contacts,dc=graylion,dc=net$" attrs=children by group.expand="cn=$1,ou=groups,dc=graylion,dc=net" write by users none the LDIF of one of my groups is: dn: cn=GraylionEnterprises,ou=groups,dc=graylion,dc=net cn: GraylionEnterprises gidNumber: 7 memberUid: user1 memberUid: user2 memberUid: user3 memberUid: ... objectClass: top objectClass: posixGroup and the log shows this error: Mar 15 17:20:27 diskslave slapd[6657]: => bdb_entry_get: found entry: "cn=graylionenterprises,ou=groups,dc=graylion,dc=net" Mar 15 17:20:27 diskslave slapd[6657]: <= bdb_entry_get: failed to find objectClass while eGW shoes this error: Error saving the contact !!! Insufficient access: so_ldap: 503 what is wrong? Anybody have any ideas? cheers Bernhard PS: this works for personal address books -- Graylion's Fetish & Fashion Store Goth and Kinky Boots, Clothing and Jewellery http://www.graylion.net

3 2

Migrating openldap db backend from ibdm to bdb
by Asrai khn 17 Mar '07

17 Mar '07

Hi I want to migrate our openldap db backend which currently using idbm to bdb, Matt have suggested following steps, would you please kind enough to put some more light on few steps <snip> Migrate to BDB or HDB. Here's the rough idea: shutdown slapd slapcat -f /path/to/slapd.conf -l mydb.ldif vi /path/to/slapd.conf Change your database to a new directory. Read about tuning, cache sizing, and other stuff. Read openldap man pages. ( what to read ;) Read oracle's tuning docs for bdb. (we are not using any oracle things) Re-Read openldap man pages. (re-read for what :-S :wq slapadd -f /path/to/slapd.conf -l mydb.ldif Fix permissions on /var/run so the slapd user can write there -- this one is pretty easy </snip> Secondly, to be safe side, if something goes wrong, taking backup of ... directory /var/lib/ldap/mydomain.com cp -r /var/lib/ldap/mydomain.com /TosomeSafePlace is enough to fallback to ibdm? I want minimum downtime, heh frankly I can't aford my ass on fire :P Thanks. Askar

