openldap-technical August 2010

openldap-technical@openldap.org

83 participants
85 discussions

Back-ldap and Nssov
by Mustafa A. Hashmi 05 Aug '10

05 Aug '10

Hi all, I am using Openldap 2.4.23 (on Ubuntu Hardy 8.04) to test nssov. Everything is working perfectly on the primary server, with user, group and host information being pulled from Openldap via nssov. Testing of authorized service / pam integration via slapd acls is also working correctly. On another Ubuntu Hardy system I setup back-ldap and nssov, and though it works perfectly (including logins/acls, etc), there appears to be some issue when running: getent group I simply get one group returned (there are 4 on the primary server), with the following recorded in the (back-ldap server) logs (debug set to -1): -- back-ldap log on `getent group` -- root@dev01:/opt/zivios/openldap/etc/openldap# getent group root:x:0: daemon:x:1: bin:x:2: sys:x:3: adm:x:4: tty:x:5: disk:x:6: lp:x:7: mail:x:8: news:x:9: uucp:x:10: man:x:12: proxy:x:13: kmem:x:15: dialout:x:20: fax:x:21: voice:x:22: cdrom:x:24: floppy:x:25: tape:x:26: sudo:x:27:zwebuser audio:x:29: dip:x:30: www-data:x:33: backup:x:34: operator:x:37: list:x:38: irc:x:39: src:x:40: gnats:x:41: shadow:x:42: utmp:x:43: video:x:44: sasl:x:45: plugdev:x:46: staff:x:50: games:x:60: users:x:100: nogroup:x:65534: libuuid:x:101: dhcp:x:102: syslog:x:103: klog:x:104: scanner:x:105: nvram:x:106: ssh:x:107: ntp:x:109: ssl-cert:x:110:zwebuser,zopenldap zwebgroup:x:950: zopenldap:x:945: mysql:x:108: daemon: activity on 1 descriptor daemon: activity on: 10r daemon: read active on 10 connection_get(10) connection_get(10): got connid=0 nssov: connection from uid=0 gid=0 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL nssov_group_all() str2filter "(objectClass=posixGroup)" put_filter: "(objectClass=posixGroup)" put_filter: simple put_simple_filter: "objectClass=posixGroup" begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0xb6db8010 ptr=0xb6db8010 end=0xb6db802b len=27 0000: a3 19 04 0b 6f 62 6a 65 63 74 43 6c 61 73 73 04 ....objectClass. 0010: 0a 70 6f 73 69 78 47 72 6f 75 70 .posixGroup end get_filter 0 =>ldap_back_getconn: conn 0x8d3b058 fetched refcnt=1. ldap_search_ext put_filter: "(objectClass=posixGroup)" put_filter: simple put_simple_filter: "objectClass=posixGroup" ldap_build_search_req ATTRS: cn userPassword gidNumber memberUid member ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x8d484a8 ptr=0x8d484a8 end=0x8d4851d len=117 0000: 30 73 02 01 04 63 6e 04 10 64 63 3d 7a 69 76 69 0s...cn..dc=zivi 0010: 6f 73 2c 64 63 3d 6e 65 74 0a 01 02 0a 01 00 02 os,dc=net....... 0020: 01 00 02 01 00 01 01 00 a3 19 04 0b 6f 62 6a 65 ............obje 0030: 63 74 43 6c 61 73 73 04 0a 70 6f 73 69 78 47 72 ctClass..posixGr 0040: 6f 75 70 30 30 04 02 63 6e 04 0c 75 73 65 72 50 oup00..cn..userP 0050: 61 73 73 77 6f 72 64 04 09 67 69 64 4e 75 6d 62 assword..gidNumb 0060: 65 72 04 09 6d 65 6d 62 65 72 55 69 64 04 06 6d er..memberUid..m 0070: 65 6d 62 65 72 ember ber_scanf fmt ({) ber: ber_dump: buf=0x8d484a8 ptr=0x8d484ad end=0x8d4851d len=112 0000: 63 6e 04 10 64 63 3d 7a 69 76 69 6f 73 2c 64 63 cn..dc=zivios,dc 0010: 3d 6e 65 74 0a 01 02 0a 01 00 02 01 00 02 01 00 =net............ 0020: 01 01 00 a3 19 04 0b 6f 62 6a 65 63 74 43 6c 61 .......objectCla 0030: 73 73 04 0a 70 6f 73 69 78 47 72 6f 75 70 30 30 ss..posixGroup00 0040: 04 02 63 6e 04 0c 75 73 65 72 50 61 73 73 77 6f ..cn..userPasswo 0050: 72 64 04 09 67 69 64 4e 75 6d 62 65 72 04 09 6d rd..gidNumber..m 0060: 65 6d 62 65 72 55 69 64 04 06 6d 65 6d 62 65 72 emberUid..member ber_flush2: 117 bytes to sd 12 0000: 30 73 02 01 04 63 6e 04 10 64 63 3d 7a 69 76 69 0s...cn..dc=zivi 0010: 6f 73 2c 64 63 3d 6e 65 74 0a 01 02 0a 01 00 02 os,dc=net....... 0020: 01 00 02 01 00 01 01 00 a3 19 04 0b 6f 62 6a 65 ............obje 0030: 63 74 43 6c 61 73 73 04 0a 70 6f 73 69 78 47 72 ctClass..posixGr 0040: 6f 75 70 30 30 04 02 63 6e 04 0c 75 73 65 72 50 oup00..cn..userP 0050: 61 73 73 77 6f 72 64 04 09 67 69 64 4e 75 6d 62 assword..gidNumb 0060: 65 72 04 09 6d 65 6d 62 65 72 55 69 64 04 06 6d er..memberUid..m 0070: 65 6d 62 65 72 ember ldap_write: want=117, written=117 0000: 30 73 02 01 04 63 6e 04 10 64 63 3d 7a 69 76 69 0s...cn..dc=zivi 0010: 6f 73 2c 64 63 3d 6e 65 74 0a 01 02 0a 01 00 02 os,dc=net....... 0020: 01 00 02 01 00 01 01 00 a3 19 04 0b 6f 62 6a 65 ............obje 0030: 63 74 43 6c 61 73 73 04 0a 70 6f 73 69 78 47 72 ctClass..posixGr 0040: 6f 75 70 30 30 04 02 63 6e 04 0c 75 73 65 72 50 oup00..cn..userP 0050: 61 73 73 77 6f 72 64 04 09 67 69 64 4e 75 6d 62 assword..gidNumb 0060: 65 72 04 09 6d 65 6d 62 65 72 55 69 64 04 06 6d er..memberUid..m 0070: 65 6d 62 65 72 ember ldap_result ld 0x8d48288 msgid 4 wait4msg ld 0x8d48288 msgid 4 (timeout 100000 usec) wait4msg continue ld 0x8d48288 msgid 4 all 0 ** ld 0x8d48288 Connections: * host: dev02.zivios.net port: 389 (default) refcnt: 2 status: Connected last used: Wed Aug 4 17:21:55 2010 ** ld 0x8d48288 Outstanding Requests: * msgid 4, origid 4, status InProgress outstanding referrals 0, parent count 0 ld 0x8d48288 request count 1 (abandoned 0) ** ld 0x8d48288 Response Queue: Empty ld 0x8d48288 response count 0 ldap_chkResponseList ld 0x8d48288 msgid 4 all 0 ldap_chkResponseList returns ld 0x8d48288 NULL ldap_int_select read1msg: ld 0x8d48288 msgid 4 all 0 ber_get_next ldap_read: want=8, got=8 0000: 30 82 01 26 02 01 04 64 0..