openldap-software

openldap-software@openldap.org

2719 discussions

Re: Cannot get "logpurge" to work
by Tony Earnshaw 10 Dec '06

10 Dec '06

Dave Horsfall wrote: > OpenLDAP 2.3.27 > > I've just started playing with "accesslog" (and "auditlog"). I have the > following configuration: > > database bdb > suffix cn=log > rootdn cn=root > directory /var/tmp/slapd.accesslog > index objectClass,reqStart eq > > ... > > overlay accesslog > logdb cn=log > logops all > # Scan every hour, delete more than 1 hour > logpurge 01:00 01:00 FWIW we're running 2.3.30 on RHAS4 with delta-syncrepl from a master to 3 slaves. We had issues with logpurge before about 2.3.25, so I wrote a small shell script to purge the entries at midnight, in anticipation of the problem being fixed in the end. Around 2.3.27 I noticed that the script wasn't outputting, but the entries were getting purged anyway, so logpurge was working. Our format in slapd.conf is slightly different from yours: logpurge 02:00:00 24:00 After a mass update, the logfiles in the changelog directory get huge, so when it's working, you'd best keep an eye on these. Best, --Tonni -- Tonni Earnshaw tonni @ barlaeus.nl

1 0

Solaris 10 and openldap - help needed.
by Robert Bannocks 08 Dec '06

08 Dec '06

Hi all, I have a number of issues with OpenLDAP on solaris 10. These are mostly to do with Samba, however, boiling the problem down I have tried to simplify things. I have openldap-2.3.27 configured with this configure line and compiled with gcc version ./configure --prefix=/usr/local/opt/openldap/openldap-2.3.27 --enable-crypt --enable-ldap --enable-slapd=no --enable-shared=no I have tried to compile the following simple program: $ more ldaptest.c #include <ldap.h> main() { char *ldapname="Dn=this is a long DN"; char *result; result=ldap_dn2ad_canonical( ldapname ); } With the command line /usr/sfw/bin/gcc -I/usr/local/opt//openldap/openldap-2.3.27/include -L/usr/local/opt/openldap/openldap-2.3.27/lib/libldap.a -L/usr/local/opt/openldap-2.3.27/lib/liblber.a ldaptest.c This gives this error: Undefined first referenced symbol in file ldap_dn2ad_canonical /var/tmp//ccKJLi7T.o ld: fatal: Symbol referencing errors. No output written to a.out collect2: ld returned 1 exit status looking as the libraries: $ /usr/ccs/bin/nm /usr/local/opt/openldap/openldap-2.3.27/lib/libldap.a | grep ldap_dn2ad_canonical [57] | 3116| 120|FUNC |GLOB |0 |1 |ldap_dn2ad_canonical However when I compile against the dynamic libraries compilation works. /usr/sfw/bin/gcc -I/usr/local/opt/openldap/openldap-2.3.27/include -L/usr/local/opt/openldap/openldap-2.3.27/lib -lldap -llber ldaptest.c I am at the limit of my understanding. Can anyone help. Regards Rob

7 11

slapd responds very slowly when cpu has 100% usage (but actually low load)
by Antonis Christofides 08 Dec '06

08 Dec '06

Hi, At the almost idle Dual Core machine which runs slapd, I run: nice sh -c 'while true; do true; done' & nice sh -c 'while true; do true; done' & (i.e. I'm running this twice). Then each of the two CPUs always has some job to do, so both CPUs have 100% usage, but this is "nice". Then, slapd takes too long to respond to queries. It may take 10 or 20 seconds. If I kill or stop one of the two dummy processes, it replies instantly. If I continue both dummy processes, it's back to 10 or 20 seconds. Needless to say all machine resources seem ok; low disk usage, lots of spare memory; and slapd is not niced. If it's not something immediately obvious, could you help me debug it? I've run slapd with various "-d" options but it gives me results that I have trouble understanding. The OS is Debian 3.1 (Sarge), with a 2.6.12 SMP Linux kernel. -- Antonis Christofides +30-2107722840 (work) +30-2106521785 (home) +30-6979924665 (mobile)

2 1

Using different clients to change password result in different stored password's form
by kadafax 08 Dec '06

