December 2011 - openldap-technical

Virtual list view problem
by Venish Khant 31 May '16

31 May '16

Hi all I am using cpan Net::LDAP module to access LDAP entries. I want to search LDAP entries using Net::LDAP search method. When I do search, I want some limited number of entries from search result, for this(searching) process I am using Net::LDAP::Control::VLV module. But I get error on VLV response control. Please, any one have idea about this error. * Error:* Died at vlv.pl line 50, This is my example. I changed the font style of line 50 #!/usr/bin/perl -w use Net::LDAP; use Net::LDAP::Control::VLV; use Net::LDAP::Constant qw( LDAP_CONTROL_VLVRESPONSE ); use Net::LDAP::Control::Sort; sub procentry { my ( $mesg, $entry) = @_; # Return if there is no entry to process if ( !defined($entry) ) { return; } print "dn: " . $entry->dn() . "\n"; @attrs = $entry->attributes(); foreach $attr (@attrs) { #printf("\t%s: %s\n", $attr, $entry->get_value($attr)); $attrvalue = $entry->get_value($attr,asref=>1); #print $attr.":". $entry->get_value($attr)."\n"; foreach $value(@$attrvalue) { print "$attr: $value\n"; } } $mesg->pop_entry; print "\n"; } $ldap = Net::LDAP->new( "localhost" ); # Get the first 20 entries $vlv = Net::LDAP::Control::VLV->new( before => 0, # No entries from before target entry after => 19, # 19 entries after target entry content => 0, # List size unknown offset => 1, # Target entry is the first ); my $sort = Net::LDAP::Control::Sort->new( order => 'cn' ); @args = ( base => "dc=example,dc=co,dc=in", scope => "subtree", filter => "(objectClass=inetOrgPerson)", callback => \&procentry, # Call this sub for each entry control => [ $sort, $vlv ], ); $mesg = $ldap->search( @args ); # Get VLV response control *($resp) = $mesg->control( LDAP_CONTROL_VLVRESPONSE ) or die;* $vlv->response( $resp ); # Set the control to get the last 20 entries $vlv->end; $mesg = $ldap->search( @args ); # Get VLV response control ($resp) = $mesg->control( LDAP_CONTROL_VLVRESPONSE ) or die; $vlv->response( $resp ); # Now get the previous page $vlv->scroll_page( -1 ); $mesg = $ldap->search( @args ); # Get VLV response control ($resp) = $mes # Now page with first entry starting with "B" in the middle $vlv->before(9); # Change page to show 9 before $vlv->after(10); # Change page to show 10 after $vlv->assert("B"); # assert "B" $mesg = $ldap->search( @args );g->control( LDAP_CONTROL_VLVRESPONSE ) or die; $vlv->response( $resp ); -- Venish Khant www.deeproot.co.in

4 11

SASL passthrough - multiple domains
by Liam Gretton 05 Jul '12

05 Jul '12

I have a working configuration with pass-through auth to an AD domain using saslauthd. However now there is a requirement to be able to handle another domain too, and I cannot work out how to do this. It seems that saslauthd cannot deal with multiple Kerberos realms, no matter what hoops one jumps through it eventually boils down to only using whatever 'default_realm' is set to in the krb5.conf file. Using multiple saslauthd daemons isn't possible either as there's no way (that I can work out) of getting OpenLDAP to use anything other than the single socket specified in /etc/sasl2/slapd.conf. My final idea was to run an LDAP instance per realm, each talking to the separate saslauthd daemons, and have another outward facing LDAP service with these as the backends but that's a non starter too because there's no way of specifying the sasl slapd.conf file, it seems sasl always looks in /etc/sasl2 for a file derived from the process name (a chroot environment for each LDAP server is therefore the next thing to look at). But this seems like a lot of work just to be able to authenticate users against multiple domains. I appreciate this is a SASL issue rather than a problem with OpenLDAP, but I'm hoping that someone here has cracked this already. Googling hasn't thrown up an solution that I can find. -- Liam Gretton liam.gretton(a)le.ac.uk HPC Architect http://www.le.ac.uk/its IT Services Tel: +44 (0)116 2522254 University of Leicester, University Road Leicestershire LE1 7RH, United Kingdom

8 10

Pass-though Authentication with Saslauthd and Kerberos
by Jeff B 06 Jun '12

06 Jun '12

I'm attempting to get pass-though auth to work against saslauthd and kerberos and while the problem seems to be in sasl I think it's most likely to be seen in this type of configuration with opendap which I why I chose this mailing list. When I run testsaslauthd it works but when I run ldapsearch it fails. But the curious thing is where it is failing. in doing straces of saslauthd and packet traces I've found that when ldapsearch calls salsauthd, and not when I run saslauthd kerberos does not deliver the AS-REP packets till just after saslauthd times out. I can't find any difference in how I'm invoking saslauthd with testdaslauthd and how ldapsearch is invoking saslauthd. However the packet traces are quite different as you will see below. I've seen these kind of errors here and there on google but no resolutions that I can find. (http://www.openldap.org/lists/openldap-software/200602/msg00278.html) Centos 6 openldap-2.4.23-15.el6_1.3.x86_64 openldap-clients-2.4.23-15.el6_1.3.x86_64 openldap-servers-2.4.23-15.el6_1.3.x86_64 openldap-devel-2.4.23-15.el6_1.3.x86_64 krb5-server-1.9-9.el6_1.2.x86_64 krb5-server-ldap-1.9-9.el6_1.2.x86_64 krb5-workstation-1.9-9.el6_1.2.x86_64 krb5-libs-1.9-9.el6_1.2.x86_64 cyrus-sasl-2.1.23-8.el6.x86_64 cyrus-sasl-lib-2.1.23-8.el6.x86_64 cyrus-sasl-gssapi-2.1.23-8.el6.x86_64 cyrus-sasl-plain-2.1.23-8.el6.x86_64 cyrus-sasl-devel-2.1.23-8.el6.x86_64 My slapd.conf contains nothing regarding kerberos / sasl / pass-through authentication. I'm using a slapd.conf file for the time being till i get it all worked out and plan on converting it to a cn=config configuration. In my DIT the userPassword field contains: {SASL}myuser@MYREALM where myuser and my realm are replaced with the proper values. /etc/sasl2/slapd.conf: mech_list: plain pwcheck_method: saslauthd saslauthd_path: /var/run/saslauthd/mux /etc/sysconfig/saslauthd KRB5_KTNAME=/etc/krb5.keytab SOCKETDIR=/var/run/saslauthd MECH=kerberos5 Which builds a daemon command line of: /usr/sbin/saslauthd -m /var/run/saslauthd -a kerberos5 My system keytab is: /etc/krb5.keytab (root.ldap 0640) host/my.hostname@realm ldap/my.hostname@realm My socket parent dir is: /var/run/saslauthd (root.ldap 0770) When I run testsaslauthd I get a packet trace between saslauthd and kerberos is all UDP and works: > AS-REQ < KRB5KDC_ERR_PREAUTH_REQUIRED (25) > AS-REQ < AS-REP > TGS-REQ < TGS-REP When I run ldapsearch the packet trace between saslauthd and kerberos is UDP and TCP communication. None of the kerberos replies come back for 18 seconds, the time it takes saslauthd to time out. > AS-REQ < KRB5KDC_ERR_PREAUTH_REQUIRED (25) > AS-REQ > TCP SYN < TCP SYN, ACK > TCP ACK > TCP AS-REQ < TCP ACK > AS-REQ > AS-REQ > TCP FIN, ACK <-- saslauthd times out and the AS-REPS all come back at once. < AS-REP < AS-REP < AS-REP < TCP AS-REP > TCP RST an strace of saslauthd supports this timeout theory as it shows the the timeouts and backoffs. I can't find any info regarding saslauthd and TCP or UDP or timeouts like this. Any ideas?

5 7

ACL in dynamic configuration
by Nick Milas 16 Mar '12

16 Mar '12

Hello, I have converted from static (slapd.conf) to dynamic (cn=config) configuration using auto file conversion. I would like to ask a couple of questions regarding ACL conversion. Here follows one of the rules we have in initial form (a), and after conversion (b): (a) access to dn.subtree="dc=xxx.xxx.xxx.in-addr.arpa,ou=dns1,dc=example,dc=gr" attrs="children,entry" by group.exact="cn=TechAdmins,ou=Groups,dc=example,dc=gr" write by group.exact="cn=Dept1Admins,ou=Groups,dc=example,dc=gr" read by group.exact="cn=Dept2Admins,ou=Groups,dc=example,dc=gr" write by group.exact="cn=Dept3Admins,ou=Groups,dc=example,dc=gr" read by group.exact="cn=Dept4Admins,ou=Groups,dc=example,dc=gr" read by group.exact="cn=Dept5Admins,ou=Groups,dc=example,dc=gr" read by group.exact="cn=GuestAdmins,ou=Groups,dc=example,dc=gr" read by dn.exact="uid=dnsauthusr,ou=System,dc=example,dc=gr" read by * break (b) as an olcAccess attribute value: {10}to dn.subtree="dc=xxx.xxx.xxx.in-addr.arpa,ou=dns1,dc=example,dc=gr" attrs=children,entry by group/groupOfNames/member.exact="cn=techadmins,ou=groups,dc=example,dc=gr" write by group/groupOfNames/member.exact="cn=Dept1Admins,ou=groups,dc=example,dc=gr" read by group/groupOfNames/member.exact="cn=Dept2Admins,ou=groups,dc=example,dc=gr" write by group/groupOfNames/member.exact="cn=Dept3Admins,ou=groups,dc=example,dc=gr" read by group/groupOfNames/member.exact="cn=Dept4Admins,ou=groups,dc=example,dc=gr" read by group/groupOfNames/member.exact="cn=Dept5Admins,ou=groups,dc=example,dc=gr" read by group/groupOfNames/member.exact="cn=guestadmins,ou=groups,dc=example,dc=gr" read by dn.base="uid=dnsauthusr,ou=system,dc=example,dc=gr" read by * +0 break Question 1. Why "group.exact" was changed to "group/groupOfNames/member.exact" ? Yes, groups are defined as entries of groupOfNames objectClass, with members defined as values of attribute "member". But should it be like that? Should we change (manually) "group/groupOfNames/member.exact" back to "group.exact" again or not (and why)? Question 2. Is there a way we can add (manually, since conversion removed the ones which existed in initial configuration files) line breaks in olcAccess attribute value so it can be more legible (for administrative purposes)? Question 3. What is the "+0" added before "break" and why is needed? Thanks in advance, Nick

3 3

OpenLDAP 2.4 : replication doesn't work when customer is stopped
by PROST Frédéric 10 Mar '12

10 Mar '12

Hello, I configured MirrorMode replication between 2 openldap 2.4 node installed on Debian (from apt). Everything is working fine when the two nodes are online but if I stop the second node, and add new datas to the first node, then restart the second node, the new data are not synced. However, if I then add new datas on node 1, they are replicated to node2 without problem. Here is a scenario of this problem : 1/ node1 and node 2 are online : I add user1 to node 1 => user1 appears on node2 => ok 2/ node1 is online and node2 is off : I add user2 on node1 => nothing happens on node2 as it is off => ok 3/ I restart node2 => user2 is not replicated to node2 => not ok 4/ node1 and node 2 are online : I add user3 to node 1 => user3 appears on node2 => ok At the end of this scenario, node1 contains user1, user2 and user3 and node2 contains only user1 and user3 (but not user2). How can I slove this problem ? Thank you for your help, Best regards, Fred Here is my config : version: 1 dn: cn=config objectClass: olcGlobal cn: config olcAllows: bind_v2 olcArgsFile: /var/run/slapd/slapd.args olcLogLevel: any olcPidFile: /var/run/slapd/slapd.pid olcServerID: 1 ldap://192.168.1.103 olcServerID: 2 ldap://192.168.1.104 olcSizeLimit: 1000000 olcToolThreads: 1 dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModuleLoad: {0}back_hdb olcModuleLoad: {1}syncprov olcModulePath: /usr/lib/ldap dn: olcBackend={0}hdb,cn=config objectClass: olcBackendConfig olcBackend: {0}hdb dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=extern al,cn=auth manage by * break olcAccess: {1}to dn.exact="" by * read olcAccess: {2}to dn.base="cn=Subschema" by * read olcSizeLimit: 500 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact="uid=syncrepl,dc=tracteur91,dc=local" read by * break olcAccess: {1}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=extern al,cn=auth manage by * break olcLimits: {0}dn.exact="uid=syncrepl,dc=tracteur91,dc=local" size=unlimited olcMirrorMode: TRUE olcRootDN: cn=admin,cn=config olcRootPW: {MD5}BkY718PMIcgBNjpfXmGpOA== olcSyncrepl: {0}rid=001 provider="ldap://192.168.1.103" searchbase="cn=confi g" type=refreshAndPersist bindmethod=simple binddn="uid=syncrepl,dc=tracteu r91,dc=local" credentials="Tr@cteur91" retry="30 +" network-timeout=5 timeo ut=30 olcSyncrepl: {1}rid=002 provider="ldap://192.168.1.104" searchbase="cn=confi g" type=refreshAndPersist bindmethod=simple binddn="uid=syncrepl,dc=tracteu r91,dc=local" credentials="Tr@cteur91" retry="30 +" network-timeout=5 timeo ut=30 dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 5 dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcAccess: {0}to * by dn.exact="uid=syncrepl,dc=tracteur91,dc=local" read by * break olcAccess: {1}to attrs=userPassword,shadowLastChange by self write by anonym ous auth by dn="cn=admin,dc=tracteur91,dc=local" write by * none olcAccess: {2}to dn.base="" by * read olcAccess: {3}to * by self write by dn="cn=admin,dc=tracteur91,dc=local" wri te by * read olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: uid eq olcDbIndex: cn eq olcDbIndex: ou eq olcDbIndex: dc eq olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcLastMod: TRUE olcLimits: {0}dn.exact="uid=syncrepl,dc=tracteur91,dc=local" size=unlimited olcMirrorMode: TRUE olcRootDN: cn=admin,dc=tracteur91,dc=local olcRootPW: {SSHA}ZtvvlHUQYloI17cv2/cjPFmx51+Ut/+5 olcSuffix: dc=tracteur91,dc=local olcSyncrepl: {0}rid=003 provider="ldap://192.168.1.103" searchbase="dc=tract eur91,dc=local" type=refreshAndPersist bindmethod=simple binddn="uid=syncre pl,dc=tracteur91,dc=local" credentials="Tr@cteur91" retry="30 +" network-ti meout=5 timeout=30 olcSyncrepl: {1}rid=004 provider="ldap://192.168.1.104" searchbase="dc=tract eur91,dc=local" type=refreshAndPersist bindmethod=simple binddn="uid=syncre pl,dc=tracteur91,dc=local" credentials="Tr@cteur91" retry="30 +" network-ti meout=5 timeout=30 dn: olcOverlay={0}syncprov,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 5

3 8

Changing schema OID values in cn=config
by Nick Milas 17 Feb '12

17 Feb '12

Hello, In my config there is: DN: cn={5}postfix,cn=schema,cn=config objectClass: olcSchemaConfig cn: {5}postfix olcAttributeTypes: {0}( 1.3.6.1.4.1.25260.1.000 NAME 'mailacceptinggeneralid' DESC 'Defines an address that we accept mail for' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {1}( 1.3.6.1.4.1.25260.1.001 NAME 'maildrop' DESC 'Defines the address mail goes to' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {2}( 1.3.6.1.4.1.25260.1.002 NAME 'mailacceptinguser' DESC 'Defines if this user accepts mail' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {3}( 1.3.6.1.4.1.25260.1.003 NAME 'aliasInactive' DESC 'A flag, for marking the alias as not in use' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcObjectClasses: {0}( 1.3.6.1.4.1.25260.1.1.100 NAME 'virtualaccount' DESC 'Holds mail info for a virtual account' STRUCTURAL MUST ( owner $ mailacceptinggeneralid $ maildrop $ cn ) MAY ( description $ aliasInactive ) ) olcObjectClasses: {1}( 1.3.6.1.4.1.25260.1.1.101 NAME 'maillist' DESC 'Virtual account for holding mailing list info' STRUCTURAL MUST ( mailacceptinggeneralid $ maildrop $ cn ) MAY ( owner $ description $ aliasInactive ) ) olcObjectClasses: {2}( 1.3.6.1.4.1.25260.1.1.102 NAME 'mailAccount' DESC 'Email account details' AUXILIARY MUST ( mailacceptinguser $ maildrop $ cn ) MAY ( mailacceptinggeneralid $ aliasInactive ) ) olcObjectClasses: {3}( 1.3.6.1.4.1.25260.1.1.105 NAME 'virtualbox' DESC 'Mailbox for system use' STRUCTURAL MUST ( owner $ mail $ uid $ cn ) MAY description ) When I try to change attribute OID value, for example: 1.3.6.1.4.1.25260.1.000 to 1.3.6.1.4.1.25260.1.0 (using a visual LDAP client) then the server hangs and will not restart. (I had to restore from backup and restart.) What is the recommended way to do this change? Thanks, Nick

4 14

Using NSS
by Braden McDaniel 06 Feb '12

06 Feb '12

I am trying to get OpenLDAP (2.4.24) working with NSS on Fedora 15. In cn=config.ldif I have: olcTLSCACertificatePath: /etc/pki/nssdb olcTLSCertificateFile: endoframe I have used certutil to create a self-signed certificate: # certutil -d /etc/pki/nssdb -L Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI endoframe Cu,Cu,Cu But this doesn't appear to be working: $ ldapsearch -H ldaps://rail -b dc=endoframe,dc=net -x -d1 ldap_url_parse_ext(ldaps://rail) ldap_create ldap_url_parse_ext(ldaps://rail:636/??base) ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP rail:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying ::1 636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_close_socket: 3 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 127.0.0.1:636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_close_socket: 3 ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) slapd is running: # systemctl status slapd.service slapd.service - LSB: starts and stopd OpenLDAP server daemon Loaded: loaded (/etc/rc.d/init.d/slapd) Active: active (running) since Wed, 05 Oct 2011 02:24:11 -0400; 3 weeks and 0 days ago Main PID: 1429 (slapd) CGroup: name=systemd:/system/slapd.service └ 1429 /usr/sbin/slapd -h ldap:/// -u ldap Any ideas of what I might be doing wrong, or where I should be looking to debug this? -- Braden McDaniel <braden(a)endoframe.com>

8 19

Re: slapd-ldap as proxy to active directory
by Juan Miscaro 04 Jan '12

04 Jan '12

On 14 December 2011 17:44, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, December 14, 2011 3:40 PM -0500 Juan Miscaro > <jmiscaro(a)gmail.com> wrote: >> I would like to use the slapd-ldap backend as a proxy to Active >> Directory (Windows Server 2008 R2). >> >> Firstly, AD can be queried directly: > Does your local OpenLDAP have a schema file that defines the AD attributes > you are using? No. I read that since OpenLDAP 2.3 this was not necessary (I'm running 2.4.25 on Ubuntu 11.10). I got my project from a tutorial [1] where this all worked. [1]: http://is.gd/dqM1Ts (see section "Using OpenLDAP 2.3 to Pass Unknown Schema" on page 2) -- /jm

5 7

Issue with index in OpenLDAP?
by External Mathieu DEDECKER (CAMPUS) 03 Jan '12

03 Jan '12

Hi @All, We meet a performance problem with our OpenLDAP. We think that we face a problem with the index of the database, and we think that the problem can be resolve by tunning the config (but not sure). We would like to be sure that our configuration is correct, in order to confirm if we are on a wrong track or not. *[Description]* We have an attribute (cardNumber) which is indexed. When we request the indexed attribute (cardNumber) with an LDAP Client (Ldapbrowser), we have either fast or very long response time. For the long response time, the CPU of the server hits 100%. *For example*: Request1: cardnumber=2098001010034 (less than 1sec) Request2: cardnumber=2090389917486 (nearly 20 sec). By checking the hit ratio of the attribute, we can see that cache is correctly used (97%). *[Details]* - We are running on a VM with RedHat with 4 process with 24 Go RAM. - The version of the OpenLDAP is 2.4.16. - We have 2 500 000 accounts. *[Attachment]* - *201111223_os.txt* -> informations about OS and Hardware. - *openldap_version.txt* -> informations about the version of OpenLDAP. - *20111220_stats.txt* -> informations about index and perf. - *olcDatabase={1}hdb.ldif.txt * -> informations about hdb config. Do not hesitate if you need some more informations. Thank you for your help (: Mathieu

2 2

Syncrepl problem
by Bram Cymet 03 Jan '12

03 Jan '12

Hi, I have a syncrepl setup that I thought was working fine because whenever I would change an attribute in an entry the changes would be reflected in slave. Recently I noticed that if I remove and entry or add a new entry that will not get synced. Any idea what would be going on? Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. 613-608-9752

2 3

openldap ssl/tls not getting started
by Jayavant Patil 02 Jan '12

02 Jan '12

Hi, I am using openldap-2.4.19-4.fc12.x86_64 on fedora 12 machine. I want to start slapd with ssl/tls enabled. I have followed all the necessary steps as per specified in admin guide but still slapd not getting started in ssl/tls mode. Whenever I do ldapsearch with -ZZ option, it shows can't contact LDAP server(-1). Can anybody tell me the detailed steps and settings so that I can match those with my followed steps? Server file names are as follows: /etc/openldap/slapd.conf /etc/openldap/ldap.conf /etc/ldap.conf /etc/nsswitch.conf Client file names are as follows: /etc/openldap/ldap.conf /etc/ldap.conf /etc/nsswitch.conf -- Thanks & Regards, Jayavant Ningoji Patil Engineer: System Software Computational Research Laboratories Ltd. Pune-411 004. Maharashtra, India. +91 9923536030.

