openldap-software

openldap-software@openldap.org

2719 discussions

Re: slapd-sql with unixodbc - userCertificate retrieval problem
by Pierangelo Masarati 07 Mar '07

07 Mar '07

Kevin Vargo wrote: > Right; except that in ITS#3113, you explicitly state that back-sql > should refuse binary data, I said that no ";binary" should be used. That's different from refusing binary data, don't you agree? p. > don't you? Granted, that was a while > back, however, I've not found mention of where that directive has > been obsoleted. As well the retrieval errors are consistent with > invalid binary->text conversion upon selection out of the database. > > Namely, error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong > tag error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested > asn1 error > > So, how do I (a) tell Back-SQL that the data is binary or (b) do > something else. You don't need to tell back-sql if data is binary or not: it already knows how to deal with data based on their syntax. You need to tell the RDBMS that its' storing binary data, and store the certificate in the RDBMS as binary. If you store the certificate in base64, then back-sql (actually, the certificate's validator, back-sql yous passes octet strings around) doesn't know what to do with it. > Note that this is the OpenSSL invoked by the X.509 validator > (assuming TLS was turned on), even though the certificate in question > is not being used for TLS. However, the normalization still fails, > even (as mentioned) if validation is disabled. I'm assuming the > normalization failure would be related, although I haven't gotten > there yet. TLS has nothing to do with this. OpenLDAP just needs to be compiled with ssl to have certificate handling routines around. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.n.c. Via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ------------------------------------------ Office: +39.02.23998309 Mobile: +39.333.4963172 Email: pierangelo.masarati(a)sys-net.it ------------------------------------------

1 0

Syncrepl with SASL External - SOLVED
by Angela Gavazzi 07 Mar '07

07 Mar '07

I found out that the problem was double encrypting of the connection: It works now if I set TLSVerifyClient to max. allow on the consumer side. All stronger configurations end in: CA unknown. Thanks anyway Angela Here the concerning parts of the slapd.conf: ***************************************************************** master: ... ... TLSCACertificateFile /etc/ldap/certs/cacert.pem TLSCACertificatePath /etc/ldap/certs TLSCertificateFile /etc/ldap/certs/erde.aag_cert.pem TLSCertificateKeyFile /etc/ldap/certs/erde.aag_key.pem TLSVerifyClient demand ***************************************************************** slave: TLSCACertificateFile /etc/ldap/certs/cacert.pem TLSCACertificatePath /etc/ldap/certs TLSCertificateFile /etc/ldap/certs/mond.aag_cert.pem TLSCertificateKeyFile /etc/ldap/certs/mond.aag_key.pem ################## TLSVerifyClient demand ################## This has to be set to max allow.

3 3

Re: syncrepl updates from consumer
by Gregor Friedrich 07 Mar '07

07 Mar '07

Hi I read it also and for me it was clear it's not an active active sync...so the docu is n't so bad! Gregor

1 0

openldap 2.2 master and (many) openldap 2.0 slaves
by Cyrille Bollu 07 Mar '07

07 Mar '07

Hi all, just a quick question: Does an openldap 2.2 master replicates with an openldap 2.0 slave? I know that an openldap 2.2 slave cannot replicate with an openldap 2.0 master. (I just discovered it) but will it work the other way round? It's quite important for me to know if I can have some kind of compatibility between openldap 2.0 and 2.2 (or 2.3 maybe) because I have about 20 openldap servers and upgrading all of them during the same night would be ... well, I think you can imagine... Best regards, Cyrille Bollu Responsable système Fedasil - ICT tel: +32.2.213.43.49 gsm: +32.478.23.08.15

1 0

syncrepl updates from consumer
by John Drescher 07 Mar '07

07 Mar '07

I have just added a second openldap server 2.3.30 to my network and setup syncrepl in refreshOnly mode. I connected to the consumer ldap server using a ldap client but when I tried to make a change I got an error stating that I must have an update referral setup. After adding the updateref to my consumer slapd.conf and restarting that I get an error stating that "modifications require stronger authentication desc Strong(er) authentication required." Now if I try to add updatedn to the consumer slapd.conf I get the following error starting the ldap server: <updatedn> database already shadowed Here is the last bit of my slapd.conf from the consumer: syncrepl rid=100 provider="ldap://192.168.1.40:389" binddn="uid=syncuser,ou=People,dc=radimg,dc=pitt,dc=edu" bindmethod=simple credentials=###CHANGED### searchbase="dc=radimg,dc=pitt,dc=edu" filter="(objectClass=*)" attrs"*" schemachecking=off scope=sub type=refreshOnly interval=00:06:00:00 updateref ldap://192.168.1.40 -- John M. Drescher

