openldap-software

openldap-software@openldap.org

2719 discussions

ACL problem
by Bernhard D Rohrer 03 Mar '07

03 Mar '07

Hi I am using openLDAP with eGroupware and am currently trying to implement eGroupware's acl_addressbook.conf, which I have adapted to the way my directory is built: # Access to users personal addressbooks # allow read of addressbook by owner and egwadmin account access to dn.regex="^cn=([^,]+),ou=personal,ou=contacts,dc=graylion,dc=net$" attrs=entry by dn.regex="uid=$1,ou=accounts,dc=graylion,dc=net" read by dn.regex="cn=egwadmin,dc=graylion,dc=net" write by users none # allow user to create entries in own addressbook; no-one else can access it # needs write access to the entries ENTRY attribute ... access to dn.regex="cn=([^,]+),ou=personal,ou=contacts,,dc=graylion,dc=net$" attrs=children by dn.regex="uid=$1,ou=accounts,dc=graylion,dc=net" write by users none # ... and the entries CHILDREN access to dn.regex="cn=([^,]+),ou=personal,ou=contacts,dc=graylion,dc=net$" attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha by dn.regex="uid=$1,ou=accounts,dc=graylion,dc=net" write by users none # Access to groups addressbooks # allow read of addressbook by members and egwadmin account access to dn.regex="^cn=([^,]+),ou=shared,ou=contacts,dc=graylion,dc=net$" attrs=entry by group.expand="cn=$1,ou=groups,dc=graylion,dc=net" read by dn.regex="cn=egwadmin,o=$2,dc=graylion,dc=net" write by users none # allow members to create entries in there group addressbooks; no-one else can access it # needs write access to the entries ENTRY attribute ... access to dn.regex="cn=([^,]+),ou=shared,ou=contacts,dc=graylion,dc=net$" attrs=children by group.expand="cn=$1,ou=groups,dc=graylion,dc=net" write by users none # ... and the entries CHILDREN access to dn.regex="cn=([^,]+),ou=shared,ou=contacts,dc=graylion,dc=net$" attrs=entry,@inetOrgPerson,@mozillaAbPersonAlpha by group.expand="cn=$1,ou=groups,dc=graylion,dc=net" write by users none when I try to add a user I get a 503 failure and the log reads somewhat like this: Mar 3 16:29:28 diskslave slapd[12582]: daemon: removing 15 Mar 3 16:29:28 diskslave slapd[12582]: conn=8 fd=15 closed Mar 3 16:29:28 diskslave slapd[12582]: do_bind Mar 3 16:29:28 diskslave slapd[12582]: >>> dnPrettyNormal: <cn=admin,dc=graylion,dc=net> Mar 3 16:29:28 diskslave slapd[12582]: <<< dnPrettyNormal: <cn=admin,dc=graylion,dc=net>, <cn=admin,dc=graylion,dc=net> Mar 3 16:29:28 diskslave slapd[12582]: do_bind: version=3 dn="cn=admin,dc=graylion,dc=net" method=128 Mar 3 16:29:28 diskslave slapd[12582]: conn=9 op=0 BIND dn="cn=admin,dc=graylion,dc=net" method=128 Mar 3 16:29:28 diskslave slapd[12582]: bdb_dn2entry("cn=admin,dc=graylion,dc=net") Mar 3 16:29:28 diskslave slapd[12582]: => access_allowed: auth access to "cn=admin,dc=graylion,dc=net" "userPassword" requested Mar 3 16:29:28 diskslave slapd[12582]: => acl_get: [1] attr userPassword Mar 3 16:29:28 diskslave slapd[12582]: => acl_mask: access to entry "cn=admin,dc=graylion,dc=net", attr "userPassword" requested Mar 3 16:29:28 diskslave slapd[12582]: => acl_mask: to all values by "", (=n) Mar 3 16:29:28 diskslave slapd[12582]: <= check a_dn_pat: cn=admin,dc=graylion,dc=net Mar 3 16:29:28 diskslave slapd[12582]: <= check a_dn_pat: anonymous Mar 3 16:29:28 diskslave slapd[12582]: <= acl_mask: [2] applying auth(=x) (stop) Mar 3 16:29:28 diskslave slapd[12582]: <= acl_mask: [2] mask: auth(=x) Mar 3 16:29:28 diskslave slapd[12582]: => access_allowed: auth access granted by auth(=x) Mar 3 16:29:28 diskslave slapd[12582]: conn=9 op=0 BIND dn="cn=admin,dc=graylion,dc=net" mech=SIMPLE ssf=0 Mar 3 16:29:28 diskslave slapd[12582]: do_bind: v3 bind: "cn=admin,dc=graylion,dc=net" to "cn=admin,dc=graylion,dc=net" Mar 3 