12 20

OpenLDAP 2.4 && SASL Auths
by Turbo Fredriksson 17 Mar '07

17 Mar '07

I've setting up a new primary server and choosed 2.4 (HEAD) as server for that... Might not be a good idea to use 2.4 on a production environment, but... :) Anyway, I set up a authz-regexp as I have on my 2.2 servers like this: ----- s n i p ----- authz-regexp uid=(.*),cn=bayour.com,cn=gssapi,cn=auth ldap:///c=SE??sub?krb5PrincipalName=$1@BAYOUR.COM ----- s n i p ----- Unfortunatly, ldapwhoami/slapd doesn't mapp this to my DN. An anonymous LDAP search will retreive my object correctly: ----- s n i p ----- root@rigel# ldapsearch -LLL -H ldapi://%2fvar%2frun%2fslapd%2fldapi.provider krb5PrincipalName=turbo(a)BAYOUR.COM dn SASL/GSSAPI authentication started SASL username: turbo(a)BAYOUR.COM SASL SSF: 56 SASL data security layer installed. dn: uid=turbo,ou=People,o=Fredriksson,c=SE root@rigel# ldapsearch -x -LLL -H ldapi://%2fvar%2frun%2fslapd%2fldapi.provider krb5PrincipalName=turbo(a)BAYOUR.COM dn dn: uid=turbo,ou=People,o=Fredriksson,c=SE ----- s n i p ----- And ldapwhoami shows: ----- s n i p ----- root@rigel# ldapwhoami -H ldapi://%2fvar%2frun%2fslapd%2fldapi.provider SASL/GSSAPI authentication started SASL username: turbo(a)BAYOUR.COM SASL SSF: 56 SASL data security layer installed. dn:uid=turbo,cn=bayour.com,cn=gssapi,cn=auth ----- s n i p ----- Running slapd with '-d -1' shows this when it tries to map my ticket/authzID (?): ----- s n i p ----- [...] put_simple_filter: "krb5PrincipalName=turbo(a)BAYOUR.COM" begin get_filter EQUALITY [...] slap_sasl2dn: performing internal search (base=c=se, scope=2) => hdb_search bdb_dn2entry("c=se") => access_allowed: auth access to "c=SE" "entry" requested => dn: [1] => dn: [2] cn=log1 => dn: [3] cn=log1 => dn: [4] cn=monitor => dn: [5] cn=subschema => dn: [6] cn=config => acl_get: [8] attr entry => acl_mask: access to entry "c=SE", attr "entry" requested => acl_mask: to all values by "", (=0) <= check a_dynacl <= check a_dynacl: aci <= aci_list_get_attr_rights test objectClass#public# for entry -> failed <= aci_list_get_attr_rights test objectClass#public# for [all] -> failed <= aci_list_get_attr_rights test userReference#public# for entry -> failed <= aci_list_get_attr_rights test userReference#public# for [all] -> failed <= aci_list_get_attr_rights test entry#public# for entry -> ok <= aci_list_get_attr_rights rights r,s,c;entry#public# to mask 0x39 <= aci_list_get_attr_rights test entry#public# for [all] -> failed <= aci_list_get_attr_rights test useControls#users# for entry -> failed <= aci_list_get_attr_rights test useControls#users# for [all] -> failed <= aci_list_get_attr_rights test useEzmlm#users# for entry -> failed <= aci_list_get_attr_rights test useEzmlm#users# for [all] -> failed <= aci_list_get_attr_rights test useBind9#users# for entry -> failed <= aci_list_get_attr_rights test useBind9#users# for [all] -> failed <= aci_list_get_attr_rights test useWebSrv#users# for entry -> failed <= aci_list_get_attr_rights test useWebSrv#users# for [all] -> failed <= aci_list_get_attr_rights test autoReload#users# for entry -> failed <= aci_list_get_attr_rights test autoReload#users# for [all] -> failed <= aci_list_get_attr_rights test allowServerChange#users# for entry -> failed <= aci_list_get_attr_rights test allowServerChange#users# for [all] -> failed <= aci_list_get_attr_rights test whoAreWe#users# for entry -> failed <= aci_list_get_attr_rights test whoAreWe#users# for [all] -> failed <= aci_list_get_attr_rights test language#users# for entry -> failed <= aci_list_get_attr_rights test language#users# for [all] -> failed <= aci_list_get_attr_rights test hostMaster#users# for entry -> failed <= aci_list_get_attr_rights test hostMaster#users# for [all] -> failed <= aci_list_get_attr_rights test ezmlmBinaryPath#users# for entry -> failed <= aci_list_get_attr_rights test ezmlmBinaryPath#users# for [all] -> failed <= aci_list_get_attr_rights test krb5RealmName#users# for entry -> failed <= aci_list_get_attr_rights test krb5RealmName#users# for [all] -> failed <= aci_list_get_attr_rights test krb5AdminServer#users# for entry -> failed <= aci_list_get_attr_rights test krb5AdminServer#users# for [all] -> failed <= aci_list_get_attr_rights test krb5PrincipalName#users# for entry -> failed <= aci_list_get_attr_rights test krb5PrincipalName#users# for [all] -> failed <= aci_list_get_attr_rights test krb5AdminKeytab#users# for entry -> failed <= aci_list_get_attr_rights test krb5AdminKeytab#users# for [all] -> failed <= aci_list_get_attr_rights test krb5AdminCommandPath#users# for entry -> failed <= aci_list_get_attr_rights test krb5AdminCommandPath#users# for [all] -> failed <= aci_list_get_attr_rights test controlBaseDn#users# for entry -> failed <= aci_list_get_attr_rights test controlBaseDn#users# for [all] -> failed <= aci_list_get_attr_rights test ezmlmAdministrator#users# for entry -> failed <= aci_list_get_attr_rights test ezmlmAdministrator#users# for [all] -> failed <= aci_list_get_attr_rights test controlsAdministrator#users# for entry -> failed <= aci_list_get_attr_rights test controlsAdministrator#users# for [all] -> failed <= aci_list_get_attr_rights test useACI#users# for entry -> failed <= aci_list_get_attr_rights test useACI#users# for [all] -> failed <= aci_list_get_attr_rights test [all]#access-id#uid=turbo,ou=people,o=fredriksson,c=se for entry -> failed <= aci_list_get_attr_rights test [all]#access-id#uid=turbo,ou=people,o=fredriksson,c=se for [all] -> ok <= aci_list_get_attr_rights rights w,r,s,c,x;[all]#access-id#uid=turbo,ou=people,o=fredriksson,c=se to mask 0x37d <= aci_mask grant =rsc deny =0 <= acl_mask: [2] applying +rsc (stop) <= acl_mask: [2] mask: =rsc => slap_access_allowed: auth access denied by =rsc => access_allowed: no more rules ----- s n i p ----- So question number one is: why does it start in my suffix? And why does it fail, even though it succeeded in what it was looking for (attr 'entry')? Oh, another thing that would be _nice_ (not that I need it now, but you never know :). The following authz-regexp don't work (because krb5Principalname is case sensitive - ?): ----- s n i p ----- authz-regexp uid=(.*),cn=(.*),cn=gssapi,cn=auth ldap:///c=SE??sub?krb5PrincipalName=$1@$2 ----- s n i p ----- Any ideas on how to do this (without having multiple authz-regexp's)?

