openldap-software

openldap-software@openldap.org

2719 discussions

2.4.18 refint getting "no such attribute" in bdb_modify_internal with removal; works with rename
by Andreas Hasenack 07 Oct '09

07 Oct '09

[apologies if you get this twice: I originally sent this from the wrong non-subscribed address] Hi, I'm using the refint overlay with a few attributes, but I can't get it to work with krbPwdPolicyReference from MIT kerberos 1.7. I get the error from the subject when deleting the entry this attribute references. If, however, I *rename* the entry, the krbPwdPolicyReference attribute gets updated correctly. It seems to fail only when I remove the entry. This is the config: dn: olcOverlay={1}refint,olcDatabase={1}hdb,cn=config objectClass: olcRefintConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {1}refint olcRefintAttribute: krbObjectReferences olcRefintAttribute: member olcRefintAttribute: krbPwdPolicyReference olcRefintNothing: cn=localroot,cn=config This is the entry which has the attribute pointing to the entry I will remove (some attributes omitted for brevity): dn: krbPrincipalName=andreas(a)EXAMPLE.COM,cn=EXAMPLE.COM,ou=Kerberos Realms,dc= example,dc=com krbPrincipalName: andreas(a)EXAMPLE.COM objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux krbObjectReferences: uid=andreas,ou=people,dc=example,dc=com krbPwdPolicyReference: cn=default,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example ,dc=com This is the entry I'm deleting. I would expect the krbPwdPolicyReference attribute from my entry above to be deleted. If I rename this cn=default, then krbPwdPolicyReference gets updated correctly. dn: cn=default,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example,dc=com cn: default objectClass: krbPwdPolicy krbMaxPwdLife: 36000 krbMinPwdLife: 0 krbPwdMinDiffChars: 1 krbPwdMinLength: 1 krbPwdHistoryLength: 1 These are the relevant logs (level 16383): Oct 7 16:55:33 maestro slapd[6381]: refint_search_cb <NOTHING> Oct 7 16:55:33 maestro slapd[6381]: ==> unique_modify <krbPrincipalName=andreas(a)EXAMPLE.COM,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example,dc=com> Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: ndn: "krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: oc: "(null)", at: "(null)" Oct 7 16:55:33 maestro slapd[6381]: bdb_dn2entry("krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com") Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: found entry: "krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: bdb_entry_get: rc=0 Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: ndn: "krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: oc: "(null)", at: "(null)" Oct 7 16:55:33 maestro slapd[6381]: bdb_dn2entry("krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com") Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: found entry: "krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: bdb_entry_get: rc=0 Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: ndn: "cn=default,ou=password policies,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: oc: "(null)", at: "(null)" Oct 7 16:55:33 maestro slapd[6381]: bdb_dn2entry("cn=default,ou=password policies,dc=example,dc=com") Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: found entry: "cn=default,ou=password policies,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: bdb_entry_get: rc=0 Oct 7 16:55:33 maestro slapd[6381]: hdb_modify: krbPrincipalName=andreas(a)EXAMPLE.COM,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example,dc=com Oct 7 16:55:33 maestro slapd[6381]: bdb_dn2entry("krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com") Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: 0x00000042: krbPrincipalName=andreas(a)EXAMPLE.COM,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example,dc=com Oct 7 16:55:33 maestro slapd[6381]: <= acl_access_allowed: granted to database root Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: delete krbPwdPolicyReference Oct 7 16:55:33 maestro slapd[6381]: dnMatch 0#012#011"cn=default,cn=example.com,ou=kerberos realms,dc=example,dc=com"#012#011"cn=default,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: replace modifiersName Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: delete krbPwdPolicyReference Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: 16 modify/delete: krbPwdPolicyReference: no such attribute Oct 7 16:55:33 maestro slapd[6381]: hdb_modify: modify failed (16) Oct 7 16:55:33 maestro slapd[6381]: send_ldap_result: conn=-1 op=0 p=0 Oct 7 16:55:33 maestro slapd[6381]: send_ldap_result: err=16 matched="" text="modify/delete: krbPwdPolicyReference: no such attribute" Oct 7 16:55:33 maestro slapd[6381]: refint_repair: dependent modify failed: 16 Any hints?

