openldap-software

openldap-software@openldap.org

2719 discussions

Question to meta-backend / ldap-backend
by Wilhelm Meier 29 Oct '08

29 Oct '08

Hi, I think this is a relative simple question but I did not use the meta/ldap-backend before. We have an openldap-server for user authentification. The user bind as uid=<user>,ou=Benutzer,dc=kmux,dc=de where <user> is the actual username. We have a diffent application where only users of a special posixGroup "Archiv" should be valid. The application is not capable of doing some sort of filtering. So, I thought it must be passoble to do this filtering with the meta or ldap-backup using the original ldap-db: the filter should look like: (&(cn=Archiv)(memberUid=<user>)(objectClass=posixGroup)) where <user> is the username as above. Any hints? -- Wilhelm

4 10

OpenLDAP 2.4 syncrepl - Size limit exceeded error in consumer end
by Karthik Dathathri 29 Oct '08

29 Oct '08

I was trying to setup replication using syncrepl with openldap 2.4.11 on two machines running RHEL 5.0 The provider has approximately 1000 entries in the directory. On the consumer side, I am getting the following error after synchronization of around 500 records. Oct 14 16:35:59 osmvm2 slapd2.4[11727]: syncrepl_entry: rid=001 cn=Delfin Labarge,ou=Payroll,dc=example,dc=com Oct 14 16:35:59 osmvm2 slapd2.4[11727]: syncrepl_entry: rid=001 be_add (0) Oct 14 16:35:59 osmvm2 slapd2.4[11727]: do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT Oct 14 16:35:59 osmvm2 slapd2.4[11727]: do_syncrep2: rid=001 (4) Size limit exceeded I am using "refreshOnly" syncrepl in the consumer. The syncrepl user dn is uid=syncrepl,ou=System,dc=example,dc=com and added this dn as a member to a group called LDAPAdmins (cn=LDAPAdmins,ou=Groups,dc=example,dc=com) slapd.conf configuration at the consumer end is as follows: # Replicas running syncrepl as non-rootdn need unrestricted size/time limits: limits group="cn=LDAPAdmins,ou=Groups,dc=example,dc=com" size=unlimited time=unlimited #SyncRepl slave configuration syncrepl rid=001 provider=ldap://16.167.10.25 type=refreshOnly interval=00:00:05:00 searchbase="dc=example,dc=com" binddn="uid=syncrepl,ou=System,dc=example,dc=com" credentials=secret timelimit=unlimited sizelimit=unlimited slapd.conf configuration at the provider is as follows: #Global ACL for replication access to * by group="cn=LDAPAdmins,ou=Groups,dc=example,dc=com" read by anonymous read # syncprov index entryCSN,entryUUID eq # Replicas running syncrepl as non-rootdn need unrestricted size/time limits: limits group="cn=LDAPAdmins,ou=Groups,dc=example,dc=com" size=unlimited time=unlimited # ACL ensuring replicator has write access access to * by group="cn=LDAPAdmins,ou=Groups,dc=example,dc=com" write by * read #syncprov overlay configuration overlay syncprov syncprov-checkpoint 50 10 syncprov-sessionlog 100 Any pointers would be appreciated. If someone needs more information about the environment, please let me know. Thanks & Regards, Karthik ________________________________________________________________________ You are invited to Get a Free AOL Email ID. - http://webmail.aol.in

6 8

Support for "codice fiscale" syntax
by Pierangelo Masarati 28 Oct '08

28 Oct '08

I've developed a module that implements support for the syntax of "codice fiscale", the personal identification code used by the Italian government to uniquely identify citizen. I think it might be of general use, although possibly limited to Italian users, so I'd like to give it a somewhat official and unbiased OID, rather than one under my arc or SysNet's. Would it qualify as general enough for OpenLDAP's OID arc, at least while experimental? I believe the need for a dedicated syntax (as opposed to IA5string, printableString or so) is that its definition, although flawed, needs to conform to quite a few restrictions, and a syntax that allows to detect trivial errors and single out impossible values would be definitely helpful. I need the OID in order to submit code along with an ITS for contrib. An OID arc would be best, because the kit consists in: - a syntax - an equality matching rule (cfMatch) - an attribute spec (cf) - an auxiliary objectClass spec (cfObject) Please comment. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

4 5

Problems converting slapd.conf to a directory: i am desperated
by John Nietzsche 27 Oct '08

