openldap-software

openldap-software@openldap.org

2719 discussions

slapo-memberof and posixGroup / posixAccount
by Wilhelm Meier 05 Dec '08

05 Dec '08

Hi, I wonder if it would be possible to manage a memberOf-attribute for posixAccount dynamically with slapo-memberOf using posixGroup and the memberUid-attribute. I know the memberUid isn't DN-format, so there may be problems. Has anyone tried this? Or is there another way to (dynamically) provide the reverse-mapping of the memberUid in posixGroup to memberOf in posixAccount? -- Wilhelm

1 0

TLS client certificates and memory use
by David Hawes 04 Dec '08

04 Dec '08

I was doing some testing and noticed that when I search for entries using TLS, significantly more memory is used when using client certificates than without them. In fact, memory will eventually be exhausted if the searches are performed indefinitely. Without using them, memory use stays (around) the same value. I stripped down the config, removed all ACLs except one (to disallow access), and started with an empty database, and get the same results. I've noticed this in 2.4.11, 2.4.12, and 2.4.13 with OpenSSL 0.9.8i. I do not notice it with an old 2.3.39 instance. Has anyone noticed anything similar, or can anyone reproduce this? Dave

3 6

acls and restricting permissions
by Brett ＠Google 04 Dec '08

04 Dec '08

Hi All, I was wondering how i go about giving LESS access than the default ACL rule. Lets assume some default permissions set from the FAQ-o-matic : access to attr=userpassword by self =xw by anonymous auth access to * by self write by users read This allows the "standard user" to read all attributes, and write thier own details. Assuming we add to the above a user that has LESS access than the default ie: access to attr=c,o,ou,cn,sn,givenName,mail by dn.exact=cn=limited,dc=example,dc=com by * none (or break) This literally wont work as intended, because even if the above does not match, the access to * by self write by users read Will always give users read by default. Any ideas ? Cheers Brett

4 5

"make test" hangs indefinitely
by Drew Leske 04 Dec '08

04 Dec '08

Hi all, Apologies if this has been asked and answered already. I did a number of searches for this problem and found nothing. When I build OpenLDAP it hangs on "make test". This has happened on two separate hosts, one AMD64 running Gentoo and the other a CentOS 5 distribution running on Intel. I am trying to build OpenLDAP 2.4.13 (have also tried 2.4.12) against BDB 4.7.25. BDB is built with a specific prefix and that's all: /usr/local/db-4.7.25. It builds without error or hiccup but unfortunately there is no test target. OpenLDAP is built with the following: CPPFLAGS="-I/usr/local/db-4.7.25/include" LDFLAGS="-L/usr/local/db-4.7.25/lib -Wl,--rpath -Wl,/usr/local/db-4.7.25/lib" ./configure --enable-syslog --enable-slapd --enable-crypt --enable-bdb --with-tls --prefix=/usr/local/openldap-2.4.13 && make depend && make && make test On the make test it gets to test001-slapadd and just sits there. Here's how that looks: [...] >>>>> Test succeeded >>>>> ./scripts/test000-rootdse completed OK. >>>>> Starting test001-slapadd ... running defines.sh Running slapadd to build slapd database... [...eventually I ctrl-c] This will sit there indefinitely. I changed the test script to use -d -1 for slapadd and the end of that output is below. On these systems I have another instance of BDB but I'm pretty clear to OpenLDAP about which to use. Perhaps I am missing something. Given this is happening to me on two different servers and I don't see anybody else having this problem I must be b0rking something myself, and consistently. Can anybody point out to me what I'm doing wrong? I am currently trying a build of BDB 4.6.21 and we'll see how that goes. Thanks, Drew. >>> dnPrettyNormal: <ou=Groups,dc=example,dc=com> <<< dnPrettyNormal: <ou=Groups,dc=example,dc=com>, <ou=groups,dc=example,dc=com> <= str2entry(ou=Groups,dc=example,dc=com) -> 0x92e7f9c oc_check_required entry (ou=Groups,dc=example,dc=com), objectClass "organizationalUnit" oc_check_allowed type "objectClass" oc_check_allowed type "ou" oc_check_allowed type "structuralObjectClass" => bdb_tool_entry_put( -1, "ou=Groups,dc=example,dc=com" ) => bdb_dn2id("ou=groups,dc=example,dc=com") <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30988) => bdb_dn2id_add 0x3: "ou=groups,dc=example,dc=com" bdb_idl_insert_key: 3 %dc=example,dc=com <= bdb_dn2id_add 0x3: 0 => index_entry_add( 3, "ou=Groups,dc=example,dc=com" ) => key_change(ADD,3) bdb_idl_insert_key: 3 [9bee355f] <= key_change 0 => key_change(ADD,3) bdb_idl_insert_key: 3 [0096defd] <= key_change 0 <= index_entry_add( 3, "ou=Groups,dc=example,dc=com" ) success => entry_encode(0x00000003): ou=Groups,dc=example,dc=com => str2entry: "dn: ou=Alumni Association,ou=People,dc=example,dc=com objectclass: organizationalUnit ou: Alumni Association " >>> dnPrettyNormal: <ou=Alumni Association,ou=People,dc=example,dc=com> <<< dnPrettyNormal: <ou=Alumni Association,ou=People,dc=example,dc=com>, <ou=alumni association,ou=people,dc=example,dc=com> <= str2entry(ou=Alumni Association,ou=People,dc=example,dc=com) -> 0x92e7f9c oc_check_required entry (ou=Alumni Association,ou=People,dc=example,dc=com), objectClass "organizationalUnit" oc_check_allowed type "objectClass" oc_check_allowed type "ou" oc_check_allowed type "structuralObjectClass" => bdb_tool_entry_put( -1, "ou=Alumni Association,ou=People,dc=example,dc=com" ) => bdb_dn2id("ou=people,dc=example,dc=com") <= bdb_dn2id: got id=0x2 => bdb_dn2id("ou=alumni association,ou=people,dc=example,dc=com") make[2]: *** [bdb-yes] Interrupt make[1]: *** [test] Interrupt make: *** [test] Interrupt