&...d ldap_read: want=290, got=290 0000: 82 01 1f 04 26 63 6e 3d 65 63 6c 73 74 61 66 66 ....&cn=eclstaff 0010: 2c 6f 75 3d 67 72 6f 75 70 73 2c 64 63 3d 7a 69 ,ou=groups,dc=zi 0020: 76 69 6f 73 2c 64 63 3d 6e 65 74 30 81 f4 30 13 vios,dc=net0..0. 0030: 04 09 67 69 64 4e 75 6d 62 65 72 31 06 04 04 33 ..gidNumber1...3 0040: 30 30 30 30 10 04 02 63 6e 31 0a 04 08 65 63 6c 0000...cn1...ecl 0050: 73 74 61 66 66 30 81 ca 04 06 6d 65 6d 62 65 72 staff0....member 0060: 31 81 bf 04 25 75 69 64 3d 6d 68 61 73 68 6d 69 1...%uid=mhashmi 0070: 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d 7a 69 76 ,ou=users,dc=ziv 0080: 69 6f 73 2c 64 63 3d 6e 65 74 04 23 75 69 64 3d ios,dc=net.#uid= 0090: 66 6b 68 61 6e 2c 6f 75 3d 75 73 65 72 73 2c 64 fkhan,ou=users,d 00a0: 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 04 c=zivios,dc=net. 00b0: 25 75 69 64 3d 6a 61 62 62 61 73 69 2c 6f 75 3d %uid=jabbasi,ou= 00c0: 75 73 65 72 73 2c 64 63 3d 7a 69 76 69 6f 73 2c users,dc=zivios, 00d0: 64 63 3d 6e 65 74 04 25 75 69 64 3d 7a 73 68 61 dc=net.%uid=zsha 00e0: 69 6b 68 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d ikh,ou=users,dc= 00f0: 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 04 23 75 zivios,dc=net.#u 0100: 69 64 3d 61 6b 68 61 6e 2c 6f 75 3d 75 73 65 72 id=akhan,ou=user 0110: 73 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e s,dc=zivios,dc=n 0120: 65 74 et ber_get_next: tag 0x30 len 294 contents: ber_dump: buf=0x8d496d0 ptr=0x8d496d0 end=0x8d497f6 len=294 0000: 02 01 04 64 82 01 1f 04 26 63 6e 3d 65 63 6c 73 ...d....&cn=ecls 0010: 74 61 66 66 2c 6f 75 3d 67 72 6f 75 70 73 2c 64 taff,ou=groups,d 0020: 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 30 c=zivios,dc=net0 0030: 81 f4 30 13 04 09 67 69 64 4e 75 6d 62 65 72 31 ..0...gidNumber1 0040: 06 04 04 33 30 30 30 30 10 04 02 63 6e 31 0a 04 ...30000...cn1.. 0050: 08 65 63 6c 73 74 61 66 66 30 81 ca 04 06 6d 65 .eclstaff0....me 0060: 6d 62 65 72 31 81 bf 04 25 75 69 64 3d 6d 68 61 mber1...%uid=mha 0070: 73 68 6d 69 2c 6f 75 3d 75 73 65 72 73 2c 64 63 shmi,ou=users,dc 0080: 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 04 23 =zivios,dc=net.# 0090: 75 69 64 3d 66 6b 68 61 6e 2c 6f 75 3d 75 73 65 uid=fkhan,ou=use 00a0: 72 73 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d rs,dc=zivios,dc= 00b0: 6e 65 74 04 25 75 69 64 3d 6a 61 62 62 61 73 69 net.%uid=jabbasi 00c0: 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d 7a 69 76 ,ou=users,dc=ziv 00d0: 69 6f 73 2c 64 63 3d 6e 65 74 04 25 75 69 64 3d ios,dc=net.%uid= 00e0: 7a 73 68 61 69 6b 68 2c 6f 75 3d 75 73 65 72 73 zshaikh,ou=users 00f0: 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 ,dc=zivios,dc=ne 0100: 74 04 23 75 69 64 3d 61 6b 68 61 6e 2c 6f 75 3d t.#uid=akhan,ou= 0110: 75 73 65 72 73 2c 64 63 3d 7a 69 76 69 6f 73 2c users,dc=zivios, 0120: 64 63 3d 6e 65 74 dc=net read1msg: ld 0x8d48288 msgid 4 message type search-entry ber_scanf fmt ({m) ber: ber_dump: buf=0x8d496d0 ptr=0x8d496d3 end=0x8d497f6 len=291 0000: 64 82 01 1f 04 26 63 6e 3d 65 63 6c 73 74 61 66 d....&cn=eclstaf 0010: 66 2c 6f 75 3d 67 72 6f 75 70 73 2c 64 63 3d 7a f,ou=groups,dc=z 0020: 69 76 69 6f 73 2c 64 63 3d 6e 65 74 30 81 f4 30 ivios,dc=net0..0 0030: 13 04 09 67 69 64 4e 75 6d 62 65 72 31 06 04 04 ...gidNumber1... 0040: 33 30 30 30 30 10 04 02 63 6e 31 0a 04 08 65 63 30000...cn1...ec 0050: 6c 73 74 61 66 66 30 81 ca 04 06 6d 65 6d 62 65 lstaff0....membe 0060: 72 31 81 bf 04 25 75 69 64 3d 6d 68 61 73 68 6d r1...%uid=mhashm 0070: 69 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d 7a 69 i,ou=users,dc=zi 0080: 76 69 6f 73 2c 64 63 3d 6e 65 74 04 23 75 69 64 vios,dc=net.#uid 0090: 3d 66 6b 68 61 6e 2c 6f 75 3d 75 73 65 72 73 2c =fkhan,ou=users, 00a0: 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 dc=zivios,dc=net 00b0: 04 25 75 69 64 3d 6a 61 62 62 61 73 69 2c 6f 75 .%uid=jabbasi,ou 00c0: 3d 75 73 65 72 73 2c 64 63 3d 7a 69 76 69 6f 73 =users,dc=zivios 00d0: 2c 64 63 3d 6e 65 74 04 25 75 69 64 3d 7a 73 68 ,dc=net.%uid=zsh 00e0: 61 69 6b 68 2c 6f 75 3d 75 73 65 72 73 2c 64 63 aikh,ou=users,dc 00f0: 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 04 23 =zivios,dc=net.