openldap-technical November 2010

openldap-technical@openldap.org

86 participants
113 discussions

syncrepl proxy problem - consumer gets cleared
by Sebastian Hofmann 03 Nov '10

03 Nov '10

Hello, I have a problem setting up replication with syncrepl proxy (push-based) according to http://www.openldap.org/doc/admin24/replication.html#Syncrepl%20Proxy. I got it working but sometimes the client gets cleared. This happens when consumer is down and some changed occur at the provider. When restarting the consumer, the changes will be replicated and after that the consumer gets cleared from searchbase down. Here is the log of the consumer. I removed dc=max,dc=pamuser,dc=sourcepark,dc=de at the provider while the consumer was down: conn=0 op=311 SRCH base="dc=pamuser,dc=sourcepark,dc=de" scope=2 deref=0 filter="(objectClass=*)" conn=0 op=311 SRCH attr=entryUUID conn=0 op=311 SEARCH RESULT tag=101 err=0 nentries=153 text= conn=0 op=312 DEL dn="dc=max,dc=pamuser,dc=sourcepark,dc=de" conn=0 op=312 RESULT tag=107 err=0 text= conn=0 op=313 DEL dn="dc=pamuser,dc=sourcepark,dc=de" conn=0 op=313 RESULT tag=107 err=66 text=subordinate objects must be deleted first ######################### My provider config: allow bind_v2 allow bind_anon_dn include /home/sebastian/ldap-master/schema/core.schema include /home/sebastian/ldap-master/schema/cosine.schema include /home/sebastian/ldap-master/schema/nis.schema include /home/sebastian/ldap-master/schema/inetorgperson.schema include /home/sebastian/ldap-master/schema/evolutionperson.schema include /home/sebastian/ldap-master/schema/automount.schema include /home/sebastian/ldap-master/schema/openldap.schema include /home/sebastian/ldap-master/schema/misc.schema include /home/sebastian/ldap-master/schema/gum.schema include /home/sebastian/ldap-master/schema/samba.schema include /home/sebastian/ldap-master/schema/sudo.schema pidfile /home/sebastian/ldap-master/run/slapd.pid modulepath /usr/lib/ldap moduleload back_bdb moduleload syncprov.la moduleload back_monitor.la moduleload back_ldap.la backend bdb database bdb suffix "dc=sourcepark,dc=de" checkpoint 512 30 directory "/home/sebastian/ldap-master/data" index objectClass eq lastmod on rootdn "cn=test,dc=sourcepark,dc=de" rootpw test access to attrs=userPassword by dn="cn=test,dc=sourcepark,dc=de" write by anonymous auth by self write by * none access to dn.base="" by * read access to dn.subtree="ou=Contacts,dc=sourcepark,dc=de" by users write by self write by * auth access to * by dn="cn=test,dc=sourcepark,dc=de" write by * read overlay syncprov syncprov-checkpoint 1000 60 database monitor database config rootpw testing database ldap hidden on suffix "dc=sourcepark,dc=de" rootdn "cn=slapd-ldap" uri ldap://localhost:9010/ lastmod on restrict all acl-bind bindmethod=simple binddn="cn=replicator,dc=sourcepark,dc=de" credentials=test syncrepl rid=001 provider=ldap://localhost:9009/ binddn="cn=replicator,dc=sourcepark,dc=de" bindmethod=simple credentials=test searchbase="dc=pamuser,dc=sourcepark,dc=de" scope=sub type=refreshAndPersist retry="5 5 300 5" overlay syncprov #################### My consumer conf: moduleload syncprov allow bind_v2 allow bind_anon_dn include /home/sebastian/ldap-slave/schema/core.schema include /home/sebastian/ldap-slave/schema/cosine.schema include /home/sebastian/ldap-slave/schema/nis.schema include /home/sebastian/ldap-slave/schema/inetorgperson.schema include /home/sebastian/ldap-slave/schema/evolutionperson.schema include /home/sebastian/ldap-slave/schema/automount.schema include /home/sebastian/ldap-slave/schema/openldap.schema include /home/sebastian/ldap-slave/schema/misc.schema include /home/sebastian/ldap-slave/schema/gum.schema include /home/sebastian/ldap-slave/schema/samba.schema include /home/sebastian/ldap-slave/schema/sudo.schema pidfile /home/sebastian/ldap-slave/run/slapd.pid loglevel 16384 modulepath /usr/lib/ldap moduleload back_bdb backend bdb database bdb suffix "dc=sourcepark,dc=de" checkpoint 512 30 directory "/home/sebastian/ldap-slave/data" index objectClass eq lastmod on rootdn "cn=test,dc=sourcepark,dc=de" rootpw test access to attrs=userPassword by dn="cn=test,dc=sourcepark,dc=de" write by anonymous auth by self write by * none access to * by dn="cn=replicator,dc=sourcepark,dc=de" write by dn="cn=test,dc=suretecsystems,dc=com" write by * break access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to * by self write by * read limits dn.exact="cn=replicator,dc=sourcepark,dc=de" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited updatedn "cn=replicator,dc=sourcepark,dc=de" updateref ldap://localhost:9009 ###################### Any help would be greatly appreciated. Thanks Sebastian