16:29:28 diskslave slapd[12582]: send_ldap_result: conn=9 op=0 p=3 Mar 3 16:29:28 diskslave slapd[12582]: send_ldap_response: msgid=1 tag=97 err=0 Mar 3 16:29:28 diskslave slapd[12582]: conn=9 op=0 RESULT tag=97 err=0 text= Mar 3 16:29:28 diskslave slapd[12582]: daemon: activity on 1 descriptors Mar 3 16:29:28 diskslave slapd[12582]: daemon: activity on: Mar 3 16:29:28 diskslave slapd[12582]: 14r Mar 3 16:29:28 diskslave slapd[12582]: Mar 3 16:29:28 diskslave slapd[12582]: daemon: read activity on 14 Mar 3 16:29:28 diskslave slapd[12582]: connection_get(14): got connid=7 Mar 3 16:29:28 diskslave slapd[12582]: connection_read(14): checking for input on id=7 Mar 3 16:29:28 diskslave slapd[12582]: ber_get_next on fd 14 failed errno=11 (Resource temporarily unavailable) Mar 3 16:29:28 diskslave slapd[12582]: daemon: select: listen=6 active_threads=0 tvp=NULL Mar 3 16:29:28 diskslave slapd[12582]: daemon: select: listen=7 active_threads=0 tvp=NULL Mar 3 16:29:28 diskslave slapd[12582]: do_unbind Mar 3 16:29:28 diskslave slapd[12582]: conn=7 op=1 UNBIND Mar 3 16:29:28 diskslave slapd[12582]: connection_closing: readying conn=7 sd=14 for close Mar 3 16:29:28 diskslave slapd[12582]: connection_resched: attempting closing conn=7 sd=14 Mar 3 16:29:28 diskslave slapd[12582]: connection_close: conn=7 sd=14 Mar 3 16:29:28 diskslave slapd[12582]: daemon: removing 14 Mar 3 16:29:28 diskslave slapd[12582]: conn=7 fd=14 closed Mar 3 16:29:28 diskslave slapd[12582]: daemon: activity on 1 descriptors Mar 3 16:29:28 diskslave slapd[12582]: daemon: select: listen=6 active_threads=0 tvp=NULL Mar 3 16:29:28 diskslave slapd[12582]: daemon: select: listen=7 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on 1 descriptors Mar 3 16:29:29 diskslave slapd[12582]: daemon: new connection on 12 Mar 3 16:29:29 diskslave slapd[12582]: conn=10 fd=12 ACCEPT from IP=127.0.0.1:59758 (IP=0.0.0.0:389) Mar 3 16:29:29 diskslave slapd[12582]: daemon: added 12r Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on: Mar 3 16:29:29 diskslave slapd[12582]: Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=6 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=7 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on 1 descriptors Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on: Mar 3 16:29:29 diskslave slapd[12582]: 12r Mar 3 16:29:29 diskslave slapd[12582]: Mar 3 16:29:29 diskslave slapd[12582]: daemon: read activity on 12 Mar 3 16:29:29 diskslave slapd[12582]: connection_get(12): got connid=10 Mar 3 16:29:29 diskslave slapd[12582]: connection_read(12): checking for input on id=10 Mar 3 16:29:29 diskslave slapd[12582]: ber_get_next on fd 12 failed errno=11 (Resource temporarily unavailable) Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=6 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=7 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: do_bind Mar 3 16:29:29 diskslave slapd[12582]: >>> dnPrettyNormal: <uid=graylion,ou=users,dc=graylion,dc=net> Mar 3 16:29:29 diskslave slapd[12582]: <<< dnPrettyNormal: <uid=graylion,ou=users,dc=graylion,dc=net>, <uid=graylion,ou=users,dc=graylion,dc=net> Mar 3 16:29:29 diskslave slapd[12582]: do_bind: version=3 dn="uid=graylion,ou=users,dc=graylion,dc=net" method=128 Mar 3 16:29:29 diskslave slapd[12582]: conn=10 op=0 BIND dn="uid=graylion,ou=users,dc=graylion,dc=net" method=128 Mar 3 16:29:29 diskslave slapd[12582]: bdb_dn2entry("uid=graylion,ou=users,dc=graylion,dc=net") Mar 3 16:29:29 diskslave slapd[12582]: => access_allowed: auth access to "uid=graylion,ou=users,dc=graylion,dc=net" "userPassword" requested Mar 3 16:29:29 diskslave slapd[12582]: => acl_get: [1] attr userPassword Mar 3 16:29:29 diskslave slapd[12582]: => acl_mask: access to entry "uid=graylion,ou=users,dc=graylion,dc=net", attr "userPassword" requested Mar 3 16:29:29 diskslave slapd[12582]: => acl_mask: to all values by "", (=n) Mar 3 16:29:29 diskslave slapd[12582]: <= check a_dn_pat: cn=admin,dc=graylion,dc=net Mar 3 16:29:29 diskslave slapd[12582]: <= check a_dn_pat: anonymous Mar 3 16:29:29 diskslave slapd[12582]: <= acl_mask: [2] applying auth(=x) (stop) Mar 3 16:29:29 diskslave slapd[12582]: <= acl_mask: [2] mask: auth(=x) Mar 3 16:29:29 diskslave slapd[12582]: => access_allowed: auth access granted by auth(=x) Mar 3 16:29:29 diskslave slapd[12582]: conn=10 op=0 BIND dn="uid=graylion,ou=users,dc=graylion,dc=net" mech=SIMPLE ssf=0 Mar 3 16:29:29 diskslave slapd[12582]: do_bind: v3 bind: "uid=graylion,ou=users,dc=graylion,dc=net" to "uid=graylion,ou=users,dc=graylion,dc=net" Mar 3 16:29:29 diskslave slapd[12582]: send_ldap_result: conn=10 op=0 p=3 Mar 3 16:29:29 diskslave slapd[12582]: send_ldap_response: msgid=1 tag=97 err=0 Mar 3 16:29:29 diskslave slapd[12582]: conn=10 op=0 RESULT tag=97 err=0 text= Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on 1 descriptors Mar 3 16:29:29 diskslave slapd[12582]: daemon: new connection on 13 Mar 3 16:29:29 diskslave slapd[12582]: conn=11 fd=13 ACCEPT from IP=127.0.0.1:59759 (IP=0.0.0.0:389) Mar 3 16:29:29 diskslave slapd[12582]: daemon: added 13r Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on: Mar 3 16:29:29 diskslave slapd[12582]: Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=6 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=7 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on 1 descriptors Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on: Mar 3 16:29:29 diskslave slapd[12582]: 13r Mar 3 16:29:29 diskslave slapd[12582]: Mar 3 16:29:29 diskslave slapd[12582]: daemon: read activity on 13 Mar 3 16:29:29 diskslave slapd[12582]: connection_get(13): got connid=11 Mar 3 16:29:29 diskslave slapd[12582]: connection_read(13): checking for input on id=11 Mar 3 16:29:29 diskslave slapd[12582]: ber_get_next on fd 13 failed errno=11 (Resource temporarily unavailable) Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=6 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=7 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: do_bind Mar 3 16:29:29 diskslave slapd[12582]: >>> dnPrettyNormal: <uid=graylion,ou=users,dc=graylion,dc=net> Mar 3 16:29:29 diskslave slapd[12582]: <<< dnPrettyNormal: <uid=graylion,ou=users,dc=graylion,dc=net>, <uid=graylion,ou=users,dc=graylion,dc=net> Mar 3 16:29:29 diskslave slapd[12582]: do_bind: version=3 dn="uid=graylion,ou=users,dc=graylion,dc=net" method=128 Mar 3 16:29:29 diskslave slapd[12582]: conn=11 op=0 BIND dn="uid=graylion,ou=users,dc=graylion,dc=net" method=128 Mar 3 16:29:29 diskslave slapd[12582]: bdb_dn2entry("uid=graylion,ou=users,dc=graylion,dc=net") Mar 3 16:29:29 diskslave slapd[12582]: => access_allowed: auth access to "uid=graylion,ou=users,dc=graylion,dc=net" "userPassword" requested Mar 3 16:29:29 diskslave slapd[12582]: => acl_get: [1] attr userPassword Mar 3 16:29:29 diskslave slapd[12582]: => acl_mask: access to entry "uid=graylion,ou=users,dc=graylion,dc=net", attr "userPassword" requested Mar 3 16:29:29 diskslave slapd[12582]: => acl_mask: to all values by "", (=n) Mar 3 16:29:29 diskslave slapd[12582]: <= check a_dn_pat: cn=admin,dc=graylion,dc=net Mar 3 16:29:29 diskslave slapd[12582]: <= check a_dn_pat: anonymous Mar 3 16:29:29 diskslave slapd[12582]: <= acl_mask: [2] applying auth(=x) (stop) Mar 3 16:29:29 diskslave slapd[12582]: <= acl_mask: [2] mask: auth(=x) Mar 3 16:29:29 diskslave slapd[12582]: => access_allowed: auth access granted by auth(=x) Mar 3 16:29:29 diskslave slapd[12582]: conn=11 op=0 BIND dn="uid=graylion,ou=users,dc=graylion,dc=net" mech=SIMPLE