openldap-technical November 2009

openldap-technical@openldap.org

51 participants
58 discussions

logging question - source of queries
by wes 12 Nov '09

12 Nov '09

Does anyone know offhand which logging category (if any) will log the IP address or other information about who is making any given query to the LDAP database? thanks, -wes

2 1

Best practice for choosing RID
by Peter Mogensen 12 Nov '09

12 Nov '09

Hi, I'm moving more and more towards loading new databases via ldapadd to cn=config. All databases are replicated between two mirrormode servers - including cn=config. From my unserstanding I need to syncrepl directives for each database. For cn=config it could be: syncrepl rid=1 provider=ldaps://<SERVER1>/ searchbase="cn=config" type=refreshAndPersist retry="60 +" scope=sub schemachecking=on bindmethod=sasl binddn="cn=config" saslmech="EXTERNAL" tls_cert=/etc/ldap/ssl/config.crt tls_key=/etc/ldap/ssl/config.nopass.key tls_cacert=/etc/ldap/ssl/ca.crt tls_cipher_suite="NULL-SHA" syncrepl rid=2 provider=ldaps://<SERVER2>/ searchbase="cn=config" type=refreshAndPersist retry="60 +" scope=sub schemachecking=on bindmethod=sasl binddn="cn=config" saslmech="EXTERNAL" tls_cert=/etc/ldap/ssl/config.crt tls_key=/etc/ldap/ssl/config.nopass.key tls_cacert=/etc/ldap/ssl/ca.crt tls_cipher_suite="NULL-SHA" The two directives are needed since the configuration will be replicated and the two servers have to contain the same configuration. As long as Server-2 can recognize it self as <SERVER2> it will ignore the directive pointing to it self - correct? So cn=config will use RID 1 and RID 2. When I add a new database it will also have to have 2 syncrepl directives, but will have to use RID 3 and RID 4 - correct? Now, I would like not to have to specify the RID in the LDIF loaded to create a new database. In principle I would not know how many other replications were in place on the server I load it into, so it would be a bad thing to hardwire the RID into the LDIF for the new database. Are there any mechanism/best practice to do chose new RIDs automatically? /Peter

3 5

Replication problems
by Dominguez, Gaston Matias 12 Nov '09

12 Nov '09

Hi people, Im having troubles with samba & openldad. I configurated two server (PDC & BDC), the replication is working fine with the ldap base. But i was wondering if i can replicated the next share logon path = \\%L\Profiles\%U Why i ask this ¿? Because this folders was created on the first server PDC and when the first is down ths user cannt logo non the BDC . Someon know what i can do to resolve this? Regards.

2 1

index on modifyTimestamp?
by Peter Mogensen 11 Nov '09

11 Nov '09

Hi, I have an application which searches on entries with modifyTimestamp in a specific interval, so I thought an index on this attribute was appropriate. But I read that (at least earlier) indexes on operational attributes was not supported? /Peter

