openldap-software

openldap-software@openldap.org

2719 discussions

delta-syncrepl and acl limitation
by COMBES Julien - CETE Lyon/DI/ET/PAMELA 05 Nov '08

05 Nov '08

Hello I use openldap 2.3.39. The Openldap admin guide indicates that (in chapter 15 for the openldap 2.3 and 17.2.1 for 2.4) : "Syncrepl supports both partial and sparse replications. The shadow DIT fragment is defined by a general search criteria consisting of base, scope, filter, and attribute list. The replica content is also subject to the access privileges of the bind identity of the syncrepl replication connection." So, I understand that, in syncrepl, I could do a partial replication on the slave with ACL limitation on the master. I have tried this with delta-syncrepl (with accesslog) but it doesn't seem to work with that kind of message on the slave : slapd : syncrepl_message_to_op: rid 252 be_modify cn=one_entry,ou=foo,ou=bar,dc=my,dc=domain (32) The slave doesn't have the entry (due to ACL limitations) but see modifications on it in the accesslog base and try to synchronize the entry. With delta-syncrepl, is it possible to do partial replication on slave with ACL limitation on master ? --------------------------------------------------------------------- master delta-syncrepl conf : # Accesslog database hdb suffix "cn=accesslog" rootdn "cn=accesslog" directory "/var/lib/ldap/accesslog" index entryCSN,objectClass,reqEnd,reqResult,reqStart eq overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE limits dn.regex="cn=syncuser\..*,ou=foo,ou=bar,dc=my,dc=domain" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited database hdb suffix "dc=my,dc=domain" rootdn "dc=my,dc=domain" [...] overlay syncprov syncprov-checkpoint 100 10 overlay accesslog logdb "cn=accesslog" logops writes logsuccess TRUE logpurge 07+00:00 01+00:00 --------------------------------------------------------------------- slave delta-syncrepl conf : syncrepl rid=252 provider=ldaps://ldapmaster.my.domain type=refreshAndPersist retry="60 10 300 +" searchbase="dc=my,dc=domain" filter="(objectClass=*)" scope=sub schemachecking=off updatedn="cn=replicsyncrepl,ou=foo,ou=bar,dc=my,dc=domain" bindmethod=simple binddn="cn=syncuser.slaveone,ou=foo,ou=bar,dc=my,dc=domain" credentials=<secret> logbase="cn=accesslog" syncdata=accesslog updateref ldaps://ldapmaster.my.domain --------------------------------------------------------------------- Regards, Julien

3 4

TLS problems with OpenLDAP
by LÉVAI Dániel 03 Nov '08

03 Nov '08

Hi! I've recreated my certificate/key pair, beacuse I can't seem get over this issue. I've changed the hostname in the certificate to the ip address of the server. OpenLDAP 2.4.11, Debian testing/lenny system. Could someone tell me why this would fail: $ ldapsearch -d 1 -ZZWx '(objectclass=*)' -H ldap://192.168.1.3 ldap_url_parse_ext(ldap://192.168.1.3) ldap_create ldap_url_parse_ext(ldap://192.168.1.3:389/??base) ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 192.168.1.3:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 192.168.1.3:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush2: 31 bytes to sd 3 ldap_result ld 0x6120a0 msgid 1 wait4msg ld 0x6120a0 msgid 1 (infinite timeout) wait4msg continue ld 0x6120a0 msgid 1 all 1 ** ld 0x6120a0 Connections: * host: 192.168.1.3 port: 389 (default) refcnt: 2 status: Connected last used: Fri Oct 31 22:36:46 2008 ** ld 0x6120a0 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x6120a0 request count 1 (abandoned 0) ** ld 0x6120a0 Response Queue: Empty ld 0x6120a0 response count 0 ldap_chkResponseList ld 0x6120a0 msgid 1 all 1 ldap_chkResponseList returns ld 0x6120a0 NULL ldap_int_select read1msg: ld 0x6120a0 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 12 contents: read1msg: ld 0x6120a0 msgid 1 message type extended-result ber_scanf fmt ({eAA) ber: read1msg: ld 0x6120a0 0 new referrals read1msg: mark request completed, ld 0x6120a0 msgid 1 request done: ld 0x6120a0 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ber_scanf fmt ({eAA) ber: ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (}) ber: ldap_msgfree TLS: hostname (192.168.1.3) does not match common name in certificate (192.168.1.3). ldap_err2string ldap_start_tls: Connect error (-11) That last "TLS:" prefixed message bothers me; it tells me that 192.168.1.3 doesn't match with 192.168.1.3?! Why? Daniel -- LEVAI Daniel PGP key ID = 0x4AC0A4B1 Key fingerprint = D037 03B9 C12D D338 4412 2D83 1373 917A 4AC0 A4B1