3 5

Re: syncrepl updates from consumer
by Pierangelo Masarati 06 Mar '07

06 Mar '07

[please keep replies on the list] Matt Benjamin wrote: > Perangelo, > > Is that an accurate statement of what MirrorMode does? I had understood > that only one master was _allowed to be written to_ to maintain > consistency--hence the need for a load-balancer. According to recent commits and posts by Howard, mirror mode seems to allow writes to all masters under the assumption they have tightly sync'ed clocks (namely, under ntp with very low latency). See <http://www.openldap.org/lists/openldap-devel/200702/msg00019.html> and test050 in HEAD code. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.n.c. Via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ------------------------------------------ Office: +39.02.23998309 Mobile: +39.333.4963172 Email: pierangelo.masarati(a)sys-net.it ------------------------------------------

1 0

Re: slapd-sql with unixodbc - userCertificate retrieval problem
by Pierangelo Masarati 06 Mar '07

06 Mar '07

Kevin Vargo wrote: > On Wed, 2006-06-07 at 17:31 +0200, Pierangelo Masarati wrote: > >> Store the certificate in the RDBMS in the form that is appropriate for >> its value. In fact, back-sql doesn't do any mucking on the value of >> your certificate; if you base64-encode it, back-sql cannot know. >> Moreover, back-sql is very poor at dealing with binary objects, so you >> might be off even if you succeed in storing the certificate in binary >> form. >> >> I guess a reasonable approach would be to use BLOB data type and make >> sure back-sql can handle it accordingly. >> >> p. > > Has anyone else had success using userCertificates? I've placed the > Base-64 encoded certificate data in the database. However upon attempted > retrieval, I get an error attempting to validate the attribute: > unable to validate value #0 of AttributeDescription userCertificate What the above message says is that it's pointless to store the certificate in the database in base64, because back-sql returns the value as is, and slapd expects it to be an octet string containing the certificate, not its base64 representation. > So I #undef'd the pretty/validate directive in back-sql.h (BACKSQL_PRETTY_VALIDATE) > but this only resulted in getting the normalization error: > unable to normalize value #0 of AttributeDescription userCertificate Same as above. Validators for certificates are already present in slapd, and, of course, they expect valid certificates. > Any ideas? As well, is there any documentation on writing validators? > I wasn't able to locate any so far. Write the certificate to the database as is, not base64 encoded, using a BLOB. And, there's no guarantee it works. As usual, if you succeed, patches are welcome. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.n.c. Via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ------------------------------------------ Office: +39.02.23998309 Mobile: +39.333.4963172 Email: pierangelo.masarati(a)sys-net.it ------------------------------------------

