openldap-technical November 2010

openldap-technical@openldap.org

86 participants
113 discussions

syncrepl proxy problem - consumer gets cleared
by Sebastian Hofmann 03 Nov '10

03 Nov '10

Hello, I have a problem setting up replication with syncrepl proxy (push-based) according to http://www.openldap.org/doc/admin24/replication.html#Syncrepl%20Proxy. I got it working but sometimes the client gets cleared. This happens when consumer is down and some changed occur at the provider. When restarting the consumer, the changes will be replicated and after that the consumer gets cleared from searchbase down. Here is the log of the consumer. I removed dc=max,dc=pamuser,dc=sourcepark,dc=de at the provider while the consumer was down: conn=0 op=311 SRCH base="dc=pamuser,dc=sourcepark,dc=de" scope=2 deref=0 filter="(objectClass=*)" conn=0 op=311 SRCH attr=entryUUID conn=0 op=311 SEARCH RESULT tag=101 err=0 nentries=153 text= conn=0 op=312 DEL dn="dc=max,dc=pamuser,dc=sourcepark,dc=de" conn=0 op=312 RESULT tag=107 err=0 text= conn=0 op=313 DEL dn="dc=pamuser,dc=sourcepark,dc=de" conn=0 op=313 RESULT tag=107 err=66 text=subordinate objects must be deleted first ######################### My provider config: allow bind_v2 allow bind_anon_dn include /home/sebastian/ldap-master/schema/core.schema include /home/sebastian/ldap-master/schema/cosine.schema include /home/sebastian/ldap-master/schema/nis.schema include /home/sebastian/ldap-master/schema/inetorgperson.schema include /home/sebastian/ldap-master/schema/evolutionperson.schema include /home/sebastian/ldap-master/schema/automount.schema include /home/sebastian/ldap-master/schema/openldap.schema include /home/sebastian/ldap-master/schema/misc.schema include /home/sebastian/ldap-master/schema/gum.schema include /home/sebastian/ldap-master/schema/samba.schema include /home/sebastian/ldap-master/schema/sudo.schema pidfile /home/sebastian/ldap-master/run/slapd.pid modulepath /usr/lib/ldap moduleload back_bdb moduleload syncprov.la moduleload back_monitor.la moduleload back_ldap.la backend bdb database bdb suffix "dc=sourcepark,dc=de" checkpoint 512 30 directory "/home/sebastian/ldap-master/data" index objectClass eq lastmod on rootdn "cn=test,dc=sourcepark,dc=de" rootpw test access to attrs=userPassword by dn="cn=test,dc=sourcepark,dc=de" write by anonymous auth by self write by * none access to dn.base="" by * read access to dn.subtree="ou=Contacts,dc=sourcepark,dc=de" by users write by self write by * auth access to * by dn="cn=test,dc=sourcepark,dc=de" write by * read overlay syncprov syncprov-checkpoint 1000 60 database monitor database config rootpw testing database ldap hidden on suffix "dc=sourcepark,dc=de" rootdn "cn=slapd-ldap" uri ldap://localhost:9010/ lastmod on restrict all acl-bind bindmethod=simple binddn="cn=replicator,dc=sourcepark,dc=de" credentials=test syncrepl rid=001 provider=ldap://localhost:9009/ binddn="cn=replicator,dc=sourcepark,dc=de" bindmethod=simple credentials=test searchbase="dc=pamuser,dc=sourcepark,dc=de" scope=sub type=refreshAndPersist retry="5 5 300 5" overlay syncprov #################### My consumer conf: moduleload syncprov allow bind_v2 allow bind_anon_dn include /home/sebastian/ldap-slave/schema/core.schema include /home/sebastian/ldap-slave/schema/cosine.schema include /home/sebastian/ldap-slave/schema/nis.schema include /home/sebastian/ldap-slave/schema/inetorgperson.schema include /home/sebastian/ldap-slave/schema/evolutionperson.schema include /home/sebastian/ldap-slave/schema/automount.schema include /home/sebastian/ldap-slave/schema/openldap.schema include /home/sebastian/ldap-slave/schema/misc.schema include /home/sebastian/ldap-slave/schema/gum.schema include /home/sebastian/ldap-slave/schema/samba.schema include /home/sebastian/ldap-slave/schema/sudo.schema pidfile /home/sebastian/ldap-slave/run/slapd.pid loglevel 16384 modulepath /usr/lib/ldap moduleload back_bdb backend bdb database bdb suffix "dc=sourcepark,dc=de" checkpoint 512 30 directory "/home/sebastian/ldap-slave/data" index objectClass eq lastmod on rootdn "cn=test,dc=sourcepark,dc=de" rootpw test access to attrs=userPassword by dn="cn=test,dc=sourcepark,dc=de" write by anonymous auth by self write by * none access to * by dn="cn=replicator,dc=sourcepark,dc=de" write by dn="cn=test,dc=suretecsystems,dc=com" write by * break access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to * by self write by * read limits dn.exact="cn=replicator,dc=sourcepark,dc=de" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited updatedn "cn=replicator,dc=sourcepark,dc=de" updateref ldap://localhost:9009 ###################### Any help would be greatly appreciated. Thanks Sebastian

