openldap-technical March 2011

openldap-technical@openldap.org

102 participants
107 discussions

LDAP browsers and cn=config
by Gervase Markham 07 Mar '11

07 Mar '11

How does one use an LDAP browser to view and change the cn=config config? I am using the OpenLDAP 2.4.23 package from Ubuntu 10.10, and have been using both "luma" and more recently ApacheDS. I have tried an enormous number of ways all afternoon, but feel I'm stumbling in the dark. Do I have to use a special bind DN and password, or should the RootDN and password for my normal data do? If it's special, what is it? Where is it configured? I can view the data using ldapsearch, as root: ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config I've tried adding an olcRootPW and olcRootDN manually to the cn=config LDIF file (/etc/ldap/slapd.d/cn=config/olcDatabase={0}config.ldif) but when I start slapd up again and do the command-line search it seems to have noticed the password but not the RootDN :-( The magic way of getting at it (-Y EXTERNAL) given above, which works only for root, doesn't translate well into filling in boxes in an LDAP browser config. (I tried running the LDAP browser as root and binding anonymously - I could see all my data, but still not cn=config.) The slapd-config man page has lots of info about what to change, but nothing about how to change it. I've searched the web for hours, and tried to find it in the Admin Guide, but no luck. Any help would be very much appreciated! :-) Gerv

2 1

Re: When login from one application, "error=49" error show up, but other application's login are all right.
by Andrew Findlay 07 Mar '11

07 Mar '11

On Fri, Mar 04, 2011 at 11:01:28AM +0000, mahaoboy(a)gmail.com wrote: > To: openldap-its(a)openldap.org This is not a bug-report at this stage so I am directing replies to openldap-technical(a)openldap.org. > This user can logged in confluence successfully, but when could not log in > fisheye. > Log of confluence logging: > conn=5 op=8052 SRCH base="ou=eejira,o=nsn" scope=2 deref=3 > filter="(&(objectClass=person)(uid=jirasupport))" > conn=5 op=8052 ENTRY dn="cn=jirasupport,ou=people,ou=eejira,o=nsn" > conn=5 op=8052 SEARCH RESULT tag=101 err=0 nentries=1 text= > conn=8 op=0 BIND dn="cn=jirasupport,ou=people,ou=eejira,o=nsn" method=128 > conn=8 op=0 BIND dn="cn=jirasupport,ou=People,ou=eejira,o=nsn" mech=SIMPLE ssf=0 > conn=8 op=0 RESULT tag=97 err=0 text= All OK so far. > Log of fisheye logging: > conn=5 op=8051 SRCH base="ou=eejira,o=nsn" scope=2 deref=3 > filter="(&(objectClass=person)(uid=jirasupport))" > conn=5 op=8051 ENTRY dn="cn=jirasupport,ou=people,ou=eejira,o=nsn" > conn=5 op=8051 SEARCH RESULT tag=101 err=0 nentries=1 text= > conn=7 op=0 BIND dn="cn=jirasupport,ou=people,ou=eejira,o=nsn" method=128 > conn=7 op=0 RESULT tag=97 err=49 text= Error 49 (decimal) is 0x31 (hex) which is LDAP_INVALID_CREDENTIALS so the password does not match. > And other users are all right for logging in all applications. My guess would be that there is something odd about this user's password. Be aware that most existing LDAP client software treats passwords as strings of binary without consideration of character set encoding. This can lead to problems where an account has a password that cannot be represented in 7-bit ASCII. There is nothing that the LDAP server can do about this, as it does not know what character set the application is using. I would suggest changing this account's password to a new one using only printable 7-bit characters. You can maintain good security by making the password longer (but beware that the old Unix-crypt hash scheme only uses the first 8 characters so avoid that if you can: SSHA1 is far better). Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

syncrepl missing entries in openldap 2.4.23
by James_Whiteacre＠McAfee.com 04 Mar '11

04 Mar '11

I am trying to set up syncrepl to have multiple providers to a single consumer. Basically allowing me to combine two ldap's into a single ldap. I know this is probably not a standard configuration but seems like it should work. This seems to work for a while but then all of the records from one of the providers is deleted. And even though the consumer still is polling both providers the records will will not get added back. Here is my consumer syncrepl configuration. The providers are a standard provider configuration. Any help would be appreciated. Jim serverID 064 database bdb suffix "o=dogcatfish" rootdn "cn=admin,o=dogcatfish" limits dn.exact="cn=admin,o=dogcatfish" size=unlimited time=unlimited # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw admin # syncrepl configuration syncrepl rid=64 provider=ldap://provider1 type=refreshOnly interval=00:00:01:00 retry="60 10 300 +" searchbase="o=dogcatfish" filter="(objectClass=*)" scope=sub attrs="*,+" schemachecking=off bindmethod=simple binddn="cn=admin,o=dogcatfish" credentials="admin" # syncrepl configuration syncrepl rid=68 provider=ldap://provider2 type=refreshOnly interval=00:00:01:00 retry="60 10 300 +" searchbase="o=dogcatfish" filter="(objectClass=*)" scope=sub attrs="*,+" schemachecking=off bindmethod=simple binddn="cn=admin,o=dogcatfish" credentials="admin" # Indices to maintain index contextCSN,entryCSN,entryUUID,objectClass,cn,dc,mail eq checkpoint 1024 5 mirrormode TRUE

