openldap-software

openldap-software@openldap.org

2719 discussions

strange bind error
by Dieter Kluenter 14 Aug '08

14 Aug '08

Hi, I just updated to 2.4.11 and experience a strange bind error. A strong bind with sasl digest-md5 is successfull but a simple bind fails with error 49. Actually I found it only out because evolution was not able to connect to ldap anymore. Following I unvail the real password: 1. a ldapwhoami, ldapwhoami -Y digest-md5 -w mailer -U admanager SASL/DIGEST-MD5 authentication started SASL username: admanager SASL SSF: 128 SASL data security layer installed. dn:cn=admanager,o=avci,c=de 2. a ldapsearch with simple bind ldapsearch -d-1 -x -D "cn=admanager,o=avci,c=de" -w mailer -H ldap://localhost -b ou=adressbuch,o=avci,c=de "(&(objectclass=evolutionperson)(sn=*))" mail telephonenumber ber_dump: buf=0x61c460 ptr=0x61c460 end=0x61c48c len=44 0000: 30 2a 02 01 01 60 25 02 01 03 04 18 63 6e 3d 61 0*...`%.....cn=a 0010: 64 6d 61 6e 61 67 65 72 2c 6f 3d 61 76 63 69 2c dmanager,o=avci, 0020: 63 3d 64 65 80 06 6d 61 69 6c 65 72 c=de..mailer ldap_msgfree ldap_err2string ldap_bind: Invalid credentials (49) Any idea what is going on? -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6 53°08'09,95"N 10°08'02,42"E

2 2

User quota on openldap
by fathi.engineer＠gnet.tn 14 Aug '08

14 Aug '08

Hi, Having solved my previous problem (Authenticated users can create new entries but then only creator can modify entry) which resembles setting up a sticky bit on a file system directory, I am facing a new one: How to limit the number of entries an authenticated user can add to a subtree where he has write access. Think of it as limiting the number of entries on a user's addressbook to prevent denial of service by a user submitting a huge amount of addressbook entries or bookmark entries for an bookmark manager based on openldap. Is there a way for openldap to count the number of entries a user has added before deciding whether to grant or deny write access to that user but always allow him to modify/delte existing entries.

2 1

delta-syncrepl only replicates some data (attempting N-way master)
by Pat Riehecky 14 Aug '08

14 Aug '08

When I add a user to one of my test openldap systems (2.4.9), some but not all, of that user's attributes are propagated. The big obvious one is userPassword. When I play around with the settings I have been able to figure out that the only attributes being migrated are ones which are visible to anon binds. This doesn't make any sense to me. When I do an ldapsearch as the user I setup for syncrepl I can see everything in the user's ldif as well as in cn=accesslog. The sync user can see the attributes, and I haven't limited what syncrepl will pull down.... any guesses as to what I have overlooked? Pat ----------------------------- syncprov-checkpoint 100 10 syncprov-sessionlog 200 syncprov-nopresent TRUE syncprov-reloadhint TRUE # <snip> serverID 2 syncrepl rid=1 provider=ldaps://testldap1.iwu.edu/ searchbase="dc=testldap,dc=iwu,dc=edu" scope=sub type=refreshAndPersist interval=00:00:00:30 retry="15 +" timeout=1 bindmethod=simple # starttls=critical tls_cert=/etc/ldap/ssl/testldap.iwu.edu.crt tls_key=/etc/ldap/ssl/testldap_privkey.key tls_cacert=/etc/ldap/ssl/IWU.crt tls_reqcert=demand tls_crlcheck=none binddn="cn=syncrepl,dc=testldap,dc=iwu,dc=edu" credentials=please schemachecking=off syncdata=accesslog logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" mirrormode on

3 2

Ppolicy locking and replication
by Jiri Netolicky 13 Aug '08

13 Aug '08

Hi, I have a one master and two slaves servers 2.3.27 from RHEL 5.2. Replication is done by syncrepl. Now I have to use password policy overlay and account locking after few unsuccessful bind. When the bind is on master server, everything works ok - the lock i replicated to the slaves. But when the user binds on slave, the lock is only on the slave and the account on master and second slave is unlocked. What is the best solution of this problem? I think some kind of multiple-master replication of pwdAccountLockedTime and pwdFailureTime from slaves? But multiple-master is since 2.4 version isnt' it? Many thanks for advice, Netolish

2 1

OpenLdap version 2.4.11
by Antonio Coloma Brotons 13 Aug '08

13 Aug '08

Hi All! I want to use mirror mode feature in openldap software. But this feature is only in version 2.4.11 (not stable yet) ... Anybody is using 2.4.11 version in a producction environment? Any problems? My purpose is to have 2 nodes (master - master) like a cluster active - active. If a ldap-master fails I can make all ldap operations in the other master. This is possible in 2.4.11 mirror mode ... It's possible in 2.3 stable openldap software? how? Thanx in advance. -- Antonio Coloma.

