openldap-technical December 2009

openldap-technical@openldap.org

59 participants
67 discussions

Re: How to Clone / move an OpenLDAP instance?
by Michael March 03 Dec '09

03 Dec '09

On Thu, Dec 3, 2009 at 10:43 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, December 03, 2009 9:36 AM -0700 Michael March > <mmarch(a)gmail.com> wrote: > >> Thanks for the response. >> >>> On Thursday, 3 December 2009 11:06:54 Michael March wrote: >>>> >>>> I need to move all the data from one OpenLDAP instance to another >>>> (including operational attributes). What is the best way to do that? >>> >>> slapcat;scp;slapadd >> >> Unfortunately slapadd doesn't maintain operational attributes. > > What in the world are you talking about? slapcat and slapadd maintain all > the attributes in the entry... Every time I import the output from slapcat I have to run the stream through this sed script to strip out operational attributes: /^creatorsName: /d /^createTimestamp: /d /^modifiersName: /d /^modifyTimestamp: /d /^structuralObjectClass: /d /^entryUUID: /d /^entryCSN: /d /^pwdHistory: /,+1d /^pwdChangedTime: /d /^pwdFailureTime: /d ... also from the slapadd man page: "As slapadd is designed to accept LDIF in database order, as produced by slapcat(8), it does not verify that superior entries exist before adding an entry, does not perform all user and system schema checks, and does not maintain operational attributes (such as createTimeStamp and modifiersName). "

2 1

Chaining problem
by Joe Friedeggs 03 Dec '09

03 Dec '09

I have a master-slave configuration, sync'ed with syncrepl. Most of my LDAP clients connect directly to the slave servers. Some of my client can handle referrals, but others cannot. For this reason, I use the 'chain' overlay. The configuration works fine when I have 'pam_password clear' in my clients' ldap.conf. But with 'pam_password md5', the clients are not sending the control messaging for ppolicy. This seems to be a pam_ldap issue, but I cannot seem to track it down and correct it. It has been suggested that I use the 'pam_password exop' option on the clients as a work-around for the pam_ldap issue. Doing this, I get hashed passwords, as well as correct ppolicy control messaging, and everything works fine doing this in my other (lab) scenario where I am not required to use chaining. BUT, in my chaining config, when the user makes a password change, instead of the user's password being changed, the chain's bind password is changed. NOTE: I do not employ SASL. Is this configuration supported? Anyone know why the chain's bind password would be getting changed, instead of the user's? Thanks, Joe _________________________________________________________________ Windows Live Hotmail gives you a free,exclusive gift. http://www.microsoft.com/windows/windowslive/hotmail_bl1/hotmail_bl1.aspx?o…

5 6

Re: changing samba and ldap password at the same time
by Luca Scamoni 02 Dec '09

02 Dec '09

you could use smbk5pwd overlay it's in contrib check out the source >----- Original Message ----- >From: mertes(a)uni-bonn.de >To: openldap-technical(a)openldap.org >Data: Wed, 02 Dec 2009 11:09:55 +0100 >Subject: changing samba and ldap password at the same time >Hi everybody, >I have a small question. > >I have here a samba domain authenticating with ldap. >If I now change the password for the regular LDAP user, it would be fine >if the samba password would be changed at the same time. Can I do that >with ldappasswd as well, and if yes, which parameters I need? >Or do I still need smbpasswd to change it? > >It would be great to do that 2in1 like.. > >Thx and regards Marc > > -- Luca Scamoni Gruppo Partners Associates Tel. Milano +39 02 67380435 - Udine +39 0432 689815 - Roma +39 06 54832300 Fax Milano +39 02 67386214 - Udine +39 0432 570120 - Roma +39 06 91659273 Cell. +39 348 0471710 Email: Luca.Scamoni(a)GruppoPA.it Sito: www.GruppoPA.it Prima di stampare, pensa all'ambiente ** Think about the environment before printing

