openldap-technical June 2008

openldap-technical@openldap.org

73 participants
83 discussions

slapcat/ldapsearch question
by daniel rahmeh 04 Jun '08

04 Jun '08

Hi, i'm trying to export my openldap entries to an ldif file. My userPassword attribute has the following format: userPassword: {CRYPT}$1$$Y2j3VjkaCXmJ.YsPztha89 when i try to export it using slapcat or ldapsearch it doesn't remain the same, it becomes something like: userPassword:: e0NSWJBUfSQxJCRVMm8zVnpJYUNVbUolWHNXenRJKTgw If you have any idea about the origin of the issue please tell me thank you

2 2

Stupid question about search
by AlexanDER Franca 04 Jun '08

04 Jun '08

Hi all. Again, sorry for my horrible english. So... I implemented a ldap server at my work. All the systems are working fine. OpenLDAP have being a great backend. But now I need to satisfy the users. They must perform some 'intuitive' searches like "who are the persons on group X, or list all telephones of people on group Y". But all of this must be executed by 'normal' users. Phpldapadmin have a good interface, but for admins, not for users (IMO). I don't know, for example, about groups... I have groupOfUniquenames, so... if an user want a list of users, and when choose 'users' node of tree, he get all users. To know about a group, he must go to 'groups' node and look at 'uniqueMember'. It seems not too much intuitive. So... I don't know how to implement (and what) to have this stuffs working for my users. []'s Alexander Brazil - Rio de Janeiro

