openldap-software

openldap-software@openldap.org

2719 discussions

working with Collect overlay (Openldap 2.4.17)
by Payasito Payasito 26 Apr '10

26 Apr '10

Hello, I'm following the slapo-collect man page but I must be missing something. For this database the collectinfo directive is pointing to "uid=template1,dc=test,dc=tld" dn and the "description" attribute as the collective one. database bdb suffix "dc=test,dc=tld" checkpoint 1024 5 cachesize 10000 rootdn "cn=root,dc=test,dc=tld" rootpw secret directory /var/lib/ldap-tests index objectClass eq access to * by * write overlay collect collectinfo "uid=template1,dc=test,dc=tld" description however, a search doesn't return the collect attribute for the result entries under "ou=people,dc=test,dc=tld" anyone knows how to resolve this problem? # ldapsearch -b "dc=test,dc=tld" -D "cn=root,dc=test,dc=tld" -w secret -LLL dn: dc=test,dc=tld objectClass: dcObject objectClass: organization dc: test o: edu dn: ou=people,dc=test,dc=tld objectClass: top objectClass: organizationalUnit ou: people dn: uid=a01,ou=people,dc=test,dc=tld objectClass: top objectClass: account uid: a01 dn: uid=a02,ou=people,dc=test,dc=tld objectClass: top objectClass: account uid: a02 dn: uid=a03,ou=people,dc=test,dc=tld objectClass: top objectClass: account uid: a03 dn: uid=template1,dc=test,dc=tld objectClass: top objectClass: account uid: template1 description: The quick brown fox jumps over the lazy dog

1 0

N-way multimaster replication problem
by Néher Márton 26 Apr '10

26 Apr '10

Hi, I have just set up openldap on two nodes (alpha, beta). I am using openldap for a passdb backend for samba. I followed this guide: http://www.openldap.org/doc/admin24/replication.html#N-Way%20Multi-Master To a point, everything seems to work just fine, the cn=config replication works both ways. After deleting everything from my base, I run smbldap-populate on the node alpha. It creates the default users, groups pretty fine, but it failed to replicat to node beta. the log entries shows this on alpha: http://pastebin.com/Ykhvq4BY on the other node the log shows this on beta: http://pastebin.com/KNwgHQDW My configuration looks the following: cn=config: http://pastebin.com/mT5A4K5i olcDatabase={0}config,cn=config: http://pastebin.com/kwBNEaeV olcDatabase={0}hdb,cn=config: http://pastebin.com/FsPaKK90 I have the olcOverlay={0}syncprov,olcDatabase={0}config,cn=config and olcOverlay={0}syncprov,olcDatabase={1}hdb,cn=config set to olcOverlay: {0}syncprov I have nothing in slapd.conf Do you know where to search this problem? What other logs should i attach to figure it out? Have a nice day, Best Regards, Marton, Neher

3 5

ACL to deny deletes but allow entry creation.
by Aravind Gottipati 24 Apr '10

24 Apr '10

Hi, I am working on an application where we want to grant an admin account the privileges to create new entries, but prevent any further changes (or deletes) to the entry by the admin account. I have looked through the docs and the faqs for this, and I am pretty sure that this is not possible. The simile folks relate this with, is the ability to grant insert privileges to an account in mysql, but restrict selects, updates etc.. Before I tell the developers that this is not possible, I wanted to check with you folks first. Have Any of you encountered similar situations? How do others deal with cases like this? Thanks in advance, Aravind.