1 0

Re: Search responses with incorrect msgId
by Eduardo Ramos Testillano 02 Dec '09

02 Dec '09

>Hi all, > >My application is an ldap client based on openLdap suite. I'm having >problems when receiving search responses with incorrect msgId. >The problem is: always returns error -1 being impossible to discriminate >other situations like remote server close. >The application always detach the connection fd when -1 is received (99% >is broken connection). >But we don't want to do close this when "receive a search response with >out-of-context msgId" (usually "out-of-time search result entries" after >sending AbandonRequest from client). > >I can't use ldap_msgid, because 'LDAPMessage*' is NULL and causes abort() >(anyway, no special result code is specified for this situation at >ldap_msgid API description). > >My code: > LDAP* handle = (LDAP*) a_ldap; > LDAPMessage* hmessage (NULL); > resultCode = ldap_result (handle, LDAP_RES_ANY, LDAP_MSG_ONE, NULL, >&hmessage); > >// I test the following, hoping result is not -1 with >LDAP_RES_UNSOLICITED, but it returned -1 again... > if (resultCode.getValue () == -1) > resultCode = ldap_result (handle, LDAP_RES_UNSOLICITED, >LDAP_MSG_ONE, NULL, &hmessage); > >?do you know any other way to identify responses with incorrect msgid? > >thnks >Regard, >Edu Hi, When we use: resultCode = ldap_result (handle, LDAP_RES_ANY, LDAP_MSG_ONE, -->NULL<--, &hmessage); I would like to clarify that -1 value was returned due to a signal on our process which interrupt the ldap_int_select within the ldap_result (where penultimate parameter (timeout) was NULL). We removed that signal and test again 'ldap_result' with zeroed-timeout (0 secs and 0 usecs): resultCode = ldap_result (handle, LDAP_RES_ANY, LDAP_MSG_ONE, &zeroed_tv, &hmessage); (even we have test 50 milisecs) Now, received response with out-of-context msgId, abort the application (due to assert over NULL hmessage when openLdap invokes 'ldap_msgid()'). We test this, changing msgId on response with TCP Test Tool, but actually, this could happen, as i said at former post, when expired context send AbandonRequest and then the ldap server sends the search result entry out of time. (The caller can expect that the result of an abandoned operation will not be returned from a future call to ldap_result()). Solutions? ---- 1 - Our ldap server, don't support LDAP_OPT_TIMELIMIT (it is optional), and then could answer out of time after an AbandonRequest received from client (or not) (RFC-compliant). ---- 2 - If we use 'LDAP_RES_ANY' we reach abort() when receive INcorrect message responses. If we use 'LDAP_RES_UNSOLICITED' we reach abort() when receive correct message responses. We can't combine these extract methods: not possible to mask values with OR, they are defined in this way: #define LDAP_RES_ANY (-1) #define LDAP_RES_UNSOLICITED (0) Perhaps it's possible to add a new #define like 'LDAP_RES_ALL=-2' which causes different special value returns on ldap_result() to make a distinction about which kind of message we receive: solicited or unsolicited. Or perhaps it's possible to get a not NULL hmessage on last ldap_result parameter, when something incorrect is received (only would be NULL on break connection event). We reach openldap debug output like this: ../../../libraries/liblber/io.c:516: ber_get_next: Assertion `ber->ber_buf == ((void *)0)' failed. ---- 3 - Avoid sending AbandonRequest in order to keep all (good/bad) contexts, perhaps solve the problem (we suppose ldap_abandon() clears internal openLdap memory resource (*)). We could send the AbandonRequest sometime later (configurable delay), or never send including any "garbage collector" mechanism (not sure if exist any openLdap primitive to do this without ldap_abandon()). We don't like any idea like this. What do you think? (*) anyone could confirm this ? ---- 4 - We are testing the following code now, but think it couldn't be such complex to afford the problem: (the application is single thread and must keep connection all the time even if incorrect msgId is received) ualarm (100000, 0); resultCode = ldap_result (handle, LDAP_RES_ANY, LDAP_MSG_ONE, NULL, &hmessage); // If we receive an unexpected message, ldap_result gets blocked on ldap_int_select due to the extract // method (LDAP_RES_ANY), and the penultimate parameter (NULL is infinite timeout). But this situation // is interrupted with former 'ualarm' signal (100 ms delay) int xerrno = errno; ualarm (0, 0); if (resultCode == -1) { int result = -1; bool disconnect (false); if (ldap_get_option (handle, LDAP_OPT_RESULT_CODE, &result) != LDAP_OPT_SUCCESS) disconnect = true; else if (result == LDAP_SERVER_DOWN) disconnect = true; else if (result == LDAP_CONNECT_ERROR) disconnect = true; if (disconnect == true && xerrno == EINTR) disconnect = false; } Indeed, we don't like this method, because we are not sure if fd stream is corrupted after an unexpected message, and probably could affect the next normal ones. We think it must be any simple way to manage this. We can't found a good point to manage the problem. any idea? Thanks Eduardo Regards Edu

