openldap-software

openldap-software@openldap.org

2719 discussions

ldap db base dn change
by Bryan Irvine 30 Nov '06

30 Nov '06

Our company was recently broken apart and certain segments were sold. Now I have to go through pull out all the parts that aren't staying with my particular organization (happens to be the one where the LDAP DB stays). The problem is that my base dn, is based on the old company that is going away. Is there a way I can make a new base dn, and then on the designated day, just switch to the new base? In my ldap.conf it seems like I can only specify 1 base. --Bryan

3 2

Extending schema files and OIDs in schema files.
by shilpa muramkar 30 Nov '06

30 Nov '06

I need to create few object classes and attribute types ..hence i created a schema file of my own with all the entries...i have used the experimental OIDs specified in openLDAP.org in my schema file which is openLDAP experimental *1.3.6.1.4.1.4203.666* Experimental attribute types *1.3.6.1.4.1.4203.666.1* Experimental objectclasses *1.3.6.1.4.1.4203.666.3* Experimental syntax *1.3.6.1.4.1.4203.666.2* .......sample schema file is as below......... attributetype( 1.3.6.1.4.1.4203.666.1.58 NAME 'ssarole' DESC 'This attribute defines the role' SYNTAX 1.3.6.1.4.1.4203.666.2.8 MULTI-VALUE ) attributetype( 1.3.6.1.4.1.4203.666.1.59 NAME 'ssaugtype' DESC 'This is Usergroup Type' SYNTAX 1.3.6.1.4.1.4203.666.2.8 SINGLE-VALUE ) attributetype( 1.3.6.1.4.1.4203.666.1.60 NAME 'approverlimit' DESC 'Limit of the approver' SYNTAX 1.3.6.1.4.1.4203.666.2.9 SINGLE-VALUE ) ........... .............. objectclass( 1.3.6.1.4.1.4203.666.3.19 NAME 'ssauser' DESC 'SSA User' SUP ssabase STRUCTURAL MAY( telephonenumber $ title $ mobile $ displayname $ facsimiletelephonenumber $ preferredlanguage $ postaladdress $ c ) ) objectclass( 1.3.6.1.4.1.4203.666.3.20 NAME 'supplier' DESC 'SSA Supplier' SUP ssauser STRUCTURAL MUST businesspartnerid ) objectclass( 1.3.6.1.4.1.4203.666.3.21 NAME 'customer' DESC 'SSA Customer' SUP ssauser STRUCTURAL MUST businesspartnerid ) objectclass( 1.3.6.1.4.1.4203.666.3.22 NAME 'ssaroleobj' DESC 'SSA Role' SUP top STRUCTURAL MUST cn MAY description ) ................... ................ and then i have included my schema file into the slapd.conf..... now i have tried to add my ldif file (using ldapmodify) ....which looks like below(theres just one entry at present).............. dn: uid=admin,ou=ssausers,dc=ssainternal,dc=net changetype: add objectClass: top objectClass: ssauser objectClass: ssantuser objectclass: ssabase uid: admin cn: admin userpassword: admin ssarole: administrator ssarole: superadministrator sn: admin preferredlanguage: en_US ntuserdomainid: ssainternal ..................... ................ but i get an error saying ldap_add: Invalid syntax (21) additional info: objectClass: value #1 invalid per syntax our schema file is actually not being recognized by the server i.e, though i include it or not in the slapd.conf its making no difference :(...........and hence the object classes arnt being recognized........... is it because of the OIDs i have used or is there any *real syntax* *error*in the schema file............is it ok if i append my schema details in any of the openLDAP schema files(core.schema,,,,nis.schema....misc.schema )??????? kindly let me know as to how to get that ldif entry added .

2 1

openldap proxy: schema issue
by jerrrry＠voila.fr 30 Nov '06

30 Nov '06

Hi everybody, I'am configuring slapd(8) 2.3.27 for use as a proxy to another LDAP server. Unfortunately this (non-OpenLDAP) LDAP directory uses non standard attributes stored in a .ldif file. i have to use one of this non standard attributes in the slapd.conf file for binddn: database ldap uri ldap://192.168.239.210:1389 suffix ou=personnes,o=sg binddn "sbzoneid=appli_test,ou=exploit,ou=personnes,o=sb" bindpw secret maybe i have to convert this file in the openldap .schema format and include it in slapd.conf. I changed attributeTypes: and objectClasses: in attributeType and objectClasse. A big issue seems to be that this ldif file doesn't use numericOIDs but string OID like: attributetype ( sbzoneid-oid NAME 'sbzoneid' SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.15 SINGLE-VALUE X-ORIGIN 'user defined' ) or objectClasses: ( sbapplication-oid NAME 'sbapplication' SUP top STRUCTURAL MAY ( sbappatt $ sbappid $ sbapplogindn $ sbappurl $ sbcustom ) X-ORIGIN 'user defined' ) so when runing "sladp -d 1" i get the error: OID could not be expanded: "sbzoneid-oid" or maybe with a more liberal parsing could be helpful ? Do you have any idea to solve this problem ? Thank you for your help Jerrrry