3 3

"Bad search filter"?
by Luis Neves 23 Apr '10

23 Apr '10

Hello, Can someone confirm this error please? Try to make a ldapsearch agains any attribute on a ldap directory with this filter please: 'Cart\xC3\xA3o' Iam geting "bad search filter' because of the '\x'. But I need this search working to be able to query a X.509 Certificate field. mod_authz_ldap is giving errors because of this Regards, Luis _________________________________________________________________ Hotmail: Powerful Free email with security by Microsoft. https://signup.live.com/signup.aspx?id=60969

3 2

problems replicating deleted entries after slave comes up.
by Lior Goikhburg 23 Apr '10

23 Apr '10

Hello, I'm having problem with 2 OpenLDAP (ver 2.4.21) servers acting as "master" and "slave" using "refresh and persist" synchronization. When both servers are up, all changes get replicated (including deletes), however when slave is down and objects get deleted on master, they are not deleted on the slave after it comes up. Also, an interesting issue I noticed, deleting object on master doesn't change the servers contextCSN, so this could be related to the problem I have. What can be done about this situation ? Configs follow: Master: dn: cn=module{0} objectClass: olcModuleList cn: module{0} olcModuleLoad: {0}syncprov.la olcModuleLoad: {1}memberof.la structuralObjectClass: olcModuleList creatorsName: cn=config entryUUID: b4dec246-8d67-102d-9827- 65d8858906d8 createTimestamp: 20090212154358Z entryCSN: 20090212154358.261980Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20090212154358Z dn: olcOverlay={1}syncprov objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov olcSpSessionlog: 100 entryUUID: ad98aace-8b05-102d-8b73-fd81f30554e6 creatorsName: cn=config createTimestamp: 20090209145713Z structuralObjectClass: olcSyncProvConfig olcSpCheckpoint: 100 1 entryCSN: 20091104130358.860872Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20091104130358Z dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: slapd.conf.1 olcConfigDir: slapd.d olcArgsFile: /var/run/openldap/slapd.args olcAttributeOptions: lang- olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcLocalSSF: 71 olcPidFile: /var/run/openldap/slapd.pid olcReadOnly: FALSE olcReverseLookup: FALSE olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCRLCheck: none olcTLSVerifyClient: never olcToolThreads: 1 structuralObjectClass: olcGlobal creatorsName: cn=config entryUUID: b4deb404-8d67-102d-9826-65d8858906d8 createTimestamp: 20090212154358Z olcSaslHost: ldap-test1.carina.griddynamics.net olcLogLevel: 0 olcAuthzPolicy: to olcAuthzRegexp: {0}uid=([^@]*)[@,].*cn=digest-md5,cn=auth ldap:///dc=griddynam ics,dc=net??sub?(uid=$1) olcSizeLimit: 10000 olcServerID: 1 ldap://ldap-test1.carina.griddynamics.net entryCSN: 20091121171118.965511Z#000000#002#000000 modifiersName: cn=config modifyTimestamp: 20091121171118Z contextCSN: 20100121080100.534901Z#000000#001#000000 dn: olcDatabase={2}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcDbDirectory: /var/lib/ldap/griddynamics.net olcSuffix: dc=griddynamics,dc=net olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=Manager,dc=griddynamics,dc=net olcMonitoring: TRUE olcDbDirtyRead: FALSE olcDbLinearIndex: FALSE olcDbMode: 384 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 entryUUID: acc152ea-8b05-102d-8b71-fd81f30554e6 creatorsName: cn=config createTimestamp: 20090209145711Z structuralObjectClass: olcBdbConfig olcRootPW:: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx= olcAccess: {0}to attrs=userPassword,userPKCS12,sambaLMPassword,sambaNTPassword by sockurl.regex="^ldapi:///$" write by group.exact="cn=noc,ou=groups,dc=gr iddynamics,dc=net" write by self write by anonymous auth olcAccess: {1}to attrs=shadowLastChange by sockurl.regex="^ldapi:///$" write by group.exact="cn=noc,ou=groups,dc=griddynamics,dc=net" write by self wri te by * read olcAccess: {2}to * by sockurl.regex="^ldapi:///$" write by group.exact="cn=n oc,ou=groups,dc=griddynamics,dc=net" write by self write by * read olcDbIndex: default eq olcDbIndex: objectClass,entryUUID,entryCSN olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: uidNumber pres,eq olcDbIndex: gidNumber pres,eq olcDbIndex: memberOf pres,eq olcDbIndex: ou pres,eq,sub olcDbIndex: mail pres,eq,sub olcDbIndex: loginShell pres,eq olcDbIndex: sn pres,eq,sub olcDbIndex: givenName pres,eq,sub olcDbIndex: memberUid pres,eq olcDbIndex: nisMapName pres,eq,sub olcDbIndex: nisMapEntry pres,eq,sub olcDbIndex: uniqueMember pres,eq olcDbIndex: gosaObject pres,eq olcDbIndex: zoneName pres,eq olcDbIndex: relativeDomainName pres,eq olcDbIndex: member pres,eq olcDbIndex: dhcpPrimaryDN pres,eq olcDbIndex: dhcpSecondaryDN pres,eq olcDbIndex: dhcpServerDN pres,eq olcDbIndex: dhcpFailOverPeerDN pres,eq olcDbIndex: dhcpHWAddress