3 2

Re: Delete events not propogating with syncrepl
by Srinidhi Sharma 04 Jun '08

04 Jun '08

Hi, I am using openldap 2.4.9. Deleted entries do not get propagated to slave from master using syncrepl. I had tried the similar use case in 2.4.8 and ran into the same issue. Is this a known issue in 2.4.9 ? Any pointers would be helpful. - Srinidhi. On Tue, May 6, 2008 at 12:42 AM, Gavin Henry <ghenry(a)openldap.org> wrote: > Srinidhi Sharma wrote: > >> Hi Gavin, >> Here are the details . >> Following logs were available at -d255 level. >> >> user.ldif file >> ======== >> dn: cn=user19,ou=people,dc=example,dc=com >> objectclass: inetOrgPerson >> cn: user19 >> sn: user19-lastname1 >> uid: user19-user1-lastname1 >> userpassword: welcome1 >> carlicense: HISCAR 123 >> homephone: 555-111-2222 >> mail: user19(a)example.com <mailto:user19@example.com> >> >> description: cool guy >> ou: Human Resources >> >> >> Master node log file snippet: >> ==================== >> >>> dnPrettyNormal: <cn=user19,ou=people,dc=example,dc=com> >> => ldap_bv2dn(cn=user19,ou=people,dc=example,dc=com,0) >> <= ldap_bv2dn(cn=user19,ou=people,dc=example,dc=com)=0 >> => ldap_dn2bv(272) >> <= ldap_dn2bv(cn=user19,ou=people,dc=example,dc=com)=0 >> => ldap_dn2bv(272) >> <= ldap_dn2bv(cn=user19,ou=people,dc=example,dc=com)=0 >> <<< dnPrettyNormal: <cn=user19,ou=people,dc=example,dc=com>, >> <cn=user19,ou=people,dc=example,dc=com> >> bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") >> => bdb_entry_get: ndn: "cn=user19,ou=people,dc=example,dc=com" >> => bdb_entry_get: oc: "(null)", at: "(null)" >> bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") >> => bdb_entry_get: found entry: "cn=user19,ou=people,dc=example,dc=com" >> bdb_entry_get: rc=0 >> ==> bdb_delete: cn=user19,ou=people,dc=example,dc=com >> bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") >> => access_allowed: delete access to "ou=people,dc=example,dc=com" >> "children" requested >> <= root access granted >> => access_allowed: delete access granted by manage(=mwrscxd) >> => access_allowed: delete access to >> "cn=user19,ou=people,dc=example,dc=com" "entry" requested >> <= root access granted >> => access_allowed: delete access granted by manage(=mwrscxd) >> => bdb_dn2id_delete 0x11: "cn=user19,ou=people,dc=example,dc=com" >> bdb_idl_delete_key: 11 @cn=user19,ou=people,dc=example,dc=com >> bdb_idl_delete_key: 11 %ou=people,dc=example,dc=com >> bdb_idl_delete_key: 11 @ou=people,dc=example,dc=com >> <= bdb_dn2id_delete 0x11: 0 >> => index_entry_del( 17, "cn=user19,ou=people,dc=example,dc=com" ) >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [860433ad] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [0250ebcb] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [8c70ccf9] >> bdb_idl_delete_key: 11 [860433ad] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [0250ebcb] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [8c70ccf9] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [0096defd] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [e8d6b696] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 >> <= key_change 0 >> <= index_entry_del( 17, "cn=user19,ou=people,dc=example,dc=com" ) success >> ====> bdb_cache_delete( 17 ) >> bdb_delete: deleted id=00000011 dn="cn=user19,ou=people,dc=example,dc=com" >> send_ldap_result: conn=1 op=15 p=3 >> send_ldap_result: err=0 matched="" text="" >> send_ldap_response: msgid=16 tag=107 err=0 >> ber_flush2: 14 bytes to sd 12 >> 0000: 30 0c 02 01 10 6b 07 0a 01 00 04 00 04 00 0....k........ >> ldap_write: want=14, written=14 >> 0000: 30 0c 02 01 10 6b 07 0a 01 00 04 00 04 00 0....k........ >> daemon: activity on 1 descriptor >> daemon: activity on: 12r >> daemon: read activity on 12 >> daemon: select: listen=7 active_threads=0 tvp=NULL >> connection_get(12) >> connection_get(12): got connid=1 >> connection_read(12): checking for input on id=1 >> >> >> Slave log snippet: ( I didnt see any log msg for delete entry in the >> slave, so wasnt sure what to cut/paste, so just cut/pasting the user >> addition log msg) >> ============= >> ber_scanf fmt ({mW}) ber: >> ber_dump: buf=5c5780 ptr=5c5892 end=5c58ca len=56 >> 0000: 30 36 04 08 65 6e 74 72 79 43 53 4e 31 2a 04 28 >> 06..entryCSN1*.