openldap-technical March 2008

openldap-technical@openldap.org

55 participants
54 discussions

Re: Paging C/C++ API
by Ralf Haferkamp 11 Mar '08

11 Mar '08

On Dienstag, 11. März 2008, Yishai Hadas wrote: > Hello, > > Can someone gives a reference to any C/C++ code that can be used on > Linux machine: > > * Connects to Microsoft AD (or to any other LDAP server) > > * Retrieves results based on the paging mechanism described > under RFC2696. The "ldapsearch" command does support this (see the ldapsearch(1) man page for details. Source code can be found in the OpenLDAP sources ( ./client/tools/*.c and ./libraries/libldap/pagectrl.c ). Another example would be the nss_ldap module. > * Which OpenLDAP rpm for Linux is needed here ? As the OpenLDAP project does not ship any prebuild packages (RPMs, whatever) this depends on the distribution you are using. In SUSE Linux e.g. you'll find ldapsearch in the openldap2-client.rpm other distributors use different names. -- Ralf

1 0

importing ldif
by Paolo Leano 11 Mar '08

11 Mar '08

hi, I am getting an "additional info: naming attribute 'uid' is not present in entry" error when importing an ldif file. here is the sample entry: dn: uid=testuid,ou=testou,dc=testdomain,dc=com cn: testcn objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: OfficePerson mail: test(a)testdomain.com URL: http://www.testdomain.com o: test givenName: testname initials: testinitial sn: testsn ou: testou i could add a line: uid: testuid under the dn and it imports just fine but the ldif file has at least 2000 entries. is there an easier way to go about this. any help would be appreciated in pointing me to the right direction thank you

2 1

alias problem - report status code 80 - internal error?
by Yan Falken 10 Mar '08

10 Mar '08

Hi, I'm trying to use alias somehow but facing some internal problem and don't know how to fix them. Situation: data for import: dn: ou=Staff,o=JNDITutorial objectclass: top objectclass: alias objectclass: organizationalUnit aliasedObjectName: ou=People,o=JNDITutorial ou: Staff error: ldap_initialize( ldap://localhost ) add objectclass: top alias organizationalUnit add aliasedObjectName: ou=People,o=JNDITutorial add ou: Staff adding new entry "ou=Staff,o=JNDITutorial" modify complete ldap_add: Internal (implementation specific) error (80) additional info: no structuralObjectClass operational attribute the problem is if I try to play with this: if I remove organizationalUnit I get: ldap_add: Object class violation (65) additional info: attribute 'ou' not allowed so I remove ou and surprise - I'm getting: ldap_add: Naming violation (64) additional info: naming attribute 'ou' is not present in entry So - any advice where may be the problem? I'm using bdb backend as a recommended one - have no ldbm modules here - in debian there is no ldbm support. Thanks. YF

2 1

OpenLDAP and Berkeley DB 4.6
by Dongsheng Song 10 Mar '08

10 Mar '08

Since OpenLDAP 2.3 is incompatible[1] with Berkeley DB 4.6, so I must stick to BDB 4.5 or upgrade to OpenLDAP 2.4 ? [1] http://www.openbsd.org/cgi-bin/cvsweb/ports/databases/openldap/Makefile Thanks for some help. Dongsheng

2 1

ldap and nfs from different servers
by VaraPrasad Yalla 10 Mar '08

10 Mar '08

Hello, Please let me know if there is a way to authenticate users from one box and mount the users' home folders from another box. Even without importing autofs details into the ldap database home directories from the same machine are getting mounted on client machines. How is it possible to mount home directories from another machine in the same way? I am getting errors when I do this on client machines. Thanks.

2 1

dynamic groups
by Andreas Moroder 10 Mar '08

10 Mar '08

Dynamic Lists Hello, I have a question about dynamic grousp ( lists ). For every department in our hospital we have six groups DEP_A_GRP1 ... DEP_A_GRP6 DEP_B_GRP1 ... DEP_B_GRP6 and so on. Is it possible to configure openldap the way that every user of any department group becomes also user in a dynamically generate all containing main department group DEP_A contains all the users of DEP_A_GRP1 to 6 DEP_B contains all the users of DEP_B_GRP1 to 6 .... This should work for primary and secondary groups and the added dynamic group should be a secondary group. Because we use also the slapo-memberof the memberof=DEP_A ... attribute should also be returne for the users of DEP_A_GRP1 to 6. Is this possible and could anyone please tell me how to configure this ? Thanks Andreas Moroder