1 0

logging to accesslog
by Evgeniy 07 Oct '09

07 Oct '09

Hello Now on our Ldap servers (OpenLdap 2.4.16) we logging all write operations to accesslog: database bdb suffix "cn=accesslog" rootdn "cn=root,cn=accesslog" rootpw password directory /usr/local/var/accesslog-data index reqStart eq overlay accesslog logdb "cn=accesslog" logops writes logold (objectclass=person) logpurge 1+00:00 1+00:00 logsuccess TRUE In case of Multi-Master replication, 2 Masters, how I can wrote to accesslog only local write operations, without replication write ops ? -- ---______________________________________________--- with deference, Evgeniy

1 0

openldap and kerberos auth-to-local rules
by Guillaume Rousse 05 Oct '09

05 Oct '09

Hello list. I successfuly configured OpenLDAP for kerberos autentication, and user mapping: authz-regexp "uid=([^,]+),cn=gssapi,cn=auth" "ldap:///ou=users,dc=futurs,dc=inria,dc=fr??sub?(uid=$1)" However, mapping doesn't work when autenticating with a user from a different realm than the one from the server. The logs show the realm is not stripped from username, as it should be: Oct 5 17:30:45 babaorum slapd[28598]: conn=24 op=2 BIND authcid="rousse(a)SACLAY.INRIA.FR" authzid="rousse(a)SACLAY.INRIA.FR" Oct 5 17:30:45 babaorum slapd[28598]: conn=24 op=2 BIND dn="uid=rousse(a)saclay.inria.fr,cn=gssapi,cn=auth" mech=GSSAPI sasl_ssf=56 ssf=56 authcid should be 'rousse', not 'rousse(a)SACLAY.INRIA.FR'. This is a classic problem, and kerberos provides mapping rules for users of external domains, such as described here: http://www.fnal.gov/docs/strongauth2003/html/krb5conf.html I used those rules succesfully with mod_krb, for instance. However, openldap seems to ignore them. I had to change the previous regexp to: authz-regexp "uid=([^,@]+)(@[^,]+)?,cn=gssapi,cn=auth" "ldap:///ou=users,dc=futurs,dc=inria,dc=fr??sub?(uid=$1) Is this intentional ? -- BOFH excuse #58: high pressure system failure

2 1

virtual attribute
by Liu, Michael 05 Oct '09

05 Oct '09

Hi, We are using OpenLDAP as a frontend proxy for another LDAP server on the backend. On the backend server, "displayname" attribute is not populated but cn is populated. We like to fake out a virtual "displayname" attribute on the frontend proxy OpenLDAP server, and the value of that attribute needs to come from "cn" attribute. Is there a way to do this? Any help is highly appricated. Thanks, Michael

3 3

ACL to allow add/remove of a specific objectclass value?
by Brandon Hume 05 Oct '09

05 Oct '09

I'm tuning my ACLs, and noting that we have several pieces of software that require the presence of a specific objectclass. Up to this point, they have write access to the objectclass attribute and can add the specific auxiliary class if needed and then modify the attributes that come with it. I'd like to pare down their access. It'd be nice to be able to allow them to add and remove the specific objectclass that they work with (in this case, posixAccount) but not touch the other objectclasses they have no business modifying (person, etc). Can an ACL work at this fine-grained a level? I'm going over the 2.4 docs and the FAQ-o-matic, but not coming across anything. (Though I'm certainly building a very nice "Ooo, I should do <x> that way..." list...)

2 2

SASL Mech EXTERNAL disabled?
by Dieter Kluenter 29 Sep '09

29 Sep '09

Hi, after updating to openldap-2.4.18, tls enabled sasl external mechanism seems to be disabled, but it is still enabled via ldapi:// :~> ldapwhoami -Y external -ZZ -H ldap://localhost SASL/EXTERNAL authentication started ldap_sasl_interactive_bind_s: Authentication method not supported (7) Is this a bug, or has something changed which I haven't noticed? :~> ldapsearch -x -LLL -H ldap://localhost -b "" -s base supportedSASLMechanisms dn: supportedSASLMechanisms: CRAM-MD5 supportedSASLMechanisms: DIGEST-MD5 :~> ldapsearch -x -ZZ -LLL -H ldap://localhost -b "" -s base supportedSASLMechanisms dn: supportedSASLMechanisms: CRAM-MD5 supportedSASLMechanisms: PLAIN supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: LOGIN :~> ldapsearch -x -LLL -H ldapi:/// -b "" -s base supportedSASLMechanisms dn: supportedSASLMechanisms: CRAM-MD5 supportedSASLMechanisms: PLAIN supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: LOGIN supportedSASLMechanisms: EXTERNAL -Dieter -- Dieter Klünter | Systemberatung sip: +49.180.1555.7770535 http://www.dpunkt.de/buecher/2104.html GPG Key ID:8EF7B6C6

