openldap-technical June 2009

openldap-technical@openldap.org

87 participants
100 discussions

OpenLDAP support for DIT Structure Rules
by James Lentini 03 Jun '09

03 Jun '09

The OpenLDAP FAQ http://www.openldap.org/faq/index.cgi?_highlightWords=structure&file=1474 and TODO file http://www.openldap.org/devel/cvsweb.cgi/doc/devel/todo?hideattic=1&sortbyd… indicate that OpenLDAP does not currently support DIT Structure Rules. Is this correct? -james

7 11

LDAP service doesn't start
by Emanuele Gesuato 03 Jun '09

03 Jun '09

Hi there, We are using OpenLDAP 2.2.29 (the full name of the setup is "openldap-2.2.29-db-4.3.29-openssl-0.9.8a-win32_Setup.exe") for a large number of Windows 2000 oses with service pack 4. Often, it happens that the openldap service doesn't start and in the event log i can see the error code "21". Right now i can solve the problem reinstalling openldap and it works but i would like to know the cause of the problem (if any) and if there is another way to solve it. Maybe it is a dumb question but is it possible to retrieve the dump of ldap if the service doesn't start ? Thanks for any help, Emanuele Gesuato

3 2

Adding a attribute of a new schema to an existing entry
by alexander＠nautae.eti.br 02 Jun '09

02 Jun '09

Hi everyone. I'm trying to add a attribute of a new schema to an existing entry. I've created the schema called 'owlco' (I've remove almost fields to concision): ---------------------------------------------------------------------- attributetype ( 1.3.6.1.4.1.4203.666.0.1 NAME 'owlChurchNumber' DESC 'Church Number' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{8} ) attributetype ( 1.3.6.1.4.1.4203.666.0.2 NAME 'owlSupernatural' DESC 'You wouldn't understand' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{8} ) ... objectclass ( 1.3.6.1.4.1.4203.666.1.1 NAME 'owlco' DESC 'Classe utilizada pela Owl Corporation' SUP inetOrgPerson STRUCTURAL MUST ( owlChurchNumber ) MAY ( owlDevotes $ owlSupernatural ) ) ---------------------------------------------------------------------- And I've added the schema: ---------------------------------------------------------------------- include /etc/openldap/schema/owlco.schema ---------------------------------------------------------------------- So, before all that actions I've created my whole directory and now I have all the entries without some mandatory owlco's fields (mandatory not to LDAP but to my business). So, now I'm trying: dn: uid=holykid,ou=saints,dc=clouds,dc=heaven,dc=god changetype: modify add: owlChurchNumber owlChurchNumber: 3212 And I've got: ---------------------------------------------------------------------- ldap_modify: Object class violation (65) additional info: attribute 'owlChurchNumber' not allowed ---------------------------------------------------------------------- Ok, absolutely normal. My schema depends on inetorgperson. So... ---------------------------------------------------------------------- dn: uid=holykid,ou=saints,dc=clouds,dc=heaven,dc=god changetype: modify add: objectclass objectclass: owlco # ldapmodify: wrong attributeType at line 4, entr ---------------------------------------------------------------------- I didn't stop on that try, I've tried a lot more combinations without success. I've read the 'http://www.zytrax.com/books/ldap/ch5/', specially the topic 'To add a new AUXILIARY objectclass to an existing entry requires'. dn: uid=holykid,ou=saints,dc=clouds,dc=heaven,dc=god changetype: modify objectclass: inetorgperson objectclass: owlco But all I get is: ldapmodify: modify operation type is missing at line I'm stuck on that... Yep, I've tried too: dn: uid=holykid,ou=saints,dc=clouds,dc=heaven,dc=god changetype: modify add: objectclass objectclass: inetorgperson objectclass: owlco And: dn: uid=holykid,ou=saints,dc=clouds,dc=heaven,dc=god changetype: modify add: owlChurchNumber objectclass: inetorgperson objectclass: owlco owlChurchNumber: 2342 But... got nothing... []'s Alexander Brazil - Rio de Janeiro ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

2 1

Adding a attribute of a new schema to an existing entry - FIXED
by alexander＠nautae.eti.br 02 Jun '09

02 Jun '09

Ok, I think I got it. I was using a 'SUP inetOrgPerson STRUCTURAL' to my new scheme. So, when I've changed to 'SUP top AUXILIARY' I finally could add my new attributes. I think it's because ldapmodify was trying to modify the structural object to my entry and it's impossible (just at creation time). So, here's my ldif (it's working): dn: uid=unicorn,ou=ground,dc=dinosaurs,dc=jurassic,dc=history changetype: modify add: objectClass objectClass: oilCorporation - add: oilCorporationTypeOfThing oilCorporationTypeOfThing: withcandle []'s Alexander Brazil - Rio de Janeiro ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

