openldap-technical October 2012

openldap-technical@openldap.org

68 participants
66 discussions

Open LDAP sometimes "Can't contact LDAP server"
by amicale.salmson＠free.fr 15 Oct '12

15 Oct '12

Hello all, I developed a PHP application which use slapd. Sometimes, I have the message "Can't contact LDAP server", but sometimes it works (almost half the time) Just before it hangs, I see the following message: -------------------------------------------------- daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=9 active_threads=0 tvp=zero daemon: epoll: listen=10 active_threads=0 tvp=zero connection_read(20): input error=-2 id=1530, closing. connection_closing: readying conn=1530 sd=20 for close daemon: removing 20 conn=1530 fd=20 closed (connection lost) daemon: activity on 1 descriptor daemon: activity on: -------------------------------------------------- Sometimes, I also see theses messages: -------------------------------------------------- slapd[9635]: connection_close: deferring conn=1582 sd=22 connection_input: conn=1593 deferring operation: binding -------------------------------------------------- I use : - debian 6.0.5 - slapd 2.4.23-7.2 - OpenSSL 0.9.8o 01 Jun 2010 SSL certificats generated with XCA : - openssl x509 -text -in /etc/ssl/pki/ca.crt Data: Version: 3 (0x2) Signature Algorithm: sha1WithRSAEncryption Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (4096 bit) X509v3 extensions: X509v3 Basic Constraints: critical CA:TRUE X509v3 Key Usage: Certificate Sign, CRL Sign Netscape Cert Type: SSL CA, S/MIME CA, Object Signing CA Netscape Comment: xca certificate - openssl x509 -text -in /etc/ssl/pki/server.crt Data: Version: 3 (0x2) Signature Algorithm: sha1WithRSAEncryption Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (4096 bit) X509v3 extensions: X509v3 Basic Constraints: critical CA:FALSE X509v3 Key Usage: Digital Signature, Non Repudiation, Key Encipherment Netscape Cert Type: SSL Server Netscape Comment: xca certificate Certificats import: ----- BEGIN /etc/ssl/pki/ldap/ldap.ldif ----- dn: cn=config replace: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/pki/ca.crt - replace: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/pki/ldap.crt - replace: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ssl/pki/server.pem ----- END /etc/ssl/pki/ldap/ldap.ldif ----- ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ssl/pki/ldap/ldap.ldif I don't see at all where the problem can comes from because it works half the time. Can anyone help me? Regards, sms

2 1

OpenLDAP Binding and MD5 Hex Authentication
by S K 15 Oct '12

15 Oct '12

Hi, I am able to bind to LDAP server using MD5 Base 64,SHA1,SHA2 encoding but not using MD5 Hex encoding. Can somebody please let me know which I get error 49 when binding using MD5 Hex encoded passwords. Thanks, SK

2 1

Re: openldap-technical Digest, Vol 59, Issue 15
by amicale.salmson＠free.fr 15 Oct '12

