November 2010 - openldap-technical

Virtual list view problem
by Venish Khant 31 May '16

31 May '16

Hi all I am using cpan Net::LDAP module to access LDAP entries. I want to search LDAP entries using Net::LDAP search method. When I do search, I want some limited number of entries from search result, for this(searching) process I am using Net::LDAP::Control::VLV module. But I get error on VLV response control. Please, any one have idea about this error. * Error:* Died at vlv.pl line 50, This is my example. I changed the font style of line 50 #!/usr/bin/perl -w use Net::LDAP; use Net::LDAP::Control::VLV; use Net::LDAP::Constant qw( LDAP_CONTROL_VLVRESPONSE ); use Net::LDAP::Control::Sort; sub procentry { my ( $mesg, $entry) = @_; # Return if there is no entry to process if ( !defined($entry) ) { return; } print "dn: " . $entry->dn() . "\n"; @attrs = $entry->attributes(); foreach $attr (@attrs) { #printf("\t%s: %s\n", $attr, $entry->get_value($attr)); $attrvalue = $entry->get_value($attr,asref=>1); #print $attr.":". $entry->get_value($attr)."\n"; foreach $value(@$attrvalue) { print "$attr: $value\n"; } } $mesg->pop_entry; print "\n"; } $ldap = Net::LDAP->new( "localhost" ); # Get the first 20 entries $vlv = Net::LDAP::Control::VLV->new( before => 0, # No entries from before target entry after => 19, # 19 entries after target entry content => 0, # List size unknown offset => 1, # Target entry is the first ); my $sort = Net::LDAP::Control::Sort->new( order => 'cn' ); @args = ( base => "dc=example,dc=co,dc=in", scope => "subtree", filter => "(objectClass=inetOrgPerson)", callback => \&procentry, # Call this sub for each entry control => [ $sort, $vlv ], ); $mesg = $ldap->search( @args ); # Get VLV response control *($resp) = $mesg->control( LDAP_CONTROL_VLVRESPONSE ) or die;* $vlv->response( $resp ); # Set the control to get the last 20 entries $vlv->end; $mesg = $ldap->search( @args ); # Get VLV response control ($resp) = $mesg->control( LDAP_CONTROL_VLVRESPONSE ) or die; $vlv->response( $resp ); # Now get the previous page $vlv->scroll_page( -1 ); $mesg = $ldap->search( @args ); # Get VLV response control ($resp) = $mes # Now page with first entry starting with "B" in the middle $vlv->before(9); # Change page to show 9 before $vlv->after(10); # Change page to show 10 after $vlv->assert("B"); # assert "B" $mesg = $ldap->search( @args );g->control( LDAP_CONTROL_VLVRESPONSE ) or die; $vlv->response( $resp ); -- Venish Khant www.deeproot.co.in

4 11

Re: (ITS#6666) Feature Request: Triggers implementation
by Buchan Milne 23 May '11

23 May '11

On Thursday, 7 October 2010 20:32:49 Nick Milas wrote: > It all started for me when I wanted to watch a serial number value from > an ldap-stored SOArecord (using powerdns with openldap backend) and when > it changes to fire a bash script. I reached the conclusion it was not > easy to be done with higher-level means within openldap and I created a > bash script which scans (using ldapsearch and other linux tools) the > SOArecords regularly (using cron) to find out if any change has happend > and do whatever is required. It would be much more elegant if I could > get a trigger from openldap when the SOArecord changes. Maybe you need this: http://memberwebs.com/stef/software/slapi-dnsnotify/ A more generic solution would be nice, but as far as I can tell, this software satisfies your current need. Regards, Buchan

7 18

Certificate authentication and back-ldap proxy
by Ubay Dorta Guerra 27 Dec '10

27 Dec '10

Hi, We have some problems with certificate authentication when the master server is behind a back-ldap proxy. We have openldap 2.4.21 on Suse Linux Enterprise Server 10 SP3 and these are the details of our scenario: The master server: server1.example.com has the following slapd.conf file: access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to attrs=userPassword,userPKCS12 by self write by dn.exact="CN=admin_w_cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=AU" read by * auth access to attrs=shadowLastChange by self write by * read access to * by * read # # Security SSL # TLSCipherSuite HIGH:MEDIUM:+SSLv3 TLSCertificateFile /etc/ssl/certs/server1.example.com.pem TLSCertificateKeyFile /etc/ssl/private/server1.example.com.key TLSCACertificatePath /etc/ssl/cacerts/ TLSVerifyClient demand # #Log level # loglevel 256 # Require authentication require authc ####################################################################### # HDB database definitions ####################################################################### database hdb suffix "dc=example,dc=com" checkpoint 1024 5 cachesize 10000 rootdn "cn=Manager,dc=example,dc=com" rootpw secret # Indices to maintain index objectClass eq # Overlay ppolicy overlay ppolicy ---------------------- Authentication is required, and we give access to the user passwords for the dn of a certificate. When we search for passwords using the certificate we get the following: root# ldapsearch -LLL -b 'uid=user_w_pass,ou=people,dc=example,dc=com' -H ldaps://server1.example.com userPassword SASL/EXTERNAL authentication started SASL username: CN=admin_w_cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=AU SASL SSF: 0 dn: uid=user_w_pass,ou=people,dc=example,dc=com userPassword:: e2NyeXB0fTcyMXpQbU4waWdKaU0= ----------------------- The root user (ldap client) has a ~/.ldaprc file with: TLS_CACERTDIR /etc/ssl/cacerts/ TLS_CERT /etc/ssl/certs/admin_w_cert.pem TLS_KEY /etc/ssl/private/admin_w_cert.key TLS_REQCERT demand SASL_MECH EXTERNAL In /var/log/messages we get: ldap-master[22358]: conn=1000 fd=11 ACCEPT from IP=server1.example.com:40899 (IP=server1.example.com:636) ldap-master[22358]: conn=1000 fd=11 TLS established tls_ssf=256 ssf=256 ldap-master[22358]: conn=1000 op=0 BIND dn="" method=163 ldap-master[22358]: conn=1000 op=0 BIND authcid="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" authzid="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" ldap-master[22358]: conn=1000 op=0 BIND dn="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" mech=EXTERNAL sasl_ssf=0 ssf=256 ldap-master[22358]: conn=1000 op=0 RESULT tag=97 err=0 text= ldap-master[22358]: conn=1000 op=1 SRCH base="uid=user_w_pass,ou=people,dc=example,dc=com" scope=2 deref=0 filter="(objectClass=*)" ldap-master[22358]: conn=1000 op=1 SRCH attr=userPassword ldap-master[22358]: conn=1000 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= ldap-master[22358]: conn=1000 op=2 UNBIND ldap-master[22358]: conn=1000 fd=11 closed This is the correct behavior for us. The problem appears when we introduce a back-ldap proxy between the client and the master. The proxy server (proxy-server1.example.com) is listening in port 1636 and its slapd.conf file is: # # Security SSL # TLSCipherSuite HIGH:MEDIUM:+SSLv3 TLSCACertificatePath /etc/ssl/cacerts/ TLSCertificateFile /etc/ssl/certs/proxy-server1.example.com.pem TLSCertificateKeyFile /etc/ssl/private/proxy-server1.example.com.key TLSVerifyClient demand # Log level loglevel 256 ####################################################################### # Database definitions ####################################################################### database ldap rebind-as-user true suffix "dc=example,dc=com" uri "ldaps://server1.example.com" tls ldaps tls_cert=/etc/ssl/certs/proxy-server1.example.com.pem tls_key=/etc/ssl/private/proxy-server1.example.com.key tls_cacertdir=/etc/ssl/cacerts/ ---------------------- If we search for passwords through the proxy we get: root # ldapsearch -LLL -b 'uid=user_w_pass,ou=people,dc=example,dc=com' -H ldaps://proxy-server1.example.com:1636 userPassword SASL/EXTERNAL authentication started SASL username: CN=admin_w_cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=AU SASL SSF: 0 Server is unwilling to perform (53) Additional information: authentication required In the /var/log/messages the following messages appear: ldap-proxy[22802]: conn=1001 fd=8 ACCEPT from IP=proxy-server1.example.com:60712 (IP=proxy-server1.example.com:1636) ldap-proxy[22802]: conn=1001 fd=8 TLS established tls_ssf=256 ssf=256 ldap-proxy[22802]: conn=1001 op=0 BIND dn="" method=163 ldap-proxy[22802]: conn=1001 op=0 BIND authcid="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" authzid="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" ldap-proxy[22802]: conn=1001 op=0 BIND dn="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" mech=EXTERNAL sasl_ssf=0 ssf=256 ldap-proxy[22802]: conn=1001 op=0 RESULT tag=97 err=0 text= ldap-proxy[22802]: conn=1001 op=1 SRCH base="uid=user_w_pass,ou=people,dc=example,dc=com" scope=2 deref=0 filter="(objectClass=*)" ldap-proxy[22802]: conn=1001 op=1 SRCH attr=userPassword ldap-master[22358]: conn=1008 op=2 SRCH base="uid=user_w_pass,ou=people,dc=example,dc=com" scope=2 deref=0 filter="(objectClass=*)" ldap-master[22358]: conn=1008 op=2 SRCH attr=userPassword ldap-master[22358]: conn=1008 op=2 SEARCH RESULT tag=101 err=53 nentries=0 text=authentication required ldap-proxy[22802]: conn=1001 op=1 SEARCH RESULT tag=101 err=53 nentries=0 text=authentication required ldap-proxy[22802]: conn=1001 op=2 UNBIND ldap-proxy[22802]: conn=1001 fd=8 closed The /root/.ldaprc file is the same than the previous one. When we increase the logging level we discover this: .... ldap-proxy[23008]: conn=1000 op=0 do_bind ldap-proxy[23008]: >>> dnPrettyNormal: <> ldap-proxy[23008]: <<< dnPrettyNormal: <>, <> ldap-proxy[23008]: conn=1000 op=0 BIND dn="" method=163 ldap-proxy[23008]: do_bind: dn () SASL mech EXTERNAL ldap-proxy[23008]: ==> sasl_bind: dn="" mech=EXTERNAL datalen=0 ldap-proxy[23008]: SASL Canonicalize [conn=1000]: authcid="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" ldap-proxy[23008]: slap_sasl_getdn: conn 1000 id=cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au [len=61] ldap-proxy[23008]: ==>slap_sasl2dn: converting SASL name cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au to a DN ldap-proxy[23008]: <==slap_sasl2dn: Converted SASL name to <nothing> ldap-proxy[23008]: SASL Canonicalize [conn=1000]: slapAuthcDN="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" ldap-proxy[23008]: SASL proxy authorize [conn=1000]: authcid="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" authzid="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" ldap-proxy[23008]: conn=1000 op=0 BIND authcid="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" authzid="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" ldap-proxy[23008]: SASL Authorize [conn=1000]: proxy authorization allowed authzDN="" ldap-proxy[23008]: send_ldap_sasl: err=0 len=-1 ldap-proxy[23008]: conn=1000 op=0 BIND dn="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" mech=EXTERNAL sasl_ssf=0 ssf=256 ldap-proxy[23008]: do_bind: SASL/EXTERNAL bind: dn="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" sasl_ssf=0 ldap-proxy[23008]: send_ldap_response: msgid=1 tag=97 err=0 ldap-proxy[23008]: conn=1000 op=0 RESULT tag=97 err=0 text= ldap-proxy[23008]: <== slap_sasl_bind: rc=0 .... ldap-proxy[23008]: conn=1000 op=1 SRCH base="uid=user_w_pass,ou=people,dc=example,dc=com" scope=2 deref=0 filter="(objectClass=*)" ldap-proxy[23008]: conn=1000 op=1 SRCH attr=userPassword ldap-proxy[23008]: ==> limits_get: conn=1000 op=1 self="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" this="uid=user_w_pass,ou=people,dc=example,dc=com" ldap-master[22983]: daemon: activity on 1 descriptor ldap-master[22983]: daemon: activity on: ldap-master[22983]: ldap-master[22983]: slap_listener_activate(7): ldap-master[22983]: daemon: epoll: listen=7 busy ldap-master[22983]: >>> slap_listener(ldaps://server1.example.com) ..... ldap-master[22983]: conn=1000 op=0 do_bind ldap-master[22983]: >>> dnPrettyNormal: <> ldap-master[22983]: <<< dnPrettyNormal: <>, <> ldap-master[22983]: conn=1000 op=0 BIND dn="" method=128 ldap-master[22983]: do_bind: version=3 dn="" method=128 ldap-master[22983]: send_ldap_result: conn=1000 op=0 p=3 ldap-master[22983]: send_ldap_result: err=0 matched="" text="" ldap-master[22983]: send_ldap_response: msgid=1 tag=97 err=0 ldap-master[22983]: conn=1000 op=0 RESULT tag=97 err=0 text= ldap-master[22983]: do_bind: v3 anonymous bind ---------------- Therefore the proxy is binding anonymously in the master, instead of using the dn of the certificate. Is there any problem with the SASL EXTERNAL method? If we use SIMPLE authentication through the proxy, there is no problem: root # ldapsearch -LLL -x -b 'uid=user_w_pass,ou=people,dc=example,dc=com' -H ldaps://proxy-server1.example.com:1636 -D 'uid=user_w_pass,ou=people,dc=example,dc=com' -W userPassword Enter LDAP Password: dn: uid=user_w_pass,ou=people,dc=example,dc=com userPassword:: e2NyeXB0fTcyMXpQbU4waWdKaU0= Thanks in advance. --------------------------------------------------------------------------------------------- ADVERTENCIA: Sobre la privacidad y cumplimiento de la Ley de Protección de Datos, acceda a http://www.iac.es/disclaimer.php WARNING: For more information on privacy and fulfilment of the Law concerning the Protection of Data, consult http://www.iac.es/disclaimer.php?lang=en

3 4

push replication with proxy and rwm overlay
by Gwenn Gueguen 13 Dec '10

13 Dec '10

Hi all, I'm trying to set up push replication from master to slave through a proxy with rwm overlay. Master, proxy and slave are OpenLDAP 2.4.11 from debian lenny. On the slave, I don't want samba related attributes so I used the attrs param on syncrepl to only get attributes I want but entries still have sambaSamAccount or sambaGroupMapping as objectClass. I tried using the rwm overlay to remove these references to samba in objectclass but it did not work and I still get the following error when proxy tries to add the entries on the slave: error code 0x15: objectClass: value #3 invalid per syntax Here is the proxy configuration: include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/authldap.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel -1 modulepath /usr/lib/ldap moduleload back_ldap moduleload syncprov moduleload rwm database ldap suffix "..." rootdn "cn=admin,..." uri ldap://ldap-dmz # Save the time that the entry gets modified, for database #1 lastmod on #We don't need any access to this DSA restrict all overlay rwm rwm-map objectclass inetOrgPerson * rwm-map objectclass posixAccount * rwm-map objectclass shadowAccount * rwm-map objectclass organizationalPerson * rwm-map objectclass person * rwm-map objectclass posixGroup * # rwm-map objectclass sambaSamAccount # rwm-map objectclass sambaGroupMapping rwm-map objectclass * acl-bind bindmethod=simple idassert-bind bindmethod=simple binddn="cn=admin,..." credentials="secret" syncrepl rid=001 provider=ldap://ldap attrs="@inetOrgPerson,@posixAccount,@shadowAccount,@organizationalPerson,@person" bindmethod=simple searchbase="ou=people,..." type=refreshAndPersist retry="60 +" interval=00:00:01:00 schemachecking=off syncrepl rid=002 provider=ldap://ldap attrs="@posixGroup" bindmethod=simple searchbase="ou=groups,..." type=refreshAndPersist retry="60 +" interval=00:00:01:00 schemachecking=off overlay syncprov I tried upgrading OpenLdap on the proxy to 2.4.17 from backports and also upgraded to squeeze with OpenLdap 2.4.23 but I still get the error. Am I doing something wrong or is rwm buggy ? Thanks, -- Gwenn

1 1

slapcat, PROXIED attributeDescription inserted, and cron jobs
by btb＠bitrate.net 09 Dec '10

09 Dec '10

hi- i'm running slapcat from a daily cron job to back up cn=config and other databases. i've recently updated from 2.4.21 to 2.4.23, and notice now in the output of slapcat, messages such as >slapcat -b 'cn=config' -l 'config.ldif' > /dev/null PROXIED attributeDescription "OU" inserted. PROXIED attributeDescription "DC" inserted. a bit of searching seems to indicate that these shouldn't be cause for concern, and are just informative messages. since these messages are written to stderr, cron sends email every time it runs slapcat. if they're not errors, do they maybe belong in stdout rather than stderr? alternatively, can these messages be suppressed? according to the man page, there doesn't appear a way to do so. thanks -ben

4 4

how to compile recent openldap on Centos 5.5
by Götz Reinicke - IT-Koordinator 06 Dec '10

06 Dec '10

Hello, I tried to compile the Release 2.4.23 of openldap on my centos 5.5 server. It fails with: checking db.h usability... yes checking db.h presence... yes checking for db.h... yes checking for Berkeley DB major version in db.h... 4 checking for Berkeley DB minor version in db.h... 3 checking if Berkeley DB version supported by BDB/HDB backends... no configure: error: BerkeleyDB version incompatible with BDB/HDB backends I do have db4 installed: db4-4.3.29-10.el5_5.2 db4-devel-4.3.29-10.el5_5.2 db4-utils-4.3.29-10.el5_5.2 What may I do wrong? Any sugesstions? Thanks and regards . Götz -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzende des Aufsichtsrats: Prof. Dr. Claudia Hübner Geschäftsführer: Prof. Thomas Schadt

8 12

Re: Want interesting restrictions to ldap auth on different servers to different users
by c0re 01 Dec '10

01 Dec '10

2010/11/19 Phuong Marie VUONG <mangocphung(a)gmail.com>: > Hello, > > First, im sorry about my English. I share here my experience which worked > for limit acces host/group of host for user... > > In the configuration of ldap client /etc/ldap.conf , i have activate the > host attribute and a filter in nss_base_passwd > pam_check_host_attr yes > nss_base_passwd > ou=People,dc=xxxxx,dc=xxxx?one?|(host=hostname.domain)(host=PatternofHostGroup)(host=*) > > In the user entry, add the host attribute > And in the host set, you can put the pattern value correpond of the level > that you want to authorize to connect , for exe : > hostname.domain > or > PatternofHostGroup > or > * > > Hope that can help > > > 2010/11/19 c0re <nr1c0re(a)gmail.com> >> >> can you give an example of usage pam_check_host_attr? >> >> And how can I use group of hosts and assign user to this group to >> permit access user to this group avoiding enumerating hosts in users >> dn each time I add new user? >> >> What should I set in "host:"? Hostname of server? How host attr are >> sent to pam_ldap? >> >> 2010/11/18 Aaron Richton <richton(a)nbcs.rutgers.edu>: >> > On Thu, 18 Nov 2010, c0re wrote: >> > >> >> I mean user user1 can must login only on server1,server2 and server3. >> >> And user2 can login only on server5 and server2. >> > >> > You could probably overload almost anything (dyngroups, OpenLDAP ACLs, >> > search filters, who knows) to accomplish this, but the cleanest way to >> > do >> > this in pam_ldap would utilize pam_check_host_attr. I assume pam_ldap >> > because you mentioned "pam_groupdn" which is not an OpenLDAP >> > configuration >> > directive. >> > > > > > -- > Milan&Phuong > 06.17.34.09.77 > 09.53.57.04.94 > http://www.phuong.fr/photos/ > > > I moved a bit different way. I used pam_groupdn in ldap.conf and created a group for each server. Now if I add user to ldap, I need to add to groups "memberUid: `userdn`". And user will be able to login to those servers in which groups is user as a member. But if I got 100-200 servers and want to give access to new user to all this servers, I should add user to all groups. Of course it's a waste of time and it's possible to be done via some external shell/perl script, but may be there another way in openldap? pam_check_host_attr do almost same. If I add user - I need to add all hosts to user attr "host:". So it's same work I think.