2 1

Ldap Tree References and Timeouts
by Klemens Kittan 29 Dec '11

29 Dec '11

Hello, I incorporated a subtree in our LDAP tree by reference. This subtree is offered by two servers. That's why I set the uri parameter to ldap1 and ldap2. If one of these servers is down, searches take very long (>10 min). The manpage says: "The URI list is space- or comma-separated. Whenever the server that responds is not the first one in the list, the list is rearranged and the responsive server is moved to the head, so that it will be first contacted the next time a connection needs be created." Have I missed something here or is there a timeout value to be set? This is our configuration for that part: # ---------------------------------------------------------- # --- Specific Backend Directives for ldap ----------------- # ---------------------------------------------------------- backend ldap # ---------------------------------------------------------- # --- Specific Directives for database ldap (babylon) ------ # ---------------------------------------------------------- database ldap # --- The base of your directory suffix "dc=subtree,dc=xyz,dc=de" uri "ldap://ldap1.xyz.de ldap://ldap2.xyz.de" # --- Save the time that the entry gets modified lastmod off # --- Specify that the current backend database is a subordinate subordinate Regards, Klemens

1 0

memory leak
by Paul DiSciascio 29 Dec '11

29 Dec '11

We are running a cluster of 2 ldap servers using the syncrepl overlay with mirror mode. After upgrading from SLES 10 SP2 (openldap 2.4.11) to SLES 11 SP1 (openldap 2.4.20), we have encountered a memory problem. The slapd process grows unbounded to the point that it uses all of the memory available to the ldap user on the server, currently 2.5GB, in a matter of hours. The database only contains around 30,000 records, so this amount of memory usage seems unusually high. No changes to the server configuration were made during the upgrade. In an attempt to address the issue, we upgraded both instances further to openldap version 2.4.28, but this has not helped. Below is the slapd.conf (security related pieces have been redacted) that we are using. ~Paul -------------------BEGIN SLAPD.CONF-------------- # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/rfc2307bis.schema include /etc/openldap/schema/ppolicy.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args # Load dynamic backend modules: modulepath /usr/lib/openldap/modules TLSCipherSuite HIGH:MEDIUM:-SSLv2 TLSCertificateFile /etc/openldap/cert.pem TLSCertificateKeyFile /etc/openldap/cert.key <ACLs go Here> loglevel none ServerID 1 ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=redacted" checkpoint 1024 5 cachesize 10000 overlay ppolicy rootdn "cn=redacted" sizelimit -1 ppolicy_default "cn=redacted" ppolicy_use_lockout directory /var/lib/ldap # Indices to maintain index cn,sn,uid eq index entryUUID eq index entryCSN eq index member eq index objectClass eq overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 limits dn.exact="uid=replica,ou=redacted" time=unlimited size=unlimited syncrepl rid=501 provider=ldap://peerhost:389 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=redacted" attrs="*,+" scope=sub bindmethod=simple binddn="uid=redacted" credentials= interval=00:01:00:00 mirrormode on database monitor -------------------END SLAPD.CONF--------------

2 1

Re: LDAP and file based authentication co-exist
by Daniel Qian 29 Dec '11

29 Dec '11

On 11-12-28 8:37 PM, yang feng电话 wrote: > > No, i configure /etc/openldap/ldap.conf, need /etc/ldap.conf Also? > > Generally speaking /etc/openldap/ldap.conf is for Ldap application software/utilities whereas /etc/ldap.conf is for system. Apparently You need the later for Ldap users to show up in your system.

1 0

LDAP and file based authentication co-exist
by 杨峰 29 Dec '11

29 Dec '11

It's a strange problem, I settle down LDAP setting and can get correct ldapsearch result at the mgmt node, but when I use "su" to the user, the system prompt "the user is not existed". It seems the LDAP service ( slaped ) is running and the user authentication goes through /etc/passwd still. How to move the user authentication to LDAP only? I had changed /etc/nsswitch.conf to use ldap also. [root@xcat user]# ldapsearch -x -v -D "cn=root,dc=isilon,dc=cn" -W -b "ou=People,dc=isilon,dc=cn" "uid=demo" ldap_initialize( <DEFAULT> ) Enter LDAP Password: filter: uid=demo requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <ou=People,dc=isilon,dc=cn> with scope subtree # filter: uid=demo # requesting: ALL # # demo, People, isilon.cn dn: uid=demo,ou=People,dc=isilon,dc=cn uid: demo cn: demo sn: demo mail: demo(a)isilon.cn objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword:: e2NyeXB0fSQ2JHkuMjUwS3hlJE9VZ3BidXJDdlg0UFk2NVFSSXBKNjhtNnpxYVp OVHdZYnBpZkdJVUJuQk1ZZnlVdmtEMHNwMTZLUmtaQmhoT0xrQ1NZdEhUU2NEUDRhTmhGUnJNSWIv shadowLastChange: 15334 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 501 gidNumber: 500 homeDirectory: /ifs/home/demo # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 [root@xcat user]# su - demo su: user demo is not existed

2 1

Value of contextCSN not persisted
by Torsten Schlabach (Tascel eG) 28 Dec '11

28 Dec '11

Dear list! We found one issue with a quite simple syncrepl replication; we have one provider and just one consumer. The consumer got set up about a week ago and loaded its initial database content from the provider. Then - after a couple of days - one object got deleted on the provider. So the consumer had to perform that delete operation as well; which is what it did fine. No problem so far. Today we compared the contextCSN values for the provider and the consumer and first thought we may have a problem, actually, because we found the contextCSN on the consumer to be newer than on the provider. Here are the actual values: consumer contextCSN: 20111216215531.923716Z#000000#003#000000 provider contextCSN: 20110124140058.246484Z#000000#003#000000 Looking twice, we found out that on the provider we got the above contextCSN value (the one which is too small) using slapcat. If we ask the provider using ldapsearch it actually reports the expectec contextCSN value, i.e. the same one which we can see on the consumer. (Note: The above value on the consumer has been taken from slapcat as well. In other words: The provider's latest contextCSN value has not been written to the disk until now; actually 4 days since the change. I guess if the power would fail now for example, the provider would load it's context CSN from the database, reading the lower value, and thus replication would get seriously out of sync, wouldn't it. Also we found that the result of the operation which increased the contextCSN (deleting an object on the provider) has been written to the disk, in contrast to the contextCSN value. Is that epxected behaviour or would we need to configure the flushing to the disk? We're using OpenLDAP 2.4.23 on Debian Linux. The backend is a back-hdb. Regards, Torsten

3 7

memberOf doesn't list members from an autogroup
by Felipe Augusto van de Wiel 28 Dec '11

28 Dec '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello, I'm using 2.4.23 packaged from Debian (2.4.23-7.2) and I'm trying to combine autogroup and memberof. autogroup (and dynlist) seems to be working, but it seems that memberof fails. :-( In terms of slapd.conf I load the modules memberof, dynlist and autogroup, the relevant configuration: overlay memberof memberof-refint TRUE overlay dynlist dynlist-attrset groupOfNames labeledURI member overlay autogroup autogroup-attrset groupOfURLs memberURL member I created the following test group: dn: cn=TEST,ou=Groups,dc=hpp,dc=org,dc=br cn: TEST memberURL: ldap:///ou=People,dc=hpp,dc=org,dc=br?member?sub?(gidnumber=1000) gidNumber: 12345 objectClass: groupOfURLs objectClass: top objectClass: posixGroup It correctly lists all the users with gidnumber 1000, I'm planning to change the filter to have a group of users from different groups. If I try to search per membership: ldapsearch -LLL -x memberof=cn=TESTE,ou=Groups,dc=hpp,dc=org,dc=b Nothing returns. :-( In other groups where I have a member field added statically, the memberof query works as expected. Am I missing something? Thanks in advance! Kind regards, - -- Felipe Augusto van de Wiel <felipe.wiel(a)hpp.org.br> Tecnologia da Informação (TI) - Complexo Pequeno Príncipe http://www.pequenoprincipe.org.br/ T: +55 41 3310 1747 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBCgAGBQJO+leVAAoJECCPPxLgxLxPw8oP/29cK3UrBphqpCFp5ce6toQN Y3JdhxX8brO5ffgv2hWYc/m+MOlsOjlxI5bEuIED0VlpnXtSJloT48GzGVNoTJoF nKt/tV9ndphJuH4MOYioybOP4aMXaOjvr0TYk4eNWZl2C/RYtR1WtTExHCt30+UV Iy3/hzNQyLiBURgRiTOR2+qCHMVSqMXJM+TuvwDXQMm89oEoZWiQHJGVZ9HDcMYE Xg3A7UBZQwPxxXjARVLX8w/n9z2M75yABQxK1p3SnJHX7JxAE5lzzhpQRV3nIXI5 kL41sXarI8Xfa/NyClf54xzOUNqnMBeNBZJQe9SSfn/E9wBw2FRvq1QAJB1Zhgde 2bu3lFPi6gdWJF5inlHVrhT3Q186oa037UljZx0Ey5sxL1XKK6oQEPxVIEbTS13n nwbEthEFjbpLE7Hgz4S9x/cYDRrVM+dFNZFvOp+1xg+kJnEfL5nkadHN+DU97QQ1 4ZuqZNnJq7GgXE3GyAadc5S2eVn10YmOx5OJf8Yct5kpLWSxRfozxGQgAtj4Zkni oGTo5w8IgYdhGXYUh1mLgTbW8PZzUCI3uxzyBXYS8uHRlyG88PCa1BtNGpoOrEGz WKDbib3wLsaaJcvLVrjtp2MO4rII+lgO2O8kei6LQ2nUp0HQxXAyDFbdLzMO3TQR YNswzdah34WWWdPBQYHE =sAbW -----END PGP SIGNATURE-----

1 0

[OT] Schema Catalog
by Reinaldo de Carvalho 27 Dec '11

27 Dec '11

Hi, To avoid us create another schema to the same objective, I'd like consult if exist a website that have a catalog of schemas? []s -- Reinaldo de Carvalho http://korreio.sf.net http://python-cyrus.sf.net "While not fully understand a software, don't try to adapt this software to the way you work, but rather yourself to the way the software works" (myself)

1 0

syncrepl: target DIT & directory server compatibility
by Asplund Marko 27 Dec '11

27 Dec '11

Hi, I'm planning on using OpenLDAP syncrepl for replicating a DIT fragment from Novell eDirectory using pull-based synchronisation. If i understood correctly synchronisation requires LDAP Sync protocol support from both the provider and the consumer sides. Any practical experience synchronising between these two different types of directory servers? How do I configure the syncrepl target DIT? For example if i have a database with suffix "dc=example,dc=com" and locally managed entries stored in o=foo,dc=example,dc=com and i'd like to synchronise a DIT from another server to o=bar,dc=example,dc=com How can i configure OpenLDAP to do that? thanks, marko

2 1

cn=config partial replication
by The Ranger 24 Dec '11

24 Dec '11

Hello, I have multiple v. 2.4.23 and 2.4.26 servers doing the master-slave replication using syncrepl. The main server contains multiple subordinate DIT-s that get replicated to different servers: * DIT1 from master to server A, B, C * DIT2 from master to server D, E, F * DIT3 from master to server G etc. Now I would like also to setup the cn=config replication. Actually the most important for me would be the cn=schema,cn=config since everything else is rather static. What would be the best setup with minimal configuration settings/values duplication? There are many howtos on the net how to sync only cn=schema,cn=config, but putting the olcSyncrepl value to olcDatabase={0}config will make the whole DB shadowed and redirect the database config changes to master server which is not the reasonable solution. The best solution would be when the cn=schema,cn=config (and maybe olso the proper olcDatabase subtree) would be synchronized with the master. All the rest of the config database should be locally manageable. I read about the suffixmassage, but this needs ldap server upgrade on 2.4.23 servers (there is no package in debian 6.0.3 for that). And as far as I understand it also requires separate cn=config,cn=slave subtrees on the server with duplicated database configuration and acl definitions etc. I simply try to find the best solution to hit as much problems at once as I can and reduce the config overhead as much as possible. Could you please advise what are my options? -- rgrds, Ivari

1 0

Using ldap_opt_x_tls_require_cert
by Thiyagu Rajendran 23 Dec '11

23 Dec '11

Hi all, I have few question on proper usage of ldap_opt_x_tls_require_cert option. when ldap_opt_x_tls_require_cert is set to LDAP_OPT_X_TLS_ALLOW on ldap handle after ldap_initialize, it was not working. It failed with certificate verify error. But according to the ldap.conf man page, setting LDAP_OPT_X_TLS_ALLOW option should not verify the server certificate After googling around found that LDAP_OPT_X_TLS_ALLOW should be set on global handle. Then got rid of certificate verify error. But I faced a new problem ,changing LDAP_OPT_X_TLS_ALLOW to LDAP_OPT_X_TLS_TRY in the same process doesnt verify the certificate. When i kill the process and restart it, it verifies the certificate properly. Somehow i managed to solve the problem by setting clearing the context using *LDAP_OPT_X_TLS_NEWCTX int tls=**LDAP_OPT_X_TLS_ALLOW* *ldap_set_option(NULL,**LDAP_OPT_X_TLS_REQUIRE_CERT,*&tls) *j=0 ldap_set_option(NULL,**LDAP_OPT_X_TLS_NEWCTX,&j) *But when i try to set *LDAP_OPT_X_TLS_REQUIRE_CERT *after clearing context, it is not working. Can someone explain the correct usage of *LDAP_OPT_X_TLS_REQUIRE_CERT * option* *Regards, Thiyagu

1 0

password-policy configuration problems: cannot change passwords
by Marco Weber 23 Dec '11

23 Dec '11

Hello, I'm running openldap with password policy overlay. after the overlay installation and configuration, we cannot change the passwords anymore. Michael Ströder told that an LDAP modify request should resolve this issue, but it didn't help. [root@ldapsrv ~]# ldappasswd -e ppolicy -D cn=username,dc=domain,dc=tld -S -W New password: Re-enter new password: Enter LDAP Password: Result: Constraint violation (19) Additional info: Password policy only allows one password value control: 1.3.6.1.4.1.42.2.27.8.5.1 false MAA= ppolicy: This is the log: Dec 22 11:15:31 ldapsrv slapd[5056]: conn=4431 fd=39 ACCEPT from IP=192.168.41.41:48899 (IP=0.0.0.0:636) Dec 22 11:15:31 ldapsrv slapd[5056]: conn=4431 fd=39 TLS established tls_ssf=256 ssf=256 Dec 22 11:15:31 ldapsrv slapd[5056]: conn=4431 op=0 BIND dn="cn= username,dc=domain,dc=tld" method=128 Dec 22 11:15:31 ldapsrv slapd[5056]: conn=4431 op=0 BIND dn="cn= username,dc=domain,dc=tld" mech=SIMPLE ssf=0 Dec 22 11:15:31 ldapsrv slapd[5056]: conn=4431 op=0 RESULT tag=97 err=0 text= Dec 22 11:15:31 ldapsrv slapd[5056]: conn=4431 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.1 Dec 22 11:15:31 ldapsrv slapd[5056]: conn=4431 op=1 PASSMOD new Dec 22 11:15:31 ldapsrv slapd[5056]: conn=4431 op=1 RESULT oid= err=19 text=Password policy only allows one password value Dec 22 11:15:31 ldapsrv slapd[5056]: conn=4431 op=2 UNBIND Dec 22 11:15:31 ldapsrv slapd[5056]: conn=4431 fd=39 closed this is my default password policy: dn: cn=password-policy,dc=policies,dc=domain,dc=tld objectClass: person objectClass: pwdPolicy objectClass: top cn: password-policy pwdAttribute: userPassword sn: Default Password Policy pwdAllowUserChange: TRUE pwdExpireWarning: 604800 pwdInHistory: 3 pwdLockout: TRUE pwdLockoutDuration: 7200 pwdMaxAge: 7776000 pwdMaxFailure: 5 pwdMinAge: 180 pwdMinLength: 8 pwdMustChange: TRUE this is my password policy configuration: dn: olcOverlay=ppolicy,dc=policies,dc=domain,dc=tld objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcPPolicyConfig objectClass: top olcOverlay: ppolicy olcPPolicyDefault: cn=password-policy,dc=policies,dc=domain,dc=tld olcPPolicyUseLockout: TRUE Thanks in advance for any reply, Marco

4 5

Re: ACL Problem
by Selcuk Yazar 23 Dec '11

23 Dec '11

Hi, Ok my rule is access to dn.regex="^mail=([^,]+),ou=([^,]+),jvd=([^,]+),o=hosting,dc=myhosting,dc=example$" attrs=userPassword by dn.exact="mail=$1,ou=$2,jvd=$3,o=hosting,dc=myhosting,dc=example" write by dn.exact,expand="mail=$1,ou=$2,jvd=$3,o=hosting,dc=myhosting,dc=example" read by dn="cn=Manager,dc=myhosting,dc=example" write by users none by * none this doesn't work , users can't change their own password. Also try this; access to attrs=userpassword by self write by anonymous auth by dn="cn=Manager,dc=myhosting,dc=example" write by users none by * none doesn't work again. open ldap have another parameter for these things ??? ?? On Tue, Dec 20, 2011 at 8:56 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, December 20, 2011 4:28 PM +0200 Selcuk Yazar < > selcuk.yazar(a)gmail.com> wrote: > > access to >> dn.regex="(.*,ou=(.+),jvd=([^,**]+),o=hosting,dc=myhosting,dc=**example)" >> attrs=userPassword >> by self write >> by users write >> > > "by users write" will allow any authenticated user to overwrite anyone's > password. I'm guessing you really do *not* want this rule. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Selçuk YAZAR http://www.selcukyazar.blogspot.com

3 3

userCertificate, wrong attribute type?
by Nicolas KOWALSKI 22 Dec '11

22 Dec '11

Hello, Using OpenLDAP 2.4.12 (SLES 2011 SP1), I am trying to add a userCertificate attribute to an existing user (inetOrgPerson object). I converted the PEM file containing the certificate to DER format, then created this ldif: dn: cn=Nicolas.Kowalski,ou=people,dc=home,dc=lan changetype: modify add: userCertificate userCertificate;binary:< file:///root/ssl/Nicolas.Kowalski-crt.der But when I try to update the entry, I always get this error: # ldapmodify -x -W-D "cn=Manager,dc=home,dc=lan" -f the-ldif-above ldapmodify: wrong attributeType at line 4, entry "cn=Nicolas.Kowalski,ou=people,dc=home,dc=lan" What am I doing wrong? Thanks, -- Nicolas

1 1

Ldap problems in paradise, working with suse 12.1 miles stone 5
by John Tobin 22 Dec '11

22 Dec '11

Dear Ralf, Hi, I hope you are still here before the holidays, I would appreciate your advice and counsel. I have Suse 12.1 up, mile stone 5. It works well. I have installed and used ldap 2.4.26. It is also working with nss_ldap code. I am having some trouble on 2 counts. First I tried to get start_tls, and / or ldaps to work in that environment. I have not gotten tls to work. Was this tested at all in SUSE? TLS is critical to some success in the university lab I am running over here. I have posted the problem to the open ldap crew, and have heard nothing from anyone for solving the problem, or even assistance in how to debug it, or understand the failure I get.....[this is from nss_ldap] >> Oct 28 11:29:01 nightmare slapd[11118]: conn=1217 op=0 STARTTLS >> Oct 28 11:29:01 nightmare worker_nscd: nss-ldap: do_open: do_start_tls >> failed:stat=-1 >> Oct 28 11:29:01 nightmare slapd[11118]: connection_read(14): TLS accept >> failure error=-1 id=1217, closing >> Oct 28 11:29:01 nightmare slapd[11118]: conn=1217 fd=14 closed (TLS >> negotiation failure) >> Oct 28 11:29:01 nightmare slapd[11118]: conn=1218 op=0 STARTTLS >> Oct 28 11:29:01 nightmare worker_nscd: nss-ldap: do_open: do_start_tls >> failed:stat=-1 In the middle of this mess Chris wood mentioned this would be easier, and may well work under nslcd. OK. I installed nslcd.... I have the lastest I believe: 0.7.13-7.3 I setup nslcd.conf to the best of my ability. With just a : Uri ldap://192.168.0.10/ Base dc=dark,dc=net Scope sub It works fine. For user jtobin [is only in ldap server] I get a login But in a similar fashion to nss_ldap, when I turn on ssl start_tls And add to the nslcd.conf above: Ssl start_tls Tls_reqcert allow Tls_cacertfile /var/lib/ldap/cacert.pem Tls_cert /var/lib/ldap/server.crt Tls_key /var/lib/ldap/server.key It fails.... I get: user jtobin does not exist But worse... I get nothing in the /var/log/localmessages file for debugging. Certificates were created using www.opeldap.org/faq/data/cache/185.html Which to my knowledge is the referenced site for openldap The certificate is a self signed cert. Most of my testing at the moment is local.... Client and slapd server are on the same machine, so same certificate file for tls_cacertfile, tls_cert, tls_key, though I have tested on remote clients with the same results. I see your name on a number of the nslcd doc and email. Help me out here.... How can I get this working / debugged? Who would have some of the information I need? Who would be interested in helping me to get this working. So far all I have gotten is a number of messages from interested parties asking me if I have gotten to work yet... Drop me aline with some advice as to how to get this resolved, or if it is probably not a short term Priority for anyone, tell me that. I will find a different strategy for securing my lab ldap client and server machines. [is getting this to work a priority at SUSE? Is there someone I can work with?] Sincerely tob There are a number of comments but the real statements are: Uri ldap://192.168.0.10/ Base dc=dark,dc=net Scope sub Ssl start_tls

2 1

Auto increment (uidNext and uidNumber)
by Pablo 21 Dec '11

21 Dec '11

Hello, Based on this article: http://www.rexconsulting.net/ldap-protocol-uidNumber.html. I am trying to increment 'uidNumber'. For doing that, I am using this LDIF file: --------------- autoinc.ldif --------------------------- dn: cn=uidNext,dc=example,dc=com changetype: modify delete:uidNumber uidNumber: 610 - add: uidNumber uidNumber: 611 ------------------- EOF -------------------------------- And this command; but produce an error: $ ldapadd -x -D "cn=Admin,dc=example,dc=com" -wsecret -f ./autoinc.ldif adding new entry "cn=uidNext,dc=example,dc=com" ldapadd: Undefined attribute type (17) additional info: add: attribute type undefined $ This is the definition of the uidNext objectClass: ---------------------------------------------- objectClass ( 1.3.6.1.4.1.4203.666.599 NAME 'uidNext' SUP top STRUCTURAL MUST ( cn $ uidNumber ) ) ---------------------------------------------- Any idea of what I am doing wrong here? Thanks in advance. Pablo.