1 0

'unary operator expected' error when TLS turned on
by John Kane 02 Jun '09

02 Jun '09

I've also posted this message on the OpenSSL forum: I just turned on TLS on my LDAP (per instructions on http://www.openldap.org/faq/data/cache/185.html). Now all of my Linux servers (RH EL5) give the following error on login: -bash: [: =: unary operator expected The error goes away when I turn TLS off. I cannot determine what is causing this error, or even which file contains the error. I've gone through my LDAP config files, cannot find an issue in any of these. Other than my cacert.pem, and the LDAP config files, are there other files that are read only when TLS is turned on? Thanks, John I am running Openldap 2.3.43-2.el5 & OpenSSL 0.9.8b-10.el5 (RPMs from Red Hat, which I am required to use unless I put up a BIG fight). ++++ Here's my configs ++++ I turn on TLS by adding the following in my /etc/ldap.conf (pam/nss file): ssl start_tls tls_checkpeer yes tls_cacertfile /etc/openldap/cacerts/cacert.pem tls_cacertdir /etc/openldap/cacerts/ and have the following in my /etc/openldap/ldap.conf (openldap file): HOST 172.25.3.97 BASE dc=example,dc=net TLS_CACERTDIR /etc/openldap/cacerts/ TLS_REQCERT allow and my (self-signed) cacert: [root@serverx cacerts]# openssl x509 -text -in /etc/openldap/cacerts/cacert.pem Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: sha1WithRSAEncryption Issuer: C=US, ST=Utah, O=Bigtime CA, OU=Signers, CN=Integration Root CA/emailAddress=john.smith(a)myco.com Validity Not Before: May 28 04:37:13 2009 GMT Not After : May 27 04:37:13 2012 GMT Subject: C=US, ST=Utah, O=Bigtime CA, OU=Signers, CN=Integration Root CA/emailAddress=john.smith(a)myco.com Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:b3:bf:f0:18:5d:7e:57:0a:ce:15:3c:28:2a:81: 6d:e6:c5:31:98:7e:cc:09:03:d2:28:f2:33:3e:88: 11:5f:7d:e1:18:33:38:7d:f5:fa:9d:89:a8:95:16: 08:00:81:08:29:ac:37:b3:b1:2b:f3:20:52:15:d7: 19:44:92:9c:45:e7:2e:58:fe:7e:07:d4:1f:5a:ad: 59:91:37:84:14:a8:4e:df:54:a2:62:66:38:9b:f0: cf:48:01:68:0d:3a:7c:93:83:02:48:e0:76:a1:5c: f9:05:3b:49:1e:03:9a:fd:ea:ee:79:f7:87:66:96: b0:69:39:e1:e6:1a:bd:9e:0d Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 0B:FB:7D:0B:0D:17:A3:CD:79:02:A3:A3:92:57:15:6F:DE:38:07:3C X509v3 Authority Key Identifier: keyid:0B:FB:7D:0B:0D:17:A3:CD:79:02:A3:A3:92:57:15:6F:DE:38:07:3C Signature Algorithm: sha1WithRSAEncryption 28:52:3d:9c:90:d1:89:00:d7:9d:3b:06:a6:32:28:e8:c0:8d: 9d:5a:0b:79:bb:1a:c9:1a:8d:c6:3a:a5:ec:5d:4c:9f:20:4c: c6:1e:41:df:7d:d5:fc:45:09:2b:4b:7c:ff:38:aa:ea:33:a0: 4a:be:7c:84:7c:58:e8:98:9b:c9:0e:4b:5b:11:c6:28:84:b1: 3f:bb:30:03:f6:38:40:9f:2d:32:bc:3a:97:b8:6f:fd:aa:9f: 67:a6:27:07:53:b2:40:41:86:b7:02:f2:6b:07:6f:1b:74:87: 63:3b:1b:89:13:08:cb:32:f0:3c:3b:5e:d6:df:e3:91:19:86: 7a:d4 -----BEGIN CERTIFICATE----- MIIDDzCCAnigAwIBAgIBADANBgkqhkiG9w0BAQUFADCBjjELMAkGA1UERhMCVVMx DjAMBgNVBAgTBVRleGFzMRMwEQYDVQQKEwpCaWd0aW1lIENBMRAwDgYDVQQLEwdT aWduZXJzMRwwGgYDVQQDExNJbnRlZ3JhdGlvbiBSb290IENBMSowKAYJKoZIhvcN AQkBFhtqb2huLmthbmVAcHJvZGVhc3lzdGV3cy5jb20wHhcNMDkwNTI4MDQzNzEz WhcNMTIwNTI3MDQzNzEzWjCBjjELMAkGA1UEBhMCVVMxDjAMBgNVBAgTBVRleGFz MRMwEQYDVQQKEwpCaWd0aW1lIENBMRAwDgYDVQQLEwdTaWduZXJzMRwwGgYDVQQD ExNJbnRlZ3JhdGlvbiBSb290IENBMSowKAYJKoZIhvcNAQkBFhtqb2huLmthbmVA cHJvZGVhc3lzdGVtcy5jb20wgZ8wDQYJKoZIhvcNAQE1BQADgY0AMIGJAoGBALO/ 8BhdflcKzhU8KCqBbebFMZh+xAkD0ijyMz6IEV994RgzNX31+p2JqJUWCACBCCms N7OxK/MgUhXXGUSSnEXnLlj+fgfUH1qtWZE3hBSoTd9UomJmOJvwz0gBaA06fJOD AkjgdqFc+QU7SR4Dmv3q7nn3h2aWsGl54eYavZ4NAgMBAAGjezB5MAkGA1UdEwQC MAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRl MB0GA1UdDgQWBBQL+30LDRejzXkCo6OSVxVv3jgHPfAfBgNVHSMEGDAWgBQL+30L DRejzXkCo6OSVxVv3jgHPDANBgkqhkiG9w0BAQUFAAOBgQAoUj2ckOGJANedOwam MijowI2dWgt5uxrJGo3GOqXsXUyfIEzGHkHffdD8RQkrS3z/OKrqM6BKvnyEfFjo mJ7JDktbEcYohLE/uzAD9jhAny0yvDqXuG/9qp9npicHU7JAQYa3AvJrB28bdIdo OxuJEwjLNvA8O17W3+ORGYZ61A== -----END CERTIFICATE----- This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