2 2

ssf settings on server restart
by Christian Bösch 01 Dec '10

01 Dec '10

hi, i have an acl set to allow only some ips to connect unencrypted: {0}to dn.children="dc=abc,dc=net" by peername.ip=10.10.40.100 read break by peername.ip=10.10.8.49 read break by ssf=128 read break by * none olcSecurity: ssf=0 tls=0 simple_bind=0 update_ssf=0 this works in general, but if i restart slapd i get from the defined ips from above 'confidentially required'. then i have to set ssf=1 then back to ssf=0 to make it work again? anyone an idea why? /thx.chris

2 6

syncrepl with accesslog not replicating
by Dieter Klünter 30 Nov '10

30 Nov '10

Hi, I am facing a problem with OpenLDAP-2.4.23. That is I am trying to setup a delta replication based on accesslog. Although the accesslog database contains new entries and the log database is successfully read, no replication ever takes place, while a setup without accesslog replicates successfully. An excerpt from the systemlogs: slapd[19170]: conn=1050 fd=20 ACCEPT from IP=192.168.0.8:41487 (IP=0.0.0.0:389) slapd[19170]: conn=1050 op=0 EXT oid=1.3.6.1.4.1.1466.20037 slapd[19170]: conn=1050 op=0 STARTTLS slapd[19170]: conn=1050 op=0 RESULT oid= err=0 text= slapd[19170]: conn=1050 fd=20 TLS established tls_ssf=256 ssf=256 slapd[19170]: conn=1050 op=1 BIND dn="" method=163 slapd[19170]: conn=1050 op=1 BIND authcid="cn=replicator,o=avci,c=de" authzid="cn=replicator,o=avci,c=de" slapd[19170]: conn=1050 op=1 BIND dn="cn=replicator,o=avci,c=de" mech=EXTERNAL sasl_ssf=0 ssf=256 slapd[19170]: conn=1050 op=1 RESULT tag=97 err=0 text= slapd[19170]: conn=1050 op=2 SRCH base="cn=log" scope=2 deref=0 filter="(&(objectClass=auditWriteObject)(reqResult=0))" slapd[19170]: conn=1050 op=2 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN slapd[19170]: conn=1050 op=2 SEARCH RESULT tag=101 err=0 nentries=7 text= slapd[19170]: conn=1050 op=3 UNBIND slapd[19170]: conn=1050 fd=20 closed A ldapsearch -Y EXTERNAL -ZZ -H ldap://localhost -b cn=log -s one "(&(objectClass=auditWriteObject)(reqResult=0))" provides the expected results, an example # 20101129144212.000003Z, log dn: reqStart=20101129144212.000003Z,cn=log objectClass: auditModify reqStart: 20101129144212.000003Z reqEnd: 20101129144212.000004Z reqType: modify reqSession: 1007 reqAuthzID: cn=admanager,o=avci,c=de reqControls: {0}{2.16.840.1.113730.3.4.18 controlValue "646O3K636O3N61646N616O 616765722M6P3N617663692M633N6465"} reqDN:: Y249U2Now6RmZXIgV29sZmdhbmcsb3U9YWRyZXNzYnVjaCxvPWF2Y2ksYz1kZQ== reqResult: 0 reqMod: sn:- Wolfgang reqMod: sn:+ Schaefer reqMod: entryCSN:= 20101129144212.353910Z#000000#000#000000 reqMod: modifiersName:= cn=admanager,o=avci,c=de reqMod: modifyTimestamp:= 20101129144212Z The relevant config files can be found here: Provider slapd.conf: http://pastebin.de/12273 Consumer slapd.conf: http://pastebin.de/12275 -Dieter -- Dieter Kl�nter | Systemberatung sip: 7770535(a)sipgate.de http://www.dpunkt.de/buecher/2104.html GPG Key ID:8EF7B6C6

3 11

slapcat segfaults when ppolicy overlay added
by Ryan Steele 30 Nov '10

30 Nov '10

I've been trying, unsuccessfully, to set up ppolicy in my installation (2.4.21 on Ubuntu). As soon as I set up the overlay (before I even configure a user with a password policy or set up a default policy), slapcatting the database results in a segmentation fault. I tried it on 2.4.23 and 2.4.17 with the same results. Here is the configuration I'm using, and a backtrace from the 2.4.21 installation: dn: cn=module{0} objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb.la olcModuleLoad: {1}autogroup.la olcModuleLoad: {2}syncprov.la olcModuleLoad: {3}smbk5pwd.la olcModuleLoad: {4}ppolicy.la dn: olcOverlay={3}ppolicy objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: {3}ppolicy olcPPolicyHashCleartext: FALSE olcPPolicyUseLockout: TRUE olcPPolicyForwardUpdates: FALSE structuralObjectClass: olcPPolicyConfig (gdb) run Starting program: /usr/sbin/slapcat -n1 [Thread debugging using libthread_db enabled] Program received signal SIGSEGV, Segmentation fault. 0x00007ffff242d840 in ppolicy_restrict (op=0x7fffffffd710, rs=0x7fffffffd670) at /usr/src/openldap/openldap-2.4.21/servers/slapd/overlays/ppolicy.c:1271 1271 /usr/src/openldap/openldap-2.4.21/servers/slapd/overlays/ppolicy.c: No such file or directory. in /usr/src/openldap/openldap-2.4.21/servers/slapd/overlays/ppolicy.c (gdb) backtrace #0 0x00007ffff242d840 in ppolicy_restrict (op=0x7fffffffd710, rs=0x7fffffffd670) at /usr/src/openldap/openldap-2.4.21/servers/slapd/overlays/ppolicy.c:1271 #1 0x00007ffff7f6ed3a in overlay_op_walk (op=0x7fffffffd710, rs=0x7fffffffd670, which=<value optimized out>, oi=0x7ffff8320fc0, on=0x7ffff8340d50) at /usr/src/openldap/openldap-2.4.21/servers/slapd/backover.c:659 #2 0x00007ffff7f6f8ab in over_op_func (op=0x7fffffffd710, rs=0xfffffffffffffff0, which=4294957776) at /usr/src/openldap/openldap-2.4.21/servers/slapd/backover.c:721 #3 0x00007ffff2a4b141 in autogroup_db_open (be=<value optimized out>, cr=<value optimized out>) at autogroup.c:1754 #4 0x00007ffff7f6e994 in over_db_open (be=<value optimized out>, cr=0x7fffffffdfc0) at /usr/src/openldap/openldap-2.4.21/servers/slapd/backover.c:155 #5 0x00007ffff7f1388c in backend_startup_one (be=0x7ffff8314e80, cr=0x7fffffffdfc0) at /usr/src/openldap/openldap-2.4.21/servers/slapd/backend.c:224 #6 0x00007ffff7f13a83 in backend_startup (be=0x7ffff8314e80) at /usr/src/openldap/openldap-2.4.21/servers/slapd/backend.c:278 #7 0x00007ffff7f742cc in slap_tool_init (progname=<value optimized out>, tool=2, argc=2, argv=0x7fffffffe5b8) at /usr/src/openldap/openldap-2.4.21/servers/slapd/slapcommon.c:780 #8 0x00007ffff7f7335a in slapcat (argc=-9520, argv=<value optimized out>) at /usr/src/openldap/openldap-2.4.21/servers/slapd/slapcat.c:51 #9 0x00007ffff7ee84f5 in main (argc=2, argv=0x7fffffffe5b8) at /usr/src/openldap/openldap-2.4.21/servers/slapd/main.c:657 As soon as I remove olcOverlay={3}ppolicy from the backend database, the problem disappears. The configuration isn't anything special so I don't think it's a misconfiguration issue, but I figured I'd get a second opinion from the list before submitting this issue as a bug to the ITS. As always, all advice and input is appreciated. -Ryan

2 3

cn=config and authz-regexp
by Julien Vehent 30 Nov '10

30 Nov '10

Hi list, I'm moving a LDAP directory on a freshly installed Debian Squeeze and I'm discovering cn=config. On my former installation, I have SASL configured using : --- authz-regexp "^uid=([^,]+).*,cn=[^,]*,cn=auth$" "ldap:///dc=domain,dc=net??sub?(uid=$1)" authz-policy to password-hash {CLEARTEXT} --- How do I translate this into cn=config directives ? I believe it should be stored into /etc/ldap/slapd.d/cn=config/olcDatabase\=\{1\}hdb.ldif is that correct ? Thanks, Julien

2 2

RE: Problems Enabling Authentication using Cyrus SASL
by Fernando Torrez 29 Nov '10

29 Nov '10

Hi all I got work sasl authentication to access ldap server by correcting two things: 1.- inserting the proxyuser's userpassword in clear text (userPassord=secret) 2.- fixing the proxyuser's authzTo atributte to authzTo: ldap:///ou=people,dc=plainjoe,dc=org??sub?(objectClass=account) (results at the end of this mail) As far as it can be seen, there's no need for cyrus-sasl for these matter but my final purpose is to enable Cyrus-sasl with openldap as backend to authenticate users for cyrus-imapd and postfix services. Any hints would be appreciated. Thanks to all for your support Fernando firewall:~ # ldapwhoami -U proxyuser -X u:test -Y digest-md5 SASL/DIGEST-MD5 authentication started Please enter your password: SASL username: u:test SASL SSF: 128 SASL data security layer installed. dn:uid=test,ou=people,dc=plainjoe,dc=org firewall:~ # ldapsearch -Y digest-md5 -U proxyuser -b 'dc=plainjoe,dc=org' '(objectclass=*)' SASL/DIGEST-MD5 authentication started Please enter your password: SASL username: proxyuser SASL SSF: 128 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <dc=plainjoe,dc=org> with scope subtree # filter: (objectclass=*)

3 4

Re: syncrepl with accesslog not replicating
by Quanah Gibson-Mount 29 Nov '10

29 Nov '10

--On Monday, November 29, 2010 10:46 PM +0100 Dieter Kluenter <dieter(a)dkluenter.de> wrote: > Quanah Gibson-Mount <quanah(a)zimbra.com> writes: > > OK, this is what I had, so going back to original configuration. You had scope specified, and the missing new line between the syncrepl and updateref clauses. Please keep this on the list. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Let user's modify some LDAP entry ?
by Frank Bonnet 29 Nov '10

29 Nov '10

Hello I'm searching for some web based software to let users modify "some" data in our LDAP database after having been authenticated. Typically I would like to let them the possiblity to modify their loginShell , password , phone number ... etc Does such software exists ? Thank you

2 3

Using shell database
by krishan kumar 29 Nov '10

29 Nov '10

Hello, I have compiled openldap-2.4.23 from source. Recently I am learning to use shell database so I try running searchexample.sh script file provided with the openldap sources. But I am not successful in doing so. I think script is not getting executed and I am not getting any search results. Search gives the following result-: #ldapsearch -x -D 'cn=Manager,dc=example,dc=com' -W -b 'dc=shell1,dc=com' '(uid=root)' Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=shell1,dc=com> with scope subtree # filter: (uid=root) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 --------------------------------------------------------------------------- My slapd.conf section for shell database is as follows-: database shell suffix "dc=shell1,dc=com" search /usr/local/openldap-test/etc/openldap/searchexample.sh ---------------------------------------------------------------------------- When started slapd with -d 1 option, I am getting following debugging information upon executing above search example-: -------------------------------------------------------------------------------------------------------------- <output truncated>.. send_ldap_response: msgid=1 tag=97 err=0 ber_flush2: 14 bytes to sd 17connection_get(17): got connid=1002 connection_read(17): checking for input on id=1002 ber_get_next ber_get_next: tag 0x30 len 53 contents: op tag 0x63, time 1291033804 ber_get_next conn=1002 op=1 do_search ber_scanf fmt ({miiiib) ber: >>> dnPrettyNormal: <dc=shell1,dc=com> <<< dnPrettyNormal: <dc=shell1,dc=com>, <dc=shell1,dc=com> ber_scanf fmt ({mm}) ber: ber_scanf fmt ({M}}) ber: ==> limits_get: conn=1002 op=1 self="cn=manager,dc=example,dc=com" this="dc=shell1,dc=com" execv failed shell: fgets failed: Success (0) str2result () expecting "RESULT" send_ldap_result: conn=1002 op=1 p=3 send_ldap_response: msgid=2 tag=101 err=0 ber_flush2: 14 bytes to sd 17 connection_get(17): got connid=1002 connection_read(17): checking for input on id=1002 ber_get_next ber_get_next: tag 0x30 len 5 contents: op tag 0x42, time 1291033804 ber_get_next conn=1002 op=2 do_unbind connection_close: conn=1002 sd=17 ---------------------------------------------------------------------------------------------------------------------- Please help me to got shell database working. Thanks.

1 0

OpenLDAP runs OK, Mac Mail and Address book do not display entries.
by Toomas Vendelin 29 Nov '10

29 Nov '10

Hi, I have set up an OpenLDAP server on a CentOS 5.5 machine and uploaded test data from ldif file. Apache directory studio connects to server nicely from my Mac and displays the records. Apple Mail and address book also seem to connect OK, but no search results returned in Address Book, and e-mails are not auto-completed in Mail. At the same time, I successfully connect to other publicly accessible servers, so it is probably a fault in my LDIF data. What is it? Do I need to use some schema specific to Apple? As for now, only the default ones are used. My LDIF data (all characters are fictional): Code: dn: dc=minu,dc=biz dc: minu objectClass: dcObject objectClass: organization o: Vendelin & Barilko dn: ou=people,dc=minu,dc=biz ou: people objectClass: organizationalUnit dn: cn=Deniska Borilko, ou=people,dc=minu,dc=biz cn: Deniska Borilko objectClass: inetOrgPerson sn: Borilko mail: denis(a)somedomain.com My LDAP settings both in Mail and address book: Code: Search base: ou=people,dc=minu,dc=biz Scope: subtree Thanks in advance! Toomas

2 1

Content-Based Access Control?
by Frank Rust 29 Nov '10

29 Nov '10

Hi all, would it be possible to configure a content-based access control? I have following configuration: my ldap contains user data. Some of the users are local ones and have a regular password entry. They shall be able to change their password. Other users are remotely authenticated with saslauthd. They shall not be able to change their 'password' which is just a redirection. Example: dn: uid=remoteuser,ou=People,dc=mydomain,dc=de uid: remoteuser cn: Adam Example uidNumber: 9007 gidNumber: 90 sn: Example userPassword: {SASL}remoteuser dn: uid=localuser,ou=People,dc=mydomain,dc=de uid: localuser cn: Bruce Somename uidNumber: 1001 gidNumber: 10 sn: Somename userPassword: {SHA}03de6c570bfe24bfc328ccd7ca46b76eadaf4334 User localuser shall be able to change his password, user remoteuser not. Can this be done by a fancy ACL entry, rejecting to change passwords starting with '{SASL}' ? Thanks in advance, Frank

2 2

Problem when trying to authenticate squid with openldap server
by Bruno Lamps 26 Nov '10