# 0100: 75 69 64 3d 61 6b 68 61 6e 2c 6f 75 3d 75 73 65 uid=akhan,ou=use 0110: 72 73 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d rs,dc=zivios,dc= 0120: 6e 65 74 net >>> dnPrettyNormal: <cn=eclstaff,ou=groups,dc=zivios,dc=net> => ldap_bv2dn(cn=eclstaff,ou=groups,dc=zivios,dc=net,0) <= ldap_bv2dn(cn=eclstaff,ou=groups,dc=zivios,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=eclstaff,ou=groups,dc=zivios,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=eclstaff,ou=groups,dc=zivios,dc=net)=0 <<< dnPrettyNormal: <cn=eclstaff,ou=groups,dc=zivios,dc=net>, <cn=eclstaff,ou=groups,dc=zivios,dc=net> ber_scanf fmt ({m) ber: ber_dump: buf=0x8d496d0 ptr=0x8d49702 end=0x8d497f6 len=244 0000: 30 13 04 09 67 69 64 4e 75 6d 62 65 72 31 06 04 0...gidNumber1.. 0010: 04 33 30 30 30 30 10 04 02 63 6e 31 0a 04 08 65 .30000...cn1...e 0020: 63 6c 73 74 61 66 66 30 81 ca 04 06 6d 65 6d 62 clstaff0....memb 0030: 65 72 31 81 bf 04 25 75 69 64 3d 6d 68 61 73 68 er1...%uid=mhash 0040: 6d 69 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d 7a mi,ou=users,dc=z 0050: 69 76 69 6f 73 2c 64 63 3d 6e 65 74 04 23 75 69 ivios,dc=net.#ui 0060: 64 3d 66 6b 68 61 6e 2c 6f 75 3d 75 73 65 72 73 d=fkhan,ou=users 0070: 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 ,dc=zivios,dc=ne 0080: 74 04 25 75 69 64 3d 6a 61 62 62 61 73 69 2c 6f t.%uid=jabbasi,o 0090: 75 3d 75 73 65 72 73 2c 64 63 3d 7a 69 76 69 6f u=users,dc=zivio 00a0: 73 2c 64 63 3d 6e 65 74 04 25 75 69 64 3d 7a 73 s,dc=net.%uid=zs 00b0: 68 61 69 6b 68 2c 6f 75 3d 75 73 65 72 73 2c 64 haikh,ou=users,d 00c0: 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 04 c=zivios,dc=net. 00d0: 23 75 69 64 3d 61 6b 68 61 6e 2c 6f 75 3d 75 73 #uid=akhan,ou=us 00e0: 65 72 73 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 ers,dc=zivios,dc 00f0: 3d 6e 65 74 =net ber_scanf fmt ([W]) ber: ber_dump: buf=0x8d496d0 ptr=0x8d4970f end=0x8d497f6 len=231 0000: 00 06 04 04 33 30 30 30 30 10 04 02 63 6e 31 0a ....30000...cn1. 0010: 04 08 65 63 6c 73 74 61 66 66 30 81 ca 04 06 6d ..eclstaff0....m 0020: 65 6d 62 65 72 31 81 bf 04 25 75 69 64 3d 6d 68 ember1...%uid=mh 0030: 61 73 68 6d 69 2c 6f 75 3d 75 73 65 72 73 2c 64 ashmi,ou=users,d 0040: 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 04 c=zivios,dc=net. 0050: 23 75 69 64 3d 66 6b 68 61 6e 2c 6f 75 3d 75 73 #uid=fkhan,ou=us 0060: 65 72 73 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 ers,dc=zivios,dc 0070: 3d 6e 65 74 04 25 75 69 64 3d 6a 61 62 62 61 73 =net.%uid=jabbas 0080: 69 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d 7a 69 i,ou=users,dc=zi 0090: 76 69 6f 73 2c 64 63 3d 6e 65 74 04 25 75 69 64 vios,dc=net.%uid 00a0: 3d 7a 73 68 61 69 6b 68 2c 6f 75 3d 75 73 65 72 =zshaikh,ou=user 00b0: 73 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e s,dc=zivios,dc=n 00c0: 65 74 04 23 75 69 64 3d 61 6b 68 61 6e 2c 6f 75 et.#uid=akhan,ou 00d0: 3d 75 73 65 72 73 2c 64 63 3d 7a 69 76 69 6f 73 =users,dc=zivios 00e0: 2c 64 63 3d 6e 65 74 ,dc=net ber_scanf fmt ({m) ber: ber_dump: buf=0x8d496d0 ptr=0x8d49717 end=0x8d497f6 len=223 0000: 30 10 04 02 63 6e 31 0a 04 08 65 63 6c 73 74 61 0...cn1...eclsta 0010: 66 66 30 81 ca 04 06 6d 65 6d 62 65 72 31 81 bf ff0....member1.. 0020: 04 25 75 69 64 3d 6d 68 61 73 68 6d 69 2c 6f 75 .%uid=mhashmi,ou 0030: 3d 75 73 65 72 73 2c 64 63 3d 7a 69 76 69 6f 73 =users,dc=zivios 0040: 2c 64 63 3d 6e 65 74 04 23 75 69 64 3d 66 6b 68 ,dc=net.#uid=fkh 0050: 61 6e 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d 7a an,ou=users,dc=z 0060: 69 76 69 6f 73 2c 64 63 3d 6e 65 74 04 25 75 69 ivios,dc=net.%ui 0070: 64 3d 6a 61 62 62 61 73 69 2c 6f 75 3d 75 73 65 d=jabbasi,ou=use 0080: 72 73 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d rs,dc=zivios,dc= 0090: 6e 65 74 04 25 75 69 64 3d 7a 73 68 61 69 6b 68 net.%uid=zshaikh 00a0: 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d 7a 69 76 ,ou=users,dc=ziv 00b0: 69 6f 73 2c 64 63 3d 6e 65 74 04 23 75 69 64 3d ios,dc=net.#uid= 00c0: 61 6b 68 61 6e 2c 6f 75 3d 75 73 65 72 73 2c 64 akhan,ou=users,d 00d0: 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 c=zivios,dc=net ber_scanf fmt ([W]) ber: ber_dump: buf=0x8d496d0 ptr=0x8d4971d end=0x8d497f6 len=217 0000: 00 0a 04 08 65 63 6c 73 74 61 66 66 30 81 ca 04 ....eclstaff0... 0010: 06 6d 65 6d 62 65 72 31 81 bf 04 25 75 69 64 3d .member1...%uid= 0020: 6d 68 61 73 68 6d 69 2c 6f 75 3d 75 73 65 72 73 mhashmi,ou=users 0030: 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 ,dc=zivios,dc=ne 0040: 74 04 23 75 69 64 3d 66 6b 68 61 6e 2c 6f 75 3d t.#uid=fkhan,ou= 0050: 75 73 65 72 73 2c 64 63 3d 7a 69 76 69 6f 73 2c users,dc=zivios, 0060: 64 63 3d 6e 65 74 04 25 75 69 64 3d 6a 61 62 62 dc=net.%uid=jabb 0070: 61 73 69 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d asi,ou=users,dc= 0080: 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 04 25 75 zivios,dc=net.%u 0090: 69 64 3d 7a 73 68 61 69 6b 68 2c 6f 75 3d 75 73 id=zshaikh,ou=us 00a0: 65 72 73 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 ers,dc=zivios,dc 00b0: 3d 6e 65 74 04 23 75 69 64 3d 61 6b 68 61 6e 2c =net.#uid=akhan, 00c0: 6f 75 3d 75 73 65 72 73 2c 64 63 3d 7a 69 76 69 ou=users,dc=zivi 00d0: 6f 73 2c 64 63 3d 6e 65 74 os,dc=net ber_scanf fmt ({m) ber: ber_dump: buf=0x8d496d0 ptr=0x8d49729 end=0x8d497f6 len=205 0000: 30 81 ca 04 06 6d 65 6d 62 65 72 31 81 bf 04 25 0....member1...