5 6

(no subject)
by Molo CoC 21 Dec '11

21 Dec '11

hi all, i hope i am in the correct list :( for lpic train iam using ldap 2.3.43 mit BerkleyDB 4.2 and libdb4.2 + libdb4.2-dev on latest Debian (64B) unfortunatly i am facing 2 Errors during installation of openLDAP: first is: getpeereid.c:52: error: storage size of ‘peercred’ isn’t known (during executing command: make) and a lot of: missing binary operator befor "(" i hope you can give ma an advice thanks a lot! ___________________________________________________________ SMS schreiben mit WEB.DE FreeMail - einfach, schnell und kostenguenstig. Jetzt gleich testen! http://f.web.de/?mc=021192

3 2

problem with openldap identity assertion to AD server
by John Uhlig 21 Dec '11

21 Dec '11

Hello. I am new to this list so please forgive any protocol violations :) I am starting with simple steps towards our goal to use the openldap server translucent overlay config to merge AD authentication for people at our company with local ldap account authentication for non-company people. I am using openldap 2.4.23 on RHEL6 server. At this point, the ldap server can access our AD servers with anonymous bind but I need authenticated access to get more information. I have been using variations of the "Identity Assertion" steps from the openldap FAQ page (http://www.openldap.org/faq/data/cache/532.html) without success. I am initially trying the simplest config e.g. bindmethod=simple with a valid AD account/password for this access. I have included my current minimalist slapd.conf file if of any help. If anyone can point me to sample working configuration file(s) or provide any recommendations, I would appreciate it. thanks, John. ------------------------------------------ # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/misc.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ###TLSCipherSuite HIGH:MEDIUM:+SSLv2 #TLSCACertificateFile /usr/var/openldap-data/cacert.pem ###TLSCertificateFile /etc/openldap/cacerts/parcldscert.pem ###TLSCertificateKeyFile /etc/openldap/cacerts/parclds.pem ###TLSVerifyClient allow TLSVerifyClient never ### Will use TLS after I get authenticated bind working ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=corp,dc=ad,dc=parc,dc=com" rootdn "cn=Manager,dc=corp,dc=ad,dc=parc,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw {SSHA}EwrR01/GdI4+sdOVzZcK6Y94QbIXIw0j # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. sizelimit unlimited directory /var/lib/ldap # Indices to maintain index objectClass eq ### debug logging loglevel -1 # try transl overlay config here moduleload translucent overlay translucent translucent_local carLicense uri ldap://ADserver.corp.ad.parc.com lastmod off # idassert-bind bindmethod=simple binddn=cn=ldapacct,OU=Pseudo_User_Accounts,OU=PARC_Users,DC=corp,DC=ad,DC=parc,DC=com credentials="password" authzID=dn:cn=ldapacct,OU=Pseudo_User_Accounts,OU=PARC_Users,DC=corp,DC=ad,DC=parc,DC=com [root@virtuosity-vm84 configs]#

2 1

ACL Problem
by Selcuk Yazar 20 Dec '11

20 Dec '11

Hi, I want to ldap users to change their password. sample user dn is mail=edergi@.....mail......edu.tr<http://193.255.140.119/phpldapadmin/htdocs/cmd.php?cmd=template_engine&serv…> ,ou=<http://193.255.140.119/phpldapadmin/htdocs/cmd.php?cmd=template_engine&serv…> SOME_UNIT,jvd=.....mail.......edu.tr<http://193.255.140.119/phpldapadmin/htdocs/cmd.php?cmd=template_engine&serv…> ,o=hosting<http://193.255.140.119/phpldapadmin/htdocs/cmd.php?cmd=template_engine&serv…> and we have acl rules in slapd.conf access to dn.regex=".*,ou=.*,jvd=([^,]+),o=hosting,dc=myhosting,dc=example" attrs=userPassword by self write by group/jammPostmaster/roleOccupant.expand="cn=postmaster,jvd=$1,o=hosting,dc=myhosting,dc=example" write by * auth by * none access to dn.regex=".*jvd=([^,]+),o=hosting,dc=myhosting,dc=example" by self write by group/jammPostmaster/roleOccupant.expand="cn=postmaster,jvd=$1,o=hosting,dc=myhosting,dc=example" write by * read access to * by * read i apply various rules from openldap documentation, but no one works. why users can't chage their password ? thanks in advance -- Selçuk YAZAR

5 6

ppolicy overlay
by Selcuk Yazar 20 Dec '11

20 Dec '11

Hi i've installed succefully, ppolicy overlay and ldap password policy objects my directroy. So what do i expected for now ? because nothing happened. we are using jamm mail account schemas and sample accounts very old, and i expected expire all of them but nothing happened. what is the correct settigns of ppolicy_default_dn ? thanks inadvance.

2 1

Ver2.4.23 - Delta syncrepl stops responding
by david m 20 Dec '11

20 Dec '11

I have a problem that has just started happening in the last few weeks. Replication of modifications and/or adds from one LDAP node to the other will work fine ( repl time <1s) for a while, then suddenly stop working all together. The only way to get replication working again is to restart each node 2 or 3 times (sometimes it comes back after 2 restarts, sometimes it takes 3). On the last restart, I usually find that one node is stuck in an infinite loop trying to process a transaction from the other node's accesslog - the only way to get around this is to delete the the accesslog entry (see below for accesslog entry and slapd output). Any ideas? OS: OpenSuse 11.1 64-bit w/ 2GB RAM Version: OpenLDAP 2.4.23 Network Setup: 2 read/write nodes, with delta syncrepl between the nodes SERVER 1 Configs: dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcAuthzRegexp: {0}gidNumber=0\+uidNumber=0,cn=peercred,cn=external,cn=auth dn:cn=config olcLogLevel: stats sync olcPidFile: /var/run/slapd/slapd.pid olcServerID: 1 ldap://LDAP1:389 olcServerID: 2 ldap://LDAP2:389 olcSizeLimit: 10000 dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig olcDatabase: {-1}frontend olcAccess: {0}to dn.base="" by * read olcAccess: {1}to dn.base="cn=Subschema" by * read olcAccess: {2}to * by dn.base="cn=admin,o=o" manage dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.base="cn=admin,o=o" manage olcAccess: {1}to * by * read olcRootDN: cn=config dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcAccess: {0}to attrs=pwdChangedTime,pwdAccountLockedTime,pwdFailureTime,pwdHistory,pwdGraceUseTime,pwdReset by * none olcAccess: {1}to attrs=userPassword by self write by * auth by dn.base="cn=admin,o=o" manage olcAccess: {2}to attrs=shadowLastChange by self write by * read olcAccess: {3}to attrs=userPKCS12 by self read by * none olcAccess: {4}to * by * read by dn.base="cn=admin,o=o" manage olcDbCheckpoint: 1024 5 olcDbConfig: {0}set_cachesize 0 151200000 1 olcDbConfig: {1}set_lg_regionmax 262144 olcDbConfig: {2}set_lg_bsize 2097152 olcDbConfig: {3}set_flags DB_LOG_AUTOREMOVE olcDbIDLcacheSize: 151200000 olcDbIndex: objectclass eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: member eq olcDbIndex: memberUid eq olcDbIndex: mail eq olcDbIndex: cn eq,sub olcDbIndex: displayName eq,sub olcDbIndex: uid eq,sub olcDbIndex: sn eq,sub olcDbIndex: givenName eq,sub olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcLimits: {0}dn.exact="cn=admin,o=o" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcMirrorMode: TRUE olcRootDN: cn=admin,o=o olcRootPW: {SSHA}PWD olcSuffix: o=o olcSyncrepl: {0}rid=2 provider=ldap://LDAP2:389 binddn="cn=admin,o=o" bindmethod=simple credentials=PWD searchbase="ou=USERS,o=o" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=off type=refreshAndPersist retry="60 +" syncdata=accesslog dn: olcOverlay={0}ppolicy,olcDatabase={1}hdb,cn=config objectClass: olcPPolicyConfig olcOverlay: {0}ppolicy olcPPolicyDefault: cn=Default Policy,o=o olcPPolicyHashCleartext: TRUE olcPPolicyUseLockout: TRUE dn: olcOverlay={1}syncprov,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov olcSpCheckpoint: 100 1 olcSpSessionlog: 100 dn: olcOverlay={2}accesslog,olcDatabase={1}hdb,cn=config objectClass: olcAccessLogConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcAccessLogDB: cn=accesslog olcOverlay: {2}accesslog olcAccessLogOps: writes olcAccessLogPurge: 03+00:00 01+00:00 olcAccessLogSuccess: TRUE dn: olcDatabase={2}accesslog,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap_accesslog olcAccess:: ezB9dG8gKiBieSBkbi5iYXNlPSJjbj1hZG1pbixvPWNvIiBtYW5hZ2Ug olcDbCheckpoint: 1024 5 olcDbConfig: {0}set_cachesize 0 9948000 1 olcDbConfig: {1}set_lg_regionmax 262144 olcDbConfig: {2}set_lg_bsize 2097152 olcDbConfig: {3}set_flags DB_LOG_AUTOREMOVE olcDbIDLcacheSize: 9948000 olcDbIndex: entryCSN eq olcDbIndex: objectClass eq olcDbIndex: reqEnd eq olcDbIndex: reqResult eq olcDbIndex: reqStart eq olcDbIndex: default eq olcLimits: {0}dn.exact="cn=admin,o=o" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcSuffix: cn=accesslog dn: olcOverlay={0}syncprov,olcDatabase={2}accesslog,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 1 olcSpNoPresent: TRUE olcSpReloadHint: TRUE olcSpSessionlog: 100 dn: olcDatabase={3}monitor,cn=config objectClass: olcMonitorConfig olcDatabase: {3}monitor olcAccess: {0}to * by dn.base="cn=admin,o=o" manage olcAccess: {1}to * by * none olcMonitoring: true -------------------------- SERVER 2 Configs: version: 1 dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcAuthzRegexp: {0}gidNumber=0\+uidNumber=0,cn=peercred,cn=external,cn=auth dn:cn=config olcLogLevel: stats sync olcPidFile: /var/run/slapd/slapd.pid olcServerID: 1 ldap://LDAP1:389 olcServerID: 2 ldap://LDAP2:389 olcSizeLimit: 10000 dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig olcDatabase: {-1}frontend olcAccess: {0}to dn.base="" by * read olcAccess: {1}to dn.base="cn=Subschema" by * read olcAccess: {2}to * by dn.base="cn=admin,o=o" manage dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.base="cn=admin,o=o" manage olcAccess: {1}to * by * read olcRootDN: cn=config dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcAccess: {0}to attrs=pwdChangedTime,pwdAccountLockedTime,pwdFailureTime,pwdHistory,pwdGraceUseTime,pwdReset by * none olcAccess: {1}to attrs=userPassword by self write by * auth by dn.base="cn=admin,o=o" manage olcAccess: {2}to attrs=shadowLastChange by self write by * read olcAccess: {3}to attrs=userPKCS12 by self read by * none olcAccess: {4}to * by * read by dn.base="cn=admin,o=o" manage olcDbCheckpoint: 1024 5 olcDbConfig: {0}set_cachesize 0 151200000 1 olcDbConfig: {1}set_lg_regionmax 262144 olcDbConfig: {2}set_lg_bsize 2097152 olcDbConfig: {3}set_flags DB_LOG_AUTOREMOVE olcDbIDLcacheSize: 151200000 olcDbIndex: objectclass eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: member eq olcDbIndex: memberUid eq olcDbIndex: mail eq olcDbIndex: cn eq,sub olcDbIndex: displayName eq,sub olcDbIndex: uid eq,sub olcDbIndex: sn eq,sub olcDbIndex: givenName eq,sub olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcLimits: {0}dn.exact="cn=admin,o=o" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcMirrorMode: TRUE olcRootDN: cn=admin,o=o olcRootPW: {SSHA}PWD olcSuffix: o=o olcSyncrepl: {0}rid=1 provider=ldap://LDAP1:389 binddn="cn=admin,o=o" bindmethod=simple credentials=PWD searchbase="ou=USERS,o=o" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=off type=refreshAndPersist retry="60 +" syncdata=accesslog dn: olcOverlay={0}ppolicy,olcDatabase={1}hdb,cn=config objectClass: olcPPolicyConfig olcOverlay: {0}ppolicy olcPPolicyDefault: cn=Default Policy,o=o olcPPolicyHashCleartext: TRUE olcPPolicyUseLockout: TRUE dn: olcOverlay={1}syncprov,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov olcSpCheckpoint: 100 1 olcSpSessionlog: 100 dn: olcOverlay={2}accesslog,olcDatabase={1}hdb,cn=config objectClass: olcAccessLogConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcAccessLogDB: cn=accesslog olcOverlay: {2}accesslog olcAccessLogOps: writes olcAccessLogPurge: 03+00:00 01+00:00 olcAccessLogSuccess: TRUE dn: olcDatabase={2}accesslog,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap_accesslog olcAccess:: ezB9dG8gKiBieSBkbi5iYXNlPSJjbj1hZG1pbixvPWNvIiBtYW5hZ2Ug olcDbCheckpoint: 1024 5 olcDbConfig: {0}set_cachesize 0 9948000 1 olcDbConfig: {1}set_lg_regionmax 262144 olcDbConfig: {2}set_lg_bsize 2097152 olcDbConfig: {3}set_flags DB_LOG_AUTOREMOVE olcDbIDLcacheSize: 9948000 olcDbIndex: entryCSN eq olcDbIndex: objectClass eq olcDbIndex: reqEnd eq olcDbIndex: reqResult eq olcDbIndex: reqStart eq olcDbIndex: default eq olcLimits: {0}dn.exact="cn=admin,o=o" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcSuffix: cn=accesslog dn: olcOverlay={0}syncprov,olcDatabase={2}accesslog,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 1 olcSpNoPresent: TRUE olcSpReloadHint: TRUE olcSpSessionlog: 100 dn: olcDatabase={3}monitor,cn=config objectClass: olcMonitorConfig olcDatabase: {3}monitor olcAccess: {0}to * by dn.base="cn=admin,o=o" manage olcAccess: {1}to * by * none olcMonitoring: true -------------------------- Bad accesslog entry & slapd output version: 1 ####From Transaction recorded in accesslog on LDAP1 dn: reqStart=20111212033402.000002Z,cn=accesslog objectClass: auditModify reqAuthzID: cn=admin,o=co reqDN: cn=bob,ou=users,o=co reqEnd: 20111212033402.000003Z reqMod: userPassword:= {SSHA}PWD reqMod: pwdChangedTime:= 20111212033402Z reqMod: entryCSN:= 2011 12 12 03 34 02.374746Z#000000#001#000000 reqMod: modifiersName:= cn=admin,o=o reqMod: modifyTimestamp:= 20111212033402Z reqResult: 0 reqSession: 3296 reqStart: 20111212033402.000002Z reqType: modify #####Log Of LDAP2 after 2nd restart (No Related Log info on LDAP1 during that timeframe) Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b639100 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b568240 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b639100 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b568240 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b639100 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b568240 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b639100 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b568240 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b639100 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b568240 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b639100 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b568240 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b639100 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b568240 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000

2 1

re: OpenLDAP for Central Auth?
by Juergen.Sprenger＠swisscom.com 19 Dec '11

19 Dec '11

Hi Craig, > Hi, > > Has anyone successfully deployed OpenLDAP for central auth in a very mixed unix environment? With Host > based access control? Plus any documentation would be really great. > > My needs; > - Central Auth > - Host based access control (e.g. user "John" from group "accounts" can't log into "development servers". > - Caching for Client logins on laptops. I figure SSSD will be useful here? > - Encryption (This looks pretty straight forward in the OpenLDAP 2.4 doco) > > Client OS's involved; > - Solaris 9/10 > - Fedora 15/16 > - Centos 5/6 > > > cya > > Craig A solution which will cover most of Your needs is in production here: Central Auth Client OS's: - Solaris 9/10 (working on 11) - HPUX 11.x - AIX 5/6 - Fedora/Redhat Host based access control: - nis-netgroups for hosts - nis-netgroups for users - members of user-netgroup 'oracle_dba' can log into machines from host-netgroup 'oracle_db_server' Role based access control: - sudo profiles for each role - sudoUser by user-netgroups (example: 'oracle_dba') - sudoHost by host-netgroups (example: oracle_db_server') Encryption: tls/ssl Pretty much straight forward from standard docs. Juergen Sprenger

2 1

Trying to add vacation.schema - object class violation error
by Andreas Cieslak 19 Dec '11

19 Dec '11

Hi list, I need some urgent advices on the openldap-scheme extension. My openldap version is slapd 2.4.23 on a debian squezze machine. When I try to activate vacation on the webmail-system roundcube (the webmailer and the plugins are working fine) it says the the activation is stored, but when I have a look into the logs of round cube, they say: [16-Dec-2011 11:20:29] Could not add new values to attribute vacationActive: Object class violation: LDAP_OBJECT_CLASS_VIOLATION (65): [16-Dec-2011 11:20:29] Could not modify entry: Could not add new values to attribute vacationActive: Object class violation: LDAP_OBJECT_CLASS_VIOLATION: (1000): The slapd-logs shows the following when I try to activate vacation: conn=1221 op=4 MOD dn="cn=admin,dc=domain,dc=de" slapd[14608]: conn=1221 op=4 MOD attr=vacationActive serv slapd[14608]: slap_queue_csn: queing 0xb58969b6 20111216110200.012914Z#000000#000#000000 serv slapd[14608]: Entry (cn=ldapadmin,dc=folkwang-hochschule,dc=de), attribute 'vacationActive' not allowed serv slapd[14608]: entry failed schema check: attribute 'vacationActive' not allowed serv slapd[14608]: conn=1221 op=4 RESULT tag=103 err=65 text=attribute 'vacationActive' not allowed The following is my vacation.schema which I add to /etc/ldap/slapd.conf: attributetype ( 1.3.6.1.4.1.39116.1.1.11 NAME 'vacationActive' SINGLE-VALUE EQUALITY booleanMatch DESC 'A flag, for marking the user as being away' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 ) attributetype ( 1.3.6.1.4.1.39116.1.1.12 NAME 'vacationInfo' SINGLE-VALUE SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 DESC 'Absentee note to leave behind, while on vacation' EQUALITY octetStringMatch ) attributetype ( 1.3.6.1.4.1.39116.1.1.13 NAME 'vacationStart' SINGLE-VALUE SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 DESC 'Beginning of vacation' EQUALITY octetStringMatch ) attributetype ( 1.3.6.1.4.1.39116.1.1.14 NAME 'vacationEnd' SINGLE-VALUE SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 DESC 'End of vacation' EQUALITY octetStringMatch ) attributetype (1.3.6.1.4.1.39116.1.1.15 NAME 'vacationForward' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} DESC 'Where to forward mails to, while on vacation' ) # # Objects start here # objectclass ( 1.3.6.1.4.1.39116.1.2.10 NAME 'vacation' SUP top AUXILIARY DESC 'Users vacation status information' MUST vacationActive MAY ( vacationInfo $ vacationStart $ vacationEnd $ vacationForward ) ) I imported a user with the object class vacation and the attributes vacationActive, vacationInfo . into my ldap database. There the import looks fine. The user has got the privileges to modify the vacation attributes. But when I try to modify the entries via vacation-plugin on roundcube, the above errors occur. Can anybody give me some advices, please? Thanks Andreas