26 Nov '10

Hi everybody, I spent some days reading the ebook "Ldap for rocket scientists" ( zytrax.com/books/ldap/) and I've succesfully (I think it's a success =3 ) created a VM with debian lenny and openldap running. After that, I created another VM, running IPfire (www.ipfire.org) distro, this will be the firewall of the SMB I'm working for. Now I'm trying to authenticate the squid proxy, installed in IPFire distro, integrating it with my openldap server. A screenshot of my IPFire's webGUI and phpldapadmin webGUI can be seen at this topic: http://forum.ipfire.org/index.php?topic=3404.0 But the authentication isn't running, the browser using squid proxy keeps asking me for username and password. Suspecting that the webGUI could be making some mistake in squid config file, I started editing it's parameters manually. Right now, the ldap authentication line in my squid.conf looks like this: *auth_param basic program /usr/lib/squid/squid_ldap_auth -D "cn=admin,dc=pisolar" -w "mypassword" -b "ou=usuarios,dc=pisolar" -h 192.168.1.7 -v 3* * * *cn=admin,dc=pisolar *= my root user. * * *ou=usuarios,dc=pisolar *= the OU where my users are stored. * * I opened slapd in debug mode (slapd -d 255) in my openldap debian-powered VM, and this is the text shown when I try to authenticate in my browser: daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(8): daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 busy >>> slap_listener(ldap:///) daemon: listen=8, new connection on 13 daemon: added 13r (active) listener=(nil) daemon: activity on 2 descriptors daemon: activity on: 13r daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: activity on 1 descriptor daemon: activity on: 13r daemon: read active on 13 daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero connection_get(13) connection_get(13): got connid=0 connection_read(13): checking for input on id=0 ber_get_next ldap_read: want=8, got=8 0000: 30 34 02 01 01 60 2f 02 04...`/. ldap_read: want=46, got=46 0000: 01 03 04 20 75 69 64 3d 6c 61 6d 70 73 2c 6f 75 ... uid=lamps,ou 0010: 3d 75 73 75 61 72 69 6f 73 2c 64 63 3d 70 69 73 =usuarios,dc=pis 0020: 6f 6c 61 72 80 08 6c 34 77 64 30 67 67 30 olar..userpassword ber_get_next: tag 0x30 len 52 contents: ber_dump: buf=0xa0598a0 ptr=0xa0598a0 end=0xa0598d4 len=52 0000: 02 01 01 60 2f 02 01 03 04 20 75 69 64 3d 6c 61 ...`/.... uid=la 0010: 6d 70 73 2c 6f 75 3d 75 73 75 61 72 69 6f 73 2c mps,ou=usuarios, 0020: 64 63 3d 70 69 73 6f 6c 61 72 80 08 6c 34 77 64 dc=pisolar..userpass 0030: 30 67 67 30 word ber_get_next ldap_read: want=8 error=Resource temporarily unavailable daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero conn=0 op=0 do_bind ber_scanf fmt ({imt) ber: ber_dump: buf=0xa0598a0 ptr=0xa0598a3 end=0xa0598d4 len=49 0000: 60 2f 02 01 03 04 20 75 69 64 3d 6c 61 6d 70 73 `/.... uid=lamps 0010: 2c 6f 75 3d 75 73 75 61 72 69 6f 73 2c 64 63 3d ,ou=usuarios,dc= 0020: 70 69 73 6f 6c 61 72 80 08 6c 34 77 64 30 67 67 pisolar..userpasswor 0030: 30 d ber_scanf fmt (m}) ber: ber_dump: buf=0xa0598a0 ptr=0xa0598ca end=0xa0598d4 len=10 0000: 00 08 6c 34 77 64 30 67 67 30 ..userpassword >>> dnPrettyNormal: <uid=lamps,ou=usuarios,dc=pisolar> => ldap_bv2dn(uid=lamps,ou=usuarios,dc=pisolar,0) <= ldap_bv2dn(uid=lamps,ou=usuarios,dc=pisolar)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=lamps,ou=usuarios,dc=pisolar)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=lamps,ou=usuarios,dc=pisolar)=0 <<< dnPrettyNormal: <uid=lamps,ou=usuarios,dc=pisolar>, <uid=lamps,ou=usuarios,dc=pisolar> do_bind: version=3 dn="uid=lamps,ou=usuarios,dc=pisolar" method=128 ==> bdb_bind: dn: uid=lamps,ou=usuarios,dc=pisolar bdb_dn2entry("uid=lamps,ou=usuarios,dc=pisolar") => bdb_dn2id("dc=pisolar") <= bdb_dn2id: got id=0x1 => bdb_dn2id("ou=usuarios,dc=pisolar") <= bdb_dn2id: got id=0xb => bdb_dn2id("uid=lamps,ou=usuarios,dc=pisolar") <= bdb_dn2id: got id=0x10 entry_decode: "uid=lamps,ou=usuarios,dc=pisolar" <= entry_decode(uid=lamps,ou=usuarios,dc=pisolar) => access_allowed: auth access to "uid=lamps,ou=usuarios,dc=pisolar" "userPassword" requested => acl_get: [1] attr userPassword => slap_access_allowed: result not in cache (userPassword) => acl_mask: access to entry "uid=lamps,ou=usuarios,dc=pisolar", attr "userPassword" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: cn=admin,dc=pisolar <= check a_dn_pat: anonymous <= acl_mask: [2] applying none(=0) (stop) <= acl_mask: [2] mask: none(=0) => slap_access_allowed: auth access denied by none(=0) => access_allowed: no more rules send_ldap_result: conn=0 op=0 p=3 send_ldap_result: err=49 matched="" text="" send_ldap_response: msgid=1 tag=97 err=49 ber_flush2: 14 bytes to sd 13 0000: 30 0c 02 01 01 61 07 0a 01 31 04 00 04 00 0....a...1.... ldap_write: want=14, written=14 0000: 30 0c 02 01 01 61 07 0a 01 31 04 00 04 00 0....a...1.... daemon: activity on 1 descriptor daemon: activity on: 13r daemon: read active on 13 daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero connection_get(13) connection_get(13): got connid=0 connection_read(13): checking for input on id=0 ber_get_next ldap_read: want=8, got=7 0000: 30 05 02 01 02 42 00 0....B. ber_get_next: tag 0x30 len 5 contents: ber_dump: buf=0xa0039c0 ptr=0xa0039c0 end=0xa0039c5 len=5 0000: 02 01 02 42 00 ...B. ber_get_next ldap_read: want=8, got=0 ber_get_next on fd 13 failed errno=0 (Success) connection_read(13): input error=-2 id=0, closing. connection_closing: readying conn=0 sd=13 for close daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero connection_close: deferring conn=0 sd=13 conn=0 op=1 do_unbind connection_resched: attempting closing conn=0 sd=13 connection_close: conn=0 sd=13 daemon: removing 13 daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(8): daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 busy >>> slap_listener(ldap:///) daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero ================================= I tried to set a lot of different config syntaxes at squid.conf, but it always come to the same kind of problem at slapd debug: After reading the user CN and his password, slapd fails to read something else (ldap_read: want=8 error=Resource temporarily unavailable) and then it doesn't authenticates. What I'm doing wrong? Is there any problem with my openldap server? With squid? =( I'd like to thank you all in advance for any support, and say sorry for my broken english. =D

3 5

Re: How to set Multiple base dn
by Hallvard B Furuseth 26 Nov '10

26 Nov '10

Please keep replies on the list. Then others can help when I'm not around. Laurent gobalraja writes: > In fact i need a complete split of the bases. The reason is that i need > duplication of cn in both domain and that is not possible in a single base > as the CN must be unique. I think you mean "dc" instead of "cn" here, but I don't think that's what you're supposed to mean:-) Maybe you mean the part of the DN below the database suffix must include the fully qualified domain name, like this? Domain here.org in database foo and there.org in database bar: database bdb suffix o=foo database bdb suffix o=bar Object names: o=foo dc=org,o=foo dc=here,dc=org,o=foo o=bar dc=org,o=foo dc=there,dc=org,o=bar or o=foo associatedDomain=here.org,o=foo o=bar associatedDomain=there.org,o=bar 'o' is short for organization name. associatedDomain, unlike dc, is for full domain names. For 'o' you need the organization object class, for associatedDomian you need domainRelatedObject from cosine.schema. Anyway, you don't need to use 'dc' if that does not suit you. Look for attributes and object classes that describe the actual structure of your intended directory tree. Though note that 'ou' (organizational unit) is often abused for "container" objects like "ou=people". >> Or write slapd.conf first according to the Admin Guide and then use >> sbin/slaptest -f <slapd.conf filename> -F <slapd.d directory> >> to convert to cn=config format. > > Is it safe to make successives updates of slapd.conf and then convert to the > slapd.d directory directly without removing it each time ? That's not supposed to work. Maybe you should just stay with slapd.conf instead? Or find some tool to help edit cn=config - there are supposed to be several, but I'm not up to date on that. -- Hallvard

1 0

Re: memberof overlay 2.4.08
by Marc Patermann 26 Nov '10

26 Nov '10

Hi, Pierangelo Masarati schrieb am 25.03.2008 18:52 Uhr: > LALOT Dominique wrote: >> I'm testing memberof overlay and I'd like to get it working >> properly for a database migration >> >> My tests showed me that's it's working when adding members in >> groups, but for an initial loading, it does not work. > Correct. This still seams to be true. >> I tested slapadd -q or slapadd without success. Could you tell us, >> or write something in the documentation to explain, the right way >> for an initial loading. > Currently, there is no solution besides writing a script that > populates the memberOf attribute in the LDIF file. > >> When we will be in production, I imagine that sometimes, we can >> get out of sync between members and memberof. What can we do in >> such case. > It should not happen. I have a lot of syncrepl consumers. For disaster recovery these are repopulated with slapadd and a recent provider dump. With overlay memberof this would not work any more, because the memberOf references are lost on this consumer until the "member" object changes, right? > The overlay should be reworked in order to have some means to repair > its connectivity. This is known but not hardly worked at. You could > open an ITS requesting this as an enhancement (or a bug fix, it's a > matter of taste). Is there any yet or do I have to do it? Marc

1 1

memberOF overlay - memberof-memberof-ad
by Marc Patermann 26 Nov '10

26 Nov '10

Hi, I installed a openldap latest 2.4.23 with a basic database setup: include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/rfc2307bis.schema include /etc/openldap/schema/yast.schema include /etc/openldap/schema/personaddon.schema loglevel config stats stats2 pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/openldap/modules moduleload memberof.la moduleload refint.la access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to attrs=userPassword,userPKCS12 by self write by * auth access to attrs=shadowLastChange by self write by * read access to * by * read database bdb suffix "dc=my-domain,dc=com" checkpoint 1024 5 cachesize 10000 rootdn "cn=Manager,dc=my-domain,dc=com" rootpw secret directory /var/lib/ldap index objectClass eq index uid,cn,mail,member,sn,manager eq Then I included a standard memberof overlay config: overlay memberof memberof-group-oc groupOfNames memberof-member-ad member memberof-memberof-ad memberOf memberof-refint true This works fine (database population below). After that I configured a second memberof overlay like this: overlay memberof memberof-group-oc inetOrgPerson memberof-member-ad manager memberof-memberof-ad owner memberof-refint true memberof-dangling error I pointed from one inetOrgPerson object by attribute manager to another there this should be shown as "owner". For the latter I created a AUXILIARY objectclass to include the owner attribute to the inetOrgPerson object. But memberof-memberof-ad does not work - it is still memberOf and mot owner. Here is the dump (I removed some attributes like creatersname etc.): dn: dc=my-domain,dc=com objectClass: dcObject objectClass: domain dc: my-domain dn: ou=humans,dc=my-domain,dc=com objectClass: organizationalUnit objectClass: top ou: humans dn: ou=accounts,dc=my-domain,dc=com objectClass: organizationalUnit objectClass: top ou: accounts dn: uid=fa770001,ou=accounts,dc=my-domain,dc=com gidNumber: 9000 objectClass: posixAccount objectClass: top objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person uidNumber: 9000 uid: fa770001 homeDirectory: /home/fa770001 cn: Max Mustermann sn: Mustermann manager: employeeNumber=0001,ou=humans,dc=my-domain,dc=com dn: employeeNumber=0001,ou=humans,dc=my-domain,dc=com objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top objectClass: personAddon employeeNumber: 0001 sn: Mustermann cn: Max Mustermann memberOf: cn=users2,ou=groups,dc=my-domain,dc=com memberOf: uid=fa770002,ou=accounts,dc=my-domain,dc=com memberOf: uid=fa770001,ou=accounts,dc=my-domain,dc=com dn: ou=groups,dc=my-domain,dc=com objectClass: organizationalUnit objectClass: top ou: groups dn: cn=users1,ou=groups,dc=my-domain,dc=com objectClass: groupOfNames objectClass: top cn: users1 member: employeeNumber=0002,ou=humans,dc=my-domain,dc=com dn: employeeNumber=0002,ou=humans,dc=my-domain,dc=com objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top objectClass: personAddon employeeNumber: 0002 sn: Hermann cn: Heinz Hermann memberOf: cn=users1,ou=groups,dc=my-domain,dc=com dn: uid=fa770002,ou=accounts,dc=my-domain,dc=com gidNumber: 9001 objectClass: posixAccount objectClass: top objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person uidNumber: 9001 uid: fa770002 homeDirectory: /home/fa770002 sn: Hermann cn: Heinz Hermann manager: employeeNumber=0001,ou=humans,dc=my-domain,dc=com dn: cn=users2,ou=groups,dc=my-domain,dc=com objectClass: groupOfNames objectClass: top cn: users2 member: employeeNumber=0001,ou=humans,dc=my-domain,dc=com And here is a ldapsearch for employeeNumber=0001, who is a member of cn=users2,ou=groups and a manager in uid=fa770001ou=accounts and uid=fa770002,ou=accounts - but the two memberof overlays both effectively use the default memberof-memberof-ad memberOf attribute. # 0001, humans, my-domain.com dn: employeeNumber=0001,ou=humans,dc=my-domain,dc=com objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top objectClass: personAddon employeeNumber: 0001 sn: Mustermann cn: Max Mustermann structuralObjectClass: inetOrgPerson entryUUID: ee628de6-8d8c-102f-9f77-3d86f090c509 creatorsName: cn=Manager,dc=my-domain,dc=com createTimestamp: 20101126094021Z memberOf: cn=users2,ou=groups,dc=my-domain,dc=com memberOf: uid=fa770002,ou=accounts,dc=my-domain,dc=com memberOf: uid=fa770001,ou=accounts,dc=my-domain,dc=com modifiersName: cn=Manager,dc=my-domain,dc=com entryCSN: 20101126112349.873160Z#000000#000#000000 modifyTimestamp: 20101126112349Z entryDN: employeeNumber=0001,ou=humans,dc=my-domain,dc=com subschemaSubentry: cn=Subschema hasSubordinates: FALSE Is there something, I did wrong? Marc

1 0

Setting up primary/secondary LDAP servers with TLS/SSL enabled
by Konstantin Boyandin 26 Nov '10

26 Nov '10

Hello, I am using primary/secondary LDAP servers configuration, it works quite normal. I need to make LDAP authentication secure. I.e., I need both LDAP servers to provide LDAP over SSL/TLS, so that both primary and secondary LDAP server be used (mentioned in ldap.conf). I have to use self-signed SSL certificates, since the servers are located in intranet, they have no 'real' domain names. The problem is I can't figure out how to specify ldap.conf SSL parameters so that they could - verify LDAP server certificate - be used with both primary and secondary LDAP servers Also, I'd prefer to use TLS - how do I run slapd so that it provided TLS-aware connection on the standard port? Is it possible to set up slapd so that TLS be optional (for testing/transition purposes). I would greatly appreciate references to the relevant docs on these. Thank you. Sincerely, Konstantin

3 2

can't use godaddy SSL cert
by bluethundr 26 Nov '10

26 Nov '10

Hey list, I was having a similar SSL/openLDAP problem to this last week. I had a chance to look at this again today and it still appears to not be working. I called godaddy and had the last cert cancelled and reissued as I had mis-typed the name of the CN on the last one. I am trying to setup a Godaddy turbo SSL certificate with an openLDAP 2.4 server under FreeBSD 8.1. [root@LBSD2:/usr/home/bluethundr]#pkg_info | grep openldap openldap-sasl-client-2.4.23 Open source LDAP client implementation with SASL2 support openldap-sasl-server-2.4.23 Open source LDAP server implementation I have setup the certificate chain in my slapd.conf like so: [root@LBSD2:/usr/home/bluethundr]#grep -i tls /usr/local/etc/openldap/slapd.conf## TLS options for slapd TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCertificateFile /usr/local/etc/openldap/cacerts/LBSD2.summitnjhome.com.crt TLSCertificateKeyFile /usr/local/etc/openldap/cacerts/slapd.pem TLSCACertificateFile /usr/local/etc/openldap/cacerts/sf_issuing.crt I have tried each of the following certs with no luck in getting my cert to talk to it's CA: -rw-r--r-- 1 root bluethundr 2604 Nov 25 11:37 ca_bundle.crt -r--r----- 1 root ldap 4604 Nov 24 18:57 gd_bundle.crt -r--r----- 1 root ldap 1537 Nov 25 02:00 sf_issuing.crt and I get the same result for each when I attempt to connect to SSL on the LDAP server: [root@LCENT01:/tmp/Foswiki-1.1.2]#openssl s_client -connect ldap.example.com:389 -showcerts -CAfile sf_issuing.crt 13730:error:02001002:system library:fopen:No such file or directory:bss_file.c:122:fopen('sf_issuing.crt','r') 13730:error:2006D080:BIO routines:BIO_new_file:no such file:bss_file.c:125: 13730:error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib:by_file.c:279: CONNECTED(00000003) 13730:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188: ldapsearch -h ldap.example.com -d -1 -ZZ "dc=example,dc=com" TLS certificate verification: depth: 0, err: 20, subject: /O=LBSD2.summitnjhome.com/OU=Domain Control Validated/CN=LBSD2.summitnjhome.com, issuer: /C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287 TLS certificate verification: Error, unable to get local issuer certificate tls_write: want=7, written=7 0000: 15 03 01 00 02 02 30 ......0 TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. ldap_perror ldap_start_tls: Connect error (-11) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed It seems to indicate that it can't talk to it's CA... does anyone have any suggestions on how to make this work? thanks! -- Here's my RSA Public key: gpg --keyserver pgp.mit.edu --recv-keys B6D6EAC3