( 0010: 32 30 30 38 30 35 30 32 30 39 34 33 34 36 2e 38 >> 20080502094346.8 0020: 38 39 39 34 36 5a 23 30 30 30 30 30 30 23 30 30 >> 89946Z#000000#00 0030: 30 23 30 30 30 30 30 30 >> 0#000000 => bdb_search >> bdb_dn2entry("dc=example,dc=com") >> => access_allowed: search access to "dc=example,dc=com" "entry" requested >> <= root access granted >> => access_allowed: search access granted by manage(=mwrscxd) >> search_candidates: base="dc=example,dc=com" (0x00000001) scope=2 >> => bdb_dn2idl("dc=example,dc=com") >> => bdb_filter_candidates >> AND >> => bdb_list_candidates 0xa0 >> => bdb_filter_candidates >> EQUALITY >> => bdb_equality_candidates (entryUUID) >> => key_read >> bdb_idl_fetch_key: [e8d6b696] >> <= bdb_index_read: failed (-30989) >> <= bdb_equality_candidates: id=0, first=0, last=0 >> <= bdb_filter_candidates: id=0 first=0 last=0 >> <= bdb_list_candidates: id=0 first=1 last=0 >> <= bdb_filter_candidates: id=0 first=1 last=0 >> bdb_search_candidates: id=0 first=1 last=0 >> bdb_search: no candidates >> send_ldap_result: conn=-1 op=0 p=3 >> send_ldap_result: err=0 matched="" text="" >> ==> bdb_add: cn=user19,ou=people,dc=example,dc=com >> bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") >> => bdb_dn2id("cn=user19,ou=people,dc=example,dc=com") >> <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found >> (-30989) >> => access_allowed: add access to "ou=people,dc=example,dc=com" "children" >> requested >> <= root access granted >> => access_allowed: add access granted by manage(=mwrscxd) >> => access_allowed: add access to "cn=user19,ou=people,dc=example,dc=com" >> "entry" requested >> <= root access granted >> => access_allowed: add access granted by manage(=mwrscxd) >> => bdb_dn2id_add 0x11: "cn=user19,ou=people,dc=example,dc=com" >> bdb_idl_insert_key: 11 %ou=people,dc=example,dc=com >> bdb_idl_insert_key: 11 @ou=people,dc=example,dc=com >> <= bdb_dn2id_add 0x11: 0 >> => index_entry_add( 17, "cn=user19,ou=people,dc=example,dc=com" ) >> => key_change(ADD,11) >> bdb_idl_insert_key: 11 [860433ad] >> <= key_change 0 >> => key_change(ADD,11) >> bdb_idl_insert_key: 11 [0250ebcb] >> <= key_change 0 >> => key_change(ADD,11) >> bdb_idl_insert_key: 11 [8c70ccf9] >> <= key_change 0 >> => key_change(ADD,11) >> bdb_idl_insert_key: 11 [0096defd] >> <= key_change 0 >> => key_change(ADD,11) >> bdb_idl_insert_key: 11 [e8d6b696] >> <= key_change 0 >> => key_change(ADD,11) >> bdb_idl_insert_key: 11 >> <= key_change 0 >> <= index_entry_add( 17, "cn=user19,ou=people,dc=example,dc=com" ) success >> => entry_encode(0x00000011): cn=user19,ou=people,dc=example,dc=com >> bdb_add: added id=00000011 dn="cn=user19,ou=people,dc=example,dc=com" >> send_ldap_result: conn=-1 op=0 p=3 >> send_ldap_result: err=0 matched="" text="" >> ldap_msgfree >> ldap_result ld 5b9630 msgid 2 >> wait4msg ld 5b9630 msgid 2 (infinite timeout) >> wait4msg continue ld 5b9630 msgid 2 all 0 >> ** ld 5b9630 Connections: >> >> - Srinidhi >> On Wed, Apr 30, 2008 at 7:53 PM, Gavin Henry <ghenry(a)openldap.org<mailto: >> ghenry(a)openldap.org>> wrote: >> >> Srinidhi Sharma wrote: >> >> Hi, >> I am using open ldap 2.4.8 with Berkeley DB 4.6.21 ( I haven't >> applied any patch to either open ldap or to Berkeley DB). >> >> When I configure a slave process, the addition and modification >> of users get propogated from master to slave. But the deletion >> of users from the master do not get propogated. the slapd logs >> in the master show that user is getting deleted. >> >> >> Logs needed and an example user please ;-) >> >> >> >> I saw a old note >> "http://www.openldap.org/lists/openldap-bugs/200409/msg00001.html" >> which listed similar issue. >> >> >> Not relevant as that's for 2.2. >> >> -- Kind Regards, >> >> Gavin Henry. >> OpenLDAP Engineering Team. >> >> E ghenry(a)OpenLDAP.org >> >> Community developed LDAP software. >> >> http://www.openldap.org/project/ >> >> Suretec Systems is a limited company registered in Scotland. Registered >> number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, >> Aberdeenshire, AB51 4FP. >> >> >> >> >> -- >> Thanks, >> Srinidhi >> > > I'd wait for 2.4.9 as there are lots of syncrepl fixes..coming soon. > > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ > > Suretec Systems is a limited company registered in Scotland. Registered > number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, > Aberdeenshire, AB51 4FP. > -- Thanks, Srinidhi