pres,eq olcDbNoSync: TRUE olcDbCheckpoint: 1024 5 olcDbCacheSize: 5000 olcDbIDLcacheSize: 5000 olcSyncrepl: {0}rid=001 provider=ldap://ldap-test1.carina.griddynamics.net bindmetho d=simple timeout=1 network-timeout=0 binddn="cn=manager,dc=griddynamics,dc=ne t" credentials="xxxxxxxxxxx" starttls=no filter="(objectclass=*)" searchbase="dc =griddynamics,dc=net" scope=sub schemachecking=off type=refreshAndPersist ret ry="10 +" olcDbConfig: {0}set_flags DB_LOG_AUTOREMOVE olcDbConfig: {1}set_cachesize 0 33554432 0 entryCSN: 20091121172900.646924Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20091121172900Z Slave: dn: cn=module{0} objectClass: olcModuleList cn: module{0} olcModuleLoad: {0}syncprov.la olcModuleLoad: {1}memberof.la structuralObjectClass: olcModuleList creatorsName: cn=config entryUUID: b4dec246-8d67-102d-9827-65d8858906d8 createTimestamp: 20090212154358Z entryCSN: 20090212154358.261980Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20090212154358Z dn: olcOverlay={1}syncprov objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov olcSpSessionlog: 100 entryUUID: ad98aace-8b05-102d-8b73-fd81f30554e6 creatorsName: cn=config createTimestamp: 20090209145713Z structuralObjectClass: olcSyncProvConfig olcSpCheckpoint: 100 1 entryCSN: 20091104130358.860872Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20091104130358Z dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: slapd.conf.1 olcConfigDir: slapd.d olcArgsFile: /var/run/openldap/slapd.args olcAttributeOptions: lang- olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcLocalSSF: 71 olcPidFile: /var/run/openldap/slapd.pid olcReadOnly: FALSE olcReverseLookup: FALSE olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCRLCheck: none olcTLSVerifyClient: never olcToolThreads: 1 structuralObjectClass: olcGlobal creatorsName: cn=config entryUUID: b4deb404-8d67-102d-9826-65d8858906d8 createTimestamp: 20090212154358Z olcSaslHost: ldap-test1.carina.griddynamics.net olcLogLevel: 0 olcAuthzPolicy: to olcAuthzRegexp: {0}uid=([^@]*)[@,].*cn=digest-md5,cn=auth ldap:///dc=griddynam ics,dc=net??sub?(uid=$1) olcSizeLimit: 10000 olcServerID: 1 ldap://ldap-test1.carina.griddynamics.net entryCSN: 20091121171118.965511Z#000000#002#000000 modifiersName: cn=config modifyTimestamp: 20091121171118Z contextCSN: 20100121080100.534901Z#000000#001#000000 dn: olcDatabase={2}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcDbDirectory: /var/lib/ldap/griddynamics.net olcSuffix: dc=griddynamics,dc=net olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=Manager,dc=griddynamics,dc=net olcMonitoring: TRUE olcDbDirtyRead: FALSE olcDbLinearIndex: FALSE olcDbMode: 384 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 entryUUID: acc152ea-8b05-102d-8b71-fd81f30554e6 creatorsName: cn=config createTimestamp: 20090209145711Z structuralObjectClass: olcBdbConfig olcRootPW:: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx= olcAccess: {0}to attrs=userPassword,userPKCS12,sambaLMPassword,sambaNTPassword by sockurl.regex="^ldapi:///$" write by group.exact="cn=noc,ou=groups,dc=gr iddynamics,dc=net" write by self write by anonymous auth olcAccess: {1}to attrs=shadowLastChange by sockurl.regex="^ldapi:///$" write by group.exact="cn=noc,ou=groups,dc=griddynamics,dc=net" write by self wri te by * read olcAccess: {2}to * by sockurl.regex="^ldapi:///$" write by group.exact="cn=n oc,ou=groups,dc=griddynamics,dc=net" write by self write by * read olcDbIndex: default eq olcDbIndex: objectClass,entryUUID,entryCSN olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: uidNumber pres,eq olcDbIndex: gidNumber pres,eq olcDbIndex: memberOf pres,eq olcDbIndex: ou pres,eq,sub olcDbIndex: mail pres,eq,sub olcDbIndex: loginShell pres,eq olcDbIndex: sn pres,eq,sub olcDbIndex: givenName pres,eq,sub olcDbIndex: memberUid pres,eq olcDbIndex: nisMapName pres,eq,sub olcDbIndex: nisMapEntry pres,eq,sub olcDbIndex: uniqueMember pres,eq olcDbIndex: gosaObject pres,eq olcDbIndex: zoneName pres,eq olcDbIndex: relativeDomainName pres,eq olcDbIndex: member pres,eq olcDbIndex: dhcpPrimaryDN pres,eq olcDbIndex: dhcpSecondaryDN pres,eq olcDbIndex: dhcpServerDN pres,eq olcDbIndex: dhcpFailOverPeerDN pres,eq olcDbIndex: dhcpHWAddress pres,eq olcDbNoSync: TRUE olcDbCheckpoint: 1024 5 olcDbCacheSize: 5000 olcDbIDLcacheSize: 5000 olcSyncrepl: {0}rid=001 provider=ldap://ldap-test1.carina.griddynamics.net bindmetho d=simple timeout=1 network-timeout=0 binddn="cn=manager,dc=griddynamics,dc=ne t" credentials="xxxxxxxxxxx" starttls=no filter="(objectclass=*)" searchbase="dc =griddynamics,dc=net" scope=sub schemachecking=off type=refreshAndPersist ret ry="10 +" olcDbConfig: {0}set_flags DB_LOG_AUTOREMOVE olcDbConfig: {1}set_cachesize 0 33554432 0 entryCSN: 20091121172900.646924Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20091121172900Z

