openldap-technical June 2010

openldap-technical@openldap.org

104 participants
113 discussions

How to use BLOB while using Back-NDB
by Priyesh Potdar 14 Jun '10

14 Jun '10

Hi All, I am using back-ndb as a backend for my openldap. I want to know, what is configuration change in slapd.conf I need to make to instruct openldap to always use BLOB and not the VARCHAR. Thanks, Best Regards, Priyesh Potdar

2 1

Re: Tool to covert from LDIF cn=config to slapd.conf?
by Quanah Gibson-Mount 13 Jun '10

13 Jun '10

--On Wednesday, June 09, 2010 12:26 PM -0700 j(a)gropefruit.com wrote: > Actually I don't think this idea solely implies "going backwards in > development", in fact I think this tool is an excellent idea and > shouldn't be immediately balked at by the OpenLDAP team. slapd.conf is deprecated and will likely be removed in OpenLDAP 2.5. > Let's look at this from the Disaster Recovery standpoint. Consider this: > > * One uses slapd.conf as a boot-strap to general the cn=config database > * cn=config works fine at first, and you are able to add new entries to > your runtime configuration, instead of adding them to slapd.conf (the > original boot-strapper). > * One day, your Junior admin tries to add an "olc" attribute to your > cn=config backend, only to crash slapd (happens occasionally). > * You start up slapd only to find the cn=config database has been > corrupted. > * You use your original slapd.conf boot-strap to generate a NEW > cn=config backend. > * You find your original bootstrap config LACKS some of the recent > changes your team made to the cn=config DB. So, in essence, you're > screwed. I would suggest you instead take backups of your cn=config database via slapcat. This is what I do, on a nightly basis. If some junior admin makes a mistake, then I can restore it very trivially via slapadd. The rest of your email is invalid due to the above. bootstrapping via slapd.conf should only be a one-time affair, and not used for disaster recovery. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

3 2

sizelimit doesn't work - keep on getting "Size limit exceeded"
by nano mir 13 Jun '10

13 Jun '10

Hi all, I have an address book of 540 entries, and I cannot get openLDAP to return them all... Please take a look: $ uname -r && cat /etc/issue 2.6.28-19-generic Ubuntu 9.04 \n \l $ grep -i --context=2 "limit\|size" /etc/ldap/slapd.conf ... # The maximum number of entries that is returned for a search operation #sizelimit 1000 limits anonymous size.soft=50 size.hard=100 size.unchecked=32767 time.soft=15 time.hard=60 sizelimit -1 limits dn.exact="cn=theadmin,dc=my,dc=server,dc=com" size=unlimited time=unlimited limits group/groupOfUniqueNames/uniqueMember="cn=theadmin,ou=testingab,dc=my,dc=server,dc=com" size=unlimited time=unlimited # The tool-threads parameter sets the actual amount of cpu's that is used -- # For the Debian package we use 2MB as default but be sure to update this # value if you have plenty of RAM dbconfig set_cachesize 0 2097152 0 # Sven Hartge reported that he had to set this value incredibly high ... $ sudo /etc/init.d/slapd restart Stopping OpenLDAP: slapd. Starting OpenLDAP: slapd. $ sudo /etc/init.d/apache2 reload * Reloading web server config apache2 apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1 for ServerName [ OK ] . And even after I do all this (add limits to '/etc/ldap/slapd.conf' and restart servers), I *still* get "Size limit exceeded": --------- $ ldapsearch -W -D cn=theadmin,dc=my,dc=server,dc=com -b ou=testingab,dc=my,dc=server,dc=com $cn=*$ ... ... # search result search: 2 result: 4 Size limit exceeded # numResponses: 501 # numEntries: 500 --------- Frustrating ! :( :( :( Can anyone tell me what am I doing wrong?! Thanks in advance, Cheers!