2 3

ACL and SSF
by Christian Bösch 03 Nov '10

03 Nov '10

Hi, I forced encryption with olcSecurity but some of our applications do not support ldaps etc. Now I disabled globally the security and wanted to do it with ACLs to force all clients with encryption except for the ip addresses from those application servers. For this I thought it would work to add the first ACL line like this: {0}to * by ssf=256 auth by peername.ip=172.16.122.210 auth {1}.... {2}... .... But this doesn't seem to work.... Can somebody tell me if there is an error in reasoning or how to solve this approach? /thx,chris

1 0

Re: unable to perform authenticated binds
by Tim Dunphy 02 Nov '10

02 Nov '10

thanks for the input guys.. I have to admit at this point, setting this up under FreeBSD was a breeze compared to what is going on now. I have made 3 attempts at this today.. twice on CentOS 5.4 and once on Ubuntu 10 Server. Given the differences in platform with identical outcomes I am thinking that it _has_ to be something with my slapd.conf file. I am still getting error 49s even if I use the actual word secret as the pass. Nov 2 19:02:00 ldap2 slapd[15768]: conn=0 fd=11 ACCEPT from IP=127.0.0.1:44448 (IP=0.0.0.0:389) Nov 2 19:02:00 ldap2 slapd[15768]: conn=0 op=0 BIND dn="cn=Manager,dc=acadaca,dc=net" method=128 Nov 2 19:02:00 ldap2 slapd[15768]: conn=0 op=0 RESULT tag=97 err=49 text= Nov 2 19:02:00 ldap2 slapd[15768]: conn=0 fd=11 closed (connection lost) And this is how my ldap.conf is setup BASE dc=acadaca,dc=net HOST localhost I would appreciate it greatly if someone could please give it a look. Thank you On Tue, Nov 2, 2010 at 6:35 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, November 02, 2010 11:07 PM +0100 Benjamin Griese > <der.darude(a)gmail.com> wrote: > >> Hello Tim, >> >> the "password" you supply won't work, as it is not encoded in base64. >> >> Try to generate a password hash + base64-enc with "slappasswd" and set >> this string as your password hash for rootpw. >> http://linux.die.net/man/8/slappasswd > > Benjamin, > > There is no requirement that the password value for the rootpw entry in > slapd.conf be SSHA hashed or Base 64 encoded. > > I.e., > > rootpw secret > > is perfectly valid. > > Also, an LDIF file with > > userPassword: secret > > is also perfectly valid, as either slapadd or slapd (via ldapadd) will take > care of encoding it to Base64. > > --Quanah > > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Here's my RSA Public key: gpg --keyserver pgp.mit.edu --recv-keys 5A4873A9 Share and enjoy!!

