openldap-technical July 2010

openldap-technical@openldap.org

103 participants
126 discussions

Proxycache overlay to back-ldap with cn=config
by Nicolas Brisac 04 Aug '10

04 Aug '10

Hi, I'm trying to set up a proxy-cache to a couple of OpenLDAP servers configured in mirror mode. The back-ldap part is working fine and I can query the underlying slapd instances through the proxy. However, I'm still struggling with the caching bit. I couldn't find any documentation or posts related to setting this up using the new cn=config way of configuring LDAP. So after some reading and a bit of guessing, I came up with the following config: # {1}ldap, config dn: olcDatabase={1}ldap,cn=config objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {1}ldap olcSuffix: dc=sol1,dc=net olcAccess: {0}to dn.base="" by * read olcAccess: {1}to dn.base="cn=Subschema" by * read olcAccess: {2}to * by self write by users read by anonymous auth olcRootDN: uid=ldapadmin,dc=sol1,dc=net olcRootPW: secret olcDbURI: "ldap://192.168.200.12 ldap://192.168.200.14" olcDbACLBind: bindmethod=simple binddn="uid=ldapadmin,dc=sol1,dc=net" credentials="secret" starttls=no # {0}pcache, {1}ldap, config dn: olcOverlay={0}pcache,olcDatabase={1}ldap,cn=config objectClass: olcOverlayConfig objectClass: olcPcacheConfig olcOverlay: {0}pcache olcPcache: bdb 10000 3 1000 100 olcPcacheAttrset: 0 uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass olcPcacheAttrset: 1 sudoCommand sudoHost olcPcacheAttrset: 2 gidNumber olcPcacheTemplate: (&(objectClass=)(uid=)) 0 300 olcPcacheTemplate: (sudoUser=) 1 300 olcPcacheTemplate: (&(objectClass=)(memberUid=)) 2 300 # {2}bdb, config dn: olcDatabase={2}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcDbDirectory: /var/lib/ldap/cache olcSuffix: cn=proxy olcRootDN: uid=ldapadmin,dc=sol1,dc=net olcDbCacheSize: 5000 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: uid eq olcDbIndex: cn eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: memberUid eq olcDbIndex: uniqueMember eq olcDbIndex: mail eq olcDbIndex: surname eq olcDbIndex: givenname eq olcDbIndex: sambaSID eq olcDbIndex: sambaPrimaryGroupSID eq olcDbIndex: sambaDomainName eq olcDbIndex: sudoUser eq But running ldapsearch keeps returning: # search result search: 2 result: 52 Server is unavailable text: pcachePrivDB: cacheDB not available I didn't find any way to specify which database to use when declaring the overlay, apart from the 'bdb' part of olcPcache, but that seems to be interpreted as the database type, not its name (I've tried replacing it with cn=proxy, but that throws an error). Looking at the pcache overlay source (I'm running 2.4.21 from Ubuntu Lucid and also checked the latest 2.4.23 stable source), I can see this bit: { "pcache-", "private database args", 1, 0, STRLENOF("pcache-"), ARG_MAGIC|PC_PRIVATE_DB, pc_cf_gen, NULL, NULL, NULL }, That seems to be for the private DB options, but the other equivalent "pcacheXXXX" in this file have the corresponding attribute declaration for the schema instead of 'NULL, NULL, NULL'. Anyway, I'm obviously missing something :) If someone who's got this working or a developer could point me in the right direction, that would be greatly appreciated! Thanks, Nico

1 1

trying to understand referrals
by Khaled Blah 04 Aug '10

04 Aug '10

Hello all, I'm writing an LDAP application using OpenLDAP. First of all, thanks to the many contributors to this project! It's highly appreciated! Now, I'm trying to understand how I can implement an application that knows how to deal with referrals. I've implemented a function which I assign via ldap_set_rebind_proc, however I am not entirely sure what to do within this function that I assign to ldap_set_rebind_proc. What I've done so far is to parse the url parameter using ldap_url_parse and then assign the data from the LDAPURLDesc structure to my own data structure. Then I call ldap_init and ldap_bind_s in order to bind to the referral. However, it seems I am doing something wrong. Can anyone here give me any hints as to what to within that function that is assigned to ldap_set_rebind_proc? Thanks in advance! Regards, Khaled

