openldap-technical November 2008

openldap-technical@openldap.org

53 participants
60 discussions

Re: Openldap and TLS issue
by ghenry＠OpenLDAP.org 19 Nov '08

19 Nov '08

----- "Ivan Ordonez" <iordonez(a)nature.berkeley.edu> wrote: > Looking at the debug log, it is expired. It puzzle me because the > certs on the other two machine are working correctly. Check their expiry dates with: openssl x509 -in /usr/local/etc/openldap/ldap-slave_cert.pem -text > Since this is the case (certificate expires), is it safe to create a > new one for this machine? Of course, then sign it with the cacert, something like: ./CA.sh -newreq ./CA.sh -sign -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

Re: Openldap and TLS issue
by Ivan Ordonez 19 Nov '08

19 Nov '08

Looking at the debug log, it is expired. It puzzle me because the certs on the other two machine are working correctly. Since this is the case (certificate expires), is it safe to create a new one for this machine? Gavin Henry wrote: > ----- "Ivan Ordonez" <iordonez(a)nature.berkeley.edu> wrote: > > >> Hi, >> >> Our environment is consist of 3 domain controllers - 1 primary and 2 >> backup. All domain controller are running on Gentoo platform using >> Samba with Openldap for user login and authentication. One of the >> backup domain controller has been acting up lately and will not start >> >> samba properly. A quick look at the log showed: >> >> slapd[22380]: conn=94 op=0 RESULT oid= err=0 text= >> slapd[22380]: conn=94 fd=11 closed (TLS negotiation failure) >> slapd[22380]: conn=95 fd=11 ACCEPT from IP=127.0.0.1:54158 >> (IP=0.0.0.0:389) >> >> It seems obvious that the issue is with certificate. The certificate >> we >> are using was created using the primary domain controller and were >> then >> copied to both backup domain controller. If I create a brand new >> certificate using the backup domain controller having certificate >> issue, >> will that interfere with the certificate on the primary domain >> controller? Will that cause confusion on the domain? Creating a brand >> >> new certificate is the only solution I can think of to fix this issue. >> > > http://www.openldap.org/faq/data/cache/185.html > > Has one of your certs expired? By default OpenSSL scripts do 365 days. > >

1 0

Slow Data sync
by Bad Guy 19 Nov '08

19 Nov '08

Hi all, I am using openldap 2.4.11, and configure as 4-way Master, config files for server A,B,C,D are shown below : Server A : syncrepl rid=A provider=ldap://serverA:389/ retry="1 +" ...... syncrepl rid=B provider=ldap://serverB:389/ retry="1 +" ...... syncrepl rid=C provider=ldap://serverC:389/ retry="1 +" ...... syncrepl rid=D provider=ldap://serverD:389/ retry="1 +" ...... serverID 001 Server B : syncrepl rid=A provider=ldap://serverA:389/ retry="1 +" ...... syncrepl rid=B provider=ldap://serverB:389/ retry="1 +" ...... syncrepl rid=C provider=ldap://serverC:389/ retry="1 +" ...... syncrepl rid=D provider=ldap://serverD:389/ retry="1 +" ...... serverID 002 Server C : syncrepl rid=A provider=ldap://serverA:389/ retry="1 +" ...... syncrepl rid=B provider=ldap://serverB:389/ retry="1 +" ...... syncrepl rid=C provider=ldap://serverC:389/ retry="1 +" ...... syncrepl rid=D provider=ldap://serverD:389/ retry="1 +" ...... serverID 003 Server D : syncrepl rid=A provider=ldap://serverA:389/ retry="1 +" ...... syncrepl rid=B provider=ldap://serverB:389/ retry="1 +" ...... syncrepl rid=C provider=ldap://serverC:389/ retry="1 +" ...... syncrepl rid=D provider=ldap://serverD:389/ retry="1 +" ...... serverID 004 I find a strange behaviour, data can be synced within all 4 servers, however, after some time, I find that when I add/update data in server A, it can sync to server B immediately, server C and server D can't receive the updated data., I check the log in server C and server D, there is no data push to C and D. (I set the log level 16384 to log the sync) When I add record in server C, data can be sync to server D immediately, server A and server B can't receive the updated data. But after some time (may be 1-2 hours), the data between the 4 servers are synced finally. Another information is that server A and B are in same segment, server C and server D are in same segment, but server A and C/D are in different segment. The ping test between servers are fast. I also use telnet server A/B/C/D 389, the response is fast. Any idea ? Thanks _________________________________________________________________ 5 GB 超大容量、創新便捷、安全防護垃圾郵件和病毒 — 立即升級 Windows Live Hotmail http://mail.live.com

