openldap-technical June 2010

openldap-technical@openldap.org

104 participants
113 discussions

Help with a referral
by Jason Voorhees 06 Jun '10

06 Jun '10

Hi: I'm trying to migrate an old LDAP server (that holds an ldap tree for Open-Xchange) to a new installation of OpenLDAP 2.3.43. A lot of users had configured their Outlook in a way that they make a base search for ou=Users,ou=OxObjects,dc=domain,dc=com in their LDAP address book. But my new LDAP tree won't have ou=OxObjects,dc=domain,dc=com entry, i'm creating a new ldap structure to be used with GOSA. So I decide to create a referral like this: dn: ou=Users,ou=OxObjects,dc=domain,dc=com ou: Users objectclass: referral objectclass: extensibleObject ref: ldap://HOSTNAME/ou=people,dc=domain,dc=com This works fine, now Outlook users can find their contacts using the same base search (ou=Users,ou=OxObjects,dc=domain,dc=com) but now GOSA got in problems because it finds two administrator users (cn=System administrator,ou=people,dc=domain,dc=com) because of the referral. I just would like to GOSA doesn't follow referrals or just searches for users under ou=people,dc=domain,dc=com instead of the root dc=domain,dc=com, but it seem that GOSA isn't good enough to customize this yet. So I think I could modify my referral to return not all attributes, just some of them (the attributes commonly used by an address book search) like this: dn: ou=Users,ou=OxObjects,dc=domain,dc=com ou: Users objectclass: referral objectclass: extensibleObject ref: ldap://HOSTNAME/ou=people,dc=domain,dc=com?cn,sn,givenName,telephoneNumber,mail After updating my referral and I make an ldapsearch: # ldapsearch -xLLL "(uid=admin)" I still get two entries (two administrators) and both of them returns all its attributes. Then I tried to modify my referral like this: dn: ou=Users,ou=OxObjects,dc=domain,dc=com ou: Users objectclass: referral objectclass: extensibleObject ref: ldap://HOSTNAME/ou=people,dc=domain,dc=com??sub?(!(uid=admin)) And still get two entries (two administrators). So I suspect that my referral URI isn't working. Am using a wrong referral? Or maybe OpenLDAP always returns all entries ignoring attributes and filters in a URI referral (ldap://HOSTNAME/ou=people,dc=domain,dc=com?cn,sn,givenName,telephoneNumber,mail)? I hope some one can help me because i'm stuck with this since two days ago. I just want to limit the entries returned by my referral. Thanks

4 8

ldap_sync* how to
by egemenozden＠gmail.com 06 Jun '10

06 Jun '10

hi, I needed to write a daemon which can react to changes on openldap server. It has to be an event driven application hence polling is ruled out. After some research, the most proper way seems to be through ldap sync however I could not find any documentation other than the man page of ldap_sync* which does not provide any example. Does any body know of an introductory document or another way to achieve my purpose? In the worst case I will dive into slapd's implementation to have a feeling or simply use the logs as an event channel. Thanks

3 2

input error=-2
by Joe Friedeggs 04 Jun '10

04 Jun '10

I just recently noticed 'input error=-2' when running in debug mode, and in my logs (loglevel sync shell stats ber conns). It seems to occur (always) when the connection it closed. Anyone know what might cause this? Is it anything I should be concerned with? I am not sure when this started. I have made numerous changes over the past few weeks; too many to back out. Thanks, Joe >From DEBUG:: ber_get_next on fd 25 failed errno=0 (Success) connection_read(25): input error=-2 id=20, closing. connection_closing: readying conn=20 sd=25 for close connection_close: conn=20 sd=25 =>ldap_back_conn_destroy: fetching conn 20 daemon: removing 25 Similarly in log: Jun 4 15:39:31 ldapserver slapd[7683]: daemon: read active on 16 Jun 4 15:39:31 ldapserver slapd[7683]: conn=150 op=2 UNBIND Jun 4 15:39:31 ldapserver slapd[7683]: connection_read(16): input error=-2 id=150, closing. Jun 4 15:39:31 ldapserver slapd[7683]: daemon: removing 16 Jun 4 15:39:31 ldapserver slapd[7683]: conn=150 fd=16 closed Jun 4 15:39:31 ldapserver slapd[7683]: daemon: epoll: listen=7 active_threads=0 tvp=zero Jun 4 15:39:31 ldapserver slapd[7683]: daemon: epoll: listen=8 active_threads=0 tvp=zero Jun 4 15:39:31 ldapserver slapd[7683]: daemon: activity on 1 descriptor Jun 4 15:39:31 ldapserver slapd[7683]: daemon: activity on: _________________________________________________________________ Hotmail has tools for the New Busy. Search, chat and e-mail from your inbox. http://www.windowslive.com/campaign/thenewbusy?ocid=PID28326::T:WLMTAGL:ON:…