3 4

OpenLDAP for Central Auth?
by Craig T 19 Dec '11

19 Dec '11

Hi, Has anyone successfully deployed OpenLDAP for central auth in a very mixed unix environment? With Host based access control? Plus any documentation would be really great. My needs; - Central Auth - Host based access control (e.g. user "John" from group "accounts" can't log into "development servers". - Caching for Client logins on laptops. I figure SSSD will be useful here? - Encryption (This looks pretty straight forward in the OpenLDAP 2.4 doco) Client OS's involved; - Solaris 9/10 - Fedora 15/16 - Centos 5/6 cya Craig

5 7

Password Policy Effects
by Selcuk Yazar 18 Dec '11

18 Dec '11

Hi i've installed succefully, ppolicy overlay and ldap password policy objects my directroy. So what do i expected for now ? because nothing happened. we are using jamm mail account schemas and sample accounts very old, and i expected expire all of them but nothing happened. what is the correct settigns of ppolicy_default_dn ? thanks inadvance. -- Selçuk YAZAR http://www.selcukyazar.blogspot.com

1 0

Password Policy
by Selcuk Yazar 17 Dec '11

17 Dec '11

Hi, we are using openldap on redhat EL6 with postfix and JAMM schema. I wantto activate password policy for ldap but i cannot add default password schema , i try to apply step that tells on http://www.zytrax.com/books/ldap/ch6/ppolicy.html but i cannot add dn: cn=default,ou=policies,dc=myhosting,dc=example class, it gives ldap_bind: Invalid DN syntax (34) additional info: invalid DN error. what is the problem ? thanks in advance [image: image.png] -- Selçuk YAZAR http://www.selcukyazar.blogspot.com

2 2

Adding an object class with required attributes to an existing entry
by Nick Milas 16 Dec '11

16 Dec '11

Hi, I want to add a new objectclass using an ldif; this objectclass requires some attributes (according to schema). I can't make it work. For posixAccount class, required attributes are: cn gidNumber homeDirectory uid uidNumber I already have cn and uid. I am trying: dn: uid=userx,ou=people,dc=example,dc=com changetype: modify add: ObjectClass objectClass: posixAccount uidNumber: 1700 homeDirectory: /var/members/userx gidNumber: 48 loginShell: /bin/false and it fails. I've tried other ways too, like including existing objectclasses in the LDIF (I've read about that in a blog), using a separate add statement for optional attribute loginShell, etc. but nothing worked. If the ObjectClass to add does not specify REQUIRED attributes in the schema, there is no problem in adding it. How should I formulate the LDIF? Please advise. Thanks, Nick

3 6

Mozilla NSS / OpenLdap 2.4.23 cert not readable?
by Aaron Bennett 16 Dec '11

16 Dec '11

Hello, I'm trying to grok Mozilla NSS prior to deploying Openldap 2.4.23 on RHEL 6.2. I've been working through creating a self-signed cert and I think I have one that works. At least, if I do: [root@animal ~]# certutil -d /etc/pki/nssdb/ -L Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI its Cu,Cu,Cu animal.clarku.edu p,p,p the its cert is the one I used to sign. If I do: [root@animal ~]# certutil -d /etc/pki/nssdb/ -L -n animal.clarku.edu Then I see a normal looking cert: Certificate: Data: Version: 3 (0x2) Serial Number: 00:96:7c:e7:ea Signature Algorithm: PKCS #1 SHA-1 With RSA Encryption Issuer: "CN=ITS Self Signed" Validity: Not Before: Mon Dec 12 16:01:27 2011 Not After : Mon Mar 12 16:01:27 2012 Subject: "CN=animal.clarku.edu,O=Clark University ITS,L=Worcester,ST= Massachusetts,C=US" Here's what I've got in cn=config: olcTLSCACertificatePath: /etc/pki/nssdb/ olcTLSCertificateFile: animal.clarku.edu If do those commands as the ldap user with sudo -u ldap, I get the same output. I can even run "certutil -V -n animal.clarku.edu -u SR -d /etc/pki/nssdb/" and I get "certificate is valid". However when I start slapd, I get: [root@animal slapd.d]# service slapd start animal.clarku.edu is not readable by "ldap" [WARNING] Starting slapd: [ OK ] What am I missing? Thanks, Aaron --- Aaron Bennett Manager of Systems Administration Clark University ITS

4 8

Ldap+Nfsv4+kerberos *nix / *bsd puzzle.
by Harry Coin 16 Dec '11

16 Dec '11

Hello group! Looking for guidance on an ldap+NFS4+Kerberos puzzle in a mixed OS local environment. Simple demo case, four computers on a little net. box 1: Running openlap server, kerberos KDC, kadmin, lets say it's running freebsd, doesn't matter. nfs server & client. box 2: Linux box. nfs server & client. box 3: *bsd/Solaris box. nfs server & client. box 4: misc user box, could be *bsd or *nix. Networking: Nfs4 secured with kerberos. That means No uid/gid numbers on the wire, only user@box. NSS is active on all boxes, reaching out to the ldap server on box 1 for info for what is not in the local passwd file searched first. Popular package X gets installed on box 2 and box 3. Package X is a drop-root privilege package, has its own uid/gid!=0. It is active on the net, might write log files or get data files via nfs on either of the other two computers in the setup. The maintainers for package X in the *bsd world have chosen a different number for the uid / gid for the package X daemon than the maintainers for package X have chosen in the *nix world. Those get written in the local passwd file on each system at package X install / download time. Note: Package X does _not_ get installed on the ldap server box #1, or box #4. There is no entry in the #1 or #4 system's passwd file for nss to find for the daemon associated with package X. nfsuserd via nss must find the package X user in ldap or the files will be unreadable or seem 'owned' by nobody:nogroup on 1 or 4 if say config or log files edited/accessed from there. Puzzle: What should the posixAccount uidNumber and gidNumber value be in ldap for uid=packageXdaemon? Alternatives: 1: Choose no entry, leave it out of the ldap db: PackageXDaemon's files will be owned by nobody:nogroup on box 1. Security Fail. 2: Choose *nix for the uid/gid in the ldap database on box 1. Fail: The files will be stored with a uid/gid that might collide with another account in the passwd database on the *bsd server. 3: Choose *bsd for the uid/gid in the ldap database on box 1: Fail: The *nix user on box 4's nfsuserid will get the bsd uid/gid from ldap which could create files not actually owned by something colliding in the *nix passwd database on box 4. 4: Instead storing all the users once under an ou=Account... create ou=AccountBSD and ou=AccountNix, duplicate the whole account tree but vary the apropos uid/gid pair under each tree with all the other remaining equal, manage collisions when amending the database. Not so pretty. 5: Edit the schema to replace uidNumber and gidNumber with uidNixNumber / uidBsdNumber & etc. for gid. Breaks code expecting standard uidNumber gidNumber in the default ldap schemas. There are so many packages that could be X, you can imagine not wanting to have to qualify and patch all of them to use a common uid/gid number. (And it gets even worse in a mixed nfs3 / nfs4 environment where uid/gid numbers actually go over the wire in some cases, and user@box in others, let's leave that to the side for now). I'm leaning toward #5 to avoid storing all the other account information under two different trees. But I'd prefer a scheme were there is a not-edited standard schema tree stored once under 'ou=Account' but with a different overlay for the uid/gid elements if looked up as AccountNix or AccountBsd. I'm sure someone has done battle with this already, what's the right answer? Thanks Harry Coin

3 3

slapdindex
by Allan E. Johannesen 16 Dec '11

16 Dec '11

First, I'm running 2.4.27 A year and a half ago, running 2.4.something-less-than-27, we installed a device which queried LDAP and was causing a load on the ldap servers. I found it was looking for an attribute we didn't have. I indexed the attribute and I believed that the load was reduced. I did not add the objectclass which offered the attribute to our objectclasses. Was I imagining things? Recently, we have another black box that queries ldap. I can't control the attributes which it requests. I added the attributes to the index and ran the slapindex and no new .bdb files were generated, even using the -q -t flags, which claims to truncate a database before scanning for the attribute. That sounded like a way to maybe trick it into making an empty database, but no dice. As an experiment, I ran slapadd to create a new database, with those attributes in the index list. It didn't add any of them, nor did it create that single attribute which I believed I had "fixed" last year. I'm reasonably sure that prior openldap versions of both slapindex and slapadd would create the index for an attribute listed as indexed without it appearing in the data. I'm curious to know if I was wrong that indexing an attribute would speed the search even if the attribute did not appear in the schemas used. Also, does this mean that I have to add whatever schema that new ldap-client black-box wants to search in order to make the index in order to reduce that client's ldap server load? Thanks for any insights.

1 0

Fresh install on debian with cn=config and slapd.conf conversion
by reyman 16 Dec '11

16 Dec '11

On Thu, Dec 15, 2011 at 10:24 AM, Raffael Sahli <public(a)raffaelsahli.com>wrote: > On 12/15/2011 09:46 AM, rey sebastien wrote: > >> Le jeu. 15 déc. 2011 08:51:29 CET, Raffael Sahli a écrit : >> >>> >>> >>>> OK, it's work, i have a fonctionnal slapd.d/cn=config folder, but i >>>> don't understand why i can't access to openldap with >>>> cn=admin,dc=parisgeo,dc=cnrs,**dc=fr and good password generated by >>>> >>>> >>>> My slapd.conf before conversion contain the SSHA password generated by >>>> slappasswd for rootDn : >>>> ----- >>>> >>>> database bdb >>>> suffix "dc=parisgeo,dc=cnrs,dc=fr" >>>> rootdn "cn=admin,dc=parisgeo,dc=cnrs,**dc=fr" >>>> rootpw {SSHA}xxxxxxxxxxxxxxxxxxxxx >>>> >>>> ---- >>>> I try this : root@xxxxx:/usr/local/etc/**openldap/slapd.d# ldapsearch >>>> -D cn=admin,dc=parisgeo,dc=cnrs,**dc=fr -W -x 'userName=*' >>>> Enter LDAP Password: ldap_bind: Invalid credentials (49) >>>> >>>> Bizarre ... >>>> Perhaps i can try to redefine the rootdn, because it disapear with >>>> conversion ? >>>> Do you have an idea about this ? >>>> >>>> Thanks, >>>> SR. >>>> >>>> >Use slapadd. Again, RTFM. Everything you've asked in the past week or >>> so has been documented in the manpages and the Admin Guide. Read and learn. >>> >>> Yes right, @rey rtfm, and ask your question again, if you're sure your >>> point is not in the OpenLDAP manual. >>> But i'm sure you will find your answer there. >>> >>> >>> >>> >Please trim irrelevant text from your emails. Please update your >>> Subject line to something relevant to the actual discussion topic. >>> @Howard, please say that to the guy who ask questions, and not me^^ >>> >>> >>> Raffael Sahli wrote: >>> >>>> On 14.12.2011 16:54, rey sebastien wrote: >>>> >>>>> Le 13/12/2011 16:48, Raffael Sahli a écrit : >>>>> >>>> >>> Hi! >>>>> It's not easy to start with zero configuration with cn=config new >>>>> openldap administration .. >>>>> I create my bd.ldif based on the slapd.ldif example in the >>>>> /usr/local/etc/openldap directory. >>>>> But how can i insert this ldif with >>>>> >>>>> ldapadd -Y EXTERNAL -H ldapi:/// -f myldiffile.ldif >>>>> >>>>> if i cannot run slapd without configuration ? >>>>> How do you start a fresh install of openldap in this case? there is an >>>>> option to run slapd without zero configuration? >>>>> Thanks a lot, >>>>> >>>> >>> Use slapadd. Again, RTFM. Everything you've asked in the past week or so >>> has been documented in the manpages and the Admin Guide. Read and learn. >>> >>> >>> >> Everything ? really ... Install from sources with specific init script >> installation on debian ? Also, i find nothing about a fresh install >> directly with cn=config (without conversion of slapd.conf) into the admin >> guide ... >> >> I'm not a junior system administrator, i make a phd in geography / >> geomatics, and i have only one week before christmas to create and populate >> a new ldap in my laboratory. I try to learn the maximum with google/debian >> tutorial and a lot of false tutorial, but actually, and i'm sorry about >> that, i have no time to read all the man page, and all the admin guide ... >> >> Thanks you again for the time you take to answer to my question Raffael, >> and others. >> > > First, change the subject, your problem has nothing to do with SSL. > > And to your root password problem, if you just convert your offline config > to online config, you root password will be the same as before. > Did it worked with the offline configuration? > Or change the olcRootPW manually in the config ldif of your database. > > Hum i check into my config ldif and olcRootPW doesn't appear. # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 7bbc1dd2 dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: slapd.conf.seb olcConfigDir: /usr/local/etc/openldap/slapd.d/ olcArgsFile: /usr/local/var/run/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcLocalSSF: 71 olcLogLevel: Stats olcPidFile: /usr/local/var/run/slapd.pid olcReadOnly: FALSE olcReverseLookup: FALSE olcSaslHost: claroline.parisgeo.cnrs.fr olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCRLCheck: none olcTLSVerifyClient: never olcToolThreads: 1 olcWriteTimeout: 0 structuralObjectClass: olcGlobal entryUUID: 065b0668-632b-4573-a915-bbe2caf96586 creatorsName: cn=config createTimestamp: 20111214212046Z entryCSN: 20111214212046.446261Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20111214212046Z I try to re-add the pasword with slapmodify : dn:cn=config changetype: modify add: olcRootDN olcRootDN: cn=admin,dc=parisgeo,dc=cnrs,dc=fr dn: cn=config changetype: modify add: olcRootPW olcRootPW: {SSHA}1dWxkkRtyUJt5fDga0Pn4EAyKQ5RPI4+ root@xxxxx:/usr/local/etc/openldap# ldapadd -Y EXTERNAL -H ldapi:/// -f initSlapd.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "cn=config" ldap_modify: Insufficient access (50) Hum, i don't really understand why i have not access, i change only password, rootsuffix, and rootdn into the slapd.conf before conversion .. I try to add manually the attribute olcRootPw, olcSuffix,olcRootDN olcSuffix: dc=parisgeo,dc=cnrs,dc=fr olcRootDN: cn=admin,dc=parisgeo,dc=cnrs,dc=fr olcRootPW: {SSHA}1dWxkkRtyUJt5fDga0Pn4EAyKQ5RPI4+ I have this error at restart : Dec 15 10:52:04 claroline slapd[11462]: olcSuffix: value #0: suffix <DC=parisgeo,DC=cnrs,DC=fr> not allowed in frontend database. Hum i think it's a good idea to remove all config/data file, restart with a fresh slapd.conf and retry the conversion .. > > -- > Raffael Sahli > public(a)raffaelsahli.com > Switzerland > > -- <http://stackoverflow.com/users/385881/reyman64>

3 4

ACL question - minimum rights for Apache HTTP Server Bind User
by Axel Birndt 15 Dec '11

15 Dec '11

Hi @All, currently i'am using a special user "cn=bind,ou=technical,ou=user,dc=2axels-company,dc=de" as bind user in my apache.conf file. ----apache.conf------- ..... AuthType basic AuthBasicProvider ldap AuthName "LDAP-geschuetztes Verzeichnis" AuthLDAPUrl "ldap://localhost:389/ou=user,dc=2axels-company,dc=de?cn?sub" AuthLDAPBindDN "cn=bind,ou=technical,ou=user,dc=2axels-company,dc=de" # it doesn't work, if the bind password is encrypted... isn't it ?? #AuthLDAPBindPassword {SHA}pfiSFDDFSAAE$$%j8BTtCUqs9IZWsQ= # Because this, the password is currently used as an unencrypted one: AuthLDAPBindPassword xxxxxxxxxxx Require ldap-group cn=awstats,ou=groups,dc=2axels-company,dc=de .... ---------------------------------- Now my question: which minimum acl rights are needed for the Bind User: "cn=bind,ou=technical,ou=user,dc=2axels-company,dc=de" to connect to the ldap server and check the group from the user who try to login. I hope my description is understandable... Thanks and regards Axel -- Gruß Axel ------------------------------

4 4

Account question
by NetNinja 15 Dec '11

15 Dec '11

Hello, I have a two different user accounts and one works the other not so much. The account user03 works on both Solaris 10 and RHEL clients. While test01 can do everything but login to the Solaris 10 client, I can use this account to login to the RHEL client though. Can someone look at my accounts below and tell me why user03 works and test01 doesn't? # user03, People, test.net dn: uid=user03,ou=People,dc=test,dc=net uid: user03 cn: user03 objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 603 gidNumber: 500 homeDirectory: /home/user03 gecos: user03 # test01, People, test.net dn: uid:test01,ou=People,dc=test,dc=net uid: test01 cn: test01 objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowMax: 0 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 701 gidNumber: 500 homeDirectory: /home/test01 # ldapclient list NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_BINDDN= uid=proxyagent,ou=People,dc=test,dc=net NS_LDAP_BINDPASSWD= password NS_LDAP_SERVERS= X.X.X.X:389 NS_LDAP_SEARCH_BASEDN= dc=test,dc=net NS_LDAP_SERVER_PREF= X.X.X.X NS_LDAP_CACHETTL= 0 NS_LDAP_CREDENTIAL_LEVEL= proxy NS_LDAP_SERVICE_SEARCH_DESC= passwd:ou=People,dc=test,dc=net NS_LDAP_SERVICE_SEARCH_DESC= group:ou=People,dc=test,dc=net NS_LDAP_SERVICE_SEARCH_DESC= shadow:ou=People,dc=test,dc=net NS_LDAP_SERVICE_AUTH_METHOD= pam_ldap:simple I'm still testing so I ran ldapclient manual. When I feel that I have the the right setting, I will load the profile into LDAP. Any suggestions will be great.

3 4

Re: N-Way Multimaster. No base DN returned from server.
by Arturo Borrero Gonzalez 15 Dec '11

15 Dec '11

2011/12/15 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Thursday, December 15, 2011 12:59 AM +0100 Arturo Borrero Gonzalez > <cer.inet(a)linuxmail.org> wrote: > >> Hi there. >> >> I followed the documentation in openldap website for setting up a >> N-Way multimaster LDAP cluster. I have two nodes, but I will be >> expanding to 3 or 4 in a near future. >> When doing an ldapsearch, I get all the server data, but when accesing >> with ApacheDirectoryStudio (with same credentials) I get nothing. >> Nothing is wrong in logfiles. I guess a problem in ACLs, but it >> doesn't work even when binding as RootDN (and as seen in oficial >> documentation, rootdn is over the scope of any ACL) > > > If it works with ldapsearch, and it doesn't work with Apache Directory > Studio, then it sounds to me like there is a bug with Apache Directory > Studio. I would advise you take the issue up with that project. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration I've installed phpLDAPadmin and it's tells me: dc=example,dc=es -- The object doesn't exist. Create it now? And this seem to be the same problem I have with Apache Directory Studio. Doing slapcat i get the database, and doing ldapsearch I get the database only if I set the base dn with -b "dc=example,dc=es". But something is misconfigured in my server ¿Any idea? -- /* Arturo Borrero Gonzalez || cer.inet(a)linuxmail.org */ /* Use debian gnu/linux! Best OS ever! */

1 1

SSL/TLS testing
by Jayavant Patil 15 Dec '11

15 Dec '11

Hi, I am using openldap-2.4.19-4.x86_64 on fedora 12 machine. I have enabled openldap SSL/TLS. How do I know (test) that I am using SSL/TLS connections instead of normal ldap:///? -- Thanks & Regards, Jayavant Ningoji Patil Engineer: System Software Computational Research Laboratories Ltd. Pune-411 004. Maharashtra, India. +91 9923536030.