08 Dec '06

Hi list, as I don't know if this behavior comes from my slapd itself, I'm not giving too much details on it. Here is what's happening: in slapd.conf I have: 'password-hash {SSHA}' so I'm expecting that each password attribute change results in a new SSHA hashed password. Our users can change their password on several ways which all result in different stored password'hashes (cleartext (!), SHA, but not SSHA). Does the hashing type is specified on the client's side and not enforced by the directory? Can someone give me some pointers for doc explaining how password's change mechanism works in openldap? kfx

2 1

is_entry_objectclass("",*) no objectClass attribute
by Michael Ströder 08 Dec '06

08 Dec '06

HI! What does these messages (OpenLDAP 2.3.30) during startup mean? These OIDs are object classes subentry, alias and referral. Dec 7 10:46:07 nb2 slapd[5158]: is_entry_objectclass("", "2.5.17.0") no objectClass attribute Dec 7 10:46:07 nb2 slapd[5158]: is_entry_objectclass("", "2.5.6.1") no objectClass attribute Dec 7 10:46:07 nb2 slapd[5158]: is_entry_objectclass("", "2.16.840.1.113730.3.2.6") no objectClass attribute Ciao, Michael. -- Michael Ströder E-Mail: michael(a)stroeder.com http://www.stroeder.com

2 3

Using rewrite and map (slapo-rwm) to unify subordinate OpenLDAP with Active Directory
by Andrew Kay 07 Dec '06

07 Dec '06

Hi, (Apologies if anybody has already received this, I sent the message before subscribing to the list and later discovered that it may not be relayed if I wasn't a subscriber.) I am trying to configure OpenLDAP such that it acts as a subordinate to an Active Directory server to allow applications to seamlessly authenticate users against both directories via the OpenLDAP server (some users will be in OpenLDAP, some in AD). The directory suffixes are set up as follows, for example: Active Directory dc=xyz, dc=com OpenLDAP ou=Extranet, dc=xyz, dc=com (subordinate) I have successfully configured OpenLDAP such that a query with a base "dc=xyz, dc=com" will return results from both directories. I now want to add a rewrite rule to entries from the AD directory such that Microsoft object classes (user and group) are transformed into inetOrgPerson and groupOfNames respectively. Also, I'd like the SAMAccountName attribute to be mapped to an attribute named uid. I followed the example of using the rwm overlay here: http://www.openldap.org/lists/openldap-software/200510/msg00256.html I was then able to perform a query on the uid attribute against the AD directory, the entry was returned rewritten as an inetOrgPerson as I had expected. However, I am no longer able to perform a query on the uid attribute against the subordinate OpenLDAP directory (base "ou=Extranet, dc=xyz, dc=com") as, AFAIK, the rewrite rule is removing it from the query, results or both. Is it possible to only apply such rewrite rules to entries within the AD directory, and leave entries stored in the OpenLDAP subordinate directory untouched, or is there a better way to approach this problem? Andrew

3 3

Re: Using rewrite and map (slapo-rwm) to unify subordinate OpenLDAP with Active Directory
by Gavin Henry 07 Dec '06