2 2

Re: Multi-master doesn't replicate deletes under certain circumstances.
by Jose Ildefonso Camargo Tolosa 03 Dec '08

03 Dec '08

Hi! On Wed, Dec 3, 2008 at 3:16 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, December 03, 2008 9:25 AM +1930 Jose Ildefonso Camargo > Tolosa <ildefonso.camargo(a)gmail.com> wrote: > >> Hi! >> >> I just configured multi-master replication (with N=3) for testing >> purposes, and I just found an annoying problem, under these >> conditions: >> >> 1. Configure a N number of "masters", and have them replicate happily >> (this is important). >> 2. Stop slapd service on all of the servers. >> 3. Start slapd service on any number of servers < N (ie, leave at >> least one stopped). >> 4. Delete any entry (yes, it only fails with deletes, you can combine >> changes: modify, add, and delete, and only deletes will fail to >> replicate). >> 5. Stop slapd service on *all of the servers again* (this is the most >> important part). >> 6. Star slapd service on all the servers. >> >> You will see that, on the servers that you left down on step 3, the >> deleted entries are still present. >> >> If you leave at least one server up, it replicates just fine, the >> problem is when you stop all of the masters. >> >> More info: >> >> OpenLDAP version: 2.4.13 >> OS: Debian GNU/Linux Etch >> Overlays: smbk5pwd (only samba enabled), syncprov (off course). >> >> Any ideas? If you need more info, just ask. > > I suggest you file an ITS. Ok. > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 1

extracting X509 certificate from LDAP connection with openldap public API
by Guillaume Rousse 03 Dec '08

03 Dec '08

Hello list. I'm trying to extend nagios check_ldap plugin to also check LDAP certificate expiration. Equivalent code in check_http work directly at socket level, and is not directly transposable, as check_ldap works at higher level, relying on openldap libraries to manage its connection. The code manipulates an opaque LDAP *ld connection handle. I had a quick look at openldap code, in libraries/libldap/tls.c, to see how this handle could be used to access the x509 certificate: LDAPConn *conn = NULL; Sockbuf *sb = NULL; SSL *ssl = NULL; X509 *certificate = NULL; conn = ld->ld_defconn; sb = conn->lconn_sb; ssl = ldap_pvt_tls_sb_ctx(sb); certificate = tls_get_cert(ssl); However, all those types are defined in libraries/libldap/ldap-int.h header, meaning those are for internal use only. I had a quick look at IETF LDAP C draft found in openldap sources, but I couldn't find anything related to the topic. So, what's the proper way for doing this ? -- Guillaume Rousse Moyens Informatiques - INRIA Futurs Tel: 01 69 35 69 62