2 3

ACL and SSF
by Christian Bösch 03 Nov '10

03 Nov '10

Hi, I forced encryption with olcSecurity but some of our applications do not support ldaps etc. Now I disabled globally the security and wanted to do it with ACLs to force all clients with encryption except for the ip addresses from those application servers. For this I thought it would work to add the first ACL line like this: {0}to * by ssf=256 auth by peername.ip=172.16.122.210 auth {1}.... {2}... .... But this doesn't seem to work.... Can somebody tell me if there is an error in reasoning or how to solve this approach? /thx,chris

1 0

Re: unable to perform authenticated binds
by Tim Dunphy 02 Nov '10

02 Nov '10

thanks for the input guys.. I have to admit at this point, setting this up under FreeBSD was a breeze compared to what is going on now. I have made 3 attempts at this today.. twice on CentOS 5.4 and once on Ubuntu 10 Server. Given the differences in platform with identical outcomes I am thinking that it _has_ to be something with my slapd.conf file. I am still getting error 49s even if I use the actual word secret as the pass. Nov 2 19:02:00 ldap2 slapd[15768]: conn=0 fd=11 ACCEPT from IP=127.0.0.1:44448 (IP=0.0.0.0:389) Nov 2 19:02:00 ldap2 slapd[15768]: conn=0 op=0 BIND dn="cn=Manager,dc=acadaca,dc=net" method=128 Nov 2 19:02:00 ldap2 slapd[15768]: conn=0 op=0 RESULT tag=97 err=49 text= Nov 2 19:02:00 ldap2 slapd[15768]: conn=0 fd=11 closed (connection lost) And this is how my ldap.conf is setup BASE dc=acadaca,dc=net HOST localhost I would appreciate it greatly if someone could please give it a look. Thank you On Tue, Nov 2, 2010 at 6:35 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, November 02, 2010 11:07 PM +0100 Benjamin Griese > <der.darude(a)gmail.com> wrote: > >> Hello Tim, >> >> the "password" you supply won't work, as it is not encoded in base64. >> >> Try to generate a password hash + base64-enc with "slappasswd" and set >> this string as your password hash for rootpw. >> http://linux.die.net/man/8/slappasswd > > Benjamin, > > There is no requirement that the password value for the rootpw entry in > slapd.conf be SSHA hashed or Base 64 encoded. > > I.e., > > rootpw secret > > is perfectly valid. > > Also, an LDIF file with > > userPassword: secret > > is also perfectly valid, as either slapadd or slapd (via ldapadd) will take > care of encoding it to Base64. > > --Quanah > > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Here's my RSA Public key: gpg --keyserver pgp.mit.edu --recv-keys 5A4873A9 Share and enjoy!!