1 0

system schema changes
by Engel, Jay A 02 Nov '10

02 Nov '10

I want to change an attribute type in system schema (e.g., CN / Equality = caseExactMatch). Is this possible? Does it require source code modification? Jay

2 1

Issue with OpenLDAP shared libraries complie on AIX 6.1 using IBM xL Compiler
by Peter Lambrechtsen 02 Nov '10

02 Nov '10

Hello I'm having an issue when using the IBM xL Compiler (not GNU GCC or any other part of the GNU stack) and the configure script fails to detect that ld can link shared libaries. The configure I am using is: ./configure --prefix=/opt/openldap --disable-slapd --disable-man --disable-client --enable-shared --with-tls --with-cyrus-sasl A snipit from the below configure show's that the configure script fails to detect that ld can compile shared libraries. checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking the maximum length of command line arguments... 131072 checking command to parse /usr/ccs/bin/nm -B output from cc_r -qlanglvl=extc89 object... ok checking for objdir... .libs checking for ranlib... ranlib checking for strip... strip checking if cc_r -qlanglvl=extc89 static flag works... yes checking for cc_r -qlanglvl=extc89 option to produce PIC... checking if cc_r -qlanglvl=extc89 supports -c -o file.o... yes checking whether the cc_r -qlanglvl=extc89 linker (/usr/ccs/bin/ld) supports shared libraries... no checking dynamic linker characteristics... no checking how to hardcode library paths into programs... unsupported checking whether stripping libraries is possible... no checking for shl_load... no checking for shl_load in -ldld... no checking for dlopen... yes checking whether a program can dlopen itself... no checking if libtool supports shared libraries... no checking whether to build shared libraries... no checking whether to build static libraries... yes configure: creating libtool checking how to run the C preprocessor... cc_r -qlanglvl=extc89 -E checking whether we are using MS Visual C++... no checking for be_app in -lbe... no checking whether we are using the GNU C compiler... (cached) no Any idea why this is happening??? checking whether the cc_r -qlanglvl=extc89 linker (/usr/ccs/bin/ld) supports shared libraries... no Or assistance on how I could modify the configure script to work. Cheers Peter

2 1

OpenLDAP works slower on a server with LDAP-based authentication
by Konstantin Boyandin 02 Nov '10

02 Nov '10

Hello, I have two servers used in Samba domain setup. Both computers are running CentOS 5.5 x86_64, all updates installed, both are using the openldap-servers-2.3.43-12 and other requried packaged of the same version (2.3.43-12). All the required ports are open. Master OpenLDAP server uses LDAP authentication, slave doesn't (Un*x authentcation). Slave syncs with the master (syncrepl) every several minutes. All the config files of both are the same, including DB_CONFIG. All recommended records are indexed. The only difference is the replciation section in /etc/opeldap/slapd.conf on slave. When I run ldapsearch against slave (Un*x authentication), it responds almost immediately. When I run ldapsearch against master (LDAP authentication), it takes 2 to 10 seconds to receive data. I would appreciate any hint on where to look for the reason of slow response on master server. Thank you! Sincerely, Konstantin

2 1

Re: tag=97 error in openLDAP
by Tim Dunphy 01 Nov '10

01 Nov '10

Thank you very much for your clarifying message. I have found it very helpful, but the problem actually turned out not to be the password, but the problem actually turned out to be the loginShell. 44 uid=bluethundr,ou=summitnjops,ou=staff,dc=summitnjhome,dc=com uid: bluethundr cn: Timothy P. ThatGuy givenName: Timothy P. sn: ThatGuy mail: bluethundr(a)example.com mailRoutingAddress: bluethundr(a)mail.example.com mailHost: mail.summitnjhome.com objectClass: inetLocalMailRecipient objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top userPassword: {CRYPT}secret uidNumber: 1001 gidNumber: 1002 homeDirectory: /home/bluethundr gecos: Timothy P. ThatGuy loginShell: /usr/local/bin/bash The LDAP server is FreeBSD but the clients are CentOS. The problem turned out to be that the PADL migration script that had generated the user ldif from /etc/passwd and produced the loginShell attribute with a BSD path to bash (i.e. /usr/local/bin/bash), when the clients which are all CentOS needed the red hat path to bash (i.e. /bin/bash). I have also added an index for uid to by slap.conf as per your suggestion. Best regards and thank you again for your assistance! On Sun, Oct 31, 2010 at 8:26 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Saturday, October 30, 2010 8:51 AM -0400 Tim Dunphy > <bluethundr(a)gmail.com> wrote: > >> Oct 29 22:49:41 LBSD2 slapd[1085]: <= bdb_equality_candidates: (uid) not >> indexed Oct 29 22:49:41 LBSD2 slapd[1085]: conn=1001 op=7 SEARCH RESULT >> tag=101 err=0 nentries=1 text= >> Oct 29 22:49:41 LBSD2 slapd[1085]: conn=1002 op=4 BIND >> dn="uid=bluethundr,ou=summitnjops,ou=staff,dc=summitnjhome,dc=com" >> method=128 >> Oct 29 22:49:41 LBSD2 slapd[1085]: conn=1002 op=4 RESULT tag=97 err=49 >> text= >> tag=97 > > Tag's are not error messages, they are information purpose. > > Error messages are prefixed with "err=", in this case, your log clearly > shows the wrong password was used, or the binddn is wrong, or both. > > Thus the LDAP server returns "ERROR 49" very clearly in your log for > connection 1002. > > You likely should also create an equality index on uid, since apparently > your dns are uid based. > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Here's my RSA Public key: gpg --keyserver pgp.mit.edu --recv-keys 5A4873A9 Share and enjoy!!