3 2

syncrepl problems
by Bram Cymet 25 Nov '10

25 Nov '10

Hi, I am trying to set up a syncrepl consumer. I have done this a number of times without any problem. The consumer seems to be connecting via TLS to the producer and authenticating but the consumer directory never gets populated. Here is the log from the producer: Nov 22 19:19:57 anubis slapd[24088]: slap_listener_activate(7): Nov 22 19:19:57 anubis slapd[24088]: >>> slap_listener(ldap://) Nov 22 19:19:57 anubis slapd[24088]: conn=1026 fd=15 ACCEPT from IP=172.20.150.141:38831 (IP=0.0.0.0:389) Nov 22 19:19:57 anubis slapd[24088]: connection_get(15) Nov 22 19:19:57 anubis slapd[24088]: connection_get(15): got connid=1026 Nov 22 19:19:57 anubis slapd[24088]: connection_read(15): checking for input on id=1026 Nov 22 19:19:57 anubis slapd[24088]: op tag 0x77, time 1290471597 Nov 22 19:19:57 anubis slapd[24088]: conn=1026 op=0 do_extended Nov 22 19:19:57 anubis slapd[24088]: conn=1026 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Nov 22 19:19:57 anubis slapd[24088]: do_extended: oid=1.3.6.1.4.1.1466.20037 Nov 22 19:19:57 anubis slapd[24088]: conn=1026 op=0 STARTTLS Nov 22 19:19:57 anubis slapd[24088]: send_ldap_extended: err=0 oid= len=0 Nov 22 19:19:57 anubis slapd[24088]: send_ldap_response: msgid=1 tag=120 err=0 Nov 22 19:19:57 anubis slapd[24088]: conn=1026 op=0 RESULT oid= err=0 text= Nov 22 19:19:58 anubis slapd[24088]: connection_get(15) Nov 22 19:19:58 anubis slapd[24088]: connection_get(15): got connid=1026 Nov 22 19:19:58 anubis slapd[24088]: connection_read(15): checking for input on id=1026 Nov 22 19:19:58 anubis slapd[24088]: connection_get(15) Nov 22 19:19:58 anubis slapd[24088]: connection_get(15): got connid=1026 Nov 22 19:19:58 anubis slapd[24088]: connection_read(15): checking for input on id=1026 Nov 22 19:19:58 anubis slapd[24088]: connection_read(15): unable to get TLS client DN, error=49 id=1026 Nov 22 19:19:58 anubis slapd[24088]: conn=1026 fd=15 TLS established tls_ssf=256 ssf=256 Nov 22 19:19:58 anubis slapd[24088]: connection_get(15) Nov 22 19:19:58 anubis slapd[24088]: connection_get(15): got connid=1026 Nov 22 19:19:58 anubis slapd[24088]: connection_read(15): checking for input on id=1026 Nov 22 19:19:58 anubis slapd[24088]: op tag 0x60, time 1290471598 Nov 22 19:19:58 anubis slapd[24088]: conn=1026 op=1 do_bind Nov 22 19:19:58 anubis slapd[24088]: >>> dnPrettyNormal: <uid=syncrepl,ou=system,dc=ls,dc=cbn> Nov 22 19:19:58 anubis slapd[24088]: <<< dnPrettyNormal: <uid=syncrepl,ou=system,dc=ls,dc=cbn>, <uid=syncrepl,ou=system,dc=ls,dc=cbn> Nov 22 19:19:58 anubis slapd[24088]: conn=1026 op=1 BIND dn="uid=syncrepl,ou=system,dc=ls,dc=cbn" method=128 Nov 22 19:19:58 anubis slapd[24088]: do_bind: version=3 dn="uid=syncrepl,ou=system,dc=ls,dc=cbn" method=128 Nov 22 19:19:58 anubis slapd[24088]: ==> hdb_bind: dn: uid=syncrepl,ou=system,dc=ls,dc=cbn Nov 22 19:19:58 anubis slapd[24088]: bdb_dn2entry("uid=syncrepl,ou=system,dc=ls,dc=cbn") Nov 22 19:19:58 anubis slapd[24088]: => access_allowed: result not in cache (userPassword) Nov 22 19:19:58 anubis slapd[24088]: => access_allowed: auth access to "uid=syncrepl,ou=system,dc=ls,dc=cbn" "userPassword" requested Nov 22 19:19:58 anubis slapd[24088]: => acl_get: [2] attr userPassword Nov 22 19:19:58 anubis slapd[24088]: => acl_mask: access to entry "uid=syncrepl,ou=system,dc=ls,dc=cbn", attr "userPassword" requested Nov 22 19:19:58 anubis slapd[24088]: => acl_mask: to value by "", (=0) Nov 22 19:19:58 anubis slapd[24088]: <= check a_dn_pat: uid=syncrepl,ou=system,dc=ls,dc=cbn Nov 22 19:19:58 anubis slapd[24088]: <= check a_dn_pat: * Nov 22 19:19:58 anubis slapd[24088]: <= acl_mask: [2] applying +0 (break) Nov 22 19:19:58 anubis slapd[24088]: <= acl_mask: [2] mask: =0 Nov 22 19:19:58 anubis slapd[24088]: => acl_get: [3] attr userPassword Nov 22 19:19:58 anubis slapd[24088]: => acl_mask: access to entry "uid=syncrepl,ou=system,dc=ls,dc=cbn", attr "userPassword" requested Nov 22 19:19:58 anubis slapd[24088]: => acl_mask: to value by "", (=0) Nov 22 19:19:58 anubis slapd[24088]: <= check a_dn_pat: self Nov 22 19:19:58 anubis slapd[24088]: <= check a_dn_pat: * Nov 22 19:19:58 anubis slapd[24088]: <= acl_mask: [2] applying auth(=xd) (stop) Nov 22 19:19:58 anubis slapd[24088]: <= acl_mask: [2] mask: auth(=xd) Nov 22 19:19:58 anubis slapd[24088]: => slap_access_allowed: auth access granted by auth(=xd) Nov 22 19:19:58 anubis slapd[24088]: => access_allowed: auth access granted by auth(=xd) Nov 22 19:19:58 anubis slapd[24088]: conn=1026 op=1 BIND dn="uid=syncrepl,ou=system,dc=ls,dc=cbn" mech=SIMPLE ssf=0 Nov 22 19:19:58 anubis slapd[24088]: do_bind: v3 bind: "uid=syncrepl,ou=system,dc=ls,dc=cbn" to "uid=syncrepl,ou=system,dc=ls,dc=cbn" Nov 22 19:19:58 anubis slapd[24088]: send_ldap_result: conn=1026 op=1 p=3 Nov 22 19:19:58 anubis slapd[24088]: send_ldap_result: err=0 matched="" text="" Nov 22 19:19:58 anubis slapd[24088]: send_ldap_response: msgid=2 tag=97 err=0 Nov 22 19:19:58 anubis slapd[24088]: conn=1026 op=1 RESULT tag=97 err=0 text= Nov 22 19:19:58 anubis slapd[24088]: connection_get(15) Nov 22 19:19:58 anubis slapd[24088]: connection_get(15): got connid=1026 Nov 22 19:19:58 anubis slapd[24088]: connection_read(15): checking for input on id=1026 Nov 22 19:19:58 anubis slapd[24088]: op tag 0x63, time 1290471598 Nov 22 19:19:58 anubis slapd[24088]: conn=1026 op=2 do_search Nov 22 19:19:58 anubis slapd[24088]: >>> dnPrettyNormal: <dc=ls,dc=cbn> Nov 22 19:19:58 anubis slapd[24088]: <<< dnPrettyNormal: <dc=ls,dc=cbn>, <dc=ls,dc=cbn> Nov 22 19:19:58 anubis slapd[24088]: SRCH "dc=ls,dc=cbn" 2 0 Nov 22 19:19:58 anubis slapd[24088]: 0 0 0 Nov 22 19:19:58 anubis slapd[24088]: filter: (objectClass=*) Nov 22 19:19:58 anubis slapd[24088]: => get_ctrls Nov 22 19:19:58 anubis slapd[24088]: => get_ctrls: oid="1.3.6.1.4.1.4203.1.9.1.1" (noncritical) Nov 22 19:19:58 anubis slapd[24088]: => get_ctrls: oid="2.16.840.1.113730.3.4.2" (critical) Nov 22 19:19:58 anubis slapd[24088]: <= get_ctrls: n=2 rc=0 err="" Nov 22 19:19:58 anubis slapd[24088]: attrs: Nov 22 19:19:58 anubis slapd[24088]: * Nov 22 19:19:58 anubis slapd[24088]: + Nov 22 19:19:58 anubis slapd[24088]: Nov 22 19:19:58 anubis slapd[24088]: conn=1026 op=2 SRCH base="dc=ls,dc=cbn" scope=2 deref=0 filter="(objectClass=*)" Nov 22 19:19:58 anubis slapd[24088]: conn=1026 op=2 SRCH attr=* + Nov 22 19:19:58 anubis slapd[24088]: ==> limits_get: conn=1026 op=2 self="uid=syncrepl,ou=system,dc=ls,dc=cbn" this="dc=ls,dc=cbn" Nov 22 19:19:58 anubis slapd[24088]: <== limits_get: type=DN match=EXACT dn="uid=syncrepl,ou=system,dc=ls,dc=cbn" Nov 22 19:19:58 anubis slapd[24088]: send_ldap_result: conn=1026 op=2 p=3 Nov 22 19:19:58 anubis slapd[24088]: send_ldap_result: err=0 matched="" text="" Nov 22 19:19:58 anubis slapd[24088]: send_ldap_response: msgid=3 tag=101 err=0 Nov 22 19:19:58 anubis slapd[24088]: conn=1026 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text= Nov 22 19:19:58 anubis slapd[24088]: connection_get(15) Nov 22 19:19:58 anubis slapd[24088]: connection_get(15): got connid=1026 Nov 22 19:19:58 anubis slapd[24088]: connection_read(15): checking for input on id=1026 Nov 22 19:19:58 anubis slapd[24088]: op tag 0x42, time 1290471598 Nov 22 19:19:58 anubis slapd[24088]: ber_get_next on fd 15 failed errno=0 (Success) Nov 22 19:19:58 anubis slapd[24088]: conn=1026 op=3 do_unbind Nov 22 19:19:58 anubis slapd[24088]: conn=1026 op=3 UNBIND Nov 22 19:19:58 anubis slapd[24088]: connection_close: conn=1026 sd=15 Nov 22 19:19:58 anubis slapd[24088]: conn=1026 fd=15 closed Here is the log from the consumer: Nov 22 18:22:49 mgaauth1 slapd[12587]: daemon: shutdown requested and initiated. Nov 22 18:22:49 mgaauth1 slapd[12587]: slapd shutdown: waiting for 0 operations/tasks to finish Nov 22 18:22:49 mgaauth1 slapd[12587]: slapd shutdown: initiated Nov 22 18:22:49 mgaauth1 slapd[12587]: ====> bdb_cache_release_all Nov 22 18:22:49 mgaauth1 slapd[12587]: slapd destroy: freeing system resources. Nov 22 18:22:49 mgaauth1 slapd[12587]: syncinfo_free: rid=001 Nov 22 18:22:49 mgaauth1 slapd[12587]: syncinfo_free: rid=002 Nov 22 18:22:49 mgaauth1 slapd[12587]: slapd stopped. Nov 22 18:22:52 mgaauth1 slapd[12638]: @(#) $OpenLDAP: slapd 2.4.20 (Jun 16 2010 10:21:06) $ abuild@anonymi:/usr/src/packages/BUILD/openldap-2.4.20/servers/slapd Nov 22 18:22:52 mgaauth1 slapd[12638]: daemon: IPv6 socket() failed errno=97 (Address family not supported by protocol) Nov 22 18:22:52 mgaauth1 slapd[12638]: daemon: IPv6 socket() failed errno=97 (Address family not supported by protocol) Nov 22 18:22:52 mgaauth1 slapd[12638]: ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=schema.ldif" Nov 22 18:22:52 mgaauth1 slapd[12638]: => str2entry: "dn: cn=schema objectClass: olcSchemaConfig cn: schema structuralObjectClass: olcSchemaConfig entryUUID: 1a05f3b8-8ade-102f-8d02-5da984889200 creatorsName: cn=config createTimestamp: 20101122234350Z entryCSN: 20101122234350.437126Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20101122234350Z " Nov 22 18:22:52 mgaauth1 slapd[12638]: >>> dnPrettyNormal: <cn=schema> Nov 22 18:22:52 mgaauth1 slapd[12638]: <<< dnPrettyNormal: <cn=schema>, <cn=schema> Nov 22 18:22:52 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:52 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:52 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:52 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:52 mgaauth1 slapd[12638]: <= str2entry(cn=schema) -> 0x7ff49ab19758 Nov 22 18:22:52 mgaauth1 slapd[12638]: ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=schema/cn={0}core.ldif" Nov 22 18:22:52 mgaauth1 slapd[12638]: => str2entry: "dn: cn={0}core objectClass: olcSchemaConfig cn: {0}core olcAttributeTypes: {0}( 2.5.4.2 NAME 'knowledgeInformation' DESC 'RFC2256: kno wledge information' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121. 1.15{32768} ) olcAttributeTypes: {1}( 2.5.4.4 NAME ( 'sn' 'surname' ) DESC 'RFC2256: last (f amily) name(s) for which the entity is known by' SUP name ) olcAttributeTypes: {2}( 2.5.4.5 NAME 'serialNumber' DESC 'RFC2256: serial numb er of the entity' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch S YNTAX 1.3.6.1.4.1.1466.115.121.1.44{64} ) olcAttributeTypes: {3}( 2.5.4.6 NAME ( 'c' 'countryName' ) DESC 'RFC4519: two- letter ISO-3166 country code' SUP name SYNTAX 1.3.6.1.4.1.1466.115.121.1.11 S INGLE-VALUE ) olcAttributeTypes: {4}( 2.5.4.7 NAME ( 'l' 'localityName' ) DESC 'RFC2256: loc ality which this object resides in' SUP name ) olcAttributeTypes: {5}( 2.5.4.8 NAME ( 'st' 'stateOrProvinceName' ) DESC 'RFC2 256: state or province which this object resides in' SUP name ) olcAttributeTypes: {6}( 2.5.4.9 NAME ( 'street' 'streetAddress' ) DESC 'RFC225 6: street address of this object' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreS ubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) olcAttributeTypes: {7}( 2.5.4.10 NAME ( 'o' 'organizationName' ) DESC 'RFC2256 : organization this object belongs to' SUP name ) olcAttributeTypes: {8}( 2.5.4.11 NAME ( 'ou' 'organizationalUnitName' ) DESC ' RFC2256: organizational unit this object belongs to' SUP name ) olcAttributeTypes: {9}( 2.5.4.12 NAME 'title' DESC 'RFC2256: title associated with the entity' SUP name ) olcAttributeTypes: {10}( 2.5.4.14 NAME 'searchGuide' DESC 'RFC2256: search gui de, deprecated by enhancedSearchGuide' SYNTAX 1.3.6.1.4.1.1466.115.121.1.25 ) olcAttributeTypes: {11}( 2.5.4.15 NAME 'businessCategory' DESC 'RFC2256: busin ess category' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTA X 1.3.6.1.4.1.1466.115.121.1.15{128} ) olcAttributeTypes: {12}( 2.5.4.16 NAME 'postalAddress' DESC 'RFC2256: postal a ddress' EQUALITY caseIgnoreListMatch SUBSTR caseIgnoreListSubstringsMatch SYN TAX 1.3.6.1.4.1.1466.115.121.1.41 ) olcAttributeTypes: {13}( 2.5.4.17 NAME 'postalCode' DESC 'RFC2256: postal code ' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4. 1.1466.115.121.1.15{40} ) olcAttributeTypes: {14}( 2.5.4.18 NAME 'postOfficeBox' DESC 'RFC2256: Post Off ice Box' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3 .6.1.4.1.1466.115.121.1.15{40} ) olcAttributeTypes: {15}( 2.5.4.19 NAME 'physicalDeliveryOfficeName' DESC 'RFC2 256: Physical Delivery Office Name' EQUALITY caseIgnoreMatch SUBSTR caseIgnor eSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) olcAttributeTypes: {16}( 2.5.4.20 NAME 'telephoneNumber' DESC 'RFC2256: Teleph one Number' EQUALITY telephoneNumberMatch SUBSTR telephoneNumberSubstringsMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.50{32} ) olcAttributeTypes: {17}( 2.5.4.21 NAME 'telexNumber' DESC 'RFC2256: Telex Numb er' SYNTAX 1.3.6.1.4.1.1466.115.121.1.52 ) olcAttributeTypes: {18}( 2.5.4.22 NAME 'teletexTerminalIdentifier' DESC 'RFC22 56: Teletex Terminal Identifier' SYNTAX 1.3.6.1.4.1.1466.115.121.1.51 ) olcAttributeTypes: {19}( 2.5.4.23 NAME ( 'facsimileTelephoneNumber' 'fax' ) DE SC 'RFC2256: Facsimile (Fax) Telephone Number' SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.22 ) olcAttributeTypes: {20}( 2.5.4.24 NAME 'x121Address' DESC 'RFC2256: X.121 Addr ess' EQUALITY numericStringMatch SUBSTR numericStringSubstringsMatch SYNTAX 1 .3.6.1.4.1.1466.115.121.1.36{15} ) olcAttributeTypes: {21}( 2.5.4.25 NAME 'internationaliSDNNumber' DESC 'RFC2256 : international ISDN number' EQUALITY numericStringMatch SUBSTR numericString SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.36{16} ) olcAttributeTypes: {22}( 2.5.4.26 NAME 'registeredAddress' DESC 'RFC2256: regi stered postal address' SUP postalAddress SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 ) olcAttributeTypes: {23}( 2.5.4.27 NAME 'destinationIndicator' DESC 'RFC2256: d estination indicator' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44{128} ) olcAttributeTypes: {24}( 2.5.4.28 NAME 'preferredDeliveryMethod' DESC 'RFC2256 : preferred delivery method' SYNTAX 1.3.6.1.4.1.1466.115.121.1.14 SINGLE-VALU E ) olcAttributeTypes: {25}( 2.5.4.29 NAME 'presentationAddress' DESC 'RFC2256: pr esentation address' EQUALITY presentationAddressMatch SYNTAX 1.3.6.1.4.1.1466 .115.121.1.43 SINGLE-VALUE ) olcAttributeTypes: {26}( 2.5.4.30 NAME 'supportedApplicationContext' DESC 'RFC 2256: supported application context' EQUALITY objectIdentifierMatch SYNTAX 1. 3.6.1.4.1.1466.115.121.1.38 ) olcAttributeTypes: {27}( 2.5.4.31 NAME 'member' DESC 'RFC2256: member of a gro up' SUP distinguishedName ) olcAttributeTypes: {28}( 2.5.4.32 NAME 'owner' DESC 'RFC2256: owner (of the ob ject)' SUP distinguishedName ) olcAttributeTypes: {29}( 2.5.4.33 NAME 'roleOccupant' DESC 'RFC2256: occupant of role' SUP distinguishedName ) olcAttributeTypes: {30}( 2.5.4.36 NAME 'userCertificate' DESC 'RFC2256: X.509 user certificate, use ;binary' EQUALITY certificateExactMatch SYNTAX 1.3.6.1. 4.1.1466.115.121.1.8 ) olcAttributeTypes: {31}( 2.5.4.37 NAME 'cACertificate' DESC 'RFC2256: X.509 CA certificate, use ;binary' EQUALITY certificateExactMatch SYNTAX 1.3.6.1.4.1. 