openldap-software

openldap-software@openldap.org

2719 discussions

Fw: Referral - not chased - working as designed?
by Brad T Waldorf 18 Jun '08

18 Jun '08

Hi... First, let me apologize if this isn't the right place to ask this question. If it isn't, i'd greatly appreciate any suggestions on a forum to which i can post this (and any future OpenLDAP questions). I'm wondering what the "normal" function of a referral is supposed to be. I (probably mistakenly) assumed that a referral is a way to specify a server (say server B) to which your search request is forwarded (from server A) if the search criteria isn't matched on server A.... And the data is then searched for on server B and returned to server A. (In slapd.conf on server A, i have a referral value of server B.) But all i get is the "referral (10)" result on server A... Referral (10) Referral: ldap://(IP address of server B):389/o=TPFstooge??sub The documentation says ... H.12. referral (10) Indicates that a referral needs to be chased to complete the operation (see Section 4.1.10). Well, right... but isn't server A supposed to do the chasing? Or is the referral simply a value that's passed back to server A, and not chased? (And you should use the "ldap" backend if you want your referalls chased?) Sorry if this was a dumb question. I'm probably mistakenly assuming that referrals are automatically chased, when their only function is to simply return a value. Thanks for your time!

2 1

use dynlist for company name? A question of practical use of dynlist
by Zhang Weiwu 18 Jun '08

18 Jun '08

Hello. I am setting up a business directory of contact persons and companies. I have this structure in mind: ou=companies,dc=demo o=company name 1, ou=companies,dc=demo o=company name 2, ou=companies,dc=demo ... ou=persons,dc=demo uid=user1,ou=persons,dc=demo cn: John Brown o: company name 1 ... uid=user2,ou=persons,dc=demo cn: Jason Brown o: company name 2 ... ... My problem: the system is multi-lingual, means each company can have multiple company names, and most of them do, because we are in a cross-culture location where each company must have two names. Thus maintaining correspondence between person's "o" value is a lot of work. The other trouble: If a company updates its name, all person records should update too. My idea to solve this problem is to use dynlist, that is for each person the organization he works in is a dynamic list which returns the o attribute value of the company by referring to the company with URI. Before I actually implement in this way I'd like to ask the list for wisdom. I 'invented' this solution by just looking at the manual of dynlist and not being aware if it brings some down-side (e.g. is the attribute that implements dynlist searchable? a.k.a. can I still search for Jason in "company name 2" with a single filter?) Anyway, do you think this solution works & is practical?

2 1

Re: managing OpenLDAP / back-config
by Michael Ströder 17 Jun '08

17 Jun '08

Hallvard B Furuseth wrote: > Michael Ströder writes: >> Since web2ldap and the delta-modification generator has full schema >> knowledge today I could look up whether there's an EQUALITY matching >> rule defined for a given attribute type and then explicitly delete >> certain attribute values like Hallvard suggested. > > Actually I wasn't suggesting that for web2ldap, though it sounds nice. > At the time I was talking about how EQUALITY rules would make it easier > to write config LDIFs by hand. I've now implemented that. Needs testing with other LDAP server implementations as well and many weird attribute types. The main problem with such an approach is that subschema is always incomplete. :-( Ciao, Michael.

3 3

reverse membership and permissions
by Jason Dusek 17 Jun '08

17 Jun '08

I'm curious about the intended permissions model for reverse group membership: http://www.openldap.org/doc/admin24/overlays.html#Reverse%20Group%20Members… Consider the case where a user should only have write access to their own attributes and a friends groups to which they can add their friends. The reverse group membership overlay is used to propogate `memberOf` of attributes to all the users that they add to their group of friends. We do it this way because 'denormalizations' of this kind are helpful for query efficiency. For this application, it seems right for the overlay to propogate changes that a user does not have permission to execute themselves -- we don't have to let a user know who anybody else's friends are, for example; nor can they change that attribute. If this can be added, it'd be great. If it's already possible, I'd appreciate it if it were part of the documentation. -- _jsn

2 2

slapauth - requires SASL support?
by Brad T Waldorf 17 Jun '08

17 Jun '08

Hi Sorry again if this is the wrong place for OpenLDAP questions. I've got a question about slapauth... We don't have SASL support enabled. The immediate question is... does slapauth require SASL support? (I've seen a bunch of SASL references in my quest to find some slapauth examples on the web.) So here's the only slapauth example i've been able to find (repeatedly) .... The command /usr/local/sbin/slapauth -f //usr/local/etc/openldap/slapd.conf -v \ -U bjorn -X u:bjensen tests whether the user bjorn can assume the identity of the user bjensen provided the directives authz-policy from authz-regexp "^uid=([^,]+).*,cn=auth$" "ldap:///dc=example,dc=net??sub?uid=$1" are defined in slapd.conf(5). I've read the authz-policy and authz-regexp descriptions in the slapd.conf man page, but i'm relatively new to OpenLDAP, and admittedly don't understand much of those descriptions. I've been trying the following command, which i think should yield a successful authorization, but the authorization fails. /usr/local/sbin/slapauth -v -f /usr/local/etc/openldap/slapd.conf -U "cn=BDB1man,o=BDB1" -X u:"cn=John Thayer,o=BDB1" bdb_monitor_open: monitoring disabled; configure monitor database to enable <= bdb_equality_candidates: (objectClass) not indexed <= bdb_equality_candidates: (objectClass) not indexed ID: <cn=BDB1man,o=BDB1> authcDN: <uid=cn\3Dbdb1man\2Co\3Dbdb1,cn=auth> authzDN: <uid=cn\3Djohn thayer\2Co\3Dbdb1,cn=auth> authorization failed "cn=BDB1man,o=BDB1" is my rootdn, and "cn=John Thayer,o=BDB1" is an entry in the o=BDB1 tree.: My database declaration in slapd.conf is as follows... database bdb suffix "o=BDB1" rootdn "cn=BDB1man,o=BDB1" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw plop timelimit 1 idletimeout 4 # The userPassword attribute is writeable by the entry itself and # "StoogeAdmin". It may be used for authentication purposes, but # is otherwise not readable access to attrs=userPassword by self write by anonymous auth by dn.base="cn=BDB1man,o=BDB1" write by * none # All other attributes are writeable by the entry itself and # "StoogeAdmin", and may be read by all users access to * by self write by dn.base="cn=BDB1man,o=BDB1" write by * read # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index sn,mail,uid,title eq So since i allow "cn=BDB1man,o=BDB1" write access to everything, i was thinking he should be able to assume the identity of "cn=John Thayer,o=BDB1", and the slapauth authorization should be allowed. But if slapauth requires SASL support, then this whole thing is easily explained. (that would be why the authorization is failing right?) Thanks in advance for your help!