8 26

"controls require LDAPv3" on cn=config syncrepl
by Brandon Hume 15 Dec '11

15 Dec '11

I had a medium-size post describing some problems I'm having with an N-Way setup with 2.4.28, but I saw a post from Quanah that sent me in a new direction so I'm doing some more testing before whining about *that* problem... But meanwhile... can anyone tell me if seeing errors like the following is normal when replicating cn=config? On the provider: Nov 30 14:41:22 kil-ds-3 slapd[7540]: conn=1027 fd=26 ACCEPT from IP=172.30.96.203:55371 (IP=172.30.96.202:389) Nov 30 14:41:22 kil-ds-3 slapd[7540]: conn=1026 op=0 BIND dn="cn=config" mech=SIMPLE ssf=0 Nov 30 14:41:22 kil-ds-3 slapd[7540]: conn=1026 op=0 RESULT tag=97 err=0 text= Nov 30 14:41:22 kil-ds-3 slapd[7540]: conn=1026 op=1 DISCONNECT tag=101 err=2 text=controls require LDAPv3 Nov 30 14:41:22 kil-ds-3 slapd[7540]: conn=1026 op=1 do_search: get_ctrls failed Nov 30 14:41:22 kil-ds-3 slapd[7540]: conn=1026 fd=27 closed (operations error) ... and on the consumer: Nov 30 14:41:22 kil-ds-4 slapd[8178]: do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT (2) Protocol error Nov 30 14:41:22 kil-ds-4 slapd[8178]: do_syncrep2: rid=001 (2) Protocol error Nov 30 14:41:22 kil-ds-4 slapd[8178]: do_syncrepl: rid=001 rc -2 retrying (3 retries left)

4 5

N-Way Multimaster. No base DN returned from server.
by Arturo Borrero Gonzalez 15 Dec '11

15 Dec '11

Hi there. I followed the documentation in openldap website for setting up a N-Way multimaster LDAP cluster. I have two nodes, but I will be expanding to 3 or 4 in a near future. When doing an ldapsearch, I get all the server data, but when accesing with ApacheDirectoryStudio (with same credentials) I get nothing. Nothing is wrong in logfiles. I guess a problem in ACLs, but it doesn't work even when binding as RootDN (and as seen in oficial documentation, rootdn is over the scope of any ACL) The replication system is working well, afaik. I've readed folk with same problems, but not exactly; here: http://www.openldap.org/lists/openldap-technical/201004/msg00195.html Anyone could take a look on this? Version: 2.4.23-7.2 My cfg (slapd.d over Debian Stable ): dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=example,dc=es olcLastMod: TRUE olcRootDN: cn=admin,dc=example,dc=es olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 structuralObjectClass: olcHdbConfig olcRootPW: asdasd olcLimits: dn.exact="cn=admin,dc=example,dc=es" time.soft=unlimited time.hard=unl imited size.soft=unlimited size.hard=unlimited olcSyncrepl: {0}rid=003 provider="ldaps://ldap1.example.es/" binddn="cn=admin,dc= example,dc=es" bindmethod=simple credentials=asdasd se archbase="dc=example,dc=es" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=004 provider="ldaps://ldap2.example.es/" binddn="cn=admin,dc= example,dc=es" bindmethod=simple credentials=asdasd se archbase="dc=example,dc=es" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE olcDbIndex: objectClass,eduPersonEntitlement,memberUID,uid,mail eq olcAccess: {0}to dn.base="dc=example,dc=es" by dn="cn=admin,dc=example,dc=es" manage olcAccess: {1}to dn.base="cn=Subschema" by * read -- /* Arturo Borrero Gonzalez || cer.inet(a)linuxmail.org */ /* Use debian gnu/linux! Best OS ever! */

2 1

slapd-ldap as proxy to active directory
by Juan Miscaro 14 Dec '11

14 Dec '11

Good day. I would like to use the slapd-ldap backend as a proxy to Active Directory (Windows Server 2008 R2). Firstly, AD can be queried directly: $ ldapsearch -LLL -D "cn=John Doe,cn=users,dc=support,dc=com" -w okay -H ldap://ad.support.com -b cn=users,dc=support,dc=com '(sAMAccountName=jdoe)' cn sAMAccountName dn: CN=John Doe,CN=Users,DC=support,DC=com cn: John Doe sAMAccountName: jdoe Now, I have the following in slapd: ========== dn: cn=module{1},cn=config objectClass: olcModuleList cn: module{1} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_ldap dn: olcDatabase={2}ldap,cn=config objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {2}ldap olcDbURI: ldap://ad.support.com olcDbRebindAsUser: TRUE olcDbChaseReferrals: TRUE olcSuffix: cn=users,dc=support,dc=com ========== But when querying via the slapd instance I don't get anything back: $ ldapsearch -D "cn=John Doe,cn=users,dc=support,dc=com" -w okay -H ldap://slapd.example.com -b cn=users,dc=support,dc=com '(sAMAccountName=jdoe)' cn sAMAccountName # extended LDIF # # LDAPv3 # base <cn=users,dc=support,dc=com> with scope subtree # filter: (sAMAccountName=jdoe) # requesting: cn sAMAccountName # # search result search: 2 result: 32 No such object # numResponses: 1 I can query my normal/local DIT fine (even while authenticating as the remote AD user, which looks weird): $ ldapsearch -D "cn=John Doe,cn=users,dc=support,dc=com" -w okay -H ldap://slapd.example.com -b dc=example,dc=com '(ou=People)' cn # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: (ou=People) # requesting: cn # # People, example.com dn: ou=People,dc=example,dc=com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 What am I missing? TIA. -- /jm

2 1

Bind as an authenticated user for fetching directory information
by Jayavant Patil 14 Dec '11

14 Dec '11

Hi, I am using openldap-2.4.19-4.x86_64 on fedora 12 machine. On client node, in /etc/ldap.conf file, we specify binddn and bindpw. If not specified, the request will be anonymous. I have on each client machine more than 500 users. I want to send the request to server as an authenticated user but users are 500+. Then, how do I specify this in binddn and bindpw. I don't want to specify 'root' (admin) in binddn and bindpw. I have rootbinddn as root's dn and his password in /etc/ldap.secret (mode 600). As earlier said, anonymous request is creating 'I have no name!' problem while doing $ssh <user>@client, since I have given anonymous user auth access. If I specify anonymous read access, 'I have no name!' problem disappears but security is getting compromised. I think there is no problem with nscd daemon, since it is stopped or even I uninstalled that, the problem still persists. -- Thanks & Regards, Jayavant Ningoji Patil Engineer: System Software Computational Research Laboratories Ltd. Pune-411 004. Maharashtra, India. +91 9923536030.

2 2

Ldap is up, trying to get tls working.
by John Tobin 13 Dec '11

13 Dec '11

Folks, I have openldap up, it supports vsftpd, sshd, and 5 client linux machines for remote login. I would like to get tls working. I would support either ldaps [port 636], or the tls available on port 389, I am aware of the differences in implementation, and the fact that an administrator effectively has to make a decision to support one or the other in most cases. Currently: I have slapd running configured for tls under ldap [std port 389]. I am testing it on the slapd machine, with a client on the same machine. I am pointing to the same cacertificate in slapd.d [cn=config.ldif] and ldap.conf. With that in place, and the ldap.conf below: nightmare:/etc # cat ldap.conf base dc=dark,dc=net uri ldap://nightmare.dark.net # scope sub # binddn "cn=admin,dc=dark,dc=net" # bindpw jackie bind_policy soft # The user ID attribute (defaults to uid) pam_login_attribute uid pam_lookup_policy yes pam_password exop nss_schema rfc2307bis tls_reqcert never pam_filter objectClass=posixAccount ldap_version 3 nss_map_attribute uniqueMember uniqueMember ssl start_tls tls_cacert /var/lib/ldap/cacert.pem tls_cert /var/lib/server.crt tls_key /var/lib/ldap/server.key I have run ldapsearch: nightmare:/media # ldapsearch -v -x -H ldap://nightmare.dark.net:389/ -b "dc=dark,dc=net" -Z ldap_initialize( ldap://nightmare.dark.net:389/??base ) filter: (objectclass=*) requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <dc=dark,dc=net> with scope subtree # filter: (objectclass=*) # requesting: ALL # # dark.net dn: dc=dark,dc=net dc: dark o: dark objectClass: organization objectClass: dcObject # admin, dark.net dn: cn=admin,dc=dark,dc=net objectClass: organizationalRole cn: admin # Default Policy, dark.net dn: cn=Default Policy,dc=dark,dc=net objectClass: namedObject objectClass: pwdPolicy cn: Default Policy # People, dark.net dn: ou=People,dc=dark,dc=net objectClass: organizationalUnit ou: People description: People is used in mapping the /etc/passwd entries # jtobin, People, dark.net dn: uid=jtobin,ou=People,dc=dark,dc=net uid: jtobin cn: John C. Tobin objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount loginShell: /bin/ksh uidNumber: 5000 gidNumber: 100 homeDirectory: /home/jtobin gecos: John C. Tobin # defaultDNS, dark.net dn: cn=defaultDNS,dc=dark,dc=net cn: defaultDNS objectClass: top objectClass: suseDnsConfiguration suseDefaultBase: ou=DNS,dc=dark,dc=net # DNS, dark.net dn: ou=DNS,dc=dark,dc=net objectClass: top objectClass: organizationalUnit ou: DNS # search result search: 3 result: 0 Success # numResponses: 8 # numEntries: 7 nightmare:~ # ##### So I am assuming the ldapserver on ldap://nightmare.dark.net:389/ with tls works. [I looked through the message output in /var/log/message and see the ³STARTTLS² and ³TLS established tls_ssf=256²] I have done a number of similar ldapsearches. This appears to work correctly. On the client machine I now do : nightmare:/media # su - jtobin su: user jtobin does not exist nightmare:/media # /var/log/message - output...... nightmare:/var/log # tail f |grep I tls Oct 28 11:29:01 nightmare slapd[11118]: conn=1217 op=0 STARTTLS Oct 28 11:29:01 nightmare worker_nscd: nss-ldap: do_open: do_start_tls failed:stat=-1 Oct 28 11:29:01 nightmare slapd[11118]: connection_read(14): TLS accept failure error=-1 id=1217, closing Oct 28 11:29:01 nightmare slapd[11118]: conn=1217 fd=14 closed (TLS negotiation failure) Oct 28 11:29:01 nightmare slapd[11118]: conn=1218 op=0 STARTTLS Oct 28 11:29:01 nightmare worker_nscd: nss-ldap: do_open: do_start_tls failed:stat=-1 Oct 28 11:29:01 nightmare slapd[11118]: connection_read(14): TLS accept failure error=-1 id=1218, closing Oct 28 11:29:01 nightmare slapd[11118]: conn=1218 fd=14 closed (TLS negotiation failure) [if you want more of the log, I can obviously get it, but these appear to be the important parts.] This is probably a configuration error, or a logical / architecture misunderstanding, ok, I m a newbie. Do I have certificates incorrectly generated? [certificates were generated via http://www.openldap.org/faq/data/cache/185.html]. What did I do wrong? This is running openldap 2.4.26 off of Suse 12.1 milestone 5. Thanks in advance. tob

4 6

Need help regarding rfc for Jldap
by Brajabasi Padhy 13 Dec '11

13 Dec '11

Hello Sir, I'm Brajabasi from india. I wanted to use OpenLDAP for my project. I found OpeLDAP( Java version and C version) 1) OpenLDAP(Java version) compliant to RFC 2251-2256,2829-2830 2) OpenLDAP(C version) compliant ti RFC 4511-RFC 4520 RFC 4511 is the latest RFC which obseletes the RFC 2251-2256,2819-2830. Could you please suggest which version i should use for my application and why? Thanks with Regards, Brajabasi

1 0

(no subject)
by Brajabasi Padhy 13 Dec '11

13 Dec '11

Hello Sir, I'm Brajabasi from india. I wanted to use OpenLDAP for my project. I found OpeLDAP( Java version and C version) 1) OpenLDAP(Java version) compliant to RFC 2251-2256,2829-2830 2) OpenLDAP(C version) compliant ti RFC 4511-RFC 4520 RFC 4511 is the latest RFC which obseletes the RFC 2251-2256,2819-2830. Could you please suggest which version i should use for my application and why? Thanks with Regards, Braj

1 0

Re:
by rey sebastien 12 Dec '11

12 Dec '11

Le lun. 12 déc. 2011 22:20:14 CET, Quanah Gibson-Mount a écrit : > --On Monday, December 12, 2011 9:55 PM +0100 rey sebastien > <reyman64(a)gmail.com> wrote: > >> IMHO i know this problem but i think this is better than nothing, and >> actually i have nothing. I wait for valid certificate... >> And sorry but your RTFM answer doesn't help me to resolve this problem >> with gnutls and debian, i take many hours to find a valid solution in my >> use case, and the manual doesn't help me particulary on this point. >> >> OpenLdap is a great software, but documentation it's a little "cryptic" >> for beginner like me, so i think it's easy to be rude with beginner on >> many points. > > You're using bad documentation from a questionable source, and are > pointed at the correct documentation, and have an issue with that? > That seems a little odd to me. When i add TLSCACertificateFile attribute with correct path, openldap with gnutls don't re-start.. I'm ok with Raffael, it's probably a bad idea to use the debian package, but i need one day or more to understand why an "official" package from debian create all this configuration's problem. If you want to use SSL/TLS, then > clearly you want a secure server. To blindly follow a guide that turns > off all of those security features leaves you back at square one. If > you don't understand the OpenLDAP documentation, then ask questions > about it rather than falling back to something unreliable that's going > to leave questionable state. > This is why i'm register on this mailling list, with hope some answers or experiences of other members resolve/enlight my beginner problems :) There a lot and a lot of old documentation for openLdap, with old slapd.conf configuration, old generation of certificates, incompatibility between certificate gnutls and openssl .. It's not easy to find the right and exhaustive documentation .. > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

1 0

Re: I have no name!
by Denis Witt 12 Dec '11

12 Dec '11

On 12.12.2011 16:44, Craig White wrote: >>> I am using openldap-2.4.19-4.x86_64 on fedora 12 machine. I am facing >>> the 'I have no name !' while I do ssh on client machine(All user info is >>> getting propagated to client machines properly (checked with getent >> are you using nscd (Name Service Cache Daemon)? If so uninstall it and the error should be gone. See google for details. >> If you want to verify before uninstall just restart/stop nscd and check if the name is shown. > FTR - I don't personally care for nscd very much but it seems that with Ubuntu 10.04 LTS that I am forced to use it or my host-based ACL's (pam_check_host_attr yes) will fail. Hi, please always reply to the list, thanks. Another "solution" might be to restart nscd every hour (or something), it seems that the cache is refreshed then and everything works fine. Bye.

3 2

decoding attrs error
by Angel L. Mateo 12 Dec '11

12 Dec '11

Hello, I have a web application that doesn't work with openldap 2.4.21. The same application is working with an old openldap 2.3.30. The problem I have is that for some reason this application performs a search with an undefined filter, the error I get in normal run is: Dec 12 13:26:47 canis21 slapd[29241]: get_filter: unknown filter type=48 In the older slapd, log is: Dec 12 03:59:14 canis5 slapd[16830]: conn=3220865 op=3 SRCH base="dc=unidades,dc=vistas,dc=um,dc=es" scope=1 deref=0 filter="(?=undefined)" Dec 12 03:59:14 canis5 slapd[16830]: conn=3220865 op=3 SEARCH RESULT tag=101 err=0 nentries=0 text= If I run slapd in debug mode, I get: ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x7f23d5a0a9d0 ptr=0x7f23d5a0a9d3 end=0x7f23d5a0aa0d len=58 0000: 63 38 04 24 64 63 3d 75 6e 69 64 61 64 65 73 2c c8.$dc=unidades, 0010: 20 64 63 3d 76 69 73 74 61 73 2c 20 64 63 3d 75 dc=vistas, dc=u 0020: 6d 2c 20 64 63 3d 65 73 0a 01 01 0a 01 00 02 02 m, dc=es........ 0030: 00 96 02 01 00 01 01 00 30 00 ........0. >>> dnPrettyNormal: <dc=unidades, dc=vistas, dc=um, dc=es> => ldap_bv2dn(dc=unidades, dc=vistas, dc=um, dc=es,0) <= ldap_bv2dn(dc=unidades, dc=vistas, dc=um, dc=es)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=unidades,dc=vistas,dc=um,dc=es)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=unidades,dc=vistas,dc=um,dc=es)=0 <<< dnPrettyNormal: <dc=unidades,dc=vistas,dc=um,dc=es>, <dc=unidades,dc=vistas,dc=um,dc=es> SRCH "dc=unidades, dc=vistas, dc=um, dc=es" 1 0 150 0 0 begin get_filter ber_scanf fmt (x) ber: ber_dump: buf=0x7f23d5a0a9d0 ptr=0x7f23d5a0aa0b end=0x7f23d5a0aa0d len=2 0000: 30 00 0. get_filter: unknown filter type=48 end get_filter 0 filter: (?=undefined) ber_scanf fmt ({M}}) ber: ber_dump: buf=0x7f23d5a0a9d0 ptr=0x7f23d5a0aa0d end=0x7f23d5a0aa0d len=0 send_ldap_disconnect 2:decoding attrs error send_ldap_response: msgid=0 tag=120 err=2 ber_flush2: 58 bytes to sd 15 0000: 30 38 02 01 00 78 33 0a 01 02 04 00 04 14 64 65 08...x3.......de 0010: 63 6f 64 69 6e 67 20 61 74 74 72 73 20 65 72 72 coding attrs err 0020: 6f 72 8a 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e or..1.3.6.1.4.1. 0030: 31 34 36 36 2e 32 30 30 33 36 1466.20036 ldap_write: want=58, written=58 0000: 30 38 02 01 00 78 33 0a 01 02 04 00 04 14 64 65 08...x3.......de 0010: 63 6f 64 69 6e 67 20 61 74 74 72 73 20 65 72 72 coding attrs err 0020: 6f 72 8a 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e or..1.3.6.1.4.1. 0030: 31 34 36 36 2e 32 30 30 33 36 1466.20036 conn=1000 op=3 DISCONNECT tag=120 err=2 text=decoding attrs error connection_closing: readying conn=1000 sd=15 for close Any idea? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

1 0

scheme extension with own OID
by Andreas Cieslak 12 Dec '11

12 Dec '11

Hi list, Because of a concern to modify our ldap environment I need to extend the scheme. The attribute I need is vacationActive and some other attributes which I didn't find in the existing OpenLDAP schemes. My question to you is, if I need to get a registered OID for our company to define the objectclass "vacation" with some further attributes? -I have read some articles about this- Or is there an up to date OID-list where I can search for a vacation objectclass or the vacation attributes which maybe already exist? - I only found the following - http://www.alvestrand.no/objectid/2.16.840.1.113730.3.1.html http://www.oid-info.com/get/2.16.840.1.113730.3.1.14 Any hints would be very appreciated. Thanks in advance. Kind regards. Andreas

1 0

OpenLDAP reader-only users , and removing anonymous user reading ?
by rey sebastien 12 Dec '11

12 Dec '11

Hello, I search some information to make reader-only users on my openLDAP .. I have already cn=reader-only, and my dn equal "dc=parisgeo,dc=cnrs,dc=fr" How can i create a .ldif with specific configuration to remove anonymous user reading, and authorize the read of my ldap only with the cn=reader-only authentification ? Thanks a lot, Best regards, SR

3 3

French tutorial
by reyman 12 Dec '11

12 Dec '11

Hello, I work on a tutorial (based on the many tutorial existing) to make TLS/SSL connexion possible with debian and the new cn=config mode (no slapd.conf) At this moment, you can see my work here (in french only) : http://www.services.parisgeo.cnrs.fr/2011/12/ldap-securise/ Thanks Best regards, Sr -- <http://stackoverflow.com/users/385881/reyman64>

1 0

I have no name!
by Jayavant Patil 12 Dec '11

12 Dec '11

Hi, I am using openldap-2.4.19-4.x86_64 on fedora 12 machine. I am facing the 'I have no name !' while I do ssh on client machine(All user info is getting propagated to client machines properly (checked with getent passwd,getent passwd and getent shadow)), and this is because I specify no access to anonymous. But, when I specify read access to anonymous this problem is getting resolved but my security is getting compromised since anonymous is reading everything. How do I write ACL rule to achieve both each user to see his data only i.e. security and getting user-name while doing ssh on client.? -- Thanks & Regards, Jayavant Ningoji Patil Engineer: System Software Computational Research Laboratories Ltd. Pune-411 004. Maharashtra, India. +91 9923536030.

