openldap-technical December 2010

openldap-technical@openldap.org

82 participants
96 discussions

Using dynlist overlay like dynlist and dyngroup (extend dyngroup schema?)
by c0re 15 Dec '10

15 Dec '10

Hello openldap users! slapd.conf: overlay dynlist dynlist-attrset groupOfUrls labeledURI member ldif: dn: cn=testgroup,ou=servers,dc=domain,dc=local objectclass: groupOfNames cn: testgroup member: cn=test,ou=users,dc=domain,dc=local dn: cn=maingroup,ou=servers,dc=domain,dc=local objectclass: groupOfNames cn: maingroup member: cn=testgroup,ou=servers,dc=domain,dc=local dn: cn=testgroup,ou=servers,dc=domain,dc=local objectClass: top objectClass: labeledURIObject objectClass: groupOfURLs cn: testgroup labeledURI: ldap:///ou=users,dc=domain,dc=local??one?(objectClass=inetOrgPerson) dn: cn=maingroup,ou=serversGroups,dc=domain,dc=local objectClass: top objectClass: labeledURIObject objectClass: groupOfURLs cn: maingroup labeledURI: ldap:///ou=servers,dc=domain,dc=local?member?one?(objectClass=groupOfUrls) With this configuration when ldapsearching for contents of "cn=testgroup,ou=servers,dc=domain,dc=local" I got "member: cn=testgroup,ou=servers,dc=domain,dc=local". Cool! It's working. Then I want to have dynlist that contains members of group of dyngroups. And here I stuck. In slapd.conf I can say that some objectClass can be dyngroup or dynlist, but not together. That's right. Then I though that I can extend dyngroup.schema and add groupOfUrls2, then add "dynlist-attrset groupOfUrls2 labeledURI" to slapd.conf and groupOfUrls2 will behave like dynlist, and groupOfUrls will still be dyngroup. That's would be very good for me! I looked in dyngroup.schema and copy groupOfUrls definition to groupOfUrls2. objectClass ( NetscapeLDAPobjectClass:33 NAME 'groupOfURLs2' SUP top STRUCTURAL MUST cn MAY ( memberURL $ businessCategory $ description $ o $ ou $ owner $ seeAlso ) ) But there was error: /usr/local/etc/openldap/schema/dyngroup.schema: line 89 objectClass: Inconsistent duplicate objectClass: "2.16.840.1.113730.3.2.33" /usr/local/etc/openldap/slapd.conf: line 11: <include> handler exited with 1! slapd destroy: freeing system resources. slapd stopped. So... I changed 33 to 34 in chema. Error gone, slapd started. I added to ldap: dn: cn=maingroup2,ou=serversGroups,dc=domain,dc=local objectClass: top objectClass: labeledURIObject objectClass: groupOfURLs2 cn: maingroup labeledURI: ldap:///ou=servers,dc=domain,dc=local?member?one?(objectClass=groupOfUrls) and my slapd.conf not looking like this: overlay dynlist dynlist-attrset groupOfUrls labeledURI member dynlist-attrset groupOfUrls2 labeledURI So groupOfUrls must be dyngroup, and groupOfUrls2 must be dynlist. And now when I ldapsearch for member attr in maingroup2 I wanted to get all members of groups that are under ou=servers,dc=domain,dc=local, but I got no members... Logic was - testgroup (and others groupOfURLs) work as dyngroup and generate member attr in it depending on specified labeledURI. Then maingroup2 (and others) will ldapsearch in ou=servers and make member: attr depending on member attr of groups in ou=servers (and some filters, that I will use later). But maingroup2 not working... It not generate member: attr in it. I think I was wrong changing 33 to 34, because I need some more thing to do, but I do not know what I should do. Can anoyone suggest what to do?

1 0

ldap personal addressbook
by Umarzuki Mochlis 14 Dec '10

14 Dec '10

i already setup squirrelmail and roundcubemail to read ldap global addressbook on RHEL 5 but how can i make both be able to: 1. store personal addressbook in openldap 2. import addressbooks from squirrelmail database into openldap so both webmail can view the same addressbook any hints and links are welcomed. -- Regards, Umarzuki Mochlis http://debmal.my

