openldap-technical May 2008

openldap-technical@openldap.org

62 participants
56 discussions

how to stop openldap
by Paul Lee 02 May '08

02 May '08

I know to start openldap, the following command is used. > slapd -f slapd.conf but to shutdown openldap, what is the command used ? Currently, I am using "pkill slapd" but I think it's not the proper way. Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

2 1

Starting Openldap and adding a new entry into the dabase
by youness hsina 02 May '08

02 May '08

Hi All, i'm a french student, i'm trying to make an Opendldap server on FreeBSD. my openldap version is : openldap-2.3.41 i configured the "slapd.conf" and ldap.conf" in order to start the server. i have two problems the first one is : i try to start the server but it doesn't work ... i don't understand whay it doesn"t work!! stavril# /usr/local/etc/rc.d/slapd start Starting slapd. stavril# /usr/local/etc/rc.d/slapd status slapd is not running. the 2 nd one is : i want to add a new entry into my database but i can't !! stavril# ldapadd -h localhost -x -f test.ldif ldap_bind: Can't contact LDAP server (-1) here there are the files of configuration : slapd.conf, ldap.conf, test.ldif, rc.conf *stavril# cat slapd.conf* # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema #include /usr/local/etc/openldap/schema/nis.schema schemacheck on # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: modulepath /usr/local/libexec/openldap moduleload back_bdb # moduleload back_ldap # moduleload back_ldbm # moduleload back_passwd # moduleload back_shell # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! access to attrs=userPassword by dn="cn=Manager,dc=uvsq,dc=fr" write by dn="cn=proxyuser,dc=uvsq,dc=fr" read by self write by anonymous auth by * none access to attrs=uidNumber,gidNumber by dn="cn=Manager,dc=uvsq,dc=fr" write by dn="cn=proxyuser,dc=uvsq,dc=fr" read by * read access to * by dn="cn=Manager,dc=uvsq,dc=fr" write by self write by * read ##################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=uvsq,dc=fr" rootdn "cn=Manager,dc=uvsq,dc=fr" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/db/openldap-data mode 700 # indice to maintain index objectClass eq #last modification lastmod on *stavril# cat ldap.conf* # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example, dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 BASE dc=uvsq, dc=fr URI ldap://127.0.0.1/ ldap_version 3 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never stavril# cat test.ldif dn: dc=uvsq, dc= fr dc: uvsq objectClass: top objectClass: domain dn: cn=Manager, dc=uvsq, dc=fr objectClass: organizationalRole cn: Manager *rc.conf (the importante lines) * slapd_enable="YES" slapd_flags="-h ldap://%2fvar%2frun%2fopenldap%2fldapi/ ldap://0.0.0.0" slapd_sockets="/var/run/openldap/ldapi" stavril# cat test.ldif dn: dc=uvsq, dc= fr dc: uvsq objectClass: top objectClass: domain dn: cn=Manager, dc=uvsq, dc=fr objectClass: organizationalRole cn: Manager i tried to find a soltuion to my problem 3 days ago without success, i'm waiting for you ideas. thank you very much best regards Uness

