openldap-technical December 2011

openldap-technical@openldap.org

88 participants
101 discussions

Need help regarding rfc for Jldap
by Brajabasi Padhy 12 Dec '11

12 Dec '11

Hello Sir, I'm Brajabasi from india. I wanted to use OpenLDAP for my project. I found OpeLDAP( Java version and C version) 1) OpenLDAP(Java version) compliant to RFC 2251-2256,2829-2830 2) OpenLDAP(C version) compliant ti RFC 4511-RFC 4520 RFC 4511 is the latest RFC which obseletes the RFC 2251-2256,2819-2830. Could you please suggest which version i should use for my application and why? Thanks with Regards, Brajabasi

1 0

(no subject)
by Brajabasi Padhy 12 Dec '11

12 Dec '11

1 0

Re:
by rey sebastien 12 Dec '11

12 Dec '11

Le lun. 12 déc. 2011 22:20:14 CET, Quanah Gibson-Mount a écrit : > --On Monday, December 12, 2011 9:55 PM +0100 rey sebastien > <reyman64(a)gmail.com> wrote: > >> IMHO i know this problem but i think this is better than nothing, and >> actually i have nothing. I wait for valid certificate... >> And sorry but your RTFM answer doesn't help me to resolve this problem >> with gnutls and debian, i take many hours to find a valid solution in my >> use case, and the manual doesn't help me particulary on this point. >> >> OpenLdap is a great software, but documentation it's a little "cryptic" >> for beginner like me, so i think it's easy to be rude with beginner on >> many points. > > You're using bad documentation from a questionable source, and are > pointed at the correct documentation, and have an issue with that? > That seems a little odd to me. When i add TLSCACertificateFile attribute with correct path, openldap with gnutls don't re-start.. I'm ok with Raffael, it's probably a bad idea to use the debian package, but i need one day or more to understand why an "official" package from debian create all this configuration's problem. If you want to use SSL/TLS, then > clearly you want a secure server. To blindly follow a guide that turns > off all of those security features leaves you back at square one. If > you don't understand the OpenLDAP documentation, then ask questions > about it rather than falling back to something unreliable that's going > to leave questionable state. > This is why i'm register on this mailling list, with hope some answers or experiences of other members resolve/enlight my beginner problems :) There a lot and a lot of old documentation for openLdap, with old slapd.conf configuration, old generation of certificates, incompatibility between certificate gnutls and openssl .. It's not easy to find the right and exhaustive documentation .. > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

1 0

Re: I have no name!
by Denis Witt 12 Dec '11

12 Dec '11

On 12.12.2011 16:44, Craig White wrote: >>> I am using openldap-2.4.19-4.x86_64 on fedora 12 machine. I am facing >>> the 'I have no name !' while I do ssh on client machine(All user info is >>> getting propagated to client machines properly (checked with getent >> are you using nscd (Name Service Cache Daemon)? If so uninstall it and the error should be gone. See google for details. >> If you want to verify before uninstall just restart/stop nscd and check if the name is shown. > FTR - I don't personally care for nscd very much but it seems that with Ubuntu 10.04 LTS that I am forced to use it or my host-based ACL's (pam_check_host_attr yes) will fail. Hi, please always reply to the list, thanks. Another "solution" might be to restart nscd every hour (or something), it seems that the cache is refreshed then and everything works fine. Bye.