1 0

Must pwdReset always be set explicitly?
by Akke Bengtsson 19 Nov '08

19 Nov '08

The draft description of ppolicy (draft-behera-ldap-password-policy-09.txt) from July 17 2005 says among other things "If the value the pwdMustChange is TRUE and the modification is performed by a password administrator, then the pwdReset attribute is set to TRUE. My impression, using OpenLDAP up to v.2.4.10 is that it rather is implemented as "...and the pwdReset attribute is set to TRUE, the user has to change his password." (i.e. to set pwdReset signals the very fact that I am a password administrator.)? (On the other hand - the reset of the pwdReset attribute when the user actually chooses a new password is as expected automatically performed by the OpenLDAP software.) The Behera draft expired more than two years ago - in a more recent IETF draft by Zeilenga from march 2008, there is a suggestion to replace pwdReset by passwdChangeRequired. Also this draft is expired by now - did it make way into any OpenLDAP code? Best Regards Akke Bengtsson IT-Forum, IT-Arkitektur och systemutveckling Karolinska Universitetssjukhuset 141 86 STOCKHOLM

1 0

Openldap and TLS issue
by Ivan Ordonez 18 Nov '08

18 Nov '08

Hi, Our environment is consist of 3 domain controllers - 1 primary and 2 backup. All domain controller are running on Gentoo platform using Samba with Openldap for user login and authentication. One of the backup domain controller has been acting up lately and will not start samba properly. A quick look at the log showed: slapd[22380]: conn=94 op=0 RESULT oid= err=0 text= slapd[22380]: conn=94 fd=11 closed (TLS negotiation failure) slapd[22380]: conn=95 fd=11 ACCEPT from IP=127.0.0.1:54158 (IP=0.0.0.0:389) It seems obvious that the issue is with certificate. The certificate we are using was created using the primary domain controller and were then copied to both backup domain controller. If I create a brand new certificate using the backup domain controller having certificate issue, will that interfere with the certificate on the primary domain controller? Will that cause confusion on the domain? Creating a brand new certificate is the only solution I can think of to fix this issue. I've already re-install samba, openldap and smbldap-tools twice to no avail. samba 3.0.32 openldap 2.3.43 smbldap-tools 0.9.4-r1 Thanks in advance. -Ivan

1 0

Mailing list query
by Stelios A. 18 Nov '08

18 Nov '08

Hello all, My user.ldif is like: dn: cn=Somename Somelastname, ou=Users,dc=mydomain,dc=edu,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: person objectClass: organizationalPerson objectClass: top givenName: Somename sn: Somelastname cn: Somename Somelastname uid: ssomelastname uidNumber: 1002 gidNumber: 100 homeDirectory: /home/ssomelastname loginShell: /bin/bash mail: ssomelastname(a)mydomain.edu.com userPassword: some password encrypted Same user for example is under cn=IT,ou=Groups,dc=mydomain,dc=edu,dc=com Example ldif: dn: cn=IT,ou=Groups,dc=bca,dc=edu,dc=gr cn: IT objectClass: groupOfUniqueNames uniqueMember: cn=Somename Somelastname,ou=Users,dc=mydomain,dc=edu,dc=com What I want is somehow to get all uid of the users belonging to each of my groups in order to build a mailing list with postfix. I've created a file called ldap-aliases.cf with the following inside: server_host = ldaps://myhostname search_base = dc=mydomain,dc=edu,dc=com scope = sub version = 3 query_filter = (&(|(objectclass=person)(objectclass=groupofuniquenames)(mail=%s)(ou=Groups))) result_attribute = uid bind = yes bind_dn = cn=admin,dc=mydomain,dc=edu,dc=com bind_pw = mypasswordwithoutencryption The above works ok without errors but it just displays all users in my ldap. I tried several different ways but can't find out how to add to the query to show me only the cn=IT,ou=Groups,dc=mydomain,dc=edu,dc=com and also a second more complicated query, that is to show me all users uid where not belonging to any Group (ou=Groups,dc=mydomain,dc=edu,dc=com) Any help is much appreciated. Thanks