27 Oct '08

Dear list members, i am trying to convert slapd.conf to a directory. I am having problems trying to get it working. Here you have the output and slapd.conf i am working on: sioux@etosha$ slaptest -f slapd.conf -F /tmp/x; cat slapd.conf WARNING: No dynamic config support for database ldbm. WARNING: The converted cn=config directory is incomplete and may not work. ldbm_back_db_open: alock package is unstable; database may be inconsistent! config file testing succeeded include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema pidfile /asd/var/run/slapd.pid argsfile /asd/var/run/slapd.args idletimeout 1024 loglevel -1 # referral sizelimit 1024 timelimit 1024 backend ldbm database ldbm readonly off #replica #replogfile suffix "dc=cpd,dc=ufv,dc=br" rootdn "cn=Manager,dc=cpd,dc=ufv,dc=br" rootpw {SSHA}L+RsBLcsc846Bv/tTiEnBONIx3oTSPG5 #syncrepl #updatedn #updateref cachesize 1024 dbcachesize 1048576 #dbnolocking #dbnosync #dbsync <frequency> <maxdelays> <delayinterval> directory /asd/var/ldap index objectClass eq mode 0600

3 2

Re: Some entries not syncing to slave using syncrepl
by Robert Fitzpatrick 27 Oct '08

27 Oct '08

On Mon, 2008-10-27 at 14:28 +0000, andylockran wrote: > Robert Fitzpatrick wrote: > > I have setup a 2.3.43 master/slave using syncrepl, but some entries are > > not syncing. I have one entire tree (ou=Domains,dc=example,dc=com) and > > some entries under another certain tree not coming over to the slave. > > > > Here is my slapd.conf syncrepl entry on the slave with an ip address of > > 10.0.0.5... > > > > syncrepl rid=120 > > provider=ldap://10.0.0.6:389 > > type=refreshAndPersist > > interval=00:00:05:00 > > searchbase="dc=example,dc=com" > > filter="(objectClass=*)" > > scope=sub > > schemachecking=off > > bindmethod=simple > > binddn="uid=slurpd,ou=Services,dc=example,dc=com" > > credentials=password > > > > And in my master from slapd.conf... > > > > overlay syncprov > > syncprov-checkpoint 100 10 > > syncprov-sessionlog 100 > > > > My ACL does not contain any specific access for my Domains container, > > but at the bottom contains... > > > > access to * > > by sockurl.regex="^ldapi://%2fvar%2frun%2fopenldap%2fldapi/$" write > > by group.exact="cn=Administrators,dc=example,dc=com" write > > by self write > > by users read > > by peername=10.0.0.5 read > > by * read > > > > My slurpd uid is a member of the Administrators group entry. Using my > > Domains tree as an example, I can read the entry no problem... > > > > esmtp# ldapsearch -LLL -h 10.0.0.6 -D uid=slurpd,ou=Services,dc=example,dc=com -W "(ou=Domains)" dn > > Enter LDAP Password: > > dn: ou=Domains,dc=example,dc=com > > > > However, I have no Domains container in my slave :( > > > > esmtp# ldapsearch -LLL -h localhost -D uid=slurpd,ou=Services,dc=example,dc=com -W "(ou=Domains)" dn > > Enter LDAP Password: > > > > Can someone help me shed some light on this problem? > > > The filter (objectclass=*) isn't blocking it is it? Thanks. I have confirmed all to have objectClass defined, however, I removed the filter, stopped the server, deleted the directory folder and put back my DB_CONFIG, then restarted. Still, this one container and select entries beneath another container are not coming over to the master. But most entries in the directory are coming over and running the above ldapsearch from the slave pulls the entries on the master, no problem. Any other ideas? -- Robert

1 0

Some entries not syncing to slave using syncrepl
by Robert Fitzpatrick 25 Oct '08