1 0

dynlist overlay feature request
by Alexander 'Leo' Bergolth 02 Dec '09

02 Dec '09

Are there any plans to extend the dynlist overlays dynamic group feature to return not the DNs of the matched entries but an attribute of the entries? This would be useful for defining dynamic groups based on posixGroup (which need only the username, not the full DN) and populating them with entries from posixAccounts. If the dynlist-attrset could be extended by one parameter like: dynlist-attrset <group-oc> <URL-ad> [<member-ad>] [<result-ad>] ... where the additional parameter specifies the attribute that should be returned from the search results, a dynamic posixGroup could be configured like that: dynlist-attrset myposixGroup memberURL memberUid uid with a search filter like that: ldap:///ou=users,dc=local,dc=site??sub?(&(objectClass=posixAccount)(<searchfilter>)) I.e. "take the uid attribute of the matched entries and add them as memberUid." Could this extension be easily implemented? Is there currently any workaround? E.g. a way to dynamically add a memberUid to each posixAccount that contains the same data as the uid attribute? If that works, a filter like ldap:///ou=users,dc=local,dc=site?memberUid?sub?(&(objectClass=posixAccount)(<searchfilter>)) ... could work. Thanks in advance, --leo -- e-mail ::: Leo.Bergolth (at) wu.ac.at fax ::: +43-1-31336-906050 location ::: IT-Services | Vienna University of Economics | Austria

3 6

PAM EXOP causes chain bind password to change
by Joe Friedeggs 01 Dec '09

01 Dec '09

I am having an issue with my 'chain' bind password getting changed instead of the user's password. In a Red Hat Linux environment, running OpenLDAP 2.3.43(-3.el5 RPM from RH), I am using a master-slave setup, with chaining (as opposed to referral) as a method to allow users to change passwords (most LDAP clients hit the slave). Because I have some other issues when I set (nss_ldap) 'pam_password md5'in ldap.conf, I tried setting it to 'pam_password exop' instead. But, with this setting, when a user attempts a password change from one of the Linux clients, the ldap chain BIND password is changed on the master, instead of the user's password. In my slave slapd.conf, I have: #################################################################### # Chain to Master for updates overlay chain chain-uri "ldap://10.10.1.191" chain-idassert-bind bindmethod="simple" binddn="cn=ldapChain,o=myorg,dc=myco,dc=net" credentials="ldapChain" mode="none" # mode="self" chain-max-depth 2 chain-return-error TRUE chain-rebind-as-user TRUE ####################################################################### # To sync with the LDAP Master database using syncrepl syncrepl rid=222 type=refreshAndPersist provider=ldap://10.10.1.191 retry="30 10 300 3" searchbase="dc=myco,dc=net" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="cn=syncRepl,o=myorg,dc=myco,dc=net" credentials="syncRepl" updateref ldap://10.10.1.191 #################################################################### SO, for example, when some user, say 'userbob' issues a 'passwd' and attempts to change his password from a Linux LDAP client (configured to hit the slave LDAP server), the password for "cn=ldapChain,o=myorg,dc=myco,dc=net" instead gets changed. The users password does not get changed. Anyone know what I could possibly have mis-configured that would cause this? Thanks in advance, Joe _________________________________________________________________ Chat with Messenger straight from your Hotmail inbox. http://www.microsoft.com/windows/windowslive/hotmail_bl1/hotmail_bl1.aspx?o…

1 0

ObjectClass for BDB databases
by Peter Mogensen 01 Dec '09

01 Dec '09

Hi, I was trying to manual change and HDB LDIF config to BDB and failed to guess the correct ObjectClass (instead of olcHdbConfig). Looking at the example in section 5.3: http://www.openldap.org/doc/admin24/slapdconf2.html#Configuration%20Example ...It seem the objectclass is olcBdbConfig, but slapd won't accept that and it isn't present in cn=config/cn=schema.ldif where the other objectclasses are defined. Is there a bug in the documentation? /Peter

1 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical December 2009