2 4

ldapadd Naming Violation error 64
by Raymond Norton 03 Aug '10

03 Aug '10

Ubuntu server 10.0.4, ldap 2.4.21 I am getting the following error when attempting to use the ldapadd command: sudo ldapadd -Y EXTERNAL -H ldapi:/// -f db.ldif (error) adding new entry "cn=module{0},cn=config" ldap_add: Naming violation (64) db.ldif: # Load modules for database type dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb # Create directory database dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=2190-db,dc=org olcRootDN: cn=admin,dc=isd2190-db,dc=org olcRootPW: 1234 olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=isd2190-db,dc=org" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=admin,dc=isd2190-db,dc=org" write by * read olcLastMod: TRUE olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: uid pres,eq olcDbIndex: cn,sn,mail pres,eq,approx,sub olcDbIndex: objectClass eq ################################################## ######### # DEFAULTS MODIFICATION ################################################## ######### # Some of the defaults need to be modified in order to allow # remote access to the LDAP config. Otherwise only root # will have administrative access. dn: cn=config changetype: modify delete: olcAuthzRegexp dn: olcDatabase={-1}frontend,cn=config changetype: modify delete: olcAccess dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW olcRootPW: {CRYPT}7hzU8RaZxaGi2 dn: olcDatabase={0}config,cn=config changetype: modify delete: olcAccess

3 4

back-sql mysql innodb
by Frederik Bosch 30 Jul '10

30 Jul '10

Hi all, Two weeks ago I also wrote to this mailinglist, but now my problem is much more clear. I succesfully installed slapd and managed to start it with back-sql. However, I have one problem. Once slapd has retrieved childs from a certain entry, it is not able to refresh it. A slapd restart is needed for that. The problem is due to the MySQL engine used: InnoDB. I discovered that when I converted my database to MyISAM, which had no problems at all. Upgrading myodbc to version 5.1.6 (I as on 3.51 before) did not help. Converting to MyISAM is not an option and was just for testing. Restarting the server each 5 minutes looks like a ugly solution to me. What could be wrong? Thank you. Frederik Bosch

2 4

Hmm. No one seems to be able to answer my question about SSL connections
by Bryan Boone 30 Jul '10

30 Jul '10

So I will try once more. I have successfully setup an openldap server using TLS. I generated self sign certs using http://www.openldap.org/faq/data/cache/185.html I have succussfully setup a client computer on a different computer than the server. I copied the cacert.pem to my client computer I can successfully run ldapsearch with the -ZZ option on the client PC. Now I want to write a client program in C that I can put on any PC, that will automatically download cacert.pem from the openldap server, and prompt a user to accept or reject the cacert.pem. If they accept it, I want to store the cert in the /etc/ssl/certs directory. If they do not accept the cert, I want to stop the connection. How do I accomplish this? I don't see any openldap functions that help me do this.

3 2

understanding referrals
by Khaled Blah 29 Jul '10

29 Jul '10

1 0

DIT entry layout - multiple mail fields, mutiple mailboxes.
by Lauro Costa G. Borges 28 Jul '10

28 Jul '10

Is it possible to have an user entry with multiple "mail" fields mapping to multiple mailboxes (or mailroutingaddress, or something similar)? What I want is to group together "mail" field and "mailroutingaddress"(or maildrop) below an user entry (by "user entry" I mean a DN with obj. classes like inetorgperson, eduperson, postfixuser, etc): - "userdn" -- attr foo -- attr bar -- obj class xyz -- obj class abc -- "some sort of container" --- mail field --- "mail destination" field -- "another container" --- mail field 2 --- "mail destination" field 2 Note that lines with 3 "-"'s are children of lines with 2 "-"'s. However, if there is another way to accomplish this without "child" entries or "containers", please tell me. Thanks ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

