openldap-technical July 2010

openldap-technical@openldap.org

103 participants
126 discussions

Proxy cache overlay: effect of pcachePersist parameter?
by Jonathan Clarke 16 Jul '10

16 Jul '10

Hi, I've set up an ldap backend, with a pcache overlay to cache binds for PAM. The config is below, for info. My question concerns the pcachePersist parameter. From the man page: pcachePersist { TRUE | FALSE } Specify whether the cached queries should be saved across restarts of the caching proxy, to provide hot startup of the cache. Only non-expired queries are reloaded. The default is FALSE. As I understand this, given "pcachePersist FALSE" (or not specified), cached queries should no longer be in the cache after restarting slapd. Am I right? However, once a bind is successfully cached, I take the proxied server offline and I can restart slapd many times, however my bind is still served from cache. Is this a bug in the docs, a bug in the implementation or just me not getting something? Thanks, Jonathan PS: the simplified config: 8<-------------- database ldap suffix "dc=proxy" rootdn "cn=manager,dc=proxy" uri ldap://my.other.ldap.server/ timeout 5 overlay pcache pcache hdb 10000 1 2 60 pcacheAttrset 0 * # cache binds for 900 seconds = 15 minutes pcacheTemplate (uid=) 0 900 pcacheBind (uid=) 0 900 sub "dc=proxy" pcachePersist FALSE pcacheOffline FALSE directory /var/cache/ldap cachesize 10000 index objectClass,sAMAccountName,pcacheQueryid eq 8<--------------

2 1

Openldap + Outlook Address Book
by Nezrin Sheniyas 16 Jul '10

16 Jul '10

Hi, I want Outlook address book to integrate with Open LDAP server. Can anyone guide a Step By Step to install and configure it. Thanks & Regards Nezshen

1 0

Re: slapd goes down
by Tim Gustafson 16 Jul '10

16 Jul '10

> There is only a core file on the server. its name is > mailwrapper.core and its located in /root Check the value of kern.coredump, like this: sysctl kern.coredump If that says "0", then you need to enable it, like this: sysctl kern.coredump 1 and also you should probably make a similar entry in /etc/sysctl.cnf so that your setting is preserved across reboots. If that's already set to "1", then I'm not sure what's preventing the core files from being created. Tim Gustafson Baskin School of Engineering UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

2 1

LDAP Referral issue
by Jagadeesh M.R 16 Jul '10

16 Jul '10

Hi All, I am trying to implement LDAP referrals using libldap. I am using ldap_set_rebind_proc function to get the credential from the referral ldap server. In this function we have to pass the function pointer for call back function. In my case the call back is not working as we expected. Can someone please help to resolve this issue. I am using libldap.so.2.2 and I tried ldap_set_option(ldap, LDAP_OPT_REBIND_PROC, &call_back_fn); but it is saying "LDAP_OPT_REBIND_PROC" not defined. Do i need to upgrade my ldap library or logical error? Thanks, Jagadeesh

1 0

Eduardo Sachs wants to stay in touch on LinkedIn
by Eduardo Sachs 15 Jul '10

15 Jul '10

LinkedIn ------------ I'd like to add you to my professional network on LinkedIn. - Eduardo Sachs Eduardo Sachs Network Administrator São Luís Area, Brazil Confirm that you know Eduardo Sachs https://www.linkedin.com/e/-48cabe-gbo0osr8-3e/isd/1470850248/WZars9Cx/ ------ (c) 2010, LinkedIn Corporation

1 0

Problem with ADS authentication - any alternatives?
by Garry Glendown 15 Jul '10

15 Jul '10

Hi, sorry if this is slightly off topic, but I'm hoping this may be possible with OpenLDAP .. After a customer of ours migrated from using a local OpenLDAP server to using a central ADS, I've run into sort of a problem ... One of the apps that had been using LDAP to get certain information for a user has now got a problem as the formerly used bind with the user ID (which was present in multiple fields, like uid, cn etc.) now fails. The customer ADS now has the user name (in the format "First Last") in the cn field, and as the complete dn in the dn field (with ou=...) Now, while stuff like Cyrus works fine through looking up the correct DN for a specified uid first and then using that DN for binding to the database, this app still just hands over the input to ADS ... of course, bind fails, as the supplied user ID doesn't match either DN or CN. Of course one could just change the user name input to the full CN contents, but as this is a customer with 600+ PCs, many of which have the old authentication information stored locally (with the user not necessarily being able to alter the information), this solution is only sub-optimal. Altering the CN field to contain the same info as the uid field is another option, which was rejected as it is uncertain to what extent this might cause some problems later on (in case M$ decides to do anything nasty with the cn field). I was thinking about creating some sort of proxy in between, that allows authentication with the uid contents, but this won't work as I'd need the password from the ADS entries, which I can't get ... So I'm wondering - is there some kind of proxy that would allow me to do something like this: - App connects to LDAP Proxy with uid and password, sending some query - Proxy queries ADS for the DN of the uid received - Proxy binds to ADS with the DN and the supplied user PW, sends the query and returns the information to the client And while I'm at it - if the proxy were able to use two backend ADS, this would be a definite plus ... ;) Thanks for any feedback! -garry

