openldap-technical May 2008

openldap-technical@openldap.org

62 participants
56 discussions

LDAP in deltasyncrepl method
by Aravind Arjunan 02 Jun '08

02 Jun '08

hi, am configuring openldap 2.3 in RHEL 5 operating system. I need the configuration file for master and slave slapd.conf file for reference. i need to configure *openldap in delta-syncrepl method.* If any one configured openldap in this method plz send me the configuration file reference. or any one plz say me how to configure ldap in master/slave in RHEL 5 OS

5 8

Log system
by Alain Siani 30 May '08

30 May '08

Hello, As soon as i activate LDAP log system in syslog, the system does not respond...and many many logs is written in log. I stop syslog, system is up and running ok CentOS release 5 (Final) any idea ? thks, Alain

2 1

slurpd replication problmes
by Almir Karic 30 May '08

30 May '08

i'm trying to set up the repliacation with openldap 2.3 (using the one debian etch), when i add things to master everything is fine, it replicates it to slave just fine, on the other hand when i add things to slave it simply writes it to it's own tree. here is slapd.conf of the slave (stripped of any comments): include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_bdb sizelimit 500 tool-threads 1 backend bdb checkpoint 512 30 TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /etc/ldap/cacert.pem TLSCertificateFile /etc/ldap/servercrt.pem TLSCertificateKeyFile /etc/ldap/serverkey.pem loglevel stats database bdb suffix "dc=kiberpipa,dc=org" directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass eq lastmod on access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=kiberpipa,dc=org" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=kiberpipa,dc=org" write by * read updatedn "cn=admin,dc=kiberpipa,dc=org" updateref "ldaps://chat.kiberpipa.org:636" with this command "ldapadd -d 65535 -WxD 'cn=admin,dc=kiberpipa,dc=org' -f /tmp/b00" (on slave) i'm getting http://static.kiberpipa.org/~redduck666/local_adding.txt with "ldapadd -d 65535 -WxD 'cn=admin,dc=kiberpipa,dc=org' -f /tmp/b00 -H ldaps://chat.kiberpipa.org:636" i get http://static.kiberpipa.org/~redduck666/add_to_master.txt (passing it the same password they write to i have seen the certificate error there, if i change the ldap.conf on slave to point to ldap:// instead of ldaps:// that error goes away, however it still doesn't touch master. i also read i really shouldn't set updatedn to be the same as rootdn, well, tried changing it and granting full priviledges to the newly created account, no difference any pointers appreciated :-) -- For far too long, power has been concentrated in the hands of "root" and his "wheel" oligarchy. We have instituted a dictatorship of the users. All system administration functions will be handled by the People's Committee for Democratically Organizing the System (PC-DOS).

2 1

Multithreaded LDAP client
by Rakesh Yadav 30 May '08

30 May '08

Hi, LDAP version: openldap-2.3.38 I want to write multithreaded ldap client but don't have any idea about multithreaded ldap client. I have seen somewhere a sample code for multithreaded client but it is having some structures which r available only on Solaris. struct ldap_thread_fns : available on Solaris but not present in linux Please give me a solution for writting a multithreaded client on linux .. waiting for reply Thanks -- Rakesh Yadav Pune.

1 0

Password management question
by daniel rahmeh 29 May '08

29 May '08

hi, I have a question about the password management. As i know, it is possible to use hach functions into openLDAP, for exemple: password-hash {CRYPT} password-crypt-salt-format "$1$somesalt$" my question is about the compatibility with applications. today, we have some applications that uses openLDAP to create and authenticate users. Is there a way to say to openLDAP to hash received userPassword before inserting it into his database? exemple: imagine an application (application1) that wants to insert a new record (user account) in a openLDAP directory. Application1 doesn't know how to hash a password, is there a way to say to openLDAP to hash this password before adding the entry. application1 ----------userPassword: testpasswd-----> openLDAP (hash(testpasswd))------------->bdb ({CRYPT}$1$salt$EdFRTTT.BNHH. the goal is to make openLDAP manage the hashing process and avoid to patch the applications thank you