1 0

Exception handling!!!
by Pratima Shet 23 Apr '10

23 Apr '10

Sorry, this is the first time posting to any forum, So, am missing important data. Below is the, part of code where am initializing and binding connection with the server. res = ldap_initialize(&ld, ldapuri); if( res != LDAP_SUCCESS ) { char *errorM = NULL; errorM = ldap_err2string(res); if(errorM != NULL) // Print Error return NULL; } if(ld != NULL) { res = ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &protocol ); if(res == LDAP_OPT_SUCCESS) { if(ld != NULL) { res = ldap_start_tls_s(ld, NULL, NULL); if(res == LDAP_SUCCESS) { if(ld != NULL) { res = ldap_sasl_interactive_bind_s( ld, NULL,"NTLM", NULL, NULL, sasl_flags, saslInteract, &auth ); } } } else { //ld is null } } } And below is the backtrace of the crash. 0 liblber-2.3.0.dylib 0x007b9583 ber_sockbuf_ctrl + 147 1 libldap-2.3.0.dylib 0x007d25ad ldap_host_connected_to + 93 2 libldap-2.3.0.dylib 0x007c67f1 ldap_int_sasl_bind + 177 3 libldap-2.3.0.dylib 0x007c9064 ldap_sasl_interactive_bind_s + 84 4 myApp 0x003f54fb 0x1000 + 4146427 5 myApp 0x003f7e50 0x1000 + 4157008 6 com.apple.Foundation 0x94176ff1 __NSFireMachPort + 325 7 com.apple.CoreFoundation 0x94c03402 __CFMachPortPerform + 338 8 com.apple.CoreFoundation 0x94bff16b __CFRunLoopRun + 6523 9 com.apple.CoreFoundation 0x94bfd0f4 CFRunLoopRunSpecific + 452 10 com.apple.CoreFoundation 0x94bfcf21 CFRunLoopRunInMode + 97 11 com.apple.Foundation 0x9414f380 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 279 12 com.apple.Foundation 0x9414f25d -[NSRunLoop(NSRunLoop) run] + 76 13 com.polycom.CMADesktop 0x003f4c53 0x1000 + 4144211 14 com.apple.Foundation 0x941158dc -[NSThread main] + 45 15 com.apple.Foundation 0x9411588c __NSThread__main__ + 1499 16 libSystem.B.dylib 0x965d5a19 _pthread_start + 345 17 libSystem.B.dylib 0x965d589e thread_start + 34