2 1

Re: Extending schema files and OIDs in schema files.
by Kurt D. Zeilenga 30 Nov '06

30 Nov '06

At 02:32 AM 11/30/2006, shilpa muramkar wrote: >I need to create few object classes and attribute types ..hence i created a schema file of my own with all the entries...i have used the experimental OIDs specified in openLDAP.org in my schema file which is Do not hijack OID name space (from the OpenLDAP Project or anyone else). Use you own OIDs for your own purposes. Kurt

1 0

Re: Reg openLDAP config
by Dieter Kluenter 29 Nov '06

29 Nov '06

"shilpa muramkar" <ratnashilpa(a)gmail.com> writes: > Hi: > > We have a business case, wherein we need to add User Defined ObjectClasses > and Attributes to OpenLDAP programmatically/dynamically using Java. > > We have an application which was written in Java uses Netscape LDAP SDK (V3 > Supported) to add ObjectClasses and Attributes to Sun One Directory > Server. Now we need to extend our application to support OpenLDAP. > > Our assumption was, Since Netscape LDAP SDK supports V3 Protocol the > application should seamlessly work with any Directory Server which supports V3 > Protocol (Correct me if I am wrong); but our applications is failing to create > User Defined ObjectClasses and Attributes to OpenLDAP. We have also tried > creating the ObjectClasses and Attributes using LDIF files and got the same > error. Your assumption was not correct, there is no requirement in RFC-4511 and RFC4512 > The Error what we have got: > > ldap_modify: Server is unwilling to perform (53) > > additional info: modification of subschema subentry not supported > > > > Sample LDIF file what we had run: > > version:1 > > #Usage Eg: ldapmodify.exe -v -F -h localhost -p 389 -x -D "cn=Directory > manager,dc=company,dc=net" -w password123 -f D: \sample.ldif > > > > # user define attributes > > dn: cn=schema [...] With OpenLDAP schemas are written to cn=schema,cn=config, and the DN contains a ordering quantifier and the schema name, like dn: cn={0}core see http://www.openldap.org/doc/admin23/slapdconf2.html Please note that X-ORDERED 'VALUES' syntax is used to create odering quantifiers. -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de N 53°37'10.08" E 10°08'02.82" GPG Key ID:8EF7B6C6

1 0

4.5Gb Slapcat after server error
by JJ 28 Nov '06

28 Nov '06

I've been having some problems while importing some records into my ldap server and the server crashed with error (23 november) Nov 23 12:06:55 berlinzoo slapd[29709]: ====> cache_add_entry( 184299 ): "cn=157041,ou=non iscritti,ou=<CUT> ": already in id cache Nov 23 12:06:55 berlinzoo slapd[29709]: cache_add_entry_lock failed Nov 23 12:06:55 berlinzoo slapd[29709]: cache_add_entry_lock failed Nov 23 12:09:09 berlinzoo slapd[29709]: ldbm: ==> page 3266: illegal page type or format Nov 23 12:09:09 berlinzoo slapd[29709]: ldbm: ==> PANIC: Invalid argument When restarted, sometimes the server crashes so I've read some on google and decided to db_recover and then restart. Yesterday (27 November) the openldap server worked "quite" well, but sometimes still crashes: Nov 27 08:09:53 berlinzoo slapd[8529]: ldbm: ==> page 3267: illegal page type or format Nov 27 08:09:53 berlinzoo slapd[8529]: ldbm: ==> PANIC: Invalid argument (infact it does not crash, my application just hangs and cannot use ldap server anymore) I've noticed that my daily backup (I know, I'm stupid, I should have restored that backup the next day and not wait till now) since 24 is getting 2Gb (but just because it lock for max file size reached otherwise goes over 4Gb). What I think is that there should be a kind of "circular" reference because normally the backup is 23Mb, not >4.5GB. Anyone can suggest a correct procedure to get it stable without restoring the 23's backup file ? Thank you very much Julien

4 5

OpenLDAP + 300 CPUs
by Jean-Francois Bouchard 28 Nov '06

28 Nov '06

Hello I have an interesting issue here. We are operating a grid ( http://en.wikipedia.org/wiki/Grid_computing ) composed of a bit more than 300 CPUs. We have a standalone machine that take care of our LDAP server. Right now this machine run the LDAP server with a idletimeout set. When a use submit a bunch of job (Lets say 10 000 jobs) each job generate a query to the LDAP machine. What happen ? The only process stop accepting connection due to the FD size limit (1024 connections). Even with a idletimeout connection set at 2 second... What choice we have to let our LDAP machine do more ... We like to know if openLDAP can do like apache (fork a process for each connection, or a process for a small bunch of connection.) Thanks --- Jean-Francois Bouchard

3 5

How do I skip the pass phrase prompt on OpenLDAP startup
by Rob Tanner 27 Nov '06