25 Oct '08

I have setup a 2.3.43 master/slave using syncrepl, but some entries are not syncing. I have one entire tree (ou=Domains,dc=example,dc=com) and some entries under another certain tree not coming over to the slave. Here is my slapd.conf syncrepl entry on the slave with an ip address of 10.0.0.5... syncrepl rid=120 provider=ldap://10.0.0.6:389 type=refreshAndPersist interval=00:00:05:00 searchbase="dc=example,dc=com" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="uid=slurpd,ou=Services,dc=example,dc=com" credentials=password And in my master from slapd.conf... overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 My ACL does not contain any specific access for my Domains container, but at the bottom contains... access to * by sockurl.regex="^ldapi://%2fvar%2frun%2fopenldap%2fldapi/$" write by group.exact="cn=Administrators,dc=example,dc=com" write by self write by users read by peername=10.0.0.5 read by * read My slurpd uid is a member of the Administrators group entry. Using my Domains tree as an example, I can read the entry no problem... esmtp# ldapsearch -LLL -h 10.0.0.6 -D uid=slurpd,ou=Services,dc=example,dc=com -W "(ou=Domains)" dn Enter LDAP Password: dn: ou=Domains,dc=example,dc=com However, I have no Domains container in my slave :( esmtp# ldapsearch -LLL -h localhost -D uid=slurpd,ou=Services,dc=example,dc=com -W "(ou=Domains)" dn Enter LDAP Password: Can someone help me shed some light on this problem?

1 0

testing symas with modrate and searchrate tools
by ELCIN HAKTANIR 24 Oct '08

24 Oct '08

Hi i have got 'symas-openldap-silver-2.4.11.0.sun4u.pkg' installed on System Configuration: Sun Microsystems sun4v Memory size: 32640 Megabytes System Peripherals (Software Nodes): SUNW,SPARC-Enterprise-T5220 i have got 1 million subscribers 1.97 GB size of data for *.bdb files. now my question is, i installed Sun Java Directory Server Enterprise Edition 6_3 on another identical machine and use its utility called 'searchrate' and 'modrate' for comparing these two servers' performances. But this command hungs my symas openLDAP instance .i can't use multiple threads for 'modrate' testing. here is my command that hungs my solserver instance. ./des/dsrk6/bin/modrate -h 192.168.43.45 -p 389 -D "cn=saadet,o=saadettest" -w admin234 -b "mobile=%s,ou=subscribers,o=saadettest" -i ./des/dsrk6/bin/numbers.txt -t40 -C 5 -M 'occupation:10:[A-Z]' The output is here: Avg r= 41.42/thr (331.40/sec), total= 1657 T0 blk, T1 blk, T2 blk, T3 blk, T4 blk, T5 blk, T6 blk, T7 blk, T8 blk, T9 blk, T10 blk, T11 blk, T12 blk, T13 blk, T14 blk, T15 blk, T16 blk, T17 blk, T18 blk, T19 blk, T20 blk, T21 blk, T22 blk, T23 blk, T24 blk, T25 blk, T26 blk, T27 blk, T28 blk, T29 blk, T30 blk, T31 blk, T32 blk, T33 blk, T34 blk, T35 blk, T36 blk, T37 blk, T38 blk, T39 blk Avg r= 0.00/thr ( 0.00/sec), total= 0 T0 blk, T1 blk, T2 blk, T3 blk, T4 blk, T5 blk, T6 blk, T7 blk, T8 blk, T9 blk, T10 blk, T11 blk, T12 blk, T13 blk, T14 blk, T15 blk, T16 blk, T17 blk, T18 blk, T19 blk, T20 blk, T21 blk, T22 blk, T23 blk, T24 blk, T25 blk, T26 blk, T27 blk, T28 blk, T29 blk, T30 blk, T31 blk, T32 blk, T33 blk, T34 blk, T35 blk, T36 blk, T37 blk, T38 blk, T39 blk Avg r= 0.00/thr ( 0.00/sec), total= 0 The question is why can't i use these two utility commands for openLDAP? What have i done wrong? -------------------------------------- Bu elektronik posta ve onunla iletilen bütün dosyalar gizlidir sadece yukarıda isimleri belirtilen kişiler arasında özel haberleşme amacını taşımaktadır. Size yanlışlıkla ulaşmıssa bu elektonik postanın içeriğini açıklamanız , kopyalamanız, yönlendirmeniz ve kullanmanız kesinlikle yasaktır. Lütfen mesajı geri gönderiniz ve sisteminizden siliniz. Vodafone Teknoloji Hizmetleri A.Ş. bu mesajın içeriği ile ilgili olarak hiç bir hukuksal sorumluluğu kabul etmez. This electonic mail and any files transmitted with it are intended for the private use of the persons named above. If you received this message in error, forwarding, copying or use of any of the information is strictly prohibited. Please immediately notify the sender and delete it from your system. Vodafone Teknoloji Hizmetleri A.S. does not accept legal responsibility for the contents of this message. --------------------------------------