2 3

userPassword
by John Nietzsche 01 Nov '08

01 Nov '08

Dear gentleman, i have installed and configured a fully environment containg debian, openldap, cyrus-sasl and bdb. I am facing a curious problem in my environment: With a ldif file i had inserted a set of user (replacing nis with openldap). When i perform a ldapsearch on the tree whe field userPassword is not shown (or it was not added when importing with ldapadd). Did anybody already face such scenario? I am losing my hairs .... Thanks a lot for your time and cooperation. Best regards.

2 2

SASL
by John Nietzsche 01 Nov '08

01 Nov '08

Dear list members, i have just setted, in my environment, kerberos, cyrus-sasl and openldap. My host operational plataform is Debian. I am facing a situation like this: altough i configured cyrus SASL i can't see its mech with the following command: sioux@gustav:~/ldap$ ldapsearch -x -b "" -s base supportedSASLMechanisms # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: supportedSASLMechanisms # # dn: # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 sioux@gustav:~/ldap$ My ldap server ldd output is: gustav:/etc/ldap# ldd `which slapd` linux-gate.so.1 => (0xffffe000) libldap_r-2.3.so.0 => /usr/lib/libldap_r-2.3.so.0 (0xb7f1c000) liblber-2.3.so.0 => /usr/lib/liblber-2.3.so.0 (0xb7f10000) libiodbc.so.2 => /usr/lib/libiodbc.so.2 (0xb7ec8000) libslp.so.1 => /usr/lib/libslp.so.1 (0xb7eb9000) libsasl2.so.2 => /usr/lib/libsasl2.so.2 (0xb7ea3000) libssl.so.0.9.8 => /usr/lib/i686/cmov/libssl.so.0.9.8 (0xb7e64000) libcrypto.so.0.9.8 => /usr/lib/i686/cmov/libcrypto.so.0.9.8 (0xb7d2a000) libcrypt.so.1 => /lib/tls/i686/cmov/libcrypt.so.1 (0xb7cfc000) libresolv.so.2 => /lib/tls/i686/cmov/libresolv.so.2 (0xb7ce8000) libpthread.so.0 => /lib/tls/i686/cmov/libpthread.so.0 (0xb7cd6000) libltdl.so.3 => /usr/lib/libltdl.so.3 (0xb7ccf000) libwrap.so.0 => /lib/libwrap.so.0 (0xb7cc7000) libc.so.6 => /lib/tls/i686/cmov/libc.so.6 (0xb7b96000) libdl.so.2 => /lib/tls/i686/cmov/libdl.so.2 (0xb7b92000) libnsl.so.1 => /lib/tls/i686/cmov/libnsl.so.1 (0xb7b7b000) libz.so.1 => /usr/lib/libz.so.1 (0xb7b67000) /lib/ld-linux.so.2 (0xb7f6b000) gustav:/etc/ldap# May some one help with this stuff? Thanks a lot for your time and cooperation. Best regards.

