openldap-software

openldap-software@openldap.org

2719 discussions

Re: Disable Protocol version 3?
by Quanah Gibson-Mount 10 Nov '08

10 Nov '08

Hi, Please keep your replies on the list. Yes, the ancient OpenLDAP v1 was an LDAP v2 server. However, all modern software uses LDAP v3. If you have software that isn't LDAP v3 compliant, I suggest fixing it, or using an OpenLDAP v2 server that allows ldapv2 style connections. If all you're doing is writing a client that wants to see the supported versions, I suggest just querying the rootDSE to see what it says: ldapsearch -x -h freelancer -s base -b "" + dn: structuralObjectClass: OpenLDAProotDSE supportedLDAPVersion: 3 (The above is edited to drop out other bits unrelated to the supportedLDAPVersion). --Quanah --On Monday, November 10, 2008 12:34 PM -0500 Jeremiah Martell <inlovewithgod(a)gmail.com> wrote: > Quanah, > > From this page: > http://www.openldap.org/software/roadmap.html > > It seems that openldap only supported version 3 beginning with openldap > 2.x. So it seems if I used 1.x it would only support version 2, right? > > Or am I missing something? > > Thanks, > - Jeremiah > > > On Mon, Nov 10, 2008 at 12:16 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> > wrote: >> No, you cannot disable protocol version 3... This question doesn't even >> really make sense. OpenLDAP is an LDAP protocol version 3 server. >> >> --Quanah >> >> --On Monday, November 10, 2008 12:01 PM -0500 Jeremiah Martell >> <inlovewithgod(a)gmail.com> wrote: >> >>> Problem: >>> I'm testing my client code that will drop down to version 2 if version >>> 3 isn't supported. >>> >>> Solution: >>> I've already found: http://www.openldap.org/faq/data/cache/822.html >>> which shows how to allow v2. >>> Now all I need is how to disable v3. >>> >>> Nothing in the slapd configuration file looks like it would do the >>> trick. And nothing in the ./configure --help looked like it would do it >>> either. >>> >>> Is this possible without buliding an older version of openldap? If so, >>> how? >>> >>> Thanks, >>> -- >>> - Jeremiah Martell >>> http://inlovewithGod.com >> >> >> >> -- >> >> Quanah Gibson-Mount >> Principal Software Engineer >> Zimbra, Inc >> -------------------- >> Zimbra :: the leader in open source messaging and collaboration >> > > > > -- > - Jeremiah Martell > http://inlovewithGod.com -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