3 2

decoding attrs error
by Angel L. Mateo 12 Dec '11

12 Dec '11

Hello, I have a web application that doesn't work with openldap 2.4.21. The same application is working with an old openldap 2.3.30. The problem I have is that for some reason this application performs a search with an undefined filter, the error I get in normal run is: Dec 12 13:26:47 canis21 slapd[29241]: get_filter: unknown filter type=48 In the older slapd, log is: Dec 12 03:59:14 canis5 slapd[16830]: conn=3220865 op=3 SRCH base="dc=unidades,dc=vistas,dc=um,dc=es" scope=1 deref=0 filter="(?=undefined)" Dec 12 03:59:14 canis5 slapd[16830]: conn=3220865 op=3 SEARCH RESULT tag=101 err=0 nentries=0 text= If I run slapd in debug mode, I get: ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x7f23d5a0a9d0 ptr=0x7f23d5a0a9d3 end=0x7f23d5a0aa0d len=58 0000: 63 38 04 24 64 63 3d 75 6e 69 64 61 64 65 73 2c c8.$dc=unidades, 0010: 20 64 63 3d 76 69 73 74 61 73 2c 20 64 63 3d 75 dc=vistas, dc=u 0020: 6d 2c 20 64 63 3d 65 73 0a 01 01 0a 01 00 02 02 m, dc=es........ 0030: 00 96 02 01 00 01 01 00 30 00 ........0. >>> dnPrettyNormal: <dc=unidades, dc=vistas, dc=um, dc=es> => ldap_bv2dn(dc=unidades, dc=vistas, dc=um, dc=es,0) <= ldap_bv2dn(dc=unidades, dc=vistas, dc=um, dc=es)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=unidades,dc=vistas,dc=um,dc=es)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=unidades,dc=vistas,dc=um,dc=es)=0 <<< dnPrettyNormal: <dc=unidades,dc=vistas,dc=um,dc=es>, <dc=unidades,dc=vistas,dc=um,dc=es> SRCH "dc=unidades, dc=vistas, dc=um, dc=es" 1 0 150 0 0 begin get_filter ber_scanf fmt (x) ber: ber_dump: buf=0x7f23d5a0a9d0 ptr=0x7f23d5a0aa0b end=0x7f23d5a0aa0d len=2 0000: 30 00 0. get_filter: unknown filter type=48 end get_filter 0 filter: (?=undefined) ber_scanf fmt ({M}}) ber: ber_dump: buf=0x7f23d5a0a9d0 ptr=0x7f23d5a0aa0d end=0x7f23d5a0aa0d len=0 send_ldap_disconnect 2:decoding attrs error send_ldap_response: msgid=0 tag=120 err=2 ber_flush2: 58 bytes to sd 15 0000: 30 38 02 01 00 78 33 0a 01 02 04 00 04 14 64 65 08...x3.......de 0010: 63 6f 64 69 6e 67 20 61 74 74 72 73 20 65 72 72 coding attrs err 0020: 6f 72 8a 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e or..1.3.6.1.4.1. 0030: 31 34 36 36 2e 32 30 30 33 36 1466.20036 ldap_write: want=58, written=58 0000: 30 38 02 01 00 78 33 0a 01 02 04 00 04 14 64 65 08...x3.......de 0010: 63 6f 64 69 6e 67 20 61 74 74 72 73 20 65 72 72 coding attrs err 0020: 6f 72 8a 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e or..1.3.6.1.4.1. 0030: 31 34 36 36 2e 32 30 30 33 36 1466.20036 conn=1000 op=3 DISCONNECT tag=120 err=2 text=decoding attrs error connection_closing: readying conn=1000 sd=15 for close Any idea? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

1 0

scheme extension with own OID
by Andreas Cieslak 12 Dec '11

12 Dec '11

Hi list, Because of a concern to modify our ldap environment I need to extend the scheme. The attribute I need is vacationActive and some other attributes which I didn't find in the existing OpenLDAP schemes. My question to you is, if I need to get a registered OID for our company to define the objectclass "vacation" with some further attributes? -I have read some articles about this- Or is there an up to date OID-list where I can search for a vacation objectclass or the vacation attributes which maybe already exist? - I only found the following - http://www.alvestrand.no/objectid/2.16.840.1.113730.3.1.html http://www.oid-info.com/get/2.16.840.1.113730.3.1.14 Any hints would be very appreciated. Thanks in advance. Kind regards. Andreas

