openldap-software

openldap-software@openldap.org

2719 discussions

Slapd fails to terminate
by Lesley Walker 28 Dec '06

28 Dec '06

Running 2.3.31, I'm seeing the behaviour described in ITS4790, in which Pierangelo Masarati wrote: >> Apparently, one thread is unable to terminate correctly... >> but then slapd hangs forever in ldap_pvt_thread_pool_destroy(). and Howard responded: > This is a bad patch to connections_shutdown in RE23, there is a > "continue" after checking for a client session that shouldn't be > there. This line is not present in HEAD and the bug doesn't exist > in HEAD. Strange that it got there since we just recently sync'd > RE23 with HEAD's connection.c. Ok, so the problem line is in connection.c, right? I know just about enough C to be able to comment out the line. How do I identify it? I need to fix this pronto, as I have already rolled out the bad code to about half of our ~80 replicas. Cheers, Lesley W (I can just hear "I told you so..." coming from my employer when he hears about this) -- Lesley Walker Linux Systems Administrator Opus International Consultants Ltd Email lesley.walker(a)opus.co.nz Tel +64 4 471 7002, Fax +64 4 473 3017 http://www.opus.co.nz Level 9 Majestic Centre, 100 Willis Street, PO Box 12 343 Wellington, New Zealand

1 0

custome schema does not work
by Sadique Puthen 26 Dec '06

26 Dec '06

Hi, I have a new schema file with the below entries, [root@host128 schema]# cat local.schema attributeType: ( 2.16.840.1.113730.3.1.241 NAME 'passworduser' DESC 'Custome Testing' SYNTAX 1.3.6.1.4.1.146.6.115.121.1.40 SINGLE-VALUE X-ORIGIN 'user defined' ) objectClass: ( 2.16.840.1.113730.3.2.2 NAME 'custome' SUP top STRUCTURAL MUST passworduser) Added in slapd.conf and restarted. trying to add below ldif file. dn: uid=guest20,ou=People,dc=example,dc=com uid: guest20 cn: guest20 objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount objectClass: passworduser passworduser: {crypt}$1$gFu78wyt$F1VXME32hviAXfrHDuObi/ shadowLastChange: 13473 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 600 gidNumber: 600 homeDirectory: /home2/guest20 dn: cn=guest20,ou=Group,dc=example,dc=com objectClass: posixGroup objectClass: top cn: guest20 userPassword: {crypt}x gidNumber: 600 Throws the below error message. [root@host128 schema]# ldapadd -f /root/ldif1 SASL/GSSAPI authentication started SASL username: guest2(a)TEST.EXAMPLE.COM SASL SSF: 56 SASL installing layers adding new entry "uid=guest20,ou=People,dc=example,dc=com" ldap_add: Invalid syntax (21) additional info: objectClass: value #4 invalid per syntax If anyone can pinpoint what is wrong, I would appreciate. Regards, Sadique