% 0010: 75 69 64 3d 6d 68 61 73 68 6d 69 2c 6f 75 3d 75 uid=mhashmi,ou=u 0020: 73 65 72 73 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 sers,dc=zivios,d 0030: 63 3d 6e 65 74 04 23 75 69 64 3d 66 6b 68 61 6e c=net.#uid=fkhan 0040: 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d 7a 69 76 ,ou=users,dc=ziv 0050: 69 6f 73 2c 64 63 3d 6e 65 74 04 25 75 69 64 3d ios,dc=net.%uid= 0060: 6a 61 62 62 61 73 69 2c 6f 75 3d 75 73 65 72 73 jabbasi,ou=users 0070: 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 ,dc=zivios,dc=ne 0080: 74 04 25 75 69 64 3d 7a 73 68 61 69 6b 68 2c 6f t.%uid=zshaikh,o 0090: 75 3d 75 73 65 72 73 2c 64 63 3d 7a 69 76 69 6f u=users,dc=zivio 00a0: 73 2c 64 63 3d 6e 65 74 04 23 75 69 64 3d 61 6b s,dc=net.#uid=ak 00b0: 68 61 6e 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d han,ou=users,dc= 00c0: 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 zivios,dc=net ber_scanf fmt ([W]) ber: ber_dump: buf=0x8d496d0 ptr=0x8d49734 end=0x8d497f6 len=194 0000: 00 81 bf 04 25 75 69 64 3d 6d 68 61 73 68 6d 69 ....%uid=mhashmi 0010: 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d 7a 69 76 ,ou=users,dc=ziv 0020: 69 6f 73 2c 64 63 3d 6e 65 74 04 23 75 69 64 3d ios,dc=net.#uid= 0030: 66 6b 68 61 6e 2c 6f 75 3d 75 73 65 72 73 2c 64 fkhan,ou=users,d 0040: 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 04 c=zivios,dc=net. 0050: 25 75 69 64 3d 6a 61 62 62 61 73 69 2c 6f 75 3d %uid=jabbasi,ou= 0060: 75 73 65 72 73 2c 64 63 3d 7a 69 76 69 6f 73 2c users,dc=zivios, 0070: 64 63 3d 6e 65 74 04 25 75 69 64 3d 7a 73 68 61 dc=net.%uid=zsha 0080: 69 6b 68 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d ikh,ou=users,dc= 0090: 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 04 23 75 zivios,dc=net.#u 00a0: 69 64 3d 61 6b 68 61 6e 2c 6f 75 3d 75 73 65 72 id=akhan,ou=user 00b0: 73 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e s,dc=zivios,dc=n 00c0: 65 74 et >>> dnPretty: <uid=mhashmi,ou=users,dc=zivios,dc=net> => ldap_bv2dn(uid=mhashmi,ou=users,dc=zivios,dc=net,0) <= ldap_bv2dn(uid=mhashmi,ou=users,dc=zivios,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=mhashmi,ou=users,dc=zivios,dc=net)=0 <<< dnPretty: <uid=mhashmi,ou=users,dc=zivios,dc=net> >>> dnPretty: <uid=fkhan,ou=users,dc=zivios,dc=net> => ldap_bv2dn(uid=fkhan,ou=users,dc=zivios,dc=net,0) <= ldap_bv2dn(uid=fkhan,ou=users,dc=zivios,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=fkhan,ou=users,dc=zivios,dc=net)=0 <<< dnPretty: <uid=fkhan,ou=users,dc=zivios,dc=net> >>> dnPretty: <uid=jabbasi,ou=users,dc=zivios,dc=net> => ldap_bv2dn(uid=jabbasi,ou=users,dc=zivios,dc=net,0) <= ldap_bv2dn(uid=jabbasi,ou=users,dc=zivios,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=jabbasi,ou=users,dc=zivios,dc=net)=0 <<< dnPretty: <uid=jabbasi,ou=users,dc=zivios,dc=net> >>> dnPretty: <uid=zshaikh,ou=users,dc=zivios,dc=net> => ldap_bv2dn(uid=zshaikh,ou=users,dc=zivios,dc=net,0) <= ldap_bv2dn(uid=zshaikh,ou=users,dc=zivios,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=zshaikh,ou=users,dc=zivios,dc=net)=0 <<< dnPretty: <uid=zshaikh,ou=users,dc=zivios,dc=net> >>> dnPretty: <uid=akhan,ou=users,dc=zivios,dc=net> => ldap_bv2dn(uid=akhan,ou=users,dc=zivios,dc=net,0) <= ldap_bv2dn(uid=akhan,ou=users,dc=zivios,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=akhan,ou=users,dc=zivios,dc=net)=0 <<< dnPretty: <uid=akhan,ou=users,dc=zivios,dc=net> >>> dnNormalize: <uid=mhashmi,ou=users,dc=zivios,dc=net> => ldap_bv2dn(uid=mhashmi,ou=users,dc=zivios,dc=net,0) <= ldap_bv2dn(uid=mhashmi,ou=users,dc=zivios,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=mhashmi,ou=users,dc=zivios,dc=net)=0 <<< dnNormalize: <uid=mhashmi,ou=users,dc=zivios,dc=net> >>> dnNormalize: <uid=fkhan,ou=users,dc=zivios,dc=net> => ldap_bv2dn(uid=fkhan,ou=users,dc=zivios,dc=net,0) <= ldap_bv2dn(uid=fkhan,ou=users,dc=zivios,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=fkhan,ou=users,dc=zivios,dc=net)=0 <<< dnNormalize: <uid=fkhan,ou=users,dc=zivios,dc=net> >>> dnNormalize: <uid=jabbasi,ou=users,dc=zivios,dc=net> => ldap_bv2dn(uid=jabbasi,ou=users,dc=zivios,dc=net,0) <= ldap_bv2dn(uid=jabbasi,ou=users,dc=zivios,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=jabbasi,ou=users,dc=zivios,dc=net)=0 <<< dnNormalize: <uid=jabbasi,ou=users,dc=zivios,dc=net> >>> dnNormalize: <uid=zshaikh,ou=users,dc=zivios,dc=net> => ldap_bv2dn(uid=zshaikh,ou=users,dc=zivios,dc=net,0) <= ldap_bv2dn(uid=zshaikh,ou=users,dc=zivios,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=zshaikh,ou=users,dc=zivios,dc=net)=0 <<< dnNormalize: <uid=zshaikh,ou=users,dc=zivios,dc=net> >>> dnNormalize: <uid=akhan,ou=users,dc=zivios,dc=net> => ldap_bv2dn(uid=akhan,ou=users,dc=zivios,dc=net,0) <= ldap_bv2dn(uid=akhan,ou=users,dc=zivios,dc=net)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=akhan,ou=users,dc=zivios,dc=net)=0 <<< dnNormalize: <uid=akhan,ou=users,dc=zivios,dc=net> ber_scanf fmt ({xx) ber: ber_dump: buf=0x8d496d0 ptr=0x8d496d3 end=0x8d497f6 len=291 0000: 64 82 01 1f 04 26 63 6e 3d 65 63 6c 73 74 61 66 d....