ssf=0 Mar 3 16:29:29 diskslave slapd[12582]: do_bind: v3 bind: "uid=graylion,ou=users,dc=graylion,dc=net" to "uid=graylion,ou=users,dc=graylion,dc=net" Mar 3 16:29:29 diskslave slapd[12582]: send_ldap_result: conn=11 op=0 p=3 Mar 3 16:29:29 diskslave slapd[12582]: send_ldap_response: msgid=1 tag=97 err=0 Mar 3 16:29:29 diskslave slapd[12582]: conn=11 op=0 RESULT tag=97 err=0 text= Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on 1 descriptors Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on: Mar 3 16:29:29 diskslave slapd[12582]: 13r Mar 3 16:29:29 diskslave slapd[12582]: Mar 3 16:29:29 diskslave slapd[12582]: daemon: read activity on 13 Mar 3 16:29:29 diskslave slapd[12582]: connection_get(13): got connid=11 Mar 3 16:29:29 diskslave slapd[12582]: connection_read(13): checking for input on id=11 Mar 3 16:29:29 diskslave slapd[12582]: ber_get_next on fd 13 failed errno=11 (Resource temporarily unavailable) Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=6 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=7 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: do_search Mar 3 16:29:29 diskslave slapd[12582]: >>> dnPrettyNormal: <cn=graylion,ou=personal,ou=contacts,dc=graylion,dc=net> Mar 3 16:29:29 diskslave slapd[12582]: <<< dnPrettyNormal: <cn=graylion,ou=personal,ou=contacts,dc=graylion,dc=net>, <cn=graylion,ou=personal,ou=contacts,dc=graylion,dc=net> Mar 3 16:29:29 diskslave slapd[12582]: conn=11 op=1 SRCH base="cn=graylion,ou=personal,ou=contacts,dc=graylion,dc=net" scope=1 deref=0 filter="(&(objectClass=inetOrgPerson))" Mar 3 16:29:29 diskslave slapd[12582]: conn=11 op=1 SRCH attr=uidnumber uid cn givenname sn audio description labeleduri o ou title street l st postalcode telephonenumber homephone facsimiletelephonenumber mobile pager mail roomnumber jpegphoto displayname postaladdress userSMIMECertificate mozillaworkstreet2 c mozillahomestreet mozillahomestreet2 mozillahomelocalityname mozillahomestate mozillahomepostalcode mozillahomecountryname mozillasecondemail mozillahomeurl mozillapostaladdress2 co mozillahomepostaladdress2 birthdate note carphone primaryphone category businessrole assistantphone assistantname fileas homefacsimiletelephonenumber freeBusyuri calendaruri otherphone callbackPhone entryUUID uid uidNumber objectClass createTimestamp modifyTimestamp creatorsName modifiersName Mar 3 16:29:29 diskslave slapd[12582]: ==> limits_get: conn=11 op=1 dn="uid=graylion,ou=users,dc=graylion,dc=net" Mar 3 16:29:29 diskslave slapd[12582]: => bdb_search Mar 3 16:29:29 diskslave slapd[12582]: bdb_dn2entry("cn=graylion,ou=personal,ou=contacts,dc=graylion,dc=net") Mar 3 16:29:29 diskslave slapd[12582]: search_candidates: base="cn=graylion,ou=personal,ou=contacts,dc=graylion,dc=net" (0x00000019) scope=1 Mar 3 16:29:29 diskslave slapd[12582]: => bdb_dn2idl( "cn=graylion,ou=personal,ou=contacts,dc=graylion,dc=net" ) Mar 3 16:29:29 diskslave slapd[12582]: <= bdb_dn2idl: id=1 first=28 last=28 Mar 3 16:29:29 diskslave slapd[12582]: => bdb_equality_candidates (objectClass) Mar 3 16:29:29 diskslave slapd[12582]: => key_read Mar 3 16:29:29 diskslave slapd[12582]: <= bdb_index_read: failed (-30990) Mar 3 16:29:29 diskslave slapd[12582]: <= bdb_equality_candidates: id=0, first=0, last=0 Mar 3 16:29:29 diskslave slapd[12582]: => bdb_equality_candidates (objectClass) Mar 3 16:29:29 diskslave slapd[12582]: => key_read Mar 3 16:29:29 diskslave slapd[12582]: <= bdb_index_read 7 candidates Mar 3 16:29:29 diskslave slapd[12582]: <= bdb_equality_candidates: id=7, first=9, last=28 Mar 3 16:29:29 diskslave slapd[12582]: bdb_search_candidates: id=1 first=28 last=28 Mar 3 16:29:29 diskslave slapd[12582]: entry_decode: "uid=325b9c76485ab753ed53ed9f496793c6,cn=graylion,ou=personal,ou=contacts,dc=graylion,dc=net" Mar 