openldap-software

openldap-software@openldap.org

2719 discussions

slurpd: skip repl record for
by Jeremy M. Guthrie 12 Jan '07

12 Jan '07

I am running into an issue trying to do LDAP replication. I am trying to get slurp to replicate data but it keeps complaining that none of the data is 'mine'. I also never see slurpd make a TCP connection to the 192.168.247.130 peer. slapd.conf include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/rfc2307bis.schema include /etc/openldap/schema/yast.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/openldap/modules access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to attrs=userPassword,userPKCS12 by self write by * auth access to attrs=shadowLastChange by self write by * read access to * by * read loglevel 0 replogfile /var/lib/ldap/replog/ldap.binc-groups.replog TLSCertificateFile /etc/openldap/servercert.pem TLSCertificateKeyFile /etc/openldap/serverkey.pem database bdb suffix "dc=remote,dc=binc,dc=net" rootdn "XXXXXXXXXXXXXXXXXXXXXXXX" rootpw XXXXXXXXXXXXX directory /var/lib/ldap/dc=remote_dc=binc_dc=net checkpoint 1024 5 cachesize 10000 index objectClass,uidNumber,gidNumber eq index member,mail eq,pres index cn,displayname,uid,sn,givenname sub,eq,pres replica host=192.168.247.130 binddn="XXXXXXXXXXXXXXXXXXXXXXXXXXXXX" bindmethod=simple credentials=XXXXXXXXXXXXX Slurpd Logs: Replica 192.168.247.130:389, skip repl record for uid=tester,ou=people,dc=remote,dc=binc,dc=net (not mine) Replica 192.168.247.130:389, skip repl record for cn=testing,ou=group,dc=remote,dc=binc,dc=net (not mine) Replica 192.168.247.130:389, skip repl record for cn=groupconfiguration,ou=ldapconfig,dc=remote,dc=binc,dc=net (not mine) Replica 192.168.247.130:389, skip repl record for uid=jguthries,ou=binc,ou=people,dc=remote,dc=binc,dc=net (not mine) Replica 192.168.247.130:389, skip repl record for uid=test22,ou=binc,ou=people,dc=remote,dc=binc,dc=net (not mine) Replica 192.168.247.130:389, skip repl record for uid=howdy,ou=binc,ou=people,dc=remote,dc=binc,dc=net (not mine) Replica 192.168.247.130:389, skip repl record for uid=sasser,ou=binc,ou=people,dc=remote,dc=binc,dc=net (not mine) -- -------------------------------------------------- Jeremy M. Guthrie jeremy.guthrie(a)berbee.com Senior Network Engineer Phone: 608-298-1061 Berbee - A CDW Company Fax: 608-288-3007 5520 Research Park Drive NOC: 608-298-1102 Madison, WI 53711

3 8

Is it possible to only log failed binds ?
by Andreas Taschner 12 Jan '07

12 Jan '07

We have a setup with a very high number of binds, so running with loglevel 256 floods the log file. According to http://www.openldap.org/lists/openldap-software/200205/msg00120.html John Dalbec wrote a patch for this for 2.0.21, but AFAICS it was ever submitted. I would like to have eg. loglevel 64 to see the configuration file processing and then on top of that only failed logins. Is the only way to accomplish that to rewrite that old patch to the current level, or is there some other way to get there ? Thanks Andreas Taschner

