openldap-technical July 2010

openldap-technical@openldap.org

103 participants
126 discussions

Re: Server Side sort and the cn attribute
by Ladislav Pašek 27 Jul '10

27 Jul '10

Hello, is there any another solution for this then patching the source like here: http://www.openldap.org/lists/openldap-technical/201001/msg00078.html Lada > On Fri, Dec 11, 2009 at 1:31 PM, Edward Capriolo <edlinuxguru(a)gmail.com> wrote: >> We use openldap as a back end for many things. One of the thing, it >> can be used for is an address book for outlook. Recently we upgrade to >> 2.4.16->2.4.20 from 2.(who knows how old). >> >> Outlook 2003 clients stopped working: >> >> http://support.microsoft.com/kb/555536 >> >> So I followed the instructions here to enable server side sorting: >> >> http://bacedifo.blogspot.com/2009/09/server-side-sort-with-openldap2418.html >> >> I was able to add the ordering to the sn attribute. >> >> attributetype ( 2.5.4.4 NAME ( 'sn' 'surname' ) >> DESC 'RFC2256: last (family) name(s) for which the entity is known by' >> ORDERING caseIgnoreOrderingMatch >> SUP name ) >> >> Unfortunately outlook is looking at the cn attribute >> >> @400000004b21316a0e808064 sssvlv: no ordering rule specified and no >> default ordering rule for attribute cn >> @400000004b21316a0e808834 <= get_ctrls: n=1 rc=18 err="serverSort >> control: No ordering rule" >> >> That unfortunately is not defined in the core.schema >> # system schema >> #attributetype ( 2.5.4.3 NAME ( 'cn' 'commonName' ) >> # DESC 'RFC2256: common name(s) for which the entity is known by' >> # SUP name ) >> >> I am sure there is a good reason why cn does not have an ordering, but >> I am guessing it used to have this in the distant past since this >> previously worked. So how would I go about changing the system schema? >> Or does anyone have a better way to deal with this. >> >> (I know I could play with client registry (kb) article but I would >> like to handle this server side) >> >> Thank you for your insights. >> > > To follow up, does anyone know why CN does not have any ordering rule? > Is their a way to add an ordering rule?

2 1

slappasswd2.4 output issue
by Stuart Cherrington 27 Jul '10

27 Jul '10

Hi, I'm writing a script to help my fellow admins automatically creates user accounts in OpenLDAP 2.4. Can provide copy of script if you would like it. The issue I have is encrypting the plain text word into passwd format, I found the very helpful slappasswd2.4 which seems to work so I put it into my script: echo $NEWPASS > /tmp/newpass chmod 400 /tmp/newpass slappasswd2.4 -h {crypt} -T /tmp/newpass > /tmp/passenc chmod 400 /tmp/passenc EPASS=`cat /tmp/passenc` It creates an entry in the passenc file which looks like this: {crypt}mHUqpeNah1BOQ But when i use this as a variable to the 'userpassword:' attribute then try to compare passwds within phpLDAPadmin it fails. Any hints would be appreciated. Thanks, Stuart. _________________________________________________________________ http://clk.atdmt.com/UKM/go/195013117/direct/01/ We want to hear all your funny, exciting and crazy Hotmail stories. Tell us now