1466.115.121.1.8 ) olcAttributeTypes: {32}( 2.5.4.38 NAME 'authorityRevocationList' DESC 'RFC2256 : X.509 authority revocation list, use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.1 21.1.9 ) olcAttributeTypes: {33}( 2.5.4.39 NAME 'certificateRevocationList' DESC 'RFC22 56: X.509 certificate revocation list, use ;binary' SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.9 ) olcAttributeTypes: {34}( 2.5.4.40 NAME 'crossCertificatePair' DESC 'RFC2256: X .509 cross certificate pair, use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.121.1.1 0 ) olcAttributeTypes: {35}( 2.5.4.42 NAME ( 'givenName' 'gn' ) DESC 'RFC2256: fir st name(s) for which the entity is known by' SUP name ) olcAttributeTypes: {36}( 2.5.4.43 NAME 'initials' DESC 'RFC2256: initials of s ome or all of names, but not the surname(s).' SUP name ) olcAttributeTypes: {37}( 2.5.4.44 NAME 'generationQualifier' DESC 'RFC2256: na me qualifier indicating a generation' SUP name ) olcAttributeTypes: {38}( 2.5.4.45 NAME 'x500UniqueIdentifier' DESC 'RFC2256: X .500 unique identifier' EQUALITY bitStringMatch SYNTAX 1.3.6.1.4.1.1466.115.1 21.1.6 ) olcAttributeTypes: {39}( 2.5.4.46 NAME 'dnQualifier' DESC 'RFC2256: DN qualifi er' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgno reSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44 ) olcAttributeTypes: {40}( 2.5.4.47 NAME 'enhancedSearchGuide' DESC 'RFC2256: en hanced search guide' SYNTAX 1.3.6.1.4.1.1466.115.121.1.21 ) olcAttributeTypes: {41}( 2.5.4.48 NAME 'protocolInformation' DESC 'RFC2256: pr otocol information' EQUALITY protocolInformationMatch SYNTAX 1.3.6.1.4.1.1466 .115.121.1.42 ) olcAttributeTypes: {42}( 2.5.4.50 NAME 'uniqueMember' DESC 'RFC2256: unique me mber of a group' EQUALITY uniqueMemberMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1 .34 ) olcAttributeTypes: {43}( 2.5.4.51 NAME 'houseIdentifier' DESC 'RFC2256: house identifier' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) olcAttributeTypes: {44}( 2.5.4.52 NAME 'supportedAlgorithms' DESC 'RFC2256: su pported algorithms' SYNTAX 1.3.6.1.4.1.1466.115.121.1.49 ) olcAttributeTypes: {45}( 2.5.4.53 NAME 'deltaRevocationList' DESC 'RFC2256: de lta revocation list; use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.121.1.9 ) olcAttributeTypes: {46}( 2.5.4.54 NAME 'dmdName' DESC 'RFC2256: name of DMD' S UP name ) olcAttributeTypes: {47}( 2.5.4.65 NAME 'pseudonym' DESC 'X.520(4th): pseudonym for the object' SUP name ) olcAttributeTypes: {48}( 0.9.2342.19200300.100.1.3 NAME ( 'mail' 'rfc822Mailbo x' ) DESC 'RFC1274: RFC822 Mailbox' EQUALITY caseIgnoreIA5Match SUBSTR ca seIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) olcAttributeTypes: {49}( 0.9.234 Nov 22 18:22:52 mgaauth1 slapd[12638]: >>> dnPrettyNormal: <cn={0}core> Nov 22 18:22:52 mgaauth1 slapd[12638]: <<< dnPrettyNormal: <cn={0}core>, <cn={0}core> Nov 22 18:22:52 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:52 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:52 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:52 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:52 mgaauth1 slapd[12638]: <= str2entry(cn={0}core) -> 0x7ff49ab19758 Nov 22 18:22:52 mgaauth1 slapd[12638]: ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=schema/cn={1}cosine.ldif" Nov 22 18:22:52 mgaauth1 slapd[12638]: => str2entry: "dn: cn={1}cosine objectClass: olcSchemaConfig cn: {1}cosine olcAttributeTypes: {0}( 0.9.2342.19200300.100.1.2 NAME 'textEncodedORAddress' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1. 1466.115.121.1.15{256} ) olcAttributeTypes: {1}( 0.9.2342.19200300.100.1.4 NAME 'info' DESC 'RFC1274: g eneral information' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{2048} ) olcAttributeTypes: {2}( 0.9.2342.19200300.100.1.5 NAME ( 'drink' 'favouriteDri nk' ) DESC 'RFC1274: favorite drink' EQUALITY caseIgnoreMatch SUBSTR caseIgno reSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {3}( 0.9.2342.19200300.100.1.6 NAME 'roomNumber' DESC 'RFC1 274: room number' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch S YNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {4}( 0.9.2342.19200300.100.1.7 NAME 'photo' DESC 'RFC1274: photo (G3 fax)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.23{25000} ) olcAttributeTypes: {5}( 0.9.2342.19200300.100.1.8 NAME 'userClass' DESC 'RFC12 74: category of user' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {6}( 0.9.2342.19200300.100.1.9 NAME 'host' DESC 'RFC1274: h ost computer' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTA X 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {7}( 0.9.2342.19200300.100.1.10 NAME 'manager' DESC 'RFC127 4: DN of manager' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115 .121.1.12 ) olcAttributeTypes: {8}( 0.9.2342.19200300.100.1.11 NAME 'documentIdentifier' D ESC 'RFC1274: unique identifier of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {9}( 0.9.2342.19200300.100.1.12 NAME 'documentTitle' DESC ' RFC1274: title of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstri ngsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {10}( 0.9.2342.19200300.100.1.13 NAME 'documentVersion' DES C 'RFC1274: version of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSu bstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {11}( 0.9.2342.19200300.100.1.14 NAME 'documentAuthor' DESC 'RFC1274: DN of author of document' EQUALITY distinguishedNameMatch SYNTAX 1 .3.6.1.4.1.1466.115.121.1.12 ) olcAttributeTypes: {12}( 0.9.2342.19200300.100.1.15 NAME 'documentLocation' DE SC 'RFC1274: location of document original' EQUALITY caseIgnoreMatch SUBSTR c aseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {13}( 0.9.2342.19200300.100.1.20 NAME ( 'homePhone' 'homeTe lephoneNumber' ) DESC 'RFC1274: home telephone number' EQUALITY telephoneNumb erMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121 .1.50 ) olcAttributeTypes: {14}( 0.9.2342.19200300.100.1.21 NAME 'secretary' DESC 'RFC 1274: DN of secretary' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.146 6.115.121.1.12 ) olcAttributeTypes: {15}( 0.9.2342.19200300.100.1.22 NAME 'otherMailbox' SYNTAX 1.3.6.1.4.1.1466.115.121.1.39 ) olcAttributeTypes: {16}( 0.9.2342.19200300.100.1.26 NAME 'aRecord' EQUALITY ca seIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {17}( 0.9.2342.19200300.100.1.27 NAME 'mDRecord' EQUALITY c aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {18}( 0.9.2342.19200300.100.1.28 NAME 'mXRecord' EQUALITY c aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {19}( 0.9.2342.19200300.100.1.29 NAME 'nSRecord' EQUALITY c aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {20}( 0.9.2342.19200300.100.1.30 NAME 'sOARecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {21}( 0.9.2342.19200300.100.1.31 NAME 'cNAMERecord' EQUALIT Y caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {22}( 0.9.2342.19200300.100.1.38 NAME 'associatedName' DESC 'RFC1274: DN of entry associated with domain' EQUALITY distinguishedNameMatc h SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 ) olcAttributeTypes: {23}( 0.9.2342.19200300.100.1.39 NAME 'homePostalAddress' D ESC 'RFC1274: home postal address' EQUALITY caseIgnoreListMatch SUBSTR caseIg noreListSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 ) olcAttributeTypes: {24}( 0.9.2342.19200300.100.1.40 NAME 'personalTitle' DESC 'RFC1274: personal title' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstring sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {25}( 0.9.2342.19200300.100.1.41 NAME ( 'mobile' 'mobileTel ephoneNumber' ) DESC 'RFC1274: mobile telephone number' EQUALITY telephoneNum berMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.50 ) olcAttributeTypes: {26}( 0.9.2342.19200300.100.1.42 NAME ( 'pager' 'pagerTelep honeNumber' ) DESC 'RFC1274: pager telephone number' EQUALITY telephoneNumber Match SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1 .50 ) olcAttributeTypes: {27}( 0.9.2342.19200300.100.1.43 NAME ( 'co' 'friendlyCount ryName' ) DESC 'RFC1274: friendly country name' EQUALITY caseIgnoreMatch SUBS TR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {28}( 0.9.2342.19200300.100.1.44 NAME 'uniqueIdentifier' DE SC 'RFC1274: unique identifer' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.14 66.115.121.1.15{256} ) olcAttributeTypes: {29}( 0.9.2342.19200300.100.1.45 NAME 'organizationalStatus ' DESC 'RFC1274: organizational status' EQUALITY caseIgnoreMatch SUBSTR caseI gnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {30}( 0.9.2342.19200300.100.1.46 NAME 'janetMailbox' DESC ' RFC1274: Janet mailbox' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Subst ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) olcAttributeTypes: {31}( 0.9.2342.19200300.100.1.47 NAME 'mailPreferenceOption ' DESC 'RFC1274: mail preference option' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) olcAttributeTypes: {32}( 0.9.2342.19200300.100.1.48 NAME 'buildingName' DESC ' RFC1274: name of building' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstrin gsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {33}( 0.9.2342.19200300.100.1.49 NAME 'dSAQuality' DESC 'RF C1274: DSA Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.19 SINGLE-VALUE ) olcAttributeTypes: {34}( 0.9.2342.19200300.100.1.50 NAME 'singleLevelQuality' DESC 'RFC1274: Single Level Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.13 SIN GLE-VALUE ) olcAttributeTypes: {35}( 0.9.2342.19200300.100.1.51 NAME 'subtreeMinimumQualit y' DESC 'RFC1274: Subtree Mininum Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1. 13 SINGLE-VALUE ) olcAttributeTypes: {36}( 0.9.2342.19200300.100.1.52 NAME 'subtreeMaximumQualit y' DESC 'RFC1274: Subtree Maximun Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1. 13 SINGLE-VALUE ) olcAttributeTypes: {37}( 0.9.2342.19200300.100.1.53 NAME 'personalSignature' D ESC 'RFC1274: Personal Signature (G3 fax)' SYNTAX 1.3.6.1.4.1.1466.115.121.1. 23 ) olcAttributeTypes: {38}( 0.9.2342.19200300.100.1.54 NAME 'dITRedirect' DESC 'R FC1274: DIT Redirect' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466 .115.121.1.12 ) olcAttributeTypes: {39}( 0.9.2342.19200300.100.1.55 NAME 'audio' DESC 'RFC1274 : audio (u-law)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.4{25000} ) olcAttributeTypes: {40}( 0.9.2342.19200300.100.1.56 NAME 'documentPublisher' D ESC 'RFC1274: publisher of document' EQUALITY caseIgnoreMatch SUBSTR caseIgno reSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcObjectClasses: {0}( 0.9.2342.19200300.100.4.4 NAME ( 'pilotPerson' 'newPilo tPerson' ) SUP person STRUCTURAL MAY ( userid $ textEncodedORAddress $ rfc822 Mailbox $ favouriteDrink $ roomNumber $ userClass $ homeTelephoneNumber $ hom ePostalAddress $ secretary $ personalTitle $ preferredDeliveryMethod $ busine ssCategory $ janetMailbox $ otherMailbox $ mobileTelephoneNumber $ pagerTelep hone Nov 22 18:22:52 mgaauth1 slapd[12638]: >>> dnPrettyNormal: <cn={1}cosine> Nov 22 18:22:52 mgaauth1 slapd[12638]: <<< dnPrettyNormal: <cn={1}cosine>, <cn={1}cosine> Nov 22 18:22:52 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:52 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:52 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:52 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:52 mgaauth1 slapd[12638]: <= str2entry(cn={1}cosine) -> 0x7ff49ab19758 Nov 22 18:22:52 mgaauth1 slapd[12638]: ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=schema/cn={2}inetorgperson.ldif" Nov 22 18:22:52 mgaauth1 slapd[12638]: => str2entry: "dn: cn={2}inetorgperson objectClass: olcSchemaConfig cn: {2}inetorgperson olcAttributeTypes: {0}( 2.16.840.1.113730.3.1.1 NAME 'carLicense' DESC 'RFC279 8: vehicle license or registration plate' EQUALITY caseIgnoreMatch SUBSTR cas eIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {1}( 2.16.840.1.113730.3.1.2 NAME 'departmentNumber' DESC ' RFC2798: identifies a department within an organization' EQUALITY caseIgnoreM atch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {2}( 2.16.840.1.113730.3.1.241 NAME 'displayName' DESC 'RFC 2798: preferred name to be used when displaying entries' EQUALITY caseIgnoreM atch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SI NGLE-VALUE ) olcAttributeTypes: {3}( 2.16.840.1.113730.3.1.3 NAME 'employeeNumber' DESC 'RF C2798: numerically identifies an employee within an organization' EQUALITY ca seIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.15 SINGLE-VALUE ) olcAttributeTypes: {4}( 2.16.840.1.113730.3.1.4 NAME 'employeeType' DESC 'RFC2 798: type of employment for a person' EQUALITY caseIgnoreMatch SUBSTR caseIgn oreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {5}( 0.9.2342.19200300.100.1.60 NAME 'jpegPhoto' DESC 'RFC2 798: a JPEG image' SYNTAX 1.3.6.1.4.1.1466.115.121.1.28 ) olcAttributeTypes: {6}( 2.16.840.1.113730.3.1.39 NAME 'preferredLanguage' DESC 'RFC2798: preferred written or spoken language for a person' EQUALITY caseIg noreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1. 15 SINGLE-VALUE ) olcAttributeTypes: {7}( 2.16.840.1.113730.3.1.40 NAME 'userSMIMECertificate' D ESC 'RFC2798: PKCS#7 SignedData used to support S/MIME' SYNTAX 1.3.6.1.4.1.14 66.115.121.1.5 ) olcAttributeTypes: {8}( 2.16.840.1.113730.3.1.216 NAME 'userPKCS12' DESC 'RFC2 798: personal identity information, a PKCS #12 PFX' SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.5 ) olcObjectClasses: {0}( 2.16.840.1.113730.3.2.2 NAME 'inetOrgPerson' DESC 'RFC2 798: Internet Organizational Person' SUP organizationalPerson STRUCTURAL MAY ( audio $ businessCategory $ carLicense $ departmentNumber $ displayName $ em ployeeNumber $ employeeType $ givenName $ homePhone $ homePostalAddress $ ini tials $ jpegPhoto $ labeledURI $ mail $ manager $ mobile $ o $ pager $ photo $ roomNumber $ secretary $ uid $ userCertificate $ x500uniqueIdentifier $ pre ferredLanguage $ userSMIMECertificate $ userPKCS12 ) ) structuralObjectClass: olcSchemaConfig entryUUID: 1a06766c-8ade-102f-8d05-5da984889200 creatorsName: cn=config createTimestamp: 20101122234350Z entryCSN: 20101122234350.440473Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20101122234350Z " Nov 22 18:22:52 mgaauth1 slapd[12638]: >>> dnPrettyNormal: <cn={2}inetorgperson> Nov 22 18:22:52 mgaauth1 slapd[12638]: <<< dnPrettyNormal: <cn={2}inetorgperson>, <cn={2}inetorgperson> Nov 22 18:22:52 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:52 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:52 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:52 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:52 mgaauth1 slapd[12638]: <= str2entry(cn={2}inetorgperson) -> 0x7ff49ab19758 Nov 22 18:22:53 mgaauth1 slapd[12638]: ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=schema/cn={3}rfc2307bis.ldif" Nov 22 18:22:53 mgaauth1 slapd[12638]: => str2entry: "dn: cn={3}rfc2307bis objectClass: olcSchemaConfig cn: {3}rfc2307bis olcAttributeTypes: {0}( 1.3.6.1.1.1.1.2 NAME 'gecos' DESC 'The GECOS field; th e common name' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatc h SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {1}( 1.3.6.1.1.1.1.3 NAME 'homeDirectory' DESC 'The absolut e path to the home directory' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1 466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {2}( 1.3.6.1.1.1.1.4 NAME 'loginShell' DESC 'The path to th e login shell' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.2 6 SINGLE-VALUE ) olcAttributeTypes: {3}( 1.3.6.1.1.1.1.5 NAME 'shadowLastChange' EQUALITY integ erMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {4}( 1.3.6.1.1.1.1.6 NAME 'shadowMin' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {5}( 1.3.6.1.1.1.1.7 NAME 'shadowMax' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {6}( 1.3.6.1.1.1.1.8 NAME 'shadowWarning' EQUALITY integerM atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {7}( 1.3.6.1.1.1.1.9 NAME 'shadowInactive' EQUALITY integer Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {8}( 1.3.6.1.1.1.1.10 NAME 'shadowExpire' EQUALITY integerM atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {9}( 1.3.6.1.1.1.1.11 NAME 'shadowFlag' EQUALITY integerMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {10}( 1.3.6.1.1.1.1.12 NAME 'memberUid' EQUALITY caseExactI A5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {11}( 1.3.6.1.1.1.1.13 NAME 'memberNisNetgroup' EQUALITY ca seExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.11 5.121.1.26 ) olcAttributeTypes: {12}( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple' DESC 'Netgr oup triple' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {13}( 1.3.6.1.1.1.1.15 NAME 'ipServicePort' DESC 'Service p ort number' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE -VALUE ) olcAttributeTypes: {14}( 1.3.6.1.1.1.1.16 NAME 'ipServiceProtocol' DESC 'Servi ce protocol name' SUP name ) olcAttributeTypes: {15}( 1.3.6.1.1.1.1.17 NAME 'ipProtocolNumber' DESC 'IP pro tocol number' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SING LE-VALUE ) olcAttributeTypes: {16}( 1.3.6.1.1.1.1.18 NAME 'oncRpcNumber' DESC 'ONC RPC nu mber' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {17}( 1.3.6.1.1.1.1.19 NAME 'ipHostNumber' DESC 'IPv4 addre sses as a dotted