2 2

small problem with ldap with tls and sasl
by Rafal (sxat) 26 Dec '06

26 Dec '06

Hello how configure slapd.conf but i try setting SASL authentication on running slapd but ldap alway is crash "slapd in free(): error: junk pointer, too high to make sense" or crash on this line in source code file: saslauthz.c: Debug(LDAP_DEBUG_TRACE,'==>slap_sasl_authorized can %s become %s') I am running ./slapd -d -1 on first console on other console I running ldapsearch -I SASL/CRAM-MD5 authentication started SASL Interaction Please enter your authentication name: test Please enter your password: **** <enter> ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) and ldapd on first console: >>> dnNormalize: <uid=test,dc=example,dc=com> => ldap_bv2dn(uid=test,dc=example,dc=com,0) <= ldap_bv2dn(uid=test,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=test,dc=example,dc=com)=0 <<< dnNormalize: <uid=test,dc=example,dc=com> <==slap_sasl2dn: Converted SASL name to uid=test,dc=example,dc=com slap_sasl_getdn: dn:id converted to uid=test,dc=example,dc=com SASL Canonicalize [conn=0]: slapAuthcDN="uid=test,dc=example,dc=com" SASL proxy authorize [conn=0]: authcid="test" authzid="test" <== slap_sasl_authorized: return 48 SASL proxy authorize after_5a [conn=0]: SASL Proxy Authorize [conn=0]: proxy authorization disallowed (48) SASL [conn=0] Failure: not authorized slapd in free(): error: junk pointer, too high to make sense my installed version is: OpenLDAP: slapd 2.3.31 - SASL cyrus-sasl-2.1.21 <- this library is ok - i have running postfix with sasl - unixODBC-2.2.11 - MyODBC-3.51.11 - FreeBSD 5.X openldap normal working without tls and auth sasl but if I activate sasl and write bad password when I logged to ldap is ok, all crash is alway when I write correct user and password when i login please help me..... ------------------ my slapd.conf: include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel -1 #allow bind_anon_cred #defaultaccess none #readonly off TLSCertificateFile /tmp/ldap.crt TLSCertificateKeyFile /tmp/ldap.key TLSCACertificateFile /tmp/ca.crt TLSCipherSuit HIGH authzTo: uid=[^,]*,dc=example,dc=com authz-regexp uid=([^,]*),cn=[^,]*,cn=auth uid=$1,dc=example,dc=com ####################################################################### # sql database definitions ####################################################################### database sql suffix "dc=example,dc=com" rootdn "cn=test,dc=example,dc=com" #rootpw secret dbname ldap dbuser ldap dbpasswd ldap subtree_cond "ldap_entries.dn LIKE CONCAT('%',?)" insentry_stmt "INSERT INTO ldap_entries (dn,oc_map_id,parent,keyval) VALUES (?,?,?,?)" has_ldapinfo_dn_ru no access to attrs=userPassword by * auth

1 0

slapd: The reverse of "authz-regexp": From Bind-DN to SASL authentication: Is it possible?
by Alexandros Vellis 24 Dec '06

24 Dec '06

The slapd.conf option "authz-regexp", according to man page is...: Used by the authentication framework to convert simple user names, such as provided by SASL subsystem, to an LDAP DN used for authorization purposes. I am searching how to do the exact reverse thing, and I haven't found an option for it. Specifically, I would like to convert the LDAP dn provided in a simple LDAP bind, to an authentication token (userid, realm, password) that would be passed to the SASL subsystem for the purposes of authentication. The SASL subsystem would then be responsible to do the authentication, just as if SASL authentication ('-Y') were used. Am I correct in assuming that this functionality currently does not exist? Alexandros Vellis

3 2

Disaster recovery question wrt replication
by Steven Harms (stharms) 22 Dec '06

22 Dec '06

Hi all, New LDAP implementor here. I'm trying to document disaster recovery steps. Assuming a single master and 3 replicas. [Q1]: Is this an acceptable architecture? In the master's slapd.conf I define 3 replica statements, and on the 3 replica servers I use this master as the updateref. If all the replicas fail and the master survives, I'm trying to figure out how to restore service. 1. Establish replacement replicas 2. (master) slapcat -l /resync.ldif. Copy to each replica. 3. (each replica) slapadd -l /resync.ldif Now here's the sticky part. The slurpd.replog has entries that were destined for the replicas. Now that I've sync'd via slapadd, these are not necessary. How can I clean out the replog back-queue to a pristine start? I suppose, more generally, I'm asking: How do a start replication all over. What files can / should I delete. Which should I not under any circumstance touch? Steven

9 11

Problem when using 'accesslog' and 'refint' overlays in combination
by Alina Dubrovska 22 Dec '06

