openldap-technical June 2009

openldap-technical@openldap.org

87 participants
100 discussions

slapcat unable to make ldif file with size > 2GB
by mukim pathan 08 Jun '09

08 Jun '09

Hi, I am trying to create backup of database using slapcat. But as soon as .ldif file reaches size of 2GB, it is giving me an error of File Size Limit Exceeded and quitting the process. I am using bdb 2.3.43. Is there anything I can do about it? Regards, Mukim Pathan

3 4

CRL expired
by joakim＠comex.se 08 Jun '09

08 Jun '09

Hello, I'm using Openldap with TLS and CRL. My slapd.conf file has the line "TLSCRLCheck all" in it. When the CRL has expired the client is not allowed to make an TLS connect. My question is whether it is possible to configure openldap to still let the client connect to the server (possibly with a warning) when the CRL has expired. Does anyone know if it is possible and of it can be achieved in that case? Regards, Jocke ########################################### This message has been scanned by F-Secure Anti-Virus for Microsoft Exchange. For more information, connect to http://www.f-secure.com/

1 0

Bind/search more than one tree and server
by Schneider, Thomas-P65851 05 Jun '09

05 Jun '09

I am seeking a solution to be able to bind to, and search more than one tree and server per request using Linux. My goal is to maintain separate groups of user accounts on an OpenLDAP server -- e.g. local and network. The groups of users can have overlapping posixAccount uid attributes, but will have unique uidNumber attributes. My main use case is authentication, which requires checking a remote LDAP server first -- currently AD which requires attribute re-mapping), then network tree on the local LDAP (openldap) if not in remote server, then the local tree on local server if not in the first tree. I have tried referrals and rewrites, but nothing I've tried worked. It looks like the creation of a custom overlay will work, but I'd rather not go down that path. I have also tried using PAM, but pam_ldap is limited to one configuration per service (modifying pam_ldap is an option at this point). Thanks, Craig

2 2

pool of Ldap-Directories
by alois blasbichler 05 Jun '09

05 Jun '09

Hello list I have this question - maybe somebody can give me a hint : I need a pool of Ldap-Directories (possible openldap, AD and other) where i can search for. The reason is : there are a lot of applications where can i get my users from one Ldap but where i cant define more Ldaps with different search bases. Is this possible for example with 2 different Openldap-Directories ? Thank you luis

3 3

Re: LDAP password information update failed: Server is unwilling to perform shadow context; no update referral
by paulpierre.brun＠free.fr 05 Jun '09