1 0

OpenLDAP reader-only users , and removing anonymous user reading ?
by rey sebastien 12 Dec '11

12 Dec '11

Hello, I search some information to make reader-only users on my openLDAP .. I have already cn=reader-only, and my dn equal "dc=parisgeo,dc=cnrs,dc=fr" How can i create a .ldif with specific configuration to remove anonymous user reading, and authorize the read of my ldap only with the cn=reader-only authentification ? Thanks a lot, Best regards, SR

3 3

French tutorial
by reyman 12 Dec '11

12 Dec '11

Hello, I work on a tutorial (based on the many tutorial existing) to make TLS/SSL connexion possible with debian and the new cn=config mode (no slapd.conf) At this moment, you can see my work here (in french only) : http://www.services.parisgeo.cnrs.fr/2011/12/ldap-securise/ Thanks Best regards, Sr -- <http://stackoverflow.com/users/385881/reyman64>

1 0

I have no name!
by Jayavant Patil 12 Dec '11

12 Dec '11

Hi, I am using openldap-2.4.19-4.x86_64 on fedora 12 machine. I am facing the 'I have no name !' while I do ssh on client machine(All user info is getting propagated to client machines properly (checked with getent passwd,getent passwd and getent shadow)), and this is because I specify no access to anonymous. But, when I specify read access to anonymous this problem is getting resolved but my security is getting compromised since anonymous is reading everything. How do I write ACL rule to achieve both each user to see his data only i.e. security and getting user-name while doing ssh on client.? -- Thanks & Regards, Jayavant Ningoji Patil Engineer: System Software Computational Research Laboratories Ltd. Pune-411 004. Maharashtra, India. +91 9923536030.