22 Dec '06

Hi, I'm trying to configure access logging in my OpenLDAP server (version is 2.3.27) using slapo-accesslog overlay. In slapd.conf I have configured accesslog database according to manual: database bdb suffix "cn=accesslog" rootdn "cn=root,cn=accesslog" rootpw accesslog index reqStart eq database bdb suffix "dc=main_domain,dc=com" checkpoint 1024 5 cachesize 10000 rootdn "cn=Administrator,dc=main_domain,dc=com" overlay accesslog logdb "cn=accesslog" logops writes logold (objectclass=person) In previous version of slapd.conf there was also slapo-refint overlay enabled to support 'uniqueMember' attribute update after member entry is renamed or deleted: overlay refint refint_attributes uniqueMember After turning on access logging I inspect the following problem: I create 2 users (objectclass=person) and a group (objectclass=groupOfUniqueNames), then I add both users to that group. Next I'm trying to rename (or delete) one of the member users and... LDAP hangs up with no response. When I connect once again, then I see that action was performed (user is renamed or deleted, but old member reference is present in group attributes). However, I'm not able to modify directory (that is to add some new entry) LDAP hangs up on any attempt and only OpenLDAP restart helps. Last note is that this problem appears only when both accesslog and refint are enabled. Separately they are working as expected. Does anybody have an idea about the reason of such problem? Thanks in advance, Alina.

1 0

RE: A "which version" question
by Lesley Walker 21 Dec '06

21 Dec '06

Dave Horsfall wrote: > And I see 2.3.31 is now STABLE... Which solved my problem, really. :-) Thanks, whoever did that. I have 2.3.31 up and running on a test server, and will deploy during the quiet time next week. I do like happy endings! -- Lesley Walker Linux Systems Administrator Opus International Consultants Ltd Email lesley.walker(a)opus.co.nz Tel +64 4 471 7002, Fax +64 4 473 3017 http://www.opus.co.nz Level 9 Majestic Centre, 100 Willis Street, PO Box 12 343 Wellington, New Zealand

1 0

two different rootdn
by Rudy Setiawan 21 Dec '06

21 Dec '06

Hi there, I need to add another rootdn in the same ldap server. The goal is to separate two organizations ldap authentication. let's say i have these two rootdn's: (in the file slapd.conf) database dbd suffix "dc=companya,dc=com" rootdn "cn=CompanyAManager,dc=companya,dc=com" rootpw {SSHA}as98dyasdhasiduhasiudhashdas directory /var/lib/ldap/companya database dbd suffix "dc=companyb,dc=com" rootdn "cn=CompanyBManager,dc=companyb,dc=com" rootpw {SSHA}aoshdsadhsaodasdhasdhasih directory /var/lib/ldap/companyb Any pointers or advise are really appreciated :) Thank you all. Regards, Rudy Setiawan -- +++++++++ Booo

2 3

pdf version of documentation, including manuals
by Douglas B. Jones 21 Dec '06

21 Dec '06

Is there a pdf version of the manuals that are up to date. I see the admin. guide, but it is dated last 2005. I am really interested if there was a document or series of documents that had "everything" in pdf format. When I try to download all the web pages within acrobat, it fails (acrobat has a feature to read the web pages and convert them, but I am trying to avoid doing that one page at a time). Thanks for any help!

1 0

A "which version" question
by Lesley Walker 21 Dec '06

21 Dec '06

Hi all, First of all, I'll mention that I've read the information on the download page about "stable" vs "release" and I understand the difference. I've also read the FAQ-o-matic entries on the topic. I'm working towards upgrading our OpenLDAP software (currently 2.3.24). Since we are utterly dependant on OpenLDAP for many things, policy is to go with "stable". However, I noticed a few days ago that somebody said in another thread: > > Look into syncrepl (make sure to upgrade to 2.3.30 first) Are there problems with syncrepl in 2.3.27? Our plan is to move from slurpd to syncrepl with this upgrade. Perhaps the comment was simply made in the spirit of generally keeping up to date, but if there is a potential issue we'd like to know about it. We operate a single master with about 80 identical replicas and some local schema additions, and have about 8000-9000 records. There's nothing particularly special or fancy about any of it as far as I'm aware. All running on Debian 3.1 except the master which is still 3.0 (upgrading RSN). Thanks in advance for any insights. Lesley W -- Lesley Walker Linux Systems Administrator Opus International Consultants Ltd Email lesley.walker(a)opus.co.nz Tel +64 4 471 7002, Fax +64 4 473 3017 http://www.opus.co.nz Level 9 Majestic Centre, 100 Willis Street, PO Box 12 343 Wellington, New Zealand

6 9

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software