openldap-software

openldap-software@openldap.org

2719 discussions

FW: Chaining
by Jorge Medina 02 Jul '08

02 Jul '08

I mean, I get "TLS negotiation failure" on the syslog when attempting to change an attribute on an entry when using the slave server. -----Original Message----- From: Jorge Medina Sent: Tuesday, July 01, 2008 5:08 PM To: openldap-software(a)openldap.org Subject: RE: Chaining I am trying to create a master-slave replication with chaining overlay enabled in the slave to redirect writes request to the master. I have it working using ldap:// but I have not been able to configure the chain overlay using a secure connection ldaps:// (running on port 5636 on the master) My master server do not require client certificates., I added the following lines: overlay chain chain-uri "ldaps://masterldap.example.com:5636" chain-idassert-bind bindmethod="simple" binddn="cn=Manager,dc=example,dc=com" credentials="secret" mode="self" tls_cacert="/path/to/my/CA/cert.pem" chain-return-error TRUE But I get "TLS negotiation failure" on the syslog I am using ldaps:// for replication, but I can't configure it for chaining Any hints? -----Original Message----- From: Gavin Henry [mailto:ghenry@suretecsystems.com] Sent: Tuesday, July 01, 2008 3:55 AM To: Jorge Medina Cc: openldap-software(a)openldap.org Subject: Re: Chaining <quote who="Jorge Medina"> > One more question, this time on the chaining overlay. > > > > > > "What is chaining? It indicates the capability of a DSA to follow > referrals on behalf of the client, so that distributed systems are > viewed as a single virtual DSA by clients that are otherwise unable to > "chase" (i.e. follow) referrals by themselves." > > > > In the example shown at > http://www.openldap.org/doc/admin24/overlays.html#Chaining > > > > Is the chaining overlay example used to forward write > requests from the syncrepl slaves to the master server? > Yes, correct. -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP.

1 1

reg ldap over ssl
by prasanth allada 02 Jul '08

02 Jul '08

Hi i am trying to start an ldap connection over SSL my code goes like this. ldap_init(host,LDAPS_PORT); ldap_set_option() ldap_start_tls_s(handle,null,null); when i call the ldap_start_tls_s() i get an error saying tat it cant contact the ldap server. can u please tell me wat all options to set before i start the tls connection. i have the CA certificate and the server certificate. Can you tell me which certificate should i use in the code. Thanks and Regards Prasanth

2 3

ppolicy/value #0 not allowed
by Jeff Adams 02 Jul '08

02 Jul '08

I'm using CentOS 5 with openldap 2.3, built from SRPMS to get the overlays. The first time I tried to create policies for ppolicy, it complained about the syntax. Google led me in the right direction and I replaced "userPassword" in the ldif file with the UID, 2.5.4.35. But now the password policies are not working and I get this message in the logs: send_search_entry: conn 102 access to attribute userPassword, value #0 not allowed This looks like the error I saw when I tried to use ldapadd on a ppolicy ldif that contained "userPassword" instead of the UID. What do I need to do differently? Any help or guidance would be appreciated.

2 1

Allow other users to manage entries
by Rakotomandimby Mihamina 02 Jul '08

02 Jul '08

Hi all, I use OpenLDAP on an Ubuntu system. I followed this document for the installation: https://help.ubuntu.com/community/OpenLDAPServer Now, I would like to allow a couple of users to manage entries (add, del, edit) without sharing the same "rootpw". I miss some keywords for my search. Would you help, please? But if you know any webpage, I would also be happy you point it me out. -- Huile Essentielle de Camphre http://www.huile-camphre.fr Infogerance http://www.infogerance.us (Serveurs, Postes de travail, Développement logiciel)

2 1

LDAP proxy to dynamicly chosen server
by Peter Mogensen 02 Jul '08

02 Jul '08

Hi, I have a scenario where I would like an LDAP proxy which looks at the base DN and generated a LDAP URI to proxy to dynamicly. I have several 100.000 potential URIs and they change constantly, so hardwiring them in slapd.conf is not an option. Example: An search request arrives for this base "dc=host1,dc=mutex,dc=dk". The proxy should proxy the request to: ldap://host1.mutex.dk/dc=host1,dc=mutex,dc=dk/ ... and so on for host2-<very high number> (no I don't have 200000 LDAP-servers but I have 200000 DNS entries to which server I do not kontrol the mapping) I though I had to write a back-perl module, but I've been looking at slapd-meta and I see that it can rewrite to URIs: "In case the rewritten DN is an LDAP URI, the operation is initiated towards the host[:port] indicated in the uri, if it does not refer to the local server" But I can't get this to work. slapd-meta insists on having a "uri" directive which doen't make sense in my scenario and if I add a dummy "uri" it seems to try to connect to that server. There might of course be some idea in reusing TCP connectiontions and that would be nice, since in reality there's only 3-4 servers answering request, but they are identified by 3-400.000 DNS entries. Am I missing something? Is this possible with slapd-meta? Or do I have to write a back-perl module? regards, Peter