&cn=eclstaf 0010: 66 2c 6f 75 3d 67 72 6f 75 70 73 2c 64 63 3d 7a f,ou=groups,dc=z 0020: 69 76 69 6f 73 2c 64 63 3d 6e 65 74 00 81 f4 30 ivios,dc=net...0 0030: 13 04 09 67 69 64 4e 75 6d 62 65 72 00 06 04 04 ...gidNumber.... 0040: 33 30 30 30 30 10 04 02 63 6e 00 0a 04 08 65 63 30000...cn....ec 0050: 6c 73 74 61 66 66 30 81 ca 04 06 6d 65 6d 62 65 lstaff0....membe 0060: 72 00 81 bf 04 25 75 69 64 3d 6d 68 61 73 68 6d r....%uid=mhashm 0070: 69 2c 6f 75 3d 75 73 65 72 73 2c 64 63 3d 7a 69 i,ou=users,dc=zi 0080: 76 69 6f 73 2c 64 63 3d 6e 65 74 04 23 75 69 64 vios,dc=net.#uid 0090: 3d 66 6b 68 61 6e 2c 6f 75 3d 75 73 65 72 73 2c =fkhan,ou=users, 00a0: 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 dc=zivios,dc=net 00b0: 04 25 75 69 64 3d 6a 61 62 62 61 73 69 2c 6f 75 .%uid=jabbasi,ou 00c0: 3d 75 73 65 72 73 2c 64 63 3d 7a 69 76 69 6f 73 =users,dc=zivios 00d0: 2c 64 63 3d 6e 65 74 04 25 75 69 64 3d 7a 73 68 ,dc=net.%uid=zsh 00e0: 61 69 6b 68 2c 6f 75 3d 75 73 65 72 73 2c 64 63 aikh,ou=users,dc 00f0: 3d 7a 69 76 69 6f 73 2c 64 63 3d 6e 65 74 04 23 =zivios,dc=net.# 0100: 75 69 64 3d 61 6b 68 61 6e 2c 6f 75 3d 75 73 65 uid=akhan,ou=use 0110: 72 73 2c 64 63 3d 7a 69 76 69 6f 73 2c 64 63 3d rs,dc=zivios,dc= 0120: 6e 65 74 net ldap_msgfree ldap_abandon_ext 4 do_abandon origid 4, msgid 4 ldap_msgdelete ld=0x8d48288 msgid=4 ber_flush2: 8 bytes to sd 12 0000: 30 06 02 01 05 50 01 04 0....P.. ldap_write: want=8, written=8 0000: 30 06 02 01 05 50 01 04 0....P.. ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_free_request (origid 4, msgid 4) send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=80 matched="" text="" -- The output is simply: eclstaff:*:3000:mhashmi,fkhan,jabbasi,zshaikh,akhan On the primary server however, I see all 4 group entries are sent during the request: conn=1000 op=5 ENTRY dn="cn=eclstaff,ou=groups,dc=zivios,dc=net" conn=1000 op=5 ENTRY dn="cn=sysadmin,ou=groups,dc=zivios,dc=net" conn=1000 op=5 ENTRY dn="cn=mailadmin,ou=groups,dc=zivios,dc=net" conn=1000 op=5 ENTRY dn="cn=finance,ou=groups,dc=zivios,dc=net" On the back-ldap server, probing a single group works, albeit, with the same err=80 being logged. getent passwd & hosts works perfectly. Please find below the relevant configuration sections of my primary slapd.conf, the back-ldap slapd.conf as well as sample user and group entries: === primary server slapd.conf === database hdb #overlay smbk5pwd overlay unique overlay nssov suffix "dc=zivios,dc=net" rootdn "cn=admin,dc=zivios,dc=net" rootpw foo # nssov config nssov-map group uniqueMember member nssov-ssd passwd ldap:///dc=zivios,dc=net??sub nssov-ssd group ldap:///dc=zivios,dc=net??sub nssov-ssd hosts ldap:///dc=zivios,dc=net??sub nssov-pam hostservice nssov-pam-session sshd nssov-pam-session login === Back-ldap slapd.conf === database ldap suffix dc=zivios,dc=net uri "ldap://dev02.zivios.net" acl-bind bindmethod=simple binddn="" credentials="" idassert-bind bindmethod=simple binddn="cn=admin,dc=zivios,dc=net" // just for testing... credentials="foo" mode=none flags=non-prescriptive overlay nssov nssov-map group uniqueMember member nssov-ssd passwd ldap:///dc=zivios,dc=net??sub nssov-ssd group ldap:///dc=zivios,dc=net??sub nssov-ssd hosts ldap:///dc=zivios,dc=net??sub nssov-pam hostservice nssov-pam-session sshd nssov-pam-session login lastmod off === 2 sample groups === dn: cn=eclstaff,ou=groups,dc=zivios,dc=net objectClass: groupOfNames objectClass: posixGroup gidNumber: 3000 description: Emergen Staff cn: eclstaff member: uid=mhashmi,ou=users,dc=zivios,dc=net member: uid=fkhan,ou=users,dc=zivios,dc=net member: uid=jabbasi,ou=users,dc=zivios,dc=net member: uid=zshaikh,ou=users,dc=zivios,dc=net member: uid=akhan,ou=users,dc=zivios,dc=net dn: cn=sysadmin,ou=groups,dc=zivios,dc=net objectClass: groupOfNames objectClass: posixGroup gidNumber: 3001 description: Administrator cn: sysadmin member: uid=mhashmi,ou=users,dc=zivios,dc=net member: uid=fkhan,ou=users,dc=zivios,dc=net === 2 sample users === dn: uid=mhashmi,ou=users,dc=zivios,dc=net cn: Mustafa Hashmi gidnumber: 3000 givenname: Mustafa homedirectory: /home/mhashmi objectclass: inetOrgPerson objectclass: posixAccount objectclass: shadowAccount ou: Users sn: Hashmi uid: mhashmi uidnumber: 5050 userpassword: foo dn: uid=fkhan,ou=users,dc=zivios,dc=net cn: Faraz Khan gidnumber: 3000 givenname: Faraz homedirectory: /home/fkhan objectclass: inetOrgPerson objectclass: posixAccount objectclass: shadowAccount ou: Users sn: Khan uid: fkhan uidnumber: 5051 userpassword: foo === Please note: running a ldapsearch on the back-ldap server for groups works correctly and all entries are returned. I am at a bit of loss here -- if anyone can tell me how to debug this further, it would be greatly appreciated. Many thanks, Mustafa.