4 10

CSN Too Old potential Bug
by Burton, Kris - Acision 17 Nov '08

17 Nov '08

All, I want to ask the list about this before I try to open an ITS to make sure that I am understanding everything correctly. We are running OpenLDAP 2.4.11. I selectively tried to back post ITS 5709 to our source, because we were losing replications. Applying this seemed to help and reduced the number of lost replications. We are running in mirror mode using refreshAndPersist, and doing a high volume of adds to the master, on the order of 100/s. We have run numerous iterations of the same test with very aggressive NTP updates that are keeping both the master and consumer within 50 microseconds of one another. Which I saw recommended as a possible solution in a previous message thread. This seemed to make little to no difference in the replication loss. >From looking at the code I was thinking that the lost replications might be due to entries being queued on the master side in non-ascending order which I was seeing preceding the replication that would be rejected on the consumer side. What I thought was happening is that the logic that traverses the queue to mark committed CSNs and updates the contextCSN was getting out of sync because of this, and orphaning replications that were still pending, because they are too old, but in reality they have never been added to the consumer. I just pulled the latest code from RE24 and reran the test, the latest code is better than before with just the back post of 5709 on 2.4.11, but we are still losing a small percentage of the replications with the "CSN too old" message. With the latest code I am still seeing a correlation between the out of sync queuing on the master and the replications that are rejected on the consumer. During this run NTP was keeping the 2 systems within 10 microseconds of each other, with the most aggressive synch interval that is configurable at 16 seconds. Below I have log snippets and some of the relevant configuration information. If more is desired then please let me know and I will provide it. #### MASTER ##### Nov 14 14:43:05 ng04be03 slapd[7582]: slap_graduate_commit_csn: removing 0x2b4c9568b0 20081114194304.892065Z#000000#001#000000 Nov 14 14:43:05 ng04be03 slapd[7582]: slap_queue_csn: queing 0x42803100 20081114194305.078713Z#000000#001#000000 Nov 14 14:43:05 ng04be03 slapd[7582]: conn=14 op=17167 ADD dn="uniqueIdentifier=Evad_Added_tele_5450408582,ou=subscribers,ou=SINGP,o=ricuc…" Nov 14 14:43:05 ng04be03 slapd[7582]: slap_queue_csn: queing 0x4680b100 20081114194305.078878Z#000000#001#000000 Nov 14 14:43:05 ng04be03 slapd[7582]: slap_queue_csn: queing 0x43004100 20081114194305.078653Z#000000#001#000000 Nov 14 14:43:05 ng04be03 slapd[7582]: conn=12 op=13844 RESULT tag=105 err=0 text= Nov 14 14:43:05 ng04be03 slapd[7582]: slap_graduate_commit_csn: removing 0x2b4c87e670 20081114194305.068251Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: slap_queue_csn: queing 0x41000100 20081114194502.917316Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: conn=10 op=19719 ADD dn="uniqueIdentifier=Evad_Added_tele_5450009858,ou=subscribers,ou=SINGP,o=ricuc…" Nov 14 14:45:02 ng04be03 slapd[7582]: slap_queue_csn: queing 0x43805100 