3 4

Syncrepl - frontend database cannot be shadow
by alexander＠nautae.eti.br 15 Jul '10

15 Jul '10

Hi. I've read the following document: http://www.openldap.org/doc/admin23/syncrepl.html And this document too: http://www.openldap.org/doc/admin23/slapdconfig.html#syncrepl So, after do my configurations, I get the following error message when I start my slave: /etc/openldap/slapd.conf: line 79: frontend database cannot be shadow. That line (79) is the last line or my syncrepl directive as: moduleload syncprov rootdn "cn=admin,dc=exemple,dc=com" syncrepl rid=0 provider=ldap://10.0.0.222:389 type=refreshAndPersist retry="60 10 300 +" searchbase="dc=example,dc=com" schemachecking=off bindmethod=simple binddn="cn=admin,dc=example,dc=com" credentials=!tsm!n3 Yes, I've tried to put all the syncrepl directives in the same line, and I've got the same error. I've put all those lines right below the section with 'moduleload' lines in slapd.conf. So... I've made a lot of search on the web... no clue, no help... Anyone? Please. []s Alexander Brazil

3 2

RE: DN failed to copy
by Stuart Cherrington 15 Jul '10

15 Jul '10

Hi, In an attempt to help myself, I enabled logging to 'loglevel 4' so got a lot of debug info out. During the copy of the objects under ou=group I got this error: Jul 13 13:12:59 msldap01 slapd2.4[7156]: connection_get(16) Jul 13 13:12:59 msldap01 slapd2.4[7156]: ==> bdb_bind: dn: cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com Jul 13 13:12:59 msldap01 slapd2.4[7156]: send_ldap_result: err=0 matched="" text="" Jul 13 13:12:59 msldap01 slapd2.4[7156]: connection_get(16) Jul 13 13:12:59 msldap01 slapd2.4[7156]: SRCH "cn=dba,ou=group,dc=ldn,dc=sw,dc=com" 0 0 Jul 13 13:12:59 msldap01 slapd2.4[7156]: 0 0 0 Jul 13 13:12:59 msldap01 slapd2.4[7156]: filter: (objectClass=*) Jul 13 13:12:59 msldap01 slapd2.4[7156]: attrs: Jul 13 13:12:59 msldap01 slapd2.4[7156]: Jul 13 13:12:59 msldap01 slapd2.4[7156]: base_candidates: base: "cn=dba,ou=group,dc=ldn,dc=sw,dc=com" (0x0000004e) Jul 13 13:12:59 msldap01 slapd2.4[7156]: send_ldap_result: err=0 matched="" text="" Jul 13 13:12:59 msldap01 slapd2.4[7156]: connection_get(17) Jul 13 13:12:59 msldap01 slapd2.4[7156]: ==> bdb_bind: dn: cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com Jul 13 13:12:59 msldap01 slapd2.4[7156]: send_ldap_result: err=0 matched="" text="" Jul 13 13:12:59 msldap01 slapd2.4[7156]: connection_get(17) Jul 13 13:12:59 msldap01 slapd2.4[7156]: conn=1013 op=1 do_add: dn (cn=copydba,ou=group,dc=ldn,dc=sw,dc=com) Jul 13 13:12:59 msldap01 slapd2.4[7156]: ==> bdb_add: cn=copydba,ou=group,dc=ldn,dc=sw,dc=com Jul 13 13:12:59 msldap01 slapd2.4[7156]: send_ldap_result: err=65 matched="" text="no structural object class provided" Jul 13 13:12:59 msldap01 slapd2.4[7156]: connection_get(16) Jul 13 13:12:59 msldap01 slapd2.4[7156]: connection_get(17) So I tried to perform my initial task which was to add a CN to my top-level 'dc', I need to add a 'cn' for 'nisDomainObject' as SOlaris 10 expects this to be set. It fails with the same errors in phpLDAPadmin and the logfile says: Jul 14 09:13:33 msldap01 slapd2.4[7156]: connection_get(16) Jul 14 09:13:33 msldap01 slapd2.4[7156]: ==> bdb_bind: dn: cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com Jul 14 09:13:33 msldap01 slapd2.4[7156]: send_ldap_result: err=0 matched="" text="" Jul 14 09:13:33 msldap01 slapd2.4[7156]: connection_get(16) Jul 14 09:13:33 msldap01 slapd2.4[7156]: SRCH "dc=ldn,dc=sw,dc=com" 0 0 Jul 14 09:13:33 msldap01 slapd2.4[7156]: 0 0 0 Jul 14 09:13:33 msldap01 slapd2.4[7156]: filter: (objectClass=*) Jul 14 09:13:33 msldap01 slapd2.4[7156]: attrs: Jul 14 09:13:33 msldap01 slapd2.4[7156]: Jul 14 09:13:33 msldap01 slapd2.4[7156]: base_candidates: base: "dc=ldn,dc=sw,dc=com" (0x00000001) Jul 14 09:13:33 msldap01 slapd2.4[7156]: send_ldap_result: err=0 matched="" text="" Jul 14 09:13:33 msldap01 slapd2.4[7156]: connection_get(16) Jul 14 09:14:12 msldap01 slapd2.4[7156]: connection_get(16) Jul 14 09:14:12 msldap01 slapd2.4[7156]: ==> bdb_bind: dn: cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com Jul 14 09:14:12 msldap01 slapd2.4[7156]: send_ldap_result: err=0 matched="" text="" Jul 14 09:14:12 msldap01 slapd2.4[7156]: connection_get(16) Jul 14 09:14:12 msldap01 slapd2.4[7156]: conn=1023 op=1 do_add: dn (cn=MyDomainName,dc=ldn,dc=sw,dc=com) Jul 14 09:14:12 msldap01 slapd2.4[7156]: ==> bdb_add: cn=MyDomainName,dc=ldn,dc=sw,dc=com Jul 14 09:14:12 msldap01 slapd2.4[7156]: send_ldap_result: err=65 matched="" text="no structural object class provided" Jul 14 09:14:12 msldap01 slapd2.4[7156]: connection_get(16) If someone could tell me at least where to look that'd be great. Thanks, Stuart. From: stuart_cherrington(a)hotmail.co.uk To: openldap-technical(a)openldap.org Subject: DN failed to copy Date: Tue, 13 Jul 2010 10:37:11 +0000 Hi, Not sure if this is an issue with phpLDAPadmin 1.0.1 or Openldap2.4 (on rhel 5.3). I've created posixGroup's within my openLDAP and can see these within phpLDAPadmin, I was trying to copy the objects within my 'dc' prior to some invasive work, but I cannot copy the posixGroups. I have done copies of all other objects but posixGroup copy errors with: 'Failed to copy DN: cn=copydba,ou=group,dc=ldn,dc=sw,dc=com LDAP said: Object class violation Error number: 0x41 (LDAP_OBJECT_CLASS_VIOLATION) Description: You tried to perform an operation that would cause an undefined attribute to exist or that would remove a required attribute, given the current list of ObjectClasses. This can also occur if you do not specify a structural objectClass when creating an entry, or if you specify more than one structural objectClass.' Having looked through countless web pages it suggests that the posixGroup definition in the rfc2037bis.schema should have a MUST clause but it already has this: objectclass ( 1.3.6.1.1.1.2.2 NAME 'posixGroup' SUP top AUXILIARY DESC 'Abstraction of a group of accounts' MUST gidNumber MAY ( userPassword $ memberUid $ description ) ) Any advice would be great. Thanks, Stuart. Get a free e-mail account with Hotmail. Sign-up now. _________________________________________________________________ http://clk.atdmt.com/UKM/go/197222280/direct/01/ Do you have a story that started on Hotmail? Tell us now