3 4

ldap_sasl_bind_s
by Gavin Henry 27 May '08

27 May '08

Hi All, I've been debugging the RealTime Asterisk LDAP driver, namely the function: static int ldap_reconnect(void) { int bind_result = 0; struct berval cred; if (ldapConn) { ast_debug(2, "Everything seems fine.\n"); return 1; } if (ast_strlen_zero(url)) { ast_log(LOG_ERROR, "Not enough parameters to connect to ldap database\n"); return 0; } if (LDAP_SUCCESS != ldap_initialize(&ldapConn, url)) { ast_log(LOG_ERROR, "Failed to init ldap connection to '%s'. Check debug for more info.\n", url); return 0; } if (LDAP_OPT_SUCCESS != ldap_set_option(ldapConn, LDAP_OPT_PROTOCOL_VERSION, &version)) { ast_log(LOG_WARNING, "Unable to set LDAP protocol version to %d, falling back to default.\n", version); } if (!ast_strlen_zero(user)) { ast_debug(2, "bind to '%s' as user '%s'\n", url, user); cred.bv_val = (char *) pass; cred.bv_len = strlen(pass); bind_result = ldap_sasl_bind_s(ldapConn, user, LDAP_SASL_SIMPLE, &cred, NULL, NULL, NULL); } else { ast_debug(2, "bind %s anonymously\n", url); bind_result = ldap_sasl_bind_s(ldapConn, "", LDAP_SASL_SIMPLE, NULL, NULL, NULL, NULL); } if (bind_result == LDAP_SUCCESS) { ast_debug(2, "Successfully connected to database.\n"); connect_time = time(NULL); return 1; } else { ast_log(LOG_WARNING, "bind failed: %s\n", ldap_err2string(bind_result)); ldap_unbind_ext_s(ldapConn, NULL, NULL); ldapConn = NULL; return 0; } } The line: bind_result = ldap_sasl_bind_s(ldapConn, NULL, LDAP_SASL_SIMPLE, NULL, NULL, NULL, NULL); is giving: May 26 14:52:03 asterisk slapd[30075]: conn=1 fd=12 ACCEPT from IP=127.0.0.1:57926 (IP=0.0.0.0:389) May 26 14:52:03 asterisk slapd[30075]: bind: ber_scanf failed May 26 14:52:03 asterisk slapd[30075]: conn=1 op=0 DISCONNECT tag=120 err=2 text=decoding error May 26 14:52:03 asterisk slapd[30075]: conn=1 fd=12 closed (operations error) Any debug tips would be greatly appreciated. Two different libldap have been tested (Centos 5.1 package and Symas OpenLDAP Devel package): openldap-devel-2.3.27-8.el5_1.3 cdsdevel-3.9-2 Thanks. -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP.

3 4

ldap database backend vs requests
by Ricardo Moreira 27 May '08

27 May '08

Hi there, I would like to know if in a database backend it's possible to know the request binded DN at on the search call? What I want is to build a wrapper database backend and integrate LDAP protocol with the private protocol used on the backend authentication/authorization system at my work. Our backend system deals with authentication/authorization and search in one request, usually our request is composed of: user + pass + input parameters + atributes (to be returned). I appreaciate any help! Regards, -- :: Ricardo Moreira

2 1

[Fwd: 2 identical names in address book]
by Thomas De Reyck 24 May '08

24 May '08

Hello, I am not sure if this is the correct place to ask this kind of information, so if I am mistaken, I apologize.. I am quite new to LDAP, however I have used some applications that require it and am now a semi-decent openLDAP administrator. So, as a next step, I am trying to program an address book with an LDAP backend. I have noticed that usually the cn is used as a dn when working with address book entries. This seems to lead to an interesting conflict which I need to resolve before I begin to program: What can be done when one has to import 2 people with an identical name? This seems to be irrelevant, since the chances of an identical name are small, but I for one know 2 people with the same first and last ames. Lets face it: names are not MD5 hashes ;-).. I guess someone must have thought this over before.. how oes one resolve this problem cleanly? Does one use another property? f so, which one? I am aware that this might be a very silly question, but I have een wondering about this for a few days now and google doesn't eem to satisfy my need for a solution.. :-). Thanks in advance, Thomas De Reyck