2 2

Re: bdb_search: 112 does not match filter
by Net Warrior 02 Dec '08

02 Dec '08

Hi Quanah My bad, did not reindex the database, sorry, I'll do that right now and see what happens. and yes, it's and old release, I'm aware of that, and we should upgrade as soon as posible. Thanks for your time and support. Best regards. 2008/11/11, Quanah Gibson-Mount <quanah(a)zimbra.com>: > > --On Tuesday, November 11, 2008 6:12 PM -0200 Net Warrior < > netwarrior863(a)gmail.com> wrote: > > Hi there guys. >> >> A costumer of us were having problems with the slapd service ( unexpected >> hangs ), it's an ubuntu installation running slapd 2.2.26 >> In the logs I noticed that there were no indexes available, the >> index_param failed were reported in the logs, the systems uses ldap for >> user authentication and nothing else. >> >> After that, I added the following in the slapd.conf, >> >> index cn,gidNumber,memberUid,uid eq >> index uniqueMember eq >> index uidNumber eq >> >> The performance where better and there were no more hangs, but I'm >> getting the following error. >> and the user cannot authenticate, so I went back to the original >> configuration without indexes. >> > > Did you reindex the database after you added the indices via slapindex > while the server was offline, as is required when you add indices to > existing objects? > > And, I'll note that OpenLDAP 2.2 is very old and no longer supported. > Numerous bugs have been fixed since that release, even in the OpenLDAP 2.2 > series. > > --Quanah > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

3 3

Multi-master doesn't replicate deletes under certain circumstances.
by Jose Ildefonso Camargo Tolosa 02 Dec '08

02 Dec '08

Hi! I just configured multi-master replication (with N=3) for testing purposes, and I just found an annoying problem, under these conditions: 1. Configure a N number of "masters", and have them replicate happily (this is important). 2. Stop slapd service on all of the servers. 3. Start slapd service on any number of servers < N (ie, leave at least one stopped). 4. Delete any entry (yes, it only fails with deletes, you can combine changes: modify, add, and delete, and only deletes will fail to replicate). 5. Stop slapd service on *all of the servers again* (this is the most important part). 6. Star slapd service on all the servers. You will see that, on the servers that you left down on step 3, the deleted entries are still present. If you leave at least one server up, it replicates just fine, the problem is when you stop all of the masters. More info: OpenLDAP version: 2.4.13 OS: Debian GNU/Linux Etch Overlays: smbk5pwd (only samba enabled), syncprov (off course). Any ideas? If you need more info, just ask. Thanks in advance, Ildefonso Camargo

2 1

syncrepl null_callback : error code 0x12
by Will Nowak 02 Dec '08

02 Dec '08

Hi All, I'm migrating our ldap service from Sun One to OpenLDAP. In the process I have stumbled upon this issue a couple times. 1. Initialize Master 2. Connect syncrepl slaves 3. Wait a week 4. Replication stops working with `null_callback : error code 0x12` in slave logs and lots of ugly output in the master logs 5. Reinitialize master, GOTO 2 We started with slapd 2.4.7-6ubuntu3, then upgraded to 2.4.9-0ubuntu0.8.04.2 to see if it would help the issue, but it has returned. I spoke with Howard at LISA'08, and he mentioned this may be resolved in a newer release. Has anyone else seen an issue like this, and is it worth my time to backport a newer version to Ubuntu Hardy (our server platform of choice)? Master Log: http://pastebin.ubuntu.com/79362/ Slave Log: http://pastebin.ubuntu.com/79348/ Ubuntu Bug Report: https://bugs.edge.launchpad.net/ubuntu/+source/openldap2.3/+bug/304437 [config bits attached there] Thanks, -Will

2 1

slapd-meta and acls
by Dmitriy Kirhlarov 02 Dec '08

02 Dec '08

Hi list. I'll try to ask again. :) We are want use slapd-meta for aggregate several databases to one DIT. We are suppose, users will read and write "o=vega" (virtual) suffix. Members of cn=sysadmins should have write access to all db objects. Also, we would like to use ACL's per-databases, not global. Currently, write access to ou=devel doesn't work and we can't find error in our acls. Could somebody help us? We can provide any extended information. slapd.conf: ... database meta suffix "o=vega" uri ldap://ldap.irka.int.masterhost.ru/ou=devel,ou=sites,o=vega" suffixmassage "ou=devel,ou=sites,o=vega" "ou=devel" uri "ldap://ldap.irka.int.masterhost.ru/o=vega" suffixmassage "o=vega" "o=vega-main" ... database hdb suffix ou=devel ... access to dn.sub="ou=devel" by group/groupOfUniqueNames/uniqueMember="cn=sysadmins,ou=groups,ou=vega-main" write by * read ... database hdb suffix o=vega-main ... We are using FreeBSD 7.0 amd64 and openldap-2.4.11 WBR. Dmitriy

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software