3 2

How to create database?
by Alfonsas Stonis 31 Oct '08

31 Oct '08

Hi, I installed Openldap on Centos 4.7. However, it did not create database. So when I connect to it there is no data. So I get exception - object not found: javax.naming.NameNotFoundException: [LDAP: error code 32 - No Such Object]; remaining name 'dc=nodomain' I have tried everything that is suggested in ldap documentation. However, nothing works. I have impression that all documentation is only after you have data base set up and how to add data to existing data, but there is nothing how to create it from scratch. Any help, I am stuck with this problem already for 3 days :(. Alfas

2 1

Upgrading 2.3.35 to 2.4.11 - best approach?
by Lesley Walker 31 Oct '08

31 Oct '08

Hi all, I looked in the online version of the Admin Guide for upgrade instructions, but they don't seem to have been written. So I have come to the experts for guidance. I have successfully compiled and installed the new version, and run it as a slave in our existing system. I allowed to create its database via syncrepl, and that worked a treat (although it took longer than I expected). It's been happily running for a while and I have no issues. My question is really, what's the best way to approach the upgrade of the master server? Since we're going from BDB4.2 to BDB4.4, I assume it wouldn't be be a good idea to just plug the existing database into the new code. If I slapcat the old version and slapadd the data into the new version, will that cause the entire database to be resynced out to all slave servers? We have about 100 slave servers, and the thought of (effectively) resetting all their sync cookies all at once makes me shudder. My other option, since all servers run matching environments, would be to take a copy of the database from a replicated 2.4.11 slave and plug that straight in (having disallowed updates and replication, and taken any other safety measures I can think of). Would this be a stupid risk, or would you expect it to work okay? Our site info: All servers run Debian 4.0 (Etch) with near-as-dammit identically configured systems Kernel is 2.6.22 One master server, many slaves with identical databases. Replication is done by syncrepl Bandwidth to some sites is limited About 12000 records in the database Thanks, Lesley W -- Lesley Walker Linux Systems Administrator Opus International Consultants Ltd Email lesley.walker(a)opus.co.nz Tel +64 4 471 7002, Fax +64 4 473 3017 http://www.opus.co.nz Level 9 Majestic Centre, 100 Willis Street, PO Box 12 343 Wellington, New Zealand

3 2

Acl problem "no write access to parent"
by Muzammel Asghar 30 Oct '08

30 Oct '08

Hi guys i need an acl like that access to dn.subtree="ou=Company_People,dc=company,dc=com" attrs=cn,member by dn="uid=testadmin,ou=People,dc=company,dc=com" write by dn="uid=admin,ou=People,dc=company,dc=com" write by users read by * none It works fine for me that uid=testadmin has only rights on two attributs cn,member under "ou=Company_People,dc=company,dc=com" But i need one more right to that uid=testadmin to create new cn (group) under this "ou=Company_People,dc=company,dc=com" when i try to add new cn under "ou=Company_People,dc=company,dc=com" by using this uid=testadmin it gives me following error ldapadd: Insufficient access (50) additional info: no write access to paren Please help me regarding this matter Thanks

