openldap-software

openldap-software@openldap.org

2719 discussions

Plenty of connection_read(): no connection! messages in log
by Maykel Moya 18 Nov '08

18 Nov '08

My slapd log is getting filled by 'no connection!' messages. Is that avoidable? aballi:/usr/local/sbin# tail -f /var/log/slapd.log Nov 18 14:22:59 aballi slapd[3185]: connection_read(41): no connection! Nov 18 14:23:00 aballi slapd[3185]: connection_read(55): no connection! Nov 18 14:23:15 aballi slapd[3185]: connection_read(98): no connection! Nov 18 14:23:22 aballi slapd[3185]: connection_read(48): no connection! Nov 18 14:23:24 aballi slapd[3185]: connection_read(74): no connection! Nov 18 14:23:29 aballi slapd[3185]: connection_read(41): no connection! Nov 18 14:23:32 aballi slapd[3185]: connection_read(148): no connection! Nov 18 14:23:43 aballi slapd[3185]: connection_read(44): no connection! Nov 18 14:23:45 aballi slapd[3185]: connection_read(122): no connection! Nov 18 14:23:46 aballi slapd[3185]: connection_read(145): no connection! Nov 18 14:23:52 aballi slapd[3185]: connection_read(182): no connection! Nov 18 14:24:01 aballi slapd[3185]: connection_read(24): no connection! Regards, maykel --------------------------------------- Red Telematica de Salud - Cuba CNICM - Infomed

2 1

Appropiate value for Read Waiters
by Maykel Moya 17 Nov '08

17 Nov '08

I'm having an average of 60 Read Waiters. Is that normal? slapd 2.4.11 backend hdb entries ~80k ram 3g Regards, maykel --------------------------------------- Red Telematica de Salud - Cuba CNICM - Infomed

1 0

Re: Error modifying uid or dn with ldapmodify (Naming violation (64) value of naming attribute 'uid' is not present in entry)
by Hallvard B Furuseth 17 Nov '08

17 Nov '08

darkxer0x writes: > Thank you very much. > But, I have another problem, what is the ACL to permit "seff" to > change dn? "man slapd.access" says: The modrdn operation requires write (=w) privileges on the pseudo-attribute entry of the entry whose relative DN is being modified, write (=w) privileges on the pseudo-attribute children of the old and new entry's parents, and write (=w) privileges on the attributes that are present in the new relative DN. Write (=w) privileges are also required on the attributes that are present in the old relative DN if deleteoldrdn is set to 1. Thus you'll need something like # hide passwords, but allow users to update their own access to attrs=userPassword by self =wx by * auth # allow users to add/delete/move entries directly below dc=dominio access to dn="dc=dominio" attrs=children by dn.onelevel="dc=dominio" write # allow users to write their own entries and everyone to read # everything else access to * by self write by * read > I''ve tried in slapd.conf: > access to dn.base="" by self write This tries to grant access to the single entry with DN "", which is not a user entry but a special entry that describes the LDAP server. Also it doesn't grant any access to anyone but 'self'. Maybe you meant access to * by self write by * read or something like access to dn.subtree=<some DN> by self write by * read > This doesn't work It would help if you said which error message you receive (where slapd tries to _tell_ you why it failed), but here is a guess: > I've read some howto about ldapmodrdn and all of them say: -D > "Directory Manager", Hopefully they don't, since that's not a valid DN. It would be something like -D "cn=Directory Manager,dc=dominio" assuming your slapd.conf includes something like database bdb suffix "dc=dominio" rootdn "cn=Directory Manager,dc=dominio" rootpw <some password, possibly encrypted with sbin/slappasswd> A database's rootdn is a special DN you can bind as which has full access to the database regardless of access control, and which does not need to exist in the database - which is why you can specify its password in slapd.conf instead. -- Hallvard

1 0

Error modifying uid or dn with ldapmodify (Naming violation (64) value of naming attribute 'uid' is not present in entry)
by Alberto GD 17 Nov '08

17 Nov '08

I'm trying to modify uid with ldapmodify. This is my modify.ldif: ###---modify.ldif---### dn: uid=old_user_uid,dc=dominio changetype: modify replace: uid uid: new_user_uid $ldapmodify -x -D "cn=admin,dc=dominio" -W -f modify.ldif Enter LDAP Password: modifying entry "uid=old_user_uid,dc=dominio" ldap_modify: Naming violation (64) additional info: value of naming attribute 'uid' is not present in entry When I try to modify dn: ###---modify.ldif---### dn: uid=old_user_uid,dc=dominio changetype: modify replace: dn dn: uid=new_user_uid,dc=dominio $ldapmodify -x -D "cn=admin,dc=dominio" -W -f modify.ldif Enter LDAP Password: modifying entry "uid=old_user_uid,dc=dominio" ldap_modify: Undefined attribute type (17) additional info: dn: attribute type undefined I've seen RFC2849, and the examples have dn and uid fields like: dn: cn=Gern Jensen, ou=Product Testing, dc=airius, dc=com objectclass: top objectclass: person objectclass: organizationalPerson cn: Gern Jensen cn: Gern O Jensen sn: Jensen uid: gernj Here is the output of #slapcat -a uid=old_user_uid dn: uid=old_user_uid,dc=dominio uid: old_user_uid cn: SomeOne homeDirectory: /home/old_user_uid uidNumber: SomeNumber objectClass: posixAccount objectClass: shadowAccount objectClass: person objectClass: inetOrgPerson gidNumber: SomeNumber sn: Someone shadowExpire: 14245 loginShell: /bin/bash userPassword:: NWh0c0p0T3g= shadowLastChange: 14193 structuralObjectClass: inetOrgPerson entryUUID: 9a2b0c7a-488e-102d-8bce-7f1d632647aa creatorsName: cn=admin,dc=dominio createTimestamp: 20081117005833Z entryCSN: 20081117013513Z#000000#00#000000 modifiersName: cn=admin,dc=dominio modifyTimestamp: 20081117013513Z