4 4

RE: Invalid DN
by Ian Moroney 12 Jan '07

12 Jan '07

But what about the fact that I can't login to openldap with anything other than anyonymous? :( Thanks and Kind Regards, Ian Moroney Field Engineer T: 020 8891 3010 M: 07791 965924 F: 020 8288 2591 www.techdivision.co.uk TechDivision - Making IT Work -----Original Message----- From: Pierangelo Masarati [mailto:ando@sys-net.it] Sent: 11 January 2007 22:30 To: Ian Moroney Cc: openldap-software(a)openldap.org Subject: Re: Invalid DN Ian Moroney wrote: > 0000: 60 14 02 01 03 04 07 4d 61 6e 61 67 65 72 80 06 > `......Manager.. > 0010: 72 62 68 34 31 39 passwd > ber_scanf fmt (m}) ber: > ber_dump: buf=0x0825d1a8 ptr=0x0825d1b9 end=0x0825d1c1 len=8 > 0000: 00 06 72 62 68 34 31 39 ..passwd > >>> dnPrettyNormal: <Manager> > => ldap_bv2dn(Manager,0) > ldap_err2string > <= ldap_bv2dn(Manager)=-4 Decoding error > bind: invalid dn (Manager) > send_ldap_result: conn=4 op=0 p=3 > send_ldap_result: err=34 matched="" text="invalid DN" > send_ldap_response: msgid=1 tag=97 err=34 > ber_flush: 24 bytes to sd 13 > 0000: 30 16 02 01 01 61 11 0a 01 22 04 00 04 0a 69 6e > 0....a..."....in > 0010: 76 61 6c 69 64 20 44 4e valid DN > ldap_write: want=24, written=24 > 0000: 30 16 02 01 01 61 11 0a 01 22 04 00 04 0a 69 6e > 0....a..."....in > 0010: 76 61 6c 69 64 20 44 4e valid DN > conn=4 op=0 RESULT tag=97 err=34 text=invalid DN Can someone shed some > light on this? The string "Manager" does not comply with DN syntax. Slapd is working as expected. Your client is broken or misused. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.n.c. Via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ------------------------------------------ Office: +39.02.23998309 Mobile: +39.333.4963172 Email: pierangelo.masarati(a)sys-net.it ------------------------------------------

2 1

Invalid DN
by Ian Moroney 11 Jan '07

11 Jan '07

well finally after lots of troubleshooting, i now have openldap up and running and i can add ldif's using slapadd etc. I've added the Manager ldif with the following info in the ldif: dn: cn=Manager,dc=global-drum,dc=com objectclass: organizationalRole cn: Manager cn: manager cn: admin description: Directory Manager slappadd comes back with: added: "cn=Manager,dc=global-drum,dc=com" (000000002) The only problem that i now have, is that when i use a windows ldap client, i can log into the ldap server anonymously, and view things (not add) and when i try to login with Manager, it says: Invalid DN syntax Since i am running slapd with -d -1, i can see the results of the connection attempt. ldap_read: want=8, got=8 0000: 30 19 02 01 01 60 14 02 0....`.. ldap_read: want=19, got=19 0000: 01 03 04 07 4d 61 6e 61 67 65 72 80 06 72 62 68 ....Manager..pas 0010: 34 31 39 swd ber_get_next: tag 0x30 len 25 contents: ber_dump: buf=0x0825d1a8 ptr=0x0825d1a8 end=0x0825d1c1 len=25 0000: 02 01 01 60 14 02 01 03 04 07 4d 61 6e 61 67 65 ...`......Manage 0010: 72 80 06 72 62 68 34 31 39 r..passwd ber_get_next ldap_read: want=8 error=Resource temporarily unavailable ber_get_next on fd 13 failed errno=11 (Resource temporarily unavailable) daemon: select: listen=7 active_threads=0 tvp=zero daemon: select: listen=8 active_threads=0 tvp=zero do_bind ber_scanf fmt ({imt) ber: ber_dump: buf=0x0825d1a8 ptr=0x0825d1ab end=0x0825d1c1 len=22 0000: 60 14 02 01 03 04 07 4d 61 6e 61 67 65 72 80 06 `......Manager.. 0010: 72 62 68 34 31 39 passwd ber_scanf fmt (m}) ber: ber_dump: buf=0x0825d1a8 ptr=0x0825d1b9 end=0x0825d1c1 len=8 0000: 00 06 72 62 68 34 31 39 ..passwd >>> dnPrettyNormal: <Manager> => ldap_bv2dn(Manager,0) ldap_err2string <= ldap_bv2dn(Manager)=-4 Decoding error bind: invalid dn (Manager) send_ldap_result: conn=4 op=0 p=3 send_ldap_result: err=34 matched="" text="invalid DN" send_ldap_response: msgid=1 tag=97 err=34 ber_flush: 24 bytes to sd 13 0000: 30 16 02 01 01 61 11 0a 01 22 04 00 04 0a 69 6e 0....a..."....in 0010: 76 61 6c 69 64 20 44 4e valid DN ldap_write: want=24, written=24 0000: 30 16 02 01 01 61 11 0a 01 22 04 00 04 0a 69 6e 0....a..."....in 0010: 76 61 6c 69 64 20 44 4e valid DN conn=4 op=0 RESULT tag=97 err=34 text=invalid DN Can someone shed some light on this? Thanks and Kind Regards, Ian Moroney Field Engineer T: 020 8891 3010 M: 07791 965924 F: 020 8288 2591 www.techdivision.co.uk <http://www.techdivision.co.uk/> TechDivision - Making IT Work

3 2

Disable SASL?
by Forrest Aldrich 11 Jan '07

11 Jan '07

The RPM that comes with Fedora appears to enable SASL. I don't want it. So, I defined this in ldap.conf: SASL_SECPROPS maxssf=0 .. per documentation I found on the net. This doesn't appear to work. How can I disable this, or must I go in and hacky/rebuild the RPM myself. Thanks.