1 0

n-way replication question
by Dieter Kluenter 30 Oct '08

30 Oct '08

6 15

TLS problems with openldap
by LÉVAI Dániel 30 Oct '08

30 Oct '08

Hi! I need some assistance regarding TLS configuration. So, I'm using OpenLDAP 2.4.11 with debian/testing. This what my config looks like: slapd.conf: [...] TLSCACertificateFile /etc/ssl/certs/ecentrum_cacert.pem TLSCertificateFile /etc/ldap/tls/openldap_cert.pem TLSCertificateKeyFile /etc/ldap/tls/openldap_key.pem TLSVerifyClient try [...] Slapd starts with these settings gladly, and with a client (eg. ldapsearch) without requesting TLS connection, I can get to the invalid credentials error (which is what I'm expecting now, this is just testing.). But with requesting TLS: $ cat ~/.ldaprc TLS_CACERT /etc/ssl/certs/ecentrum_cacert.pem $ ls -l /etc/ssl/certs/ecentrum_cacert.pem -rw-r--r-- 1 root root [...] /etc/ssl/certs/ecentrum_cacert.pem $ ldapsearch -d 1 -ZZWx '(objectclass=*)' \ -H ldap://fileserver.digiszfv:636 ldap_url_parse_ext(ldap://fileserver.digiszfv:636) ldap_create ldap_url_parse_ext(ldap://fileserver.digiszfv:636/??base) ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP fileserver.digiszfv:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 192.168.1.3:636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush2: 31 bytes to sd 3 ldap_result ld 0x67e0b0 msgid 1 wait4msg ld 0x67e0b0 msgid 1 (infinite timeout) wait4msg continue ld 0x67e0b0 msgid 1 all 1 ** ld 0x67e0b0 Connections: * host: fileserver.digiszfv port: 636 (default) refcnt: 2 status: Connected last used: Mon Oct 27 11:07:53 2008 ** ld 0x67e0b0 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x67e0b0 request count 1 (abandoned 0) ** ld 0x67e0b0 Response Queue: Empty ld 0x67e0b0 response count 0 ldap_chkResponseList ld 0x67e0b0 msgid 1 all 1 ldap_chkResponseList returns ld 0x67e0b0 NULL ldap_int_select read1msg: ld 0x67e0b0 msgid 1 all 1 ber_get_next ldap_free_connection 1 0 ldap_free_connection: actually freed ldap_err2string ldap_start_tls: Can't contact LDAP server (-1) Meanwhile on the server side: # tail -f syslog slapd[3779]: slap_listener_activate(9): slapd[3779]: >>> slap_listener(ldaps://fileserver.digiszfv:636/) slapd[3779]: connection_get(15): got connid=21 slapd[3779]: connection_read(15): checking for input on id=21 slapd[3779]: connection_read(15): TLS accept failure error=-1 id=21, closing slapd[3779]: connection_closing: readying conn=21 sd=15 for close slapd[3779]: connection_close: conn=21 sd=15 The log messages are so terse and/or cryptic, I simply can not figure out what could be wrong. Any help would be appreciated! Thanks! Daniel -- LEVAI Daniel PGP key ID = 0x4AC0A4B1 Key fingerprint = D037 03B9 C12D D338 4412 2D83 1373 917A 4AC0 A4B1

3 5

smbk5pwd segfault on AIX 5.3
by David Markey 29 Oct '08

29 Oct '08

I'm trying to get smbk5pwd to work on AIX 5.3(power 6) compiled with xlc, Have compiled most things from scratch, bdb, libtool, sasl. Openldap 2.4.12 slapd log: line 18 (argsfile /opt/csr/var/run/slapd/slapd.args) line 20 (loglevel 20) line 22 (modulepath /opt/csr/etc/openldap/smbk5pwd/.libs) line 23 (moduleload smbk5pwd) loaded module smbk5pwd Segmentation fault Im getting a segfault when the module is loaded. more info: (gdb) backtrace #0 0xd30afe58 in lutil_passwd_add () from /opt/csr/etc/openldap/smbk5pwd/.libs/smbk5pwd.so.0 #1 0xd30ae1d0 in smbk5pwd_initialize () at smbk5pwd.c:1022 #2 0x100e9454 in ?? () bash-3.2# ldd /opt/csr/etc/openldap/smbk5pwd/.libs/smbk5pwd.so.0 /opt/csr/etc/openldap/smbk5pwd/.libs/smbk5pwd.so.0 needs: /usr/lib/libc.a(shr.o) /opt/csr/lib/liblber.a(liblber-2.4.so.2) /opt/csr/lib/libkrb5.a(libkrb5.so.22) /opt/csr/lib/libkadm5srv.a(libkadm5srv.so.8) /opt/csr/lib/libldap_r.a(libldap_r-2.4.so.2) /usr/lib/libcrypto.a(libcrypto.so.0.9.8) /unix /usr/lib/libcrypt.a(shr.o) /opt/csr/lib/libroken.a(libroken.so.18) /opt/csr/lib/libasn1.a(libasn1.so.8) /opt/csr/lib/libcom_err.a(libcom_err.so.1) /opt/csr/lib/libhx509.a(libhx509.so.1) /opt/csr/lib/libhdb.a(libhdb.so.9) /usr/lib/libs.a(shr.o) /usr/lib/libpthread.a(shr_xpg5.o) /usr/lib/libssl.a(libssl.so.0.9.8) /opt/csr/lib/libldap.a(libldap-2.4.so.2) /usr/lib/libpthreads.a(shr_comm.o) I was just doing this as an experiment so its not essential this works. Would be nice though. Thanks.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software