decimal omitting leading zeros or IPv6 addresses as de fined in RFC2373' SUP name ) olcAttributeTypes: {18}( 1.3.6.1.1.1.1.20 NAME 'ipNetworkNumber' DESC 'IP netw ork as a dotted decimal, eg. 192.168, omitting leading zeros' SUP name SINGLE-VALUE ) olcAttributeTypes: {19}( 1.3.6.1.1.1.1.21 NAME 'ipNetmaskNumber' DESC 'IP netm ask as a dotted decimal, eg. 255.255.255.0, omitting leading zeros' EQU ALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {20}( 1.3.6.1.1.1.1.22 NAME 'macAddress' DESC 'MAC address in maximal, colon separated hex notation, eg. 00:00:92:90:ee:e2' EQUALI TY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {21}( 1.3.6.1.1.1.1.23 NAME 'bootParameter' DESC 'rpc.bootp aramd parameter' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1 .26 ) olcAttributeTypes: {22}( 1.3.6.1.1.1.1.24 NAME 'bootFile' DESC 'Boot image nam e' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {23}( 1.3.6.1.1.1.1.26 NAME 'nisMapName' DESC 'Name of a A generic NIS map' SUP name ) olcAttributeTypes: {24}( 1.3.6.1.1.1.1.27 NAME 'nisMapEntry' DESC 'A generic N IS entry' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTA X 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {25}( 1.3.6.1.1.1.1.28 NAME 'nisPublicKey' DESC 'NIS public key' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-V ALUE ) olcAttributeTypes: {26}( 1.3.6.1.1.1.1.29 NAME 'nisSecretKey' DESC 'NIS secret key' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-V ALUE ) olcAttributeTypes: {27}( 1.3.6.1.1.1.1.30 NAME 'nisDomain' DESC 'NIS domain' E QUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26) olcAttributeTypes: {28}( 1.3.6.1.1.1.1.31 NAME 'automountMapName' DESC 'automo unt Map Name' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch S YNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {29}( 1.3.6.1.1.1.1.32 NAME 'automountKey' DESC 'Automount Key value' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNT AX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {30}( 1.3.6.1.1.1.1.33 NAME 'automountInformation' DESC 'Au tomount information' EQUALITY caseExactIA5Match SUBSTR caseExactIA5Substrings Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcObjectClasses: {0}( 1.3.6.1.1.1.2.0 NAME 'posixAccount' SUP top AUXILIARY D ESC 'Abstraction of an account with POSIX attributes' MUST ( cn $ uid $ uidNu mber $ gidNumber $ homeDirectory ) MAY ( userPassword $ loginShell $ gecos $ description ) ) olcObjectClasses: {1}( 1.3.6.1.1.1.2.1 NAME 'shadowAccount' SUP top AUXILIARY DESC 'Additional attributes for shadow passwords' MUST uid MAY ( userPassword $ description $ shadowLastChange $ shadowMin $ shadowMax $ shado wWarning $ shadowInactive $ shadowExpire $ shadowFlag ) ) olcObjectClasses: {2}( 1.3.6.1.1.1.2.2 NAME 'posixGroup' SUP top AUXILIARY DES C 'Abstraction of a group of accounts' MUST gidNumber MAY ( userPassword $ me mberUid $ description ) ) olcObjectClasses: {3}( 1.3.6.1.1.1.2.3 NAME 'ipService' SUP top STRUCTURAL DES C 'Abstraction an Internet Protocol service. Maps an IP port and protoc ol (such as tcp or udp) to one or more names; the distinguished value o f the cn attribute denotes the services canonical name' MUST ( cn $ ipServicePort $ ipServiceProtocol ) MAY description ) olcObjectClasses: {4}( 1.3.6.1.1.1.2.4 NAME 'ipProtocol' SUP top STRUCTURAL DE SC 'Abstraction of an IP protocol. Maps a protocol number to one or mor e names. The distinguished value of the cn attribute denotes the protoc ols canonical name' MUST ( cn $ ipProtocolNumber ) MAY description ) olcObjectClasses: {5}( 1.3.6.1.1.1.2.5 NAME 'oncRpc' SUP top STRUCTURAL DESC ' Abstraction of an Open Network Computing (ONC) [RFC1057] Remote Procedur e Call (RPC) binding. This class maps an ONC RPC number to a name. The distinguished value of the cn attribute denotes the RPC services can onical name' MUST ( cn $ oncRpcNumber ) MAY description ) olcObjectClasses: {6}( 1.3.6.1.1.1.2.6 NAME 'ipHost' SUP top AUXILIARY DESC 'A bstraction of a host, an IP device. The distinguished value of the cn a ttribute denotes the hosts canonical name. Device SHOULD be used as a s tructural class' MUST ( cn $ ipHostNumber ) MAY ( userPassword $ l $ descript ion $ manager ) ) olcObjectClasses: {7}( 1.3.6.1.1.1.2.7 NAME 'ipNetwork' SUP top STRUCTURAL DES C 'Abstraction of a network. The distinguished value of the cn attribut e denotes the networks canonical name' MUST ipNetworkNumber MAY ( cn $ ipNetm askNumber $ l $ description $ manager ) ) olcObjectClasses: {8}( 1.3.6.1.1.1.2.8 NAME 'nisNetgroup' SUP top STRUCTURAL D ESC 'Abstraction of a netgroup. May refer to other netgroups' MUST cn MAY ( n isNetgroupTriple $ memberNisNetgroup $ description ) ) olcObjectClasses: {9}( 1.3.6.1.1.1.2.9 NAME 'nisMap' SUP top STRUCTURAL DESC ' A generic abstraction of a NIS map' MUST nisMapName MAY description ) olcObjectClasses: {10}( 1.3.6.1.1.1.2.10 NAME 'nisObject' SUP top STRUCTURAL D ESC 'An entry in a NIS map' MUST ( cn $ nisMapE Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnPrettyNormal: <cn={3}rfc2307bis> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnPrettyNormal: <cn={3}rfc2307bis>, <cn={3}rfc2307bis> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <= str2entry(cn={3}rfc2307bis) -> 0x7ff49ab19758 Nov 22 18:22:53 mgaauth1 slapd[12638]: ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=schema/cn={4}yast.ldif" Nov 22 18:22:53 mgaauth1 slapd[12638]: => str2entry: "dn: cn={4}yast objectClass: olcSchemaConfig cn: {4}yast olcObjectIdentifier: {0}SUSE 1.3.6.1.4.1.7057 olcObjectIdentifier: {1}SUSE.YaST SUSE:10.1 olcObjectIdentifier: {2}SUSE.YaST.ModuleConfig SUSE:10.1.2 olcObjectIdentifier: {3}SUSE.YaST.ModuleConfig.OC SUSE.YaST.ModuleConfig:1 olcObjectIdentifier: {4}SUSE.YaST.ModuleConfig.Attr SUSE.YaST.ModuleConfig:2 olcAttributeTypes: {0}( SUSE.YaST.ModuleConfig.Attr:2 NAME ( 'suseDefaultBase' ) DESC 'Base DN where new Objects should be created by default' EQUALITY dis tinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE ) olcAttributeTypes: {1}( SUSE.YaST.ModuleConfig.Attr:3 NAME ( 'suseNextUniqueId ' ) DESC 'Next unused unique ID, can be used to generate directory wide uniqe IDs' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1. 1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {2}( SUSE.YaST.ModuleConfig.Attr:4 NAME ( 'suseMinUniqueId' ) DESC 'lower Border for Unique IDs' EQUALITY integerMatch ORDERING integerO rderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {3}( SUSE.YaST.ModuleConfig.Attr:5 NAME ( 'suseMaxUniqueId' ) DESC 'upper Border for Unique IDs' EQUALITY integerMatch ORDERING integerO rderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {4}( SUSE.YaST.ModuleConfig.Attr:6 NAME ( 'suseDefaultTempl ate' ) DESC 'The DN of a template that should be used by default' EQUALITY di stinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE ) olcAttributeTypes: {5}( SUSE.YaST.ModuleConfig.Attr:7 NAME ( 'suseSearchFilter ' ) DESC 'Search filter to localize Objects' SYNTAX 1.3.6.1.4.1.1466.115.121. 1.15 SINGLE-VALUE ) olcAttributeTypes: {6}( SUSE.YaST.ModuleConfig.Attr:11 NAME ( 'suseDefaultValu e' ) DESC 'an Attribute-Value-Assertions to define defaults for specific Attr ibutes' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {7}( SUSE.YaST.ModuleConfig.Attr:12 NAME ( 'suseNamingAttri bute' ) DESC 'AttributeType that should be used as the RDN' EQUALITY caseIgno reIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {8}( SUSE.YaST.ModuleConfig.Attr:15 NAME ( 'suseSecondaryGr oup' ) DESC 'seconday group DN' EQUALITY distinguishedNameMatch SYNTAX 1.3.6. 1.4.1.1466.115.121.1.12 ) olcAttributeTypes: {9}( SUSE.YaST.ModuleConfig.Attr:16 NAME ( 'suseMinPassword Length' ) DESC 'minimum Password length for new users' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VAL UE ) olcAttributeTypes: {10}( SUSE.YaST.ModuleConfig.Attr:17 NAME ( 'suseMaxPasswor dLength' ) DESC 'maximum Password length for new users' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VA LUE ) olcAttributeTypes: {11}( SUSE.YaST.ModuleConfig.Attr:18 NAME ( 'susePasswordHa sh' ) DESC 'Hash method to use for new users' EQUALITY caseIgnoreIA5Match SYN TAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {12}( SUSE.YaST.ModuleConfig.Attr:19 NAME ( 'suseSkelDir' ) DESC '' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {13}( SUSE.YaST.ModuleConfig.Attr:20 NAME ( 'susePlugin' ) DESC 'plugin to use upon user/ group creation' EQUALITY caseIgnoreMatch SYNTA X 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {14}( SUSE.YaST.ModuleConfig.Attr:21 NAME ( 'suseMapAttribu te' ) DESC '' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {15}( SUSE.YaST.ModuleConfig.Attr:22 NAME ( 'suseImapServer ' ) DESC '' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {16}( SUSE.YaST.ModuleConfig.Attr:23 NAME ( 'suseImapAdmin' ) DESC '' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {17}( SUSE.YaST.ModuleConfig.Attr:24 NAME ( 'suseImapDefaul tQuota' ) DESC '' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {18}( SUSE.YaST.ModuleConfig.Attr:25 NAME ( 'suseImapUseSsl ' ) DESC '' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121 .1.7 SINGLE-VALUE ) olcObjectClasses: {0}( SUSE.YaST.ModuleConfig.OC:2 NAME 'suseModuleConfigurati on' SUP top STRUCTURAL DESC 'Contains configuration of Management Modu les' MUST ( cn ) MAY ( suseDefaultBase )) olcObjectClasses: {1}( SUSE.YaST.ModuleConfig.OC:3 NAME 'suseUserConfiguration ' SUP suseModuleConfiguration STRUCTURAL DESC 'Configuration of user m anagement tools' MAY ( suseMinPasswordLength $ suseMaxPasswordLength $ susePasswordHash $ suseSkelDir $ suseNextUniqueId $ suseMinUniqueId $ suseMaxUniqueId $ suseDefaultTemplate $ suseSearchFilter $ suseMapAttribute )) olcObjectClasses: {2}( SUSE.YaST.ModuleConfig.OC:4 NAME 'suseObjectTemplate' SUP top STRUCTURAL DESC 'Base Class for Object-Templates' MUST ( cn ) M AY ( susePlugin $ suseDefaultValue $ suseNamingAttribute )) olcObjectClasses: {3}( SUSE.YaST.ModuleConfig.OC:5 NAME 'suseUserTemplate' SUP suseObjectTemplate STRUCTURAL DESC 'User object template' MUST ( cn ) MAY ( suseSecondaryGroup )) olcObjectClasses: {4}( SUSE.YaST.ModuleConfig.OC:6 NAME 'suseGroupTemplate' SUP suseObjectTemplate STRUCTURAL DESC 'Group object template' MUST ( cn )) olcObjectClasses: {5}( SUSE.YaST.ModuleConfig.OC:7 NAME 'suseGroupConfiguratio n' SUP suseModuleConfiguration STRUCTURAL DESC 'Configuration of user management tools' MAY ( suseNextUniqueId $ suseMinUniqueId $ suseMaxUni queId $ suseDefaultTemplate $ suseSearchFilter $ suseMapAttribut e )) olcObjectClasses: {6}( SUSE.YaST.ModuleConfig.OC:8 NAME 'suseCaConfiguration' SUP suseModuleConfiguration STRUCTURAL DESC 'Configuration of CA manage ment tools') olcObjectClasses: {7}( SUSE.YaST.ModuleConfig.OC:9 NAME 'suseDnsConfiguration' SUP suseModuleConfiguration STRUCTURAL DESC 'Configuration of mail se rver management tools') olcObjectClasses: {8}( SUSE.YaST.ModuleConfig.OC:10 NAME 'suseDhcpConfiguratio n' SUP suseModuleConfiguration STRUCTURAL DESC 'Configuration of DHCP server management tools') olcObjectClasses: {9}( SUSE.YaST.ModuleConfig.OC:11 NAME 'suseMailConfiguratio n' SUP suseModuleConfiguration STRUCTURAL DESC 'Configuration of IMAP user management tools' MUST ( suseImapServer $ suseImapAdmin $ suseImap DefaultQuota $ suseImapUseSsl )) structuralObjectClass: olcSchemaConfig entryUUID: 1a06ad4e-8ade-102f-8d07-5da984889200 creatorsName: cn=config createTimestamp: 20101122234350Z entryCSN: 20101122234350.441878Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20101122234350Z " Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnPrettyNormal: <cn={4}yast> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnPrettyNormal: <cn={4}yast>, <cn={4}yast> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <= str2entry(cn={4}yast) -> 0x7ff49ab19758 Nov 22 18:22:53 mgaauth1 slapd[12638]: ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=schema/cn={5}kerberos.ldif" Nov 22 18:22:53 mgaauth1 slapd[12638]: => str2entry: "dn: cn={5}kerberos objectClass: olcSchemaConfig cn: {5}kerberos olcAttributeTypes:: ezB9KCAyLjE2Ljg0MC4xLjExMzcxOS4xLjMwMS40LjEuMSAgICAgICAgIC AgICAgIE5BTUUgJ2tyYlByaW5jaXBhbE5hbWUnICAgICAgICAgICAgICAgRVFVQUxJVFkgY2FzZUV 4YWN0SUE1TWF0Y2ggCVNVQlNUUiBjYXNlRXhhY3RTdWJzdHJpbmdzTWF0Y2ggICAgICAgICAgICAg ICBTWU5UQVggMS4zLjYuMS40LjEuMTQ2Ni4xMTUuMTIxLjEuMjYp olcAttributeTypes: {1}( 1.2.840.113554.1.4.1.6.1 NAME 'krbCanoni calName' EQUALITY caseExactIA5Match SUBSTR caseEx actSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE) olcAttributeTypes: {2}( 2.16.840.1.113719.1.301.4.3.1 NAME 'krbP rincipalType' EQUALITY integerMatch SYNTAX 1.3.6. 1.4.1.1466.115.121.1.27 SINGLE-VALUE) olcAttributeTypes: {3}( 2.16.840.1.113719.1.301.4.5.1 NAME 'krbU PEnabled' DESC 'Boolean' SYNTAX 1.3.6.1.4.1.1466. 115.121.1.7 SINGLE-VALUE) olcAttributeTypes: {4}( 2.16.840.1.113719.1.301.4.6.1 NAME 'krbP rincipalExpiration' EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE) olcAttributeTypes: {5}( 2.16.840.1.113719.1.301.4.8.1 NAME 'krbT icketFlags' EQUALITY integerMatch SYNTAX 1.3.6.1. 4.1.1466.115.121.1.27 SINGLE-VALUE) olcAttributeTypes: {6}( 2.16.840.1.113719.1.301.4.9.1 NAME 'krbM axTicketLife' EQUALITY integerMatch SYNTAX 1.3.6. 1.4.1.1466.115.121.1.27 SINGLE-VALUE) olcAttributeTypes: {7}( 2.16.840.1.113719.1.301.4.10.1 NAME 'krb MaxRenewableAge' EQUALITY integerMatch SYNTAX 1.3 .6.1.4.1.1466.115.121.1.27 SINGLE-VALUE) olcAttributeTypes: {8}( 2.16.840.1.113719.1.301.4.14.1 NAME 'krb RealmReferences' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12) olcAttributeTypes: {9}( 2.16.840.1.113719.1.301.4.15.1 NAME 'krb LdapServers' EQUALITY caseIgnoreMatch SYNTAX 1.3. 6.1.4.1.1466.115.121.1.15) olcAttributeTypes: {10}( 2.16.840.1.113719.1.301.4.17.1 NAME 'kr bKdcServers' EQUALITY distinguishedNameMatch SYNT AX 1.3.6.1.4.1.1466.115.121.1.12) olcAttributeTypes: {11}( 2.16.840.1.113719.1.301.4.18.1 NAME 'kr bPwdServers' EQUALITY distinguishedNameMatch SYNT AX 1.3.6.1.4.1.1466.115.121.1.12) olcAttributeTypes: {12}( 2.16.840.1.113719.1.301.4.24.1 NAME 'kr bHostServer' EQUALITY caseExactIA5Match SYNTAX 1. 3.6.1.4.1.1466.115.121.1.26) olcAttributeTypes: {13}( 2.16.840.1.113719.1.301.4.25.1 NAME 'kr bSearchScope' EQUALITY integerMatch SYNTAX 1.3.6. 1.4.1.1466.115.121.1.27 SINGLE-VALUE) olcAttributeTypes: {14}( 2.16.840.1.113719.1.301.4.26.1 NAME 'kr bPrincipalReferences' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12) olcAttributeTypes: {15}( 2.16.840.1.113719.1.301.4.28.1 NAME 'kr bPrincNamingAttr' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE) olcAttributeTypes: {16}( 2.16.840.1.113719.1.301.4.29.1 NAME 'kr bAdmServers' EQUALITY distinguishedNameMatch SYNT AX 1.3.6.1.4.1.1466.115.121.1.12) olcAttributeTypes: {17}( 2.16.840.1.113719.1.301.4.30.1 NAME 'kr bMaxPwdLife' EQUALITY integerMatch SYNTAX 1.3.6.1 .4.1.1466.115.121.1.27 SINGLE-VALUE) olcAttributeTypes: {18}( 2.16.840.1.113719.1.301.4.31.1 NAME 'kr bMinPwdLife' EQUALITY integerMatch SYNTAX 1.3.6.1 .4.1.1466.115.121.1.27 SINGLE-VALUE) olcAttributeTypes: {19}( 2.16.840.1.113719.1.301.4.32.1 NAME 'kr bPwdMinDiffChars' EQUALITY integerMatch SYNTAX 1 .3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE) olcAttributeTypes: {20}( 2.16.840.1.113719.1.301.4.33.1 NAME 'kr bPwdMinLength' EQUALITY integerMatch SYNTAX 1.3. 6.1.4.1.1466.115.121.1.27 SINGLE-VALUE) olcAttributeTypes: {21}( 2.16.840.1.113719.1.301.4.34.1 NAME 'kr bPwdHistoryLength' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE) olcAttributeTypes: {22}( 1.3.6.1.4.1.5322.21.2.1 NAME 'krbPwdMax Failure' EQUALITY integerMatch SYNTAX 1.3.6.1.4. 