20081114194502.917523Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: slap_queue_csn: queing 0x4780d100 20081114194502.917288Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: conn=12 op=17496 RESULT tag=105 err=0 text= Nov 14 14:45:02 ng04be03 slapd[7582]: slap_graduate_commit_csn: removing 0x2b5a7f8340 20081114194502.917316Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: conn=13 op=19983 ADD dn="uniqueIdentifier=Evad_Added_tele_5450509990,ou=subscribers,ou=SINGP,o=ricuc…" Nov 14 14:45:02 ng04be03 slapd[7582]: conn=10 op=19719 RESULT tag=105 err=0 text= Nov 14 14:45:02 ng04be03 slapd[7582]: slap_graduate_commit_csn: removing 0x2b5ae77160 20081114194502.917523Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: conn=14 op=19598 ADD dn="umbillingnumber=5450409797,uniqueIdentifier=Evad_Added_tele_5450409797,ou=s…" Nov 14 14:45:02 ng04be03 slapd[7582]: slap_queue_csn: queing 0x41000100 20081114194502.936884Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: conn=11 op=16763 RESULT tag=105 err=0 text= Nov 14 14:45:02 ng04be03 slapd[7582]: slap_queue_csn: queing 0x43805100 20081114194502.947725Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: slap_graduate_commit_csn: removing 0x2b5ad51170 20081114194502.917288Z#000000#001#000000 ### CONSUMER ### Nov 14 14:43:36 ng04be04 slapd[24622]: syncrepl_entry: rid=002 be_add (0) Nov 14 14:43:36 ng04be04 slapd[24622]: do_syncrep2: cookie=rid=002,sid=002,csn=20081114194305.078653Z#000000#001#000000 Nov 14 14:43:36 ng04be04 slapd[24622]: do_syncrep2: rid=002 CSN too old, ignoring 20081114194305.078653Z#000000#001#000000 Nov 14 14:43:36 ng04be04 slapd[24622]: do_syncrep2: cookie=rid=002,sid=002 Nov 14 14:43:36 ng04be04 slapd[24622]: syncrepl_entry: rid=002 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Nov 14 14:43:36 ng04be04 slapd[24622]: syncrepl_entry: rid=002 be_search (0) Nov 14 14:45:39 ng04be04 slapd[24622]: slap_queue_csn: queing 0x2b4737c990 20081114194502.917523Z#000000#001#000000 Nov 14 14:45:39 ng04be04 slapd[24622]: slap_graduate_commit_csn: removing 0x2b473ca890 20081114194502.917523Z#000000#001#000000 Nov 14 14:45:39 ng04be04 slapd[24622]: do_syncrep2: cookie=rid=002,sid=002,csn=20081114194502.917288Z#000000#001#000000 Nov 14 14:45:39 ng04be04 slapd[24622]: do_syncrep2: rid=002 CSN too old, ignoring 20081114194502.917288Z#000000#001#000000 Nov 14 14:45:39 ng04be04 slapd[24622]: do_syncrep2: cookie=rid=002,sid=002,csn=20081114194502.936884Z#000000#001#000000 ### Replication Config ### dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig ... olcSyncrepl: {0}rid=2 provider=ldap://ldap.server.com bindmethod=si mple timeout=0 network-timeout=0 binddn="cn=Directory Manager,o=ricuc.com" cr edentials="secret" starttls=no filter="(objectclass=*)" searchbase="o=ricuc.com" scope=sub schemachecking=off type=refreshandpersist retry="60 +" olcMirrorMode: TRUE dn: olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 600 olcSpSessionlog: 100 ### Hardware ### Dual Quad Core Xeon 2.83GHz 32GB RAM 8x15000rpm RAID10 Separate LUNS for db and txn logs Kris Burton Software Engineer ________________________________________ Acision. Innovation. Assured. www.acision.com 4870 Sadler Road Suite 200 Glen Allen, VA 23060 USA This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

