openldap-technical December 2012

openldap-technical@openldap.org

66 participants
73 discussions

rwm searchAttrDN rewrite skipping some rewrites
by Scott Koranda 07 Dec '12

07 Dec '12

Hi, I am using OpenLDAP 2.4.33 and the rwm overlay. I am attempting to remove ("hide") certain DN entries from returned queries. The rwm configuration looks like overlay rwm rwm-rewriteEngine on rwm-rewriteContext searchAttrDN rwm-rewriteRule "^employeeNumber=.*$" "$0" ":@" rwm-rewriteRule "cn=.*" "" "#" Without the rwm overlay the query with filter '(&(objectClass=groupOfNames)(cn=LVCGroupMembers))' member returns dn: cn=LVCGroupMembers,ou=LVC,ou=Communities,ou=grouper,o=internal,dc=wiki,dc=myorg,dc=org member: employeeNumber=1377,ou=people,o=internal,dc=wiki,dc=myorg,dc=org member: cn=UWashingtonGroupMembers,ou=UWashington,ou=MOU,ou=LSC,ou=LVC,ou=Communities,ou=grouper,o=internal,dc=wiki,dc=myorg,dc=org member: employeeNumber=19,ou=people,o=internal,dc=wiki,dc=myorg,dc=org member: employeeNumber=1331,ou=people,o=internal,dc=wiki,dc=myorg,dc=org member: employeeNumber=935,ou=people,o=internal,dc=wiki,dc=myorg,dc=org member: employeeNumber=459,ou=people,o=internal,dc=wiki,dc=myorg,dc=org member: employeeNumber=876,ou=people,o=internal,dc=wiki,dc=myorg,dc=org <snip> I want to "hide" the members with DNs of the form "cn=*" (I want to squash the nested groups). With the rwm configuration above the hiding almost works--93 of member DNs are "hidden", but 3 are not: $ ldapsearch -D "<some bind dn>" -w password -x -LLL -b 'dc=wiki,dc=myorg,dc=org' -H ldaps://server.somewhere '(&(objectClass=groupOfNames)(cn=LVCGroupMembers))' member | grep cn dn: cn=LVCGroupMembers,ou=LVC,ou=Communities,ou=grouper,o=internal,dc=wiki,dc= member: cn=AGWGGroupMembers,ou=AGWG,ou=MOU,ou=LSC,ou=LVC,ou=Communities,ou=gro member: cn=GWUGroupMembers,ou=GWU,ou=MOU,ou=LSC,ou=LVC,ou=Communities,ou=group member: cn=ULBGroupMembers,ou=ULB,ou=MOU,ou=LSC,ou=LVC,ou=Communities,ou=group I checked and the 3 DNs that survive are not different in any substantial way then the 97 DNs that are effectively hidden. Any ideas why the 3 DNs survive the rewriting? Thanks, Scott

2 2

slapd-meta configuration details
by Scott Koranda 07 Dec '12

07 Dec '12

Hello, As part of an evaluation and testing phase, on a Debian Squeeze system using version 2.4.23 of OpenLDAP I successfully configured and used the slapd-meta backend. The configuration looked like this: database meta suffix "dc=test,dc=myorg,dc=org" uri "ldapi:///o=external,dc=test,dc=myorg,dc=org" acl-authcDN uid=foswiki,ou=system,o=external,dc=test,dc=myorg,dc=org acl-passwd passwd idassert-bind bindmethod=simple binddn="uid=foswiki,ou=system,o=external,dc=test,dc=myorg,dc=org" credentials="passwd" mode=self uri "ldapi:///o=internal,dc=test,dc=myorg,dc=org" acl-authcDN uid=foswiki,ou=system,o=external,dc=test,dc=myorg,dc=org acl-passwd passwd idassert-bind bindmethod=simple binddn="uid=foswiki,ou=system,o=external,dc=test,dc=myorg,dc=org" credentials="passwd" mode=self To prepare for a production deployment I then compiled OpenLDAP 2.4.33 using this set of configure options: ./configure --prefix=/opt/openldap-2.4.33 --enable-slapd --enable-cleartext --enable-rewrite --enable-bdb --enable-hdb --enable-ldap --enable-meta --enable-rwm I attempted to use the same configuration for the slapd-meta backend. My queries to slapd no longer returned anything and I saw this in the debug ouput: 50c15573 conn=1000 op=1 meta_search_dobind_init[0] mc=0x22c2da0: non-empty dn with empty cred; binding anonymously 50c15573 conn=1000 op=1 meta_search_dobind_init[1] mc=0x22c2da0: non-empty dn with empty cred; binding anonymously I interpret this to mean that the slapd-meta backend is deciding it does not have a credential to use and is binding anonymously to the proxied services. How should I change my configuration above so that the most recent version of OpenLDAP will be able to bind to the proxied services in the way that happened with version 2.4.23? Note that I installed versions between 2.4.23 and 2.4.33 (bisection) and found that the change from 2.4.25 to 2.4.26 causes the configuration above to go from "working" to "not working". Versions 2.4.26 and above that I tested result in the "non-empty dn with empty cred" in the debug output. Thanks, Scott

