openldap-technical September 2011

openldap-technical@openldap.org

101 participants
119 discussions

Question on best way to partially disable users
by Ski Kacoroski 02 Sep '11

02 Sep '11

Hi, I have an openldap server that several applications use for authenication. What we need to do is when a person is disabled, we need to disable access for that user for all applications but one (employeeonline). My first thought was simply to move the disabled person to a different OU (e.g. ou=eoonly,dc=... instead of ou=people,dc=...). The problem I am running into is that employeeonline is windows/vbscript that uses SASL to bind which means that I cannot just move the user to a different OU as they are always coming in as sasl-realm OL.NSD.ORG. Does any one have a good trick for how to do this? So far all I have come up with is: 1. Bind as a admin user and then check the user's password instead of binding as the user. 2. Figure out someway for vbscript to bind as a different SASL realms. Thanks in advance for your advice. cheers, ski -- "When we try to pick out anything by itself, we find it connected to the entire universe" John Muir Chris "Ski" Kacoroski, Unix Admin, NSD 206-501-9803, ski98033 on IRC and most IM services

2 2

change syncrepl creds with no restart?
by Christopher Wood 02 Sep '11

02 Sep '11

(I'm having trouble finding the answer with Google, so inquiring here. If you have RTFM urls I will be quite happy indeed.) It looks like I'm unable to change syncrepl (client) credentials without restarting slapd. When I tried this I couldn't modify an entry after the change, with an error message apparently indicating that this was a replicated consumer. Things went back to multimaster-normal after restarting both slapd's involved. My questions (more details are below): 1) Is this intended? 2) Is there something that I can prod slapd with in order to have it change syncrepl credentials without restarting slapd? (Details caveats: s/${companyname}/base/; munged hostnames too; I have checked that all passwords are the same on the real hosts just like here; I have checked that the syncrepl provider= are correct on the real hosts): The "before" state is me using the olcRootDN for multimaster syncrepl, on the grounds that I wanted to set it up quickly in the lab. Now I want to use a less privileged user. All changes to cn=config were replicated between supplier hosts. First I added a new user: dn: uid=sync,o=base userPassword:: YmFzZQ== objectClass: account objectClass: shadowAccount uid: sync Then I gave that user read access to everything: dn: olcDatabase={1}hdb,cn=config changetype: modify replace: olcAccess olcAccess: to dn.subtree="uid=basero,o=base" by anonymous auth by dn=uid=basero,o=base by dn=uid=sync,o=base read olcAccess: to attrs="userPassword" by anonymous auth by self read by dn=uid=basero,o=base by dn=uid=sync,o=base read olcAccess: to dn.subtree="ou=groups,o=base" by * read olcAccess: to dn.subtree="ou=people,o=base" by * read olcAccess: to * by dn=uid=sync,o=base read The acls for the o=base tree were then: olcAccess: {0}to dn.subtree="uid=basero,o=base" by anonymous auth by dn=uid=basero,o=base read olcAccess: {1}to attrs="userPassword" by anonymous auth by self read by dn=uid=basero,o=base read olcAccess: {2}to dn.subtree="ou=groups,o=base" by * read olcAccess: {3}to dn.subtree="ou=people,o=base" by * read olcAccess: {4}to * by dn=uid=sync,o=base read So I updated the olcSyncrepl rules: dn: olcDatabase={1}hdb,cn=config changetype: modify replace: olcSyncRepl olcSyncrepl: rid=003 provider=ldap://ldap-supplier-lab-01 binddn="uid=sync,o=base" bindmethod=simple credentials=base searchbase="o=base" type=refreshOnly interval=00:00:00:10 retry="5 5 30 +" timeout=1 olcSyncrepl: rid=004 provider=ldap://ldap-supplier-lab-02 binddn="uid=sync,o=base" bindmethod=simple credentials=base searchbase="o=base" type=refreshOnly interval=00:00:00:10 retry="5 5 30 +" timeout=1 However, when I attempted to change my password on one of the hosts (using o=base not cn=config)... dn: uid=cwood,ou=people,o=base changetype: modify add: userPassword userPassword: fakefakefake I got this: modifying entry "uid=cwood,ou=people,o=base" ldap_modify: Server is unwilling to perform (53) additional info: shadow context; no update referral And this is what turned up in the logs: Sep 1 11:34:03 ldap-supplier-lab-01 slapd[8549]: conn=42902 op=1 MOD dn="uid=cwood,ou=people,o=base" Sep 1 11:34:03 ldap-supplier-lab-01 slapd[8549]: conn=42902 op=1 MOD attr=userPassword Sep 1 11:34:03 ldap-supplier-lab-01 slapd[8549]: conn=42902 op=1 RESULT tag=103 err=53 text=shadow context; no update referral Sep 1 11:34:03 ldap-supplier-lab-01 slapd[8549]: conn=42902 op=2 UNBIND