3 16:29:29 diskslave slapd[12582]: <= entry_decode(uid=325b9c76485ab753ed53ed9f496793c6,cn=graylion,ou=personal,ou=contacts,dc=graylion,dc=net) Mar 3 16:29:29 diskslave slapd[12582]: => bdb_dn2id( "uid=325b9c76485ab753ed53ed9f496793c6,cn=graylion,ou=personal,ou=contacts,dc=graylion,dc=net" ) Mar 3 16:29:29 diskslave slapd[12582]: <= bdb_dn2id: got id=0x0000001c Mar 3 16:29:29 diskslave slapd[12582]: => access_allowed: search access to "uid=325b9c76485ab753ed53ed9f496793c6,cn=graylion,ou=personal,ou=contacts,dc=graylion,dc=net" "objectClass" requested Mar 3 16:29:29 diskslave slapd[12582]: => dn: [2] Mar 3 16:29:29 diskslave slapd[12582]: => acl_get: [3] attr objectClass Mar 3 16:29:29 diskslave slapd[12582]: => acl_mask: access to entry "uid=325b9c76485ab753ed53ed9f496793c6,cn=graylion,ou=personal,ou=contacts,dc=graylion,dc=net", attr "objectClass" requested Mar 3 16:29:29 diskslave slapd[12582]: => acl_mask: to value by "uid=graylion,ou=users,dc=graylion,dc=net", (=n) Mar 3 16:29:29 diskslave slapd[12582]: <= check a_dn_pat: cn=admin,dc=graylion,dc=net Mar 3 16:29:29 diskslave slapd[12582]: <= acl_mask: no more <who> clauses, returning =n (stop) Mar 3 16:29:29 diskslave slapd[12582]: => access_allowed: search access denied by =n Mar 3 16:29:29 diskslave slapd[12582]: bdb_search: 28 does not match filter Mar 3 16:29:29 diskslave slapd[12582]: send_ldap_result: conn=11 op=1 p=3 Mar 3 16:29:29 diskslave slapd[12582]: send_ldap_response: msgid=2 tag=101 err=0 Mar 3 16:29:29 diskslave slapd[12582]: conn=11 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on 1 descriptors Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on: Mar 3 16:29:29 diskslave slapd[12582]: 13r Mar 3 16:29:29 diskslave slapd[12582]: Mar 3 16:29:29 diskslave slapd[12582]: daemon: read activity on 13 Mar 3 16:29:29 diskslave slapd[12582]: connection_get(13): got connid=11 Mar 3 16:29:29 diskslave slapd[12582]: connection_read(13): checking for input on id=11 Mar 3 16:29:29 diskslave slapd[12582]: ber_get_next on fd 13 failed errno=11 (Resource temporarily unavailable) Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=6 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=7 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: do_unbind Mar 3 16:29:29 diskslave slapd[12582]: conn=11 op=2 UNBIND Mar 3 16:29:29 diskslave slapd[12582]: connection_closing: readying conn=11 sd=13 for close Mar 3 16:29:29 diskslave slapd[12582]: connection_resched: attempting closing conn=11 sd=13 Mar 3 16:29:29 diskslave slapd[12582]: connection_close: conn=11 sd=13 Mar 3 16:29:29 diskslave slapd[12582]: daemon: removing 13 Mar 3 16:29:29 diskslave slapd[12582]: conn=11 fd=13 closed Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on 1 descriptors Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=6 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: daemon: select: listen=7 active_threads=0 tvp=NULL Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on 1 descriptors Mar 3 16:29:29 diskslave slapd[12582]: daemon: activity on: Mar 3 16:29:29 diskslave slapd[12582]: 10r Mar 3 16:29:29 diskslave slapd[12582]: Mar 3 16:29:29 diskslave slapd[12582]: daemon: read activity on 10 Mar 3 16:29:29 diskslave slapd[12582]: connection_get(10): got connid=9 Mar 3 16:29:29 diskslave slapd[12582]: connection_read(10): checking for input on id=9 Mar 3 16:29:29 diskslave slapd[12582]: ber_get_next on fd 10 failed errno=11 (Resource temporarily unavailable) so this looks like the cinch to me: Mar 3 16:29:29 diskslave slapd[12582]: bdb_search: 28 does not match filter any idea what is wrong? thanks Bernhard -- Graylion's Fetish & Fashion Store Goth and Kinky Boots, Clothing and Jewellery http://www.graylion.net