1 0

Re: backend issue
by Friedrich Locke 14 Dec '10

14 Dec '10

Hi, Here are the location of some files related to db-4.6.21 installed in my box. sioux@lion$ pkg_info -L db-4.6.21 | grep include /usr/local/include/db4/db.h /usr/local/include/db4/db_185.h /usr/local/include/db4/db_cxx.h sioux@lion$ pkg_info -L db-4.6.21 | grep lib /usr/local/lib/db4/libdb.a /usr/local/lib/db4/libdb.la /usr/local/lib/db4/libdb_cxx.a /usr/local/lib/db4/libdb_cxx.la /usr/local/share/doc/db4/ref/build_unix/shlib.html /usr/local/share/doc/db4/ref/refs/libtp_usenix.ps /usr/local/lib/db4/libdb.so.5.0 /usr/local/lib/db4/libdb_cxx.so.6.0 /usr/local/lib/libdb.so.5.0 /usr/local/lib/libdb_cxx.so.6.0 sioux@lion$ I setted CPPFLAGS as the following (and it worked when i ran ./configure): sioux@lion$ export CPPFLAGS="-I/usr/local/include/db4" But for LDFLAGS, how should i set it? On Tue, Dec 14, 2010 at 4:25 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, December 14, 2010 5:51 AM -0200 Friedrich Locke > <friedrich.locke(a)gmail.com> wrote: > >> Ok! >> >> I looked at /usr/include/db.h. How could i solve this problem ? > > Set the appropriate variables, specifically: > CPPFLAGS > and > LDFLAGS > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

backend issue
by Friedrich Locke 14 Dec '10

14 Dec '10

Hi folks, i run openbsd as my OS of choice and would like to install openldap and BDB. i am forced to use openldap 2.3.43 with Berkeley DB v3. Is there anything i should be aware about this combination? Has anyone in this list faced the same scenario ? What is your experience? best regards, Fried.

3 6

rwm overlay missing
by Josh Spranger 14 Dec '10

14 Dec '10

I have OpenLDAP 2.4.23 on OpenSUSE 11. When I compiled the binaries I used the flags -enable-ldap and -enable-rewrite so I could use it as a Proxy to AD. I also want to use the rwm overlay to remap the AD attributes. My problem is when I configure 'overlay rwm' and use slaptest it returns with "overlay 'rwm' not found" and I do not have any rwm.la files anywhere to load in the 'moduleload' section. I presume I am missing a configure flag, but for this version which one? Thanks!

2 1

OpenLDAP and third party authentication integration
by Any Joe 14 Dec '10

14 Dec '10

Dear LDAP tech gurus, Newbie here.. I need some pointers on how to integrate a third party web-based auth system and OpenLDAP. Our reqs are as follows 1. We dont store passwords (or hashes) in LDAP and they are dont-care for us; for backward compatibility we may still have some admin/admin-password credentials on LDAP). In other words, reg-users are not authenticated against LDAP, but we use LDAP for directories and corp-info repository purposes. 2. Third party app will authenticate and may access user info in LDAP depending on the applications 3. Users will be created, deleted and modified on LDAP directories, but again passwords are dont-cares What is the best way to achieve this? Any lit/pointers highly appreciated. Many thanks in anticipation -JM

2 1

how to analysis openldap log
by owen nirvana 14 Dec '10

14 Dec '10

I could not find apis for analysising log. Thanks for help! gtalk:freeespeech@gmail.com <gtalk%3Afreeespeech(a)gmail.com>

2 1

Openldap occasional hunging
by Nick Milas 14 Dec '10

14 Dec '10

Hi, I am experiencing the following problem: Occasionally but consistently (about once a month), one of my ldap servers will hung - usually after some entry update. I find out the hung due to problems with the services which are dependent on ldap (mail, dns, see below). The question is: Why does this happen, and how can I avoid it? All servers are production systems, and need maximum reliability. When the problem occurs, I need to stop ldap service. If I try to start it again, I get: Checking configuration files for slapd: bdb_db_open: unclean shutdown detected; attempting recovery. bdb_db_open: Recovery skipped in read-only mode. Run manual recovery if errors are encountered. Then (as I have found from researching the problem), I must issue (as root): # service ldap stop # slapd_db_recover -v -h /var/lib/ldap ... # slapindex # chown ldap:ldap /var/lib/ldap/* # service ldap start Then, everything works fine again. My setup is: one master (provider) openldap server (where all modifications take place) with 3 slaves (consumers), one of which is used with postfix/dovecot, and the other two with powerdns (ldap backend). Sync is being done with syncrepl, type=refreshAndPersist. Modifications are carried out using phpLDAPadmin (1.0.7), JXplorer, and other custom php scripts. The DIT is small (less than 2000 entries in total) and DIT changes are relatively few (max ~50 modifications per day, sometimes no modifications are made for several days). The hung can occur to anyone of the ldap servers (either master or slave), with the same frequency (about once per month)! One of the servers is affected each time. All servers run CentOS 5.5 with the latest openldap packages available: 2.3.43-12.el5_5.3. BDB: # slapd_db_upgrade -V Sleepycat Software: Berkeley DB 4.4.20: (January 10, 2006) I wonder: Could such a database corruption problem occur in case: 1. An entry is being modified at the same time as it is being read by another process? 2. An entry is being modified "concurrently" by two different connected clients? Could the problem be resolved with upgrading to a more recent openldap/bdb version? Can anyone suggest RPM (RHEL5 or Centos 5) packages to use safely (with TLS, cyrus-sasl, slapi, overlays=mod, plugins, modules) ? Thanks in advance, Nick

1 0

How to rename the BASE DN?
by Anton Chu 14 Dec '10

14 Dec '10

How do I rename my base dn due to my domain name change? I'm using the latest openldap run time configuraiton.