2 2

LDAP authentication of unregistered user at client side.
by vijay s sheelavantar 02 Sep '11

02 Sep '11

Hi Friends, I have a openldap server running on one machine (fedora10) and pam_ldap.so and nss_ldap.so running on the other machine. I have added a new user to the LDAP server database, this user is not created on client machine. 1. Can i login to the client machine using this new user?2. Now if i try logging with this new user I am getting error messages, the error messages are as follows at client side Sep  2 10:34:36 localhost sshd[8484]: Invalid user kim from 10.254.194.148Sep  2 10:34:36 localhost sshd[8485]: input_userauth_request: invalid user kim Sep  2 10:35:16 localhost sshd[8484]: pam_ldap: error trying to bind as user "cn=min soo,ou=people,dc=samsung,dc=com" (Invalid credentials)Sep  2 10:35:16 localhost sshd[8484]: pam_succeed_if(sshd:auth): error retrieving information about user kimSep  2 10:35:16 localhost sshd[8484]: Failed password for invalid user kim from 10.254.194.148 port 52652 ssh2 Kindly let me know is it a limitation with LDAP ??? Thanks and Regards,VIJAY S.

2 1

OpenLDAP client test program connecting to LDAP server over SSL failed
by daisy.wu＠emc.com 01 Sep '11

01 Sep '11

I am trying to write a simple client test program using OpenLDAP client API to connect to Microsoft Active Directory Server over SSL. Below is code snippet. The program failed to connect. It failed because of this error: ldap_sasl_bind_s: Can't contact LDAP server (-1) error:14090086:SSL routines: SSL3_GET_SERVER_CERTIFICATE:certificate verify failed I know there's no problem with LDAP certificate store /path/to/ldap_certdb because a simple LDAP client test program written in Mozilla LDAP C-SDK worked fine connecting to this same AD server, over SSL. I need to know if I am using the correct OpenLDAP client API calls. Any input would be much appreciated. Thanks. Source Code: ldap_initialize( &ld, uri ); if ( ld == NULL ) { tester_perror( "ldap_initialize", NULL ); exit( EXIT_FAILURE ); } rc = ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &version ); printf("rc=ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, %d)=%d, error=%s\n", version, rc, ldap_err2string(rc)); rc = ldap_set_option( ld, LDAP_OPT_REFERRALS, chaserefs ? LDAP_OPT_ON : LDAP_OPT_OFF ); printf("rc=ldap_set_option(ld, LDAP_OPT_REFERRALS, %d)=%d, error=%s\n", chaserefs, rc, ldap_err2string(rc)); int debug_flag1 = -1; // LDAP_DEBUG_ANY ; rc = ldap_set_option( ld, LDAP_OPT_DEBUG_LEVEL, &debug_flag1); printf("rc=ldap_set_option(ld, LDAP_OPT_DEBUG_LEVEL, %d)=%d, error=%s\n", debug_flag1, rc, ldap_err2string(rc)); char *cert_path="/path/to/ldap_certdb"; rc = ldap_set_option( ld, LDAP_OPT_X_TLS_CACERTDIR, &cert_path); printf("rc=ldap_set_option(ld, LDAP_OPT_X_TLS_CACERTDIR, %s)=%d, error=%s\n", cert_path, rc, ldap_err2string(rc)); int reqcert = LDAP_OPT_X_TLS_ALLOW; rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &reqcert); printf("rc=ldap_set_option(ld, LDAP_OPT_X_TLS_REQUIRE_CERT, %d)=%d, error=%s\n", reqcert, rc, ldap_err2string(rc)); rc = ldap_sasl_bind_s( ld, manager, LDAP_SASL_SIMPLE, passwd, NULL, NULL, NULL ); if ( rc != LDAP_SUCCESS ) { tester_ldap_error( ld, "ldap_sasl_bind_s", NULL ); switch ( rc ) { case LDAP_BUSY: case LDAP_UNAVAILABLE: /* fallthru */ default: break; } exit( EXIT_FAILURE ); } Here's program output: rc=ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, 3)=0, error=Success rc=ldap_set_option(ld, LDAP_OPT_REFERRALS, 0)=0, error=Success rc=ldap_set_option(ld, LDAP_OPT_DEBUG_LEVEL, -1)=0, error=Success rc=ldap_set_option(ld, LDAP_OPT_X_TLS_CACERTDIR, /path/to/ldap_certdb)=0, error=Success rc=ldap_set_option(ld, LDAP_OPT_X_TLS_REQUIRE_CERT, 3)=0, error=Success PID=4781 - Search(2): base="OU=people,OU=documentum,DC=adldap112,DC=dctmlabs,DC=com", filter="cn=aduser2*" attr="cn". slapd-search PID=4781: ldap_sasl_bind_s: Can't contact LDAP server (-1) error:14090086:SSL routines: SSL3_GET_SERVER_CERTIFICATE:certificate verify failed From: Wu, Daisy Sent: Friday, August 26, 2011 4:53 PM To: openldap-technical(a)openldap.org; 'openldap-devel-request(a)openldap.org' Subject: Need sample OpenLDAP client test program connecting to LDAP server over SSL Hi, OpenLDAP developers, Do you have any sample test programs (or code snippets) that uses OpenLDAP client API to connect to LDAP server over SSL? Thanks in advance. Daisy

