openldap-technical January 2011

openldap-technical@openldap.org

91 participants
107 discussions

error while loading shared libraries
by jptienshan 15 Jan '11

15 Jan '11

Here is a question from a newbie. I use red hat 5.5. I didn't want to use the openldap that is bundled with and installed by red hat, so I downloaded and installed BerkeleyDB-4.8.30 and openldap-2.4.23. configure, make as a non-root make install as a root user. I specified --prefix=/usr/local in both cases. For openldap, I had to export CPPFLAGS, LDFLAGS and LD_LIBRARY_PATH as follows: export CPPFLAGS="-I/usr/local/include" export LDFLAGS="-L/usr/local/lib" export LD_LIBRARY_PATH="-I/usr/local/lib" I created a slapd file and put it in /etc/init.d, chmod and chkconfig successfully. In .bashrc file, I put /usr/local/sbin and /usr/local/lib in the path. I also added this line: export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/lib I was able to run slappasswd and set/create a password for root. But that was the end of my successes :( As a root user, when I type "service slapd start", I get this error: //---- Starting slapd /usr/local/libexec/slapd: error while loading shared libraries: libdb-4.8.so cannot open shared object file no such file or dir. //----- Is it because my BerkeleyDB installation isn't working properly? (I don't recall any errors while installing BDB though) or something more is amiss? I can see that the file libdb-4.8.so is in /usr/local/lib How do I solve this problem? Thank you all for taking time to read. Cheers, -------------------------------------- Get the new Internet Explorer 8 optimized for Yahoo! JAPAN http://pr.mail.yahoo.co.jp/ie8/

2 2

Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX
by Alexey Shalin 15 Jan '11

15 Jan '11

Could not add object cn=default,ou=Policies,dc=itelsib,dc=com Message: Invalid syntax Error code: 0x15 (LDAP_INVALID_SYNTAX) Error description: An invalid attribute value was specified. You can not use cn=default,ou=Policies,dc=itelsib,dc=com please try cn=ppolicy,ou=Policies,dc=itelsib,dc=com -----Original Message----- From: openldap-technical-bounces(a)OpenLDAP.org [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of openldap-technical-request(a)OpenLDAP.org Sent: Thursday, January 13, 2011 6:00 PM To: openldap-technical(a)openldap.org Subject: openldap-technical Digest, Vol 38, Issue 12 Send openldap-technical mailing list submissions to openldap-technical(a)openldap.org To subscribe or unsubscribe via the World Wide Web, visit http://www.openldap.org/lists/mm/listinfo/openldap-technical or, via email, send a message with subject or body 'help' to openldap-technical-request(a)openldap.org You can reach the person managing the list at openldap-technical-owner(a)openldap.org When replying, please edit your Subject line so it is more specific than "Re: Contents of openldap-technical digest..." Send openldap-technical mailing list submissions to openldap-technical(a)openldap.org When replying, please edit your Subject: header so it is more specific than "Re: openldap-technical digest..." Today's Topics: 1. One root and two domain? (gael therond) 2. Re: One root and two domain? (Pierangelo Masarati) 3. Re: Evolution Contacts Schema (Peter L. Berghold) 4. Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Konstantin Boyandin) 5. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Quanah Gibson-Mount) 6. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Konstantin Boyandin) 7. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Chris Jacobs) 8. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Konstantin Boyandin) 9. LDAP and PAM: account is expired, but pam_ldap allows authentification (Konstantin Boyandin) 10. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Chris Jacobs) 11. Re: LDAP and PAM: account is expired, but pam_ldap allows authentification (Indexer) 12. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Howard Chu) 13. Re: LDAP and PAM: account is expired, but pam_ldap allows authentification (Howard Chu) 14. Re: LDAP and PAM: account is expired, but pam_ldap allows authentification (Chris Jacobs) 15. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Howard Chu) 16. Re: LDAP and PAM: account is expired, but pam_ldap allows authentification (Howard Chu) 17. Re: LDAP and PAM: account is expired, but pam_ldap allows authentification (Indexer) 18. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Dieter Kluenter) 19. Re: LDAP and PAM: account is expired, but pam_ldap allows authentification (Howard Chu) 20. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Konstantin Boyandin) 21. Re: LDAP and PAM: account is expired, but pam_ldap allows authentification (Indexer) 22. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Pierangelo Masarati) 23. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Konstantin Boyandin) 24. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Howard Chu) 25. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Howard Chu) 26. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Pierangelo Masarati) 27. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Howard Chu) 28. Re: Evolution Contacts Schema (Bj?rn Ruberg) 29. Re: Evolution Contacts Schema (Stefan Palme) 30. Hello, how (Alexey Shalin) ---------------------------------------------------------------------- Message: 1 Date: Wed, 12 Jan 2011 15:58:28 +0100 From: gael therond <gael.therond(a)gmail.com> To: openldap-technical <openldap-technical(a)openldap.org> Subject: One root and two domain? Message-ID: <AANLkTinxG_W4QQA5-vA587CN1FtYLf7TTUUchNP1DfTh(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Is it possible to add a domain on an already existing root? I got the following root for now: dc=lab,dc=corp and I want to create a second Top entry on my root which will be named like this: dc=prod,dc=corp Is that possible? I've try the following syntaxe without succes. Racine.ldif: #Racine dn: dc=prod, dc=corp ObjectClass: Top ObjectClass: dcObject ObjectClass: organization o: prod.corp dc: prod #OU Groups dn: ou=groups, dc=prod, dc=geka ObjectClass: organizationalUnit ObjectClass: top ou: groups #OU Users dn: ou=users, dc=prod, dc=geka ObjectClass: organizationalUnit ObjectClass: top ou: users And then I've done the usual LdapADD command, but with the following error returned: ldap_add: Server is unwilling to perform (53) Additional info: No global Superior Knowledge. Well, my guest is that I didn't set correctly Slapd because my default root is lab.corp instead of being TLD .corp Is that theory right? Many thanks