2 3

Replication monitoring
by Andreas Andersson 04 Mar '11

04 Mar '11

Hi! I posted an announcement here about a year ago about my little LDAP monitoring project CN=Monitor. Asked for feedback and received a lot. Thank you! Some feedback was related to adding replication verification for OpenLDAP so of course I gave it a try. Unfortunately I don’t have a large scale OpenLDAP environment to verify this functionality on so I need your help :) Is it working and can it be improved? This is how it works: The contextCSN is verified on all servers within the same environment. See attached image. As always… I appreciate all feedback I can get and let me know if you have any suggestions on new features or something else that can approve this monitoring application. Project page: http://cnmonitor.sourceforge.net Freshmeat: http://freshmeat.net/projects/cnmonitor Best Regards - Andreas

4 11

Combining multiple objectClasses
by Johannes Michael Jordan 04 Mar '11

04 Mar '11

Hello, I am setting up LDAP and I wonder if my sense of laying out my directory is possible to realize. For each of our users, we need (_objectClass_): - _inetOrgPerson_ (obv.) - PAM login, _posixAccount_ - automounter information for her home: _automount_ - samba account for Windows: _sambaSamAccount_ My rationale was that I put all these objectClasses into a single object. This is not possible, as several of them are structural. Next thing I tried is to create a new objectClass that has these as superiors. Also not possible: slapd silently refuses to start, when this is included in my schema file: objectclass ( 1.3.6.1.4.1.693.10.2.2 NAME 'lmeStudent' DESC 'Student working at LME.' SUP (inetOrgPerson $ sambaSamAccount) STRUCTURAL ) Whereas it starts up fine with: objectclass ( 1.3.6.1.4.1.693.10.2.2 NAME 'lmeStudent' DESC 'Student working at LME.' SUP inetOrgPerson STRUCTURAL ) What is holding slapd from accepting my schema? Johannes

2 1

Allowing users to add, but not delete, entries?
by Gervase Markham 04 Mar '11

04 Mar '11

Hi, Summary: is it possible to configure access control such that users to can add, but not delete, entries? Details: My planned schema has a branch: ou=tags,dc=example,dc=com The entries below this are like this: objectClass=groupOfNames cn=sometagname member=<user dn 1> member=<user dn 2> member=<user dn 3> ... I have worked out how to make it so users can only add and remove themselves from a tag: access to dn.children="ou=tags,dc=example,dc=com" attrs=member,entry # Allow people to add and remove themselves from any other tag by dnattr=member selfwrite # Allow anyone to read by anonymous read So far so good, but I would like authenticated users to be able to add new entries (tags), and add themselves as members to them, but _not_ to be able to delete tags. Even better, the tag would be deletable, or even automatically removed, but only if the user removed their own name and there were no more members - i.e. it was empty. (I believe the member attribute is mandatory in groupOfNames, and I don't want it to be impossible for someone to remove their name because they are the only member!) This is difficult, because as far as I can see the "write" permission does not distinguish between adding and deleting. Can someone tell me if this is possible? Thanks, Gerv

4 10

openLDAP C++ API
by sim123 04 Mar '11

04 Mar '11

Hi, I am evaluating openLDAP and need to perform ldapsearch from C++ program. I looked at openLDAP C++ API, however README says its an unstable release. So just wanted to understand, is it ok to use that API in production environment? Is anyone using it? If there is any other library for C++ and openLDAP, please point me to that. Would really appreciate any suggestions! Thanks.