05 Jun '09

Thanks for answer, With updateref after syncrepl slave slapd.conf syncrepl rid=000 provider=ldap://ldap-v000 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=mydomain,dc=mydomain2,dc=fr" attrs="*,+" bindmethod=simple binddn="cn=replication_ldap,dc=mydomain,dc=mydomain2,dc=fr" credentials=secret updateref "ldap://ldap-v000/" master slapd.conf access to attrs=userPassword by dn="cn=Manager,dc=mydomain,dc=mydomain2,dc=fr" write by dn="cn=samba,dc=mydomain,dc=mydomain2,dc=fr" write by dn.base="cn=replication_ldap,dc=mydomain,dc=mydomain2,dc=fr" write by self write by * none I have LDAP password information update failed: Referral passwd Changing password for user paul-pierre.brun. Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information update failed: Referral passwd: Permission denied Nothing in master ldap log In slave ldap log Jun 5 12:51:34 ldap-v002 slapd[18734]: conn=2 op=2 SRCH base="dc=mydomain,dc=mydomain2,dc=fr" scope=2 deref=0 filter="(&(objectClass=ipHost)(cn=ldap-v000))" Jun 5 12:51:35 ldap-v002 slapd[18734]: conn=2 op=2 SRCH attr=cn ipHostNumber Jun 5 12:51:35 ldap-v002 slapd[18734]: ==> limits_get: conn=2 op=2 self="[anonymous]" this="dc=mydomain,dc=mydomain2,dc=fr" Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_search Jun 5 12:51:35 ldap-v002 slapd[18734]: bdb_dn2entry("dc=mydomain,dc=mydomain2,dc=fr") Jun 5 12:51:35 ldap-v002 slapd[18734]: => access_allowed: search access to "dc=mydomain,dc=mydomain2,dc=fr" "entry" requested Jun 5 12:51:35 ldap-v002 slapd[18734]: => acl_get: [1] attr entry Jun 5 12:51:35 ldap-v002 slapd[18734]: => slap_access_allowed: result not in cache (entry) Jun 5 12:51:35 ldap-v002 slapd[18734]: => acl_mask: access to entry "dc=mydomain,dc=mydomain2,dc=fr", attr "entry" requested Jun 5 12:51:35 ldap-v002 slapd[18734]: => acl_mask: to all values by "", (=0) Jun 5 12:51:35 ldap-v002 slapd[18734]: <= check a_dn_pat: cn=manager,dc=mydomain,dc=mydomain2,dc=fr Jun 5 12:51:35 ldap-v002 slapd[18734]: <= check a_dn_pat: cn=samba,dc=mydomain,dc=mydomain2,dc=fr Jun 5 12:51:35 ldap-v002 slapd[18734]: <= check a_dn_pat: cn=replication_ldap,dc=mydomain,dc=mydomain2,dc=fr Jun 5 12:51:35 ldap-v002 slapd[18734]: <= check a_dn_pat: self Jun 5 12:51:35 ldap-v002 slapd[18734]: <= check a_dn_pat: * Jun 5 12:51:35 ldap-v002 slapd[18734]: <= acl_mask: [5] applying read(=rscxd) (stop) Jun 5 12:51:35 ldap-v002 slapd[18734]: <= acl_mask: [5] mask: read(=rscxd) Jun 5 12:51:35 ldap-v002 slapd[18734]: => slap_access_allowed: search access granted by read(=rscxd) Jun 5 12:51:35 ldap-v002 slapd[18734]: => access_allowed: search access granted by read(=rscxd) Jun 5 12:51:35 ldap-v002 slapd[18734]: search_candidates: base="dc=mydomain,dc=mydomain2,dc=fr" (0x00000001) scope=2 Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_dn2idl("dc=mydomain,dc=mydomain2,dc=fr") Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_filter_candidates Jun 5 12:51:35 ldap-v002 slapd[18734]: AND Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_list_candidates 0xa0 Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_filter_candidates Jun 5 12:51:35 ldap-v002 slapd[18734]: OR Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_list_candidates 0xa1 Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_filter_candidates Jun 5 12:51:35 ldap-v002 slapd[18734]: EQUALITY Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_equality_candidates (objectClass) Jun 5 12:51:35 ldap-v002 slapd[18734]: => key_read Jun 5 12:51:35 ldap-v002 slapd[18734]: bdb_idl_fetch_key: [b49d1940] Jun 5 12:51:35 ldap-v002 slapd[18734]: <= bdb_index_read: failed (-30989) Jun 5 12:51:35 ldap-v002 slapd[18734]: <= bdb_equality_candidates: id=0, first=0, last=0 Jun 5 12:51:35 ldap-v002 slapd[18734]: <= bdb_filter_candidates: id=0 first=0 last=0 Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_filter_candidates Jun 5 12:51:35 ldap-v002 slapd[18734]: AND Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_list_candidates 0xa0 Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_filter_candidates Jun 5 12:51:35 ldap-v002 slapd[18734]: EQUALITY Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_equality_candidates (objectClass) Jun 5 12:51:35 ldap-v002 slapd[18734]: => key_read Jun 5 12:51:35 ldap-v002 slapd[18734]: bdb_idl_fetch_key: [7ec2180d] Jun 5 12:51:35 ldap-v002 slapd[18734]: <= bdb_index_read 6 candidates Jun 5 12:51:35 ldap-v002 slapd[18734]: <= bdb_equality_candidates: id=6, first=15, last=21 Jun 5 12:51:35 ldap-v002 slapd[18734]: <= bdb_filter_candidates: id=6 first=15 last=21 Jun 5 12:51:36 ldap-v002 slapd[18734]: => bdb_filter_candidates Jun 5 12:51:36 ldap-v002 slapd[18734]: EQUALITY Jun 5 12:51:36 ldap-v002 slapd[18734]: => bdb_equality_candidates (cn) Regards ----- Mail Original ----- De: masarati(a)aero.polimi.it À: "paulpierre brun" <paulpierre.brun(a)free.fr> Cc: openldap-technical(a)openldap.org Envoyé: Jeudi 4 Juin 2009 17h03:05 GMT +01:00 Amsterdam / Berlin / Berne / Rome / Stockholm / Vienne Objet: Re: LDAP password information update failed: Server is unwilling to perform shadow context; no update referral > > Objet: LDAP password information update failed: Server is unwilling to > perform shadow context; no update referral > > > Hello, > I try to change password on customer, to a referal thru a overlay chain > config. > I have answer LDAP password information update failed: Server is unwilling > to perform. > OS REDHAT 5.2. > openldap openldap-2.4.16 > > could you help me ? The message looks pretty self explanatory. You don't post the whole config, so it's hard to tell, but the database the update is trying to modify should contain an "updateref" statement, and according to the error message this is not present. slapo-chain(5) can chain databases by chasing referrals only when referrals are returned. p.