1 0

Samba to Kerberos via OpenLDAP
by Wes Modes 08 Mar '08

08 Mar '08

Thanks for all your advice so far. First, I'll just say this is a question principally about the arcane mysteries of Samba to OpenLDAP authentication. I've had Samba to OpenLDAP authentication running for a while now using the samba.schema and the ldapsam module. Now I'd like to understand a bit more about how that works in order to take it a step further and get openLDAP to bind against a Kerberos database via SASL. An aside; Yes, I'd heard that Samba can be configured to authenticate against Kerberos directly, but for my own reasons, I'd prefer that Samba talk only to OpenLDAP, and OpenLDAP can do the authentication. I'll fall back on the Samba to Kerberos direct route if I can't find a way to do what I want. I've noted that the Samba schema and smbldap-tools add to the user record two Samba specific password fields, sambaNTPassword and sambaLMPassword. If I have the ldapsam module specified as the passdb backend in smb.conf, is OpenLDAP merely storing the samba passwords while Samba does the password comparisons? Or does OpenLDAP do the authentication and return a yes or no? Is it possible to have Samba defer authentication to OpenLDAP? If so, I can have OpenLDAP use the {SASL} method to do authentication via kerberos. Wes -- Wes Modes Server Administrator & Programmer Analyst McHenry Library Computing & Network Services Information and Technology Services 459-5208

3 2

Problem setting up OpenLDAP for user authentication
by Guennadi Liakhovetski 05 Mar '08

05 Mar '08

Hi all I'm new to LDAP, and I must say it took me a LONG time to set it up under Debian etch on both server and client at all to do anything useful. Now I can do "ldapsearch -x -v -L" type requests from remote a host and locally. I then tried switching the remote host to using LDAP for user authentication. I'd like users not registered locally to be able to login using ldap, and for locally-known users nothing should change. I did manage to get logins to use ldap by configuring all /etc/pam.d/common-* files to first try pam_unix and then, if that fails to use ldap: * sufficient pam_unix * sufficient pam_ldap (should this be "required?) where * is "account", "auth", "password" and "session". In "auth" and "password" I also had to put * required pam_deny after ldap, because otherwise wrong passwords were accepted. In nsswitch.conf I put *: files ldap for "passwd", "group", "shadow". Now I would expect that with sequences ("pam_unix" before "pam_ldap" and "files" before "ldap") indeed locally known users wouldn't be authenticated using ldap. Unfortunately, this doesn't seem to be the case. Now _all_ nss / pam requests go to the LDAP server. Including calls from udevd, avahi-daemon, and others, which causes them to fail in various ways. What am I doing wrong? I know SASL is not configured in my setup, but that shouldn't be a problem? At least not for the cases when LDAP shouldn't be attempted at all. Thanks Guennadi --- Guennadi Liakhovetski

2 4

Could I import the data through the slapadd what I export by the ldapsearch
by 何萍 05 Mar '08

05 Mar '08

There are 6,000,000 records in my openldap directory, I want to backup the data, but I found that the slapcat isn't work when the file id2entry.dbbsize over 2G, so I export the data by ldapsearch, but after I use slapadd to import the data to the backup server, there are some strange error happened, some records can't be add to the ldap correctly, and the record coundn't be searched by ldapsearch. As the same time, others data can be correctly operated. Operation system is the redhat linux 9.0. The verson of openldap is 2.0.27, use ldbm. Because there are too many records so I couldn't upgrade the version of the openldap . when I use ldapsearch the result is : # # filter: (&(uid=abc)(domain=123)) # requesting: ALL # # search result search: 2 result: 0 Success when i use ldapadd to add the record, it says: ldap_add: Already exists ldif_record() = 68 when i use ldapdelete to del it, the result is: Delete Result: Invalid DN syntax (34) Additional info: invalid DN (my dn is right) I thought mybe the record format is not correct that I exported by ldapsearch and imported by slapadd, because the ldif file lost entryUUID、entryCSN... and so on. now how can i do? I have tried to rebuild the entryUUID and run the slapindex to rebuild the index, but failed at least.

2 1

Fwd: GSSAPI contexts used in multiple threads
by Russ Allbery 04 Mar '08

04 Mar '08

As part of the discussion of adding additional thread safety guarantees to MIT Kerberos's GSS-API implementation to support OpenLDAP's use case, Sam Hartman had the following additional questions about how OpenLDAP uses SASL in such a way as to run into this problem. I'm happy to forward answers back to him. I don't understand the usage well enough to explain it myself. | From: Sam Hartman <hartmans(a)mit.edu> | Subject: GSSAPI contexts used in multiple threads | Date: Mon, 03 Mar 2008 16:28:13 -0500 | | Hi. I'm catching up on email. I read a discussion (although I cannot | find it now) of adding support so that an established gss-api context | can be used in multiple threads at the same time. This seems like a | fine feature to add to MIT Kerberos. | | However I'm quite puzzled as to how this works for LDAP or any other | SASL application. SASL is a stream protocol; it presents an ordered | stream across the network connection. In order to guarantee this the | sasl security layer requires that tokens be wrapped and unwrapped in | the same order. If you don't do that you can get into a situation | where the wrap order is different from the unwrap order and you get | spurious gap tokens or out of order tokens. You cannot tell the | difference between this and an attack. Also, since SASL applications | may chunk data into GSS-API tokens in arbitrary order, GSS-API tokens | may not line up with LDAP PDU boundaries. | | So, I'm very confused about how an LDAP implementation could be a | correct application and run into problems with MIT's current thread | safety requirements. | | I'd appreciate it if people who do remember the original discussion | could forward my message to the right place to get an answer. | | Thanks, | | --Sam -- Russ Allbery (rra(a)stanford.edu) <http://www.eyrie.org/~eagle/>

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical March 2008