2 1

back-sql with thunderbird-frontend fails
by rpeschke＠peschke-it.de 12 Jun '10

12 Jun '10

Hi, I have an OpenLDAP running with the back-sql. On ldapsearch it runs quite good, but thunderbird refuses to use the LDAP addressbook. In the logged query, excerpts see below, it requests it's "secondary" attributes like custom1 etc.. These attributes are not part of any schema. What's the solution: 1. to modify all thunderbirds configuration, where the secondary attributes are configured. There are some th...!? 2. defining my own schema to extend the mozillaAbPersonAlpha-schema? 3. Looking for a schema in the net? Any suggestions what to do? Thank you Ralf PS: Here are some lines from the slapd-log: Jun 11 23:30:49 osicsd slapd[2652]: conn=1000 op=2 SRCH base="dc=address" scope=2 deref=0 filter="(|(mail=*.*)(cn=*.*)(givenName=*.*)(sn=*.*))" Jun 11 23:30:49 osicsd slapd[2652]: conn=1000 op=2 SRCH attr=o company mail mozillaCustom3 custom3 street streetaddress postOfficeBox mozillaUseHtmlMail xmozillausehtmlmail mozillaCustom2 custom2 mozillaHomeCountryName ou department departmentnumber orgunit mobile cellphone carphone telephoneNumber title mozillaCustom1 custom1 mozillaNickname xmozillanickname mozillaWorkUrl workurl fax facsimiletelephonenumber mozillaSecondEmail xmozillasecondemail mozillaCustom4 custom4 nsAIMid nscpaimscreenname givenName l locality homePhone mozillaHomeUrl homeurl mozillaHomeStreet st region mozillaHomePostalCode mozillaHomeLocalityName birthyear mozillaWorkStreet2 mozillaHomeStreet2 postalCode zip c countryname pager pagerphone sn surname mozillaHomeState description notes modifytimestamp cn commonname Jun 11 23:30:49 osicsd slapd[2652]: is_entry_objectclass("", "2.16.840.1.113730.3.2.6") no objectClass attribute Jun 11 23:30:49 osicsd slapd[2652]: is_entry_objectclass("", "2.16.840.1.113730.3.2.6") no objectClass attribute Jun 11 23:30:49 osicsd slapd[2652]: conn=1000 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text= Jun 11 23:34:31 osicsd slapd[2652]: conn=1000 op=3 UNBIND Jun 11 23:34:31 osicsd slapd[2652]: conn=1000 fd=13 closed

1 0

Re: Migratate Zimbra to Openldap
by Claudio Guzman 11 Jun '10

11 Jun '10

I need not upgrade, I require the zimbra ldap export and import it into a machine that only has ldap

2 1

Re: Migratate Zimbra to Openldap
by Claudio Guzman 11 Jun '10

11 Jun '10

when you place the export amount of zimbra and then only throw me different errors ldap Could not add object: cn=central,ou=people,dc=domainname,dc=org LDAP said: LDAP_UNDEFINED_TYPE The attribute type specified is invalid. would have to create the values to import the schema? best regard Claudio

2 1

Migratate Zimbra to Openldap
by Claudio Guzman 11 Jun '10

11 Jun '10

Exporting the data will place all of your LDAP Data into a single, movable .LDIF file. su – zimbra openldap/sbin/slapcat -f /opt/zimbra/conf/slapd.conf -l /tmp/ldap.ldif 6.0+: /opt/zimbra/libexec/zmslapcat /backup when you imported a number of mistakes and I pulled that scheme is another way, how could I make a proper import or apply some filter to get all of zimbra thanks.

2 1

Restricting client access using pam_groupdn with dynamic groups : Was[Re: restrict host login based on group]
by Shamika Joshi 11 Jun '10

