openldap-software

openldap-software@openldap.org

2719 discussions

slurpd -d 65535 Invalid credentials error
by Yao Mingxi 14 Jun '08

14 Jun '08

Hello! I’m a newbie to openldap and I am trying to set up a replication openldap server following the guide at http://www.ibm.com/developerworks/linux/library/l-openldap/ . After configuration, slapd and slurpd started successfully but when I tried to use the slurpd –d 65535 command, the following error message pop up: Error: ldap_simple_bind_s for 10.0.11.6:389 failed: Invalid credentials The configurations of slapd.conf are as follow: Master: replogfile /var/lib/ldap/replog replica uri=ldap://10.0.11.6 binddn=”cn=Mananger,dc=example,dc=com” bindmethod=simple credentials=testing Slave: updatedn “cn=Manager,dc=example,dc=com” updateref ldap://10.0.11.5 The “cn=Manager,dc=example,dc=com” is the rootdn of both master and slave servers and I can use the password “testing” to successfully authenticates commands such as ldapsearch on both machines. What possibly could be the problem? Any help is greatly appreciated. Thanks! Sincerely, Yao Mingxi

3 2

API for assertion control
by Michael Ströder 14 Jun '08

14 Jun '08

HI! I'd like to implement the assertion control in python-ldap. Are there already any utility functions usable for generating the control value? Basically this would be turning a filter string representation into the BER. Yes? Preferrably in OpenLDAP 2.3.x libs (since 2.3 is currently the minimum requirement for building python-ldap). Ciao, Michael.

2 4

bdb 4.7?
by Dominic Hargreaves 13 Jun '08

13 Jun '08

Hello, I wondered if anyone had tested OpenLDAP with Berkeley DB 4.7? It's not listed as a possibility on http://www.openldap.org/doc/admin24/appendix-recommended-versions.html but maybe someone's looked at it anyway? I ask mostly out of curiosity, but also in case we need to move to 4.7 for other reasons. Thanks, Dominic. -- Dominic Hargreaves, Systems Development and Support Team Computing Services, University of Oxford

2 1

Seems I do not understand the ssf entries..... either that or something a bit more strange.
by Pat Riehecky 13 Jun '08

13 Jun '08

>From the doc ( http://www.openldap.org/doc/admin24/security.html ) ----------------- security controls disallow operations when appropriate protections are not in place. For example: security ssf=1 update_ssf=112 requires integrity protection for all operations and encryption protection, 3DES equivalent, for update operations (e.g. add, delete, modify, etc.). See slapd.conf(5) for details. ----------------- This sounds good to me, so I read the man page, added this to my slapd.conf, and restarted openldap but now I get "stronger confidentiality required for update" when making updates..... As a test I lowed the value to 34 (security ssf=1 update_ssf=34) halted slapd and ensured I got a clean restart. Updates still fail. If I lower it down to 31 it succeeds. Initial reactions would be to blame a lack of SSL for the low ssf failure. I assure you I am connecting with -ZZ and an ldapsearch -ZZ returns results. I have a suspicion that the problem is in part due to my lack of understanding. Here are the logs from an attempt (loglevel 256) conn=0 fd=17 ACCEPT from IP=127.0.0.1:48533 (IP=0.0.0.0:389) conn=0 op=0 EXT oid=1.3.6.1.4.1.1466.20037 conn=0 op=0 STARTTLS conn=0 op=0 RESULT oid= err=0 text= TLS: gnutls_certificate_verify_peers2 failed -49 conn=0 fd=17 TLS established tls_ssf=32 ssf=32 conn=0 op=1 BIND dn="cn=admin" method=128 conn=0 op=1 BIND dn="cn=admin" mech=SIMPLE ssf=0 conn=0 op=1 RESULT tag=97 err=0 text= conn=0 op=2 EXT oid=1.3.6.1.4.1.4203.1.11.1 conn=0 op=2 PASSMOD id="uid=test,ou=People,dc=testldap,dc=iwu,dc=edu" new conn=0 op=2 RESULT oid= err=13 text=stronger confidentiality required for update conn=0 op=3 UNBIND conn=0 fd=17 closed Where I think I am getting screwed up is at either tls_ssf=32 or mech=SIMPLE ssf=0 The tls_ssf seems very low to me. gnutls is perhaps not at the top of everyone's SSL list, but my reading of the doc is that it promises TLS1.0 and SSL3.0 without SSL2.0 ( http://www.gnu.org/software/gnutls/ ) and that "SSF greater than one (>1) roughly correlates to the effective encryption key length." ( http://www.openldap.org/doc/admin24/security.html ) I would not expect something that refuses SSL2 support to select a 32 bit cipher.... The ssf=0 for simple sasl auth makes perfect sense, I am trying a simple bind. A few vendor apps I have on hand wont do more than a simple bind so that is my low water mark as it were. In an ideal world I would like security update_ssf=128 simple_bind=112 to be working (force 3DES or better for a bind, for AES or better for an update), but I will settle for what must I do to make the documented example work for me? Pat Ubuntu 8.04 OpenLDAP 2.4.7 (installed from repo, linked against gnutls)