2 2

n-way multi master setup
by Joshua Miller 24 May '08

24 May '08

Good morning, I am attempting to follow the admin guide in setting up n-way multi-master replication. re: http://www.openldap.org/doc/admin24/replication.html#N-Way%20Multi-Master I'm running OpenLDAP 2.4.7, from Buchan Milne's RPMs, DB 4.6 on CentOS 5.1. I have setup a working directory on both nodes, then removed all data to start fresh, converting my slapd.conf to a slapd.d with slaptest. ie, # /etc/init.d/ldap stop # rm -rf /var/lib/ldap/* # slaptest -f slapd.conf -F slapd.d # /etc/init.d/ldap start Since I already had cn=config setup from my slapd.conf file, I skipped that part of the admin guide's instructions. I then modified the directory with the following LDIF, replacing the URI and credential values with my environment specific ones: dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 ldap://ldapserver1 olcServerID: 2 ldap://ldapserver2 dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://ldapserver2 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=002 provider=ldap://ldapserver1 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 - add: olcMirrorMode olcMirrorMode: TRUE I received no errors on running the modify command to add the changes from this LDIF. I then attempted to make a change and have it replicated, very simple to start with, using the following LDIF: dn: cn=config changetype: modify replace: olcSecurity olcSecurity: ssf=256 Once I successfully made this change on ldapserver1, I received the following errors in the logs of ldapserver2 (continuously repeating): ldapserver2 slapd2.4[12172]: conn=15 op=0 EXT oid=1.3.6.1.4.1.1466.20037 ldapserver2 slapd2.4[12172]: conn=15 op=0 STARTTLS ldapserver2 slapd2.4[12172]: conn=15 op=0 RESULT oid= err=0 text= ldapserver2 slapd2.4[12172]: conn=15 fd=17 ACCEPT from IP=10.12.2.25:4174 (IP=0.0.0.0:389) ldapserver2 slapd2.4[12172]: conn=15 fd=17 TLS established tls_ssf=256 ssf=256 ldapserver2 slapd2.4[12172]: conn=15 op=1 BIND dn="cn=config" method=128 ldapserver2 slapd2.4[12172]: conn=15 op=1 BIND dn="cn=config" mech=SIMPLE ssf=0 ldapserver2 slapd2.4[12172]: conn=15 op=1 RESULT tag=97 err=0 text= ldapserver2 slapd2.4[12172]: conn=15 op=2 SRCH base="cn=config" scope=2 deref=0 filter="(cn=config)" ldapserver2 slapd2.4[12172]: conn=15 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= ldapserver2 slapd2.4[12172]: conn=15 op=3 UNBIND ldapserver2 slapd2.4[12172]: conn=15 fd=17 closed ldapserver2 slapd2.4[12172]: olcServerID: value #1: <olcServerID> unknown factor <80>A<C2> ldapserver2 slapd2.4[12172]: olcServerID: value #1: <olcServerID> unknown factor <D0>A<C2> ldapserver2 slapd2.4[12172]: null_callback : error code 0x50 ldapserver2 slapd2.4[12172]: syncrepl_entry: rid=002 be_modify failed (80) ldapserver2 slapd2.4[12172]: do_syncrepl: rid=002 retrying (4 retries left) ldapserver2 slapd2.4[12172]: olcServerID: value #1: <olcServerID> unknown factor ldapserver2 slapd2.4[12172]: olcServerID: value #1: <olcServerID> unknown factor ldapserver2 slapd2.4[12172]: null_callback : error code 0x50 Any idea what I may have done wrong here? Thanks! Josh Miller, RHCE

5 6

Remote LDAP servers and parallel queries
by Julien Cassignol 21 May '08

21 May '08

Hi, I recently tried to build a setup as follows : Tree : dc=mycompany,dc=com Subtree 1 : dc=subtree1,dc=mycompany,dc=com Subtree 2 : dc=subtree2,dc=mycompany,dc=com Assuming that my needs are to store subtrees 1 and 2 in separate and remote LDAP servers, I used the LDAP backend. It worked pretty fine, and then I tried to check what was the behaviour if a link went down, or a remote server was unavailable. Testing, I saw that if I have a 10 seconds timeout for each server, if they're both down, my server spends 20 seconds waiting for the timeouts. I assume that's because the queries are done sequentially and not in parallel. Is there any way to be able to parallelize the queries and build a "buffer" for each remote backend in order to reconstruct it later, allowing a user not only to use each remote server, but also to find which subtree a user belongs to, without having those kind of problems ? My test case is pretty simple, but as the final implementation I want to build involves a lot more remote LDAP servers, and as I can't modify the architecture, I'm wondering what are the available solutions. Thanks, -- Julien Cassignol

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical May 2008