2 2

Incorrect NetBios Hostname on LDAP packet
by Przemek Jagieła 05 Aug '10

05 Aug '10

Hello I install Samba 4.0.0 alpha 12 on Ubuntu 9.10 and configured as PDC. When I want join windows to domain I get error message: It’s unable to communicate with domain controller for domain firma.local. Query DNS resource record for the service location (SRV) used to locate a domain controller for domain firma.local was successful. The query was for the SRV record for _ldap._tcp.dc._msdcs.firma.local The query identified the following domain controllers: Przemek-laptop.firma.local The most common causes of this error are: - host (A) records that map the name of the domain controller to IP addresses are missing or contain incorrect addresses. - Domain controllers registered in DNS are not connected to the network or do not work. In smb.conf file netbios name is “PRZEMEK-LAPTOP”. In captured packet in line 6 on the CLDAP packet from server to client http://www.psalask.cba.pl/foto1.jpg I saw that NetBios Hostname is “\\PRZEMEK-LAPTOP” http://www.psalask.cba.pl/foto2.jpg . NetBios Hostname is taken by LDAP from smb.conf because when I change netbios name on this file, CLDAP packet is changing to. I include captured packet from attempt to connect to domain on Samba 4 www.psalask.cba.pl/packet_samba4.pcap <http://www.psalask.cba.pl/packet_samba4.pcap> To compare I include captured packets from connection to the same domain on Active Directory in Windows 2003 http://psalask.cba.pl/packets_AD_windows2003.pcap My question is: How can I remove “\\” from NetBios Hostname on CLDAP packet? Thanks -- Pozdrawiam Przemysław Jagieła