3 3

Re: additional info: homePhone: value #0 normalization failed
by Michael Ströder 13 Jun '08

13 Jun '08

Jay Jesus Amorin wrote: > Thanks Michael, Do you have any idea on how i can fix this issue? Simply provide attribute value which complies to telephone number syntax. There are examples like +49 123 456789. Since you did not provide your file data.ldif here further hints about how to exactly fix your data are not possible. > Is there any tool that I can use to handle this problem? No special tool needed. Simply fix your data.ldif with your preferred text editor. Ciao, Michael.

2 1

query result size limit by ip
by Bill MacAllister 12 Jun '08

12 Jun '08

We have an application that can only bind to the directory anonymously and needs to be able to exceed our query size limit. The queries will come from a small set of IP addresses. What we want to do is to set the query size limit by source ip address. One way that I can see to do this is to run two slapd servers with different -h switches specified on the slapd startup so that each server will bind to a different interface:port. Then we can restrict access to the unlimited-size-query server using ip tables. What would be really nice is if the two configurations could specify the same backend databases. Has anyone done this? Should this work? Is there a better way to do this? Bill -- Bill MacAllister <whm(a)stanford.edu> Systems Programmer, ITS Unix Systems, Stanford University

2 2

Syncrepl connections
by Erich Weiler 12 Jun '08

12 Jun '08

Greetings all! I'm using OpenLDAP 2.3.28-8, and have configured a master LDAP server for our environment, works great. I then configured a slave server that stays in sync using syncrepl (use refreshAndPersist), also works fine. One think I'm noticing is that is I restart slapd on the master server, it seems that the slave server stops syncing properly. i.e. if I make a change on the master, it is not sync'd to the slave. If I restart slapd on the slave it then syncs any changes that it missed from before. Is this standard behavior? Does anyone know of a way to tell the slave to automatically try and reconnect with the master if the connection is temporarily lost? Thanks in Advance! Erich

2 2

user they can modify passwords
by Sven Buchstaller 12 Jun '08

12 Jun '08

Hi List i need an user "it" they can modify on my ldap the passwords for all users. atm my settings in the acl.conf are: access to dn.base="" by * read access to dn.base="cn=subSchema" by * read access to attrs=userPassword,userPKCS12 by self write by * auth access to attrs=shadowLastChange by self write by * read access to dn.subtree="ou=users,dc=server1,dc=intern" by self write by dn="uid=intern,ou=users,dc=server1,dc=intern" by * read access to dn.subtree="ou=groups,dc=server1,dc=intern" by * read access to dn.sub="ou=hosts,dc=server1,dc=intern" by self write by dn="uid=hostadmin,ou=users,dc=server1,dc=intern" write by * read can i do like this: access to dn.subtree="ou=users,dc=server1,dc=intern" by self write by dn="uid=intern,ou=users,dc=server1,dc=intern" by * read by dn="uid=it,ou=users,dc=server1,dc=intern" by * write MFG Sven

2 1

Re: additional info: homePhone: value #0 normalization failed
by Michael Ströder 11 Jun '08

11 Jun '08

Jay Jesus Amorin wrote: > ldapadd -x -D "cn=Administrator,dc=house,dc=org" -w 12345678 -f > /home/ja9/data.ldif > adding new entry "cn=labacan,ou=house_backup,dc=house,dc=org" > ldap_add: Invalid syntax (21) > additional info: homePhone: value #0 normalization failed It means what the error code says: The syntax of the attribute value you're providing in your data.ldif does not comply to the LDAP syntax assigned to attribute type 'homePhone'. Ciao, Michael.

1 0

Authentication by group
by Mauricio Paulo de Sousa 11 Jun '08

11 Jun '08

Helo all! The problem I have to resolve is to see if is possible authenticate the users by groups... and make users belong from more than one group,mut, by priorities... I dont know if this is possible. can anybody said me if its is possible?? thanks to all! -- Mauricio Paulo de Sousa

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software