3 5

Write, then read & mirror-mode
by Peter Mogensen 29 Sep '09

29 Sep '09

Hi, I about to set up a mirror-mode server pair with a slapd-ldap proxy to access them through. But it strikes me that the small delay for replication may result in race conditions for applications which use write, then read of entries. Like: The application creates an object through the proxy, which forwards the add request to server-1. Immediately after the application tries to read the object back, but now the proxy have a small chance for redirecting the search request to server-2 ... before replication has been done? Is this correct? Is there anyway to avoid it besides writing directly to server-1 or server-2 and reading back from the same server? /Peter

2 1

LDAP_OPT_X_TLS_NEWCTX
by Michael Ströder 29 Sep '09

29 Sep '09

HI! How is LDAP_OPT_X_TLS_NEWCTX set to LDAP_OPT_ON supposed to work? I've added support for it in python-ldap to set connection-specific values for LDAP_OPT_X_TLS_REQUIRE_CERT and LDAP_OPT_X_TLS_CACERTFILE. Note: In python-ldap LDAP options can be set globally by invoking ldap.set_option() or connection-specific with LDAPObject.set_option() which both uses ldap_set_option() in libldap or libldap_r. A libldap constant LDAP_OPT_FOO is mapped to a python-ldap constant ldap.OPT_FOO. Python-code for testing looks like this: ---------------------------- snip ---------------------------- # Create LDAPObject instance l = ldap.initialize('ldap://localhost:1390') # Set LDAP protocol version used l.protocol_version=ldap.VERSION3 # Force libldap to create a new SSL context l.set_option(ldap.OPT_X_TLS_NEWCTX,ldap.OPT_ON) # Force cert validation l.set_option(ldap.OPT_X_TLS_REQUIRE_CERT,ldap.OPT_X_TLS_DEMAND) # Set path name of file containing all trusted CA certificates l.set_option(ldap.OPT_X_TLS_CACERTFILE,CACERTFILE) # Now try StartTLS extended operation l.start_tls_s() # Try a bind to provoke failure if protocol version is not supported l.simple_bind_s('','') # Close connection l.unbind_s() ---------------------------- snip ---------------------------- But this does not work. The CA cert file is not taken into account for validating the server cert. Setting it globally with ldap.set_option(ldap.OPT_X_TLS_CACERTFILE,CACERTFILE) works. Ciao, Michael.

1 0

Proxy Authorization
by Jittinan Suwanrueangsri 27 Sep '09

27 Sep '09

Hi All I try configure slapd.conf to support proxy authorization but I can not add authzTo attribute to an entry [root@masterldap ~]# ldapmodify -x -w secret -D "cn=admin,dc=demo,dc=net" dn: uid=matt,ou=Users,dc=demo,dc=net changetype: add authzTo: dn.regex=^uid=[^,]*,ou=Users,dc=demo,dc=net$ adding new entry "uid=matt,ou=Users,dc=demo,dc=net" ldap_add: Invalid syntax (21) additional info: authzTo: value #0 invalid per syntax [root@masterldap ~]# I didn't see an authzTo attribute in any openldap schema .How can I fix an error?

2 1

Search fails after adding index
by Laurens Blankers 27 Sep '09

27 Sep '09

Hi, I am trying to index searching on uid. However as soon as I add the following index to slapd.conf: index uid pres,eq,sub stop slapd, run 'su openldap -c slapindex' and start slapd again, searching for any uid returns 0 results. I am using the following search command: ldapsearch -x "(&(objectClass=posixAccount)(uid=laurens))" After removing the index line from slapd.conf and restarting slapd the search returns the desired result again. I set the loglevel to 480, but the log does not contain any entries which indicate a problem. Why does adding indexes result in the search failing? I am running OpenLDAP 2.4.17 on Debian testing with the hdb backend. TIA, Laurens

3 3

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software