2 2

Re: Disable Protocol version 3?
by Jeremiah Martell 10 Nov '08

10 Nov '08

Quanah, Sorry. I hit "Reply" instead of "Reply to All". My problem is not simply seeing which versions a server supports. I have written some ldap client code that does certain functions on an ldap server. My code attempts to bind with version 3, but if it gets a protocol error back, it is supposed to drop down to version 2 and attempt the bind again with version 2. So my problem is finding a server that doesn't accept version 3 binds. Is the only solution to my problem using an older openldap 1.x server? >From your earlier reply it seems that is the case. Thanks, - Jeremiah On Mon, Nov 10, 2008 at 12:45 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > Hi, > > Please keep your replies on the list. > > Yes, the ancient OpenLDAP v1 was an LDAP v2 server. However, all modern > software uses LDAP v3. If you have software that isn't LDAP v3 compliant, I > suggest fixing it, or using an OpenLDAP v2 server that allows ldapv2 style > connections. > > If all you're doing is writing a client that wants to see the supported > versions, I suggest just querying the rootDSE to see what it says: > > ldapsearch -x -h freelancer -s base -b "" + > dn: > structuralObjectClass: OpenLDAProotDSE > supportedLDAPVersion: 3 > > > (The above is edited to drop out other bits unrelated to the > supportedLDAPVersion). > > --Quanah > > --On Monday, November 10, 2008 12:34 PM -0500 Jeremiah Martell > <inlovewithgod(a)gmail.com> wrote: > >> Quanah, >> >> From this page: >> http://www.openldap.org/software/roadmap.html >> >> It seems that openldap only supported version 3 beginning with openldap >> 2.x. So it seems if I used 1.x it would only support version 2, right? >> >> Or am I missing something? >> >> Thanks, >> - Jeremiah >> >> >> On Mon, Nov 10, 2008 at 12:16 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> >> wrote: >>> >>> No, you cannot disable protocol version 3... This question doesn't even >>> really make sense. OpenLDAP is an LDAP protocol version 3 server. >>> >>> --Quanah >>> >>> --On Monday, November 10, 2008 12:01 PM -0500 Jeremiah Martell >>> <inlovewithgod(a)gmail.com> wrote: >>> >>>> Problem: >>>> I'm testing my client code that will drop down to version 2 if version >>>> 3 isn't supported. >>>> >>>> Solution: >>>> I've already found: http://www.openldap.org/faq/data/cache/822.html >>>> which shows how to allow v2. >>>> Now all I need is how to disable v3. >>>> >>>> Nothing in the slapd configuration file looks like it would do the >>>> trick. And nothing in the ./configure --help looked like it would do it >>>> either. >>>> >>>> Is this possible without buliding an older version of openldap? If so, >>>> how? >>>> >>>> Thanks, >>>> -- >>>> - Jeremiah Martell >>>> http://inlovewithGod.com >>> >>> >>> >>> -- >>> >>> Quanah Gibson-Mount >>> Principal Software Engineer >>> Zimbra, Inc >>> -------------------- >>> Zimbra :: the leader in open source messaging and collaboration >>> >> >> >> >> -- >> - Jeremiah Martell >> http://inlovewithGod.com > > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- - Jeremiah Martell http://inlovewithGod.com

1 0

Disable Protocol version 3?
by Jeremiah Martell 10 Nov '08

10 Nov '08

Problem: I'm testing my client code that will drop down to version 2 if version 3 isn't supported. Solution: I've already found: http://www.openldap.org/faq/data/cache/822.html which shows how to allow v2. Now all I need is how to disable v3. Nothing in the slapd configuration file looks like it would do the trick. And nothing in the ./configure --help looked like it would do it either. Is this possible without buliding an older version of openldap? If so, how? Thanks, -- - Jeremiah Martell http://inlovewithGod.com

2 1

ASN.1 BER tag that is corrupt
by Ivan Rodriguez 10 Nov '08

10 Nov '08

Hi People, I'm getting mad with this problem for one very special application we need to keep the support of openldap 1.2.11 we are migrating this applications to virtual servers 2.6.18-92.el5xen #1 SMP Tue Jun 10 19:20:18 EDT 2008 x86_64 We compile the source code for this version of openldap we build the binaries, until here looks ok. however when we try to search in the directory any directory with different releases we got this message in the server side: Client request contains an ASN.1 BER tag that is corrupt or connection aborted Does anybody know the reason for this error ?? the binaries look ok and the compilation process looks clean except for some modifications that we did at the ltconfig file to specify the host with i686. Any clue it would be greatly appreciate it I'm running out of ideas with this issue