2 1

DDS object does not expire?
by manu＠netbsd.org 15 Nov '08

15 Nov '08

Hello I am trying out slapo-dds. I haver this in slapd.conf: overlay dds dds-state TRUE dds-max-ttl 1d dds-min-ttl 10s dds-default-ttl 1h dds-interval 120s dds-tolerance 5s Then I created an entry with this: objectClass: dynamicObject I had this automatically generated. entryTtl: 3600 entryExpireTimestamp: 20081029215410Z But now this entry should be expired, and it is still in the tree. What is wrong? Did I misunderstood the documentation, shoudln't it vanish now? -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

3 8

Replica (ldap slave server) certificates (SSL/TLS). Are clients certificates needed?
by Alberto GD 14 Nov '08

14 Nov '08

Hi! I've followed openldap.org's guide and ldap works great with TLS/SSL with authentication in server and clients. Now I have added a LDAP replica (ldap slave server), and I have some questions: - In the clients I had to make the certs with the server certificate (cacer.pem) of the master, because I check the server certificate, and also check the clients in the server. Now that I have a replica, I have to make others certs with the server certificate of the slave server (and how can I show two certificates to ldap.conf)?? (I followed this<http://www.openldap.org/pub/ksoper/OpenLDAP_TLS.html#4.3>( http://www.openldap.org/pub/ksoper/OpenLDAP_TLS.html#4.3) Or with the certificates made from server certificates its sufficient?? >Step 1 and 2: Do nothing ... the CA does not need to be created again. The plan is to use the same CA certificate to sign the client certificate.

2 3

syncprov-sessionlog
by Gavin Henry 12 Nov '08

12 Nov '08

Hi All, I'm just writing up the small overlay section on slapo-syncprov (not much to it), but the man page has confused me: syncprov-sessionlog <ops> Specify a session log for recording information about write operations made on the database. The <ops> specifies the number of operations that are recorded in the log. All write operations (except Adds) are recorded in the log. When using the session log, it is helpful to set an eq index on the entryUUID attribute in the underlying database. "All write operations (except Adds) are recorded in the log." What log are we talking about here? -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

4 6

ACL regex and attribute value
by Emmanuel Dreyfus 11 Nov '08

11 Nov '08

Helo Is the kind of ACL below supported? access to dn.regex="^uid=.+,(ou=.+),o=org$" attrs=foo val.regex="^(.*)$" by ... I expect $1 to hold ou=whatever and $2 to hold attribute foo value that gets modified. I have trouble to get it working, and I wonder if 1) are $<digit> supported in val.regex ? 2) is it allowed touse $<digit> with multiples regex? Ot will the values gathered by the last match overwrite the first one? -- Emmanuel Dreyfus manu(a)netbsd.org

3 2

bdb_search: 112 does not match filter
by Net Warrior 11 Nov '08

11 Nov '08

Hi there guys. A costumer of us were having problems with the slapd service ( unexpected hangs ), it's an ubuntu installation running slapd 2.2.26 In the logs I noticed that there were no indexes available, the index_param failed were reported in the logs, the systems uses ldap for user authentication and nothing else. After that, I added the following in the slapd.conf, index cn,gidNumber,memberUid,uid eq index uniqueMember eq index uidNumber eq The performance where better and there were no more hangs, but I'm getting the following error. and the user cannot authenticate, so I went back to the original configuration without indexes. Nov 11 12:05:06 localhost slapd[28509]: <= check a_dn_pat: cn=admin,dc=domain,dc=gub Nov 11 12:05:06 localhost slapd[28509]: <= check a_dn_pat: self Nov 11 12:05:06 localhost slapd[28509]: <= check a_dn_pat: * Nov 11 12:05:06 localhost slapd[28509]: <= acl_mask: [3] applying read(=rscx) (stop) Nov 11 12:05:06 localhost slapd[28509]: <= acl_mask: [3] mask: read(=rscx) Nov 11 12:05:06 localhost slapd[28509]: => access_allowed: search access granted by read(=rscx) Nov 11 12:05:06 localhost slapd[28509]: <= test_filter 5 Nov 11 12:05:06 localhost slapd[28509]: <= test_filter_and 5 Nov 11 12:05:06 localhost slapd[28509]: <= test_filter 5 Nov 11 12:05:06 localhost slapd[28509]: bdb_search: 114 does not match filter Nov 11 12:05:06 localhost slapd[28509]: entry_decode: "uid=user,ou=People,dc=domain,dc=gub" Reading in the list I found that some people suggest to add more index, but, what else can I add? this is the structure. dn: uid=user,ou=People,dc=domain,dc=gub cn:: THVjw61hIENhbGRlcw== description:: THVjw61hIENhbGRlcyAtIERJTkFFIC0gT2JzZXJ2YXRvcmlvIE0uVC4= gidNumber: 1553 homeDirectory: /home/user loginShell: /bin/bash objectClass: person objectClass: posixAccount objectClass: top sn: Name uid: user uidNumber: 1542 userPassword:: bGNhbGRlcw== structuralObjectClass: person Thanks in advance. Best Regards.

2 1

syncrepl binding DN privileges?
by David Markey 11 Nov '08

11 Nov '08

If im doing multi master replication, what privileges does the bind DN need? i know its bad practice to use the manager DN, does the binding user need write access to anything on the remote ldap tree or just full read access? Thanks. David.

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software