1 0

Proxycache overlay to back-ldap with cn=config
by Nicolas Brisac 04 Aug '10

04 Aug '10

Hi, I'm trying to set up a proxy-cache to a couple of OpenLDAP servers configured in mirror mode. The back-ldap part is working fine and I can query the underlying slapd instances through the proxy. However, I'm still struggling with the caching bit. I couldn't find any documentation or posts related to setting this up using the new cn=config way of configuring LDAP. So after some reading and a bit of guessing, I came up with the following config: # {1}ldap, config dn: olcDatabase={1}ldap,cn=config objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {1}ldap olcSuffix: dc=sol1,dc=net olcAccess: {0}to dn.base="" by * read olcAccess: {1}to dn.base="cn=Subschema" by * read olcAccess: {2}to * by self write by users read by anonymous auth olcRootDN: uid=ldapadmin,dc=sol1,dc=net olcRootPW: secret olcDbURI: "ldap://192.168.200.12 ldap://192.168.200.14" olcDbACLBind: bindmethod=simple binddn="uid=ldapadmin,dc=sol1,dc=net" credentials="secret" starttls=no # {0}pcache, {1}ldap, config dn: olcOverlay={0}pcache,olcDatabase={1}ldap,cn=config objectClass: olcOverlayConfig objectClass: olcPcacheConfig olcOverlay: {0}pcache olcPcache: bdb 10000 3 1000 100 olcPcacheAttrset: 0 uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass olcPcacheAttrset: 1 sudoCommand sudoHost olcPcacheAttrset: 2 gidNumber olcPcacheTemplate: (&(objectClass=)(uid=)) 0 300 olcPcacheTemplate: (sudoUser=) 1 300 olcPcacheTemplate: (&(objectClass=)(memberUid=)) 2 300 # {2}bdb, config dn: olcDatabase={2}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcDbDirectory: /var/lib/ldap/cache olcSuffix: cn=proxy olcRootDN: uid=ldapadmin,dc=sol1,dc=net olcDbCacheSize: 5000 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: uid eq olcDbIndex: cn eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: memberUid eq olcDbIndex: uniqueMember eq olcDbIndex: mail eq olcDbIndex: surname eq olcDbIndex: givenname eq olcDbIndex: sambaSID eq olcDbIndex: sambaPrimaryGroupSID eq olcDbIndex: sambaDomainName eq olcDbIndex: sudoUser eq But running ldapsearch keeps returning: # search result search: 2 result: 52 Server is unavailable text: pcachePrivDB: cacheDB not available I didn't find any way to specify which database to use when declaring the overlay, apart from the 'bdb' part of olcPcache, but that seems to be interpreted as the database type, not its name (I've tried replacing it with cn=proxy, but that throws an error). Looking at the pcache overlay source (I'm running 2.4.21 from Ubuntu Lucid and also checked the latest 2.4.23 stable source), I can see this bit: { "pcache-", "private database args", 1, 0, STRLENOF("pcache-"), ARG_MAGIC|PC_PRIVATE_DB, pc_cf_gen, NULL, NULL, NULL }, That seems to be for the private DB options, but the other equivalent "pcacheXXXX" in this file have the corresponding attribute declaration for the schema instead of 'NULL, NULL, NULL'. Anyway, I'm obviously missing something :) If someone who's got this working or a developer could point me in the right direction, that would be greatly appreciated! Thanks, Nico

1 1

using ldap to control access to other services
by William Cai 04 Aug '10

04 Aug '10

Hi List, I have been using LDAP for some time. The LDAP server is mainly used to store user information. Today I heard that LDAP can be used to control access to other services. More specific, "The way it works is that your (or any other) app calls LDAP with like "I am user A, here is my ticket, so what I can do?" and then LDAP responds: "User A has a type X and can access B, C and D function, but can not access X, Y and Z function". So your app realizes that "Type X can access today and tomorrow, but not day after tomorrow" etc." I went through OpenLDAP document http://www.openldap.org/doc/admin24/access-control.html. But seems it focuses on how to control the access to LDAP server itself. Could anybody show me how to implement this? 1. Do I need to model the business environment in LDAP? e.g. create a node for each function point. 2. What is the programming model? Can I use Java interface to retrieve these permission information? 3. Is it OpenLDAP specific function or LDAP common function? Thanks, William

3 2

Webmin LDAP User Module Don't Wor
by Andrea Minardi 04 Aug '10

04 Aug '10

Webmin's LDAP Users and Groups module stopped working after upgrading from Webmin 1.400 to webmin 1.510 I have been using Webmin's LDAP Users and Groups module on my company's server to administer users. It was working fine on Webmin 1.400, but after upgrading I get the error: "Webmin has connected to the LDAP server, but failed to fetch the schema. Make sure that access has not been denied in the LDAP Server module." I work with OpenLDAP 2.3.27 on Red Hat 5. Thanks. Andrea Minardi

3 2

Re: Unclear attribute: entry
by Dieter Kluenter 04 Aug '10

04 Aug '10

Klaus Ethgen <klaus+usenet(a)ethgen.de> writes: > Hello, > > I have to admit that I do not know what exactly the entry attribute (and > partly the children attribute too) is for. I know that it is needed to > give access to any other attribute but that is not enough for me as I > want to _know_ what it is for. > > Unfortunately I did not find a more clear description of this attribute > than "scope limited to this entry" which is somewhat meaningless for me. > > So my question is what is the rights that are needed for which entry > attribute (in tree) to allow read, write, search or other access to > other attributes? > > Please excuse that I did crosspost this question to three groups as > there is no user group and g.n.o.general is very empty so it was not > clear if it is read at all. entry and children are so called pseudo attributes. They are mainly used to allow access to children of an entry. As example you have an entry ou=users,dc=example,dc=com and want to allow access to children of this entry but no read or write access to the entry itself, a rule set could be access to dn.onelevel=ou=users,dc=example,dc=com by users write by anonymous auth access to dn.base=ou=users,dc=example,dc=com attrs=entry,children by users write by anonymous auth -Dieter -- Dieter Klünter | Systemberatung sip: 7770535(a)sipgate.de http://www.dpunkt.de/buecher/2104.html GPG Key ID:8EF7B6C6