27 Nov '06

Hi, Right now I'm just testing SSL with a self-signed certificate, but one potentially serious issue has come up. When ever I restart OpenLDAP I get the prompt "Enter PEM pass phrase". This means that the OpenLDAP server can auto-start on reboot. Is there anyway to bypass that? In apache, for example, SSLPassPhraseDialog has an option to execute a program, and I use that option to supply the pass phrase. Is there any kind of equivalent in OpenLDAP. Thanks, Rob -- Rob Tanner UNIX Services Manager Linfield College, McMinnville OR

2 1

Re: ACL using netgroups
by Claudio Strizzolo 25 Nov '06

25 Nov '06

Hi Dieter, >> Hello Dieter, >> thanks for your reply. >> I tried as you suggested: >> >> by dn="cn=ldapauth,dc=example,dc=com" \ >> group/nisNetgroup/nisNetgroupTriple=cn=linuxa,ou=netgroup,dc=example,dc=com >> read >> >> Unfortunately it does not work: >> >> [...] >> >> If that matters, I am using openldap 2.2.13. > Ah your historic version might be a problem. I can't remember, in > which version the group expansion has been implemented. > My slapd.access(5) OpenLDAP-2.3.27 states > THE <WHO> FIELD > > [...] > It can have the forms > > [ other forms deleted ] > group[/<objectclass>[/<attrname>]] Actually I have the same syntax available in my slapd.access: <who> ::= [ * | anonymous | users | self | dn[.<dnstyle>]=<DN> ] [dnattr=<attrname>] [group[/<objectclass>[/<attrname>]][.<style>]=<group>] [peername[.<peernamestyle>]=<peer>] [sockname[.<style>]=<name>] [domain[.<domainstyle>]=<domain>] [sockurl[.<style>]=<url>] So probably the error is somewhere else. I report it again for the list (sorry, I replied to Dieter only instead of the list the first time): Checking configuration files for slurpd: /etc/openldap/userauth.acl: line 82: group "cn=linuxa,ou=netgroup,dc=example,dc=com": inappropriate syntax: 1.3.6.1.1.1.0.0 <access clause> ::= access to <what> [ by <who> <access> [ <control> ] ]+ (...) Any hints? Thanks again Claudio

3 3

Re: ppolicy - getting to work
by Prakash Velayutham 24 Nov '06

24 Nov '06

Thanks again. Makes sense. Now that I am locked out for SSH access, I will just ask questions of interest without actually trying things out. For all the different ppolicy-related things to work, I am guessing the following is the procedure. Please correct me. a) Editing slapd.conf and adding "include", "modulepath", "loadmodule ppolicy.la", "overlay", "ppolicy_use_lockout", "ppolicy_default" statements. b) Adding necessary policy-related objects to LDAP (policy object and standard policy sub-object). These will inherit from pwdPolicy objectclass. c) Adding the users that will be managed by the password policy to the directory. Do I have to add "objectClass=pwdPolicy" attribute to all the users that need to be managed by ppolicy and leave it out for the other users? I will try all these out on monday. Prakash >>> Aaron Richton <richton(a)nbcs.rutgers.edu> 11/24/06 8:06 PM >>> Note that I build static modules, so this may need verification/clarification, but I'll try: The .la files are libtool archives. If you examine them (e.g. cat(1)), then you'll see that they point to .so files (among other details). A libtool-aware application--note that slapd(8) should be one of them--can parse the .la file, which allegedly offers advantages (mostly platform independence). So, following a 'make install', you should be able to specify in slapd.conf > moduleload /path/to/ppolicy.la and that should parse OK. At least, that's the way I remember it... Then again, you should be able to moduleload the .so also. If the .la doesn't work out, try that. On Fri, 24 Nov 2006, Prakash Velayutham wrote: > Thanks Aaron. So I built openldap with: > > $ ./configure --with-tls=no --with-cyrus-sasl=no --enable-slurpd=no > --enable-ipv6=no --enable-ppolicy=mod --enable-hdb=yes --enable-modules > --enable-bdb=no --enable-ldif=no --enable-monitor=no --enable-relay=no > --enable-syncprov=no > > Why do I have a ppolicy*.so and a ppolicy*.la file in the install > location? When do you use the ppolicy*.so? > > I have temporarily lost access to the system because of PAM. Will have > access again on monday. > > Thanks, > Prakash > >>>> Prakash Velayutham 11/24/06 5:13 PM >>> >>>> Aaron Richton <richton(a)nbcs.rutgers.edu> 11/24/06 4:04 PM >>> > configure --enable-hdb --enable-ppolicy={yes|mod} should handle it. > "yes" will build it into slapd, "mod" will give you a module. (You can > do > the same for --enable-hdb.) > > On Fri, 24 Nov 2006, Prakash Velayutham wrote: > >> Hello All, >> >> I am trying to get ppolicy working on my openldap-2.3.29 server. I > want >> this setup to work with hdb backend and either static or dynamic > ppolicy >> module. What compile time options would be sufficient? >> >> Thanks, >> Prakash >

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software