11 Jun '10

Hi I've followed Adam's post below on 'using pam_groupdn to use dynlist' to my query posted couple of months back and after revisiting this configuration facing issue with doing ssh to client machine with dynamic member of the group. It works correctly for the static members of the same group.Could you figure out if I'm missing something here?? Currently using Ubuntu 9.10 which uses slapd.d configuration directory. dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb *olcModuleLoad: {1}dynlist.la* olcModuleLoad: {2}syncprov dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=testlab,dc=com olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=testla b,dc=com" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=admin,dc=testlab,dc=com" write by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=testlab,dc=com olcRootPW: 1234 olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: uid pres,eq olcDbIndex: cn,sn,mail pres,eq,approx,sub olcDbIndex: objectClass eq *dn: olcOverlay={0}dynlist,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcDynamicList olcOverlay: {0}dynlist olcDlAttrSet: {0}groupOfNames labeledURI member* *ldap.conf* on client machine contains # Group to enforce membership of *pam_groupdn cn=u910desk,ou=Machines,dc=testlab,dc=com* # Group member attribute *pam_member_attribute member** * I have added following group *dn: cn=u910desk,ou=Machines,dc=testlab,dc=com* cn: u910desk ipHostNumber: 172.17.5.232 objectClass: top objectClass: groupOfNames objectClass: labeledURIObject objectClass: ipHost* labeledURI: ldap://172.17.0.200/ou=Users,dc=testlab,dc=com??one?(host=cms3)* member: cn=placeholder,dc=testlab,dc=com member: uid=henry,ou=Users,dc=testlab,dc=com Also a user with host=cms3 entry, which should become dynamic member 'u910desk' after resolving labledURI above *dn: uid=jack,ou=Users,dc=testlab,dc=com* cn: jack sn: jack givenName: jack uid: jack uidNumber: 1002 gidNumber: 513 homeDirectory: /home/jack loginShell: /bin/bash gecos: System User host: cms3 objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: hostobj shadowMax: 45 However when I run search for member of group 'u910desk' it returns following : member list does not contain entry of user 'jack' here $ldapsearch -xLLL -b 'cn=u910desk,ou=Machines,dc=testlab,dc=com' member dn: cn=u910desk,ou=Machines,dc=testlab,dc=com member: cn=placeholder,dc=testlab,dc=com member: uid=henry,ou=Users,dc=testlab,dc=com For same reason(not sure tho) I think I'm not able to ssh to this client using 'jack', however ssh using 'henry' works it being a static member of 'u910desk'. admins@u910desk:~$ ssh jack@localhost jack@localhost's password: You must be a member of cn=u910desk,ou=Machines,dc=testlab,dc=com to login. Connection closed by ::1 admins@u910desk:~$ admins@u910desk:~$ admins@u910desk:~$ admins@u910desk:~$ ssh henry@localhost henry@localhost's password: Linux u910desk 2.6.31-17-generic #54-Ubuntu SMP Thu Dec 10 17:01:44 UTC 2009 x86_64 To access official Ubuntu documentation, please visit: http://help.ubuntu.com/ 164 packages can be updated. 90 updates are security updates. Last login: Wed Jun 2 17:10:19 2010 from localhost henry@u910desk:~$ Any help in this matter will be highly appreciated. Thanks in advance Shamika On Sat, Dec 12, 2009 at 4:53 AM, Adam Hough <adam(a)gradientzero.com> wrote: > I am guessing you are either using RHEL5, Centos5 or some other RHEL5 based > distro. I replaced the openldap that was on my centos5 machines with an > newer version at 2.4.16+patches. > > I have uploaded the rpms and srpms of what I used which you can do a drop > in replacement of the RHEL5 based openldap rpms. > http://www.gradientzero.com/openldap/ > > I do not remember for sure but I think I had to force one or 2 of the > packages it get it to install but once everyhting is installed then it ran > fine for me. I have 3 ldap servers using this version setup in a > multi-master setup. > > Since I am doing a multimastet setup, I do not use slapd.conf but rather > the slapd.d configuration directory though the dynlist overlay should work > with slapd.conf as well. > > > - Adam > >> >> >> On Fri, Dec 11, 2009 at 4:18 AM, Adam Hough <adam(a)gradientzero.com>wrote: >> >>> There are other ways to populate the pam_groupdn that you have associated >>> with each machine but those all correspond to some attribute in the user's >>> profile. >>> >>> I have pam_groupdn setup like this >>> >>> /etc/ldap.conf: >>> pam_groupdn cn=<GROUP_NAME>,ou=Systems,dc=domain,dc=com >>> pam_member_attribute member >>> >>> cn=<GROUP_NAME>,ou=Systems,dc=domain,dc=com >>> cn: <GROUP_NAME> >>> objectClass: top >>> objectClass: groupOfNames >>> objectClass: labeledURIObject >>> member: uid=nobody,ou=People, dc=domain,dc=com >>> labeledURI: ldap:///ou=People,dc=domain,dc=com??one?(host=<type of >>> system>) >>> labeledURI: ldap:///ou=People,dc=domain,dc=com??one?(gidNumber=XXXX) >>> >>> So as you can see you can have as many labeledURI attributes as you want >>> or need. I tend to use the host name function of what the host does. >>> >>> This is how my account profile would look: >>> uid=<MYUSERID>,ou=People,dc=domain,dc=com >>> host: "cluster" >>> host: sysadmin >>> >>> So "cluster" is a compute cluster that we have and thus for all those >>> machines the pam_groupdn cn="cluster",ou=Systems,dc=domain,dc=com, and for >>> machines where only the sysadmins login to then pam_groupdn >>> cn=sysadmin,ou=Systems,dc=domain,dc=com. >>> >>> As long as you can for a labeledURI: >>> ldap:///ou=People,dc=domain,dc=com??one?<attribute>=<value>) type search you >>> can use it to auto populate the group. >>> >>> Summary: >>> * Do to not think of the host attribute as host = hostname but as host = >>> type of machine and that you can have more then one labeledURI per group to >>> help populate the group. >>> * Use good gidNumbers for groups to help auto populate groupOfName style >>> groups. >>> >>> >>> >>> - Adam >>> >>> >>> >>> On Wed, Dec 9, 2009 at 4:01 AM, Shamika Joshi <shamika.joshi(a)gmail.com>wrote: >>> >>>> Hi Adam, >>>> I'm able to get host auth working by using host attribute.But the >>>> drawback of that is everytime there a new machine, I have to add that host >>>> to all the users I want to grant access to. If I decide to do it based on >>>> group membership, I can use pam_groupdn but then it does not allow multiple >>>> group entries there, plus it has to be managed on client side,which is even >>>> more undesirable by any administrator. >>>> >>>> I went through this article but I'm not sure if it will work if I have >>>> some members already associated with some groups. Like ldap1 & ldap2 members >>>> of qagroup & ldap3 & ldap4 members of sysadmin, would this method allow me >>>> to limit access based on their group membership?? if yes...could you briefly >>>> explain with an example? >>>> >>>> Thank for your time in advance >>>> Shamika >>>> >>>> >>>> >>>> On Wed, Dec 9, 2009 at 9:04 AM, Adam Hough <adam(a)gradientzero.com>wrote: >>>> >>>>> Here is is the write up that I read to figure out how to do setup to >>>>> auto-restrict users to certain hosts. >>>>> >>>>> >>>>> http://www.hurricanelabs.com/september2009_login_security_using_openldap_an… >>>>> >>>>> >>>>> >>>> >>> >> >

