openldap-software

openldap-software@openldap.org

2719 discussions

posixgroup & structuralobject errors
by jef peeraer 03 Nov '06

03 Nov '06

i am using openldap for many years now ( arround 300 users ) but recently i encountered some problems. i installed a new server ( opensuse 10.1) and tried to import an ldap database which comes from a suse 9.3 There seems to be a difference in schemas anyway. (opensuse 10.1 has openldap version 2.3.19 , 9.3 -> 2.2.23) I've get these errors during import -> structuralObjectClass 'posixGroup' is not STRUCTURAL The entry on which i've got the complaints -> dn: cn=root,ou=Group,dc=deterp,dc=be objectClass: posixGroup objectClass: top cn: root userPassword:: xxxxxxx gidNumber: 0 structuralObjectClass: posixGroup I did a search in the faq and on google, but didn't find very much about it. jef peeraer

3 2

Hi people, about backend.
by Brivaldo Junior 03 Nov '06

03 Nov '06

What's the best backend for OpenLDAP... Fastest, stable, the best.. or a explain about each one... if possible. Thank's a lot. -- Brivaldo Alves da Silva Jr ITS/Shared Application Services Federal University of Mato Grosso do Sul - Brazil

2 1

Re: Hi people, about backend.
by Kurt D. Zeilenga 03 Nov '06

03 Nov '06

At 10:05 AM 11/3/2006, Brivaldo Junior wrote: > or a explain about each one... See <http://www.openldap.org/faq/index.cgi?file=756>. >Thank's a lot. > >-- >Brivaldo Alves da Silva Jr >ITS/Shared Application Services >Federal University of Mato Grosso do Sul - Brazil

1 0

ldapadd fails with "ldap_add: No such object (32)"
by Reed Kempf 03 Nov '06

03 Nov '06

Hello, I am new to openldap and am having trouble with ldapadd. This is the error I am getting when running the command. [root@centutl1 openldap]# ldapadd -x -D "cn=ldapadmin,dc=cent,dc=lan" -w "foo" -f /etc/openldap/passwd.LDIF adding new entry "uid=root,ou=People,dc=cent,dc=lan" ldap_add: No such object (32) Here is my slapd.conf and the commands I used to get to this point. database bdb suffix "dc=cent,dc=lan" rootdn "cn=ldapadmin,dc=cent,dc=lan" rootpw {SSHA}M3xAuwK9FK6Oj28DiTpR0Pb/DBaVHUcU issued service ldap start [root@centutl1 openldap]# service ldap start Checking configuration files for : config file testing succeeded Starting slapd: [ OK ] 1. migrate_common.ph (changed to $DEFAULT_BASE = "dc=cent,dc=lan";) 2. migrate_passwd.pl /etc/password passwd.LDIF 3. migrate_group.pl /etc/group group.LDIF 4. Attempted to import the files with these commands. Thanks in advance. ReedK

1 0

ppolicy implementation questions
by Lee Sheridan 02 Nov '06

02 Nov '06

I'm a little confused about a couple of things with ppolicy, I would appreciate somone helping me to sort it out. Here's my problem. I have a pwdMinAge set to some number X. The reason is that the password policy I'm implementing says that passwords must not be reused until some N days and Y number of changes have elapsed. Thus, pwdMinAge is approximately N / Y, which means that even if a user changes their password every X days, they won't go through all Y passwords until all N days have passed. Clearly not the best option. So my first question is this: I see that the pwdHistory attribute stores time the password was used within it. Is there some way for ppolicy to check if a password that is being reused has been reused in < X days? Failing in that (which would allow me to get rid of using pwdMinAge)... When I set a user password with the rootdn or similar, the user can not reset their password because it is too young. I can see no way to modify pwdChangedTime. How exactly is this handled? Third, apparently only the rootdn can set a password when the password is < pwdMinAge. Users with an ACL that allows write access to userPassword also go through the ppolicy policies (which makes sense). Is there a way to exclude them also from ppolicy constraints when setting another user's password? TIA, -- Lee Sheridan 301.286.5898 voice NASA / Goddard Space Flight Center lsherida(a)nccs.nasa.gov Computer Sciences Corporation Building 28, Room S230 Code 606.2