1 0

ldbm bdb Conversion
by Net Warrior 01 Mar '07

01 Mar '07

Hi there guys. I was just wondering if there is a tool to convert an ldbm database to the new bdb backend. Thanks in advance.

3 4

"error in SSLv3 flush data" when connecting from network
by Antonis Christofides 01 Mar '07

01 Mar '07

Hi, Summary: A tls connection between a client and a 2.3.30 slapd hangs while the server is giving the certificate; but this does not happen if the server is run with -d 2 or higher, or if the client is the server itself. Details: (A seemingly similar issue has been reported before, without satisfactory reply, 4 years ago: http://www.openldap.org/lists/openldap-software/200210/msg00459.html) My slapd is the Debian-etch-packaged 2.3.30. If I run a ldapsearch -ZZ on the server, it runs fine. If I try to run the same thing from a client through the network, then the connection hangs (I tried this from three clients). After I hit Enter, the client stays there and it appears to wait forever until interrupted. If I use -d 1 on both the client and the server, then the client hangs after it has displayed TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 0, subject: /C=GR/L=Athens/O=National Technical University of Athens/OU=ITIA Research Team/CN=www.itia.ntua.gr/emailAddress=sysadmins(a)itia.ntua.gr, issuer: /C=GR/L=Athens/O=National Technical University of Athens/OU=ITIA Research Team/CN=www.itia.ntua.gr/emailAddress=sysadmins(a)itia.ntua.gr TLS trace: SSL_connect:SSLv3 read server certificate A and the server has displayed TLS trace: SSL_accept:before/accept initialization TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write certificate request A TLS trace: SSL_accept:error in SSLv3 flush data TLS trace: SSL_accept:error in SSLv3 flush data But if I use -d 2 or higher on the server, then the connection succeeds. (Increasing -d on the client does not appear to affect it.) Could you suggest how to search into it next? Because I'm lost. I thought it might have to do with networking hardware, but ping -f from one client to the server runs fine, with no packet loss, and nfs (which I've noticed to be most sensitive to networking hardware issues) also runs fine. The three clients where through Gigabit, 100 MBits, and 10 MBits. Two of them were running ubuntu-edgy-packaged ldap-utils 2.2.26, one was running debian-etch-packaged 2.3.30. All had identical behaviour.