2 1

Re: slapd hanging - meta backend - Solaris 10
by Lincoln Souzek 12 Dec '11

12 Dec '11

Hello, I compiled 2.4.28 and I'm trying to recreate the issue with that version but I've run into two other issues that are causing slapd to crash in the meantime. I compiled with the following options: ./configure --enable-ldap --enable-meta --prefix="/opt/local/openldap-2.4.28" --enable-dynlist --enable-memberof --enable-rwm --enable-mdb=no The first issue is that slapd has crashed twice with a SIGBUS and dumped a core file. I haven't been able to regularly reproduce it but both times it happened on the initial query after a bind. The stack of the thread where that signal originates wasn't identical both times but the two instances look similar: ----------------- lwp# 6 / thread# 6 -------------------- fedd446c _malloc_unlocked (28, 0, 1a40cb8, 1646c0, 0, 0) + 22c fedd4224 malloc (28, 1, 940a8, 59550, fee68288, fee709b0) + 4c 001646c0 ber_memalloc_x (28, 0, 0, 0, 0, 2fcfc8) + 58 00059550 ch_malloc (28, 427390, 0, fbfff428, 8000, 4551c8) + 8 00047910 ???????? (7864d4, 7866e4, 0, 0, 0, 2fcfc8) 00047b20 attrs_dup (7866e4, 427390, 0, fbfff428, 8000, 63) + 48 0004a980 entry_dup2 (4273d4, 427384, 0, 0, 0, 2fcfc8) + ac 0011f1d4 ???????? (fffffff6, fbfffcb8, 2932d0, fbfff428, 8000, 63) 0011f938 ???????? (1a3cfe0, fbfffcb8, 0, 0, 1, 0) 000a2fe4 ???????? (8000, fbfffcb8, 1b5b298, 2627c8, 8000, a2f70) 0004e978 ???????? (1a3cfe0, fbfffcb8, 2, 41a10, ffffffff, ffffffff) 00050d88 slap_send_search_entry (0, fbfffcb8, 1b5b298, 2627c8, 262750, 1ee000) + 3d4 00041de8 fe_op_search (1a3cfe0, fbfffcb8, 2, 41a10, 1, 0) + 3d8 000a39cc overlay_op_walk (8000, fbfffcb8, 8000, 1ee5f8, 8000, 200) + c8 000a3ae4 ???????? (1a3cfe0, fbfffcb8, 2, 0, 2b9d88, 1ee6f0) 00041528 do_search (1a3cfe0, fbfffcb8, fee6cbc0, fe020c00, 40f98, fbfffa38) + 590 0003f8e4 ???????? (fbfffe08, 1a3cfe0, fee6cbc0, fe020c00, 2fcfe8, 0) 00040270 ???????? (0, 20, fee6cbc0, fe020c00, 268328, 0) 0013ca30 ???????? (268318, fc000000, 0, 0, 13c8d4, 1) fee40368 _lwp_start (0, 0, 0, 0, 0, 0) ----------------- lwp# 5 / thread# 5 -------------------- fedd446c _malloc_unlocked (800, 1, 420780, fedd4224, 0, 0) + 22c fedd416c _smalloc (18, 0, 9415c, 16cbc8, fffffff9, fee6fa48) + 4c fedd4224 malloc (17, 1, 940a8, 16cf38, fee68288, fee709b0) + 4c 0016cbc8 ber_memalloc_x (17, 0, 0, 0, 0, 30dc98) + 58 0016cf38 ber_dupbv_x (8dea98, 12f6ab0, 0, fc3ff4c8, 8000, 8de950) + 3c 0004990c ???????? (750174, 750024, 0, 0, 0, 30dc98) 00049a20 attrs_dup (750024, 3fbc50, 0, fc3ff4c8, 8000, 63) + 48 0004c7b0 entry_dup2 (3fbc6c, 3fbc44, 0, 0, 0, 30dc98) + ac 0012556c ???????? (fffffff6, fc3ffd58, 2c7208, fc3ff4c8, 8000, 63) 00125d68 ???????? (423350, fc3ffd58, 0, 0, 0, 0) 000a71c0 ???????? (8000, fc3ffd58, 9e1f38, 275fb8, 8000, a714c) 00050818 ???????? (423350, fc3ffd58, ffffffff, ffffffff, 0, 0) 00052cb8 slap_send_search_entry (0, fc3ffd58, 9e1f38, 275fb8, 3, 1f9400) + 3e0 00043c94 fe_op_search (423350, fc3ffd58, 2, 43894, 1, 0) + 400 000a7b98 overlay_op_walk (8000, fc3ffd58, 8000, 1f9b90, 8000, 200) + c8 000a7cb0 ???????? (423350, fc3ffd58, 2, fc3ffad8, 2a0bd8, 1f9c88) 00043364 do_search (423350, fc3ffd58, fee6cbc0, 1edc00, 177400, fc3ffad8) + 618 00041698 ???????? (fc3ffe08, 423350, fee6cbc0, fdcf0800, 27bb18, 0) The second issue, which I can reproduce, is that slapd is crashing with a SIGSEGV when it encounters the following entry in a Sun Directory Server configured as a meta backend: c=undef,dc=company Is undef a reserved word that's causing an issue here? In earlier versions (2.4.23, at least), it seems like that entry was just discarded and not returned as a search result. Thanks, Lincoln On Mon, Dec 5, 2011 at 10:32 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, December 05, 2011 6:09 PM +0100 Lincoln Souzek < > lsouzek(a)gmail.com> wrote: > > Hello, >> >> I've seen a couple of instances where slapd becomes unresponsive, >> apparently because the threads are waiting on a backend meta DB. We're >> running slapd 2.4.23 on Solaris 10 (update 11/06). We have 128 threads >> configured and when I attach with truss, I see 130 allocated, most of >> which look like this: >> > > I would note there have been some re-entry fixes for back-meta since > 2.4.23 was released. I would suggest you re-try with the latest OpenLDAP > version as a first step. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

← Newer
1
2
3
4
5
6
7
8
9
10
11
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical December 2011