2 1

Re: slapd hanging - meta backend - Solaris 10
by Lincoln Souzek 12 Dec '11

12 Dec '11

Hello, I compiled 2.4.28 and I'm trying to recreate the issue with that version but I've run into two other issues that are causing slapd to crash in the meantime. I compiled with the following options: ./configure --enable-ldap --enable-meta --prefix="/opt/local/openldap-2.4.28" --enable-dynlist --enable-memberof --enable-rwm --enable-mdb=no The first issue is that slapd has crashed twice with a SIGBUS and dumped a core file. I haven't been able to regularly reproduce it but both times it happened on the initial query after a bind. The stack of the thread where that signal originates wasn't identical both times but the two instances look similar: ----------------- lwp# 6 / thread# 6 -------------------- fedd446c _malloc_unlocked (28, 0, 1a40cb8, 1646c0, 0, 0) + 22c fedd4224 malloc (28, 1, 940a8, 59550, fee68288, fee709b0) + 4c 001646c0 ber_memalloc_x (28, 0, 0, 0, 0, 2fcfc8) + 58 00059550 ch_malloc (28, 427390, 0, fbfff428, 8000, 4551c8) + 8 00047910 ???????? (7864d4, 7866e4, 0, 0, 0, 2fcfc8) 00047b20 attrs_dup (7866e4, 427390, 0, fbfff428, 8000, 63) + 48 0004a980 entry_dup2 (4273d4, 427384, 0, 0, 0, 2fcfc8) + ac 0011f1d4 ???????? (fffffff6, fbfffcb8, 2932d0, fbfff428, 8000, 63) 0011f938 ???????? (1a3cfe0, fbfffcb8, 0, 0, 1, 0) 000a2fe4 ???????? (8000, fbfffcb8, 1b5b298, 2627c8, 8000, a2f70) 0004e978 ???????? (1a3cfe0, fbfffcb8, 2, 41a10, ffffffff, ffffffff) 00050d88 slap_send_search_entry (0, fbfffcb8, 1b5b298, 2627c8, 262750, 1ee000) + 3d4 00041de8 fe_op_search (1a3cfe0, fbfffcb8, 2, 41a10, 1, 0) + 3d8 000a39cc overlay_op_walk (8000, fbfffcb8, 8000, 1ee5f8, 8000, 200) + c8 000a3ae4 ???????? (1a3cfe0, fbfffcb8, 2, 0, 2b9d88, 1ee6f0) 00041528 do_search (1a3cfe0, fbfffcb8, fee6cbc0, fe020c00, 40f98, fbfffa38) + 590 0003f8e4 ???????? (fbfffe08, 1a3cfe0, fee6cbc0, fe020c00, 2fcfe8, 0) 00040270 ???????? (0, 20, fee6cbc0, fe020c00, 268328, 0) 0013ca30 ???????? (268318, fc000000, 0, 0, 13c8d4, 1) fee40368 _lwp_start (0, 0, 0, 0, 0, 0) ----------------- lwp# 5 / thread# 5 -------------------- fedd446c _malloc_unlocked (800, 1, 420780, fedd4224, 0, 0) + 22c fedd416c _smalloc (18, 0, 9415c, 16cbc8, fffffff9, fee6fa48) + 4c fedd4224 malloc (17, 1, 940a8, 16cf38, fee68288, fee709b0) + 4c 0016cbc8 ber_memalloc_x (17, 0, 0, 0, 0, 30dc98) + 58 0016cf38 ber_dupbv_x (8dea98, 12f6ab0, 0, fc3ff4c8, 8000, 8de950) + 3c 0004990c ???????? (750174, 750024, 0, 0, 0, 30dc98) 00049a20 attrs_dup (750024, 3fbc50, 0, fc3ff4c8, 8000, 63) + 48 0004c7b0 entry_dup2 (3fbc6c, 3fbc44, 0, 0, 0, 30dc98) + ac 0012556c ???????? (fffffff6, fc3ffd58, 2c7208, fc3ff4c8, 8000, 63) 00125d68 ???????? (423350, fc3ffd58, 0, 0, 0, 0) 000a71c0 ???????? (8000, fc3ffd58, 9e1f38, 275fb8, 8000, a714c) 00050818 ???????? (423350, fc3ffd58, ffffffff, ffffffff, 0, 0) 00052cb8 slap_send_search_entry (0, fc3ffd58, 9e1f38, 275fb8, 3, 1f9400) + 3e0 00043c94 fe_op_search (423350, fc3ffd58, 2, 43894, 1, 0) + 400 000a7b98 overlay_op_walk (8000, fc3ffd58, 8000, 1f9b90, 8000, 200) + c8 000a7cb0 ???????? (423350, fc3ffd58, 2, fc3ffad8, 2a0bd8, 1f9c88) 00043364 do_search (423350, fc3ffd58, fee6cbc0, 1edc00, 177400, fc3ffad8) + 618 00041698 ???????? (fc3ffe08, 423350, fee6cbc0, fdcf0800, 27bb18, 0) The second issue, which I can reproduce, is that slapd is crashing with a SIGSEGV when it encounters the following entry in a Sun Directory Server configured as a meta backend: c=undef,dc=company Is undef a reserved word that's causing an issue here? In earlier versions (2.4.23, at least), it seems like that entry was just discarded and not returned as a search result. Thanks, Lincoln On Mon, Dec 5, 2011 at 10:32 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, December 05, 2011 6:09 PM +0100 Lincoln Souzek < > lsouzek(a)gmail.com> wrote: > > Hello, >> >> I've seen a couple of instances where slapd becomes unresponsive, >> apparently because the threads are waiting on a backend meta DB. We're >> running slapd 2.4.23 on Solaris 10 (update 11/06). We have 128 threads >> configured and when I attach with truss, I see 130 allocated, most of >> which look like this: >> > > I would note there have been some re-entry fixes for back-meta since > 2.4.23 was released. I would suggest you re-try with the latest OpenLDAP > version as a first step. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: Solaris 10 Native Client connecting to OpenLdap How to needed
by adam＠spoontech.biz 12 Dec '11

12 Dec '11

Hi, I have scripted the following which is what we use when joining a new client to ldap: setup_ldap.sh #!/bin/sh if [ ! -d /var/ldap ] ; then mkdir /var/ldap chown root:sys /var/ldap chmod 755 /var/ldap fi cd /var/ldap rm -rf /var/ldap/* >/dev/null 2>&1 /usr/sfw/bin/sparcv9/certutil -N -d /var/ldap if [ -f /etc/ssl/our_CA_cert.pem ] ; then /usr/sfw/bin/sparcv9/certutil -A -n "ca-cert1" -i /etc/ssl/our_CA_cert.pem -a -t CT -d . else echo 'Could not find /etc/ssl/our_CA_cert.pem' fi if [ -f /etc/ssl/our_CA_cert2.pem ] ; then /usr/sfw/bin/sparcv9/certutil -A -n "ca-cert2" -i /etc/ssl/our_CA_cert2.pem -a -t CT -d . else echo 'Could not find /etc/ssl/our_CA_cert2.pem' fi if [ -f /etc/ssl/our_root_CA.pem ] ; then /usr/sfw/bin/sparcv9/certutil -A -n "ca-cert-root" -i /etc/ssl/our_root_CA.pem -a -t CT -d . else echo 'Could not find /etc/ssl/our_root_CA.pem' fi ldapclient init -v -a profileName=ldapprofilename -a domainName=example.com -a proxyDN=cn=proxyagent,ou=profile,dc=example,dc=com -a proxyPassword=examplepasswd ldapserver1 svcadm enable svc:/network/ldap/client:default svcadm restart svc:/network/ldap/client:default svcadm enable svc:/system/name-service-cache:default svcadm restart svc:/system/name-service-cache:default Obviously from the script above you can see that we have created profiles in ldap storing settings like uri etc. We did this so that machines authenticate to our local ldap server first, then connect to remote servers if unable to get a response from the local server. Let me know if you need anything else. Cheers, > Adam, > > What is the ldapclient init command you are using? > > > > On Sun, Dec 11, 2011 at 5:14 AM, <adam(a)spoontech.biz> wrote: > >> Hi, I manage an OpenLDAP environment consisting of Linux, Solaris and >> AIX. >> >> Here is the Schema I use for Solaris 10. >> >> Hope this helps. >> >> # Sun nisMapEntry attributes >> attributetype ( 1.3.6.1.1.1.1.28 >> NAME 'nisPublickey' >> DESC 'nisPublickey' >> EQUALITY caseIgnoreIA5Match >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) >> >> attributetype ( 1.3.6.1.1.1.1.29 >> NAME 'nisSecretkey' >> DESC 'nisSecretkey' >> EQUALITY caseIgnoreIA5Match >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) >> >> attributetype ( 1.3.6.1.4.1.1.1.1.12 SUP name >> NAME 'nisDomain' ) >> >> # Sun additional attributes to RFC2307 attributes (NIS) >> attributetype ( 2.16.840.1.113730.3.1.30 >> NAME 'mgrpRFC822MailMember' >> DESC 'mgrpRFC822MailMember' >> EQUALITY caseIgnoreIA5Match >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) >> >> #attributetype ( 1.3.6.1.4.1.42.2.27.2.1.15 >> # NAME 'rfc822MailMember' >> # DESC 'rfc822MailMember' >> # EQUALITY caseIgnoreIA5Match >> # SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.1.1.12 >> NAME 'nisNetIdUser' >> DESC 'nisNetIdUser' >> EQUALITY caseExactIA5Match >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.1.1.13 >> NAME 'nisNetIdGroup' >> DESC 'nisNetIdGroup' >> EQUALITY caseExactIA5Match >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.1.1.14 >> NAME 'nisNetIdHost' >> DESC 'nisNetIdHost' >> EQUALITY caseExactIA5Match >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) >> >> # Sun NIS publickey objectclass >> objectclass ( 1.3.6.1.1.1.2.14 >> NAME 'NisKeyObject' >> DESC 'NisKeyObject' >> SUP top >> MUST ( cn $ nisPublickey $ nisSecretkey ) >> MAY ( uidNumber $ description ) ) >> >> # Sun NIS domain objectclass >> objectclass ( 1.3.1.6.1.1.1.2.15 >> NAME 'nisDomainObject' >> DESC 'nisDomainObject' >> SUP top AUXILIARY >> MUST ( nisDomain ) ) >> >> # Sun NIS mailGroup objectclass >> objectclass ( 2.16.840.1.113730.3.2.4 >> NAME 'mailGroup' >> DESC 'mailGroup' >> SUP top >> MUST ( mail ) >> MAY ( cn $ mgrpRFC822MailMember ) ) >> >> # Sun NIS nisMailAlias objectclass >> #objectclass ( 1.3.6.1.4.1.42.2.27.1.2.5 >> # NAME 'nisMailAlias' >> # DESC 'nisMailAlias' >> # SUP top >> # MUST ( cn ) >> # MAY ( rfc822mailMember ) ) >> >> # Sun NIS nisNetId objectclass >> objectclass ( 1.3.6.1.4.1.42.2.27.1.2.6 >> NAME 'nisNetId' >> DESC 'nisNetId' >> SUP top >> MUST ( cn ) >> MAY ( nisNetIdUser $ nisNetIdGroup $ nisNetIdHost ) ) >> >> # Below is optional unless you want to use ldap_gen_profile >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.15 SUP name >> NAME 'SolarisLDAPServers' >> DESC 'SolarisLDAPServers' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.16 SUP name >> NAME 'SolarisSearchBaseDN' >> DESC 'SolarisSearchBaseDN' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.17 >> NAME 'SolarisCacheTTL' >> DESC 'SolarisCacheTTL' >> EQUALITY integerMatch >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.18 SUP name >> NAME 'SolarisBindDN' >> DESC 'SolarisBindDN' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.19 SUP name >> NAME 'SolarisBindPassword' >> DESC 'SolarisBindPassword' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.20 SUP name >> NAME 'SolarisAuthMethod' >> DESC 'SolarisAuthMethod' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.21 SUP name >> NAME 'SolarisTransportSecurity' >> DESC 'SolarisTransportSecurity' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.24 SUP name >> NAME 'SolarisDataSearchDN' >> DESC 'SolarisDataSearchDN' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.25 SUP name >> NAME 'SolarisSearchScope' >> DESC 'SolarisSearchScope' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.26 >> NAME 'SolarisSearchTimeLimit' >> DESC 'SolarisSearchTimeLimit' >> EQUALITY integerMatch >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.27 SUP name >> NAME 'SolarisPreferedServer' >> DESC 'SolarisPreferedServer' ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.28 SUP name >> NAME 'SolarisPreferedServerOnly' >> DESC 'SolarisPreferedServerOnly' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.29 SUP name >> NAME 'SolarisSearchReferral' >> DESC 'SolarisSearchReferral' >> SINGLE-VALUE ) >> >> objectclass ( 1.3.6.1.4.1.42.2.27.5.2.7 >> NAME 'SolarisNamingProfile' >> DESC 'Solaris LDAP NSS Profile' >> SUP top STRUCTURAL >> MUST ( cn $ SolarisLDAPServers ) >> MAY ( SolarisBindDN $ SolarisBindPassword $ >> SolarisSearchBaseDN $ SolarisAuthMethod $ >> SolarisTransportSecurity $ SolarisSearchReferral $ >> SolarisDataSearchDN $ SolarisSearchScope $ >> SolarisSearchTimeLimit $ SolarisCacheTTL ) ) >> >> # End of solaris.schema >> > I am working on getting a bunch of Solaris 10 hosts connected to >> OpenLdap. >> > I am not Ldap expert by far however I must get this working. >> > >> > I have 0 issues getting Linux clients to connect but Solaris 10 how >> to's >> > docs are very evasive. >> > >> > I have searched everywhere the best I can find is a few online docs >> that >> > say you need to load a custom schema. >> > >> > I just need user / passwd authentication to a directory nothing more. >> Will >> > not be using TLS.. >> > >>

1 0

Solaris 10 Native Client connecting to OpenLdap How to needed
by Jeremy Loukinas 11 Dec '11

11 Dec '11

I am working on getting a bunch of Solaris 10 hosts connected to OpenLdap. I am not Ldap expert by far however I must get this working. I have 0 issues getting Linux clients to connect but Solaris 10 how to's docs are very evasive. I have searched everywhere the best I can find is a few online docs that say you need to load a custom schema. I just need user / passwd authentication to a directory nothing more. Will not be using TLS..

3 3

Debugging OpenLDAP client: Where are the log files?
by daisy.wu＠emc.com 11 Dec '11

11 Dec '11

Hi, OpenLDAP developers, I've been able to successfully built OpenLDAP client libraries liblber and libldap for Window 64 bit OS. I wrote a test program to connect to Microsoft AD (hosted on Win 2008 R2, a 64 bit OS) over SSL. I made sure the root certificate file is converted to X509 base 64 PEM format. And the certificate file name is named using the hash value returned from "openssl" command. I made sure I can telnet to the AD host at port 636 from my test machine (where I run my test program). This is to make sure there's not network connectivity problem between my client test machine and the LDAP server host. Here's snippet of my source code: int debug_flag = -1; // debug all rc = ldap_set_option( ld, LDAP_OPT_DEBUG_LEVEL, &debug_flag); rc = ldap_sasl_bind_s( ld, dn, LDAP_SASL_SIMPLE, &passwd, NULL, NULL, NULL); if (rc != LDAP_SUCCESS) { trace("%15s: %s (%s: %d = %s)", "FAILED", "ldap_sasl_bind_s() failed!", "Return value is", rc, ldap_err2string(rc)); } However, my OpenLDAP client test program fails with the following error: 0011-12-10 16:08:59 [5296]: FAILED: ldap_sasl_bind_s() failed! (Return value is: -1 = Can't contact LDAP server) My question is: I need to troubleshoot this problem. I will need to examine the OpenLDAP log files to find the root cause. Where are the OpenLDAP log files located? I read that the log file location is configured in slapd.conf. But where is slapd.conf file on Windows? Considering I am not running OpenLDAP server on this test machine. Any input or feedback will be much appreciated. Thanks. Daisy

1 0

Syncrepl SSL fail
by Hugo Deprez 10 Dec '11

10 Dec '11

Dear community, I setup a syncrepl between my master openldap server and a consumer. I am trying to use SSL for this syncrepl I got the following error in the log when I start slapd on the consumer : Oct 13 17:04:59 server slapd[16905]: slapd starting Oct 13 17:04:59 server slapd[16905]: slap_client_connect: URI=ldaps://ldap.mydomain.fr:1024/ DN="cn=syncrepluser,o=others,dc=mydomain,dc=fr" ldap_sasl_bind_s failed (-1) Oct 13 17:04:59 server slapd[16905]: do_syncrepl: rid=003 rc -1 retrying (9 retries left) I don't understand why it is failing as a single ldapsearch from the same server with the syncrepl user is working. here is my syncrepl configuration : Syncrepl rid=003 provider=ldaps://ldap.mydomain.fr:1024/ type=refreshOnly retry="60 10 600 +" interval=00:00:00:10 searchbase="dc=mydomain,dc=fr" scope=sub schemachecking=on bindmethod=simple binddn="cn=syncrepluser,o=others,dc=mydomain,dc=fr" credentials=my_password Any idea ? Regards, Hugo

8 14

Starting out with NSS overlay - Guidance required
by ptw 09 Dec '11

09 Dec '11

Hi gang! I'm looking for some guidance in what is most probably a very common objective. Which is to manage all authentication to network hosts from slapd. To begin, my goal is to have: 1. one machine (generically-configured LDAP client) running sshd (10.153.107.100) 2. multiple LDAP users 3. specify, from slapd, that only one user (tony) can log in over ssh to the machine Surprisingly, I have not found much documentation on this stuff beyond the slapo-nssov man page. Anyway, I have some LDIF entries ready to go but I'm feeling very uneasy about dumping them in and hoping for the best. I would rather learn more about how this all works together and hopefully get some pointers/gotchas from others who have done this before. That's why I'm writing this email. In particular, at this point I only want the bare necessities to achieve my simple goad specified above. My slapd server has the nis and ldapns schemas configured and the client machine has libnss-ldapd (applied to group and passwd services) and libpam-ldapd. All systems are running Ubuntu 11.10. I have manually disabled nslcd on the Ubuntu client machine (sudo update-rc.d nslcd disable). These are the entries I have so far: for slapd-config: # NSSOV dn: olcOverlay=nssov,ocDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcNssOvConfig olcOverlay: nssov olcNssSsd: passwd ldap:///ou=People,dc=example,dc=com??one olcNssSsd: group ldap:///ou=People,dc=example,dc=com??one olcNssSsd: hosts ldap:///ou=People,dc=example,dc=com??one olcNssPam: hostservice uid2dn olcNssPamSession: sshd # ACL dn: olcDatabase={1}hdb,cn=config olcAccess: to attrs=userPassword by anonymous auth by self write by * none olcAccess: to attrs=shadowLastChange by self write by * none olcAccess: to * by self write by * read olcAccess: to dn.exact=cn=host1.example.com,ou=Hosts,dc=example,dc=com attrs=authorizedservice by dn.exact=cn=ssh,ou=host1,ou=server_access,ou=Groups,dc=example,dc=com compare by * read ================== The sshd host, user & group entries from my regular hdb-based DIT: # NSSOV HOST and USER dn: cn=host1.example.com,ou=Hosts,dc=example,dc=com objectClass: device objectClass: top objectClass: ipHost objectClass: authorizedServiceObject cn=host1.example.com ipHostNumber: 10.153.107.100 authorizedService: sshd dn: cn=ssh,ou=host1,ou=server_access,ou=Groups,dc=example,dc=com objectClass: posixGroup cn: ssh-host1-server_access gidNumber: 6000 dn: uid=tony,ou=People,dc=example,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount uid: tony cn: Tony Doe uidNumber: 11000 gidNumber: 6000 userPassword: tonyldap loginShell: /bin/bash homeDirectory: /home/tony =================== Anyone? Thanks in advance, Peter

2 1

Seemingly broken database
by Peter Mogensen 09 Dec '11

09 Dec '11

Hi, I have a large database with several million entries, which for a few specific entries takes very long (several minutes) to search. Looking at the debug output the search suddenly goes into a mode where it tests a lot of completely irrelevant entries and outputs a lot of "bdb_search: <number> scope not okay" messages - which takes very long time before the query ends. I've tried deleting all indexes and re-indexing with slapdindex, but the problem persists - also with 2.4.28. It's BDB 4.8.26 with back_bdb. However... loading the entire database with slapadd made the problem go away. So I suspect the id2entry or dn2id database is broken. So now I'm wondering... how do these situations occur and is there anyway to fix the database without reloading. It takes several hourse to reload, so it's not an ideal situation to have to do that every time such an event occurs. They are rather rare compared to the total number of entries, but they pop up once in a while, so it'll be a rutine job to start the database over from ldif, if that's the solution. Is there any tool to inspect the BDB database, find the problem, fix it and re-index? /Peter

3 4

creating databases corruption
by mark cunningham 09 Dec '11

09 Dec '11

Default install with debian, dc=nodomain as the database... This is my ldif dn: olcDatabase=hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: hdb olcSuffix: o=myTestDB olcDbDirectory: /var/lib/ldap olcAccess: to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,o=myTestDB" write by * none olcAccess: to dn.base="" by * read olcAccess: to * by self write by dn="cn=admin,o=myTestDB" write by * read olcRootDN: cn=admin,o=myTestDB olcRootPW:: e1NTSEF9MERCYWRzYXpicy9zQ1dSRmJUbFRuRlUyVFdwK0p6Qi8= olcDbIndex: objectClass eq ldapadd -vH ldapi:/// -Y EXTERNAL -f filewithldif Now slapcat just freezes when run, doesn't end, doesn't give out any text. slapcat -n 0 does give: dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap olcSuffix: o=myTestDB olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,o=myTestDB" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by self write by dn="cn=admin,o=myTestDB" write by * read olcRootDN: cn=admin,o=myTestDB olcRootPW:: e1NTSEF9MERCYWRzYXpicy9zQ1dSRmJUbFRuRlUyVFdwK0p6Qi8= olcDbIndex: objectClass eq structuralObjectClass: olcHdbConfig entryUUID: 8f41159e-b658-1030-8ee3-253edcff5134 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20111209022343Z entryCSN: 20111209022343.389564Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20111209022343Z slapd -V @(#) $OpenLDAP: slapd 2.4.23 (Jun 16 2011 02:53:39) $ buildd@murphy :/build/buildd-openldap_2.4.23-7.2-i386-Y1mwvF/openldap-2.4.23/debian/build/servers/slapd Fresh install on squeeze debian along with nodomain one. Mark