3 11

Status of persistent search in OpenLDAP
by Clément OUDOT 01 Sep '11

01 Sep '11

Hello, I tried to know if the persistent search control (OID 2.16.840.1.113730.3.4.3) was supported in OpenLDAP. The latests messages I read were saying "no", as we can see in this discussion: http://www.openldap.org/lists/openldap-technical/201008/msg00246.html But this blog entry is saying this control was introduced in OpenLDAP 2.2: http://www.connexitor.com/blog/pivot/entry.php?id=112 So can you confirm that OpenLDAP 2.4 does not support persistent search control? Is this feature planned? Thanks for your help, Clément.

4 7

task slapd blocked for more than 120 seconds.
by ml+openldap＠esmtp.org 01 Sep '11

01 Sep '11

I'm trying some scenarios to see how syncrepl behaves in certain error conditions. In one of these slapd blocks and is terminated(?) (2.4.23 and 2.4.26, running on RH 5.5): slapd D ffff810002536420 0 21032 1 21037 4521 (NOTLB) slapd D ffff810002536420 0 21032 1 21037 4521 (NOTLB) ffff810003f3fce8 0000000000000082 ffff81007eaae080 ffff81007faec100 000ec08328ac597e 0000000000000007 ffff81007eaae080 ffffffff80311b60 000ec0832bef5b8d 0000000000000990 ffff81007eaae268 0000000000000001 Call Trace: [<ffffffff8006315f>] wait_for_completion+0x79/0xa2 [<ffffffff8008e430>] default_wake_function+0x0/0xe [<ffffffff8004213e>] exit_mm+0x76/0xf5 [<ffffffff800158e6>] do_exit+0x305/0x965 [<ffffffff80049392>] cpuset_exit+0x0/0x88 [<ffffffff8002b42d>] get_signal_to_deliver+0x465/0x494 [<ffffffff8005af5e>] do_notify_resume+0x9c/0x7af [<ffffffff8008e430>] default_wake_function+0x0/0xe [<ffffffff80031545>] do_fork+0x148/0x1c1 [<ffffffff800a6061>] sys_futex+0x10a/0x12b [<ffffffff8005d19f>] sysret_signal+0x1c/0x27 [<ffffffff8005d427>] ptregscall_common+0x67/0xac INFO: task slapd:21037 blocked for more than 120 seconds. How to reproduce: Configuration: one master with a push replica (see also ITS 6999). On the replica: stop slapd, clean out the database directory, set up the essential files, start slapd. On the master: add a new entry to LDAP and run ldapsearch on that entry afterwards: the command hangs. ldap log entries for this: conn=1002 fd=20 ACCEPT from PATH=/var/run/ldapi (PATH=/var/run/ldapi) conn=1002 op=0 BIND dn="cn=Manager" method=128 conn=1002 op=0 BIND dn="cn=Manager" mech=SIMPLE ssf=0 conn=1002 op=0 RESULT tag=97 err=0 text= conn=1002 op=1 ADD dn="uid=user2002,ou=People,dc=example,dc=com" slap_queue_csn: queing 0x43224150 20110831224446.739440Z#000000#001#000000 syncprov_sendresp: cookie=rid=001,sid=001,csn=20110831224446.739440Z#000000#001#000000 do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20110831224446.739440Z#000000#001#000000 syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) conn=1002 op=2 UNBIND conn=1002 op=1 RESULT tag=105 err=0 text= slap_graduate_commit_csn: removing 0x2aaab0004160 20110831224446.739440Z#000000#001#000000 conn=1002 fd=20 closed syncrepl_entry: rid=001 be_search (0) syncrepl_entry: rid=001 uid=user2002,ou=People,dc=example,dc=com slap_queue_csn: queing 0x5d4ea70 20110831224446.739440Z#000000#001#000000 syncrepl_entry: rid=001 be_add uid=user2002,ou=People,dc=example,dc=com (32) Is this an error in slapd or in RH?