1 0

system schema changes
by Engel, Jay A 02 Nov '10

02 Nov '10

I want to change an attribute type in system schema (e.g., CN / Equality = caseExactMatch). Is this possible? Does it require source code modification? Jay

2 1

Issue with OpenLDAP shared libraries complie on AIX 6.1 using IBM xL Compiler
by Peter Lambrechtsen 02 Nov '10

02 Nov '10

Hello I'm having an issue when using the IBM xL Compiler (not GNU GCC or any other part of the GNU stack) and the configure script fails to detect that ld can link shared libaries. The configure I am using is: ./configure --prefix=/opt/openldap --disable-slapd --disable-man --disable-client --enable-shared --with-tls --with-cyrus-sasl A snipit from the below configure show's that the configure script fails to detect that ld can compile shared libraries. checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking the maximum length of command line arguments... 131072 checking command to parse /usr/ccs/bin/nm -B output from cc_r -qlanglvl=extc89 object... ok checking for objdir... .libs checking for ranlib... ranlib checking for strip... strip checking if cc_r -qlanglvl=extc89 static flag works... yes checking for cc_r -qlanglvl=extc89 option to produce PIC... checking if cc_r -qlanglvl=extc89 supports -c -o file.o... yes checking whether the cc_r -qlanglvl=extc89 linker (/usr/ccs/bin/ld) supports shared libraries... no checking dynamic linker characteristics... no checking how to hardcode library paths into programs... unsupported checking whether stripping libraries is possible... no checking for shl_load... no checking for shl_load in -ldld... no checking for dlopen... yes checking whether a program can dlopen itself... no checking if libtool supports shared libraries... no checking whether to build shared libraries... no checking whether to build static libraries... yes configure: creating libtool checking how to run the C preprocessor... cc_r -qlanglvl=extc89 -E checking whether we are using MS Visual C++... no checking for be_app in -lbe... no checking whether we are using the GNU C compiler... (cached) no Any idea why this is happening??? checking whether the cc_r -qlanglvl=extc89 linker (/usr/ccs/bin/ld) supports shared libraries... no Or assistance on how I could modify the configure script to work. Cheers Peter

2 1

OpenLDAP works slower on a server with LDAP-based authentication
by Konstantin Boyandin 02 Nov '10

02 Nov '10

Hello, I have two servers used in Samba domain setup. Both computers are running CentOS 5.5 x86_64, all updates installed, both are using the openldap-servers-2.3.43-12 and other requried packaged of the same version (2.3.43-12). All the required ports are open. Master OpenLDAP server uses LDAP authentication, slave doesn't (Un*x authentcation). Slave syncs with the master (syncrepl) every several minutes. All the config files of both are the same, including DB_CONFIG. All recommended records are indexed. The only difference is the replciation section in /etc/opeldap/slapd.conf on slave. When I run ldapsearch against slave (Un*x authentication), it responds almost immediately. When I run ldapsearch against master (LDAP authentication), it takes 2 to 10 seconds to receive data. I would appreciate any hint on where to look for the reason of slow response on master server. Thank you! Sincerely, Konstantin

2 1

Re: tag=97 error in openLDAP
by Tim Dunphy 01 Nov '10

01 Nov '10

Thank you very much for your clarifying message. I have found it very helpful, but the problem actually turned out not to be the password, but the problem actually turned out to be the loginShell. 44 uid=bluethundr,ou=summitnjops,ou=staff,dc=summitnjhome,dc=com uid: bluethundr cn: Timothy P. ThatGuy givenName: Timothy P. sn: ThatGuy mail: bluethundr(a)example.com mailRoutingAddress: bluethundr(a)mail.example.com mailHost: mail.summitnjhome.com objectClass: inetLocalMailRecipient objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top userPassword: {CRYPT}secret uidNumber: 1001 gidNumber: 1002 homeDirectory: /home/bluethundr gecos: Timothy P. ThatGuy loginShell: /usr/local/bin/bash The LDAP server is FreeBSD but the clients are CentOS. The problem turned out to be that the PADL migration script that had generated the user ldif from /etc/passwd and produced the loginShell attribute with a BSD path to bash (i.e. /usr/local/bin/bash), when the clients which are all CentOS needed the red hat path to bash (i.e. /bin/bash). I have also added an index for uid to by slap.conf as per your suggestion. Best regards and thank you again for your assistance! On Sun, Oct 31, 2010 at 8:26 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Saturday, October 30, 2010 8:51 AM -0400 Tim Dunphy > <bluethundr(a)gmail.com> wrote: > >> Oct 29 22:49:41 LBSD2 slapd[1085]: <= bdb_equality_candidates: (uid) not >> indexed Oct 29 22:49:41 LBSD2 slapd[1085]: conn=1001 op=7 SEARCH RESULT >> tag=101 err=0 nentries=1 text= >> Oct 29 22:49:41 LBSD2 slapd[1085]: conn=1002 op=4 BIND >> dn="uid=bluethundr,ou=summitnjops,ou=staff,dc=summitnjhome,dc=com" >> method=128 >> Oct 29 22:49:41 LBSD2 slapd[1085]: conn=1002 op=4 RESULT tag=97 err=49 >> text= >> tag=97 > > Tag's are not error messages, they are information purpose. > > Error messages are prefixed with "err=", in this case, your log clearly > shows the wrong password was used, or the binddn is wrong, or both. > > Thus the LDAP server returns "ERROR 49" very clearly in your log for > connection 1002. > > You likely should also create an equality index on uid, since apparently > your dns are uid based. > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Here's my RSA Public key: gpg --keyserver pgp.mit.edu --recv-keys 5A4873A9 Share and enjoy!!