3 2

Exception handling!!!
by Pratima Shet 22 Apr '10

22 Apr '10

Hi, Sorry for insufficient information. In brief,am trying to connect to LDAP server using following api's res = ldap_initialize(&ld, ldapuri); res = ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &protocol ); res = ldap_start_tls_s(ld, NULL, NULL); res = ldap_sasl_interactive_bind_s( ld, NULL, "NTLM", NULL, NULL,sasl_flags, saslInteract, &auth ); My code normally works fine, but in one senario after TLS, it crashed inside ldap_sasl_interactive_bind_s() API. Crash report says it crashed in "ber_sockbuf_ctrl + 147" inside "liblber" library. I think, it is possible to avoid the crash, If I could catch exceptions from library. Any idea? Thanks and regards, Pratima

2 3

ppolicy
by Frank Swasey 22 Apr '10

22 Apr '10

We are setting up a new service that is going to actually hold passwords in the OpenLDAP database instead of using Kerberos (via sasl and saslauthd). To that end, I'm investigating ppolicy. However, what I haven't found in the man page (slapo-ppolicy), or the Admin Guide, or the FAQ-O-Matic is whether I need to configure ppolicy on the master and the replicas or just the master. My assumption is that I need to set up ppolicy on the replicas as well as the master -- otherwise those pwd* operational attributes are not going to be legal on the replica and I'll get in trouble. I haven't set up a test environment with a replica yet -- so, I'm asking here. I also see in the FAQ that ppolicy only works on OpenLDAP versions greater than 2.3 (item 2 of the ppolicy checklist). So, I'm sensing that ppolicy in OpenLDAP v2.3.x is not really completely functional? Am I reading too much into the entry in the FAQ? -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

3 2

Re: syncrepl's "retry" option
by Quanah Gibson-Mount 21 Apr '10

21 Apr '10

--On Tuesday, April 20, 2010 5:34 PM -0400 Ryan Steele <ryans(a)aweber.com> wrote: > The FAQ indicates that the 'retry' option should be a comma-separated > list: http://www.openldap.org/faq/data/cache/1118.html > > > However, all of the examples from the section on replication in the Admin > Guide seem to show them as being space-delimited values: > http://www.openldap.org/doc/admin24/replication.html#Syncrepl > > > Which is correct? Both. If you examine the source, you find: slap_str2clist( &retry_list, val, " ,\t" ); i.e., it accepts a space, a comma, or a tab, as delimiters. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

4 8

syncrepl's "retry" option
by Ryan Steele 20 Apr '10

20 Apr '10

The FAQ indicates that the 'retry' option should be a comma-separated list: http://www.openldap.org/faq/data/cache/1118.html However, all of the examples from the section on replication in the Admin Guide seem to show them as being space-delimited values: http://www.openldap.org/doc/admin24/replication.html#Syncrepl Which is correct? Thanks, Ryan

1 0

← Newer
1
2
3
4
5
6
7
...
272
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software