3 4

Communicate from php/apache to openLDAP over LDAPS
by Jérémy ESCOLANO 11 Jun '10

11 Jun '10

Hi I'm writing from france cuz i'm having a big problem with apache and ldap. let me explain : I would like to make an Apache server communicate in php with en openLDAP server (both servers are under win srv 2003), using LDAPS protocol. In order to activate LDAPS on my openLDAP srv (srvLDAP), I created self signed certificates with openSSL. I got 3 files: cacert.pem srvLDAP.pem srvLDAP.key I configured my slapd.con file and ldap.conf fil (openLDAP side) like this: slapd.conf TLSCertificateFile ./ssl/srvLDAP.pem TLSCertificateKeyFile ./ssl/srvLDAP.key TLSCACertificateFile ./ssl/cacert.pem ldap.conf BASE <ma branche> URI ldaps://srvLDAP/ TLS_CACERT ./ssl/cacert.pem TLS_REQCERT demand I launched my openLDAP service, and checked ldaps protocol was okay, using this command : C:\Program Files\OpenLDAP>ldapsearch -b o=exemple,dc=fr -s sub -x -w pass-D cn=admin,o=exemple,dc=fr -H ldaps://srvLDAP/ Now I would like, from the remote apache server, communicate with the openLDAP server using [b]LDAPS[/b] Protocol. Here is my simplified PHP code <h2>LDAP OPENLDAP LDAPS</h2> <?php $host="ldaps://srvldap"; $port="636"; $ds=ldap_connect($host,$port); ldap_set_option($ds,LDAP_OPT_PROTOCOL_VERSION,3); $r=ldap_bind($ds,"cn=admin,o=exemple,dc=fr","pass" ); $sr=ldap_search($ds,"o=exemplec,dc=fr",("objectClass=maclasse" )); $info=ldap_get_entries($ds,$sr); print $info["count"]." enregistrements trouvés."; ?> I get this errror: Unable to bind to server: Can't contact LDAP server I know i have to configure certificates in the Apache server configuration, I tried to to this according several internet ressources but didn't succeed. I also read this link [URL=" http://forum.hardware.fr/hfr/OSAlternatifs/Logiciels-2/certificats-securise…"]Here[/URL] which is a french link which speak about an ldap.con and ldaprc files to put in the apache server. I did it but nothing happened. Well, i'm lost in all this stuff, that is why i'm asking for help to configure my servers to use ldaps with php. Do you have information that could help me ? I thank you in advance