2 2

Meta backend
by Andrew Graham 01 Jul '08

01 Jul '08

*** Before acting on this email or opening any attachment you are advised to read the disclaimer at the end of this email *** Some questions about the back-meta... 1. According to ITS 3785, any filter that cannot be successfully parsed is rewritten to include "(!(objectClass=*))" before being propagated to any target, always producing an empty result. My problem is that one of my target servers throws a wobbly when it receives a query with this filter, and takes around 15 seconds to respond with the empty result. Is there any way of circumventing this behaviour? 2. Two of the target servers return search references for every query. As these are of no use in this application, is there some way to stop openldap from returning these references to the client? 3. Just out of interest, are there any plans to enable dynamic config functionality for back-meta? Thanks, Drew Andrew Graham AgustaWestland UK andrew.graham(a)agustawestland.com *** Disclaimer *** The information contained in this E-Mail and any subsequent correspondence may be subject to the Export Control Act (ECA) 2002. The content is private and is intended solely for the recipient(s). For those other than the recipient any disclosure, copying, distribution, or action taken, or omitted to be taken, in reliance on such information is prohibited and may be unlawful. If received in error please return to sender immediately. Under the laws of England misuse of information that is subject to the ECA 2002, is a criminal offence. Westland Helicopters Ltd Lysander Road Yeovil BA20 2YB England Registered in England under No 604352

2 1

segfaults with syncrepl
by Liutauras Adomaitis 01 Jul '08

01 Jul '08

hello everybody, I'm quite new to OpenLdap. Actually i've been using it for a few years, but I have no deep knowlege. The problem I'm facing is my cosumer replicas are segfaulting. My design: I have one master with several o=BranchX,dc=example,dc=com This is provider. I have several (the number is X-1) replicas, consumers. All consumers are replicating its branch o=BranchX,dc=example,dc=com and one common branch o=BranchMain,dc=example,dc=com. The picture is like this: Provider o=BranchMain,dc=example,dc=com o=Branch1,dc=example,dc=com o=Branch2,dc=example,dc=com ..... o=BranchX,dc=example,dc=com Consumer 1: o=BranchMain,dc=example,dc=com o=Branch1,dc=example,dc=com Consumer 2: o=BranchMain,dc=example,dc=com o=Branch2,dc=example,dc=com At the begining I had one consumer, which was segfaultin just randomly once or twice a day. I decided to comment out my syncrepl directives in conf file and now it is running for a day and half. I should mention, that after cosumer segfaults I cannot start slapd any more. The only solution I have is to delete ol /var/lib/ldap (all database) directory contents and then restarting slapd. If restarting slapd on the old database - segfaulti is happening. Since this was a smaill branch and only one branch I thought to debug the problem later. Today I faced the same situation on a biger consumer. The same situation. slapd just crashed and only deleting database helped me to start it again. My systems are Mandriva 2008.1 with slapd version: @(#) $OpenLDAP: slapd 2.4.8 (Mar 23 2008 16:49:39) $ mandrake(a)klodia.mandriva.com: /home/mandrake/rpm/BUILD/openldap-2.4.8/servers/slapd I have one branch runing old slapd versions (the ones comming with Mandriva 2007.0), but they seem to work except that I can have replicated only one branch (one rid). Seems old slapd doesn't support several rids. Can anybody help me to debug this situation? This configuration is rather new but I was thinking to build all infrastructure on such a configuration, so segfaulting is very big issue. Provider (master) configuration is: include /usr/share/openldap/schema/core.schema include /usr/share/openldap/schema/cosine.schema include /usr/share/openldap/schema/corba.schema include /usr/share/openldap/schema/inetorgperson.schema include /usr/share/openldap/schema/nis.schema include /usr/share/openldap/schema/openldap.schema include /usr/share/openldap/schema/samba.schema include /usr/share/openldap/schema/qmail.schema include /etc/openldap/schema/local.schema include /etc/openldap/slapd.access.conf access to dn.subtree="dc=example,dc=com" by group="cn=Replicator,ou=Group,dc=example,dc=com" by users read by anonymous read pidfile /var/run/ldap/slapd.pid argsfile /var/run/ldap/slapd.args modulepath /usr/lib64/openldap moduleload syncprov.la TLSRandFile /dev/random TLSCipherSuite HIGH:MEDIUM:+SSLv2+SSLv3 TLSCertificateFile /etc/pki/tls/certs/slapd.pem TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem TLSCACertificatePath /etc/pki/tls/certs/ TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt TLSVerifyClient never # ([never]|allow|try|demand) database bdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw secret directory /var/lib/ldap checkpoint 256 5 index mailAlternateAddress eq,sub index accountStatus,mailHost,deliveryMode eq index default sub index objectClass eq index cn,mail,surname,givenname eq,subinitial index uidNumber,gidNumber,memberuid,member,uniqueMember eq index uid eq,subinitial index sambaSID,sambaDomainName,displayName eq index entryCSN,entryUUID eq limits group="cn=Replicator,dc=infosaitas,dc=lt" size=unlimited time=unlimited access to * by group="cn=Replicator,dc=infosaitas,dc=lt" write by * read overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 10 Consumers configuration (all the same): include /usr/share/openldap/schema/core.schema include /usr/share/openldap/schema/cosine.schema include /usr/share/openldap/schema/corba.schema include /usr/share/openldap/schema/inetorgperson.schema include /usr/share/openldap/schema/nis.schema include /usr/share/openldap/schema/openldap.schema include /usr/share/openldap/schema/samba.schema include /usr/share/openldap/schema/qmail.schema include /etc/openldap/schema/local.schema include /etc/openldap/slapd.access.conf include /etc/openldap/slapd.access.ldapauth.conf access to dn.subtree="dc=example,dc=com" by group="cn=Replicator,ou=Group,dc=example,dc=com" by users read by anonymous read pidfile /var/run/ldap/slapd.pid argsfile /var/run/ldap/slapd.args modulepath /usr/lib64/openldap moduleload back_ldap.la TLSCertificateFile /etc/ssl/openldap/ldap.pem TLSCertificateKeyFile /etc/ssl/openldap/ldap.pem TLSCACertificateFile /etc/ssl/openldap/ldap.pem overlay chain chain-uri "ldap://master.server" chain-idassert-bind bindmethod="simple" binddn="cn=Manager,dc=example,dc=com" credentials=secret mode="none" chain-tls start chain-return-error TRUE database bdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw secret directory /var/lib/ldap checkpoint 256 5 index objectClass eq index mailAlternateAddress eq,sub index accountStatus,mailHost,deliveryMode eq index default sub index cn,mail,surname,givenname eq,subinitial index uidNumber,gidNumber,memberuid,member,uniqueMember eq index uid eq,subinitial index sambaSID,sambaDomainName,displayName eq limits group="cn=Replicator,ou=Group,dc=example,dc=com" size=unlimited time=unlimited syncrepl rid=1 provider=ldap://master.server:389 type=refreshAndPersist retry="60 +" searchbase="o=BranchMain,dc=example,dc=com" filter="(objectClass=*)" scope=sub attrs=* schemachecking=off bindmethod=simple binddn="cn=Manager,dc=example,dc=com" credentials=secret starttls=yes syncrepl rid=2 provider=ldap://master.server:389 type=refreshAndPersist retry="60 +" searchbase="o=Branch1,dc=example,dc=com" filter="(objectClass=*)" scope=sub attrs=* schemachecking=off bindmethod=simple binddn="cn=Manager,dc=example,dc=com" credentials=secret starttls=yes updateref ldap://master.server Thanks for any hints on this Liutauras