3 5

DB_LOCK_DEADLOCK
by Pawan Kamboj 06 Dec '12

06 Dec '12

Hi, We are getting "bdb_idl_fetch_key: get failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30995)" error in Openldap debug log. We are using Openldap.2.3.31 and db.4.5 version and have configured master-slave. Any help on this? Is it something need to worry or we can ignore this. This error coming frequently when we do lots of write opration on ldap. Regards Pawan

3 5

how to speed up filtering of dn's
by Hanspeter Kunz 06 Dec '12

06 Dec '12

Hi all, I want to find all entries in my ldap directory that contain certain ou's, e.g. ldapsearch -x "(ou:dn:=Administration)" which returns (in my case) all entries that correspond to administrative staff. The query works but it is slow and puts a high load on the ldap server. I wonder if I can create an index which would speed things up, but I could not figure out what I should index. Note that I cannot do this using a specific basedn, because we have administrative staff in several subtrees of our ldap hierarchy. Best

2 4

dnMatch flooding logs and access blocked
by Al Dispennette 05 Dec '12

05 Dec '12

Hello, I am seeing the following get repeated in my slapd logs for hundreds of line. I know it is due to the logging level. However, when this starts happening no one can access the server because what ever is logging this is blocking. Can anyone tell me what is causing this log entry? slapd[20616]: dnMatch -1#012#011"uid=item1,ou=users,dc=example,dc=com"#012#011"uid=user,ou=users,dc=example,dc=com" slapd[20616]: dnMatch 2#012#011"uid=item2,ou=users,dc=example,dc=com"#012#011"uid=user,ou=users,dc=example,dc=com" slapd[20616]: dnMatch 2#012#011"uid=item3,ou=users,dc=example,dc=com"#012#011"uid=user,ou=users,dc=example,dc=com" slapd[20616]: dnMatch -2#012#011"uid=item4,ou=users,dc=example,dc=com"#012#011"uid=user,ou=users,dc=example,dc=com" slapd[20616]: dnMatch -1#012#011"uid=item5,ou=users,dc=example,dc=com"#012#011"uid=user,ou=users,dc=example,dc=com" slapd[20616]: dnMatch -2#012#011"uid=item6,ou=users,dc=example,dc=com"#012#011"uid=user,ou=users,dc=example,dc=com" Al Dispennette Sr. Software Engineer t: 415 526 7206 m: 309 868 1401 al.dispennette(a)monitise.com<mailto:al.dispennette@monitise.com> [Description: Description: Description: http://mailmedia.monitisegroup.com/MonitiseUpdate/Images/Email_logo.gif] www.monitisegroup.com<http://www.monitisegroup.com/> [Description: Description: Description: http://mailmedia.monitisegroup.com/MonitiseUpdate/Images/linked_in_sig.gif]<http://www.linkedin.com/company/monitise>[Description: Description: Description: http://mailmedia.monitisegroup.com/MonitiseUpdate/Images/twitter_sig.gif]<http://twitter.com/#!/MonitiseGroup>

3 4

meta_back_db_open: no targets defined
by Matthew Bik 05 Dec '12

05 Dec '12

Hello, I hope this is the right forum for technical questions. If not I apologise in advance. I have been surfing for an answer for a while and was hoping that I am just missing something simple and someone can point me in the right direction. The scenario : I have several active directory domains where individual user accounts are managed. I am trying to setup slapd to use the meta backend so that my ldap server can act as a single sign on source for internal tools such as web pages, jabber, and the like. During the start of slapd it looks like I'm either missing something in my config or I have a typo that I haven't been able to find. To me, it looks like slapd won't start because I'm not giving it anything to do (no targets). I've also been using slaptest to convert a slapd.conf file since documentation on the cn=config files is a little hard to find. The Setup: - CentOS release 6.3 - openldap-2.4.23-26.el6_3.2.x86_64 - openldap-servers-2.4.23-26.el6_3.2.x86_64 The Error Log: Dec 5 08:20:56 example-host slapd[3487]: slapd startup: initiated. Dec 5 08:20:56 example-host slapd[3487]: backend_startup_one: starting "cn=config" Dec 5 08:20:56 example-host slapd[3487]: config_back_db_open Dec 5 08:20:56 example-host slapd[3487]: backend_startup_one: starting "dc=example,dc=com" Dec 5 08:20:56 example-host slapd[3487]: meta_back_db_open: no targets defined Dec 5 08:20:56 example-host slapd[3487]: backend_startup_one (type=meta, suffix="dc=example,dc=com"): bi_db_open failed! (1) Dec 5 08:20:56 example-host slapd[3487]: slapd shutdown: initiated Dec 5 08:20:56 example-host slapd[3487]: slapd destroy: freeing system resources. Dec 5 08:20:56 example-host slapd[3487]: slapd stopped. My slapd.conf: include /etc/openldap/schema/core.schema loglevel -1 modulepath /var/lib/openldap moduleload back_meta.la moduleload back_ldap.la lastmod off database config rootdn "cn=root,cn=config" rootpw "secret" database meta suffix "dc=example,dc=com" uri "ldap://dom01.example.com/dc=us,dc=example,dc=com" default-target uri "ldap://dom02.example.com/dc=eu,dc=example,dc=com"