5 12

Delta-syncrepl and delay in replication
by MIKI Soichiro 11 Jun '10

11 Jun '10

Hi All, I am testing delta-syncrepl using OpenLDAP 2.3.43.7(actually as ZimbraLDAP on ZCS 5.0.16). It spends a lot of time to complete replication when adding 20,000 or 200,000 objects(accounts) to the master at a time. [Time for replication] User time(updates to master) replica1 replica2 ------------------------------------------- 20,000 0:19:03 0:58:51 1:19:29 200,000 2:38:03 4:33:39 13:33:38 [Setting value in LDAP] *checkpoint = 10240 *Thread numbers = 8 *Security = 0(zimbra_require_interprocess_security) *The following operation is actually executed by each user in a loop. 1.Add account 2.Add settings(filters,contacts,signatures) for an account 3.Update the setting of the created account There seems no performance problem with writing accesslog to the database, thus, updates to the master server was finished successfully in reasonable time. Also, it seems that there is no bottleneck such as resource of the servers, and we still have extra spaces on CPU, memory and network. I've attached the servers spec. I assume there will be a problem with the process of pushing data from LDAP master to multiple replicas, but is this process serialized ? How can we reduce the replication time on replica servers? I think updates could not be delayed on the replicas themselves because only the secondary replica took a lot of time to update data. And we don't have plan to execute export/import method. Here are the settings of the provider and the replicas: ######################################################## # BDB database definitions for provider # excluding Zimbra settings ######################################################## database bdb suffix "" rootdn "cn=config" # number of entries to keep in memory cachesize 10000 # number of search results to keep in memory idlcachesize 10000 # check point whenever 64k data bytes written or # 5 minutes has elapsed whichever occurs first checkpoint 64 5 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory "/opt/zimbra/openldap-data" # recommended for replication index entryUUID eq index entryCSN eq sizelimit unlimited timelimit unlimited overlay syncprov syncprov-checkpoint 20 10 syncprov-sessionlog 500 include /opt/zimbra/conf/master-accesslog-overlay.conf ################################################## # BDB database definitions for consumer ################################################## database bdb suffix "" rootdn "cn=config" # number of entries to keep in memory cachesize 10000 # number of search results to keep in memory idlcachesize 10000 # check point whenever 64k data bytes written or # 5 minutes has elapsed whichever occurs first checkpoint 64 5 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory "/opt/zimbra/openldap-data" index uid pres,eq # white pages index mail pres,eq,sub index cn pres,eq,sub index displayName pres,eq,sub index sn pres,eq,sub index gn pres,eq,sub # recommended for replication index entryUUID eq index entryCSN eq sizelimit unlimited timelimit unlimited ###include /opt/zimbra/conf/master-accesslog-overlay.conf syncrepl rid=100 provider=ldap://ldapm.XXX1.XXX-test.ne.jp:389 retry="60 +" type=refreshAndPersist schemachecking=off searchbase="" bindmethod=simple binddn=uid=zmreplica,cn=admins,cn=zimbra credentials=@@ldap_replication_password@@ starttls=critical logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" syncdata="accesslog" updateref ldap://ldapm.ngm1.XXX-test.ne.jp:389 overlay syncprov Please let us know if you need more information. Best Regards, Soichiro Miki ===== Soichiro Miki Hitachi Software Engineering Co,Ltd. s-miki(a)hitachisoft.jp

3 2

← Newer
1
...
5
6
7
8
9
10
11
12
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical June 2010