1 0

Multi Master replication error
by arun.sasi1＠wipro.com 01 Sep '11

01 Sep '11

Hello Team, Issue:- Multi master replication, I have configured multimaster server in the infra, but only one server can replicate and write the data... and another server I can write but it is not replicating to another server. Server names Oldap01.domain.com > Yes I am able replicate and write the data to oldap03.domain.com Oldap03.domain.com > I can write the data but changes are not replicating to oldap01.domain.com Below are the logs from oldap03.domain com server. Sep 2 22:33:02 oldap03 slapd[6767]: do_syncrep2: rid=003 LDAP_RES_SEARCH_RESULT Sep 2 22:33:12 oldap03 slapd[6767]: daemon: epoll: listen=8 active_threads=0 tvp=zero Sep 2 22:33:12 oldap03 slapd[6767]: daemon: epoll: listen=9 active_threads=0 tvp=zero Sep 2 22:33:12 oldap03 slapd[6767]: daemon: epoll: listen=10 active_threads=0 tvp=zero Sep 2 22:33:12 oldap03 slapd[6767]: daemon: epoll: listen=11 active_threads=0 tvp=zero Sep 2 22:33:12 oldap03 slapd[6767]: daemon: epoll: listen=12 active_threads=0 tvp=zero Configuration in oldap01.domain.com vi olcDatabase\=\{0\}config.ldif dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config structuralObjectClass: olcDatabaseConfig entryUUID: 8b9b46f4-69c2-1030-9437-4bf7fbbdbef2 creatorsName: cn=config createTimestamp: 20110902151824Z olcRootDN: cn=admin,cn=config olcRootPW:: c2VjcmV0 olcSyncrepl: {0}rid=001 provider=ldap://oldap01.emb.slb.com binddn="cn=admin,c n=config" bindmethod=simple credentials=secret searchbase="cn=config" type=re freshAndPersist retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=002 provider=ldap://oldap03.emb.slb.com binddn="cn=admin,c n=config" bindmethod=simple credentials=secret searchbase="cn=config" type=re freshAndPersist retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE entryCSN: 20110902151840.657300Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20110902151840Z vi olcDatabase\=\{1\}hdb.ldif dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=emb,dc=slb,dc=com olcLastMod: TRUE olcRootPW:: c2VjcmV0 olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 structuralObjectClass: olcHdbConfig entryUUID: 8cbd67d8-69c2-1030-944e-7d5b88770cfe creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20110902151826Z olcDbIndex: entryUUID eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: loginShell eq olcDbIndex: uid eq,pres,sub olcDbIndex: memberUid eq,pres,sub olcDbIndex: uniqueMember eq,pres olcDbIndex: sambaSID eq olcDbIndex: sambaPrimaryGroupSID eq olcDbIndex: sambaGroupType eq olcDbIndex: sambaSIDList eq olcDbIndex: sambaDomainName eq olcDbIndex: default sub olcDbIndex: entryCSN eq olcRootDN: cn=admin,dc=emb,dc=slb,dc=com olcSyncrepl: {0}rid=003 provider=ldap://oldap01.emb.slb.com binddn="cn=admin,d c=emb,dc=slb,dc=com" bindmethod=simple credentials=secret searchbase="dc=emb, dc=slb,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeou t=1 olcSyncrepl: {1}rid=004 provider=ldap://oldap03.emb.slb.com binddn="cn=admin,d c=emb,dc=slb,dc=com" bindmethod=simple credentials=secret searchbase="dc=emb, dc=slb,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeou t=1 olcMirrorMode: TRUE entryCSN: 20110902151842.375156Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20110902151842Z Configuration in oldap03.domain.com The same as above configuration Could you please help me to solve this issue.. Thanks & Regards, Arun Sasi V ------------------------------------------------------------------------ ------------------------------------------------------------- Sr. Engineer - Server Management (UNIX), Wipro Infotech (GSMC) |Direct +918213029356 Mob: +919731031500 | E: arun.sasi1(a)wipro.com <mailto:koresh.dash@wipro.com> Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