1 0

Re: Delete events not propogating with syncrepl
by Srinidhi Sharma 02 May '08

02 May '08

Hi Gavin, Here are the details . Following logs were available at -d255 level. user.ldif file ======== dn: cn=user19,ou=people,dc=example,dc=com objectclass: inetOrgPerson cn: user19 sn: user19-lastname1 uid: user19-user1-lastname1 userpassword: welcome1 carlicense: HISCAR 123 homephone: 555-111-2222 mail: user19(a)example.com description: cool guy ou: Human Resources Master node log file snippet: ==================== >>> dnPrettyNormal: <cn=user19,ou=people,dc=example,dc=com> => ldap_bv2dn(cn=user19,ou=people,dc=example,dc=com,0) <= ldap_bv2dn(cn=user19,ou=people,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=user19,ou=people,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=user19,ou=people,dc=example,dc=com)=0 <<< dnPrettyNormal: <cn=user19,ou=people,dc=example,dc=com>, <cn=user19,ou=people,dc=example,dc=com> bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") => bdb_entry_get: ndn: "cn=user19,ou=people,dc=example,dc=com" => bdb_entry_get: oc: "(null)", at: "(null)" bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") => bdb_entry_get: found entry: "cn=user19,ou=people,dc=example,dc=com" bdb_entry_get: rc=0 ==> bdb_delete: cn=user19,ou=people,dc=example,dc=com bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") => access_allowed: delete access to "ou=people,dc=example,dc=com" "children" requested <= root access granted => access_allowed: delete access granted by manage(=mwrscxd) => access_allowed: delete access to "cn=user19,ou=people,dc=example,dc=com" "entry" requested <= root access granted => access_allowed: delete access granted by manage(=mwrscxd) => bdb_dn2id_delete 0x11: "cn=user19,ou=people,dc=example,dc=com" bdb_idl_delete_key: 11 @cn=user19,ou=people,dc=example,dc=com bdb_idl_delete_key: 11 %ou=people,dc=example,dc=com bdb_idl_delete_key: 11 @ou=people,dc=example,dc=com <= bdb_dn2id_delete 0x11: 0 => index_entry_del( 17, "cn=user19,ou=people,dc=example,dc=com" ) => key_change(DELETE,11) bdb_idl_delete_key: 11 [860433ad] <= key_change 0 => key_change(DELETE,11) bdb_idl_delete_key: 11 [0250ebcb] <= key_change 0 => key_change(DELETE,11) bdb_idl_delete_key: 11 [8c70ccf9] bdb_idl_delete_key: 11 [860433ad] <= key_change 0 => key_change(DELETE,11) bdb_idl_delete_key: 11 [0250ebcb] <= key_change 0 => key_change(DELETE,11) bdb_idl_delete_key: 11 [8c70ccf9] <= key_change 0 => key_change(DELETE,11) bdb_idl_delete_key: 11 [0096defd] <= key_change 0 => key_change(DELETE,11) bdb_idl_delete_key: 11 [e8d6b696] <= key_change 0 => key_change(DELETE,11) bdb_idl_delete_key: 11 <= key_change 0 <= index_entry_del( 17, "cn=user19,ou=people,dc=example,dc=com" ) success ====> bdb_cache_delete( 17 ) bdb_delete: deleted id=00000011 dn="cn=user19,ou=people,dc=example,dc=com" send_ldap_result: conn=1 op=15 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=16 tag=107 err=0 ber_flush2: 14 bytes to sd 12 0000: 30 0c 02 01 10 6b 07 0a 01 00 04 00 04 00 0....k........ ldap_write: want=14, written=14 0000: 30 0c 02 01 10 6b 07 0a 01 00 04 00 04 00 0....k........ daemon: activity on 1 descriptor daemon: activity on: 12r daemon: read activity on 12 daemon: select: listen=7 active_threads=0 tvp=NULL connection_get(12) connection_get(12): got connid=1 connection_read(12): checking for input on id=1 Slave log snippet: ( I didnt see any log msg for delete entry in the slave, so wasnt sure what to cut/paste, so just cut/pasting the user addition log msg) ============= ber_scanf fmt ({mW}) ber: ber_dump: buf=5c5780 ptr=5c5892 end=5c58ca len=56 0000: 30 36 04 08 65 6e 74 72 79 43 53 4e 31 2a 04 28 06..entryCSN1*.( 0010: 32 30 30 38 30 35 30 32 30 39 34 33 34 36 2e 38 20080502094346.8 0020: 38 39 39 34 36 5a 23 30 30 30 30 30 30 23 30 30 89946Z#000000#00 0030: 30 23 30 30 30 30 30 30 0#000000 => bdb_search bdb_dn2entry("dc=example,dc=com") => access_allowed: search access to "dc=example,dc=com" "entry" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) search_candidates: base="dc=example,dc=com" (0x00000001) scope=2 => bdb_dn2idl("dc=example,dc=com") => bdb_filter_candidates AND => bdb_list_candidates 0xa0 => bdb_filter_candidates EQUALITY => bdb_equality_candidates (entryUUID) => key_read bdb_idl_fetch_key: [e8d6b696] <= bdb_index_read: failed (-30989) <= bdb_equality_candidates: id=0, first=0, last=0 <= bdb_filter_candidates: id=0 first=0 last=0 <= bdb_list_candidates: id=0 first=1 last=0 <= bdb_filter_candidates: id=0 first=1 last=0 bdb_search_candidates: id=0 first=1 last=0 bdb_search: no candidates send_ldap_result: conn=-1 op=0 p=3 send_ldap_result: err=0 matched="" text="" ==> bdb_add: cn=user19,ou=people,dc=example,dc=com bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") => bdb_dn2id("cn=user19,ou=people,dc=example,dc=com") <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) => access_allowed: add access to "ou=people,dc=example,dc=com" "children" requested <= root access granted => access_allowed: add access granted by manage(=mwrscxd) => access_allowed: add access to "cn=user19,ou=people,dc=example,dc=com" "entry" requested <= root access granted => access_allowed: add access granted by manage(=mwrscxd) => bdb_dn2id_add 0x11: "cn=user19,ou=people,dc=example,dc=com" bdb_idl_insert_key: 11 %ou=people,dc=example,dc=com bdb_idl_insert_key: 11 @ou=people,dc=example,dc=com <= bdb_dn2id_add 0x11: 0 => index_entry_add( 17, "cn=user19,ou=people,dc=example,dc=com" ) => key_change(ADD,11) bdb_idl_insert_key: 11 [860433ad] <= key_change 0 => key_change(ADD,11) bdb_idl_insert_key: 11 [0250ebcb] <= key_change 0 => key_change(ADD,11) bdb_idl_insert_key: 11 [8c70ccf9] <= key_change 0 => key_change(ADD,11) bdb_idl_insert_key: 11 [0096defd] <= key_change 0 => key_change(ADD,11) bdb_idl_insert_key: 11 [e8d6b696] <= key_change 0 => key_change(ADD,11) bdb_idl_insert_key: 11 <= key_change 0 <= index_entry_add( 17, "cn=user19,ou=people,dc=example,dc=com" ) success => entry_encode(0x00000011): cn=user19,ou=people,dc=example,dc=com bdb_add: added id=00000011 dn="cn=user19,ou=people,dc=example,dc=com" send_ldap_result: conn=-1 op=0 p=3 send_ldap_result: err=0 matched="" text="" ldap_msgfree ldap_result ld 5b9630 msgid 2 wait4msg ld 5b9630 msgid 2 (infinite timeout) wait4msg continue ld 5b9630 msgid 2 all 0 ** ld 5b9630 Connections: - Srinidhi On Wed, Apr 30, 2008 at 7:53 PM, Gavin Henry <ghenry(a)openldap.org> wrote: > Srinidhi Sharma wrote: > > > Hi, > > I am using open ldap 2.4.8 with Berkeley DB 4.6.21 ( I haven't applied > > any patch to either open ldap or to Berkeley DB). > > > > When I configure a slave process, the addition and modification of users > > get propogated from master to slave. But the deletion of users from the > > master do not get propogated. the slapd logs in the master show that user > > is getting deleted. > > > > Logs needed and an example user please ;-) > > > > I saw a old note " > > http://www.openldap.org/lists/openldap-bugs/200409/msg00001.html" which > > listed similar issue. > > > > > Not relevant as that's for 2.2. > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ > > Suretec Systems is a limited company registered in Scotland. Registered > number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, > Aberdeenshire, AB51 4FP. > -- Thanks, Srinidhi