1 0

Syncrepl with SASL External
by Angela Gavazzi 05 Mar '07

05 Mar '07

Hallo! I'm trying to set up a replication with syncrepl and saslmech external and it wont succeed. I was reading a lot but I really don't see where the problem is now and don't know how to continue. So I really would appreciate if somebody could point me to the probable error. Please let me know if you need more infos. slapd is 2.3.31 master = erde.aag slave = mond.aag both compiled with: ./configure \ '--prefix=/usr/local/ldap' \ '--mandir=/usr/local/ldap/man' \ '--libexecdir=/usr/local/ldap/sbin' \ '--sysconfdir=/etc' \ '--with-configdir=/etc/ldap' \ '--with-subdir=ldap' \ '--enable-spasswd' \ '--enable-modules' \ '--enable-hdb' \ '--enable-overlays' \ '--enable-slurpd' \ (- will put this out when syncrepl works) '--with-cyrus-sasl' \ '--with-tls' Here the concerning parts of the slapd.conf: ***************************************************************** master: ... overlay syncprov syncprov-checkpoint 100 600 syncprov-sessionlog 100 ... authz-regexp "C=CH,ST=Switzerland,L=Dornach,O=Allgemeine Anthroposophische Gesellschaft,OU=Goetheanum,CN=mond.aag,emailAddress=edv(a)goetheanum.ch" "ldap:///dc=aag??one? (cn=repl)" limits dn.exact="cn=repl,dc=aag" size=unlimited time=unlimited access to * by dn.exact="cn=repl,dc=aag" read by * none break ... TLSCACertificateFile /etc/ldap/certs/cacert.pem TLSCACertificatePath /etc/ldap/certs TLSCertificateFile /etc/ldap/certs/erde.aag_cert.pem TLSCertificateKeyFile /etc/ldap/certs/erde.aag_key.pem TLSVerifyClient demand ***************************************************************** slave: ... overlay syncprov syncrepl rid=001 provider=ldap://erde.aag:389 searchbase="dc=aag" type=refreshOnly filter="objectClass=*" attrs="*,+" schemachecking=off scope=sub interval=00:00:01:00 updatedn "cn=repl,dc=aag" updateref="ldap://erde.aag:389" bindmethod=sasl saslmech=EXTERNAL authz-regexp "C=CH,ST=Switzerland,L=Dornach,O=Allgemeine Anthroposophische Gesellschaft,OU=Goetheanum,CN=mond.aag,emailAddress=edv(a)goetheanum.ch" "ldap:///dc=aag??one? (cn=repl)" access to * by dn="cn=repl,dc=aag" write by * read break TLSCACertificateFile /etc/ldap/certs/cacert.pem TLSCACertificatePath /etc/ldap/certs TLSCertificateFile /etc/ldap/certs/mond.aag_cert.pem TLSCertificateKeyFile /etc/ldap/certs/mond.aag_key.pem TLSVerifyClient demand ********** syncrepl with bindmethod simple works fine with user repl. ***************************************************************** manual connection from the slave as client with the same certs I will use for syncrepl works: ldapsearch -Y external -ZZ cn=repl -h erde.aag -LLL SASL/EXTERNAL authentication started SASL username: emailAddress=edv(a)goetheanum.ch,CN=mond.aag,OU=Goetheanum,O=Allgemeine Anthroposophische Gesellschaft,L=Dornach,ST=Switzerland,C=CH SASL SSF: 0 dn: cn=repl,dc=aag objectClass: simpleSecurityObject objectClass: organizationalRole cn: repl description: LDAP replicator ***************************************************************** When I start the slave for the firt replication with sasl external: snip... =>do_syncrepl rid 001 ldap_create ldap_url_parse_ext(ldap://erde.aag:389) ldap_sasl_interactive_bind_s: user selected: EXTERNAL ldap_int_sasl_bind: EXTERNAL ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP erde.aag:389 ldap_new_socket: 13 ldap_prepare_socket: 13 ldap_connect_to_host: Trying 192.168.100.72:389 ldap_connect_timeout: fd: 13 tm: -1 async: 0 ldap_int_sasl_open: host=192.168.100.72 do_syncrep1: rid 001 ldap_sasl_interactive_bind_s failed (-6) and on the master: daemon: activity on 1 descriptor daemon: activity on: >>> slap_listener(ldap:///)daemon: listen=8, new connection on 12 daemon: added 12r (active) listener=(nil) conn=21 fd=12 ACCEPT from IP=192.168.100.73:60625 (IP=0.0.0.0:389) daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: 12r daemon: read active on 12 connection_get(12) connection_get(12): got connid=21 connection_read(12): checking for input on id=21 ber_get_next ldap_read: want=8, got=7 0000: 30 05 02 01 01 42 00 0....B. ber_get_next: tag 0x30 len 5 contents: ber_dump: buf=0x082abc08 ptr=0x082abc08 end=0x082abc0d len=5 0000: 02 01 01 42 00 ...B. ber_get_next ldap_read: want=8, got=0 ber_get_next on fd 12 failed errno=0 (Success) connection_read(12): input error=-2 id=21, closing. connection_closing: readying conn=21 sd=12 for close connection_close: deferring conn=21 sd=12 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL do_unbind conn=21 op=0 UNBIND connection_resched: attempting closing conn=21 sd=12 connection_close: conn=21 sd=12 daemon: removing 12 conn=21 fd=12 closed () thank you very much angela

5 5

syncrepl works only once
by Wolfgang Hennerbichler 05 Mar '07

05 Mar '07

Hi LDAP Folks, don't know why that happens, but my syncrepl only works, when I start slapd. olcSyncrepl: syncrepl rid=1 provider=ldaps://my.ldap.server type=refreshOnly interval=00:00:10:00 searchbase="dc=my,dc=domain" bindmethod=simple binddn="cn=user,dc=my,dc=domain" retry="60 10 300 3" schemachecking=off credentials=mypasswd my loglevel: olcLogLevel: Parse Sync I see the syncrepl-logs when I fire up slapd, but after that just nothing. I honestly don't know why syncrepl wouldn't loop. I'd appreciate your help; wogri -- wogri(a)wogri.com http://www.wogri.com http://www.einradfilm.at

1 1

dynamic list questions
by Dieter Kluenter 03 Mar '07

03 Mar '07

Hi, i want to create dynamic lists of ipHostnumber. This is the dynamic Group entry ,----[ dynamic Group entry ] | dn: cn=dynamicHosts,o=avci,c=de | cn: dynamicGroup | memberURL: ldap:///ou=benchmark,o=avci,c=de?ipHostNumber?sub?(objectclass=ipHost) | objectClass: groupOfURLs `---- The relevant parts of slapd.conf are ,----[ slapd.conf ] | include /etc/openldap/schema/dyngroup.schema | modulepath /opt/openldap/libexec/openldap | moduleload dynlist.la | database bdb | suffix o=avci,c=de | overlay dynlist | dynlist-attrset groupOfURLs memberURL `---- A ldapsearch -x -H ldap://localhost -b "o=avci,c=de" -s one \ "(objectclass=groupOfUrls)" only presents the DN, that is member: host=abc,ou=benchmark,o=avci,c=de member: host=cde,ou=benchmark,o=avci,c=de ... but I would like a presentation of attribut ipHostNumber like member: ipHostNumber=192.168.100.31 member: ipHostNumber=192.168.100.32 The slapd.conf is based on the example in man slapo-dynlist(5), which says "This example collects all the email addresses of a database into a sin- gle entry;..." What is wrong with my setup? -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de N 53°37'10.08" E 10°08'02.82" GPG Key ID:8EF7B6C6

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software