1 0

ACL filter not working
by Darren Hildebrand 01 Nov '10

01 Nov '10

I'm having a problem with access control lists in slapd.conf. The filter doesn't seem to be working in OpenLDPA 2.4.23 using syntax that worked in 2.3.43. I've simplified my tests down to a single ACL rule just to see if it's working, and this is what I'm finding: I'm trying this ACL: access to dn.subtree="ou=users,dc=companyname,dc=com" filter="(objectClass=person)" by * read I tried an anonymous search using this command: ldapsearch -h 1.2.3.4 -x -b ou=users,dc=companyname,dc=com And it returned the following: # search result search: 2 result: 32 No such object I tried the same with the same ACL as above with the filter set to "(uid=*)", and got the same problem (note that all users have a uid value set). However, I tried with the filter set to "(objectClass=*), and it returned all users as I would expect. Has anything changed with ACL syntax between OpenLDAP 2.3 and 2.4? Or do you see any problems with the syntax of my ACL line above? Thanks. Darren

2 2

memberOf Overlay
by Bram Cymet 01 Nov '10

01 Nov '10

Hi, I am using the memberOf overlay and it works perfectly on my main ldap server but when I search for memberOf on my slave ldap server I don't see everything I should, however the member attributes all got synchronized properly. Any idea what is going on? Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. Cell: 613-608-9752

1 0

LDAP filter question
by Antonio Batovanja 01 Nov '10

01 Nov '10

Hi, I'm having problems finding documentation for range filters. Can someone explain to me how to use a range filter on shadowExpire? From nis.schema: attributetype ( 1.3.6.1.1.1.1.10 NAME 'shadowExpire' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) so it's an integer value. from my slapd.conf (openldap 2.3.38): index shadowExpire pres,eq I'd like to find entries where either shadowExpire is not present, or shadowExpire is present and greater than or equal to X. # ldapsearch -x '(&(objectclass=shadowaccount)(shadowexpire=*))' dn returns 978 entries. # ldapsearch -x '(&(objectclass=shadowaccount)(!(shadowexpire=*)))' dn returns 311 entries. But: # ldapsearch -x '(&(objectclass=shadowaccount)(shadowexpire>1000))' dn gives me ldap_search_ext: Bad search filter (-7) and # ldapsearch -x '(&(objectclass=shadowaccount)(shadowexpire>=1000))' dn returns no results. At least one entry has shadowExpire > 1000: # ldapsearch -x -LLL uid=toni objectclass shadowexpire dn: cn=Batovanja Antonio,ou=People,ou=EDV Zentrale,dc=humanomed,dc=at objectClass: person objectClass: posixAccount objectClass: shadowAccount objectClass: hmUserExtention objectClass: organizationalPerson shadowExpire: 20000 My final filter should be (|(shadowExpire=0)(shadowExpire>=14910)(!(shadowExpire=*))) but that's not working What am I doing wrong? Cheers, Toni

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical November 2010