1 0

ACL filter not working
by Darren Hildebrand 01 Nov '10

01 Nov '10

I'm having a problem with access control lists in slapd.conf. The filter doesn't seem to be working in OpenLDPA 2.4.23 using syntax that worked in 2.3.43. I've simplified my tests down to a single ACL rule just to see if it's working, and this is what I'm finding: I'm trying this ACL: access to dn.subtree="ou=users,dc=companyname,dc=com" filter="(objectClass=person)" by * read I tried an anonymous search using this command: ldapsearch -h 1.2.3.4 -x -b ou=users,dc=companyname,dc=com And it returned the following: # search result search: 2 result: 32 No such object I tried the same with the same ACL as above with the filter set to "(uid=*)", and got the same problem (note that all users have a uid value set). However, I tried with the filter set to "(objectClass=*), and it returned all users as I would expect. Has anything changed with ACL syntax between OpenLDAP 2.3 and 2.4? Or do you see any problems with the syntax of my ACL line above? Thanks. Darren

2 2

memberOf Overlay
by Bram Cymet 01 Nov '10

01 Nov '10

Hi, I am using the memberOf overlay and it works perfectly on my main ldap server but when I search for memberOf on my slave ldap server I don't see everything I should, however the member attributes all got synchronized properly. Any idea what is going on? Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. Cell: 613-608-9752

1 0

LDAP filter question
by Antonio Batovanja 01 Nov '10

01 Nov '10

Hi, I'm having problems finding documentation for range filters. Can someone explain to me how to use a range filter on shadowExpire? From nis.schema: attributetype ( 1.3.6.1.1.1.1.10 NAME 'shadowExpire' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) so it's an integer value. from my slapd.conf (openldap 2.3.38): index shadowExpire pres,eq I'd like to find entries where either shadowExpire is not present, or shadowExpire is present and greater than or equal to X. # ldapsearch -x '(&(objectclass=shadowaccount)(shadowexpire=*))' dn returns 978 entries. # ldapsearch -x '(&(objectclass=shadowaccount)(!(shadowexpire=*)))' dn returns 311 entries. But: # ldapsearch -x '(&(objectclass=shadowaccount)(shadowexpire>1000))' dn gives me ldap_search_ext: Bad search filter (-7) and # ldapsearch -x '(&(objectclass=shadowaccount)(shadowexpire>=1000))' dn returns no results. At least one entry has shadowExpire > 1000: # ldapsearch -x -LLL uid=toni objectclass shadowexpire dn: cn=Batovanja Antonio,ou=People,ou=EDV Zentrale,dc=humanomed,dc=at objectClass: person objectClass: posixAccount objectClass: shadowAccount objectClass: hmUserExtention objectClass: organizationalPerson shadowExpire: 20000 My final filter should be (|(shadowExpire=0)(shadowExpire>=14910)(!(shadowExpire=*))) but that's not working What am I doing wrong? Cheers, Toni

3 3

Dynamically unloading a module
by Jaap Winius 01 Nov '10

01 Nov '10

Hi folks, With cn=config (OpenLDAP 2.4.23-6 on Debian squeeze), dynamically loading a module is straightforward. E.g., create an LDIF to add the the attribute "olcModuleLoad: {1}syncprov" to the cn=module{0} entry, apply it and as a result the configuration will be changed and the module loaded. However, when attempting to do the reverse -- applying an LDIF to delete that same attribute and unload the module -- this error appears: modifying entry "cn=module{0},cn=config" ldap_modify: Other (e.g., implementation specific) error (80) additional info: cannot delete olcModuleLoad Of course, it is still possible to stop slapd, remove the unwanted attribute directly from /etc/ldap/slapd.d/cn=config/cn=module{0}.ldif and start slapd again, but surely that is not the preferred method. Can anyone explain what the correct method is for dynamically removing a module, or does this not work due to a bug in the aforementioned version of OpenLDAP? Thanks, Jaap