15 Oct '12

Hello, How can I find this informations? I didn't find any information about binding by using the command: #/usr/sbin/slapcat -n 0 -l output.ldif Command result: http://pastebin.com/4ihGjLXf # cat /etc/ldap/ldap.conf URI ldaps:/// BASE dc=sms,dc=fr TLS_CACERT /etc/ssl/pki/fr.sms.ca.crt TLS_REQCERT never cat /etc/default/slapd SLAPD_CONF= SLAPD_USER="openldap" SLAPD_GROUP="openldap" SLAPD_PIDFILE= SLAPD_SERVICES="ldaps:/// ldapi:///" SLAPD_SENTINEL_FILE=/etc/ldap/noslapd SLAPD_OPTIONS="" Does anyone have an ideai why it works half the time? Thanks, sms. ----- Mail original ----- De: "25Dollar Tech" <25dollartechhelp(a)gmail.com> À: "amicale salmson" <amicale.salmson(a)free.fr> Envoyé: Lundi 15 Octobre 2012 14:11:36 Objet: Re: openldap-technical Digest, Vol 59, Issue 15 Hello you must check in your bind details from conf or ldif file Message: 2 Date: Mon, 15 Oct 2012 12:57:56 +0200 (CEST) From: amicale.salmson(a)free.fr To: openldap-technical(a)openldap.org Subject: Open LDAP sometimes "Can't contact LDAP server" Message-ID: < 258228487.277539862.1350298676206.JavaMail.root(a)zimbra63-e11.priv.proxad.net > Content-Type: text/plain; charset=utf-8 Hello all, I developed a PHP application which use slapd. Sometimes, I have the message "Can't contact LDAP server", but sometimes it works (almost half the time) Just before it hangs, I see the following message: -------------------------------------------------- daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=9 active_threads=0 tvp=zero daemon: epoll: listen=10 active_threads=0 tvp=zero connection_read(20): input error=-2 id=1530, closing. connection_closing: readying conn=1530 sd=20 for close daemon: removing 20 conn=1530 fd=20 closed (connection lost) daemon: activity on 1 descriptor daemon: activity on: -------------------------------------------------- Sometimes, I also see theses messages: -------------------------------------------------- slapd[9635]: connection_close: deferring conn=1582 sd=22 connection_input: conn=1593 deferring operation: binding -------------------------------------------------- I use : - debian 6.0.5 - slapd 2.4.23-7.2 - OpenSSL 0.9.8o 01 Jun 2010 SSL certificats generated with XCA : - openssl x509 -text -in /etc/ssl/pki/ca.crt Data: Version: 3 (0x2) Signature Algorithm: sha1WithRSAEncryption Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (4096 bit) X509v3 extensions: X509v3 Basic Constraints: critical CA:TRUE X509v3 Key Usage: Certificate Sign, CRL Sign Netscape Cert Type: SSL CA, S/MIME CA, Object Signing CA Netscape Comment: xca certificate - openssl x509 -text -in /etc/ssl/pki/server.crt Data: Version: 3 (0x2) Signature Algorithm: sha1WithRSAEncryption Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (4096 bit) X509v3 extensions: X509v3 Basic Constraints: critical CA:FALSE X509v3 Key Usage: Digital Signature, Non Repudiation, Key Encipherment Netscape Cert Type: SSL Server Netscape Comment: xca certificate Certificats import: ----- BEGIN /etc/ssl/pki/ldap/ldap.ldif ----- dn: cn=config replace: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/pki/ca.crt - replace: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/pki/ldap.crt - replace: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ssl/pki/server.pem ----- END /etc/ssl/pki/ldap/ldap.ldif ----- ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ssl/pki/ldap/ldap.ldif I don't see at all where the problem can comes from because it works half the time. Can anyone help me? Regards, sms ------------------------------ _______________________________________________ openldap-technical mailing list openldap-technical(a)openldap.org http://www.openldap.org/lists/mm/listinfo/openldap-technical End of openldap-technical Digest, Vol 59, Issue 15 ************************************************** -- Thanks & Regards, 25dollarTech Team https://sites.google.com/site/25dollartech/ Email: 25dollartechhelp(a)gmail.com

1 0

ACI module
by Brian Empson 14 Oct '12

14 Oct '12

Is it possible to load ACI support as a module? It would really help when installing from a precompiled package, all of which seem to turn off this very powerful feature. (I really like it anyway)

2 1

MDB Status
by Howard Chu 13 Oct '12

13 Oct '12

For those who haven't been following along, support for OpenLDAP's MDB (memory-mapped database) library is also available for several other open source projects, including Cyrus SASL (sasldb mech), Heimdal Kerberos (hdb module), SQLite3, OpenDKIM, and MemcacheDB. A work-in-progress patch for Postfix is also available, with a final version coming soon. A backend for SQLite4 is also in the works. A port of Android (JellyBean) for the Motorola Droid4 using MDB/SQLite3 is in progress (since my current phone is a Droid4). Other projects are also in progress and will be announced in the near future. The current list is also posted on http://highlandsun.com/hyc/mdb/ - feel free to suggest other projects. OpenLDAP MDB completely outclasses other embedded databases (like Oracle BerkeleyDB, Google LevelDB, SQLite, Kyoto Cabinet) from every angle: performance, efficiency, reliability, administrative ease, simplicity, whatever. With MDB not only have we made the world's fastest LDAP server even faster, but we can also make anything else that uses a database even better. I'll also be presenting an updated talk on MDB at LinuxCon Europe in Barcelona, November 7. http://events.linuxfoundation.org/events/linuxcon-europe/schedule -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 3