2 1

Current OpenLDAP Windows Binary
by guse＠kingmedia.de 03 Jun '08

03 Jun '08

Dear all, in a project we use the OpenLDAP proxy feature. Our server infrastructure is based on MS Windows, so it is tough to install a current OpenLDAP version. At the moment we use Cygwin to run OpenLDAP, but this doesn't seem to be the best solution. We searched the web and found OpenLDAP 2.0.27 as a Windows installer. Unfortunately this old version does not accept our configuration which runs like a charm in 2.3.39 we use in Cygwin. Is there anybody out there who can give us a helping hand getting a current windows OpenLDAP build? Regards, Christoph

1 0

Custom Syntaxes
by Jeff Sussna 03 Jun '08

03 Jun '08

Is it possible to add new syntax definitions to LDAP? I've done various searches without unearthing anything. In particular, I'd like to specify a syntax which is "an integer between 0 and 5". Can I do that or do I need to code the enforcement into my client?

2 1

bdb panics with openldap
by Govind c 03 Jun '08

03 Jun '08

We have openldap using the bdb has its database.For some reason the bdb had crashed complaining permission issue. May 13 16:04:40 ccc slapd[30372]: conn=12430 fd=10 ACCEPT from IP=xxx.yyy.zzz.aaa:33905 (IP=0.0.0.0:389) May 13 16:04:40 ccc slapd[30372]: conn=12430 op=0 BIND dn="cn=Directory Manager,o=none.com" method=128 May 13 16:04:40 ccc slapd[30372]: conn=12430 op=0 BIND dn="cn=Directory Manager,o=none.com" mech=SIMPLE ssf=0 May 13 16:04:40 ccc slapd[30372]: conn=12430 op=0 RESULT tag=97 err=0 text= May 13 16:04:40 ccc slapd[30372]: conn=12430 op=1 MOD dn="uid=sysadmin,o=none.com" May 13 16:04:40 ccc slapd[30372]: conn=12430 op=1 MOD noner=lastlogints lastaccessts authcookie May 13 16:04:40 ccc slapd[30372]: bdb(o=none.com): /var/lib/ldap/log.0000000002: log file open failed: Permission denied May 13 16:04:40 ccc slapd[30372]: bdb(o=none.com): PANIC: Permission denied May 13 16:04:40 ccc slapd[30372]: bdb(o=none.com): DB_ENV->log_put: 2: DB_RUNRECOVERY: Fatal error, run database recovery May 13 16:04:40 ccc slapd[30372]: bdb(o=none.com): /var/lib/ldap/log.0000000002: log file open failed: Permission denied The log.000000000 gets rotated based on the size (10MB).The new logfile(log.0000000002) was rotated at on Apr 30th and I believe the permission was set as root:root instead of ldap:ldap(Note: the ldap being run as user ldap).The reason why didnât crash till yesterday was, only search queries were run against the ldap/bdb (The ldap search test for testing ldap keep alive).Yesterday a modify query was run from IP xxx.yyy.zzz.aaa and I guess bdb complained of permission problem and panicked May 13 16:04:40 ccc slapd[30372]: conn=12430 fd=10 ACCEPT from IP=xxx.yyy.zzz.aaa:33905 (IP=0.0.0.0:389) May 13 16:04:40 ccc slapd[30372]: conn=12430 op=0 BIND dn="cn=Directory Manager,o=none.com" method=128 May 13 16:04:40 ccc slapd[30372]: conn=12430 op=0 BIND dn="cn=Directory Manager,o=none.com" mech=SIMPLE ssf=0 May 13 16:04:40 ccc slapd[30372]: conn=12430 op=0 RESULT tag=97 err=0 text= May 13 16:04:40 ccc slapd[30372]: conn=12430 op=1 MOD dn="uid=sysadmin,o=none.com" [root@ccc ldap]# ls -l /var/lib/ldap total 13236 -rw------- 1 ldap ldap 106496 Mar 24 19:30 cn.bdb -rw------- 1 ldap ldap 16384 Mar 20 11:50 __db.001 -rw------- 1 ldap ldap 278528 Mar 20 11:50 __db.002 -rw------- 1 ldap ldap 98304 Mar 20 11:50 __db.003 -rw------- 1 ldap ldap 450560 Mar 20 11:50 __db.004 -rw------- 1 ldap ldap 16384 Mar 20 11:50 __db.005 -rw------- 1 ldap ldap 45056 Mar 24 19:30 dn2id.bdb -rw------- 1 ldap ldap 278528 Apr 2 13:40 id2entry.bdb -rw------- 1 ldap ldap 10485710 Apr 30 14:40 log.0000000001 -rw------- 1 root root 1827874 May 13 16:00 log.0000000002 -rw------- 1 ldap ldap 8192 Mar 20 11:50 mail.bdb -rw------- 1 ldap ldap 16384 Mar 24 19:30 objectClass.bdb -rw-r--r-- 1 ldap ldap 0 Apr 2 13:31 openldap-master-replog -rw-r--r-- 1 ldap ldap 0 Apr 2 13:31 openldap-master-replog.lock -rw------- 1 ldap ldap 8192 Mar 20 11:50 ou.bdb drwxr-xr-x 2 root root 4096 Mar 21 16:33 replica -rw------- 1 ldap ldap 49152 Mar 20 11:50 sn.bdb -rw------- 1 ldap ldap 8192 Mar 20 12:00 uid.bdb The ldap is being run as user ldap [root@ccc ~]# ps -ef | grep ldap root 8983 6956 0 15:40 pts/0 00:00:00 grep ldap ldap 31694 1 0 Mar20 ? 00:01:57 /usr/sbin/slapd -u ldap -h ldap:/// [root@ccc ~]# grep ldap /etc/passwd ldap:x:55:55:LDAP User:/var/lib/ldap:/bin/false Why should a modify cause a panic and not a search?Why did the rotated log had root as owner instead of ldap?Is there a fix for this issue? Cheers CG