2 1

configure with back-sql on mingw/msys fails.
by Zhang William 10 Jan '07

10 Jan '07

hi,all I want to build openldap on mingw and msys with back-sql, but the configure fails with following error message: *checking sql.h usability... no checking sql.h presence... yes configure: WARNING: sql.h: present but cannot be compiled configure: WARNING: sql.h: check for missing prerequisite headers? configure: WARNING: sql.h: see the Autoconf documentation configure: WARNING: sql.h: section "Present But Cannot Be Compiled" configure: WARNING: sql.h: proceeding with the preprocessor's result configure: WARNING: sql.h: in the future, the compiler will take precedence configure: WARNING: ## --------------------------------------------- ## configure: WARNING: ## Report this to <**http://www.openldap.org/its/*<http://www.openldap.org/its/> *> ## configure: WARNING: ## --------------------------------------------- ## checking for sql.h... yes checking sqlext.h usability... no checking sqlext.h presence... yes configure: WARNING: sqlext.h: present but cannot be compiled configure: WARNING: sqlext.h: check for missing prerequisite headers? configure: WARNING: sqlext.h: see the Autoconf documentation configure: WARNING: sqlext.h: section "Present But Cannot Be Compiled" configure: WARNING: sqlext.h: proceeding with the preprocessor's result configure: WARNING: sqlext.h: in the future, the compiler will take precedence configure: WARNING: ## --------------------------------------------- ## configure: WARNING: ## Report this to <**http://www.openldap.org/its/*<http://www.openldap.org/its/> *> ## configure: WARNING: ## --------------------------------------------- ## checking for sqlext.h... yes checking for SQLDriverConnect in -liodbc... no checking for SQLDriverConnect in -lodbc... no configure: error: could not locate suitable ODBC library* in mingw/lib there is libodbc32.a, I copied and renamed it as libodbc.a and checked it has 'SQLDriverConnect' function: *$ nm libodbc32.a | grep SQLDriverConnect 00000000 I **__imp__SQLDriverConnectW@32* <__imp__SQLDriverConnectW@32> *00000000 T **_SQLDriverConnectW@32* <_SQLDriverConnectW@32> *00000000 I **__imp__SQLDriverConnectA@32* <__imp__SQLDriverConnectA@32> *00000000 T **_SQLDriverConnectA@32* <_SQLDriverConnectA@32> *00000000 I **__imp__SQLDriverConnect@32* <__imp__SQLDriverConnect@32> *00000000 T **_SQLDriverConnect@32* <_SQLDriverConnect@32> but configure still fails with above errors. could anyone help me ? any commets are appreciated. -- Regards. William

2 3

replication: sharing entries via distribution site - syncrepl vs. replica (slurpd)
by MERIGHI Marcus 10 Jan '07

