openldap-technical November 2009

openldap-technical@openldap.org

51 participants
58 discussions

OpenLDAP not finding Cyrus SASL
by Dhruva T S 17 Nov '09

17 Nov '09

Hi, I have compiled OpenLDAP 2.4.19 using env CPPFLAGS="-I/Desktop/libs/include/sasl" LDFLAGS="-L/Desktop/libs/lib/sasl2 -R/Desktop/libs/lib/sasl2" ./configure --with-cyrus-sasl. The version of Cyrus SASL is 2.1.23. When I use /usr/local/bin/ldapsearch -H ldap://ldap.example.org -x -b "" -s base supportedSASLMechanisms, I get NTLM and GSS-SPNEGO as the mechanisms from server. But when I give /usr/local/bin/ldapsearch -Y NTLM -H ldap://ldap.example.org -b 'ou=users,ou=readimanager' '(cn=dhruva)' I am getting ldap_sasl_interactive_bind_s : Local error (-2). Is there a way to solve this? Thanks, Dhruva

1 0

checkpoint and DB_TXN_NOSYNC
by jakjr 17 Nov '09

17 Nov '09

Hello Guys, A little doubt. When using DB_TXN_NOSYNC flag in DB_CONFIG is it necessary to config checkpoint on slapd.conf ? I ask this, because when restarting a old openldap version (2.3.30) it always start the bdb recovery, and this recovery access all log,0000(XXX) and it is too slow. I checked this using lsof. Best regards, João Alfredo

1 0

Reg Profile in OpenLdap
by Asimananda Mohanty 16 Nov '09

16 Nov '09

Hi All, I have openLDAP on ubuntu and LDAP client on Solaris. What I need is a user should be able to log in to the solaris server with a user that is present in LDAP (not in /etc/passwd of Solaris machine) I have added object classes nisDomainObject, ndsLoginProperties and ndsContainerLoginProperties (all inherits from organizationalUnit) and also added an attribute nisDomain. Then I created a user asmii like : dn: uid=asmii,ou=people,dc=ldap-company,dc=com objectClass: organizationalUnit objectClass: nisDomainObject objectClass: posixAccount objectClass: shadowAccount uid: asmii ou: asmii cn: asmii uidNumber: 1006 gidNumber: 10000 userPassword: password gecos: asmii loginShell: /bin/bash homeDirectory: /home/asmii nisDomain: ldap-company.com shadowExpire: -1 shadowFlag: 0 shadowWarning: 7 shadowMin: 8 shadowMax: 999999 shadowLastChange: 10877 postalCode: 122015 l: Toulouse postalAddress: Now I need to create a profile so that the LDAP client on Solaris can download it. Please let me know what is this profile and how do I create this. I googled a bit and found that I need a ObjectClass DUAConfigProfile in my LDAP. Is this the ObjectClass I need in my LDAP server? What would I do next? How do I connect the user "asmii" with a profile? Please suggest. Thanks in advance. Regards Asimananda Mohanty

2 2

Recursive ACL entries (group member of group)
by Jan Thiemo Fricke 16 Nov '09

16 Nov '09

Hi list members, I use a openldap server for the user management of an proprietary client/server application. Users are modified person class objects. Groups are groupOfName objects. Rights are also groupOfNames. Users are members of groups and groups are members of rights. To exemplify my problem: User: cn=example,ou=users,dc=mydomain Group: cn=supervisors,ou=groups,dc=mydomain Right: cn=someRight,ou=rights,dc=mydomain For instance someRight should give all members of supervisors the right to modify other users. At the moment the ACL is related to the group. Access to dn.sub="ou=users,dc=mydomain" By group.exact="cn=supervisor,ou=groups,dc=mydomain" write By self read To use the rights I'd need an ACL with a group of group. Access to dn.sub="ou=users,dc=mydomain" By group.exact="cn=someRight,ou=rights,dc=mydomain" write Should allow all members of all groups that are member of someRight to modify users. Is this possible or is groupOfNames the wrong class to represent group rights? Thanks in advance! Jan

3 4

For openldap suggestion
by bfmyvmqj 16 Nov '09

16 Nov '09

Hello, everyone: I want to use openldap for my parallel compting environment in CentOS 5.2. Because I'm fresh person for openldap, so I don't know whether it is feasible. Therefore, a pretty advice is rather appreciated. Thanks.

1 0

Re: slapo-auditlog doesn't log the time and name for delete operation
by Michael Ströder 15 Nov '09

15 Nov '09

Ben, please follow-up on the mailing list so others can answer and learn as well. Ben Leo wrote: > Can I get the timestamp and name for the delete operation with > slapo-accesslog? > FYI, what I need is to log all the changes made in LDAP, which is the > what, the when, and the who. > So, I don't want to log the request as it is not relevant. See slapo-accesslog. You probably want in your slapd.conf: overlay accesslog logops writes Ciao, Michael.