3 2

Re: bdb panics with openldap
by Hallvard B Furuseth 03 Jun '08

03 Jun '08

Please keep replies on the list. Govind c writes: > Well I haven`t set any parameter to rotate.I guess the > bdb has some in-built feature where in it rotates > after the log file reached 10M. Ah, OK. I don't think BDB rotates, it just closes the old logfile and starts a new one. I expect that's what they want all the digits for: They don't reuse logfile names, but you are not likely to need 1000000000 logfiles for the lifetime of a database. Anyway, it looks like you have sometimes run slapd or the slap tools as user ldap and sometimes as root, and so the files have conflicting ownership. Make up your mind about the user, chown the files to that user and stick to it. -- Hallvard

1 0

ProFTP + LDAP + SSL (LDAPServer 1.2.3.4:636)
by catia.lavalle＠bechtle.com 03 Jun '08

03 Jun '08

Hello, I do not know if this is the place to ask but maybe some of you have already had this configuration. I have a problem configuring ProFTP to use LDAP over SSL (i.e. ldaps on port 636). In short: ProFTP without TLS (TLSEngine off) DOES authenticate with LDAP without SSL (LDAPServer 1.2.3.4:389) ProFTP with TLS (TLSEngine on, path to the ftp-ssl certificates) DOES authenticate with LDAP without SSL (LDAPServer 1.2.3.4:389) ProFTP with TLS (TLSEngine on, path to the ftp-ssl certificates) DOES NOT authenticate with LDAP with SSL (LDAPUseTLS on; LDAPServer 1.2.3.4:636) The procedure is a 2 way SSL with 2 certificates: filezilla (for example) (acting as client for ProFTP) ->SSL(cert_ftp)-> ProFTP (acting as server for filezilla, cert_ftp) ProFTP (acting as client for LDAP) ->SSL(cert_LDAP)-> LDAP (acting as server for the ProFTP, cert_LDAP). If I look in the logs I see that the ProFTP Server connects to the LDAP server on the correct port, the LDAP server accepts the connection but the TLS fails! In principle for me it is obvious because in the ProFTP configuration I do give the path to the FTP-SSL certificates and keys but I do not input any path for the LDAP-SSL certificates i.e. in my opinion it can not work like this. So my question is how to make it work? As I have said in my opinion the key point is to be able to set the path where the ProFTP server finds the certificates for the LDAP server. I do not find any hint whatsoever in the net. The steps I have done: LDAP Server: The LDAP Server IP (say) 1.2.3.4 The LDAP Server listens to port 636 (ldaps) and port (ldap). I have created a certificate for the LDAP server (slapd.pem, slapd.key) The LDAP server itself is fully functioning on both ldap and ldaps (for example ldaps with apache ok) ProFTP Server: The ProFTP Server IP (say) 5.6.7.8 I have created a certificate for the ProFTP