2 5

ldapsearch across back-sql and non-back-sql tree
by Robert Brooks 01 Mar '07

01 Mar '07

I have a back-sql portion of my ldap tree, I can search within the back-sql part of the tree (and within the ldbm), but searches do not cross from the ldbm tree into the back-sql part of the tree. Should I make a referal in the ldbm tree at the point the back-sql tree is mounted, or is there a better way to do this? Regarrds, Rob

5 5

LDAP 'virtual' operations
by Mark Mcdonald 01 Mar '07

01 Mar '07

Is there a way to perform a change operation in OpenLDAP that does not commit the final data? Essentially I want to do a dry insert, where I can find out if the data to insert conforms to the defined schema without actually writing to the DB. Technically I know it can be done by other mechanisms but this is more of an academic question I guess. Thanks, Mark Mark McDonald iiNet Limited

3 2

reg OpenLdap installation
by shilpa muramkar 01 Mar '07

01 Mar '07

I have installed openldap on my machine. In the slapd.conf file i have included all the schema files. I need to import our directory server data into OpenLdap now. Hence i have done the below things.... 1) Created a schema file containing our data and included it in the slapd.conf. 2) Created an ldif file, and tried importing our data using "ldapmodify" command. I am facing few problems. Looks like my schema file isnt being referred by openldap as....even when i comment my schema file and run, the service is starting. That shows my schema file isnt creating any impact there. What i did is,,,,,i took some of our required ObjectClasses and included them in the "misc.schema" file of OpenLdap just for a trial. Few of them worked properly and my data from ldif got added into the server. I still have few attributes and ObjectClasses which i am neither able to add into any of OpenLdap's schema files nor create a new schema file and add( as OpenLdap isnt referring to it). Can someone guide me as to how to easily get my schema and data added to the server. If i have to create a schema file of my own.....in that case..how do i make the server refer to that as well........... Eagerly awaiting the reply....... Thanks Shilpa

3 2

Beginners question
by Jan Mostert 01 Mar '07

01 Mar '07

5 4

Re: LDAP/BDB log purging
by Tony Earnshaw 28 Feb '07

28 Feb '07

Norman Gaywood wrote, on 28. feb 2007 23:41: > On Wed, Feb 28, 2007 at 04:44:20AM +0100, Tony Earnshaw wrote: >> FWIW the Red Hat RHAS4 db-4.2.52 installed as-is causes OpenLDAP to >> puke; I built and install my own rpms, patched to the hilt, and install > > I what way does this break on RHAS4? For my installs OL 2.3 complains about the environment; I'm not sure which - could be TXN - it's been such a long time ... > I'm currently testing a self compiled 2.3.34 openldap with the default > RH db4-4.2.52-7.1. Indeed, if one asks up2date to --get db4, this is the version you get. I should first try Buchan Milne's srpm if I were installing on RHAS/RHEL4 (which I in fact do). > The changelog for db4-4.2.52-7.1 includes changes that seem to have been > talked about in this thread: > > * Tue Jun 08 2004 Jeff Johnson <jbj(a)jbj.org> 4.2.52-4 > - remove dangling symlinks (#123721 et al). > - remove db_cxx.so and db_tcl.so symlinks, versioned equivs exist. > - apply 2 patches from sleepycat. A couple of or 4 symlinks (not these) were wrong in Red Hat's rpm and I fixed those in my rpm. It didn't cause any harm in practice, but ldconfig complained each time it was run. As for the patches, there could have been 2 in 2004, then there were later 4 and I think the latter have since been condensed into a single patch, which I apply. I also apply Quanah's bdb-transactions.patch, which is most likely redundant now. Buchan applies 4 Sleepycat patches to his OL 2.3 rpms. It's not possible to go to Sleepycat's site and find out any longer, since Oracle's taken the thing over and messed everything up. I can't get at 4.2.52 any more. > - resurrect db4-java using sun jvm-1.4.2. > - cripple autoconf sufficiently to build db4-java with gcj, without jvm. > - check javac first, gcj34 next, then gcj-ssa, finally gcj. > - add ed build dependency (#125180). > >> them with my own Cyrus SASL 2.2.22 rpms on any RHAS4 system I install. >> Buchan also builds his own discrete-sonamed db-4.2.52 stuff for his >> OpenLDAP 2.3 on systems where db-4.2.52 might give problems. As for the Cyrus SASL stuff, I need it built with Howard's ldapdb and the standard build doesn't do that, one has to tell it to. --Tonni -- Tony Earnshaw Email: tonni at hetnet dot nl