2 3

openLDAP paged response problem
by Navaneetha Subramanian 24 Oct '08

24 Oct '08

Hi, I'm using OpenLDAP backend with .NET 2.0 System.DirectoryServices.Protocols API in my application. I'm trying to issue PagedResult control as part of my request to get results in multiple pages that code can navigate. This would use rfc2696 which is already supported in OpenLDAP. But when I run my code it comes back with exception that ''critical control unavailable in context'. I've attached the capture from OpenLDAP server ## T 10.218.5.27:33236 -> 10.217.94.154:389 [AP] 0........c....s.!dc=openldap,dc=dev,dc=net6,dc=com...................... .objectClass..person0.... ..distinguishedName..sn..manager...../0....)..1.2.840.1 13556.1.4.319.....0........... # T 10.217.94.154:389 -> 10.218.5.27:33236 [AP] 03...e...5...'critical control unavailable in context # But OpenLDAP does support the control 1.2.840.113556.1.4.319 as listed in my query response against rootDSE below DB2-95-02:~ # ldapsearch -x -h 10.217.94.154 -b "" -s base '(objectclass=*)' + # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: + # # dn: structuralObjectClass: OpenLDAProotDSE configContext: cn=config namingContexts: dc=openldap,dc=dev,dc=net6,dc=com supportedControl: 1.3.6.1.4.1.4203.1.9.1.1 supportedControl: 2.16.840.1.113730.3.4.18 supportedControl: 2.16.840.1.113730.3.4.2 supportedControl: 1.3.6.1.4.1.4203.1.10.1 supportedControl: 1.2.840.113556.1.4.319 supportedControl: 1.2.826.0.1.334810.2.3 supportedControl: 1.3.6.1.1.13.2 supportedControl: 1.3.6.1.1.13.1 supportedControl: 1.3.6.1.1.12 supportedExtension: 1.3.6.1.4.1.4203.1.11.1 supportedExtension: 1.3.6.1.4.1.4203.1.11.3 supportedFeatures: 1.3.6.1.1.14 supportedFeatures: 1.3.6.1.4.1.4203.1.5.1 supportedFeatures: 1.3.6.1.4.1.4203.1.5.2 supportedFeatures: 1.3.6.1.4.1.4203.1.5.3 supportedFeatures: 1.3.6.1.4.1.4203.1.5.4 supportedFeatures: 1.3.6.1.4.1.4203.1.5.5 supportedLDAPVersion: 3 entryDN: subschemaSubentry: cn=Subschema Any idea why the server responds with ''critical control unavailable in context' message? I'm using OpenLDAP v 2.3.19 [root@labvmware ~]# slapd -V @(#) $OpenLDAP: slapd 2.3.19 (Feb 13 2006 11:19:24) $ root@ls20-bc1-14.build.redhat.com:/usr/src/build/708086-i386/BUILD/openl dap-2.3.19/openldap-2.3.19/build-servers/servers/slapd Thanks, Navaneetha