1 0

ldap search bug
by Jeremiah Martell 03 Jun '10

03 Jun '10

Just pinging the mailing list again. I'm hoping someone has some advice or guidance on this. Thanks, - Jeremiah ---------- Forwarded message ---------- From: Jeremiah Martell <inlovewithgod(a)gmail.com> Date: Thu, May 27, 2010 at 3:42 PM Subject: ldap search hangs forever To: openldap-technical(a)openldap.org I'm using openldap-2.4.18 as a client to bind and asynchronously search an active directory server. I have a domain, example.com, that has two domain controllers: one.example.com, and two.example.com. The ip of one.example.com is 12.34.56.1 The ip of two.example.com is 12.34.56.2 The reverse mapping of 12.34.56.1 is one.example.com The reverse mapping of 12.34.56.2 doesn't exist ----- / nslookup one.example.com Server: 12.34.56.99 Address 1: 12.34.56.99 dns1.example.com Name: one.example.com Address 1: 12.34.56.1 one.example.com / nslookup two.example.com Server: 12.34.56.99 Address 1: 12.34.56.99 dns1.example.com Name: two.example.com Address 1: 12.34.56.2 / nslookup example.com Server: 12.34.56.99 Address 1: 12.34.56.99 dns1.example.com Name: example.com Address 1: 12.34.56.2 Address 2: 12.34.56.1 one.example.com / nslookup 12.34.56.2 Server: 12.34.56.99 Address 1: 12.34.56.99 dns1.example.com Name: 12.34.56.2 Address 1: 12.34.56.2 / nslookup 12.34.56.1 Server: 12.34.56.99 Address 1: 12.34.56.99 dns1.example.com Name: 12.34.56.1 Address 1: 12.34.56.1 one.example.com / ----- I have given openldap a "rebind proc" to use when chasing the referrals. I do a sasl gssapi bind to one.example.com, which succeeds. I do a search, which returns three referrals: DomainDnsZones.example.com ForestDnsZones.example.com example.com openldap looks up these three names and gets 12.34.56.2, which doesn't reverse map to anything. Then I get error messages for each referral: May 27 16:26:18 xyz: GSSAPI Error: Miscellaneous failure (see text) (Server (krbtgt/23.56.2(a)EXAMPLE.COM) unknown) May 27 16:26:18 xyz: GSSAPI Error: Miscellaneous failure (see text) (Server (krbtgt/23.56.2(a)EXAMPLE.COM) unknown) May 27 16:26:18 xyz: GSSAPI Error: Miscellaneous failure (see text) (Server (krbtgt/23.56.2(a)EXAMPLE.COM) unknown) Then openldap hangs forever; I never get a LDAP_RES_SEARCH_RESULT. ----- If I modify my DNS server to return 12.34.56.1 first instead of 12.34.56.2, then everything works perfectly. If I don't chase referrals, then everything works perfectly minus chasing referrals of course. If I use "normal" binding instead of sasl gssapi, then everything works perfectly. If I use openldap's syncronous search instead of asyncronously polling with ldap_result, then the call times out and returns. I half-expected openldap to not be able to bind to the referrals, but still fail quickly and return. I don't understand why the ldap search never finishes. (I never get a LDAP_RES_SEARCH_RESULT) I did get a LDAP_RES_SEARCH_REFERENCE and a LDAP_NO_RESULTS_RETURNED, but those dont signify the search has finished, right? I've attached the ldap debugging. You'll see at the end the repeated calls to ldap_result with timeouts of 10 seconds. I don't know how to read them exactly, but the status seems to be "RequestCompleted" ? ----- 17:20:50.530 ldap_result ld 0x10097060 msgid 5 17:20:50.530 wait4msg ld 0x10097060 msgid 5 (timeout 10000000 usec) 17:20:50.530 wait4msg continue ld 0x10097060 msgid 5 all 2 17:20:50.530 ** ld 0x10097060 Connections: 17:20:50.530 * host: one.example.com port: 389 (default) 17:20:50.530 refcnt: 1 status: Connected 17:20:50.530 last used: Wed May 26 17:19:59 2010 17:20:50.530 17:20:50.530 ** ld 0x10097060 Outstanding Requests: 17:20:50.530 * msgid 5, origid 5, status RequestCompleted 17:20:50.530 outstanding referrals 0, parent count 0 17:20:50.530 ld 0x10097060 request count 1 (abandoned 0) 17:20:50.530 ** ld 0x10097060 Response Queue: 17:20:50.530 Empty 17:20:50.530 ld 0x10097060 response count 0 17:20:50.530 ldap_chkResponseList ld 0x10097060 msgid 5 all 2 17:20:50.530 ldap_chkResponseList returns ld 0x10097060 NULL 17:20:50.530 ldap_int_select ----- I got the latest 2.4.22 release and grabbed the majority of the changes, but the hang remains. You can see the full debugging information in the attached txt file. I'm asking if the forever hang could be a bug in openldap, or perhaps I'm doing something wrong? Thanks, - Jeremiah

