openldap-technical September 2011

openldap-technical@openldap.org

101 participants
119 discussions

manage vs write
by Christopher Wood 07 Sep '11

07 Sep '11

What access privileges over a particular suffix are granted to somebody with the "manage" level that somebody with the "write" level does not get? As background, using 2.4.26: This document specifies that somebody with the level "manage" gets everything else: http://www.openldap.org/doc/admin24/access-control.html#The%20access%20to%2… On the other hand, slapd.access(5) specifies that "manage grants all access including administrative access. The write access is actually the combination of add and delete, which respectively restrict the write privilege to add or delete the specified <what>." (I am very puzzled. It strikes me that once I can write (add/delete) any entry in a subtree I effectively manage it.)

2 1

Authenticate Mac OS X users against OpenLDAP on Debian
by Mi 07 Sep '11

07 Sep '11

We added a Mac to our network, and I would like the network users to be able to login with their existing credentials on our Debian openLDAP server. I configured the LDAP access on the Mac, and it can indeed see the users and groups from the openldap server. But when I try to login after clicking "Other...", the login window shakes around, and nothing happens. The server logs show the connection from the Mac and it's searches ( http://pastebin.com/MB2JswAa). (Logging is configured with Parse, Stats, Stats2, Sync. Is there something else I should add to logging that may be useful?) On the Mac, I didn't find anything looking helpful in the logs (http://pastebin.com/yRreFQrJ), but maybe I don't know what to look for. I found many instructions on the Internet which concentrate on mounting user homes from the server over NFS. This is NOT what we want. Users would be authenticated with openldap, but have their homes locally on the Mac, like normal users. I also saw many mentions of adding the apple schema, and I have done that. But maybe I now need to actually use parts of that schema in the user records? Thanks for any help...

3 3

Open LDAP Installation/Configuration Failed.
by vijay s sheelavantar 07 Sep '11

07 Sep '11

Hi,I am trying to configure and compile the pam_ldap and nss_ldap for MIPS architecture. for this they need ldap library. so I am trying to compile openldap code for MIPS first, but the configuration is failing. The command and options used for configuration is as follows. ./configure --host=mips CC=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc LD=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-ld CFLAGS="-g -O2 -I/usr/include -I/usr/include/openssl" LDFLAGS="-L/usr/lib" --prefix=/mips/ldap --with-yielding_select=no and the errors got are as follows. hecking for sys/un.h... yes checking openssl/ssl.h usability... no checking openssl/ssl.h presence... yes configure: WARNING: openssl/ssl.h: present but cannot be compiled configure: WARNING: openssl/ssl.h: check for missing prerequisite headers? configure: WARNING: openssl/ssl.h: see the Autoconf documentation configure: WARNING: openssl/ssl.h: section "Present But Cannot Be Compiled" configure: WARNING: openssl/ssl.h: proceeding with the compiler's result configure: WARNING: ## --------------------------------------------- ## configure: WARNING: ## Report this to <http://www.openldap.org/its/> ## configure: WARNING: ## --------------------------------------------- ## checking for openssl/ssl.h... no checking gnutls/gnutls.h usability... no checking gnutls/gnutls.h presence... no checking for gnutls/gnutls.h... no checking nssutil.h usability... no checking nssutil.h presence... no checking for nssutil.h... no configure: error: MozNSS not found - please specify the location to the NSPR and NSS header files in CPPFLAGS and the location to the NSPR and NSS libraries in LDFLAGS (if not in the system location) Kindly help me to fix this error. Thank you. Regards,Vijay S.

2 1

About the information acquisition from slapd.d
by nozawat 06 Sep '11

06 Sep '11

Hi It is a question about the setting when I use slapd.d. 1.I acquire PID information in the following scripts, but will not have any problem? $config_file appoints slapd.d directory. ---- pid_file=`sed -ne \ 's/^olcPidFile:[[:space:]]\+$.\+$[[:space:]]*/\1/p' \ "$config_file"/'cn=config.ldif' 2>/dev/null` ---- 2.I am going to acquire information to use in the following scripts in ldapsearch -b. ---- for suffix in `find "$config_file"/'cn=config' -type f -name olcDatabase* -exec \ sed -ne 's/^[[:space:]]*olcSuffix:[[:space:]]\+$.\+$/\1/p' {} \;` ---- The script mentioned above is a part of a script for slapd monitoring to use it in pacemaker. Because ldap is not an expert, I want to hear the opinion of the person of the expert. Regards, Tomo