2 1

OpenLDAP delegates authentication to PAM
by Manuel Rodríguez Hernández 15 Jan '11

15 Jan '11

Hello I want to configure an application that only supports LDAP authentication, the challenge I face is that this application should not use the LDAP database to compare user and password, what I need, is to authenticate against a private solution which use its own auth schema, besides the only way to pass credentials to this private solution is using PAM, that is for example: an http proxy use a PAM helper to authenticate, and the PAM config use a PAM module to pass user/password to the private solution. So due to the restrictions, I'm looking to deploy an OpenLDAP server that redirects auth or executes an external program in order to authenticate against the private solution, and finally returns the response to the application that needs the authentication. So I was looking to the back-perl module to deploy something like that, but I'm not sure it will work. Does anybody know anything to solve this deployment? I will appreciate any clue. Thanks in advance RODRIGUEZ Manuel Tel: +52 (55) 5322-5290 Soporte: +52(55) 5322-5240 Fax: +52 (55) 5322-5252 www.insys-corp.com.mx "Ce message est confidentiel. Si vous n'êtes pas le destinataire de ce message, nous vous prions de le notifier au destinataire voie un courrier électronique et de l'effacer avec toutes ces pièces jointes de son ordinateur, sans sauvegarder un copie. Vous ne devez pas le copier, l'utiliser, le répliquer, par aucun propos et même plus diffuser son contenu à personne. Merci d'avance." "Este mensaje es confidencial. Si usted no es el destinatario de este mensaje, le suplicamos se lo notifique al remitente mediante un correo electrónico y que borre el presente mensaje y sus anexos de su computadora sin retener copia de los mismos. Por lo que no debe copiar este mensaje, usarlo, transmitir para cualquier propósito ni tampoco divulgar su contenido. Muchas gracias." "This e-mail is confidential and may also be privileged. If you are not the intended recipient please immediately advise the sender by reply e-mail and delete this message and its attachments from your computer without retaining a copy. You should not copy it, use it, transfer it, for any purpose, nor disclose its contents to any other person. Thank you."