4 5

Last bind timestamp?
by Pat Riehecky 01 Jul '08

01 Jul '08

At the university we have massive account creep. Alumni keep their accounts and terminated employees would never do anything bad so I generally don't get informed when the leave, drop outs aren't even tracked so who knows... Right now I estimate about 700 accounts that should not even exist. That being said, I would like to reclaim some sanity in my account system. For political reasons I can only ask for one account to be checked for validity at a time... could take a few years to filter through them all.... Thus was a plan hatched.... If there was a way I could store the timestamp of the last successful bind by this user in their entry (similarly to lastmod or create date) then after a year or three anyone who has no entry would be a candidate for further investigation.... Is there a way to make openldap store this data for me? Or must I write some C for an overlay (direct integration into the bind code seems a bad idea since if you don't need this why let it slow you down, and my C is more than a bit rough around the edges)? Pat OpenLDAP 2.4.10 on Linux for what it is worth.

2 4

userPasswd Attribute
by Net Warrior 01 Jul '08

01 Jul '08

Hi there guys, what I'm going to ask may be is insane, and I'm awaiting the storm to come :) I know that there is a directive/option password-hash that allows me to store the password in plain taxt for example or whatever I want. As far as I know, this only apllies to the server, If I set up a replication server, is there a way to tell the replication server to store in difefferent format , for exmaple, to store them in plain text? or at least for a especific user via ACL to store it's password in plain text? Thanks for your time and support.

2 1

RE: Mirror Mode
by Jorge Medina 01 Jul '08

01 Jul '08

Also, e) How does the load balancer knows what mirror to use and when to switch to the other? -----Original Message----- From: Jorge Medina Sent: Monday, June 30, 2008 4:39 PM To: 'openldap-software(a)openldap.org' Subject: Mirror Mode Hi, I am trying to configure OpenLDAP in mirror mode. From what I understood, the documentation suggests having two servers configured in mirror mode, plus a set of replicas. (As shown in the diagram at the end of the page at http://www.openldap.org/doc/admin24/replication.html#Configuring%20the%2 0different%20replication%20types) The documentation suggests that the backend LDAP module can be used as the load balancer. Nevertheless the documentation is missing the sections on configuring this module. http://www.openldap.org/doc/admin24/backends.html#LDAP a) I am assuming the replicas are just read-only replicas. Right? b) If a client requires to write to the directory, how are these request forwarded to the active mirror? c) Does anyone knows how to configure the LDAP backend to act as a proxy? d) Is mirror mode mature? Is it ready for production use? Any help or pointers are appreciated. -Jorge

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software