1.1466.115.121.1.27 SINGLE-VALUE) olcAttributeTypes: {23}( 1.3.6.1.4.1.5322.21.2.2 NAME 'krbPwdFai lureCountInterval' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE) olcAttributeTypes: {24}( 1.3.6.1.4.1.5322.21.2.3 NAME 'krbPwdLoc koutDuration' EQUALITY integerMatch SYNTAX 1.3.6 .1.4.1.1466.115.121.1.27 SINGLE-VALUE) olcAttributeTypes: {25}( 2.16.840.1.113719.1.301.4.36.1 NAME 'kr bPwdPolicyReference' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE) olcAttributeTypes: {26}( 2.16.840.1.113719.1.301.4.37.1 NAME 'kr bPasswordExpiration' EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE) olcAttributeTypes: {27}( 2.16.840.1.113719.1.301.4.39.1 NAME 'kr bPrincipalKey' EQUALITY octetStringMatch SYNTAX 1 .3.6.1.4.1.1466.115.121.1.40) olcAttributeTypes: {28}( 2.16.840.1.113719.1.301.4.40.1 NAME 'kr bTicketPolicyReference' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE) olcAttributeTypes: {29}( 2.16.840.1.113719.1.301.4.41.1 NAME 'kr bSubTrees' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12) olcAttributeTypes: {30}( 2.16.840.1.113719.1.301.4.42.1 NAME 'kr bDefaultEncSaltTypes' EQUALITY caseIgnoreMatch SY NTAX 1.3.6.1.4.1.1466.115.121.1.15) olcAttributeTypes: {31}( 2.16.840.1.113719.1.301.4.43.1 NAME 'kr bSupportedEncSaltTypes' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15) olcAttributeTypes: {32}( 2.16.840.1.113719.1.301.4.44.1 NAME 'kr bPwdHistory' EQUALITY octetStringMatch SYNTAX 1.3 .6.1.4.1.1466.115.121.1.40) olcAttributeTypes: {33}( 2.16.840.1.113719.1.301.4.45.1 NAME 'kr bLastPwdChange' EQUALITY generalizedTimeMatch SYN TAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE) olcAttributeTypes: {34}( 2.16.840.1.113719.1.301.4.46.1 NAME 'kr bMKey' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4 .1.1466.115.121.1.40) olcAttributeTypes: {35}( 2.16.840.1.113719.1.301.4.47.1 NAME 'kr bPrincipalAliases' EQUALITY caseExactIA5Match SYN TAX 1.3.6.1.4.1.1466.115.121.1.26) olcAttributeTypes: {36}( 2.16.840.1.113719.1.301.4.48.1 NAME 'kr bLastSuccessfulAuth' EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE) olcAttributeTypes: {37}( 2.16.840.1.113719.1.301.4.49.1 NAME 'kr bLastFailedAuth' EQUALITY generalizedTimeMatch SY NTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE) olcAttributeTypes: {38}( 2.16.840.1.113719.1.301.4.50.1 NAME 'kr bLo Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnPrettyNormal: <cn={5}kerberos> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnPrettyNormal: <cn={5}kerberos>, <cn={5}kerberos> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <= str2entry(cn={5}kerberos) -> 0x7ff49ab19758 Nov 22 18:22:53 mgaauth1 slapd[12638]: ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=schema/cn={6}uidnext.ldif" Nov 22 18:22:53 mgaauth1 slapd[12638]: => str2entry: "dn: cn={6}uidnext objectClass: olcSchemaConfig cn: {6}uidnext olcObjectClasses: {0}( 1.1.2.2.1.30 NAME 'uidnext' SUP top STRUCTURAL MUST ( cn $ uidNumber )) structuralObjectClass: olcSchemaConfig entryUUID: 189d1db6-8adf-102f-87a7-a13f60af0032 creatorsName: cn=config createTimestamp: 20101122235057Z entryCSN: 20101122235057.569075Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20101122235057Z " Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnPrettyNormal: <cn={6}uidnext> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnPrettyNormal: <cn={6}uidnext>, <cn={6}uidnext> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <= str2entry(cn={6}uidnext) -> 0x7ff49ab19758 Nov 22 18:22:53 mgaauth1 slapd[12638]: ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/olcDatabase={-1}frontend.ldif" Nov 22 18:22:53 mgaauth1 slapd[12638]: => str2entry: "dn: olcDatabase={-1}frontend objectClass: olcDatabaseConfig olcDatabase: {-1}frontend olcAccess: {0}to dn.base="" by * read olcAccess: {1}to dn.base="cn=Subschema" by * read structuralObjectClass: olcDatabaseConfig entryUUID: 1a06c66c-8ade-102f-8d08-5da984889200 creatorsName: cn=config createTimestamp: 20101122234350Z entryCSN: 20101122234350.442520Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20101122234350Z " Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnPrettyNormal: <olcDatabase={-1}frontend> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnPrettyNormal: <olcDatabase={-1}frontend>, <olcDatabase={-1}frontend> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <= str2entry(olcDatabase={-1}frontend) -> 0x7ff49ab19758 Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=Subschema> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=subschema> Nov 22 18:22:53 mgaauth1 slapd[12638]: ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/olcDatabase={0}config.ldif" Nov 22 18:22:53 mgaauth1 slapd[12638]: => str2entry: "dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.base="uid=syncrepl,ou=system,dc=ls,dc=cbn" read by * break olcLimits: {0}dn.exact="uid=syncrepl,ou=system,dc=ls,dc=cbn" size.soft=unlimit ed olcRootDN: cn=config olcRootPW:: e1NTSEF9K3hqNDB5T2U1ZGtyTU45aWVrMGhpSlFMMFVGUlFVNWFXZz09 olcSecurity: simple_bind=128 ssf=71 olcSyncrepl: {0}rid=1 provider="ldap://mgaauth1.ni.ls.cbn/" searchbase="cn=con fig" type="refreshAndPersist" retry="120 +" starttls=critical tls_reqcert=dem and bindmethod="simple" binddn="uid=syncrepl,ou=system,dc=ls,dc=cbn" credenti als="I9BpLVmLdOaL" olcUpdateRef: ldap://mgaauth1.ni.ls.cbn/ structuralObjectClass: olcDatabaseConfig entryUUID: 1a06cd10-8ade-102f-8d09-5da984889200 creatorsName: cn=config createTimestamp: 20101122234350Z entryCSN: 20101122234350.442690Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20101122234350Z " Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnPrettyNormal: <olcDatabase={0}config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnPrettyNormal: <olcDatabase={0}config>, <olcDatabase={0}config> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <= str2entry(olcDatabase={0}config) -> 0x7ff49ab19758 Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnPrettyNormal: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnPrettyNormal: <cn=config>, <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <uid=syncrepl,ou=system,dc=ls,dc=cbn> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <uid=syncrepl,ou=system,dc=ls,dc=cbn> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <uid=syncrepl,ou=system,dc=ls,dc=cbn> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <uid=syncrepl,ou=system,dc=ls,dc=cbn> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnPrettyNormal: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnPrettyNormal: <cn=config>, <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <uid=syncrepl,ou=system,dc=ls,dc=cbn> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <uid=syncrepl,ou=system,dc=ls,dc=cbn> Nov 22 18:22:53 mgaauth1 slapd[12638]: ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/olcDatabase={0}config/olcOverlay={0}syncprov.ldif" Nov 22 18:22:53 mgaauth1 slapd[12638]: => str2entry: "dn: olcOverlay={0}syncprov objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 10 structuralObjectClass: olcSyncProvConfig entryUUID: 1a06d9fe-8ade-102f-8d0a-5da984889200 creatorsName: cn=config createTimestamp: 20101122234350Z entryCSN: 20101122234350.443021Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20101122234350Z " Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnPrettyNormal: <olcOverlay={0}syncprov> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnPrettyNormal: <olcOverlay={0}syncprov>, <olcOverlay={0}syncprov> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <= str2entry(olcOverlay={0}syncprov) -> 0x7ff49ab19758 Nov 22 18:22:53 mgaauth1 slapd[12638]: ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/olcDatabase={1}hdb.ldif" Nov 22 18:22:53 mgaauth1 slapd[12638]: => str2entry: "dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=ls,dc=cbn olcAccess: {0}to attrs=userPassword by self write by * auth olcAccess: {1}to attrs=shadowLastChange by self write by * read olcAccess: {2}to attrs=userPKCS12 by self read by * none olcAccess: {3}to * by * read olcRootDN: cn=admin,dc=ls,dc=cbn olcRootPW:: e1NTSEF9TkJSVVEyR0FGMlNQN1dsbFh3eS9GK2t5MFBST1UxaEpWQT09 olcUpdateRef: ldap://anubis.ls.cbn/ olcDbCacheSize: 10000 olcDbCheckpoint: 1024 5 olcDbConfig: {0}set_cachesize 0 15000000 1 olcDbConfig: {1}set_lg_regionmax 262144 olcDbConfig: {2}set_lg_bsize 2097152 olcDbConfig: {3}set_flags DB_LOG_AUTOREMOVE olcDbIDLcacheSize: 30000 olcDbIndex: objectclass eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: member eq olcDbIndex: memberUid eq olcDbIndex: mail eq olcDbIndex: cn eq,sub olcDbIndex: displayName eq,sub olcDbIndex: uid eq,sub olcDbIndex: sn eq,sub olcDbIndex: givenName eq,sub olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq structuralObjectClass: olcHdbConfig entryUUID: 65b86196-8adf-102f-87a8-a13f60af0032 creatorsName: cn=config createTimestamp: 20101122235306Z olcSyncrepl: {0}rid=2 provider="ldap://anubis.ls.cbn/" searchbase="dc=ls,dc=cb n" type="refreshOnly" retry="120 +" interval="00:00:01:00" starttls=critical tls_reqcert=demand bindmethod="simple" binddn="uid=syncrepl,ou=system,dc=ls,d c=cbn" credentials="lieguYwHee" entryCSN: 20101123001649.251496Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20101123001649Z " Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnPrettyNormal: <olcDatabase={1}hdb> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnPrettyNormal: <olcDatabase={1}hdb>, <olcDatabase={1}hdb> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <dc=ls,dc=cbn> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <dc=ls,dc=cbn> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=admin,dc=ls,dc=cbn> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=admin,dc=ls,dc=cbn> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=config> Nov 22 18:22:53 mgaauth1 slapd[12638]: <= str2entry(olcDatabase={1}hdb) -> 0x7ff49ab19758 Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnPrettyNormal: <dc=ls,dc=cbn> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnPrettyNormal: <dc=ls,dc=cbn>, <dc=ls,dc=cbn> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnPrettyNormal: <cn=admin,dc=ls,dc=cbn> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnPrettyNormal: <cn=admin,dc=ls,dc=cbn>, <cn=admin,dc=ls,dc=cbn> Nov 22 18:22:53 mgaauth1 slapd[12638]: hdb_db_init: Initializing HDB database Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnPrettyNormal: <dc=ls,dc=cbn> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnPrettyNormal: <dc=ls,dc=cbn>, <dc=ls,dc=cbn> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnPrettyNormal: <cn=admin,dc=ls,dc=cbn> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnPrettyNormal: <cn=admin,dc=ls,dc=cbn>, <cn=admin,dc=ls,dc=cbn> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <dc=ls,dc=cbn> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <dc=ls,dc=cbn> Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <uid=syncrepl,ou=system,dc=ls,dc=cbn> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <uid=syncrepl,ou=system,dc=ls,dc=cbn> Nov 22 18:22:53 mgaauth1 slapd[12638]: send_ldap_result: conn=-1 op=0 p=0 Nov 22 18:22:53 mgaauth1 slapd[12638]: send_ldap_result: err=0 matched="" text="" Nov 22 18:22:53 mgaauth1 slapd[12638]: >>> dnNormalize: <cn=Subschema> Nov 22 18:22:53 mgaauth1 slapd[12638]: <<< dnNormalize: <cn=subschema> Nov 22 18:22:53 mgaauth1 slapd[12638]: matching_rule_use_init Nov 22 18:22:53 mgaauth1 slapd[12638]: 1.2.840.113556.1.4.804 (integerBitOrMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 1.2.840.113556.1.4.804 NAME 'integerBitOrMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcChainMaxReferralDepth $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ olcDDSmaxDynamicObjects $ olcPcacheMaxQueries $ olcRetcodeSleep $ olcSssVlvMax $ olcSssVlvMaxKeys $ olcSpSessionlog $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber $ suseNextUniqueId $ suseMinUniqueId $ suseMaxUniqueId $ suseMinPasswordLength $ suseMaxPasswordLength $ suseImapDefaultQuota $ krbPrincipalType $ krbTicketFlags $ krbMaxTicketLife $ krbMaxRenewableAge $ krbSearchScope $ krbMaxPwdLife $ krbMinPwdLife $ krbPwdMinDiffChars $ krbPwdMinLength $ krbPwdHistoryLength $ krbPwdMaxFailure $ krbPwdFailureCountInterval $ krbPwdLockoutDuration $ krbLoginFailedCount ) ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 1.2.840.113556.1.4.803 (integerBitAndMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 1.2.840.113556.1.4.803 NAME 'integerBitAndMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcChainMaxReferralDepth $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ olcDDSmaxDynamicObjects $ olcPcacheMaxQueries $ olcRetcodeSleep $ olcSssVlvMax $ olcSssVlvMaxKeys $ olcSpSessionlog $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber $ suseNextUniqueId $ suseMinUniqueId $ suseMaxUniqueId $ suseMinPasswordLength $ suseMaxPasswordLength $ suseImapDefaultQuota $ krbPrincipalType $ krbTicketFlags $ krbMaxTicketLife $ krbMaxRenewableAge $ krbSearchScope $ krbMaxPwdLife $ krbMinPwdLife $ krbPwdMinDiffChars $ krbPwdMinLength $ krbPwdHistoryLength $ krbPwdMaxFailure $ krbPwdFailureCountInterval $ krbPwdLockoutDuration $ krbLoginFailedCount ) ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 1.3.6.1.4.1.1466.109.114.2 (caseIgnoreIA5Match): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 1.3.6.1.4.1.1466.109.114.2 NAME 'caseIgnoreIA5Match' APPLIES ( altServer $ olcDbConfig $ c $ mail $ dc $ associatedDomain $ email $ aRecord $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMailbox $ gecos $ homeDirectory $ loginShell $ memberUid $ memberNisNetgroup $ nisNetgroupTriple $ ipNetmaskNumber $ macAddress $ bootParameter $ bootFile $ nisMapEntry $ nisDomain $ automountMapName $ automountKey $ automountInformation $ suseNamingAttribute $ susePasswordHash $ suseSkelDir $ krbPrincipalName $ krbCanonicalName $ krbHostServer $ krbPrincipalAliases $ krbAllowedToDelegateTo ) ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 1.3.6.1.4.1.1466.109.114.1 (caseExactIA5Match): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 1.3.6.1.4.1.1466.109.114.1 NAME 'caseExactIA5Match' APPLIES ( altServer $ olcDbConfig $ c $ mail $ dc $ associatedDomain $ email $ aRecord $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMailbox $ gecos $ homeDirectory $ loginShell $ memberUid $ memberNisNetgroup $ nisNetgroupTriple $ ipNetmaskNumber $ macAddress $ bootParameter $ bootFile $ nisMapEntry $ nisDomain $ automountMapName $ automountKey $ automountInformation $ suseNamingAttribute $ susePasswordHash $ suseSkelDir $ krbPrincipalName $ krbCanonicalName $ krbHostServer $ krbPrincipalAliases $ krbAllowedToDelegateTo ) ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.39 (certificateListMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.38 (certificateListExactMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 2.5.13.38 NAME 'certificateListExactMatch' APPLIES ( authorityRevocationList $ certificateRevocationList $ deltaRevocationList ) ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.35 (certificateMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.34 (certificateExactMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 2.5.13.34 NAME 'certificateExactMatch' APPLIES ( userCertificate $ cACertificate ) ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.30 (objectIdentifierFirstComponentMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 2.5.13.30 NAME 'objectIdentifierFirstComponentMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ ldapSyntaxes $ supportedApplicationContext ) ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.29 (integerFirstComponentMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 2.5.13.29 NAME 'integerFirstComponentMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcChainMaxReferralDepth $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ olcDDSmaxDynamicObjects $ olcPcacheMaxQueries $ olcRetcodeSleep $ olcSssVlvMax $ olcSssVlvMaxKeys $ olcSpSessionlog $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber $ suseNextUniqueId $ suseMinUniqueId $ suseMaxUniqueId $ suseMinPasswordLength $ suseMaxPasswordLength $ suseImapDefaultQuota $ krbPrincipalType $ krbTicketFlags $ krbMaxTicketLife $ krbMaxRenewableAge $ krbSearchScope $ krbMaxPwdLife $ krbMinPwdLife $ krbPwdMinDiffChars $ krbPwdMinLength $ krbPwdHistoryLength $ krbPwdMaxFailure $ krbPwdFailureCountInterval $ krbPwdLockoutDuration $ krbLoginFailedCount ) ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.27 (generalizedTimeMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 2.5.13.27 NAME 'generalizedTimeMatch' APPLIES ( createTimestamp $ modifyTimestamp $ pwdChangedTime $ pwdAccountLockedTime $ pwdFailureTime $ pwdGraceUseTime $ krbPrincipalExpiration $ krbPasswordExpiration $ krbLastPwdChange $ krbLastSuccessfulAuth $ krbLastFailedAuth ) ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.24 (protocolInformationMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 2.5.13.24 NAME 'protocolInformationMatch' APPLIES protocolInformation ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.23 (uniqueMemberMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 2.5.13.23 NAME 'uniqueMemberMatch' APPLIES uniqueMember ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.22 (presentationAddressMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 2.5.13.22 NAME 'presentationAddressMatch' APPLIES presentationAddress ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.20 (telephoneNumberMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 2.5.13.20 NAME 'telephoneNumberMatch' APPLIES ( telephoneNumber $ homePhone $ mobile $ pager ) ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.17 (octetStringMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 2.5.13.17 NAME 'octetStringMatch' APPLIES ( userPassword $ olcDbCryptKey $ pwdHistory $ nisPublicKey $ nisSecretKey $ krbPrincipalKey $ krbPwdHistory $ krbMKey $ krbExtraData ) ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.16 (bitStringMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 2.5.13.16 NAME 'bitStringMatch' APPLIES x500UniqueIdentifier ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.14 (integerMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 2.5.13.14 NAME 'integerMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcChainMaxReferralDepth $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ olcDDSmaxDynamicObjects $ olcPcacheMaxQueries $ olcRetcodeSleep $ olcSssVlvMax $ olcSssVlvMaxKeys $ olcSpSessionlog $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber $ suseNextUniqueId $ suseMinUniqueId $ suseMaxUniqueId $ suseMinPasswordLength $ suseMaxPasswordLength $ suseImapDefaultQuota $ krbPrincipalType $ krbTicketFlags $ krbMaxTicketLife $ krbMaxRenewableAge $ krbSearchScope $ krbMaxPwdLife $ krbMinPwdLife $ krbPwdMinDiffChars $ krbPwdMinLength $ krbPwdHistoryLength $ krbPwdMaxFailure $ krbPwdFailureCountInterval $ krbPwdLockoutDuration $ krbLoginFailedCount ) ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.13 (booleanMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 2.5.13.13 NAME 'booleanMatch' APPLIES ( hasSubordinates $ olcAddContentAcl $ olcGentleHUP $ olcHidden $ olcLastMod $ olcMirrorMode $ olcMonitoring $ olcReadOnly $ olcReverseLookup $ olcSyncUseSubentry $ olcDbChecksum $ olcDbNoSync $ olcDbDirtyRead $ olcDbLinearIndex $ olcChainCacheURI $ olcChainReturnError $ olcDbRebindAsUser $ olcDbChaseReferrals $ olcDbProxyWhoAmI $ olcDbSingleConn $ olcDbUseTemporaryConn $ olcDbNoRefs $ olcDbNoUndefFilter $ olcAccessLogSuccess $ olcDDSstate $ olcMemberOfRefInt $ pwdReset $ olcPPolicyHashCleartext $ olcPPolicyForwardUpdates $ olcPPolicyUseLockout $ olcPcachePersist $ olcPcacheValidate $ olcPcacheOffline $ olcRetcodeInDir $ olcRwmNormalizeMapped $ olcRwmDropUnrequested $ olcSpNoPresent $ olcSpReloadHint $ olcTranslucentStrict $ olcTranslucentNoGlue $ olcTranslucentBindLocal $ olcTranslucentPwModLocal $ olcUniqueStrict $ suseImapUseSsl $ krbUPEnabled ) ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.11 (caseIgnoreListMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 2.5.13.11 NAME 'caseIgnoreListMatch' APPLIES ( postalAddress $ registeredAddress $ homePostalAddress ) ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.8 (numericStringMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 2.5.13.8 NAME 'numericStringMatch' APPLIES ( x121Address $ internationaliSDNNumber ) ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.7 (caseExactSubstringsMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 2.5.13.7 NAME 'caseExactSubstringsMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.6 (caseExactOrderingMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 2.5.13.6 NAME 'caseExactOrderingMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.5 (caseExactMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 2.5.13.5 NAME 'caseExactMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcInclude $ olcLdapSyntaxes $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLimit $ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTCPBuffer $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSCRLFile $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSProtocolMin $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbCryptFile $ olcDbPageSize $ olcDbIndex $ olcDbLockDetect $ olcDbMode $ olcChainingBehavior $ olcDbURI $ olcDbStartTLS $ olcDbACLPasswd $ olcDbACLBind $ olcDbIDAssertPasswd $ olcDbIDAssertBind $ olcDbIDAssertMode $ olcDbIDAssertAuthzFrom $ olcDbTFSupport $ olcDbTimeout $ olcDbIdleTimeout $ olcDbConnTtl $ olcDbNetworkTimeout $ olcDbCancel $ olcDbQuarantine $ olcAccessLogOps $ olcAccessLogPurge $ olcAccessLogOld $ olcAccessLogOldAttr $ olcAuditlogFile $ olcCollectInfo $ olcConstraintAttribute $ olcDDSmaxTtl $ olcDDSminTtl $ olcDDSdefaultTtl $ olcDDSinterval $ olcDDStolerance $ olcDGAttrPair $ olcDlAttrSet $ olcMemberOfDangling $ olcMemberOfGroupOC $ olcMemberOfMemberAD $ olcMemberOfMemberOfAD $ olcMemberOfDanglingError $ olcPcache $ olcPcacheAttrset $ olcPcacheTemplate $ olcPcachePosition $ olcPcacheBind $ olcRefintAttribute $ olcRetcodeItem $ olcRwmRewrite $ olcRwmTFSupport $ olcRwmMap $ olcSpCheckpoint $ olcTranslucentLocal $ olcTranslucentRemote $ olcUniqueIgnore $ olcUniqueAttribute $ olcUniqueURI $ olcValSortAttr $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName $ destinationIndicator $ givenName $ initials $ generationQualifier $ dnQualifier $ houseIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info $ drink $ roomNumber $ userClass $ host $ documentIdentifier $ documentTitle $ documentVersion $ documentLocation $ personalTitle $ co $ uniqueIdentifier $ organizationalStatus $ buildingName $ documentPublisher $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ preferredLanguage $ ipServiceProtocol $ ipHostNumber $ ipNetworkNumber $ nisMapName $ suseSearchFilter $ suseDefaultValue $ susePlugin $ suseMapAttribute $ suseImapServer $ suseImapAdmin $ krbLdapServers $ krbPrincNamingAttr $ krbDefaultEncSaltTypes $ krbSupportedEncSaltTypes ) ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.4 (caseIgnoreSubstringsMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 2.5.13.4 NAME 'caseIgnoreSubstringsMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.3 (caseIgnoreOrderingMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 2.5.13.3 NAME 'caseIgnoreOrderingMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.2 (caseIgnoreMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 2.5.13.2 NAME 'caseIgnoreMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcInclude $ olcLdapSyntaxes $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLimit $ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTCPBuffer $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSCRLFile $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSProtocolMin $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbCryptFile $ olcDbPageSize $ olcDbIndex $ olcDbLockDetect $ olcDbMode $ olcChainingBehavior $ olcDbURI $ olcDbStartTLS $ olcDbACLPasswd $ olcDbACLBind $ olcDbIDAssertPasswd $ olcDbIDAssertBind $ olcDbIDAssertMode $ olcDbIDAssertAuthzFrom $ olcDbTFSupport $ olcDbTimeout $ olcDbIdleTimeout $ olcDbConnTtl $ olcDbNetworkTimeout $ olcDbCancel $ olcDbQuarantine $ olcAccessLogOps $ olcAccessLogPurge $ olcAccessLogOld $ olcAccessLogOldAttr $ olcAuditlogFile $ olcCollectInfo $ olcConstraintAttribute $ olcDDSmaxTtl $ olcDDSminTtl $ olcDDSdefaultTtl $ olcDDSinterval $ olcDDStolerance $ olcDGAttrPair $ olcDlAttrSet $ olcMemberOfDangling $ olcMemberOfGroupOC $ olcMemberOfMemberAD $ olcMemberOfMemberOfAD $ olcMemberOfDanglingError $ olcPcache $ olcPcacheAttrset $ olcPcacheTemplate $ olcPcachePosition $ olcPcacheBind $ olcRefintAttribute $ olcRetcodeItem $ olcRwmRewrite $ olcRwmTFSupport $ olcRwmMap $ olcSpCheckpoint $ olcTranslucentLocal $ olcTranslucentRemote $ olcUniqueIgnore $ olcUniqueAttribute $ olcUniqueURI $ olcValSortAttr $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName $ destinationIndicator $ givenName $ initials $ generationQualifier $ dnQualifier $ houseIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info $ drink $ roomNumber $ userClass $ host $ documentIdentifier $ documentTitle $ documentVersion $ documentLocation $ personalTitle $ co $ uniqueIdentifier $ organizationalStatus $ buildingName $ documentPublisher $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ preferredLanguage $ ipServiceProtocol $ ipHostNumber $ ipNetworkNumber $ nisMapName $ suseSearchFilter $ suseDefaultValue $ susePlugin $ suseMapAttribute $ suseImapServer $ suseImapAdmin $ krbLdapServers $ krbPrincNamingAttr $ krbDefaultEncSaltTypes $ krbSupportedEncSaltTypes ) ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 1.2.36.79672281.1.13.3 (rdnMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.1 (distinguishedNameMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 2.5.13.1 NAME 'distinguishedNameMatch' APPLIES ( creatorsName $ modifiersName $ subschemaSubentry $ entryDN $ namingContexts $ aliasedObjectName $ dynamicSubtrees $ distinguishedName $ seeAlso $ olcDefaultSearchBase $ olcRootDN $ olcSchemaDN $ olcSuffix $ olcUpdateDN $ olcDbACLAuthcDn $ olcDbIDAssertAuthcDn $ olcRelay $ olcAccessLogDB $ memberOf $ olcMemberOfDN $ pwdPolicySubentry $ olcPPolicyDefault $ olcRefintNothing $ olcRefintModifiersName $ olcRetcodeParent $ olcUniqueBase $ member $ owner $ roleOccupant $ manager $ documentAuthor $ secretary $ associatedName $ dITRedirect $ suseDefaultBase $ suseDefaultTemplate $ suseSecondaryGroup $ krbRealmReferences $ krbKdcServers $ krbPwdServers $ krbPrincipalReferences $ krbAdmServers $ krbPwdPolicyReference $ krbTicketPolicyReference $ krbSubTrees $ krbObjectReferences $ krbPrincContainerRef ) ) Nov 22 18:22:53 mgaauth1 slapd[12638]: 2.5.13.0 (objectIdentifierMatch): Nov 22 18:22:53 mgaauth1 slapd[12638]: matchingRuleUse: ( 2.5.13.0 NAME 'objectIdentifierMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ supportedApplicationContext ) ) Nov 22 18:22:53 mgaauth1 slapd[12651]: slapd startup: initiated. Nov 22 18:22:53 mgaauth1 slapd[12651]: backend_startup_one: starting "cn=config" Nov 22 18:22:53 mgaauth1 slapd[12651]: config_back_db_open Nov 22 18:22:53 mgaauth1 slapd[12651]: send_ldap_result: conn=-1 op=0 p=0 Nov 22 18:22:53 mgaauth1 slapd[12651]: send_ldap_result: err=0 matched="" text="" Nov 22 18:22:53 mgaauth1 slapd[12651]: backend_startup_one: starting "dc=ls,dc=cbn" Nov 22 18:22:53 mgaauth1 slapd[12651]: hdb_db_open: "dc=ls,dc=cbn" Nov 22 18:22:53 mgaauth1 slapd[12651]: hdb_db_open: database "dc=ls,dc=cbn": dbenv_open(/var/lib/ldap). Nov 22 18:22:53 mgaauth1 slapd[12651]: hdb_monitor_db_open: monitoring disabled; configure monitor database to enable Nov 22 18:22:53 mgaauth1 slapd[12651]: slapd starting Nov 22 18:22:53 mgaauth1 slapd[12651]: =>do_syncrepl rid=002 Nov 22 18:22:53 mgaauth1 slapd[12651]: => bdb_entry_get: ndn: "dc=ls,dc=cbn" Nov 22 18:22:53 mgaauth1 slapd[12651]: => bdb_entry_get: oc: "(null)", at: "contextCSN" Nov 22 18:22:53 mgaauth1 slapd[12651]: bdb_dn2entry("dc=ls,dc=cbn") Nov 22 18:22:53 mgaauth1 slapd[12651]: => hdb_dn2id("dc=ls,dc=cbn") Nov 22 18:22:53 mgaauth1 slapd[12651]: <= hdb_dn2id: got id=0x1 Nov 22 18:22:53 mgaauth1 slapd[12651]: entry_decode: "" Nov 22 18:22:53 mgaauth1 slapd[12651]: <= entry_decode() Nov 22 18:22:53 mgaauth1 slapd[12651]: bdb_entry_get: rc=0 Nov 22 18:22:53 mgaauth1 slapd[12651]: =>do_syncrep2 rid=002 Nov 22 18:22:53 mgaauth1 slapd[12651]: do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT Nov 22 18:22:54 mgaauth1 slapd[12651]: slap_listener_activate(7): Nov 22 18:22:54 mgaauth1 slapd[12651]: >>> slap_listener(ldap://) Nov 22 18:22:54 mgaauth1 slapd[12651]: conn=1000 fd=13 ACCEPT from IP=127.0.0.1:33205 (IP=0.0.0.0:389) Nov 22 18:22:54 mgaauth1 slapd[12651]: connection_get(13) Nov 22 18:22:54 mgaauth1 slapd[12651]: connection_get(13): got connid=1000 Nov 22 18:22:54 mgaauth1 slapd[12651]: connection_read(13): checking for input on id=1000 Nov 22 18:22:54 mgaauth1 slapd[12651]: op tag 0x60, time 1290471774 Nov 22 18:22:54 mgaauth1 slapd[12651]: conn=1000 op=0 do_bind Nov 22 18:22:54 mgaauth1 slapd[12651]: >>> dnPrettyNormal: <> Nov 22 18:22:54 mgaauth1 slapd[12651]: <<< dnPrettyNormal: <>, <> Nov 22 18:22:54 mgaauth1 slapd[12651]: conn=1000 op=0 BIND dn="" method=128 Nov 22 18:22:54 mgaauth1 slapd[12651]: do_bind: version=3 dn="" method=128 Nov 22 18:22:54 mgaauth1 slapd[12651]: send_ldap_result: conn=1000 op=0 p=3 Nov 22 18:22:54 mgaauth1 slapd[12651]: send_ldap_result: err=0 matched="" text="" Nov 22 18:22:54 mgaauth1 slapd[12651]: send_ldap_response: msgid=1 tag=97 err=0 Nov 22 18:22:54 mgaauth1 slapd[12651]: conn=1000 op=0 RESULT tag=97 err=0 text= Nov 22 18:22:54 mgaauth1 slapd[12651]: do_bind: v3 anonymous bind Nov 22 18:22:54 mgaauth1 slapd[12651]: connection_get(13) Nov 22 18:22:54 mgaauth1 slapd[12651]: connection_get(13): got connid=1000 Nov 22 18:22:54 mgaauth1 slapd[12651]: connection_read(13): checking for input on id=1000 Nov 22 18:22:54 mgaauth1 slapd[12651]: op tag 0x63, time 1290471774 Nov 22 18:22:54 mgaauth1 slapd[12651]: conn=1000 op=1 do_search Nov 22 18:22:54 mgaauth1 slapd[12651]: >>> dnPrettyNormal: <> Nov 22 18:22:54 mgaauth1 slapd[12651]: <<< dnPrettyNormal: <>, <> Nov 22 18:22:54 mgaauth1 slapd[12651]: SRCH "" 0 0 Nov 22 18:22:54 mgaauth1 slapd[12651]: 0 0 0 Nov 22 18:22:54 mgaauth1 slapd[12651]: filter: (objectClass=*) Nov 22 18:22:54 mgaauth1 slapd[12651]: attrs: Nov 22 18:22:54 mgaauth1 slapd[12651]: Nov 22 18:22:54 mgaauth1 slapd[12651]: conn=1000 op=1 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" Nov 22 18:22:54 mgaauth1 slapd[12651]: => send_search_entry: conn 1000 dn="" Nov 22 18:22:54 mgaauth1 slapd[12651]: conn=1000 op=1 ENTRY dn="" Nov 22 18:22:54 mgaauth1 slapd[12651]: <= send_search_entry: conn 1000 exit. Nov 22 18:22:54 mgaauth1 slapd[12651]: send_ldap_result: conn=1000 op=1 p=3 Nov 22 18:22:54 mgaauth1 slapd[12651]: send_ldap_result: err=0 matched="" text="" Nov 22 18:22:54 mgaauth1 slapd[12651]: send_ldap_response: msgid=2 tag=101 err=0 Nov 22 18:22:54 mgaauth1 slapd[12651]: conn=1000 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Nov 22 18:22:54 mgaauth1 slapd[12651]: connection_get(13) Nov 22 18:22:54 mgaauth1 slapd[12651]: connection_get(13): got connid=1000 Nov 22 18:22:54 mgaauth1 slapd[12651]: connection_read(13): checking for input on id=1000 Nov 22 18:22:54 mgaauth1 slapd[12651]: op tag 0x42, time 1290471774 Nov 22 18:22:54 mgaauth1 slapd[12651]: conn=1000 op=2 do_unbind Nov 22 18:22:54 mgaauth1 slapd[12651]: conn=1000 op=2 UNBIND Nov 22 18:22:54 mgaauth1 slapd[12651]: connection_close: conn=1000 sd=13 Nov 22 18:22:54 mgaauth1 slapd[12651]: conn=1000 fd=13 closed Any idea what could be going on? Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. Cell: 613-608-9752

2 2

Is it possible to prevent many loggings on many computer from only one user?
by Olivier PAVILLA 25 Nov '10

25 Nov '10

Hi everyone I would like to know if it's possible to prevent many loggings on many computers from only one user? I have LDAP/Samba server. Anyone must connect with LDAP to acces its home. So I have user who opened 12 computers, logged on those 12 computers and ran boinc-client on those 12 computers... I want to prevent this kind of behaviour... Thanks in advance. Regards. -- Olivier Pavilla << 仕事を探しています。求職中です。>> S.C.I.R.C. Orléans (Bourgogne) - I.U.F.M. Centre-Val de Loire 72 Rue du Faubourg Bourgogne -45044 ORLEANS Cedex 1 Tel : 02-38-49-26-20 , mailto:olivier.pavilla@univ-orleans.fr http://blog.linux-squad.com - 僕の傑作です。 http://gallery.linux-squad.com - 僕の傑作です。

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical November 2010