3 3

Openldap Setup Master Slave + Samba pdc
by Sachin Gopal 15 Jul '10

15 Jul '10

Hi All, I am looking at setting up a Openldap + Smba pdc at 3 different locations with replication. I have these queries: 1. The three locations should have the same database. 2. Will it be one master and 2 slaves or is there something else which can be set ? 3. Will windows users be able to changepasswords(I understand that with freeIPA, never tried, any docs) 4.How is the replication possibile ? 5. Is it possibile. Thanks in advance. --Sac

2 1

Help with developing LDAP client
by Bryan Boone 14 Jul '10

14 Jul '10

Hi everyone. I am writting an LDAP client. I am able to simple bind, and simble bind over SSL. I am having trouble with getting options. I am kinda a noob to C programming. What am I doing wrong? Here is what I have. if ((ld = ldap_init(HOSTNAME, PORTNUMBER)) == NULL) { perror("ldap_init"); return (1); } version = LDAP_VERSION3; if (ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version) != LDAP_SUCCESS) { //rc = ldap_get_lderrno(ld, NULL, NULL); fprintf(stderr, "ldap_set_option: %s\n", ldap_err2string(rc)); ldap_unbind(ld); return (1); } ldap_start_tls_s(ld, NULL, NULL); char **temp; if (ldap_get_option(ld, LDAP_OPT_X_TLS_CACERTDIR, temp) != LDAP_SUCCESS) { ldap_perror(ld, "ldap_get_option"); return (1); } Everything works except I am having problems with the ldap_get_option. thanks

1 0

← Newer
1
...
4
5
6
7
8
9
10
...
13
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical July 2010