2 1

some questions on n-way replication
by Dieter Kluenter 10 Nov '08

10 Nov '08

Hello, there are some examples of n-way replication configuration examples around and I would like to ask for some authoritative configuration advice. test050 for example gives the impression that serverID parameter has to be multivalued at each configuration file, i.e. in a 3-way replication: serverID 1 $URL1 serverID 2 $URL2 serverID 3 $URL3 same applies to replication ID, it seems that sid and rid have some mutual relation, and all participating hosts should be aware of all rids, i.e. in a 3-way replication: syncrepl rid 1 provider=$URL1 syncrepl rid 2 provider=$URL2 syncrepl rid 3 provider=$URL3 mirrormode true overlay syncprov syncprov-reloadhint true syncprov-checkpoint 1 5 with this configuration each host has to connect to itself and to all participating hosts. I have done some extensive testing in the last few days and found that a system configuration as described above caused contextCSN to be set to sid 000 and led to a quite unstable system. The following configuration provided correct contextCSN setting and a stable system: serverID 1 syncrepl rid 1 provider=$URL2 syncrepl rid 3 provider=$URL3 mirrormode true overlay syncprov serverID 2 syncrepl rid 2 provider=$URL1 syncrepl rid 3 provider=$URL3 mirrormode true overlay syncprov serverID 3 syncrepl rid 3 provider=$URL1 syncrepl rid 1 provider=$URL2 mirrormode true overlay syncprov My question now is: is this a proper way to setup n-way replication or is this a wrong, but working, configuration. -Dieter -- Dieter Klünter | Systemberatung http://www.dpunkt.de/buecher/2104.html sip: +49.180.1555.7770535 GPG Key ID:8EF7B6C6 53°08'09,95"N 10°08'02,42"E

2 1

Strange LDAP userPassword: i am losing my hairs
by John Nietzsche 08 Nov '08

08 Nov '08

Dear gentleman, i have installed openldap with sasl and ssl support. I am facing a strange scenario: Although i can do every operation with the rootdn/rootpwd in /etc/ldap/slapd.conf i cannot log in with another DN. I does not matter how i tried, using SASL or even simple bind on a dn. What have realized that userPassword attribute type is changed from what i feed ldapadd with my lidf file. For instance: the entry from a ldif was: dn: uid=sioux,ou=people,dc=ufv,dc=br objectClass: account objectClass: posixAccount objectClass: top cn: sioux uid: sioux uidNumber: 1000 gidNumber: 1000 homeDirectory: /home/sioux userPassword: {SSHA}zK8OHcZn/Jz9Dj2ssRo4P8zY3uAD+5Ua loginShell: /bin/sh gecos: The root of all evil But when i perform a command like: sioux@centauro:~$ ldapsearch -x -LLL -D 'cn=admin,dc=ufv,dc=br' -W '(uid=sioux)' Enter LDAP Password: dn: uid=sioux,ou=people,dc=ufv,dc=br objectClass: account objectClass: posixAccount objectClass: top cn: sioux uid: sioux uidNumber: 1000 gidNumber: 1000 homeDirectory: /home/sioux userPassword:: e1NTSEF9eks4T0hjWm4vSno5RGoyc3NSbzRQOHpZM3VBRCs1VWE= loginShell: /bin/sh gecos: The root of all evil sioux@centauro:~$ Realize that userPassword is totally diiferent from what is in the ldif file. When i try to log: sioux@centauro:~$ ldapsearch -x -LLL -D 'cn=sioux,ou=people,dc=ufv,dc=br' -W '(uid=sioux)' Enter LDAP Password: ldap_bind: Invalid credentials (49) sioux@centauro:~$ May some one help me?

2 1

Strange ldap behavior
by John Nietzsche 06 Nov '08

06 Nov '08

Dear list members, i am trying to delete a tree in my ldapserver (i am using ldbm as database backend). Actually i can perform the delete operation, but i end up with the following: $ ldapdelete -x -D 'cn=admin,dc=ufv,dc=br' -W -r dc=ufv,dc=br^M^M Enter LDAP Password: ^M ldap_search: Server is unwilling to perform (53)^M additional info: critical control unavailable in context^M ldap_search: Server is unwilling to perform (53)^M additional info: critical control unavailable in context^M ldap_search: Server is unwilling to perform (53)^M additional info: critical control unavailable in context^M ldap_search: Server is unwilling to perform (53)^M additional info: critical control unavailable in context^M ldap_search: Server is unwilling to perform (53)^M additional info: critical control unavailable in context^M ldap_search: Server is unwilling to perform (53)^M additional info: critical control unavailable in context^M ldap_search: Server is unwilling to perform (53)^M additional info: critical control unavailable in context^M ldap_search: Server is unwilling to perform (53)^M additional info: critical control unavailable in context^M ldap_search: Server is unwilling to perform (53)^M additional info: critical control unavailable in context^M ldap_search: Server is unwilling to perform (53)^M additional info: critical control unavailable in context^M $