2 5

Ldapsearch Error while using Back-NDB
by Priyesh Potdar 27 Jul '10

27 Jul '10

Hi, An error comes while searching in ldap compiled with NDB support. To reproduce the issue: 1) Import the below sample.ldif file to the database by issuing the following command: /usr/local/sbin/slapadd -l sample.ldif sample.ldif: dn: dc=dimdim,dc=com dc: dimdim description: My wonderful company as much text as you want to place in this line up to 32K continuation data for the line above must have <CR> or <CR><LF> i.e. ENTER works on both Windows and *nix system - new line MUST begin with ONE SPACE objectClass: dcObject objectClass: organization o: Example, Inc. dn: ou=people, dc=dimdim,dc=com ou: people description: All people in organisation objectclass: organizationalunit dn: cn=Robert Smith,ou=people,dc=dimdim,dc=com objectclass: inetOrgPerson cn: Robert Smith cn: Robert Pagal cn: Howard Chu sn: smith uid: rjsmith userpassword: rJsmitH carlicense: HISCAR 123 homephone: 555-111-2222 mail: r.smith(a)dimdim.com mail: sampel1(a)yahoo.com mail: sample2(a)gmail.com description: swell guy ou: Human Resources 2) Start the ldap server and issue the command to search: ldapsearch -H ldap://192.168.3.47 -x -D "dc=dimdim,dc=com" -b "dc=dimdim,dc=com" -w dimdim "(uid=rjsmith)" 3) It will return multiple results and that is the issue we are facing. Output of the command: # extended LDIF # # LDAPv3 # base <dc=dimdim,dc=com> with scope subtree # filter: (uid=rjsmith) # requesting: ALL # # Robert Smith, people, dimdim.com dn: cn=Robert Smith,ou=people,dc=dimdim,dc=com objectClass: inetOrgPerson userPassword:: ckpzbWl0SA== description: swell guy sn: smith cn: Robert Smith cn: Robert Pagal cn: Howard Chu ou: Human Resources carLicense: HISCAR 123 homePhone: 555-111-2222 mail: r.smith(a)dimdim.com mail: sampel1(a)yahoo.com mail: sample2(a)gmail.com uid: rjsmith # Robert Smith, people, dimdim.com dn: cn=Robert Smith,ou=people,dc=dimdim,dc=com objectClass: inetOrgPerson userPassword:: ckpzbWl0SA== description: swell guy sn: smith cn: Robert Smith cn: Robert Pagal cn: Howard Chu ou: Human Resources carLicense: HISCAR 123 homePhone: 555-111-2222 mail: r.smith(a)dimdim.com mail: sampel1(a)yahoo.com mail: sample2(a)gmail.com uid: rjsmith # Robert Smith, people, dimdim.com dn: cn=Robert Smith,ou=people,dc=dimdim,dc=com objectClass: inetOrgPerson userPassword:: ckpzbWl0SA== description: swell guy sn: smith cn: Robert Smith cn: Robert Pagal cn: Howard Chu ou: Human Resources carLicense: HISCAR 123 homePhone: 555-111-2222 mail: r.smith(a)dimdim.com mail: sampel1(a)yahoo.com mail: sample2(a)gmail.com uid: rjsmith # search result search: 2 result: 0 Success # numResponses: 4 # numEntries: 3 Kindly provide a solution for the same. -- Best Regards, Priyesh Potdar Dimdim Inc.

3 3

Re: OpenLDAP with MySQL Cluster - No free node Error
by Gavin Henry 27 Jul '10

27 Jul '10

On 03/06/10 13:18, Priyesh Potdar wrote: > Hi All, > > I am new to use of ndb with openLDAP. I have established a MySQL Cluster > in my network and also compiled the openLDAP with --enable-ndb option. > Now when I start the openLDAP with command "slapd -d 5" (To see the > debug output), I get the following error: > > Configuration error: Error : Could not alloc node id at 192.168.7.40 > port 1186: No free node id found for mysqld(API). Did you resolve this? Thanks. -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

2 1

Re: OpenLDAP to replace Oracle Internet Directory
by Gavin Henry 27 Jul '10

27 Jul '10

> I want thank every one responsible to keep OpenLDAP project with that high > level of quality and I am really proud about that kind of quality has been > produced by a free software project (free as in freedom). Excellent news! How is it going now? Did you use our docs to help you? Do you have any suggestions for improvements to the docs? Thanks. -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

Re: acls help
by Gavin Henry 27 Jul '10

27 Jul '10

> Please, where can I found which ACLs are Denying > cn=postmaster,vd=social.com.br,o=hosting,dc=example,dc=tld ? > I only see, access_allowed, slap_access_allowed, backend default add > access denied. > I cannot do much more with this information. > How can I debug ACLs hardest? (Only acls, I already tryed -1 without > success (looking for denying information)) > Sorry my low know how in this issue, but I realy need to finish this job. > Thanks. "man slapacl" will help -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