2 1

Problem in sb_stream_read
by Dave Daugherty 10 Nov '09

10 Nov '09

We very occasionally see a problem that goes like this: 1) Send an LDAP search request to a Windows DC 2) Call ldap_int_select from result.c - wait4msg() 3) After ldap_int_select returns okay - (eventually) call down into the sockbuf.c function sb_stream_read() which calls read(...) 4) The read() hangs forever if it has to do multiple calls to get the entire response (very very occasionally) I was not able to get a network trace to see why recv() hangs forever (AIX 5.3 BTW), but it does have to do with a large response that comes back in several TCP fragments. I solved the issue by adding an additional select() call in sb_stream_read() Here is what I did in code base 2.2.6 static ber_slen_t sb_stream_read( Sockbuf_IO_Desc *sbiod, void *buf, ber_len_t len ) ... #elif defined( HAVE_NCSA ) /* * NCSA Telnet TCP/IP stack (under DOS) */ return nread( sbiod->sbiod_sb->sb_fd, buf, len ); #else { int rc = ber_int_sb_read_wait(sbiod->sbiod_sb); <- The new check if (rc > 0) { rc = read( sbiod->sbiod_sb->sb_fd, buf, len ); } return rc; } #endif } New Function /** * If there is a timeout - wait for data, to avoid * permanent blocking on a read. * * @param sb Socket buf with socket id and timeout * @return -1=error : 0=timeout : 1=proceed */ static int ber_int_sb_read_wait(Sockbuf *sb) { struct timeval tm = sb->sb_timeout; int rc = 1; /* If no timeout was specified skip the select */ if (tm.tv_sec || tm.tv_usec) { int sock = sb->sb_fd; fd_set rfds; FD_ZERO(&rfds); FD_SET(sock, &rfds); ber_log_printf(LDAP_DEBUG_PACKETS, sb->sb_debug, "ber_int_sb_read_wait start: timeout is %d %d", (int)tm.tv_sec, (int)tm.tv_usec); rc = select(sock+1, &rfds, NULL, NULL, &tm); ber_log_printf(LDAP_DEBUG_PACKETS, sb->sb_debug, "ber_int_sb_read_wait end: sock=%d rc=%d %s\n", sock, rc, (rc >= 0) ? "" : STRERROR(errno)); } return rc; } In open.c - ldap_int_open_connection(), I added some code to propagate the timeout down to ber_int_sb_read_wait(( { /* * Propagate the network timeout to sockbuf layer for * select calls. */ struct timeval *tm = 0; int ret = ldap_get_option(ld, LDAP_OPT_NETWORK_TIMEOUT, (void *)&tm); if (ret == LDAP_OPT_SUCCESS && tm) { ber_sockbuf_ctrl(conn->lconn_sb, LBER_SB_OPT_SET_TIMEOUT, tm); LDAP_FREE(tm); } } Regards Dave Daugherty Centrify Corp.

2 2

Problem with ber_flatten2
by Dave Daugherty 10 Nov '09

10 Nov '09

We use ber_flatten2 in an unusual way, but I think this issue is generic int ber_flatten2( BerElement *ber, struct berval *bv, int alloc ) { ... /* copy the berval */ ber_len_t len = ber_pvt_ber_write( ber ); if ( alloc ) { bv->bv_val = (char *) ber_memalloc_x( len + 1, ber->ber_memctx ); if ( bv->bv_val == NULL ) { return -1; } AC_MEMCPY( bv->bv_val, ber->ber_buf, len ); } else { bv->bv_val = ber->ber_buf; } bv->bv_val[len] = '\0'; <- ???? bv->bv_len = len; The problem I have is a crash, because of the bv->bv_val[len] = '\0' when alloc is set to zero, AND the buffer that was passed in was generated by ber_realloc, which did not leave an extra byte at the end, resulting in a write beyond the allocated memory block. The questions I have are: 1) Is the zero terminator really necessary? 2) If so, seems like it should only be don if we actually allocated a new buffer (which does leave one byte at the end). Thanks Dave Daugherty Centrify Corp. BTW I this is my first post here, so let me know

2 2

ldap overlays
by srg 10 Nov '09

10 Nov '09

Hello: We are running openldap 2.4.11. The "base" dn is "dc=foo,dc=com", under this, there are two organizationalunits "ou=people,dc=foo,dc=com" and "dc=groups,dc=foo,dc=com". Entries under "groups" use objectclass groupOfNames. Entries under "people" use objectclass inetOrgPerson. Each group entry has some "member" attributes, each of them "pointing" to one user dn. With this we have the "list of members that the group has". Also we are using the "memberof" overlay (memberof.la) that automatically "inserts" "memberof" attributes to each user, so each user, has a list of memberof attributes (one for each group that the user belongs to). At this point all is OK and working fine. Now we need another overlay that "inserts" a new "text" attribute for each user called for example "groups" that contains a string with all the groups that the user belongs to. Note that we need to have this with only ONE attribute (NOT one attribute for each group that the user belongs to). For example: groups: g1,g2,g3 Not: groups: g1 groups: g2 groups: g3 It is possible? How? Thanks a lot and best regards