1 0

slapo-auditlog doesn't log the time and name for delete operation
by Ben Leo 14 Nov '09

14 Nov '09

Hi, I have successfully implemented slapo-auditlog but as I test the logging, I found a problem on the logging for "delete" operation. I noticed that, for "add" and "modify" operation, the auditlog shows the Timestamp and Name of each operation, as the following example: # add 1257968890 dc=example,dc=com cn=manager,dc=example,dc=com dn: uid=test,ou=People,dc=example,dc=com changetype: add uid: test sn: test cn: test objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson *creatorsName*: cn=manager,dc=example,dc=com *createTimestamp*: 20091111194810Z entryCSN: 20091111194810.672178Z#000000#000#000000 *modifiersName*: cn=manager,dc=example,dc=com *modifyTimestamp*: 20091111194810Z # end add 1257968890 But, for "delete" operation, it doesn't show the Timestamp and Name at all, as the following example: # delete 1258152007 dc=example,dc=com cn=manager,dc=example,dc=com dn: uid=test,ou=People,dc=example,dc=com changetype: delete # end delete 1258152007 How can I get the Timestamp and Name to show for the "delete" operation? If slapo-auditlog cannot provide this, is there any other way to do this? Please kindly help. Thanks, Ben

2 1

ldap clients cant connect to replica after failure
by Scott Behrens 13 Nov '09

13 Nov '09

Hello, I am running 2 hosts CentOS release 5.3 (Final) with kernel 2.6.18-164.el5l. One box is the provider and the other is a consumer using syncrepl. When the primary goes down, I can perform searches against the domain from the replica so I know the replica has replicated the data (when I stop both hosts I can't preform the search obviously). When I point a client to the replica, I get a timeout when trying to perform searches or pull data. ldap_bind: Can't contact LDAP server (-1). Any ideas? I will provide more information if needed. Scott .

3 8

unique overlay
by Piyush Joshi 13 Nov '09

13 Nov '09

Dear Expert, I am currently using unique overlay with uid and mail attributes which is working perfectly for me but now i want to make it unique across the directory like if i am using mailAlternateAddress attribute and try to add any value which is already defined in mail attribute should not be allowed. Example -- mail: piyush(a)xxx.com is already there in ldap dit then piyush(a)xxx.com should not be allowed in mailAlternateAddress attribute's value and vice versa. Any help would be appreciated !!! OpenLDAP version - 2.4.19 BDB version - 4.7.25 -- Regards ****************************** Piyush Joshi System administrator 9415414376 ****************************** "Ability is what you're capable of doing. Motivation determines what you do. Attitude determines how well you do it"

2 1

Problem with ldaps:// when switching from 2.3 to 2.4
by Tomasz Welman 12 Nov '09

12 Nov '09

I have to machine, on the first there is no problem in connecting to the LDAP server (IBM directory server). The first machine is RedHat RHEL5 Client, the second is Ubuntu karmic 9.10. First machine looks like this: <root@trog /etc/openldap># uname -a Linux trog.krakow.pl.ibm.com 2.6.30 #1 SMP Fri Jun 26 08:44:06 CEST 2009 i686 i686 i386 GNU/Linux <root@trog /etc/openldap># rpm -qa |grep ldap python-ldap-2.2.0-2.1 openldap-2.3.43-3.el5 openldap-devel-2.3.43-3.el5 nss_ldap-253-21.el5 mozldap-6.0.5-1.el5 openldap-clients-2.3.43-3.el5 openldap-compat-2.1.30-1.oc2 <root@trog /etc/openldap># cat ldap.conf # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example, dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never TLS_CACERT /etc/openldap/cacerts/bp.cert On the second the configuration is: root@xwing:/etc/ldap# uname -a Linux xwing 2.6.31-server #1 SMP Thu Oct 1 11:55:18 CEST 2009 i686 GNU/Linux root@xwing:/etc/ldap# dpkg -l |grep ldap ii ldap-utils 2.4.15-1ubuntu3 OpenLDAP utilities ii libldap-2.4-2 2.4.15-1ubuntu3 OpenLDAP libraries root@xwing:/etc/ldap# cat ldap.conf # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example,dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never TLS_CACERT /etc/ldap/cacerts/bp.cert When I start the ldapsearch on the second machine, I get the error: root@xwing:/etc/ldap# ldapsearch -d5 -x -H ldaps://myldapserver.com ldap_url_parse_ext(ldaps://myldapserver.com) ldap_create ldap_url_parse_ext(ldaps://myldapserver.com:636/??base) ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP myldapserver.com:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 9.17.186.253:636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 TLS: can't connect: A TLS packet with unexpected length was received.. ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) What is more... when using ldap:// instead of ldaps:// on the second machine everything works perfectly, but since it's not secured connection I cannot accept that solution. The ldapsearch works fine on the first machine for both secure and insecure connection. Can anyone help? -- Tomasz 'Trog' Welman Software Developer external: 48-12-628-9449 ITN: 34819449 T/L: 9449 IBM SWG Lab, Krakow, Poland IBM Polska Sp. z o.o. oddział w Krakowie ul. Armii Krajowej 18 30 -150 Kraków NIP: 526-030-07-24, KRS 0000012941 Kapitał zakładowy: 33.000.000 PLN

3 6

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical November 2009