2 1

objectclasses as part of schema file
by Aleksandar Stoisavljevic 03 Mar '11

03 Mar '11

Hi all, as a almost newby with openLDAP, I encounter following problem and would like if there is someone to help me to clarify few things. So the state of a problem follows. I have request from a client (e.g. client name as foo) to establish LDAP provider at my office while we are in process of development and once we are ready for acceptance then we will move our software to client machines. Therefore I have a requirement to support user management using IBM Tivoly DS. Since I am not willing to pay for such solution and having in mind that LDAP providers should support common LDAP protocol and last I have a little knowledge how to set-up openLDAP I've decided to go with openLDAP while we are at development. Now since they have some legacy directory structure, I've asked them to export existing data and to give me that file so I can import in LDAP. But as may guessed that would be the easy and often in practice this is not the case. I've noticed that exported LDIF file contain some "custom" objectClasses and was under impression that this was something related to Tivoly DS. But after further investigation I was wondering if it is the case why I can have those objectClasses as well ??? Reading more on this theme, and in a communication with a client (legacy code was done by some external 3rd party company) I've came to conclusion that client has custom schema files. Let's call them foo.schema and foo_v3.schema So two of them and now I thought that all of my problems are gone. My intention was to change slapd.conf file so that these two are now included (include directive in the the top of the slapd.conf file). So I have places these two files in /etc/openldap/schema directory and added these two lines in slapd.conf include /etc/openldap/schema/foo.schema include /etc/openldap/schema/foo_v3.schema As I've learned on my previous project that I have worked with openLDAP, now I have started slaptest command: slaptest -d 4095 -f /etc/openldap/slapd.conf And I've got following error (this is just a example, please be aware that names are different due to NDA): eading config file /etc/openldap/schema/foo_v3.schema line 1 (objectClasses {) /etc/openldap/schema/foo_v3.schema: line 1: unknown directive <objectClasses> inside backend database definition (ignored). And if I post here you the start of this foo_v3.schema the first line really starts with: objectClasses { ( 1.3.18.0.2.6.398 NAME 'os400-root' DESC 'Root node for OS/400 system projection suffix.' SUP top STRUCTURAL MAY os400-sys ) ( 1.3.18.0.2.6.399 NAME 'os400-usrprf' DESC 'Projected OS/400 user profile.' SUP top STRUCTURAL MUST os400-profile MAY userPassword ) ... To be honest, all examples that I have encounter (openLDAP and Apache DS) that was addressing customizing schema NEVER HAD objectClasses, but rather objectClass. And finally my question is, Is this what I am trying to do really feasable, and if it is what is wrong with this foo_v3.schema file and why this is not working ? Thank you for help -- Aleksandar dipl. ing. Stoisavljevic Software Developer mobile: +381 (0) 64 211 50 40 Web: http://www.staleksit.in.rs E-mail:staleks@gmail.com SkypeId: staleks_ns Mail: Branislava Nusica 10, 21000 Novi Sad, Serbia

3 2

Problem unexpected failing slapd
by Ruud Baart 03 Mar '11

03 Mar '11

Problem: For a customer we use LDAP for many years. Last year suddenly the slapd service just stopped without any traces in the logfiles. After a restart of slapd everything works fine again. But the problem was there: it was not an incident, now and then slapd just stops and always without any traces in the logfiles. Sometime three times a day, sometime a week without a failure. I can't find a pattern or any relation to any other service on the linux server. Environment: - Several (debian squeeze) servers , several windows servers. We use bdb database backend. - There is one master LDAP server which provides syncprov and two replica's LDAP servers (syncrepl). The master server is most intens used (mainly samba as primary domain controller: a few hundred useraccounts, lot of groupaccounts, workstations, acl's, etc.), one of the replica's is not very busy but handles the mail for all users (lookup: amavis, postfix, courier-imap, mailaccount settings etc). The third replica is not busy at all, it is a remote location. - Total LDAP is 3700 dn's, slapcat produces a file of 7,3 Mb. - It is only the master LDAP with stops suddenly. I have never seen a failure of a replica LDAP. Because I have no clear idea about the problem I have no idea which technical details are relevant: DB_CONFIG =========== set_cachesize 0 10485760 1 set_lk_max_objects 10000 set_lk_max_locks 10000 set_lk_max_lockers 10000 set_lg_dir /home/ldap-dbd The database is stored on a ext3 filesystem, kernel 2.6.32. The server has no problems, plenty of memory and a fast diskarray (SAS->SATA). Never technical problems with this server. And it worked without problems for a long period. Nothing has changed to the environment or the LDAP setup (except of course with the upgrade to debian squeeze but the problem was already there). What we have tried: - upgrade from openldap 2..4.17 (debian lenny+backports) to openldap 2.4.23 (debian squeeze). I saw in the release notes that problems related to syncrepl were solved. Therefor we waited for version 2.4.23 te become available in debian. This upgrade made no difference. - reindex, rebuilt the directory. When I rebuilt the LDAP with a clean LDIF file on the master LDAP or an other machine with ldapadd there is not one error or warning. The workaround for the moment: I have written a process monitor (perl daemon) which monitors the slapd daemon and if it suddenly stops, slapd is restarted. It is of course not a solution but the 300 user can work. If slapd stops without a restart within 1 minute a few hundred people can't work because samba stops working. I would like to receive suggestions what we can do to find the problem. Because there is no pattern, nothing in the logfiles I don't know where to start. -- Regards, Ruud Baart

5 12

Re: Slapd restarting slowly
by Buchan Milne 02 Mar '11

02 Mar '11

----- "Joe Tseng" <joe_tseng(a)hotmail.com> wrote: > I found the link below that sounds exactly like my problem: > > https://bugzilla.redhat.com/show_bug.cgi?id=553032 Seems RH hasn't figured it out yet ... > > I did notice httpd was hung. I configured it so it'd auth against > LDAP for > my SVN repos; It has nothing to do with whether the service itself does anything with LDAP, only if it runs as non-root and your nss_ldap configuration is broken. > it started right up by hand after slapd was running. My > > rpcidmapd also hung - is there a dependency there too? With 'bind_policy hard', or without 'bind_policy soft', and the LDAP host/uri configured in /etc/ldap.conf not available, compare the behaviour of: $ getent passwd nobody and $ groups nobody (BTW., some distros default bind_policy to 'soft' ...) Regards, Buchan

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical March 2011