1 0

OpenLDAP with MySQL Cluster - No free node Error
by Priyesh Potdar 03 Jun '10

03 Jun '10

Hi All, I am new to use of ndb with openLDAP. I have established a MySQL Cluster in my network and also compiled the openLDAP with --enable-ndb option. Now when I start the openLDAP with command "slapd -d 5" (To see the debug output), I get the following error: Configuration error: Error : Could not alloc node id at 192.168.7.40 port 1186: No free node id found for mysqld(API). My slapd.conf contains : ####################################################################### database ndb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret dbconnect 192.168.7.40 ## dbhost - mysql host, where you mysql server resides, used to create schemas dbhost 192.168.7.40 ## dbname - mysql database dbname testing ## dbuser - mysql user name dbuser root ## dbpass - mysql user password (empty in this case) dbpass "" ## dbconnections - how many connections slapd should make to Cluster ## (like ndb-cluster-connection-pool) dbconnections 1 # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain #index objectClass eq Output from the ndbd_mgm show command is as follows: -- NDB Cluster -- Management Client -- ndb_mgm> show Connected to Management Server at: 192.168.7.40:1186 Cluster Configuration --------------------- [ndbd(NDB)] 3 node(s) id=2 @192.168.7.30 (mysql-5.1.44 ndb-7.1.3, Nodegroup: 0, Master) id=3 @192.168.7.56 (mysql-5.1.44 ndb-7.1.3, Nodegroup: 1) id=4 (not connected, accepting connect from 192.168.7.40) [ndb_mgmd(MGM)] 1 node(s) id=1 @192.168.7.40 (mysql-5.1.44 ndb-7.1.3) [mysqld(API)] 8 node(s) id=5 @192.168.7.30 (mysql-5.1.44 ndb-7.1.3) id=6 (not connected, accepting connect from any host) id=7 (not connected, accepting connect from any host) id=8 (not connected, accepting connect from any host) id=9 (not connected, accepting connect from any host) id=10 (not connected, accepting connect from any host) id=11 (not connected, accepting connect from any host) id=12 (not connected, accepting connect from any host) and Config.ini file contains the following data: [NDBD DEFAULT] NoOfReplicas=1 [MYSQLD DEFAULT] [NDB_MGMD DEFAULT] [TCP DEFAULT] # Managment Server [NDB_MGMD] HostName=192.168.7.40 # Storage Engines [NDBD] HostName=192.168.7.30 [NDBD] HostName=192.168.7.56 [NDBD] HostName=192.168.7.40 [MYSQLD] [MYSQLD] [MYSQLD] [MYSQLD] [API] [API] [API] [API] Any help on the same is appreciated. Thanks, Priyesh Potdar