2 4

openldap client over ssl
by Beijing Normal Univ 16 Nov '08

16 Nov '08

Hi I am new to openldap and ssl. I would like to use only the openldap client sdk. What I want to do is use the openldap client sdk to develop some tools which could comunicate with ldap server over ssl channel. Do I still need openssl? Maybe I should ask my question this way: Openssl will need to be used to generate the certificate etc. Does my application itself requre openssl libraries if it needs to support ssl? I think the answer probably is yes. Thanks

1 0

OpenLDAP interop with AD questions
by Christopher Barry 16 Nov '08

16 Nov '08

Hi All, I'm still researching methods, and trying to find the best way to integrate our Unix hosts with AD in a way that makes sense for us. The goal is to have a single user/password db in AD, and have all of the old NIS map data in OpenLDAP. SSO would be a nice to have feature too. I've read more stuff than I can count, but I'm still more than a little confused. The translucent overlay looks cool (if it'll even work with AD), but I'm not sure it's the right answer for us with respect to keeping the maps local to OpenLDAP. Any suggestions or doc links you can post? Thanks, -C

4 3

Re: Mailing list query
by Stelios A. 15 Nov '08

15 Nov '08

That query does not return any result. root@myserver:/etc/postfix# postmap -q mail_Group ldap:/etc/postfix/ldap-aliases.cf postmap: warning: dict_ldap_open: /etc/postfix/ldap-aliases.cf: Fixed query_filter cn=IT,ou=Groups,dc=bca,dc=edu,dc=gr is probably useless root@myserver:/etc/postfix# Regarding my second query, I have 5 groups where only staff is assigned to each one depending the department. Then the rest of the users (students) does not belong to any group so in order to get all uid's of students I need to query the whole ldap excluding the groups. 2008/11/15 Chris <cjl(a)viptalk.net>: > > On Nov 15, 2008, at 12:22 AM, Stelios A. wrote: > >> Hello all, >> >> My user.ldif is like: >> >> dn: cn=Somename Somelastname, ou=Users,dc=mydomain,dc=edu,dc=com >> objectClass: inetOrgPerson >> objectClass: posixAccount >> objectClass: person >> objectClass: organizationalPerson >> objectClass: top >> givenName: Somename >> sn: Somelastname >> cn: Somename Somelastname >> uid: ssomelastname >> uidNumber: 1002 >> gidNumber: 100 >> homeDirectory: /home/ssomelastname >> loginShell: /bin/bash >> mail: ssomelastname(a)mydomain.edu.com >> userPassword: some password encrypted >> >> Same user for example is under cn=IT,ou=Groups,dc=mydomain,dc=edu,dc=com >> Example ldif: >> >> dn: cn=IT,ou=Groups,dc=bca,dc=edu,dc=gr >> cn: IT >> objectClass: groupOfUniqueNames >> uniqueMember: cn=Somename Somelastname,ou=Users,dc=mydomain,dc=edu,dc=com >> >> What I want is somehow to get all uid of the users belonging to each >> of my groups in order to build a mailing list with postfix. >> >> I've created a file called ldap-aliases.cf with the following inside: >> >> server_host = ldaps://myhostname >> search_base = dc=mydomain,dc=edu,dc=com >> scope = sub >> version = 3 >> query_filter = >> (&(|(objectclass=person)(objectclass=groupofuniquenames)(mail=%s)(ou=Groups))) >> result_attribute = uid >> bind = yes >> bind_dn = cn=admin,dc=mydomain,dc=edu,dc=com >> bind_pw = mypasswordwithoutencryption >> >> The above works ok without errors but it just displays all users in my >> ldap. >> I tried several different ways but can't find out how to add to the >> query to show me only the cn=IT,ou=Groups,dc=mydomain,dc=edu,dc=com > > Try setting this as your search base: > cn=IT,ou=Groups,dc=mydomain,dc=edu,dc=com > >> and also a second more complicated query, that is to show me all users >> uid where not belonging to any Group >> (ou=Groups,dc=mydomain,dc=edu,dc=com) > > Not quite sure I understand what you're looking for there. > > -- Stelios A

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical November 2008