1 0

Re: openldap
by Michael Ströder 17 Jun '08

17 Jun '08

Aravind Arjunan wrote: > ldap_modify: Cannot modify object class (69) > additional info: structural object class modification from > 'person' to ' > inetOrgPerson' not allowed You cannot change a structural object class. 'person' and 'inetOrgPerson' are both structural object classes with the latter derived from the former. In this case you have to delete and re-add the entries. See also: http://www.openldap.org/faq/data/cache/1341.html Ciao, Michael.

1 0

Can't add, delete or modify entries
by Rob Tanner 17 Jun '08

17 Jun '08

I can no longer add, delete or modify existing entries. For all intents and purposes, this an all-of-the-sudden it quit working. Actually it's my test environment and it's where I point to when I'm developing code that reads/writes to LDAP. The machine hung about a week ago and it actually had to be power cycled to get it back but since I haven't actually accessed that server in several weeks, I don't know if the problem is related to the server problem. I couldn't find any reason so I shut the OpenLDAP down, used slapcat to dump the whole database and then I removed everything but the DB_CONFIG file and all the files under /var/log/ldap. I used slapadd (as the ldap user) to rebuild the database and thn started up OpenLDAP again. No difference. Slapadd put everything back, but I can't can't add, delete or modify. I m running OpenLDAP v.3.2.7 and Fedora Core 6. Fortunately this is not the production server so I've got room to play. Any ideas about what I need to play with? Thanks, Rob Tanner Linfield College

3 2

Re: openldap
by Michael Ströder 17 Jun '08

17 Jun '08

Aravind Arjunan wrote: > ldap_add: Object class violation (65) > additional info: attribute 'mail' not allowed > > What i need to do for adding this attribute. tell me the correct > objectclass for this attribute. Most people use object class 'inetOrgPerson' for adding attribute 'mail' to user/person entries. Since you don't provide an example entry nobody can tell what's right for your data. Ciao, Michael.

1 0

Re: syncrepl in OpenLDAP 2.3.x and updating on a replica
by Michael Ströder 17 Jun '08

17 Jun '08

Filipe Brandenburger wrote: > So, my questions are: > > 1. How do I get ldapmodify, ldapdelete, ... to follow referrals? > > 2. Will pam_ldap (when changing passwords) follow referrals? You shouldn't chase referrals at the client's side. Rather use slapo-chain to let the server chase the referral (chain the request to the master). > I will try to see if referrals will work first, then I'll > start going down that route. The LDAPv3 specification is incomplete regarding referrals since it does not specifiy what the client should do regarding binding to the referred server. So vendors implemented it differently. Example: The rule within MS AD domains is to just use the domains credentials you used before. But it's not implemented like this in OpenLDAP libs since not generally true. In web2ldap I'm presenting a login form to the user letting him interactively decide what to do when chasing the referral. Ciao, Michael.

1 0

slapo-rwm and map attribute
by Raphaël 'SurcouF' Bordet 16 Jun '08

16 Jun '08

Hi, I'm using OpenLDAP 2.3.38 under Solaris 10 and I'm trying to configure a relay from a another base. I've set many rwm-map directives and they, minus one, works fine : /----( /etc/ldap/slapd.conf )---- database relay suffix "o=Example,c=FR" relay "dc=example,dc=org" overlay rwm rwm-map objectclass frGovPerson organizationalPerson rwm-map objectclass inetOrgPerson * rwm-map objectclass person * rwm-map attribute mail * rwm-map attribute cn * rwm-map attribute sn * rwm-map attribute givenName * rwm-map attribute ou o rwm-map attribute telephoneNumber * rwm-map attribute departmentNumber * rwm-map attribute departmentUID * rwm-map attribute l * rwm-map attribute postalCode * rwm-map attribute description * rwm-map attribute title rank rwm-map attribute facsimileTelephoneNumber * rwm-map attribute uid * rwm-map attribute initials * rwm-map attribute employeType * rwm-map objectclass * rwm-map attribute * \---8<---8<---8<---8<---8<---8<--- With this above configuration, I'm getting all attributes as mentionned by rwm-map attribute directives but no objectclass. If I comment the last directive, I get all attributes minus the objectclass that should have been removed with the similar line above it. Best regards, -- Raphaël 'SurcouF' Bordet

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software