1 0

Syncrepl - ldap_bind: Invalid credentials error
by Gocher, Mark 03 Jun '10

03 Jun '10

I'm receiving the following error on my consumer, using logging -d stats + args + trace + sync 2> /var/log/ldap @(#) $OpenLDAP: slapd 2.4.22 (May 21 2010 12:10:42) $ @cambridge:/usr/local/openldap-2.4.22/servers/slapd slapd starting slap_client_connect: URI=ldap://oxford.unix1.city.ac.uk:389 DN="cn=replicator,dc=city,dc=ac,dc=uk" ldap_sasl_bind_s failed (49) I can see from the documentation that my consumer is not authenticating to my provider, but I can't see what the error is. If any other info would help please let me know. I have created the uid for replicator and repeated this search with the 'access to attrs=userPassword' line commented out on the provider to ensure that the userPassword for replicator is clear text 'secret'. I can also perform this search from the consumer successfully. ldapsearch -x -b dc=city,dc=ac,dc=uk uid=replicator version: 1 dn: uid=replicator,ou=users,dc=city,dc=ac,dc=uk objectClass: person objectClass: posixAccount objectClass: inetOrgPerson sn: replicator cn: replicator uid: replicator uidNumber: 22258 gidNumber: 22258 homeDirectory: /export/home/replicator userPassword: secret displayName: replicator mail: None labeledURI: None description: openLDAP replication id Consumer ldap.conf: database bdb suffix "dc=city,dc=ac,dc=uk" rootdn "cn=DSAmgr,dc=city,dc=ac,dc=uk" rootpw {CRYPT}******* directory /var/opt/csw/openldap-data index default pres,eq,sub index objectClass eq index cn index sn index uid access to attrs=userPassword by anonymous auth by * none access to * by * read index entryUUID eq syncrepl rid=0 provider=ldap://oxford.unix1.city.ac.uk:389 bindmethod=simple binddn="cn=replicator,dc=city,dc=ac,dc=uk" credentials=secret searchbase="dc=city,dc=ac,dc=uk" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog updateref ldap://oxford.unix1.city.ac.uk database monitor Provider ldap.conf: database bdb suffix "dc=city,dc=ac,dc=uk" rootdn "cn=DSAmgr,dc=city,dc=ac,dc=uk" rootpw {CRYPT}aZmvWMwFgg.vk directory /var/opt/csw/openldap-data index default pres,eq,sub index objectClass eq index cn index sn index uid access to * by dn.base="cn=replicator,dc=city,dc=ac,dc=uk" read by * break access to attrs=userPassword by anonymous auth by * none access to * by * read modulepath /usr/local/openldap-2.4.22 moduleload back_bdb.la moduleload accesslog.la moduleload syncprov.la database bdb suffix cn=accesslog directory /var/opt/csw/accesslog rootdn cn=accesslog index default eq index objectClass,reqEnd,reqResult,reqStart overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE limits dn.exact="cn=replicator,dc=city,dc=ac,dc=uk" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited # database bdb # suffix "dc=dc=city,dc=ac,dc=uk" # rootdn "cn=DSAmgr,dc=city,dc=ac,dc=uk" index entryCSN eq index entryUUID eq overlay syncprov syncprov-checkpoint 1000 60 overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logpurge 99+00:00 00+00:01 # Let the replica DN have limitless searches limits dn.exact="cn=replicator,dc=city,dc=ac,dc=uk" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited database monitor

