openldap-software

openldap-software@openldap.org

2719 discussions

Building with MSYS/MinGW
by Pierangelo Masarati 06 Aug '08

06 Aug '08

I'm building OpenLDAP with MSYS/MinGW. Tests fail because apparently slapd is unable to handle full path files. For example, "directory /home/masarati/ldap-devel/tests/testrun/db.1.a" does not work, but if I rename it to "directory ./testrun/db.1.a" it works fine. I don't have version info handy right now, I just wanted a quick feedback: is this a known issue, or did I forget anything while installing MSYS/MinGW, or am I missing something trivial? I can look at this later, if any additional info is needed. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

2 2

Re: Authenticated users can create new entries but then only creator can modify entry
by fathi.engineer＠gnet.tn 06 Aug '08

06 Aug '08

Hi, Thinking of my subtree as a file system directory, I understood what you meant by your answer and this the solution to my problem: access to dn="ou=PGP Keys,o=SNCFT,c=TN" by users write by * read access to dn.children="ou=PGP Keys,o=SNCFT,c=TN" by dnattr=creatorsName write by * read Now, an authenticated user can create a new entry but can't overwite someone else's entry. Thank you. Fathi B.N.

1 0

Re[2]: N-Way replication
by Alexander Kriventsov 06 Aug '08

06 Aug '08

Вы писали 6 августа 2008 г., 3:29:41: > --On Tuesday, August 05, 2008 6:29 PM +0400 Alexander Kriventsov > <akriventsov(a)masterhost.ru> wrote: >> >> Hello. >> I'm trying to do N-way replication, and I have some strange issue with >> replication. >> I have two servers ldap1 and ldap2. In ldap1 I did these: > OpenLDAP release? OpenLDAP 2.4.11 - Freebsd 7.0 - amd64 > --Quanah > -- > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration -- Best Regards, Alexander Kriventsov .masterhost

1 0

attrs.regex?
by Pat Riehecky 06 Aug '08

06 Aug '08

In the interest of simplifying my life I was going to convert one of my crazy ACLs to a regex (and a rather trivial one at that), but I am finding a bit of an issue... seems I have misread the doc and am not sure where... I was aiming for something along the lines of: anything that has an attribute name of IWU with something else attached afterward would be captured (in practice my perl says I want /^IWU.*/ but for now the simple and later the hard as first character on the line matching can be added later once syntax errors go away) Thus I wrote: access to dn.sub="dc=testldap,dc=iwu,dc=edu" attrs.regex="IWU.*" by self read by * none However, I get a happy syntax error on this line. That is fair as on a closer reading of the syntax I have come to the conclusion that attrs.regex is nonsense and that the regex entry near the attrs list relates to values. Am I right? Is there no way to do attrs regex matching? OpenLDAP 2.4.11 Pat

2 1

Authenticated users can create new entries but then only creator can modify entry
by fathi.engineer＠gnet.tn 05 Aug '08

05 Aug '08

Hi, In the proccess of setting up an openldap server as a pgp key server, I want to grant access to every authenticated user to create a new entry in a subtree of the basedn and every body to read entries in that subtree but only creator to be able to modify his entries. I tried with the following (unsuccessfully): access to dn.children="ou=PGP Keys,o=SNCFT,c=TN" by dn.regex="^uid=([^,]+),(ou=[^,]+,)+ou=Users,o=SNCFT,c=TN$" selfwrite by dn.regex="^uid=([^,]+),ou=Users,o=SNCFT,c=TN$" write by * read and also by dnattr=owner selfwrite by users write by * read but none worked. I am running openldap-2.3.27-8.el5_2.4 TIA Fathi B.N.

1 0

Re: slapd does not start, where do I find the error?
by Buchan Milne 05 Aug '08

05 Aug '08

On Monday 04 August 2008 22:08:16 Brad Knowles wrote: > Buchan Milne wrote: > > See the repo file for some information on how to install: > > http://staff.telkomsa.net/packages/OpenLDAP.repo > > Out of curiosity, how do you configure this repo to be used? I tried > putting it into /etc/sysconfig/rhn/sources on a RHEL4 box, and it doesn't > seem to work as either a yum-style or apt-style repo, so up2date ends up > barfing on it. RHEL4 is quite depressing, we use smart on our RHEL4 boxes (so that we have a feature that was available on Mandrake 7.0, in 2000, being able to install packages on the installation media after installation), but the repo file is actually for yum. Unfortunately, up2date on RHEL4 doesn't understand the new RPM meta-data repo as used by yum/smart etc., only the old legacy yum 1.x format. Let me see if I can run yum-arch on the repo ... > Is there additional documentation somewhere that I've missed?

1 0

effective rights, was: Determine current access level
by Simon Victor 05 Aug '08

05 Aug '08

Hi, > What about trying to modify/delete it with the noop control? that is a good tip, thank you at all. i will try to implement this, but i think this is some kind of "hack" anyway. additionally i will check if a solution with the aci's is also possible. googling around i've found a control named "effective rights": https://opends.dev.java.net/public/standards/draft-ietf-ldapext-acl-model.t… is this supported by openldap? many thanks for your suggestion regards, s.

3 5

Re: OpenLDAP questions
by Michael Ströder 05 Aug '08

05 Aug '08

Kristen Walker wrote: > Another possibility would be to sync the LDAP server with our Mysql > database, that way we could keep adding users as we do now and sync > them nightly with the LDAP server. Would be a better approach than messing around with CSV files. > Does anyone do this? Very simple example script for such a sync implemented in Python: http://www.stroeder.com/pylib/egadr2ldap.py Your mileage may vary. Ciao, Michael.

1 0

Proxy Auth Question
by Yeargan Yancey 04 Aug '08

04 Aug '08

My goal is to configure OpenLDAP as a proxy to provide e-mail addresses to the public (via anonymous simple binds) using an LDAP back-end which requires authenticated simple binds. Public ccess to this server will be anonymous only and read-only. All non-anonymous bind attempts are transformed to anonymous using authz- regexp ".+" "dn:". However, I need all binds to the back-end LDAP service to use a specific account. I've looked at the docs and the list archives for information related to "idassert-bind" but I'm not understanding it well enough. I tried this ... idassert-authzFrom "dn:*" idassert-bind bindmethod="simple" binddn="cn=info,o=org" credentials="password" but that does not seem to be working for me. I'm getting anonymous binds on the back-end. Is it possible to do what I'm asking? If so, what am I doing wrong? Thanks, Yancey

2 1

restoring an accesslog database
by Emmanuel Dreyfus 04 Aug '08

04 Aug '08

Hello I'm trying to restore an accesslog database, and it badly breaks: slapadd -b cn=accesslog -f /etc/openldap/slapd.conf -l accesslog.ldif (...) str2entry: invalid value for attributeType reqControls #0 (syntax 1.3.6.1.4.1.4203.666.11.5.3.1) Any hint? -- Emmanuel Dreyfus manu(a)netbsd.org

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software