server (ftp2.pem, ftp2.key) I have copied locally the certificates of the LDAP server (slapd.pem) This is exactly what you do with apache (and it works) provided one gives the path for "both" certificates LDAPTrustedGlobalCert CA_BASE64 /apache/conf/ssl_certs/slapd.pem .... .... SSLCertificateFile /apache/conf/ssl_certs/apache.pem SSLCertificateKeyFile /apache/conf/ssl_certs/apache.key This is the ProFTP configuration (mod_tls and mod_ldap parts) <IfModule mod_tls.c> TLSEngine on TLSLog /ftp2/logs/tls.log TLSProtocol SSLv23 TLSOptions NoCertRequest TLSRSACertificateFile /ftp2/conf/ssl_certs/ftp2.pem TLSRSACertificateKeyFile /ftp2/conf/ssl_certs/ftp2.key TLSCACertificateFile /ftp2/conf/ssl_certs/ftp2.pem TLSVerifyClient off TLSRequired on TLSRenegotiate required off </IfModule> <IfModule mod_ldap.c> #LDAPServer 1.2.3.4:389 LDAPUseTLS on LDAPServer 1.2.3.4:636 LDAPDoAuth on "ou=bbb,dc=aaa,dc=de" "(&(uid=%v)(objectclass=posixAccount))" LDAPDNInfo "uid=1234,dc=aaa,dc=de" root LDAPAuthBinds on LDAPDoUIDLookups on "ou=bbb,dc=aaa,dc=de" LDAPSearchScope subtree </IfModule> Both LDAP server and ProFTP (proftp-ldap) server are: Linux version 2.6.18-6-amd64 (Debian 2.6.18.dfsg.1-18etch1) (waldi(a)debian.org) (gcc version 4.1.2 20061115 (prerelease) (Debian 4.1.1-21)) #1 SMP Sun Feb 10 17:50:19 UTC 2008 OpenLDAP server (slapd) dpkg -l | grep slapd ii slapd 2.3.30-5+etch1 I have used the ProFTP with precompiled LDAP (proftp-ldap) dpkg -l | grep proftp ii proftpd 1.3.0-19 Versatile, virtual-hosting FTP daemon ii proftpd-ldap 1.3.0-19 Versatile, virtual-hosting FTP daemon Error in /var/log/syslog from slapd May 27 10:54:05 ftp1test slapd[7323]: daemon: activity on 1 descriptor May 27 10:54:05 ftp1test slapd[7323]: daemon: listen=9, new connection on 19 May 27 10:54:05 ftp1test slapd[7323]: daemon: added 19r (active) listener=(nil) May 27 10:54:05 ftp1test slapd[7323]: conn=106 fd=19 ACCEPT from IP=5.6.7.8:42564 (IP=0.0.0.0:636) May 27 10:54:05 ftp1test slapd[7323]: daemon: select: listen=6 active_threads=0 tvp=NULL May 27 10:54:05 ftp1test slapd[7323]: daemon: select: listen=7 active_threads=0 tvp=NULL May 27 10:54:05 ftp1test slapd[7323]: daemon: select: listen=8 active_threads=0 tvp=NULL May 27 10:54:05 ftp1test slapd[7323]: daemon: select: listen=9 active_threads=0 tvp=NULL May 27 10:54:05 ftp1test slapd[7323]: daemon: activity on 1 descriptor May 27 10:54:05 ftp1test slapd[7323]: daemon: activity on: May 27 10:54:05 ftp1test slapd[7323]: 19r May 27 10:54:05 ftp1test slapd[7323]: May 27 10:54:05 ftp1test slapd[7323]: daemon: read activity on 19 May 27 10:54:05 ftp1test slapd[7323]: daemon: removing 19 May 27 10:54:05 ftp1test slapd[7323]: conn=106 fd=19 closed (TLS negotiation failure) Please Help Thanks.

