openldap-technical September 2011

openldap-technical@openldap.org

101 participants
119 discussions

LDAP Dynamic Library Creation Failed.
by vijay s sheelavantar 16 Sep '11

16 Sep '11

Hi, I am trying to cross compile openldap-2.4.26 using the following command for MIPS. ./configure --host=mips CC=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc LD=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-ld LDFLAGS=-Bshareable CPPFLAGS="-I/product/wibro/premium/src/APP/Protocols/ASNGW/vijay/db-4.8.26/build_unix" AR=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-ar RANLIB=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-ranlib NM=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-nm STRIP=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-strip OBJDUMP=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-objdump --enable-dynamic=yes AS=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-as --enable-shared=yes --with-yielding_select=no The configuration and make is going well, but at the end it is not creating the required dynamic libraries.only static libraries are getting created.  I have observed the following points during configuration checking whether a program can dlopen itself... cross checking if libtool supports shared libraries... no checking whether to build shared libraries... no checking whether to build static libraries... yes I tried to enable dynamic library creation by giving option --enable-shared=yes. But it didn't work out. please help me how can i solve this problem. Thanks & Regards,Vijay S.

2 1

Moving LDAP DB directory
by Bram Cymet 16 Sep '11

16 Sep '11

Hi, I am wondering if I have an ldap tree with olcDbDirectory: /var/lib/ldap. Would I be able to move just that tree to a different directory. Say /var/lib/ldap/someotherdir? Or do I have to throw everything away and start over? -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. 613-608-9752

1 0

ldap proxy acl filter problem
by Ron Peterson 16 Sep '11

16 Sep '11

Hi, (OpenLDAP version 2.4.23) I have a filter expression in an ACL that is somehow affecting my ability to retrieve specific attributes. What's strange (to me) is that with or without the filter expression in place, I can retrieve all attributes, i.e. the full object. 4986# ldapsearch -LLL -Z -x -y ../../private/pwemail '(uid=rpeterso)' dn: yDirectoryID=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=email yDirectoryID: c44883ba-ac62-d28c-556f-99ccbf532da7 objectClass: yAccount objectClass: inetOrgPerson uid: rpeterso mail: rpeterso(a)mtholyoke.edu etc... But if I specify a particular attribute, then having the filter expression in place somehow inhibits my ability to retrieve the specific attribute(s). Without filter expression: 4987# ldapsearch -LLL -Z -x -y ../../private/pwemail '(uid=rpeterso)' mail dn: yDirectoryID=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=email mail: rpeterso(a)mtholyoke.edu With filter expression in place: 4990# ldapsearch -LLL -Z -x -y ../../private/pwemail '(uid=rpeterso)' mail dn: yDirectoryID=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=email The ACL in question looks like: access to dn.regex="(yDirectoryID=.*),ou=email" filter="(&(yInstitution=mtholyoke.edu)(yGlobalPermission=allow)(|(yApplicationPermission=email)(&(yDefaultApplicationPermission=allow)(!(yApplicationPermission=email)))))" by dn.regex=$1,ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu read by dn="uid=email,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu" read by * none I've turned my logging way up, and the hiccup seems to be that the DN I've authenticated as (uid=email,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu) needs read access to the attributes in the filter expression. But how do I give that account read access to those attributes, without then exposing the objects that I'm trying to hide with the filter expression? -- Ron Peterson Network & Systems Administrator Mount Holyoke College http://www.mtholyoke.edu/~rpeterso

2 3

Generating unique identifier
by sim123 16 Sep '11

16 Sep '11

Does openldap support generating unique identifier or guids, I need to generate it using a ldap C API and wondering if DS does that for me or do I need my own GUID generator in application. Thanks for the help and support.

2 1

authz-regexp in conf.d
by Bram Cymet 15 Sep '11

15 Sep '11

Hi, I would like to use authz-regexp so that I can map users DN's to the auth DN that sasl with GSSAPI expects. I have found lots of slapd.conf examples of how to do this but I am using conf.d for my configuration. Does anyone have an example ldif file that I can use to add authz-regexp? Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. 613-608-9752

2 2

OpenLDAP / PAM: No Username
by Denis Witt 15 Sep '11

15 Sep '11

Hi, I'm running OpenLDAP 2.4.23-7.2 (from Debian Squeeze). Most of the time everything works fine, the LDAP-Server is used by libpam/libnss, Samba, Dovecot and Postfix. Sometimes when I log into the Server via SSH the command prompt displays "Ich habe keinen Benutzernamen@servername" (which means "I don't have a username") instead of my username. The login itself works fine. The real problem is that if this happens the Mailserver isn't able to deliver mails: status=bounced (unknown user: "myusername") Using google I found some other users with the "don't have a username"-Problem, but most of the time they had a ACL-Problem. As the LDAP-Server usually is working it seems that this isn't the problem. Also the problem is gone when I restart the whole machine (just restarting slapd doesn't help). Any ideas? -- Regards, Denis Witt

2 4

Where to get valid LDAP library (libldap.so)?
by vijay s sheelavantar 15 Sep '11

15 Sep '11

Hi, I am getting following error while compiling pam_ldap for MIPS. configure: error: could not locate a valid LDAP library I compiled openldap-2.4.26 for mips and gave the path, but I couldn't find libldap.so in that openldap-2.3.26. I need libldap.so source code so that I can compile it for my architecture. please help me to get libldap.so. Warm Regards VIJAY S.