2 2

memberOf question
by Chris Jackson 06 Sep '11

06 Sep '11

Running OpenLDAP: slapd 2.4.23. My server currently returns memberOf info only when directly queried using memberOf. Is there a way to allow a base uid=me ldapsearch to return group memberships without specifying the memberOf? ldapsearch -x -h someserver.test.net -W -D cn=someuser,dc=test,dc=net -b dc=test,dc=net uid=me versus ldapsearch -x -h someserver.test.net -W -D cn=someuser,dc=test,dc=net -b dc=test,dc=net uid=me memberOf Here is the result of memberOf query: # extended LDIF # # LDAPv3 # base <dc=test,dc=net> with scope subtree # filter: uid=me # requesting: memberOf # # me, test.net dn: uid=me,dc=test,dc=net memberOf: cn=agroup,dc=test,dc=net

2 1

Re-binding to a different LDAP tree from an overlay
by Abu Marcose 06 Sep '11

06 Sep '11

I have a unique situation where we have developed a custom overlay that intercepts & processes bind requests. As part of the processing I need to bind to a different LDAP tree as a different user (with write access) and delete an object. How can I accomplish this ? Would anyone be able to point me to some sample code that would accomplish this ? Thanks in advance

1 0

Cross compilation of LDAP clients.
by vijay s sheelavantar 06 Sep '11

06 Sep '11

Hello,I want to compile pam_ldap and nss_ldap for MIPS architecture. I am getting lot of errors while doing this. it is asking for lldap and other libraries, and  ldap.h, ber.h, sasl.h header files. Kindly tell me the exact steps to follow for compiling these libraries for a particular architecture(MIPS,PPC etc). Thanks and Regards, VIJAY S.

2 1

Assigning Groups to LDAP users
by pradyumna dash 06 Sep '11

06 Sep '11

Guys, I have a query, lets take a scenario : Assume we have 2 servers "Server1" and "Server2" and 2 groups "Admin" and "ITTech", What is needed is like say when a user "bob" logging in to "Server1" he will get the group "Admin", but when he logs in to "Server2" he will get group "ITTech". Also it may vary for different users like when "Kris" logs in to Server1 he may get a group called "ITTech" and when he logs in to "Server2" he will get some other group say "Security". Can it be possible by OpenLDAP ? If this is achieved then we are planning to have SUDO files based on the grooups. It would be great if you can provide me some pointers or how-to. Regards, Neo

6 6

Re: syncrepl giving error "CSN too old, ignoring " for detla replication
by Yuri Bank 05 Sep '11

05 Sep '11

Hmm. I thought you only needed NTP time sync with N-way and MMR. But not with single Provider. I guess I never noticed an issue with this since my servers run ntp ayways. On Sat, Sep 3, 2011 at 1:57 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Saturday, September 03, 2011 1:02 AM -0700 Yuri Bank < > yuribank(a)gmail.com> wrote: > > I've seen a very similar issue (ContextCSNs being newer on my consumers), >> and I believe it was fixed in OpenLDAP (2.4.26). Do the "CSN too old, >> ignoring" error messages spam endlessly in your consumer logs? >> >> As for your other questions. You only need a single accesslog, and the >> clocks on your consumer nodes do not need to be in synch with the >> Provider (in deltasync replication). >> > > Wrong. Your clocks should *always* be tightly in sync. Particularly with > the advent of delta-sync MMR in the next release. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Slapd-meta stop at the first unreachable candidate
by Michel Gruau 05 Sep '11

05 Sep '11

Hello, It have a slapd-meta configuration as follows: database meta suffix dc=com uri ldap://server1:389/dc=suffix1,dc=com uri ldap://server2:389/dc=suffix2,dc=com uri ldap://server3:389/dc=suffix3,dc=com I performed numerous tests using "base=com" and changing the order of the above list of uri (in slapd.cnof) and I see that as soon as a candidate directory is unreachable, all other directories located below the directory in failure are not requested by the proxy. For instance, in example below: - if server2 is down, then server 3 is not requeted - if server1 is down, then none of the directories is requested. I have the felling this is a bug ... could you confirm ? FYI, I also tried the "'onerrr continue" config, but did not change annything Thanks in advance. Michel Une messagerie gratuite, garantie à vie et des services en plus, ça vous tente ? Je crée ma boîte mail www.laposte.net

4 6

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical September 2011