How indexes used with search
by Roman Rybalko 13 Oct '12

13 Oct '12

I'd like to understand how indexes are used with search. I've found some info http://www.openldap.org/doc/admin24/tuning.html#Understanding how a search works <http://www.openldap.org/doc/admin24/tuning.html#Understanding%20how%20a%20s…> but that's not very precise. Suppose there is a search like (&(attr1=value1)(attr2=value2)), attr1 and attr2 are indexed. As far as I understand, this search fetches objectIDs from the index on attr1, than the objectIDs from the index on attr2, than, according to operation "and" ("&"), objectIDs that present in BOTH sets are determined (using some set-intersection algorithm). When the search is "or" (|(...)(...)), the objectIDs from both sets are joined and duplicates are removed (using some set-union algorithm). If there is no index on attribute, the resulting objectID set is determined by bare iterate-and-compare on all the objects, or so. Am I right? Could anyone advice some docs on this? -- WBR, Roman Rybalko

3 8

Addressbook: setups and/or best practice?
by Patrick Lists 12 Oct '12

12 Oct '12

Hi all, I want to setup an Addressbook for use with Thunderbird (on Linux), Zimbra or Zarafa, Asterisk & VoIP phones. Going through Google and the list archives I did not find a lot of answers other than that it's a bit of a mess and that there is not one setup to rule them all. Does anyone have any pointers where I can read how to avoid pitfalls and setup a decent addressbook? Thanks, Patrick

1 0

Re: OpenLDAP 2.4.33 available
by Clément OUDOT 12 Oct '12

12 Oct '12

2012/10/11 OpenLDAP Project <project(a)openldap.org>: > OpenLDAP 2.4.33 is now available for download as detailed on our download page: > > http://www.openldap.org/software/download/ > For people interested in RPM, you can find some here: http://ltb-project.org/wiki/download#openldap Regards, Clément OUDOT.

1 0

reconfig question
by Mark Molenda 11 Oct '12

11 Oct '12

It's been a little while since I've worked with OpenLdap so I need to frame this as a newbie question. It appears that the slapd.conf file and a lot of configuration step by steps are now different than what was in the O'reilly book I was using. Additionally the build procedures are different as well. ( at least from what I remember ) so after a few attempts at building from source, I scrapped that and decided to try the pre-built option using Mint's Software Manager to install. Well that brought up the slapd program, and I was able to configure a test version at home using steps in this URL. http://ubuntuforums.org/showthread.php?p=8161118. I used this as the Quick Start guide on openldap.org is also out of date and refereed to the "old" way to configure everything. Well here is the rub... The steps in the url above worked great for home with some edits for dc=home,dc=local. However at work , where I really need this to work , I noticed that I missed one edit on the ldifs after I had run the ldapadd. No sweat I thought I'd just unload OpenLdap with Software Manager and reload and start from scratch. This does not work as some configuration is left around even after uninstalling OpenLdap. Can someone tell me where these files exist on Mint / Ubuntu or if this is too platform specific , what directory structures need to be removed prior to reloading to make sure everything is "new". I am assuming someone can tell me just remove "cn=config.ldif" directory etc. in /etc/ldap or something like that to get me up and running. All help is most appreciated. -Mark -- *Mark Molenda* Software Developer / IT Support | Fetch Logistics, Inc. 25 Northpointe Parkway | Suite 200 | Amherst, NY 14228 800-964-4940 x417 | mmolenda(a)fetchlogistics.com <mailto:mmolenda@fetchlogistics.com> Fax: 716-689-9676 | Direct: 716-504-4417 http://www.fetchlogistics.com

2 1

RE24 testing call #1 (OpenLDAP 2.4.33)
by Quanah Gibson-Mount 11 Oct '12

11 Oct '12

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.33 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical October 2012