6 9

Problem using ldapsearch with TLS (-ZZ)
by Eric Johanson 24 Oct '08

24 Oct '08

I am trying to get a basic TLS connection working on my Linux server using OpenLDAP and the ldapsearch command, but it does not connect with TLS. I've created an SSL certificate with the usual command: openssl req -new -x509 -nodes -out ldcert.pem -keyout ldkey.pem -days 3650 I've added the requisite lines to slapd.conf (TLSCertificateFile TLSCertificateKeyFile) and to ldap.conf (TLS_CACERT) (since my certificate is self-signed). I've started the OpenLDAP server with the command: slapd -d 10 If I issue the command: ldapsearch -x -b 'dc=com' -H 'ldap://localhost/' -D 'uid=root' -W -v And everything works and I see a list of all the directory entries in the server. However, if I issue the same command except with the -ZZ option to use TLS: ldapsearch -x -b 'dc=com' -H 'ldap://localhost/' -D 'uid=root' -W -v -ZZ Then I get an error that reads: ldap_start_tls: Connect error (-11) So I analyzed the debug log coming from the server (during the ldapsearch ... -ZZ command) and I get the debug log below (I've snipped out the actual buffer exchanges for brevity). As you can see, it goes through several handshakes successfully, but then suddenly the server is looking for more data but the client doesn't send it, so the server closes the connection. Can someone please help to analyze this problem so I can get this working. LDAP 2.4.12, OpenSSL 0.9.8i. Thank you in advance for any advice you can offer me. -Eric slap_listener_activate(8): >>> slap_listener(ldap:///) connection_get(12): got connid=0 connection_read(12): checking for input on id=0 ber_get_next ldap_read: want=8, got=8 0000: 30 1d 02 01 01 77 18 80 0....w.. ldap_read: want=23, got=23 0000: 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 31 34 36 .1.3.6.1.4.1.146 0010: 36 2e 32 30 30 33 37 6.20037 ber_get_next: tag 0x30 len 29 contents: ber_dump: buf=0x83881e8 ptr=0x83881e8 end=0x8388205 len=29 0000: 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 ...w...1.3.6.1.4 0010: 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .1.1466.20037 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=0 op=0 do_extended ber_scanf fmt ({m) ber: ber_dump: buf=0x83881e8 ptr=0x83881eb end=0x8388205 len=26 0000: 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e w...1.3.6.1.4.1. 0010: 31 34 36 36 2e 32 30 30 33 37 1466.20037 send_ldap_extended: err=0 oid= len=0 send_ldap_response: msgid=1 tag=120 err=0 ber_flush2: 14 bytes to sd 12 0000: 30 0c 02 01 01 78 07 0a 01 00 04 00 04 00 0....x........ ldap_write: want=14, written=14 0000: 30 0c 02 01 01 78 07 0a 01 00 04 00 04 00 0....x........ connection_get(12): got connid=0 connection_read(12): checking for input on id=0 TLS trace: SSL_accept:before/accept initialization tls_read: want=11, got=11 0000: 80 7a 01 03 01 00 51 00 00 00 20 .z....Q... tls_read: want=113, got=113 <... snip ...> TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write server done A tls_write: want=1105, written=1105 <... snip ...> TLS trace: SSL_accept:SSLv3 flush data tls_read: want=5, got=5 0000: 16 03 01 01 06 ..... tls_read: want=262, got=262 <... snip ...> TLS trace: SSL_accept:SSLv3 read client key exchange A tls_read: want=5, got=5 0000: 14 03 01 00 01 ..... tls_read: want=1, got=1 0000: 01 . tls_read: want=5, got=5 0000: 16 03 01 00 30 ....0 tls_read: want=48, got=48 <... snip ...> TLS trace: SSL_accept:SSLv3 read finished A TLS trace: SSL_accept:SSLv3 write change cipher spec A TLS trace: SSL_accept:SSLv3 write finished A tls_write: want=59, written=59 <... snip ...> TLS trace: SSL_accept:SSLv3 flush data connection_read(12): unable to get TLS client DN, error=49 id=0 connection_get(12): got connid=0 connection_read(12): checking for input on id=0 ber_get_next tls_read: want=5, got=0 ldap_read: want=8, got=0 ber_get_next on fd 12 failed errno=0 (Success) connection_closing: readying conn=0 sd=12 for close connection_close: conn=0 sd=12 --- -Eric Johanson Principle Software Engineer Newpoint Technologies, Inc.

2 1

SASL pass-through autentication with a ldap-backend KDC
by Guillaume Rousse 23 Oct '08

23 Oct '08

Hello list. Reading http://www.openldap.org/doc/admin24/security.html#SASL password storage scheme, I understand autentication can be delegated to an external mechanisme. Such as, for instance, a kerberos server. In this case, it is advised to prevent changing passwords in the directory. What happens if the autentication provider is an heimdal server, using OpenLDAP as its backend, and smbkrb5 overlay to keep ldap, samba and kerberos password synced ? Does pass-through still work ? And it is recommended then to make the userPassword attribute read-ony, but still use Exop PasswordChange to change samba and kerberos attributes ? I didn't tested it yet, but it look very interesting if it works. Particulary because heimdal password change through kpassword doesn't use ExOp PasswordChange operation, but only update kerberos and samba passwords. I know smbkrb5 has a special {smbkrb5} password storage scheme for redirecting autentication against kerberos password internally, not relying on a external SASL process. But it's only usable if smbkrb5 overlay is available (some of our slaves servers are centos-based, and don't have this overlay, but still need to autenticate users). And the trick of setting password-hash directive in slapd.conf to {smbkrb5} to prevent overwriting of userPassword attribute on PasswordChange operation with a normal value has the drawback than even pure ldap administrative accounts (syncrepl, for instance) get redirected to kerberos password for autentication, whereas only our users have principals currently. -- Guillaume Rousse Moyens Informatiques - INRIA Futurs Tel: 01 69 35 69 62

2 5

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software