10 Jan '07

1 0

ldap_add: No such object (32)
by Steve Olisar 09 Jan '07

09 Jan '07

Hello all, I am getting this very annoying error when ever I try to add to lapd. I had the server running, and accepting connections, I was also able to add users...etc. My setup is simple, I am using LDAP to authenticate users for Horde. I made a mistake in the Horde config, and had to use ldapmodify to correct the issue. After some tinkering I made the mistake again, and had to run ldapmodify again. The next time I tried to add something I get ldap_add: No such object (32). I looked over my config and ldif files about 60 times, and even re-installed openldap. I have been searching Google all day for answers to this problem, but nothing has worked. I am using Freebsd 6.1, with OpenLdap 2.3 Here is my slapd.conf file... # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/corba.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/dyngroup.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/java.schema include /usr/local/etc/openldap/schema/misc.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/openldap.schema include /usr/local/etc/openldap/schema/ppolicy.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: modulepath /usr/local/libexec/openldap moduleload back_bdb # moduleload back_ldap # moduleload back_ldbm # moduleload back_passwd # moduleload back_shell # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=nerdbot,dc=net" rootdn "cn=root,dc=nerdbot,dc=net" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw {SSHA}NdX6sbPuOHZl4xuzStv5DnyI1pcfIWYM # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/db/openldap-data # Indices to maintain index objectClass eq and my ldif... dn: ou=DSA,dc=nerdbot,dc=net objectclass: organizationalUnit ou: DSA dn: cn=horde,ou=DSA,dc=nerdbot,dc=net objectclass: organizationalRole objectClass: top objectClass: simpleSecurityObject userPassword: supersecretpassword cn: horde dn: ou=horde,dc=nerdbot,dc=net objectclass: organizationalUnit ou: horde dn: ou=users,ou=horde,dc=nerdbot,dc=net objectclass: organizationalUnit ou: users dn: uid=administrator,ou=users,ou=horde,dc=nerdbot,dc=net objectclass: shadowaccount objectclass: inetorgperson uid: administrator cn: Administrator sn: Administrator userpassword: supersecretpassword dn: ou=groups,ou=horde,dc=nerdbot,dc=net objectclass: organizationalUnit ou: groups and the command I used to add it... ldapadd -x -h localhost -D "cn=root,dc=nerdbot,dc=net" -f horde.ldif -W I have tried many different combinations, adding the includes (as you can see in the .conf) and trying different things with ldif, but nothing will work. However, it worked earlier! I do not understand what might be the problem. Here is what the log file says... Jan 9 18:47:53 shadowfax slapd[99163]: conn=3 fd=11 ACCEPT from IP=::1 50584 (IP=:: 389) Jan 9 18:47:53 shadowfax slapd[99163]: conn=3 op=0 BIND dn="cn=root,dc=nerdbot,dc=net" method=128 Jan 9 18:47:53 shadowfax slapd[99163]: conn=3 op=0 BIND dn="cn=root,dc=nerdbot,dc=net" mech=SIMPLE ssf=0 Jan 9 18:47:53 shadowfax slapd[99163]: conn=3 op=0 RESULT tag=97 err=0 text= Jan 9 18:47:53 shadowfax slapd[99163]: conn=3 op=1 ADD dn="ou=DSA,dc=nerdbot,dc=net" Jan 9 18:47:53 shadowfax slapd[99163]: is_entry_objectclass("", " 2.16.840.1.113730.3.2.6") no objectClass attribute Jan 9 18:47:53 shadowfax slapd[99163]: conn=3 op=1 RESULT tag=105 err=32 text= Jan 9 18:47:53 shadowfax slapd[99163]: conn=3 op=2 UNBIND Jan 9 18:47:53 shadowfax slapd[99163]: conn=3 fd=11 closed () and here is what the terminal says... Enter LDAP Password: adding new entry "ou=DSA,dc=nerdbot,dc=net" ldap_add: No such object (32) Does anyone know what is going on? Thanks in advance. -steve

2 1

server crashes
by shashank agrawal 09 Jan '07

09 Jan '07

hello, i have openldap running on fedora core 5. however the openldap process keep crashing in every few days. how can i find what the problem is and troubleshoot the issue. regards, shashank

3 2

Slurpd log file rotation
by Srilakshmanan, Kumuthiny 09 Jan '07

09 Jan '07

Hi, My slurpd log file has grown large. Could you please suggest a way to rotate the slurp.log file without stop/starting slurd process? Any help/suggestions is greatly appreciated . Platform :UNIX Openldap version :2.2. Regards, Kumuthiny Australia Post is committed to providing our customers with excellent service. If we can assist you in any way please telephone 13 13 18 or visit our website. The information contained in this e-mail communication may be proprietary, confidential or legally professionally privileged. It is intended exclusively for the individual or entity to which it is addressed. You should only read, disclose, re-transmit, copy, distribute, act in reliance on or commercialise the information if you are authorised to do so. Australia Post does not represent, warrant or guarantee the integrity of this e-mail communication has been maintained nor that the communication is free of errors, virus or interference. If you are not the addressee or intended recipient please notify us by replying direct to the sender and then destroy any electronic or paper copy of this message. Any views expressed in this e-mail communication are taken to be those of the individual sender, except where the sender specifically attributes those views to Australia Post and is authorised to do so.

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software