1 0

Re: memberof overlay deployment
by Asplund Marko 08 Dec '11

08 Dec '11

Masarati wrote: > slapo-memberof(5) does not support tool mode; in order to populate the > memberOf attribute of an existing database you need to use ldapadd(1). > You could, for example, dump your group entries, remove them, and re-add > them via ldapadd(1). Thanks for clearing that out. Could this be mentioned in the documentation somewhere (e.g. slapo-memberof(5))? So, the procedure would look something like this? Scripting would be a lot easier if ldapsearch could optionally output DNs without wrapping lines. # dump existing groups ldapsearch -H ldap://localhost:389 -b dc=example,dc=org -x -w XXXX -D cn=manager,dc=example,dc=org '(objectclass=groupofnames)' > groups.ldif # list existing groups by DN cat groups.ldif | perl -p00e 's/\r?\n //g' |grep '^dn: ' | sed -e 's/^dn: //' > groups_to_del.ldif # remove existing groups ldapdelete -v -c -H ldap://localhost:389 -x -w XXXX -D cn=manager,dc=example,dc=org -f groups_to_del.ldif # re-add groups ldapadd -v -H ldap://localhost:389 -x -w XXXX -D cn=manager,dc=example,dc=org -f groups.ldif best regards, marko

3 5

Test - disregard
by Peter Matulis 08 Dec '11

08 Dec '11

Pardon the noise. I've had trouble sending to this mailing list so I'm testing with this (3rd) address. Peter

1 0

RootDSE search, add attributes
by W.Siebert＠t-systems.com 08 Dec '11

08 Dec '11

Hello, my application sends a root_dse search, (objectclass=*) without any attributes. So openldap answers with 2 lines: Top objectClass: top objectClass: OpenLDAProotDSE But I need all attributes and controls Application is a blackbox, I can't change the search filter. Question: is it posible to add an attribute with '+' to get all system features by using rewritting/remapping to substitute the ampty attribute witch '+' regards Waldemar

2 1

OpenLDAP 2.3.4.3: modrdn and synrepl
by Brian C. Hill 08 Dec '11

08 Dec '11

Hello, I am using OpenLDAP 2.3.43 from the RHEL 5 rpm (openldap-2.3.43-12.el5_7.10) on RHEL 5 with syncrepl from one master to multiple slaves. This works fine for add/deletes/mods but seemingly not for modrdns. I have a perl script that uses Net::LDAP to rename logins with moddn (modrdn). When I do this, the master updates properly, but the slaves generally crash or hang, or less often just don't sync the change. A slapd_db_recovery usually fixes this. I vaguely remember seeing a mention in a post on some other list that modrdn wasn't supported by syncrepl, but I can't find that post now. Is modrdn in fact not supported by syncrepl up to 2.3.43? If it is, is there something special I need to do in slapd.conf do to make modrn+syncrepl work? If it is not, do I simply add the new entry and delete the old entry, or is there a more specific recommendation? If I update to the latest to 2.4, I'll need to do that by hand which I'd prefer not to do if I can avoid it. Thanks for any help. Brian

2 1

db_recover question
by frank.offermanns＠caseris.de 07 Dec '11

07 Dec '11

Since I haven't got an answer to my previous question. Maybe you could answer me this questions: In the cases slapd.exe performes internal database cleanup at startup is it possible for LDAP clients to access the database while cleanup is running or will connect attempts from clients fail at that state. If the database is locked while recovering we would be able to assume safely, that internal database recovery at startup has completed when a client connect attempt succeeds. Can we? > I searched the list and found several different informations to db_recover. > In older versions it was not advised to do a manual db_recover. > Can db_recover still harm a consistent database (I use db-5.1.25.NC / hdb)? > To be more precise, should I try to find out, if a unclean shutdown occured and then db_recover manually or can I db_recover with the 5.1.25 DB and Openldap 2.4.26 at every startup? Thanks & Regards, Frank

2 1

cn=config repl failure with 2.4.28
by Brandon Hume 07 Dec '11

07 Dec '11

Hrm... my previous post seems to have gone MIA, hopefully this one won't do the same. I have a pair of servers running 2.4.28 built with BerkeleyDB 5.2.36, in a multi-master setup. I was having issues with synchronization (namely, it wasn't syncing) and decided to rebuild the second server. I nuked etc/slapd.d/* as well as the contents of the cn=accesslog and main DIT directories, leaving behind only the DB_CONFIG files. I dumped the first server's cn=config tree using slapcat -b cn=config, copied the file over to the second server, and re-added the config using 'slapadd -F slapd.d -b cn=config -l slapcat_output.ldif'. Then I fired up the server, and let it pull over the main DIT from the first server. That went fine. It doesn't seem to have fixed my issue, though, which is the cn=config tree not synchronizing changes. When I make a change to olcDatabase={1}hdb,cn=config (which is cn=accesslog) to add some new indexes on server2, I see the following errors in syslog on server1 (after restarting slapd on server2 to try to force a sync...): Dec 7 12:13:04 server1 slapd[5984]: conn=1308 fd=25 ACCEPT from IP=172.30.96.203:52788 (IP=172.30.96.202:389) Dec 7 12:13:04 server1 slapd[5984]: conn=1308 op=0 BIND dn="cn=config" method=128 Dec 7 12:13:04 server1 slapd[5984]: conn=1308 op=0 BIND dn="cn=config" mech=SIMPLE ssf=0 Dec 7 12:13:04 server1 slapd[5984]: conn=1308 op=0 RESULT tag=97 err=0 text= Dec 7 12:13:04 server1 slapd[5984]: conn=1308 op=1 DISCONNECT tag=101 err=2 text=controls require LDAPv3 Dec 7 12:13:04 server1 slapd[5984]: conn=1308 op=1 do_search: get_ctrls failed Dec 7 12:13:04 server1 slapd[5984]: conn=1308 fd=25 closed (operations error) ... and on server2: Dec 7 12:13:04 server2 slapd[7798]: do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT (2) Protocol error Dec 7 12:13:04 server2 slapd[7798]: do_syncrep2: rid=001 (2) Protocol error Dec 7 12:13:04 server2 slapd[7798]: do_syncrepl: rid=001 rc -2 retrying Dec 7 12:13:04 server2 slapd[7798]: do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT (2) Protocol error Dec 7 12:13:04 server2 slapd[7798]: do_syncrep2: rid=001 (2) Protocol error Dec 7 12:13:04 server2 slapd[7798]: do_syncrepl: rid=001 rc -2 retrying The "controls require LDAPv3" error confuses me, as a wireshark capture of the conversation shows the bind asking for LDAPv3. Can anyone give me some guidance here?

1 0

OpenLdap + TLS error : ldap_start_tls: Connect error (-11)
by reyman 07 Dec '11

07 Dec '11

Hello, I try to create a openLdap + TLS server for my university laboratory. My configuration is : Linux ***** 2.6.32-5-686 #1 SMP Mon Oct 3 04:15:24 UTC 2011 i686 GNU/Linux slapd 2.4.23 (*This version use gnutls library)* I apply this tutorial on help.ubuntu.com (see TLS and SSL section) https://help.ubuntu.com/10.04/serverguide/C/openldap-server.html<%20https://help.ubuntu.com/10.04/serverguide/C/openldap-server.html> * The command i use to make the auto-signed certificate *: (with cn=localhost in my localhost.info and ca.info) sh -c "certtool --generate-privkey > /etc/ssl/myLdapKey/cakey.pem" certtool --generate-self-signed --load-privkey /etc/ssl/myLdapKey/cakey.pem --template /etc/ssl/myLdapKey/ca.info --outfile /etc/ssl/myLdapKey/cacert.pem sh -c "certtool --generate-privkey > /etc/ssl/myLdapKey/localhost_slapd_key.pem" * After that :* adduser openldap ssl-cert chgrp ssl-cert /etc/ssl/myLdapKey/localhost_slapd_key.pem chmod g+r /etc/ssl/myLdapKey/localhost_slapd_key.pem * -I add the cert path info file into ldap with a file, tls-config.ldif which contain : * dn: cn=config add: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/myLdapKey/cacert.pem dd: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/myLdapKey/localhost_slapd_cert.pem add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/myLdapKey/localhost_slapd_key.pem ldapmodify -QY EXTERNAL -H ldapi:/// -f tls-config.ldif * I uncomment this in my etc/default/slapd *SLAPD_SERVICES="ldap://127.0.0.1:389/ ldaps:/// ldapi:///"* After, i use for my client in my ldap.conf : * BASE dc=parisgeo,dc=cnrs,dc=fr URI ldap://localhost <ldaps://localhost> SSL start_tls TLS_CACERT /etc/ssl/myLdapKey/cacert.pem TLS_REQCERT demand I restart server with succes, but when i try to connect, i have this error (botom off this mail), do you have an explanation ? Thanks a lot if you can help me ... *Best regards, SR.* root@*****:/etc/ldap# ldapsearch -x -LLL -ZZ -d 1 ldap_create ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 127.0.0.1:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush2: 31 bytes to sd 3 ldap_result ld 0x978b280 msgid 1 wait4msg ld 0x978b280 msgid 1 (infinite timeout) wait4msg continue ld 0x978b280 msgid 1 all 1 ** ld 0x978b280 Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Wed Dec 7 16:29:19 2011 ** ld 0x978b280 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x978b280 request count 1 (abandoned 0) ** ld 0x978b280 Response Queue: Empty ld 0x978b280 response count 0 ldap_chkResponseList ld 0x978b280 msgid 1 all 1 ldap_chkResponseList returns ld 0x978b280 NULL ldap_int_select read1msg: ld 0x978b280 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 12 contents: read1msg: ld 0x978b280 msgid 1 message type extended-result ber_scanf fmt ({eAA) ber: read1msg: ld 0x978b280 0 new referrals read1msg: mark request completed, ld 0x978b280 msgid 1 request done: ld 0x978b280 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_parse_extended_result ber_scanf fmt ({eAA) ber: ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (}) ber: ldap_msgfree TLS: can't connect: A TLS packet with unexpected length was received.. ldap_err2string* ldap_start_tls: Connect error (-11) additional info: A TLS packet with unexpected length was received. * * * -- <http://stackoverflow.com/users/385881/reyman64>SR.

1 0

Strange slapd-meta search problem
by Liam Gretton 07 Dec '11

07 Dec '11

Hi, I have a meta DB pointing to an Active Directory backend. This is used by SASL for authentication. The meta DB does not contain a schema definition for the AD. I've configured SASL to lookup sAMAccountName in AD, but this always fails until a lookup against the meta DB has first been performed against an attribute that the meta DB does understand (e.g. cn). Once that's been done, the system is rock solid and can be searched on any attribute. Looking at the debug output it seems that any initial search does not honour the specified filter unless the attribute being searched for is defined in the schema, but after one successful search, the LDAP server is happy to search for these attributes. I can work around this by doing a dummy search when the LDAP server starts, but I'd like to understand the cause of the problem properly. Any suggestions as to the cause of this? I'm using 2.4.20 on SLES 11. Here's how to reproduce the problem. Meta LDAP server is listening on a socket /var/run/slapd/slapd (configuration at end), providing dc=meta. AD is dc=ad,dc=org,dc=uk. After startup: ldapsearch -H ldapi://%2Fvar%2Frun%2Fslapd%2Fldapi-meta -x -D "cn=administrator,dc=meta" -b dc=meta -w secret sAMAccountName=user1 <nothing returned> Try again with cn: ldapsearch -H ldapi://%2Fvar%2Frun%2Fslapd%2Fldapi-meta -x -D "cn=administrator,dc=meta" -b dc=meta -w secret cn=user1 <AD record returned successfully> After this, the original search on sAMAccountName or any other attribute will also be successful. Debug output from slapd shows an incorrect filter on objectClass with the original failed search: ==> rewrite_context_apply [depth=1] string='ou=ad.org.uk,dc=meta' ==> rewrite_rule_apply rule='((.+),)?ou=ad.org.uk,[ ]?dc=meta$' string='ou=ad.org.uk,dc=meta' [1 pass(es)] ==> rewrite_context_apply [depth=1] res={0,'dc=ad,dc=org,dc=uk'} ==> rewrite_context_apply [depth=1] string='(!(objectClass=*))' ==> rewrite_context_apply [depth=1] res={0,'NULL'} ldap_search_ext put_filter: "(!(objectClass=*))" put_filter: NOT put_filter_list "(objectClass=*)" put_filter: "(objectClass=*)" put_filter: simple put_simple_filter: "objectClass=*" ldap_send_initial_request ldap_send_server_request A successful search with cn shows the following: ==> rewrite_context_apply [depth=1] string='ou=ad.org.uk,dc=meta' ==> rewrite_rule_apply rule='((.+),)?ou=ad.org.uk,[ ]?dc=meta$' string='ou=ad.org.uk,dc=meta' [1 pass(es)] ==> rewrite_context_apply [depth=1] res={0,'dc=ad,dc=org,dc=uk'} ==> rewrite_context_apply [depth=1] string='(cn=user1)' ==> rewrite_context_apply [depth=1] res={0,'NULL'} ldap_search_ext put_filter: "(cn=user1)" put_filter: simple put_simple_filter: "cn=user1" ldap_send_initial_request ldap_send_server_request Here's the minimal slapd.conf file: include /etc/openldap/schema/core.schema modulepath /usr/lib/openldap/modules moduleload back_meta.so argsfile /var/run/slapd/slapd.args pidfile /var/run/slapd/slapd.pid ################################################################# # # Meta DB config # # dc=meta # ################################################################# database meta suffix dc=meta rootdn cn=administrator,dc=meta rootpw secret uri ldap://ad.org.uk:3268/ou=ad.org.uk,dc=meta suffixmassage "ou=ad.org.uk,dc=meta" "dc=ad,dc=org,dc=uk" lastmod off idassert-bind bindmethod=simple binddn="cn=adldap,dc=ad,dc=org,dc=uk credentials="password" flags=non-prescriptive idassert-authzFrom "dn.exact:cn=administrator,dc=meta" Thanks for any help offered. -- Liam Gretton liam.gretton(a)le.ac.uk HPC Architect http://www.le.ac.uk/its IT Services Tel: +44 (0)116 2522254 University of Leicester, University Road Leicestershire LE1 7RH, United Kingdom

2 2

openldap user login
by Jayavant Patil 07 Dec '11

07 Dec '11

Hi, I am using openldap-2.4.19-4 on fedora 12 machine. In order to protect roobindpw, I removed that from /etc/ldap.conf and written it in /etc/ldap.secret with root access only. Now, /etc/ldap.conf file (with permissions 644) contents w.r.t. bind are as follows: # The distinguished name to bind to the server with. # Optional: default is to bind anonymously. #binddn cn=root,dc=abc,dc=com # The credentials to bind with. # Optional: default is no credential. #bindpw cluster # The distinguished name to bind to the server with # if the effective user ID is root. Password is # stored in /etc/ldap.secret (mode 600) rootbinddn cn=root,dc=abc,dc=com but now when I do $ssh ldap_6@client-node-name, I get the following message: id: cannot find name for user ID 514 id: cannot find name for user ID 514 [I have no name!@client-node-name ~]$ when i do $id on client node I get the followng: uid=514 gid=514(ldap_6) groups=514(ldap_6) Any idea what could be the problem? -- Thanks & Regards, Jayavant Ningoji Patil Engineer: System Software Computational Research Laboratories Ltd. Pune-411 004. Maharashtra, India. +91 9923536030.

3 4

Fixed : SHELL env variable not red
by Olivier 07 Dec '11

07 Dec '11

Just to update on that : I have received this RedHat update notification last night : Synopsis openldap bug fix and enhancement update updated : 06/12/11 Subject Updated openldap packages that fix number of bugs and add various enhancements are now available for Red Hat Enterprise Linux 6. Description ... https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.2_Tech… I updated and the loginShell variable is now properly used over authentication ( with no change on my initial configuration). I also see that many TLS issues that I have faced in the passed seem to have been fixed : I'm going to check that. Best, --- olivier On Thu, Dec 1, 2011 at 3:00 PM, Olivier <ldap(a)guillard.nom.fr> wrote: > > Hello, > > I have configured nss/pam on a REDHAT6 box to authenticate users > against an ldap : it works but I have a problem with getting my favorite > user shell when I log in. > > The "loginShell" shell attribute sounds to not been used to provide users > with their favorite shell when they log in : may be I misunderstood the > usage of this "posixAccount" attribute ? > > Thanks for your help, see below for additional indications : > > $ ssh olivier(a)redhatbox.example.fr > olivier(a)redhatbox.example.fr's password: < MY LDAP PASSWORD> > > RHN Satellite kickstart on 2011-06-16 > > ##################### > # redhatbox.example.fr # > # # > # Hello # > ##################### > > > sh-4.1$ grep olivier /etc/passwd > <returns nothing (no local entry for olivier)> > > -sh-4.1$ pwd > > /home/olivier (my home directory found in ldap) > > -sh-4.1$ env | grep -i shell > SHELL=/bin/sh ( my shell user environnment is not picked in ldap) > > sh-4.1$ ldapsearch -D uid=olivier,ou=staff,ou=people,dc=example,dc=fr > -W uid=olivier > > Enter LDAP Password: < MY LDAP PASSWORD> > > # olivier, staff, people, example.fr > dn: uid=olivier,ou=staff,ou=people,dc=example,dc=fr > cn: Olivier G > gidNumber: 18000 > homeDirectory: /home/olivier > objectClass: top > objectClass: person > objectClass: organizationalPerson > objectClass: inetOrgPerson > objectClass: posixAccount > objectClass: shadowAccount > sn: olivier > uid: olivier > uidNumber: 1000 > shadowLastChange: 15282 > loginShell: /bin/tcsh > givenName: Olivier > mail: olivier(a)example.fr > userPassword:: xxxxxxxxxxxxxxxxxxxxxxx > > -sh-4.1$ cat /etc/shells > /bin/sh > /bin/bash > /sbin/nologin > /bin/tcsh (my favorite shell is allowed) > /bin/csh > > ANY HELP ??? > > > Thanks > > --- > Olivier

1 0

openldap with Ipv6 link local ip?
by Richard Knight 07 Dec '11

07 Dec '11

Is it possible to use an IPv6 Link-Local ip with openlap clients? address would be of the form ldaps://[fe80::abcd:346:123%eth0]:636 where %eth0 is the interface specifier Richard

2 1

Adding many users together
by Andreas Rudat 06 Dec '11

06 Dec '11

Hello, I have 100 users which I have to add into my ldap database, how can I do that? With a ldif file? Like that? dn: cn=John Doe, ou=Rochester, o=IBM, c=US objectclass: person objectclass: inetOrgPerson objectclass: top objectclass: organizationalPerson objectclass: ePerson cn: John Doe sn: Doe uid: jdoe userpassword: secretpass I think its realy horrible if I want to add 100 users in this way? thanks

4 4

memberof overlay deployment
by Asplund Marko 06 Dec '11

06 Dec '11

Hi, I'm planning on deploying the memberof overlay feature in our OpenLDAP v2.3 directory and I'd like to get some practical advice on this. So far, I've done some testing in my test environment. I've added an overlay directive in slapd.conf: overlay memberof and imported group info to populate data. memberof queries appear to be working fine. Is there something else I should consider in addition? What would be the best way to get the memberof attribute values populated in the production database? Should I reimport all the data? What would be the best way for doing that? Or is it possible to somehow get the attribute values populated without reimporting? marko

5 7

slapd hanging - meta backend - Solaris 10
by Lincoln Souzek 05 Dec '11

05 Dec '11

Hello, I've seen a couple of instances where slapd becomes unresponsive, apparently because the threads are waiting on a backend meta DB. We're running slapd 2.4.23 on Solaris 10 (update 11/06). We have 128 threads configured and when I attach with truss, I see 130 allocated, most of which look like this: /53: lwp_park(0x00000000, 0) (sleeping...) When I run pstack against the PID, the stack for almost all of the threads looks like one of the two threads below, both of which are somewhere within meta_back_search: ----------------- lwp# 20 / thread# 20 -------------------- fee40408 lwp_park (0, 0, 0) 00140e64 ldap_build_search_req (110f0c0, 599eb90, 2, 79db010, 79db0a0, 0) + 2c 001412bc ldap_pvt_search (110f0c0, 599eb90, 2, 79db010, 79db0a0, 0) + d4 000cd494 ???????? (3f45d70, f4fffd58, f4fff478, f4fff294, 0, 2b822c0) 000cd7fc meta_back_search (3f45d70, f4fffd58, 2, 2, 24d400, 0) + 1e0 000a0928 ???????? (3f45d70, f4fffd58, f4fff8e0, 28ff20, 2ac1b8, 14) 000a12dc ???????? (f4fff8e0, f4fffd58, 2, 2, 24d400, 28ff20) 000a3950 overlay_op_walk (8000, f4fffd58, 8000, 28fe18, 28ff20, 818) + 4c 000a3ae4 ???????? (3f45d70, f4fffd58, 2, 1e6000, a3ba0, 28fe18) 00041e08 fe_op_search (3f45d70, f4fffd58, 3f45e70, f4fffad8, 1ee5f8, 1ee6f0) + 3f8 00041528 do_search (3f45d70, f4fffd58, fee6cbc0, 1e6000, 16ec00, f4fffad8) + 590 0003f8e4 ???????? (f4fffe08, 3f45d70, fee6cbc0, fe2d4400, 2683c8, 0) 0013ca30 ???????? (2683b8, f5000000, 0, 0, 13c8d4, 1) fee40368 _lwp_start (0, 0, 0, 0, 0, 0) ----------------- lwp# 21 / thread# 21 -------------------- fee40408 lwp_park (0, 0, 0) 0013e5c8 ldap_result (10ea3b0, 43e, 2, f47ff488, f47ff290, 0) + 3c 000cddf0 meta_back_search (53fe5b8, f47ffd58, 2, 2, 0, 1) + 7d4 000a0928 ???????? (53fe5b8, f47ffd58, f47ff8e0, 28ff20, 2ac1b8, 14) 000a12dc ???????? (f47ff8e0, f47ffd58, 2, 2, 24d400, 28ff20) 000a3950 overlay_op_walk (8000, f47ffd58, 8000, 28fe18, 28ff20, 818) + 4c 000a3ae4 ???????? (53fe5b8, f47ffd58, 2, 1e6000, a3ba0, 28fe18) 00041e08 fe_op_search (53fe5b8, f47ffd58, 53fe6b8, f47ffad8, 1ee5f8, 1ee6f0) + 3f8 00041528 do_search (53fe5b8, f47ffd58, fee6cbc0, 1e6000, 16ec00, f47ffad8) + 590 0003f8e4 ???????? (f47ffe08, 53fe5b8, fee6cbc0, fe2d4800, 2683c8, 0) 0013ca30 ???????? (2683b8, f4800000, 0, 0, 13c8d4, 1) fee40368 _lwp_start (0, 0, 0, 0, 0, 0) I took a core dump while the process was running but I'm not really sure how to proceed from here. Is there any way to get more information on what was happening with these threads at the time? In either case, is this a situation that should be handled with a general timeout directive? We currently only have a network-timeout and a bind timeout specified: network-timeout 3 timeout bind=3 Thanks, Lincoln