1 0

could not hard reconnect to LDAP server - Server is unavailable
by Gar Nelson 03 Jun '08

03 Jun '08

"As it quite unlikely that issues raised in your message could not be discussed without talking about the particulars of nss_ldap, your message is more appropriately directed to the openldap-technical list." So, take two. :) Starting openldap takes about five minutes to come up due to all the timeouts indicated in /var/log/messages. I've been googling without success, and openldap-software is not the appropriate venue for discussion of my problem. Hopefully this is, since I'm running out of options on where to look. Thank you for any assistance, or pointers toward the right direction. Gar -------- Original Message -------- Subject: could not hard reconnect to LDAP server - Server is unavailable Date: Fri, 30 May 2008 15:17:32 -0600 From: Gar Nelson <gar.nelson(a)noaa.gov> Organization: National Weather Service To: openldap-software(a)openldap.org I'm currently using openldap-2.2.13-8.el4_6.4 on RHEL 4 and for the most part, it appears to be working. I can use ldap to log in on another machine, and on a different workstation, the Apache directory browser connects and browses (and edits) just fine. However, when watching /var/log/messages, all is not calm under the surface. A shortened snippet of the log is as follows; May 30 14:55:46 ggw-s-bdc runuser: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server May 30 14:55:46 ggw-s-bdc runuser: nss_ldap: reconnecting to LDAP server... May 30 14:55:46 ggw-s-bdc runuser: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server May 30 14:55:46 ggw-s-bdc runuser: nss_ldap: reconnecting to LDAP server... [...] May 30 14:57:46 ggw-s-bdc runuser: nss_ldap: could not hard reconnect to LDAP server - Server is unavailable May 30 14:57:46 ggw-s-bdc slaptest: sql_select option missing May 30 14:57:46 ggw-s-bdc slaptest: auxpropfunc error no mechanism available May 30 14:57:46 ggw-s-bdc runuser: config file testing succeeded May 30 14:57:46 ggw-s-bdc ldap: Checking configuration files for slapd: succeeded May 30 14:57:46 ggw-s-bdc slapd[16932]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server May 30 14:57:46 ggw-s-bdc slapd[16932]: nss_ldap: reconnecting to LDAP server... May 30 14:57:46 ggw-s-bdc slapd[16932]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server May 30 14:57:46 ggw-s-bdc slapd[16932]: nss_ldap: reconnecting to LDAP server... [...] May 30 14:59:46 ggw-s-bdc slapd[16932]: nss_ldap: could not hard reconnect to LDAP server - Server is unavailable May 30 14:59:46 ggw-s-bdc slapd[16932]: sql_select option missing May 30 14:59:46 ggw-s-bdc slapd[16932]: auxpropfunc error no mechanism available May 30 14:59:46 ggw-s-bdc ldap: slapd startup succeeded It takes around five minutes for ldap to come up waiting for all the bind timeouts. I've tried googling without success, I've tried changing from host to uri, and from the local 127 address to the machine's outside IP without success. SELinux is disabled. IPTables is not running. nmap localhost reports port 389 is open, along with an nmap to it's outside ip address. I'm at a loss as to how to get "nss-ldap" to bind. ldap.conf is as follows; # @(#)$Id: ldap.conf,v 1.34 2004/09/16 23:32:02 lukeh Exp $ # # PADL Software # http://www.padl.com # debug 256 logdir /var/log/ldap.log #host 127.0.0.1 base dc=ggw,dc=nws,dc=noaa uri ldap://127.0.0.1/ #uri ldaps://127.0.0.1/ #uri ldapi://%2fvar%2frun%2fldapi_sock/ # Note: %2f encodes the '/' used as directory separator binddn cn=Manager,dc=ggw,dc=nws,dc=noaa bindpw [correct ldap password] port 389 timelimit 50 bind_timelimit 50 bind_policy hard idle_timelimit 3600 pam_password exop nss_base_passwd ou=People,dc=ggw,dc=nws,dc=noaa?one nss_base_passwd ou=Computers,dc=ggw,dc=nws,dc=noaa?one nss_base_shadow ou=People,dc=ggw,dc=nws,dc=noaa?one nss_base_group ou=Groups,dc=ggw,dc=nws,dc=noaa?one #nss_base_hosts ou=Hosts,dc=ggw,dc=nws,dc=noaa?one #nss_base_services ou=Services,dc=ggw,dc=nws,dc=noaa?one #nss_base_networks ou=Networks,dc=ggw,dc=nws,dc=noaa?one #nss_base_protocols ou=Protocols,dc=ggw,dc=nws,dc=noaa?one #nss_base_rpc ou=Rpc,dc=ggw,dc=nws,dc=noaa?one #nss_base_ethers ou=Ethers,dc=ggw,dc=nws,dc=noaa?one #nss_base_netmasks ou=Networks,dc=ggw,dc=nws,dc=noaa?one #nss_base_bootparams ou=Ethers,dc=ggw,dc=nws,dc=noaa?one #nss_base_aliases ou=Aliases,dc=ggw,dc=nws,dc=noaa?one #nss_base_netgroup ou=Netgroup,dc=ggw,dc=nws,dc=noaa?one ssl no tls_cacertdir /etc/openldap/cacerts pam_password md5