3 2

Using int ldap_sasl_interactive_bind_s with SASL/EXTERNAL and certificate
by Mathieu MILLET 05 Nov '08

05 Nov '08

Hi everyone, I'm trying to add support to SASL/EXTERNAL with certificate to NSSLDAP. For now, for testing, I'm implementing a very quick client in C. I'm able to perform starttls and client certificate verification. But, when using ldap_sasl_interactive_bind_s, I can't figure out what to pass to arguments server/client controls, sasl interact and <void *defaults>. the only parameter I have set yet is mechs which equal to "EXTERNAL". Does anyone have any documentation on how to perform this type of authentication ? Thanks in advance for any answer. Sincerely yours, Mathieu MILLET. -- Mathieu MILLET mailto:ldap@htam.net ----

2 1

Problem adding objectClass posixAccount using Novell's JLDAP
by Nuno 05 Nov '08

05 Nov '08

Hi everyone. I believe this is the correct mailing list to post my question. If not, please point me to the correct one. I'm using Novell's JLDAP Java library (available from http://www.openldap.org/jldap/) to talk to my OpenLDAP server from an application developed in-house. It's been a pretty straightforward ride: I can list users, change attributes, etc. There is, however, one thing I haven't yet been able to implement - create a new user that inherits the objectClass "posixAccount". According to Novell's code samples, to create such an entry, one would do: LDAPEntry entry = new LDAPEntry(cn); LDAPAttributeSet attrSet = new LDAPAttributeSet(); // Object class descriptions attrSet.add(new LDAPAttribute("objectclass", new String("inetOrgPerson"))); // add the other attributes until all required inetOrgPerson attributes are set ... // add the LDAPAttributeSet connection.add(new LDAPEntry(entry.getDN(), attrSet)); This snippet works only if the objectClass being added is an "inetOrgPerson". Trying to add an additional objectClass called "posixAccount" and its attributes ("gidNumber", "description", "gecos", "loginShell" and "userPassword") results in the following error: LDAPException: Object Class Violation (65) Object Class Violation LDAPException: Server Message: attribute 'uidNumber' not allowed Upon further testing, I concluded the posixAccount objectClass is never added, thus its attributes are in fact, not allowed. How should I proceed to correctly add the objectClass posixAccount?

3 3

bdb 4.6 issue with 2.4.12
by Guillaume Rousse 05 Nov '08

05 Nov '08

Since I upgraded one of my server from 2.4.11 to 2.4.12, I'm facing heavy database issues: [root@etoile ~]# slapcat -b dc=msr-inria,dc=inria,dc=fr ... bdb(dc=msr-inria,dc=inria,dc=fr): pthread lock failed: Invalid argument bdb(dc=msr-inria,dc=inria,dc=fr): PANIC: Invalid argument bdb(dc=msr-inria,dc=inria,dc=fr): PANIC: DB_RUNRECOVERY: Fatal error, run database recovery bdb(dc=msr-inria,dc=inria,dc=fr): PANIC: fatal region error detected; run recovery bdb_db_close: database "dc=msr-inria,dc=inria,dc=fr": close failed: DB_RUNRECOVERY: Fatal error, run database recovery (-30975) Even importing a backup ldiff file on a fresh installation triggers the same problems. I tested this problem on two different environment (mandriva 2008.1, mandriva cooker), and one user reported it against mandriva 2009.0 (https://qa.mandriva.com/show_bug.cgi?id=45034). This seems to either imply an openldap or a packaging issue. Should I report an ITS for this, or rather provide more informations ? -- Guillaume Rousse Moyens Informatiques - INRIA Futurs Tel: 01 69 35 69 62

4 8

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software