2 1

dbd to hdb migration
by dan picon 15 Jan '11

15 Jan '11

Hi, I would like to use hdb as the back-end for my openldap server in order to support subtree-renaming. Untill today i'm using dbd and i have some questions before i change it to hdb: will existing entries be deleted? If yes, what is the best way to restore it? Thank you,

2 1

joomla ldap; joomla users not created
by mike＠grounded.net 14 Jan '11

14 Jan '11

Joomla 1.5, fully updated. php does have ldap installed and working Openldap 2.3.43-12.el5_5.3 running on fully updated centos server dedicated to this. On the openldap server, I have; Server Local LDAP Server timeout (Schema | search | refresh | info | import | export | logout ) Logged in as: cn=admin,dc=mydomain,dc=com - img dc=mydomain,dc=com (2) - img cn=admin new Create new entry here - img ou=users (2) + img uid=bob + img uid=bobby new Create new entry here new Create new entry here I have Distinguished Name: ou=users,dc=mydomain,dc=com I followed docs which showed me how to create add and use a joomla.schema. The above is where joomla users are supposed to be being created. What I suspect is that joomla isn't talking to the proper joomla.schema on the ldap server which is preventing the user from being created. But since I'm new to ldap, I've not been able to figure out how to diagnose this and fix the problem. I've been struggling with this for weeks and would very much welcome some help. Thanks.

1 0

Substrings in attributes - changing schemas
by Nick Milas 14 Jan '11

14 Jan '11

Hi, I store my DNS records in openldap (I use powerdns with ldap backend) and I am trying to use a search filter like: (aRecord=10.11.12.*) but it never produces results. I noticed that aRecord is defined in dnsDomain schema (available in cosine.schema) and inherited in dnsDomain2 schema (which is used by powerdns, available here: http://www.linuxnetworks.de/pdnsldap/dnsdomain2.schema). I came to the conclusion that the problem may be caused by the fact that aRecord (oid: 0.9.2342.19200300.100.1.26) in cosine.schema has no substring matching rule defined in schema: attributetype ( 0.9.2342.19200300.100.1.26 NAME 'aRecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) I thought of modifying it in order to allow substring matching, like: attributetype ( 0.9.2342.19200300.100.1.26 NAME 'aRecord' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) Questions: 1. Is the above logic correct, i.e. has the cause of the problem been identified correctly? 2. Is there any other way we can search substrings of values in this (or other similar) attribute(s) without modifying the schema(s)? 3. Can an LDAP administrator freely modify an organisation's schema(s) whenever it is deemed appropriate? Are there any risks by doing it? (I understand one should be cautious when upgrading openldap, and take care to "cascade" modifications to the upgraded version.) - AND/OR - Is there any process of "schema evolution" where LDAP server users provide feedback so that standard schema(s) are globally adapted to user request(s)? In the end: What is the easiest recommended way of using customized schema(s) in an organization? Please advise. Thanks in advance, Nick

3 7

distribution list in openldap
by Ben Kim 13 Jan '11

13 Jan '11

Hi, I'm trying to create a distribution list for outlook 2007, using openldap. Outlook reads ldap contacts quite OK, but I can't make a mailing group. Does anyone know of a good tutorial? I did some googling, but most of the related questions seem unanswered. I looked at http://www.openldap.org/faq/data/cache/1317.html MS Outlook: How To Make Distribution Lists. If you have followed the tutorial already, I would need some detailed steps, since I'm not an ldap expert. Thanks. -- Ben Kim Lead Database Administrator College of Education Texas A&M University http://benix.tamu.edu