1 0

create new ldap database query
by mukim pathan 04 Jun '09

04 Jun '09

Hi, I am trying to create new ldap database on new machine and I want to transfer full ldap database from old machine to new machine. Can I just transfer all the database files (.bdb,_db,alock) and expect new database to be at the same stage of old database?? Thanks in advance. Regards, Mukim Pathan

5 6

log files and recovery
by mukim pathan 04 Jun '09

04 Jun '09

Hi all, I am unable to understand the answers for following question which i got on net. This might be naive questions but I really need to know the answers. 1. why does ldap write log files and what are its content? 2. why does ldap go through all log files during recovery? Thank you in advance. Regards, Mukim pathan

2 2

Re: LDAP password information update failed: Server is unwilling to perform shadow context; no update referral
by masarati＠aero.polimi.it 04 Jun '09

04 Jun '09

> > Objet: LDAP password information update failed: Server is unwilling to > perform shadow context; no update referral > > > Hello, > I try to change password on customer, to a referal thru a overlay chain > config. > I have answer LDAP password information update failed: Server is unwilling > to perform. > OS REDHAT 5.2. > openldap openldap-2.4.16 > > could you help me ? The message looks pretty self explanatory. You don't post the whole config, so it's hard to tell, but the database the update is trying to modify should contain an "updateref" statement, and according to the error message this is not present. slapo-chain(5) can chain databases by chasing referrals only when referrals are returned. p.

1 0

LDAP password information update failed: Server is unwilling to perform shadow context; no update referral
by paulpierre.brun＠free.fr 04 Jun '09

04 Jun '09

Objet: LDAP password information update failed: Server is unwilling to perform shadow context; no update referral Hello, I try to change password on customer, to a referal thru a overlay chain config. I have answer LDAP password information update failed: Server is unwilling to perform. OS REDHAT 5.2. openldap openldap-2.4.16 could you help me ? Thanks Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information update failed: Server is unwilling to perform shadow context; no update referral passwd: Permission denied Master conf ldap-v000 ---------------------- overlay syncprov syncprov-checkpoint 100 10 # allow the world read access access to * by dn="cn=Manager,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn="cn=samba,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn.base="cn=replication_ldap,dc=mydomaine,dc=mydomaine2,dc=fr" write by self write by * read # restrict userPassword for authentication only, allowing changes by user access to attrs=userPassword by dn="cn=Manager,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn="cn=samba,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn.base="cn=replication_ldap,dc=mydomaine,dc=mydomaine2,dc=fr" write by self write by * none Slave conf ---------- overlay chain chain-uri ldap://ldap-v000/ chain-idassert-bind bindmethod=simple binddn="cn=replication_ldap,dc=mydomaine,dc=mydomaine2,dc=fr" credentials=secret mode=self flags=non-prescriptive # allow the world read access access to * by dn="cn=Manager,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn="cn=samba,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn.base="cn=replication_ldap,dc=mydomaine,dc=mydomaine2,dc=fr" write by self write by * read # restrict userPassword for authentication only, allowing changes by user #access to dn.subtree="ou=Aliases,dc=mydomaine,dc=mydomaine2,dc=fr" by * read access to attrs=userPassword by dn="cn=Manager,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn="cn=samba,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn.base="cn=replication_ldap,dc=mydomaine,dc=mydomaine2,dc=fr" write by self write by * none

1 0

openldap login issues
by Serge Fonville 04 Jun '09

04 Jun '09

Hi, I'm new to ldap, so please be gentle ;-) I have a box running CentOS 5.3 wit OpenLDAP 2.3.43. When I run getent passwd fo0072 (which is my username), this was advised as a check I get nothing. when I su - fo0072 as root, it logs in as expected, when I try to login trough GDM I get a invalid username/passwd error when I press CTRL-F1 and login to the console it logs on without any trouble. This suggests to me thatt there is something wrong in my config, but I checked everything, but could not find it. I'll post the necessary config files and ldifs when requested Any help is greatly appreciated. Thanks in advance. Regards, Serge Fonville

2 3

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical June 2009