1 0

Finiky old OpenLDAP Server: To be or not to be...
by Kendall Gifford 28 Jul '10

28 Jul '10

Sorry for the somewhat vague email title but it is actually somewhat descriptive of a problem I'm having. I also apologize if this is the incorrect list for this question (I first subscribed to openldap-software@... but upon subscription the "welcome" message said it had been shut down and to use this list instead). I'm pretty new to the whole OpenLDAP (and LDAP in general) thing. I'm running an old OpenLDAP server (2.2.29) in a production environment. I recently needed to add some extra schema definitions for my postfix email server (attached as postfix.schema). I edited my slapd.conf file and included my schema file, then restarted the server. All is good so far... Skipping ahead in my story, to test things out I created the following LDIF below: dn: mailDomain=example.com,ou=Email,dc=EXAMPLE,dc=COM mailDomain: example.com objectClass: top objectClass: mailDomainEntry mailDomainVirtual: FALSE The "organization unit" named "Email" already existed. I then ran sladadd: $ sudo slapadd -v -l data.ldif added: "mailDomain=example.com,ou=Email,dc=EXAMPLE,dc=COM" (0000023e) I then ran ldapsearch to dump everything at or under my "Email" ou: $ ldapsearch -x -b "ou=Email,dc=EXAMPLE,dc=COM" This dumped the Email organization unit entry and nothing else. So, on a whim I re-ran the above slapadd command to retry adding a sub-entry beneath my "Email" entry. This time I got the following error: slapadd: could not add entry dn="mailDomain=example.com,ou=Email,dc=EXAMPLE,dc=COM" (line=6): txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) So, apparently it DID get added as this says it "already exists". Hmm, so I'll try to delete it: $ sudo ldapdelete -vx -D "cn=root,dc=EXAMPLE,dc=COM" \ -W "mailDomain=example.com,dc=EXAMPLE,dc=COM" ldap_initialize( <DEFAULT> ) Enter LDAP Password: ******** deleting entry "mailDomain=example.com,dc=EXAMPLE,dc=COM" Delete Result: No such object (32) Matched DN: dc=EXAMPLE,dc=COM So, now it doesn't exist? "To be or not to be?" Hmm. Anyhow, I've tried many search queries and used tools like phpLDAPadmin and JXplorer and cannot find this entry I've created/added. The only command/tool that claims it exists is slapadd when I try to add the same entry again. I know my server version is very very old (2005-ish?) but does anyone have any ideas or recommendations (besides the obvious "save/export your data and upgrade your server" kind which isn't an immediate option). Thanks in advance. I'm hoping I'm just doing something obviously stupid. -- Kendall Gifford

2 1

rebinding and following referrals on bind
by Arthur de Jong 27 Jul '10

27 Jul '10

Hello list, Is there a way to follow a referral on bind? I'm trying to get the PAM module in nss-pam-ldapd to follow referrals while binding. Background is available here [1]. If ldapserver1 refers a subtree to another server (server2) searches for a user are correctly continued on server2 (using ldap_set_rebind_proc()) but when I try to call ldap_simple_bind_s() on the connection that just returned the user from server2 I get "Invalid credentials". Is there a way to find out which LDAP server returned a specific entry or is there some other way to solve this? Thanks for any pointes. [1] http://lists.arthurdejong.org/nss-pam-ldapd-users/2010/msg00097.html -- -- arthur - arthur(a)arthurdejong.org - http://arthurdejong.org --

2 2

How to let users change their passwords?
by Steven Truong 27 Jul '10

27 Jul '10

Dear, all. I have been searching low and high for a tool that can let users to change their passwords in 389 DS or OpenLDAP? I think there is a real need for such a tool and I hope that people already wrote such a tool... Please share your ways of how you allow your users to change their passwords or other setup/architecture that allow this function. Beside that, I also recommend Apache Studio as a great tool to work with LDAP servers..... Thank you in advance.

5 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical July 2010