3 2

RE: LDAP/BDB log purging
by Lesley Walker 28 Feb '07

28 Feb '07

Buchan Milne [mailto:bgmilne@obsidian.co.za] > > > > Well, I just ran db_archive and caused widespread chaos > because most (all?) > > of the replicas stopped responding to queries. (I have yet > to perform a > > post-mortem) > > You ran db_archive for the first time, on *all* replicas at > the same time???? Yes. We administer 80+ servers that are more or less identically configured, and typically perform small admin tasks in "for" loop, which is what I did in this case. > > I know that there's a bug in bdb 4.2 that causes logs to be > held open even > > though they're no longer required. Upgrading bdb is not on > the cards right > > now so I need to work around that problem by stopping and starting > > openldap. > > This may or may not be the cause of your problems. > Additionally, this is > affected by your database configuration and checkpointing settings. Copied below... > > So the question I have just at the moment is, when I run > db_archive, should > > openldap be running or not running? > > It should be safe, depending on your configuration, to run > db_archive. > However, due to the tasks it does (just deleting all the > unused log files > would have a similar effect), it can be quite IO intensive, > and you may incur > IO starvation when doing it, impacting performance of any > other application > using files on the same block devices (e.g. slapd). As an additional piece of background, we are currently running all the replication out of an intermediate server (it's a transistional setup). As far as I can tell, it all hit the fan when the db_archive ran on that intermediate server. Obviously I should have left that one out of the list but I didn't think of it at the time. These are all the non-comment entries in DB_CONFIG: set_cachesize 0 268435456 1 set_data_dir db set_lg_regionmax 262144 set_lg_bsize 2097152 set_lg_dir logs set_tmp_dir /tmp Database definition entries in slapd.conf: database bdb suffix "dc=example,dc=com" rootdn "cn=root,dc=example,dc=com" rootpw secret directory /var/local/openldap-2.3.32/openldap-data mode 0600 sizelimit 12000 Replication entries on most servers: syncrepl rid=123 provider=ldap://server.example.com type=refreshAndPersist searchbase="dc=example,dc=com" scope=sub schemachecking=off bindmethod=simple binddn="cn=root,dc=example,dc=com" credentials=secret retry=5,5,30,5,60,5,300,+ And replication entries on the intermediate host: syncrepl rid=123 provider=ldap://master.example.com type=refreshAndPersist interval=00:00:01:00 searchbase="dc=example,dc=com" scope=sub schemachecking=off bindmethod=simple binddn="cn=root,dc=example,dc=com" credentials=secret retry=5,5,30,5,60,5,300,+ overlay syncprov syncprov-checkpoint 10 5 syncprov-sessionlog 100 -- Lesley Walker Linux Systems Administrator Opus International Consultants Ltd Email lesley.walker(a)opus.co.nz Tel +64 4 471 7002, Fax +64 4 473 3017 http://www.opus.co.nz Level 9 Majestic Centre, 100 Willis Street, PO Box 12 343 Wellington, New Zealand

2 2

Get Effective Rights
by Ed Frey 28 Feb '07

28 Feb '07

Has openLDAP implemented the Get Effective Rights control extension? I tried using "2.16.840.1.113719.1.27.100.33" (getEffectivePrivilegesRequest); however, got a "not implemented" result. I searched around google and the list archives and saw some references to it, but never a reference to whether it was implemented or not. I'm trying to move an application that was running against novell's eDirectory to openLDAP and it makes heavy use of this control. That OID may be novell specific, but i didn't see anything in ldap.h with that name either. Any insight would be appreciated Thank you -Ed

2 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software