1 0

about LDIF operation by API
by owen nirvana 04 Aug '10

04 Aug '10

It seems nothing is provided for operating LDIF. How to implement ldif export and import with C/C++ in OpenLDAP. gtalk:freeespeech@gmail.com <gtalk%3Afreeespeech(a)gmail.com>

2 1

Kerberos userpassword storage
by Indexer 04 Aug '10

04 Aug '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, Im attempting to use Kerberos as a password storage backend in my ldap server. I have the server setup with its own principal of the form ldap/domainname@REALM , and this keytab is in the KRB5_KTNAME environment variable as slapd starts. I have put olcSaslRealm=REALM and olcSaslHost=kdc.domain into my cn=config. Then, i have uid=user, where the userPassword attribute is {KERBEROS}user@REALM When attempting to bind to this user, it seems to fail. When i reset the password to a standard SSHA hash, it authenticates correctly. I can authenticate with kerberos to the host that the ldap enabled client, but i just cannot use ldap with the kerberos password backend. Any help in solving what else i need to do in this would be greatly appreciated William Brown pgp.mit.edu -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.14 (Darwin) iQIcBAEBAgAGBQJMWSI4AAoJEHF16AnLoz6JYt0P/0GzaH8jSYxiFLkjuh+XnXKI E1Io0H9a0U3Z2GWnkpGwfYmZpPSPHhCV7qs18y2AFHyekvxW9Io3sraKWbsHqLOh yygbVeZXvhdp29fpvvDfUoSXE6VN20pYtNdRUGQ+aMFCTwGjikBQoMZJjzjYZQOG cN3HF/TDHLVKQHKsmkVJr5qHKoWEjG2duD/vQ1vd1PS1Lv+QtQxjuSLFZFU5Fmwd L0ujNLExlyosR0CyvuIQ+wzZldPDy0yrCHlfD69GYNyfYp1l6+9o4bR9glFVdzIP C6JBciipPuq+PmHfi8YuWI0pO5XCS0n0S2K1Jtp5iMgCeInUiAMKw1oPnrygTXBi K8SaiO9jjleA6GFeql4Tzf9swIYVXxtOrUkTS+lRmEX4hl8ZkyRC+2lMDcKk5O5m 4OmW6B5k0NFQ+oEkGnmW+6UzfdhXuDC/I42XHGMfAMf3aW3f671JjTllxS/1aQJE A2v1VgjHAVLHx0qRj0aucJGQveGK8wmpA9odZIokxu4KJPn42THFa2ITvWAk/hux dpYuh4d8PFU8ikHVu4rmXsvPFfpVUrFl389+P9jAziS41dCpqC5doo3TP+W+pz93 7d0gkSCPGPnPp7f/tXAcnISwQMeKvzqi0XzJN3xmCRXVdfsJNk8yxFF+KZ1JoZKW r+qQcwwXTkogq/+tBeNq =0f+g -----END PGP SIGNATURE-----

3 2

what makes client use mech=SIMPLE?
by Klavs Klavsen 04 Aug '10

04 Aug '10

Hi, I have many ubuntu 8.04 clients which all work fine with my ldap server. I am now trying to connect a 10.04 client to the server - but login fails - and the only difference in output (in the debug file on the server) is the mech=SIMPLE line in the client that works. The one that works: Aug 4 10:21:36 ldap01 slapd[3077]: conn=1439319 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 4 10:21:36 ldap01 slapd[3077]: conn=1439319 op=2 BIND anonymous mech=implicit ssf=0 Aug 4 10:21:36 ldap01 slapd[3077]: conn=1439319 op=2 BIND dn="cn=Klavs Klavsen,ou=People,dc=example,dc=net" method=128 Aug 4 10:21:36 ldap01 slapd[3077]: conn=1439319 op=2 BIND dn="cn=Klavs Klavsen,ou=People,dc=example,dc=net" mech=SIMPLE ssf=0 Aug 4 10:21:36 ldap01 slapd[3077]: conn=1439319 op=2 RESULT tag=97 err=0 text= The one that fails: Aug 4 10:19:20 ldap01 slapd[3077]: conn=1439273 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 4 10:19:20 ldap01 slapd[3077]: conn=1439273 op=2 BIND anonymous mech=implicit ssf=0 Aug 4 10:19:20 ldap01 slapd[3077]: conn=1439273 op=2 BIND dn="cn=Klavs Klavsen,ou=People,dc=example,dc=net" method=128 Aug 4 10:19:20 ldap01 slapd[3077]: conn=1439273 op=2 RESULT tag=97 err=49 text= Any idea what makes the client try binding with mech=SIMPLE? or perhaps a hint as to why the first "method=128" doesn't work? I hope you have ideas :) Thank you in advance -- Regards, Klavs Klavsen, GSEC - kl(a)vsen.dk - http://www.vsen.dk "Those who do not understand Unix are condemned to reinvent it, poorly." --Henry Spencer

1 0

trying to understand referrals
by Khaled Blah 04 Aug '10

04 Aug '10

Hello all, I'm writing an LDAP application using OpenLDAP. First of all, thanks to the many contributors to this project! It's highly appreciated! Now, I'm trying to understand how I can implement an application that knows how to deal with referrals. I've implemented a function which I assign via ldap_set_rebind_proc, however I am not entirely sure what to do within this function that I assign to ldap_set_rebind_proc. What I've done so far is to parse the url parameter using ldap_url_parse and then assign the data from the LDAPURLDesc structure to my own data structure. Then I call ldap_init and ldap_bind_s in order to bind to the referral. However, it seems I am doing something wrong. Can anyone here give me any hints as to what to within that function that is assigned to ldap_set_rebind_proc? Thanks in advance! Regards, Khaled

2 4

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical August 2010