2 9

syncrepl & history store
by Oliver Henriot 02 Jun '10

02 Jun '10

Dear OpenLDAP list users, I'm having syncrepl oddities. One of my consumer servers has an entry which is absent on the provider. I thought syncrepl would delete it during "present phase" mentioned in the admin guide but it's been sitting there for days and hasn't been removed. There is only one consumer on which this superfluous entry is present. I'm logging sync level on provider and consumers since I identified the problem and nothing odd appears. I unfortunately did not log sync level at the time the problem appeared so maybe I missed any useful info. The only thing I got in the logs when the problem occured was "deferring operation: too many executing" but I also sometimes get the same error in the logs and nothing bad happens to the data. I'm reading through the guide trying to understand what's going on and in the syncrepl section (http://www.openldap.org/doc/admin23/syncrepl.html ; yes I'm reading the version 2.3 documentation because I'm using the CentOS 5.5 packaged version : 2.3.43-12.el5) I've come across references to a history store maintained on the provider which is useful for the delete phase used in refreshAndPersist, which is what I am using. I thought this might be a plausible clue for my problem. However, nowhere else do I find any reference to this history store, how it's configured or how it works. Could the use of RefreshAndPersist explain the superflous entry present on one consumer and should(could) I configure a history store to solve this issue? Or should I switch to RefreshOnly to prevent this kind of problem from occuring again in the future? It's the first time I've come across it but when my directories will really be used they will be absolutely critical and I'd rather not have this kind of problem again if possible. Thanks for your help. Best regards, Oliver

2 1

multiple instances
by mj romero 02 Jun '10

02 Jun '10

Hello, I installed a server (RHEL5 x86_64) with three instances of OpenLDAP 2.3.43. ldap 6572 1 0 May24 ? 00:49:12 /usr/sbin/slapd -u ldap -g ldap -h ldap://X.Y.Z.104:389 -f /etc/openldap/slapd.conf -l LOCAL4ldap 6612 1 0 May24 ? 00:49:09 /usr/sbin/slapd -u ldap -g ldap -h ldap://X.Y.Z.106:389 -f /etc/openldap/slapd_i3.conf -l LOCAL6ldap 8031 1 0 01:01 ? 00:01:26 /usr/sbin/slapd -u ldap -g ldap -h ldap://X.Y.Z.105:389 -f /etc/openldap/slapd_i2.conf -l LOCAL5 At first everything worked perfect but after several days working properly one instance stopped.I started the instance again but after several days one instance stopped (not the same).I don't understand what happens. Any help is very useful to me. Thank you very much. _________________________________________________________________ Consejos para seducir ¿Puedes conocer gente nueva a través de Internet? ¡Regístrate ya! http://contactos.es.msn.com/?mtcmk=015352

2 2

TLS certs needed for Provider and consumer
by Sotomayor, Vicente (ITD) 01 Jun '10

01 Jun '10

Hello Everyone: Does anyone a have a link the shows what steps are needed to for creating certs for a Provider and Consumer? I've been able to do it for Provider, but I'm stuck on what to do for the consumer. Thanks

2 1

replication issue
by Lennart Job 01 Jun '10

01 Jun '10

Hi there, I've got some problems with ldap replication. Ever since I've updated the master from Debian Etch to Lenny changes are no longer synced. I've got v2.4.11 running on both servers. The slave is still running Etch. SSL is active, so maybe there's a problem with the certificates... However, if I restart the slave slapd he does replicate properly. Do you know any reasons for this behavior? In addition, synchronization with samba on the master doesn't work properly anymore. I can create accounts but password changes don't take effect. So everybody has to use his first ever password to connect to samba... Thanks for your help! Kind regards, Lennart -- Lennart Job Ressort IT / Wissensmanagement fuks e.V. Waldhornstraße 27 76131 Karlsruhe Büro +49 721 38 42 313 Fax +49 721 37 98 24 Privat +49 721 20 46 845 Mobil +49 173 78 87 643 E-Mail lennart.job(a)fuks.org Web www.fuks.org fuks e.V. - Vorsitz: André Fuchs - VR: 791 (Amtsgericht Karlsruhe)

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical June 2010