1 0

Re: Open LDAP Installation/Configuration Failed.
by vijay s sheelavantar 15 Sep '11

15 Sep '11

Thanq very much Aaron Richton. Now I am able to cross compile openldap successfully. but it didn't create the libldap.so library? Please let me know how i can create this libldap.so library??

1 0

Deleting database config
by Styopa Semenukha 15 Sep '11

15 Sep '11

Hi, I have a testing database which appears in slapcat output as: --- dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/mytest olcSuffix: dc=example,dc=org olcRootDN: cn=admin,dc=example,dc=org olcRootPW:: <password cut> olcDbIndex: objectClass eq olcDbIndex: memberUid eq structuralObjectClass: olcHdbConfig entryUUID: cdabedf0-6a03-1030-90e5-d10501c8fbf2 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20110902230532Z olcAccess: {0}to attrs=userPassword by anonymous auth by dn="cn=replication,dc=example,dc=org" read by self write by * none olcAccess: {1}to dn.subtree="ou=People,dc=example,dc=org" by users read by * none olcAccess: {2}to * by dn="cn=replication,dc=example,dc=org" read entryCSN: 20110905234735.466413Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20110905234735Z --- I need to drop it completely. To delete data I stop slapd, rm /var/mytest/* and restart slapd. But I also need to drop database config. I tried: # ldapdelete -r -Y EXTERNAL -H ldapi:/// "olcDatabase={2}hdb,cn=config" SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 ldap_delete: Server is unwilling to perform (53) The debug log says I get manage privilege to all. Maybe there is another way to address this DB (e.g. by UUID)? How do I delete this DB config? Thank you. -- Best regards, Styopa Semenukha. xmpp:styopa@jabber.org

2 1

OpenLDAP 2.4.23 - Syncrepl - TLS Trouble
by Alexey Tyurikov 15 Sep '11

15 Sep '11

Dear OpenLDAP experts, I'm about to setup an OpenLDAP server with the following features: - TLS/SSL with self-signed certificates - TLS-encrypted N-way replication (Syncrepl) My environment: - 2 x RHEL 6.0 - OpenLDAP 2.4.23 I try to sync both databases: cn=config and backend-db. The problem is that I'm not able to turn on TLS for both sync-connections at the same time. It works for each connection but only if the second one is unencrypted. Working configuration: ----- olcDatabase={0}config,cn=config ... olcSyncrepl: {0}rid=001 provider=ldap://ldapserver1.com binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=002 provider=ldap://ldapserver2.com binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 ... olcDatabase={1}bdb,cn=config ... olcSyncrepl: {0}rid=003 provider=ldap://ldapserver1.com binddn="cn=manager,dc=ldap,dc=com" bindmethod=simple credentials=password searchbase="dc=ldap,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes tls_cacert=/etc/openldap/cacerts/ca.pem olcSyncrepl: {1}rid=004 provider=ldap://ldapserver2.com binddn="cn=manager,dc=ldap,dc=com" bindmethod=simple credentials=password searchbase="dc=ldap,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes tls_cacert=/etc/openldap/cacerts/ca.pem ----- (desired) Configuration, which doesn't work: ----- olcDatabase={0}config,cn=config ... olcSyncrepl: {0}rid=001 provider=ldap://ldapserver1.com binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 starttls=yes tls_cacert=/etc/openldap/cacerts/ca.pem olcSyncrepl: {1}rid=002 provider=ldap://ldapserver2.com binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 starttls=yes tls_cacert=/etc/openldap/cacerts/ca.pem ... olcDatabase={1}bdb,cn=config ... olcSyncrepl: {0}rid=003 provider=ldap://ldapserver1.com binddn="cn=manager,dc=ldap,dc=com" bindmethod=simple credentials=password searchbase="dc=ldap,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes tls_cacert=/etc/openldap/cacerts/ca.pem olcSyncrepl: {1}rid=004 provider=ldap://ldapserver2.com binddn="cn=manager,dc=ldap,dc=com" bindmethod=simple credentials=password searchbase="dc=ldap,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes tls_cacert=/etc/openldap/cacerts/ca.pem ----- /etc/openldap/cacerts/ca.pem contains CA certificates of both servers. What is wrong? I would be very thankful for every advise.

2 1

← Newer
1
...
4
5
6
7
8
9
10
11
12
Older →

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical September 2011