1 1

confusion with two ldap.conf in a single system
by JOYDEEP 16 Mar '07

16 Mar '07

Dear list, I am using Suse 10.1 with openldap2-2.3.19-18. I am very much confused to see the two ldap.conf file in my system one is located at /etc/ldap.conf and the other is at /etc/openldap/ldap.conf Which file should I modify to get the effect ? thanks.

5 7

dnattr
by Bernhard D Rohrer 15 Mar '07

15 Mar '07

regarding my ACL problem i have tried to solve it by using this ACL: # Access to groups addressbooks # allow read of addressbook by members and egwadmin account access to dn.regex="^cn=([^,]+),ou=shared,ou=contacts,dc=graylion,dc=net$" attrs=entry by group.expand="cn=$1,ou=groups,dc=graylion,dc=net" read by dn.regex="cn=admin,dc=graylion,dc=net" write by users none # allow members to create entries in their group addressbooks; no-one else can a ccess it # needs write access to the entries ENTRY attribute ... access to dn.regex="cn=([^,]+),ou=shared,ou=contacts,dc=graylion,dc=net$" attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha by dnattr=memberUid write # by group.expand="cn=$1,ou=groups,dc=graylion,dc=net" write by users none # ... and the entries CHILDREN access to dn.regex="cn=([^,]+),ou=shared,ou=contacts,dc=graylion,dc=net$" attrs=children by dnattr=memberUid write # by group.expand="cn=$1,ou=groups,dc=graylion,dc=net" write by users none the group looks like this: dn: cn=GraylionEnterprises,ou=groups,dc=graylion,dc=net cn: GraylionEnterprises gidNumber: 7 memberUid: user1 memberUid: user2 memberUid: user3 memberUid: ... objectClass: top objectClass: posixGroup and on restarting slapd I get: Starting OpenLDAP: running BDB recovery, slapd - failed: /usr/share/egroupware/addressbook/doc/acl_addressbook.conf: line 37: dnattr "memberUid": inappropriate syntax: 1.3.6.1.4.1.1466.115.121.1.26 thanks Bernhard -- Graylion's Fetish & Fashion Store Goth and Kinky Boots, Clothing and Jewellery http://www.graylion.net

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software