2 2

Help reading db_printlog
by Peter Palmreuther 13 Jan '11

13 Jan '11

Hello, I had soem problems with a MirrorMode set up OpenLDAP cluster (version 2.4.20) and after some replication trouble I lost some data. I could restore it by using "db_restore" on the data directory (it's a 'hdb' backend). Now I'm trying to get as much information as possible about when exactly, and as far as possible why, the data got lost / was deleted. Unluckily I don't get far with reading the output of "db_printlog". I found " http://download.oracle.com/docs/cd/E17076_02/html/installation/debug_printl…" but this does not really help in getting the meaning of all the output. Is there any more help / documentation / whatever available to "dissect" the output and get an idea about what happend (and when, if possible)? Thanks in advance, -- Peter

1 0

Hello, how
by Alexey Shalin 13 Jan '11

13 Jan '11

Good afternoon, Tell me how to exclude the user's "search" from thesecurity policies The user is located in the ou =users Ou=policy also located in ou=users The reason that I need to exclude the user, is that when I set the pwdMaxAge and pwdGraceAuthNLimit. I can not log into the application at any login. In the openldap logs have a message bdb_dn2entry("uid=search,ou=users,ou=db") bdb_entry_get: rc=0 ppolicy_bind: Entry uid=search,ou=users,ou=db has an expired password: -39 grace logins send_ldap_response: msgid=1 tag=97 err=49 ber_flush2: 52 bytes to sd 13 tls_write: want=73, written=73 0000: 17 03 01 00 44 c3 ec 7b f6 fb 12 85 2d 87 57 6c ....D..{....-.Wl 0010: 6c 8c 36 ec 6f d3 39 1d 91 4b 1a db 53 d6 99 0e l.6.o.9..K..S... 0020: e8 94 85 93 b0 9a 3e 38 18 ab 00 fc 0f 3f d6 b4 ......>8.....?.. 0030: 39 a8 2d 8f 84 7f 46 09 90 cf 1d d2 28 a3 6e eb 9.-...F.....(.n. 0040: e8 ac f0 ad 66 44 7b 4f 47 ....fD{OG ldap_write: want=52, written=52 0000: 30 32 02 01 01 61 07 0a 01 31 04 00 04 00 a0 24 02...a...1.....$ 0010: 30 22 04 19 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 0"..1.3.6.1.4.1. 0020: 34 32 2e 32 2e 32 37 2e 38 2e 35 2e 31 04 05 30 42.2.27.8.5.1..0 0030: 03 81 01 00 .... conn=1 op=0 RESULT tag=97 err=49 text= If I set pwdGraceAuthNLimit to 100. I'm able to login into the application. I can not change password for user "search" :-( Thank you ------------------------------------------------------------------------------- С уважением, Алексей Шалин Системный Администратор Отдел системного администрирования ЗАО "Межбанковский процессинговый центр" 720083, Кыргызская Республика г. Бишкек, ул. Ауэзова 1/2 тел.: +996 (312) 637738 (вн. 138) факс: +996 (312) 637748 e-mail: a.shalin(a)ipc.kg

1 0

Evolution Contacts Schema
by Peter L. Berghold 13 Jan '11

13 Jan '11

Hi folks, I've been running in circles trying to locate something and I've had Epic Fail. Quick background: I've been setting up a new email/calendering system for my family. My wife and I both run our own small businesses and just keeping our schedules in sync is nuts. The "nice to have" my wife asked for was being able to have one central email contacts place to work with. This is where Evolution comes in. Unfortunately Evolution seems to do contacts differently than say Thunderbird and I need a "special schema" to get it to work. I've done a Google looking for the schema files and found lots of dead links and schema files that don't seem to play well. Anyone know of a more reliable source? Thanks in advance... -- Peter L. Berghold <peter(a)berghold.net>

3 4

← Newer
1
2
3
4
5
6
7
8
9
10
11
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical January 2011