3 2

A strange dn
by Ed Greenberg 13 Aug '08

13 Aug '08

I'm bringing up openldap, and I have almost everything working except: The servers have an existing ldap.conf of: uri ldap://ldap001.example.com ldap://ldap002.example.com base dc=example,dc=com binddn uid=server,cn=config bindpw xxxxxx ldap_version 3 ...etc... I'm having trouble figuring out how to create a user that looks like: uid=server,cn=config,dc=example,dc=com I'd prefer not to visit all the servers to change their ldap.conf files, rather, I'd like to swap out the name service records to point to openldap. To do this, I need to create the uid=server,cn=config user. Any suggestions? Do I have to build up a new schema entry? Thanks, </edg> Ed Greenberg

3 2

slapd breaks NSS, NSS breaks slapd
by manu＠netbsd.org 13 Aug '08

13 Aug '08

Hello I have a machine where slapd will not start if ldap://localhost is listed in /etc/nss_ldap.conf. It just hangs: # slapd -u slapd -h ldap://localhost -d5 @(#) $OpenLDAP: slapd 2.4.8 (Jun 24 2008 04:21:32) $ root@:/pkg_comp/obj/pkgsrc/databases/openldap-server/default/openldap-2. 4.8/servers/slapd daemon_init: ldap://localhost daemon_init: listen on ldap://localhost daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap://localhost) daemon: listener initialized ldap://localhost daemon_init: 2 listeners opened ldap_create ldap_url_parse_ext(ldap://127.0.0.1) ldap_create ldap_url_parse_ext(ldap://127.0.0.1) ldap_create ldap_url_parse_ext(ldap://127.0.0.1) ldap_simple_bind ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 127.0.0.1:389 ldap_new_socket: 8 ldap_prepare_socket: 8 ldap_connect_to_host: Trying 127.0.0.1:389 ldap_pvt_connect: fd: 8 tm: 30 async: 0 ldap_ndelay_on: 8 ldap_int_poll: fd: 8 tm: 30 If I remove ldap://localhost from nss_ldap.conf, is works fine. Any idea how to get that working? Here is nss_ldap.conf: BASE dc=example,dc=net URI ldap://localhost ldap://ldap.example.net TLS_CACERT /etc/openssl/certs/ca.crt TLS_REQCERT demand -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

10 16

Multi Master doesn't replicate everything
by Pat Riehecky 12 Aug '08

12 Aug '08

I have gotten two boxes setup in multi master and was loading up my test data when I noticed everything isn't being replicated. In particular the entire ou=idmap tree is being sent, but not recorded. When I put slapd into debug I can see the system receiving the entire tree, but it doesn't seem to be trying to insert it into the database. After it pulls the data over I get an error do_syncrep2: cookie=rid=001,sid=002,csn=20080807221724.788347Z#000000#001#000000 do_syncrep2: rid=001 CSN too old, ignoring 20080807221724.788347Z#000000#001#000000 ldap_msgfree Which is telling me the entry is being flagged as older than it should be for getting transferred over. Slapd is doing the efficient thing and skipping entries that /should/ be on the other system already. My problem is that it isn't on the other system. I realize that the replication work is done off of the UUID and CSN, but about 30% of my replication test came back with the CSN too old message. I am just sort of wondering, is there a way to have openldap say, "Hey, I realize this CSN is old and everything, but this is a dn on the one of us that isn't on the other." Is there something I can do to bulk update the CSNs (fully expecting downtime and horrid performance as loads of needless replications happen)? From my perspective, I would rather have rather horrid performance and a trustworthy mirror than it run like a dream and not have my trust. OpenLDAP 2.4.11 Pat

2 1

dynlist with back-config examples
by Jeff Strunk 09 Aug '08

09 Aug '08

Is anyone using the dynlist overlay and back-config? The slapo-dynlist man page says it supports configuration via back-config, but it does not say how. My searches have only come up with old messages from before the overlay supported back-config and the man page. So far, I have added "olcModuleLoad: {2}dynlist.la" to cn=module{0},cn=config . After reloading, I checked cn=subschema for olcDLattrSet which I found in the dynlist source, but it wasn't there. I think I would to add the following entry: dn: olcOverlay={1}dynlist,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: top olcOverlay: {1}dynlist olcDLattrSet: groupOfURLs memberURL When I try, I get: adding new entry "olcOverlay={1}dynlist,olcDatabase={1}hdb,cn=config" ldap_add: Object class violation (65) additional info: attribute 'olcDLattrSet' not allowed What is the right way to do this? I am using OpenLDAP 2.4.9 on ubuntu hardy built with openssl. Thank you, Jeff

2 1

Not all ports are open in debug mode?
by Pat Riehecky 09 Aug '08

09 Aug '08

I am trying to troubleshoot a sync related issue (which is still in progress) so I do the sane thing and launch slapd by hand with -d 16384, but when I do this it doesn't seem to open the 636 port.... It seems like it should as I am running: /usr/sbin/slapd -h ldap:/// ldaps:/// ldapi:/// -g openldap -u openldap -f /etc/ldap/slapd.conf -d 16384 When I do not launch it with debugging on 636 is opened.... What obvious thing am I missing? OpenLDAP 2.4.11 Pat

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software