how to add a new database with slapd.d?
by Zhang Weiwu 26 Jul '10

26 Jul '10

With Ubuntu 10.04, slapd is shipped by default using slapd.d configuration instead of slapd.conf. Referring to the document [1] I believe adding a new database should be as simple as adding a new file in slapd.d/cn=config/ But it doesn't work for me. Behavior explained below: I created this new database definition by copying example [2]: # cat "/etc/ldap/slapd.d/cn=config/olcDatabase={1}hdb" # BDB definition for example.com dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcSuffix: "dc=test,dc=com" olcDbDirectory: /var/lib/ldap olcRootDN: "cn=Manager,dc=test,dc=com" olcRootPW: secret olcDbIndex: uid pres,eq olcDbIndex: cn,sn,uid pres,eq,approx,sub olcDbIndex: objectClass eq olcAccess: to attrs=userPassword by self write by anonymous auth by dn.base="cn=Admin,dc=test,dc=com" write by * none olcAccess: to * by self write by dn.base="cn=Admin,dc=test,dc=com" write by * read According to my experience of using slapd.conf in the last five years, if I restart slapd, I should see DB_CONFIG and a few other files created in DB directory. But this is not happening this time. root@orphalese:~# ls -dlh /var/lib/ldap drwxr-x--- 2 openldap openldap 4.0K Jun 12 10:36 /var/lib/ldap root@orphalese:~# ls -lh /var/lib/ldap total 0 Quesiton: 1) did I do anything wrong? 2) What would you future suggest me to check? List of what I have checked: 1. Adding entry to the newly created database also doesn't work: # slapadd -b dc=test,dc=com < /tmp/first.ldif slapadd: slap_init no backend for "dc=test,dc=com" 2. I checked syslog with LogLevel set to 255, end up with a lot of details in syslog but none mentioning keyword 'hdb'. 3. The above experiment is re-done with hdb replaced with bdb without luck neither. 4. Authentication also fails: $ ldapsearch -x -D cn=Manager,dc=test,dc=com -w secret ldap_bind: Invalid credentials (49) 5. I also checked to make sure slapd.conf doesn't exist. 6. I also checked there is only one slapd.d directory and slapd is using the same slapd.d that I am editing, by the fact I changed LogLevel in cn=config.ldif and it has vivid effect on syslog. [1] http://www.openldap.org/doc/admin24/slapdconf2.html [2] The 'example' is "/etc/ldap/slapd.d/cn=config/olcDatabase=bdb" shipped with Ubuntu: # cat "/etc/ldap/slapd.d/cn=config/olcDatabase=bdb" # BDB definition for example.com dn: olcDatabase=bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: bdb olcSuffix: "dc=example,dc=com" olcDbDirectory: /usr/local/var/openldap-data olcRootDN: "cn=Manager,dc=example,dc=com" olcRootPW: secret olcDbIndex: uid pres,eq olcDbIndex: cn,sn,uid pres,eq,approx,sub olcDbIndex: objectClass eq olcAccess: to attrs=userPassword by self write by anonymous auth by dn.base="cn=Admin,dc=example,dc=com" write by * none olcAccess: to * by self write by dn.base="cn=Admin,dc=example,dc=com" write by * read

3 7

"objectClass: olcBdbConfig" causes "ldap_add: Invalid syntax" error
by Zhang Weiwu 26 Jul '10

26 Jul '10

Hello. This is again the problem of adding a new database with cn=config structure. Since I asked last question I now have much more knowledge to ask again with more understandable description of the problem, thus new post here. In short the problem is "objectClass: olcBdbConfig" causes "ldap_add: Invalid syntax" error. Step 1: fresh new Ubuntu 10.04 installation with slapd package. (Production server is Debian, but home PC is Ubuntu, try at home first, there hardly can be difference on server packages like slapd between Ubutnu and Debian) Step 2: Not being able to find default credential to access cn=config I added my own, adding these two lines to /etc/ldap/slapd.d/cn=config/olcDatabase={0}config.ldif olcRootDN: cn=Manager,cn=config olcRootPW: secret And test the new credential works. (how do I test? [1]) Step 3: Adding a new database definition from ldif file. Error: # ldapadd -x -D cn=Manager,cn=config -w secret < /tmp/ldif adding new entry "olcDatabase=bdb,cn=config" ldap_add: Invalid syntax (21) additional info: objectClass: value #1 invalid per syntax The file that caused the error is attached below, I could not see anything wrong in it and it is mostly copied from document[2] example. # BDB definition for example.com dn: olcDatabase=bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: bdb olcSuffix: dc=example,dc=com olcDbDirectory: /var/lib/ldap olcRootDN: cn=Manager,dc=example,dc=com olcRootPW: secret olcDbIndex: uid pres,eq olcDbIndex: cn,sn,uid pres,eq,approx,sub olcDbIndex: objectClass eq olcAccess: to attrs=userPassword by self write by anonymous auth by dn.base="cn=Admin,dc=example,dc=com" write by * none olcAccess: to * by self write by dn.base="cn=Admin,dc=example,dc=com" write by * read [1] To verify the credential I added to cn=config is usable I did this: # ldapsearch -x -D cn=Manager,cn=config -w secret -b cn=config | tail ,cn=auth manage by * break olcRootDN: cn=Manager,cn=config olcRootPW: secret # search result search: 2 result: 0 Success # numResponses: 6 # numEntries: 5 [2] ending page of this document: http://www.openldap.org/doc/admin24/slapdconf2.html

3 3

openLDAP and SSL client/server certs
by Bryan Boone 26 Jul '10

26 Jul '10

Hi everyone. I am trying to develop an ldap client that uses SSL. I read in the documentation on the openldap website this... You must also install a copy of the CA certificate on all of your client machines. Configuration is done in /usr/local/etc/openldap/ldap.conf: TLS_CACERT /usr/local/etc/openldap/cacert.pem Does this mean that the function ldap_start_tls_s()performs mutual SSL authentication??? If I want to achieve server side authentication, does that mean I will have to use the openSSL libraries to get the server cert prior to using the ldap_start_tls_s() function???

2 1

More about libldap locking
by masarati＠aero.polimi.it 26 Jul '10

26 Jul '10

I'm having trouble in determining what mutex is related to what data in libldap's structures. For example, as far as I understand, lconn_refcnt in LDAPConn is tested and even modified without expressly locking any mutex. Logically, it seems to me that ld_conn_mutex should be the one. Could anybody please confirm this or provide insight? Thanks, p.

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical July 2010