2 5

Re: 2.4.16 performance issues
by jakjr 02 Jun '09

02 Jun '09

Thanks again, just one more question. Openldap 2.4.16 depends on BDB 4.4 or higher, right ? ( http://www.openldap.org/doc/admin24/appendix-recommended-versions.html) Best Regards, João Alfredo On Mon, Jun 1, 2009 at 4:00 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, June 01, 2009 3:50 PM -0300 jakjr <joao.alfredo(a)gmail.com> > wrote: > > bdb 4.3, 4.4, 4.5, 4.6 and 4.7: should be used with the compiling >> options: >> >> >> --enable-posixmutexes --with-mutex=POSIX/pthreads and debian packages do >> not use these options. >> >> Correct ? >> > > With the exception of BDB 4.3, which should never be used, yes, that is > correct. > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

3 2

Re: 2.4.16 performance issues
by jakjr 01 Jun '09

01 Jun '09

Thanks for your reply, Quanah I red some links: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=421946 http://www.mail-archive.com/openldap-software@openldap.org/msg15013.html http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg627930.html So, the abstract is: bdb 4.2 is good. bdb 4.3, 4.4, 4.5, 4.6 and 4.7: should be used with the compiling options: --enable-posixmutexes --with-mutex=POSIX/pthreads and debian packages do not use these options. Correct ? Thanks again. On Mon, Jun 1, 2009 at 2:44 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, June 01, 2009 12:11 PM -0300 jakjr <joao.alfredo(a)gmail.com> > wrote: > > > My suspecion is about debian etch and its packages version (berkley db, >> gcc). >> > > Rebuild BDB with the correct mutex options, since Debian refuses to do > this. > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

2.4.16 performance issues
by jakjr 01 Jun '09

01 Jun '09

Hello Guys, Last week we upgraded our openldap server from version 2.3.30-5 (debian lenny package) to 2.4.16 (compilation). There wasn't any big changes on config files (slapd.conf and DB_CONFIG). Our server is heavily used (samba + webservices + web applications) in a total of 15 millions operations per day. After the upgrade the new openldap server presented some strange behavior. The ports (389 and 636) sometimes were in a filtered state, denying any new connections and the load of the server was incredibly high. No index or memory problem was detected. My suspecion is about debian etch and its packages version (berkley db, gcc). Any tips ? Best regards, João Alfredo

2 1

server redundancy setup
by Rex Roof 01 Jun '09

01 Jun '09

I'm migrating our existing openLDAP 2.3 servers into a new setup running openLDAP 2.4. I will eventually have 4 or 5 servers, hopefully all having the same synchronized data, and all accepting writes, if need be. Can anyone suggest a configuration where I have 4 servers, all keeping themselves in sync, and all accepting writes? Can multimaster replication work with more than two servers? Is that the right solution here? -Rex

2 3

using -y option for ldapsearch
by Sai 01 Jun '09

01 Jun '09

Hi All, I am trying and writing a script to use ldapsearch. But I want to create a password file and use the "-y" option. I am unable to figure out how to create one. ================================== ldapsearch -x -h <Machine> -p <port> -s one -D <CN> -b <BASE_DN> -y pwdfile -v "(&(cn=fm*))" cn ================================== I tried the following. 1) I tried putting the plaintext password for <CN> in the file and it did not work. 2) I ran slappasswd to generate the hashed password for <CN> and directed the output to this file and it did not work. 3) The file permissions I tried are 700 and 600. What is this "-y" option and am I interpreting it correctly? Is there a specific format that this file should be in? Version Info: ================================== $ rpm -qa|egrep openldap openldap-clients-2.2.13-12.el4 openldap-2.2.13-12.el4 openldap-devel-2.2.13-12.el4 openldap-servers-2.2.13-12.el4 $ ================================== Any help is greatly appreciated. -Sai

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical June 2009