2 1

ldap_add_s - mods.mod_values empty
by Sean Ryan 05 Dec '11

05 Dec '11

Hello, Firstly, I hope this is the correct list Relevant versions: O/S: Debian Etch (server) - Debian Lenny (client) Slapd : OpenLDAP: slapd 2.3.30 Client libs : libldap2 (debian) I'm seeing some problems using the ldap_add_s function call - For some reason the mods.mod_values array *appears* to be empty - slapd reports that it's missing values for the attribute type and wireshark confirms that to be the case (partial extract below). addRequest entry: macaddress=002145ccfadf,dc=nodomain attributes: 2 items Item macaddress type: macaddress vals: 0 items The below is the partial source code involved. Code : char * vals[LdapDefaults::MAX_MODS][2]; ACE_DEBUG((LM_DEBUG, "(%t) Add Entry %s:%s %D \n", tempName, tempValue)); vals[loopcount][0] = new char [LdapDefaults::MAX_OPTION_LEN]; vals[loopcount][1] = 0; opTypes[loopcount] = new char [LdapDefaults::MAX_OPTION_LEN]; mod[loopcount].mod_op = 0; strcpy (opTypes[loopcount], tempName); strcpy (vals[loopcount][0], tempValue); mod[loopcount].mod_type = new char [LdapDefaults::MAX_OPTION_LEN]; strcpy (mod[loopcount].mod_type ,opTypes[loopcount]); mod[loopcount].mod_values = vals[loopcount]; loopcount ++; ++ nvpBegin ; for (int counter = 0 ; counter < loopcount ; counter ++) { mods[counter] = &mod[counter]; mods[counter]->mod_values = sn_values; ADA_DEBUG ((LM_DEBUG, "Value == %s\n", mods[counter]->mod_values[0])); } mods[loopcount] = 0; errCode = ldap_add_s(pld, tempDn , mods) ; addRequest entry: macaddress=002145ccfadf,dc=nodomain attributes: 2 items Item macaddress type: macaddress vals: 0 items There are a couple of curious things here. 1. Assigning mod->mod_values to a statically declared array ( char *sn_values[] = { "Jensen", NULL }; mods[counter]->mod_values = sn_values;) does not change the behavior 2. Debugging the contents of mods[i]->mod_values[0] immediately before and after the call to ldap_add_s shows that the correct values as being present in the structure. 3. Building a standalone test application and directly linking my library produced works as expected. Any thoughts on how to debug this further much appreciated. Thanks Sean

1 0

Re: LDAP query to Active Directory backend
by Khaled Blah 05 Dec '11

05 Dec '11

Thanks for your reply, Michael! I should have mentioned that I have tested this code with an OpenLDAP server (2.4.23) and a Lotus Notes server (ver. 8) and both of them return UTF-8 encoded data (like I expected it). The only difference are the parameters which I use to start the query on these backends (bind DN, filter, etc...). Regards, Khaled

1 1

rootDSE
by W.Siebert＠t-systems.com 05 Dec '11

05 Dec '11

Hello, is it posible to add an attribute to rootDSE? regards Waldemar

2 1

Re: RWM
by masarati＠aero.polimi.it 04 Dec '11

04 Dec '11

> Hello, > > the slapd-meta backend (OpenLDAP version: 2.4.26 and 2.4.28) has an own > rewriting module. If I want to use rewriting and remaping, do I have to > install rwm-overlay although I have meta installed? not sure what you mean by "installed"; if you mean "loaded" when built as run-time loadable modules, then the answer is "no". The two modules (back-meta and slapo-rwm) are orthogonal. p.

1 0

extract response controls after ldap_sasl_interactive_bind_s()
by Michael Ströder 04 Dec '11

04 Dec '11

HI! Disclaimer: I'm not a C programmer. I'd like to evaluate response controls (e.g. ppolicy) also when doing a SASL bind. I'm using python-ldap which in turn uses OpenLDAP C API's function ldap_sasl_interactive_bind_s(). But currently there's no way to extract the server's response controls. The server I'm testing with is returning the ppolicy response control and others. I looked at clients/tools/common.c but it seems to me it also uses ldap_sasl_interactive_bind_s() and no response controls are extracted. Do I have to use ldap_get_option(ld,LDAP_OPT_SERVER_CONTROLS) separately? Does that work? Ciao, Michael.

2 5

RWM
by W.Siebert＠t-systems.com 03 Dec '11

03 Dec '11

Hello, the slapd-meta backend (OpenLDAP version: 2.4.26 and 2.4.28) has an own rewriting module. If I want to use rewriting and remaping, do I have to install rwm-overlay although I have meta installed? My predecessor recently left the company. How can I check which backends and overlays are already installed? Kind regards Waldemar

1 0

Re: OpenLDAP syncrepl woes
by Jeffrey Crawford 03 Dec '11

03 Dec '11

Ok will give that a try stay tuned. Jeffrey On Thu, Dec 1, 2011 at 11:39 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, December 01, 2011 9:38 AM -0800 Jeffrey Crawford > <jeffreyc(a)ucsc.edu> wrote: > >>> Humm that didn't seem to work. I'm rebuilding so I'll give that another >>> try. >> >> >> Finally got to do another test. I tested by changing the permissions >> of the replication account permissions and tried restarting with slapd >> -c rid=<number> where the number is the id of the rid= definition in >> the olcSyncrepl configuration. It didn't seem to work (Note the >> permission changes were just what attributes the account could see) >> >> Just for grins I also tried rid=0 and rid by itself. None seemed to >> work. I'm guessing I'm just doing something wrong but not sure what it >> is. > > > Well, rid can't be zero. rid has to be the rid you selected in the replica > for that master connection. Looking at test058, it looks like the correct > syntax is to use -c rid=<rid>,csn=0 > > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

1 0

Failure while importing an exported ldif file
by Axel Birndt 02 Dec '11

02 Dec '11

Hi @All, now while my ldapserver is working on my testmachine, i'am trying to import my ldif files. I read the thread http://www.openldap.org/lists/openldap-software/200711/msg00069.html but the import isn't working for me. abirndt@lvps83-169-33-218:~/openldap_2axels-company$ sudo slapadd -F /etc/ldap/slapd.d -n 0 -l dc_2axels-company_dc_de_export.ldif slapadd: line 1: database (cn=config) not configured to hold "dc=2axels-company,dc=de" slapadd: line 1: database (cn=config) not configured to hold "dc=2axels-company,dc=de" abirndt@lvps83-169-33-218:~/openldap_2axels-company$ sudo slapadd -F /etc/ldap/slapd.d -n 0 -l cn_config_export.ldif I created my backupfiles with the following commands: sudo slapcat -b cn=config -F /etc/ldap/slapd.d/ >cn_Config_export.ldif sudo slapcat -b dc=2axels-company,dc=de -F /etc/ldap/slapd.d/ >dc_2axels-company_dc_de_export.ldif I'am also looking in google for solving this, but in my mind i haven't the right keywords... Could anyone give me a hint or a link for reading, how to import the created ldif files from above to a new ldap-server? -- Gruß Axel ------------------------------

2 4

Re: memberof overlay deployment
by Bryce Powell 02 Dec '11

02 Dec '11

Hi, I tried the method suggested by Marco to populate memberOf attributes of existing entries: >> How would you recommend getting memberof values populated in the existing directory? > If you can afford a sequence of: > stop -> slapcat -> drop db -> slapadd > Everything gets populated as desired. I tried this and the directory was restored minus the memberOf attributes. I used the following commands on version 2.4.11 (yes, I know I have to upgrade ...) : /usr/local/sbin/slapcat -l data_20111201.ldif (..drop db..) /usr/local/sbin/slapadd -c -v -l data_20111201.ldif 'Manual' group membership updates do result in the memberOf attributes getting updated, so I know the overlay is working. Thanks, Bryce Powell

5 5

Security between server and client nodes.
by Jayavant Patil 02 Dec '11

02 Dec '11

Hi, I am using openLDAP-2.4.19-4 on fedora 12 machine. I want to make server secure from client nodes so that clients don't hack the server node. Hack in the sense that one client doesn't even read the data of another client, client doesn't tamper the server directory information or try to spoof the server. Does anybody have any suggestions how to avoid these things in openLDAP? Thanks in advance. -- Regards, Jayavant Ningoji Patil Engineer: System Software Computational Research Laboratories Ltd. Pune-411 004. Maharashtra, India. +91 9923536030.

3 14

Re: OpenLDAP syncrepl woes
by Jeffrey Crawford 01 Dec '11

01 Dec '11

On Wed, Nov 23, 2011 at 10:13 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, November 23, 2011 9:26 AM -0800 Jeffrey Crawford > <jeffreyc(a)ucsc.edu> wrote: > >> read that already: >> >> my original question was the following: >> >> Granted the above issues might be explained away in that we don't yet >> have enough ram on the machines yet, however it does seem to present >> us with a problem when we notice the discrepancy, how do we during run >> time re-sync the data from the provider server? I have tried the slapd >> -c rid=2,csn=20111114000000.000000Z but that doesn't seem to do any >> good. (I've tried several different values of csn=0 >> csn=20111114000000.000000Z#000000#000#000000 etc. to no avail) > > > Regardless of RAM limitations, you should never have an inconsistent > database. However, so far, the only replication mechanism I've seen > guarantee this is delta-syncrepl. This may be better in the upcoming > OpenLDAP 2.4.27 for syncrepl. > > If you read the slapd man page for the -c option, it is quite clear: > > Use only the rid part to force a full reload. Humm that didn't seem to work. I'm rebuilding so I'll give that another try. > > >> from man slapadd >> >> LIMITATIONS >> Your slapd(8) should not be running when you do this to ensure >> consis- tency of the database. >> >> So how can I have slapd run, respond to what data it has currently yet >> understand that it will update all it's data with the source provider >> updating, adding, removing entries as necessary without removing the >> database first? > > I don't understand why you would want slapd to respond with completely bogus > data to any clients doing queries. If you're going to force reload the > replica anyway, it makes much more sense to use slapadd from the master > rather than trying to do it via syncrepl, which can take numerous amounts of > time longer than doing it via slapadd, and during that entire time period, > you have the possibility of sending out significantly erroneous data. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 2

[***** SPAM 3.5 *****] Re: pwdCheckModule not loaded
by Raffael Sahli 01 Dec '11

01 Dec '11

Is OpenLDAP compiled with enable-modules? You should see something in the syslog with loglevel -1 or run the daemon in forderground. Are you sure your daemon reads the config file and not a config db? Clément OUDOT <clem.oudot(a)gmail.com> schrieb: >Le 1 décembre 2011 17:00, Fabian Heinz <fabian.heinz(a)xinfo.de> a écrit : >> Sorry ... >> My outbox contains the mail with list, could be some problem with my >> mailclient html vs txt >> >> It shows as text so I hope list will be kept... > >Fail. > >> I'm using Ubuntu 11.10 >> And I have tried blank and column separated with /usr/lib/ /usr/lib/ldap >> /usr/local/libexec >> Which are the directories I installed the modules to. >> There was no error in logging but also no pwdCheckModule >> > >Sorry, no other idea. Maybe someone else can help you. > >Clément. >

1 0

Re: pwdCheckModule not loaded
by Clément OUDOT 01 Dec '11

01 Dec '11

Le 1 décembre 2011 17:00, Fabian Heinz <fabian.heinz(a)xinfo.de> a écrit : > Sorry ... > My outbox contains the mail with list, could be some problem with my > mailclient html vs txt > > It shows as text so I hope list will be kept... Fail. > I'm using Ubuntu 11.10 > And I have tried blank and column separated with /usr/lib/ /usr/lib/ldap > /usr/local/libexec > Which are the directories I installed the modules to. > There was no error in logging but also no pwdCheckModule > Sorry, no other idea. Maybe someone else can help you. Clément.

1 0

Re: pwdCheckModule not loaded
by Clément OUDOT 01 Dec '11

01 Dec '11

Le 1 décembre 2011 16:33, Fabian Heinz <fabian.heinz(a)xinfo.de> a écrit : > I already did that after your last mail > > => no effect > > Must there one modulepath or are there multiple possible > It seems like the second one but I better ask ... Please keep the list in copy! man slapd.conf: modulepath <pathspec> Specify a list of directories to search for loadable modules. Typically the path is colon-separated but this depends on the operating system. The default is /home/clement/Programmes/openldap/libexec/openldap, which is where the standard OpenLDAP install will place its modules. Clément.

1 0

Re: pwdCheckModule not loaded
by Clément OUDOT 01 Dec '11

01 Dec '11

Le 1 décembre 2011 14:53, Fabian Heinz <fabian.heinz(a)xinfo.de> a écrit : > > Hi > > Thanks for the fast reply. > > > > But didn’t help > > > > Modulepath points to /usr/lib/ldap > > > > I also tried to add a second modulepath, don’t know if this is correct… > > modulepath /usr/lib/ldap > > moduleload back_bdb.la > > moduleload back_hdb.la > > moduleload back_ldap.la > > moduleload back_bdb.lda > > moduleload ppolicy.la > > > > modulepath /usr/local/lib > > > > I installed the library in /usr/local/libexec > > > > Added the modulepath > > But still no effect > > > > Is there any logging for loading of the function? Please keep the list in copy. You said: > modulepath /usr/local/lib > I installed the library in /usr/local/libexec Try modulepath /usr/local/libexec Clément.

1 0

SHELL env variable not red
by Olivier 01 Dec '11

01 Dec '11

Hello, I have configured nss/pam on a REDHAT6 box to authenticate users against an ldap : it works but I have a problem with getting my favorite user shell when I log in. The "loginShell" shell attribute sounds to not been used to provide users with their favorite shell when they log in : may be I misunderstood the usage of this "posixAccount" attribute ? Thanks for your help, see below for additional indications : $ ssh olivier(a)redhatbox.example.fr olivier(a)redhatbox.example.fr's password: < MY LDAP PASSWORD> RHN Satellite kickstart on 2011-06-16 ##################### # redhatbox.example.fr # # # # Hello # ##################### sh-4.1$ grep olivier /etc/passwd <returns nothing (no local entry for olivier)> -sh-4.1$ pwd /home/olivier (my home directory found in ldap) -sh-4.1$ env | grep -i shell SHELL=/bin/sh ( my shell user environnment is not picked in ldap) sh-4.1$ ldapsearch -D uid=olivier,ou=staff,ou=people,dc=example,dc=fr -W uid=olivier Enter LDAP Password: < MY LDAP PASSWORD> # olivier, staff, people, example.fr dn: uid=olivier,ou=staff,ou=people,dc=example,dc=fr cn: Olivier G gidNumber: 18000 homeDirectory: /home/olivier objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount sn: olivier uid: olivier uidNumber: 1000 shadowLastChange: 15282 loginShell: /bin/tcsh givenName: Olivier mail: olivier(a)example.fr userPassword:: xxxxxxxxxxxxxxxxxxxxxxx -sh-4.1$ cat /etc/shells /bin/sh /bin/bash /sbin/nologin /bin/tcsh (my favorite shell is allowed) /bin/csh ANY HELP ??? Thanks --- Olivier

1 0

pwdCheckModule not loaded
by Fabian Heinz 01 Dec '11

01 Dec '11

Hi together, I want to setup password policy in a small company. Were using openldap for a while without any pw constraints. Now I got ppolicy working and pw update fails correctly on the defined constraints. But I am not able to load the pwdCheckModule. I implemented some basic function which should always fail, just to see it is working. But it seems not be loaded. I compiled it as shared library with libtool and tried different locations with no result. I even cannot find any logging information about that. Can you give some tips where to find the loggings or how to increase them. At the moment I configured slapd.conf to loglevel -1 And can only find logging in the syslog Here my policy ldif version: 1 DN: cn=default,ou=policies,dc=company,dc=com objectClass: top objectClass: device objectClass: pwdPolicy objectClass: pwdPolicyChecker cn: default pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckModule: libcheck_password.so pwdCheckQuality: 1 pwdExpireWarning: 432000 pwdFailureCountInterval: 0 pwdGraceAuthNLimit: 0 pwdInHistory: 0 pwdLockout: TRUE pwdLockoutDuration: 1920 pwdMaxAge: 7516800 pwdMaxFailure: 4 pwdMinLength: 8 pwdMustChange: TRUE pwdSafeModify: FALSE I tried to put the shared library to /usr/local/lib and /usr/lib/ldap Both had not effect. Thanks and greetings fabs Beschreibung: C:\Users\fabs\AppData\Roaming\Microsoft\Signatures\xinfo-Dateien\bgleft.png Fabian Heinz Tel.: +49-89-1891788-34 Mobile.: +49-176-36107036 Mail: <mailto:fabian.heinz@xinfo.de> fabian.heinz(a)xinfo.de Beschreibung: C:\Users\fabs\AppData\Roaming\Microsoft\Signatures\xinfo-Dateien\bgbottom.pn g X-info Wieland Sacher GmbH IT-Beratung · Dienstleistung · Entwicklung Automotive IT · Application Solutions · Communications Am Stichgartl 6 | 85764 Oberschleißheim | Tel +49-89-31770785 | Fax +49-89-31770786 | <http://www.xinfo.de> www.xinfo.de Geschäftsführung: Dipl. Phys. Wieland Sacher | Sitz der Gesellschaft:Oberschleißheim Amtsgericht München HRB 1088 49 | UST-Nr:143-828-10155 | UID-NR: DE170540430 <http://www.app-solut.com/> Beschreibung: APP-SOLUT Mobile Applications · Internet Applications · Customized Software

2 1

Possible ACL Issue while try to read Root DSE
by Axel Birndt 01 Dec '11

01 Dec '11

Hi @All, i'am new on this list and i have a question. While i'am using the tool web2ldap from Michael Stroeder and try to create a new entry with this tool. I'am using openldap with cn=config backend on ubuntu 10.04 Michael mentioned it could be a acl problem, because his tool couldn't read the Root DSE If i specify the search base and the adminuser i could see the content of the Tree root. ldapsearch -b "dc=2axels-company,dc=de" -s base 'objectclass=*' -h localhost -D cn=admin,dc=2axels-company,dc=de -W -------------------->> abirndt@ubuntunb:~$ ldapsearch -b "dc=2axels-company,dc=de" -s base 'objectclass=*' -h localhost -D cn=admin,dc=2axels-company,dc=de -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=2axels-company,dc=de> with scope baseObject # filter: objectclass=* # requesting: ALL # # 2axels-company.de dn: dc=2axels-company,dc=de objectClass: dcObject objectClass: organization o: 2axels-company.de dc: 2axels-company description: Tree root <<<<---------------------------------------- But if i use ldapsearch with the following command i got nothing: ldapsearch -b "" -s base 'objectclass=*' ldap_sasl_interactive_bind_s: No such object (32) Could you help me please to identify if there is a problem with reading the Root DSE? What could i do next ? Any help is very appreciated. -- Gruß Axel ------------------------------

6 14

Overlay ordering and compatibility
by Nick Milas 01 Dec '11

01 Dec '11

Hello, We are using overlays: auditlog, dynlist, syncrprov and we would like to evaluate the deployment of MemberOf overlay as well. Is there a suggested ordering of the above overlays? (I've read that ordering matters.) In general: * Is there a suggested ordering list of all standard overlays (i.e. of overlays included in the distibution and/or "officially" documented in http://www.openldap.org/doc/admin24/overlays.html)? * Is there a list of possibly incompatible overlays, i.e. overlays which cannot or should not be used at the same time? * Are there any direct or indirect limitations in the number of used overlays? (e.g. software-related limitations, performance / stability risks etc.) Thanks, Nick

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical December 2011