2 1

2.3 admin guide
by Gerard Ranke 02 Nov '06

02 Nov '06

Hi all, I wanted to read up on indexing, and I noticed that, in the admin guide, the index directive is under par. 6.2.5.6. So it seems as if this is specific to the ldbm backend ( par. 6.2.5 ). I was under the impression that index directives were valid for bdb backends too. So, can I use index directives for bdb? And is the syntax in 6.2.5.6 still valid? Thanks for your answers. Best regards, Gerard Ranke

3 2

ldapsearch hang
by Phillip 02 Nov '06

02 Nov '06

Hi all, I do the following testing, use a running "ftp" to instead of existed LDAP, and with its corresponding port, # ldapsearch -x -H ldap://192.168.123.1:22 Here, 192.168.123.1 is a ftp server with port 22 open. When I execute the command, it seems to be hung without any error messages. I think, if the ldap server or port is not available, it would return with error message immediately. How do you think of this interesting testing? Regards, Phillip

2 1

slapo accesslog purge in 2.3.19 [auf Viren überprüft]
by Hans Moser 02 Nov '06

02 Nov '06

Hi! I activated overlay accesslog in a 2.3.19 server. Everthing works fine (changes are logged) as long as I do not activate logpurge: line 69 (overlay accesslog) line 70 (logdb "ou=log,ou=foo,o=bar,c=de") >>> dnPrettyNormal: <ou=log,ou=foo,o=bar,c=de> <<< dnPrettyNormal: <ou=log,ou=foo,o=bar,c=de>, <ou=log,ou=foo,o=bar,c=de> line 71 (logops writes) line 72 (logpurge 10+00:00 1+00:00) /opt/mail//etc/openldap/slapd.conf: line 72: <logpurge> handler exited with 1! slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. # in slapd.conf overlay accesslog logdb "ou=log,ou=foo,o=bar,c=de" logops writes logpurge 10+00:00 1+00:00 This seems not to be related to ITS#4505 or #4595, which occour in CHANGES for "accesslog purge" for version >2.3.19. Hans

2 1

Per-objectclass attribute mapping with slapd-meta
by Daniel Montero Motilla 01 Nov '06

01 Nov '06

Hi, i'm trying to accomplish this kind of attribute and objectclass mapping with slapd-meta: map objectclass inetOrgPerson User map attribute cn givenName map objectclass groupOfNames Group map attribute cn name But it seems that attribute mapping affects attributes of all objectclasses, so I obtain a "duplicate attribute mapping" error with lines 2 and 4. How can I establish a per-objectclass attribute mapping so I don't obtain that error? Thanks in advance! Dani.

3 4

OpenLDAP configured for TLS not listenting on port 636
by Rob Tanner 31 Oct '06

31 Oct '06

I am just now venturing for the first time into using SSL with OpenLDAP. The principal problem (or at least the first symptom of the problem) is that the server is listening only on port 389 and not 636 (according to netstat) OpenLDAP was built with the '--with-tls' configuration parameter. While I intend get a regular certificate, for testing purposes I created my own certificate using CA.pl. I copied the output files to where I want to keep them and added the additional configuration info to slapd.conf: TLSCertificateFile /usr/local/etc/openldap/Certs/newcert.pem TLSCertificateKeyFile /usr/local/etc/openldap/Certs/newkey.pem When I start OpenLDAP, I'm prompted to enter the PEM pass phrase. A ps command confirms that the start-up script did the right thing: /usr/local/libexec/slapd -u ldap -h ldap:/// ldaps:/// But ssl connections fail and a netstat command only shows the server listening on port 389. Is there something I'm missing at this point merely to get the server listening on port 636? Thanks. -- Rob Tanner UNIX Services Manager Linfield College, McMinnville OR

5 6

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software