2 1

Error building OpenLDAP source code 2.3.43 on CentOS 5.3
by Swaminathan Saikumar 09 Nov '09

09 Nov '09

I'm using CentOS 5.3. I downloaded openldap-2.3.43 (which I installed using "Add/Remove Programs" in CentOS) and tried to build it. (Ultimately, I'm trying to get a C program to initialize my local ldap server and want to link to the relevant library in gcc). ./configure worked make depend worked make gave me an error ... cc -g -O2 -I../../include -I. -I./slapi -I. -I../../include -c -o component.o component.c cc -g -O2 -I../../include -I. -I./slapi -I. -I../../include -c -o version.o version.c /bin/sh ../..//libtool --mode=link cc -static -g -O2 -o slapd main.o globals.o bconfig.o config.o daemon.o connection.o search.o filter.o add.o cr.o attr.o entry.o backend.o backends.o result.o operation.o dn.o compare.o modify.o delete.o modrdn.o ch_malloc.o value.o ava.o bind.o unbind.o abandon.o filterentry.o phonetic.o acl.o str2filter.o aclparse.o init.o user.o repl.o lock.o controls.o extended.o kerberos.o passwd.o schema.o schema_check.o schema_init.o schema_prep.o schemaparse.o ad.o at.o mr.o syntax.o oc.o saslauthz.o oidm.o starttls.o index.o sets.o referral.o root_dse.o sasl.o module.o mra.o mods.o sl_malloc.o zn_malloc.o limits.o operational.o matchedValues.o cancel.o syncrepl.o backglue.o backover.o ctxcsn.o ldapsync.o frontend.o slapadd.o slapcat.o slapcommon.o slapdn.o slapindex.o slappasswd.o slaptest.o slapauth.o slapacl.o component.o aci.o alock.o version.o libbackends.a liboverlays.a ../../libraries/liblunicode/liblunicode.a ../../libraries/librewrite/librewrite.a ../../libraries/liblutil/liblutil.a ../../libraries/libldap_r/libldap_r.la ../../libraries/liblber/liblber.la -ldb-4.3 -lsasl2 -lssl -lcrypto -lresolv -pthread \ cc -g -O2 -o slapd main.o globals.o bconfig.o config.o daemon.o connection.o search.o filter.o add.o cr.o attr.o entry.o backend.o backends.o result.o operation.o dn.o compare.o modify.o delete.o modrdn.o ch_malloc.o value.o ava.o bind.o unbind.o abandon.o filterentry.o phonetic.o acl.o str2filter.o aclparse.o init.o user.o repl.o lock.o controls.o extended.o kerberos.o passwd.o schema.o schema_check.o schema_init.o schema_prep.o schemaparse.o ad.o at.o mr.o syntax.o oc.o saslauthz.o oidm.o starttls.o index.o sets.o referral.o root_dse.o sasl.o module.o mra.o mods.o sl_malloc.o zn_malloc.o limits.o operational.o matchedValues.o cancel.o syncrepl.o backglue.o backover.o ctxcsn.o ldapsync.o frontend.o slapadd.o slapcat.o slapcommon.o slapdn.o slapindex.o slappasswd.o slaptest.o slapauth.o slapacl.o component.o aci.o alock.o version.o -pthread libbackends.a liboverlays.a ../../libraries/liblunicode/liblunicode.a ../../libraries/librewrite/librewrite.a ../../libraries/liblutil/liblutil.a ../../libraries/libldap_r/.libs/libldap_r.a /home/swami/official/Aprius/ldap/openldap-2.3.43/libraries/liblber/.libs/liblber.a ../../libraries/liblber/.libs/liblber.a /usr/lib/libdb-4.3.so -lpthread -lsasl2 -lssl -lcrypto -lresolv -pthread /usr/lib/libdb-4.3.so: could not read symbols: File in wrong format collect2: ld returned 1 exit status make[2]: *** [slapd] Error 1 make[2]: Leaving directory `/home/swami/official/Aprius/ldap/openldap-2.3.43/servers/slapd' make[1]: *** [all-common] Error 1 make[1]: Leaving directory `/home/swami/official/Aprius/ldap/openldap-2.3.43/servers' make: *** [all-common] Error 1 How do I resolve this? Thanks