2 1

Multimaster "cluster" + Regular Slaves (consumers?)
by Ciro Iriarte 31 Oct '10

31 Oct '10

Hi, I've done some Master/Slave replication in the 2.2 era. Right now I'm looking to setup a multimaster replication with 2.4 on a main office (2 node pacemaker cluster) and at least 6 slaves (only "consumers" this days) on different branches. This LDAP directories will be used as samba backends. A PDC/BDC pair on the main office and BDCs on the branches. Should this work with the "only slaves" pointing to a clustered IP that could move between the two clustered nodes?. This resource can be for "load balancing" or failover only. Should regular replication work?, what about delta replication? Anybody has done something like this?. Regards, -- Ciro Iriarte http://cyruspy.wordpress.com --

1 0

tag=97 error in openLDAP
by Tim Dunphy 31 Oct '10

31 Oct '10

Hello, I recently had a "knowledgeable" friend work on my openldap server. he made some changes to the cofigs without backing them up and now users are unable to authenticate against this openldap 2.4 server where previously they could. I am running on FreeBSD 8.1. I am a student trying to learn and be comfortable with openLDAP. when a user ssh's to any machine on the network that is configured to listen to this ldap server now gets an error in the LDAP logs: Oct 29 22:49:41 LBSD2 slapd[1085]: <= bdb_equality_candidates: (uid) not indexed Oct 29 22:49:41 LBSD2 slapd[1085]: conn=1001 op=7 SEARCH RESULT tag=101 err=0 nentries=1 text= Oct 29 22:49:41 LBSD2 slapd[1085]: conn=1002 op=4 BIND dn="uid=bluethundr,ou=summitnjops,ou=staff,dc=summitnjhome,dc=com" method=128 Oct 29 22:49:41 LBSD2 slapd[1085]: conn=1002 op=4 RESULT tag=97 err=49 text= Oct 29 22:49:41 LBSD2 slapd[1085]: conn=1002 op=5 BIND dn="" method=128 Oct 29 22:49:41 LBSD2 slapd[1085]: conn=1002 op=5 RESULT tag=97 err=0 text= it looks like it's failing to bind: conn=1003 op=3 BIND dn="" method=128 and I think this error may be key but I am unsure of it's meaning: tag=97 my ldap.conf reads as so: host ldap.summitnjhome.com base dc=summitnjhome,dc=com scope sub pam_password exop nss_base_passwd ou=staff,dc=summitnjhome,dc=com nss_base_shadow ou=staff,dc=summitnjhome,dc=com sudoers_base ou=sudoers,ou=Services,dc=summitnjhome,dc=com And why would the uid not be indexed? and this is the user id in LDAP: [root@LBSD2:/home/bluethundr/txt/ldif]#cat bluethundr.ldif dn: uid=bluethundr,ou=summitnjops,ou=staff,dc=summitnjhome,dc=com uid: bluethundr cn: Timothy P. givenName: Timothy P. sn: mail: bluethundr(a)blah.com mailRoutingAddress: bluethundr(a)mail.blah.com mailHost: mail.blah.com objectClass: inetLocalMailRecipient objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top userPassword: {CRYPT}secret loginShell: /usr/local/bin/bash uidNumber: 1001 gidNumber: 1002 homeDirectory: /home/bluethundr gecos: Timothy P. and these are my ACL's in slapd.conf: access to * by read access to attrs=userPassword by self write by anonymous auth access to * by self write by dn.children="ou=summitnjops,ou=staff,dc=summitnjhome,dc=com" write by users read by anonymous auth access to * by self write I would certainly appreciate any help to get this working again! thank you -- Here's my RSA Public key: gpg --keyserver pgp.mit.edu --recv-keys 5A4873A9 Share and enjoy!!

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical November 2010