2 1

Custom Schema
by openLDAP 02 Jun '08

02 Jun '08

I am quite new to OpenLDAP and cannot seem resolve why slapd does not start when I add a custom schema. Nothing appears in syslog and the following appears when I try to start it: root@control:/etc/ldap# sudo slapd -d acl @(#) $OpenLDAP: slapd 2.4.7 (Apr 29 2008 08:44:27) $ buildd@rothera:/build/buildd/openldap2.3-2.4.7/debian/build/servers/slapd AttributeTypeDescription = "(" whsp numericoid whsp ; AttributeType identifier [ "NAME" qdescrs ] ; name used in AttributeType [ "DESC" qdstring ] ; description [ "OBSOLETE" whsp ] [ "SUP" woid ] ; derived from this other ; AttributeType [ "EQUALITY" woid ] ; Matching Rule name [ "ORDERING" woid ] ; Matching Rule name [ "SUBSTR" woid ] ; Matching Rule name [ "SYNTAX" whsp noidlen whsp ] ; see section 4.3 [ "SINGLE-VALUE" whsp ] ; default multi-valued [ "COLLECTIVE" whsp ] ; default not collective [ "NO-USER-MODIFICATION" whsp ]; default user modifiable [ "USAGE" whsp AttributeUsage ]; default userApplications ; userApplications ; directoryOperation ; distributedOperation ; dSAOperation whsp ")" slapd stopped. Can someone please point me in the right direction to resolving this type of error?

2 1

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical June 2008