3 2

unable to user evolutionperson.schema
by cornjump 09 Nov '09

09 Nov '09

Hi all. First, excuse me for my bad english. I use openldap 2.3.27 on RHEL5. Openldap is needed for authentication and addresssbook storage for egrouware. I have only one last thing to do : getting contact's categories in the addressbook. For that, I have added the evolutionperson.schema given in the egroupware package. After adding the evolutionperson.schema and restarting openldap, I've no error messages. Then, if I want to add the objectClass evolutionPerson to an uid in the addressbook, I have the following error : ############### $slapadd -n 1 -l /tmp/importbase.ldif str2entry: invalid value for attributeType objectClass #2 (syntax 1.3.6.1.4.1.1466.115.121.1.38) slapadd: could not parse entry (line=8463) ############## Here is the modified entry (line 8463) in /tmp/importbase.ldif ############## dn: uid=6f945b6f9556393d9151252790d2f7a4,cn=aldevar,ou=personal,ou=contacts,ou =Users,dc=domain,dc=fr uid: 6f945b6f9556393d9151252790d2f7a4 objectClass: inetOrgPerson objectClass: person objectClass: evolutionPerson cn: sebastien quettier2 givenName: sebastien sn: quettier2 mail: sebastien.quettier2(a)revnew.domain.fr displayName: quettier2, sebastien structuralObjectClass: inetOrgPerson entryUUID: d91d6e36-5284-102e-8370-b3fd7d4e5e39 creatorsName: cn=Manager,dc=domain,dc=fr createTimestamp: 20091021115853Z entryCSN: 20091021115853Z#0001a6#00#000000 modifiersName: cn=Manager,dc=domain,dc=fr modifyTimestamp: 20091021115853Z ################ And finally here is slapd.conf : ################ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema inculde /etc/openldap/schema/evolutionperson.schema include /etc/openldap/schema/mozillaabpersonalpha.schema include /etc/openldap/schema/rfc2307bis.schema include /etc/openldap/schema/samba.schema include /etc/openldap/schema/hopital.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args moduleload back_bdb.la moduleload back_ldap.la moduleload back_ldbm.la moduleload back_passwd.la moduleload back_shell.la access to dn.one="ou=Users,dc=domain,dc=fr" attrs=entry,sn,mail,cn,givenName,telephoneNumber,uid,objectClass by anonymous read access to dn.one="ou=Groups,dc=domain,dc=fr" attrs=cn,memberUid,objectClass by anonymous read access to dn.one="ou=People,dc=domain,dc=fr" attrs=entry,sn,mail,cn,givenName,telephoneNumber by anonymous read include /etc/openldap/acl_addressbooks.conf access to * by * peername.ip=194.146.14.189 read access to * by * none database bdb suffix "dc=domain,dc=fr" rootdn "cn=Manager,dc=domain,dc=fr" rootpw passord directory /var/lib/ldap index default pres,eq index uid index cn,sn,mail pres,eq index objectClass eq ################## Can someone help me to find a solution for this problem?

4 4

Fail-Over
by Dominguez, Gaston Matias 06 Nov '09

06 Nov '09

Hi people, Someone knows how to prepare a fail-over between two servers with samba & ldap. regards

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical November 2009