07 Dec '06

<quote who="Andrew Kay"> > Gavin, > > Thanks for your reply. Apologies for the delay in replying, I've been > away from a computer for the past two days. Did you see Howards reply? "You need to configure the rwm overlay so that it only applies to the main DB. You do this by explicitly configuring the position of the glue overlay, putting it above the rwm overlay: database ldap suffix dc=xyz,dc=com ... overlay rwm ... overlay glue " > > The database portion of my configuration file is currently: > > database bdb > suffix "ou=Extranet, ou=XYZ, dc=xyz, dc=com" > subordinate > rootdn "cn=Manager, ou=Extranet, ou=XYZ, dc=xyz, dc=com" > rootpw secret > directory /usr/local/var/openldap-data > index objectClass eq > > database ldap > suffix "ou=XYZ, dc=xyz, dc=com" > uri "ldap://dc1" > > acl-bind > bindmethod=simple > binddn="cn=Andrew Kay, ou=Users, ou=XYZ, dc=xyz, dc=com" > credentials="secret" > > idassert-bind > bindmethod=simple > binddn="cn=Andrew Kay, ou=Users, ou=XYZ, dc=xyz, dc=com" > credentials="secret" > mode=none > authzId="dn:cn=Andrew Kay, ou=Users, ou=XYZ, dc=xyz, dc=com" > > idassert-authzFrom "dn.children:ou=XYZ, dc=xyz, dc=com" > > overlay rwm > rwm-map objectclass inetOrgPerson user > rwm-map objectclass groupOfNames group > rwm-map attribute uid sAMAccountname > rwm-map attribute cn name > rwm-map attribute sn sn > rwm-map attribute mail mail > rwm-map attribute member member > rwm-map attribute * > > If I run a query against a user from the AD portion of the directory: > > extranet:~# ldapsearch -x -D "cn=Manager, ou=Extranet, ou=XYZ, dc=xyz, > dc=com" -W -b "ou=Users, ou=XYZ, dc=xyz, dc=com" "(cn=Andrew Kay)" > ... > > # Andrew Kay, Users, XYZ, xyz.com > dn: cn=Andrew Kay,ou=Users,ou=XYZ,dc=xyz,dc=com > objectClass: top > objectClass: person > objectClass: organizationalPerson > objectClass: inetOrgPerson > sn: Kay > cn: Andrew Kay > uid: Andrew > mail: andrew.kay(a)xyz.com > > ... > extranet:~# > > The AD user is successfully mapped to an inetOrgPerson, if I run a > query against a user from the OpenLDAP portion of the directory where > the user is already an inetOrgPerson: > > extranet:~# ldapsearch -x -D "cn=Manager, ou=Extranet, ou=XYZ, dc=xyz, > dc=com" -W -b "ou=Extranet, ou=XYZ, dc=xyz, dc=com" "(cn=John Smith)" > ... > > # John Smith, Users, Extranet, XYZ, xyz.com > dn: cn=John Smith,ou=Users,ou=Extranet,ou=XYZ,dc=xyz,dc=com > objectClass: inetOrgPerson > sn: Smith > > ... > extranet:~# > > The result is missing the uid field. If it comment out all rwm > directives in the configuration and perform the same query (after > restarting OpenLDAP), I get the following: > > extranet:~# ldapsearch -x -D "cn=Manager, ou=Extranet, ou=XYZ, dc=xyz, > dc=com" -W -b "ou=Extranet, ou=XYZ, dc=xyz, dc=com" "(cn=John Smith)" > ... > > # John Smith, Users, Extranet, XYZ, xyz.com > dn: cn=John Smith,ou=Users,ou=Extranet,ou=XYZ,dc=xyz,dc=com > objectClass: inetOrgPerson > cn: John Smith > sn: Smith > uid: john.smith > userPassword:: am9obi5zbWl0aA== > > ... > extranet:~# > > If I query the AD portion of the directory I recieve the unaltered > user, with AD schema attributes such as SAMAccountName. > > > Andrew >

1 0

identifying weak passwords
by Thierry Lacoste 06 Dec '06

06 Dec '06

I'm running OpenLDAP 2.3.24 on a production server. As I was in a hurry and discovering LDAP when I installed it, I didn't enforce any password policy. Now I would like to identify weak passwords to warn their users. What are my options? Best regards, Thierry.

4 4

schemacheck in slapd.conf
by Anant S Athavale 06 Dec '06

06 Dec '06

Dear List: In version 2.0.x of openldap, I used to use, schemacheck off in slapd.conf file. But, in the newer version 2.3.x, this directive is getting ignored. I want schemacheck to be disabled, how do I achieve this in the current version. Regards, Anant Athavale,

5 4

slapdd running at 100% of the cpu?
by Mike 06 Dec '06

06 Dec '06

Slapd was fine this weekend, then yesterday it went to 100% of the CPU and load average of 1.0+. No filesystems are full and I can find no mention of an issue in /var/log/*. Where can I look next for what's going on? I had this happen a few weeks ago, but I thought it was due to a full file system at the same time. Mike Red Hat Fedora Core 5 with all the latest patches [mikee@host ~]$ rpm -qa | grep ldap openldap-devel-2.3.19-4 ldapjdk-4.17-1jpp_3fc.1.1 openldap-clients-2.3.19-4 nss_ldap-249-1 python-ldap-2.0.6-5.2.1 cyrus-sasl-ldap-2.1.21-10 openldap-servers-2.3.19-4 smbldap-tools-0.9.2-3.fc5 openldap-2.3.19-4 mod_authz_ldap-0.26-6.2.1

2 3

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software