Memory Leak in slapd (or did I miss something configuring?)
by Thomas Rasmussen 01 Sep '11

01 Sep '11

Hello (originally posted to -bugs list, but think this might be the correct list) I have an openldap installation setup which appears to have a memory leak which I have not been able to solve by upgrading software etc. which is why I'm submitting this, if this is the wrong list, please let me know. The setup is: - OpenLDAP server running 2.4.26, compiled against db-5.2.28, heimdal 1.2.1. - Server is SunOS servername 5.10 Generic_141445-09 i86pc i386 i86pc, 6GB of RAM and 5GB of swap (in a VMWare ESX environment) I have the following in my DB_CONFIG file: set_cachesize 0 52428800 0 set_lg_regionmax 1048576 set_lg_max 10485760 set_lg_bsize 2097152 set_lg_dir /pack/openldap/var/openldap-crl-logs In my slapd.conf I have the following entries (I stripped out some restricts and other irrelevant lines) include /pack/openldap/etc/openldap/schema/core.schema include /pack/openldap/etc/openldap/schema/entrust.attributes.cfg include /pack/openldap/etc/openldap/schema/entrust.objectclasses.cfg idletimeout 300 pidfile /pack/openldap/var/run/slapd-crl.pid argsfile /pack/openldap/var/run/slapd-crl.args threads 4 database bdb suffix "c=DK" directory /pack/openldap/var/openldap-crl index objectClass,entryCSN,entryUUID eq checkpoint 128 1 dbnosync overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 serverID 2 monitoring off idletimeout 10 Just FYI, the server is a clone of another server currently running syncprov replication between two nodes, hence the syncprov lines. This server has the same databases as the production ones, but I just moved it to isolated area and removed all sync options from slapd. My database is rather big: vs24n02z2.prl1:/pack/openldap/var/openldap-crl root$ du -sh *.bdb 961M dn2id.bdb 162M entryCSN.bdb 67M entryUUID.bdb 10G id2entry.bdb 4.0M objectClass.bdb but I'd imagine this not beeing a problem (other than some performance issues, but this is not the problem here). Now, when I start up my slapd, it consumes around 6MB RAM, all is fine, I can perform searches and updates without problems. But my memory consumption is going through the roof! If I perform a search through the part of the database having alot of data, I suddenly find slapd using 500+ MB of memory... In our production setup, we actually see that after a couple of weeks, slapd is consuming 3+ GB of memory, and then at some point hits a Out of memory, and crashes. Our production setup is infact a openldap 2.4.22 with berkeley db 4.6.21, and my test server (cloned in a vmware environment) has just upgraded this environment by this recipe: Using db-4.6.21 * db_checkpoint -1 * db_recover -h <path to bdb files> install db-5.2.28 * Loop through all bdb files: db_upgrade <bdb file> * install openldap 2.4.26 (compiled against db-5.2.28) * start slapd The server which updates the LDAP is performing many search and updates, which is probably why memory consumption is exploding after restarts? Now, my main concern is, how (if possible) can we procede with this? We really need to find the problem as this causes production problems whenever the ldap crashes. Regards Thomas

3 7

TLS issue with SLES11
by pradyumna dash 01 Sep '11

01 Sep '11

List, It would be great if someone can share doc on TLS with OpenLDAP configuration on SLES 11, I tried all the possible ways to make it happen but no luck. I tried with both yast2 and by CA.pl and openssl commands, but no luck, When i do netstat .lnap |grep ldap it shows both 636 and 389 port listtening to the hostname, When i check the logs it shows the destination port its showing is 389. But when i try ldapsearch -x -H ldaps://hostname, its also showing me the ldap contents, dont know whats wrong, I also tried to open /etc/sysconfig/openldap and assigned the LDAP service to run on 127.0.0.1, but if i do so then its not able to get the server. Please help. Regards, Neo

4 6

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical September 2011