4 4

Duplicate DN records, sometimes..
by Jorgen Lundman 13 Dec '10

13 Dec '10

openldap-2.4.23 db-4.8.30.NC Solaris 10u8 x86 We use LDAP for many things, including DNS. We've had an intermittent issue where doing a ldap subtree (recursive) delete would fail. I dug deeper, and found that it would die with NO SUCH OBJECT. Curiously, it was not lying. Or rather, the LDAP Search to determine the objects to delete would return duplicate for the "@" entry. - Found 9 service entries in subtree DNSZoneName=reger.jorgen.jp,ou=dns: 1 DNSHostName=(a),DNSZoneName=reger.jorgen.jp,ou=dns 2 DNSHostName=(a),DNSZoneName=reger.jorgen.jp,ou=dns etc. What would then happen, is that the #1 deletion would succeed (and delete both entries). After which it would try to delete #2 and receive NO SUCH OBJECT. I created a new (many many new) domains, and did a command-line ldapsearch: /usr/local/bin/ldapsearch -h 172.20.12.113 -b DNSZoneName=fun.jorgen.jp,ou=dns # fun.jorgen.jp, dns, dn: DNSZoneName=fun.jorgen.jp,ou=dns objectClass: DNSZone DNSZoneName: fun.jorgen.jp # @, fun.jorgen.jp, dns dn: DNSHostName=(a),DNSZoneName=fun.jorgen.jp,ou=dns objectClass: DNSHost DNSHostName: @ # @, fun.jorgen.jp, dns dn: DNSHostName=(a),DNSZoneName=fun.jorgen.jp,ou=dns objectClass: DNSHost DNSHostName: @ How curious. I peppered the perl code with the same ldapsearch to try to determine where the duplicate DN was (accidentally?) created. I found that if I had this: ldapdb::CreateSOA($domain,$serial,28800, 7200, 604800, $ttl, "hostmaster.$domain.", "dns01.company.com."); system("/usr/local/bin/ldapsearch -h $ldap_host_dns DNSZoneName=$domain,ou=dns"); ldapdb::AddRecord($domain, "NS", "@", "dns01.company.com."); The duplicate records were no longer created. By simply having an LDAP search between the creation of the tree, the error went away. Does anyone know what is actually going on here? I have also found that I can create a LDAP tree, which has duplicate "@" entries. Then wait ~30mins, and the duplicate entry also, sometimes(?), goes away. But not always. The code for CreateSOA and AddRecord is relatively simple, here I have stripped out the error checking code for simplicity. ---------------------------------------------------------------------- CreateSOA(): $ldap = Net::LDAP->new($ldap_host_dns); $mesg = $ldap->bind($ldap_bind, password=>$ldap_pass); $mesg = $ldap->add("DNSZoneName=$adddomain,$ldap_base_dns", attr => [ 'objectClass' => [ 'DNSZone' ], 'DNSZoneName' => "$adddomain" ] ); $mesg = $ldap->add("DNSHostName=\@,DNSZoneName=$adddomain,$ldap_base_dns", attr => [ 'objectClass' => [ 'DNSHost' ], 'DNSHostName' => "\@" ] ); $mesg = $ldap->add("DNSRecord=SOA,DNSHostName=\@,DNSZoneName=$adddomain,$lda p_base_dns", attr => [ 'objectClass' => [ 'DNSSOARecord' ], 'DNSHostName' => "\@", 'DNSRecord' => "SOA", 'DNSType' => "soa", 'DNSSerial' => "$serial", 'DNSRefresh' => "$refresh", 'DNSRetry' => "$retry", 'DNSExpire' => "$expire", 'DNSMinimum' => "$minttl", 'DNSAdminEmail' => "$hostmaster", 'DNSPrimaryns' => "$nameserver", 'DNSTTL' => "$minttl" ] ); $ldap->unbind; ---------------------------------------------------------------------- And AddRecord: $ldap = Net::LDAP->new($ldap_host_dns); $mesg = $ldap->bind($ldap_bind, password=>$ldap_pass); $mesg = $ldap->add("DNSHostName=$name,DNSZoneName=$domain,$ldap_base_dns", attr => [ 'objectClass' => [ 'DNSHost' ], 'DNSHostName' => "$name" ] ); $ldap->unbind; ---------------------------------------------------------------------- For now, we will have the simple/pointless ldapsearch between CreateSOA and AddRecord to avoid the duplicate "@" DN entry, and in ldap delete-subtree we will ignore NO SUCH OBJECT error so that it keeps going and cleans up the domain properly. Lund -- Jorgen Lundman | <lundman(a)lundman.net> Unix Administrator | +81 (0)3 -5456-2687 ext 1017 (work) Shibuya-ku, Tokyo | +81 (0)90-5578-8500 (cell) Japan | +81 (0)3 -3375-1767 (home)

1 0

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical December 2010