1 0

Recommendation for Web Interface for OpenLDAP
by Wes Modes 02 May '08

02 May '08

Howdy, I'm looking for a web interface for OpenLDAP. I want something pretty simple since I won't need to reorganize the entire DIT through the web, only add, delete, and modify users and groups. I'm using smbldap-tools which has it's own set of scripts that I can tap into. I will need to extend the web interface to modify the samba schema extensions to LDAP or run the smbldap-scripts. With that in mind, I am interested in something written in PHP or Perl that can be easily modified or extended. I'd love it if you can recommend a simple web interface for LDAP. If you can recommend something, please tell me what features appeal to you or work well for you. And how does it meet my criteria: * Simple - minimal bells and whistles * add, delete, and modify users * add, delete, and modify groups * secure - using SSL/TLS * linux and apache friendly * written in perl, php, or python Thanks for your help.

4 5

Re: syncrel seems ignore some of the LDAP update request
by Paul Lee 02 May '08

02 May '08

I setup 2-way master as shown in the config file previously. I think the openldap will sync the data once I update one of the openldap servers. I use a java program to update the data every 100ms. Thanks Gavin Henry wrote: > How did you bring the data over to the second MirrorMode node? > Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

1 0

Passwd can not able to updated Centerlize LDAP Server
by Vipul Ramani 01 May '08

01 May '08

Hi all , I have openldap running on solaris 10 x86 server with all system users are migrated on LDAP TREE.!. I configure client on other solaris 10 x86 server. I can login( SSH and dtlogin) to other solaris 10 server using LDAP user . but while i am try to change password i m getting this problem do i missing anything . I am suspecting about pam.conf configuration. I tried couple of combinations but not able to get rid of this. Same configuration is working Linux ( as standard changes in system-auth config file...) I am using Solaris 10 ( intel) NATIVE LDAP Client as LDAP client. ==Solaris console=== bash-3.00$ passwd passwd: Changing password for vipul3 Enter existing login password: New Password: Re-enter new Password: passwd: vipul3 does not exist. Permission denied bash-3.00$ ======================== Var/adm/message Apr 30 02:27:30 xxxx passwd[6954]: [ID 574280 user.error] passwdutil: no legal LDAP authentication method configured Apr 30 02:27:30 xxxx passwd[6954]: [ID 574280 user.error] passwdutil: no legal LDAP authentication method configured ============================= -- Regards Vipul Ramani

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical May 2008