1 0

Re: Password policy
by Mauricio Tavares 04 Dec '12

04 Dec '12

On Mon, Nov 19, 2012 at 10:46 AM, jeevan kc <jeev_biz(a)hotmail.com> wrote: > Thanks . But we have like more than 25k users on the server. Doing that individually would be tedious. Is there any other way ? > How about a script of some sorts? Something on the lines of: ask ldap for the userlist (using ldapsearch) for each user Add objectClass: pwdPolicy (using ldapmodify) done > Sent from my iPhone > > On Nov 19, 2012, at 10:42 AM, "Mauricio Tavares" <raubvogel(a)gmail.com> wrote: > >> On Mon, Nov 19, 2012 at 10:14 AM, jeevan kc <jeev_biz(a)hotmail.com> wrote: >>> Hello >>> >>> I want to enable password policy on Openldap 2.4.30(to all users. I see that >>> the ppolicy.ldif and ppolicy.schema are listed under >>> /usr/local/etc/openldap/schema but are not present on >>> /usr/local/etc/openldap/slapd.d/cn=config folder. So do I need to add the >>> policy.ldif to the cn=config folder ? Is there like specific procedure to do >>> that or can I add manually with ldapadd ? Also how do I enable that schema >>> to all users ? Please help. >>> >>> >>> Jeevan >> >> If you have the policy as a diff, you could add it by saying >> >> ldapadd -Y EXTERNAL -H ldapi:/// -f /path/to/ppolicy.ldif >> >> Then you need to ldapmodify each user, adding something like >> >> objectClass: pwdPolicy >> >> to each of them. >> >> This is off the top of my head, so do verify before doing exciting >> thingies to your server. ;)

4 4

Fwd: Difference between 2.4.30 and 2.3.43 in certificateMatch.
by Erwann Abalea 03 Dec '12

03 Dec '12

---------- Forwarded message ---------- From: Erwann Abalea <eabalea(a)gmail.com> Date: 2012/12/3 Subject: Re: Difference between 2.4.30 and 2.3.43 in certificateMatch. To: Mike Hulsman <mike(a)hulsman.net> 2012/12/3 Mike Hulsman <mike(a)hulsman.net> > > Quoting Erwann Abalea <eabalea(a)gmail.com>: > > 2012/12/3 Mike Hulsman <mike(a)hulsman.net> >> >> >>> Quoting Howard Chu <hyc(a)symas.com>: >>> >>> >>>> [...] >>>> >>> >> No. Read RFC4523. >>> >>>> >>>> >>> After a lot of reading and testing I still cannot get it working. >>> >>> I read RFC4523 and am now doing an ldap search of (usercertificate:** >>> certificateExactMatch:=****certificate_serial_number$** >>> >>> certificate_Issuer_DN) >>> Than I get an (?=undefined) in my logfile, so the query is not correct. >>> In my schema is 2.5.4.36 and 2.5.4.37 defined. >>> >>> When I search on >>> (usercertificate=certificate_****serial_number$certificate_**** >>> Issuer_DN) >>> >>> I see the query in the log so I asume it is ok, but in the debugging i >>> see >>> "illegal value for attributeType usercertificate" >>> >>> >> Here's what I use: >> >> 'userCertificate={ serialNumber <yourserial>, issuer "<yourIssuerDN>" }' >> >> For example: >> 'userCertificate={ serialNumber 5090, issuer "cn=passport country signing >> authority, ou=ptb, ou=dfat, o=gov, c=au" }' >> > Thanks alot for pointing me in the right direction, > > The search is working now. > Now I also noticed that I put in the serialnumber in Hex instead of > decimal. > That is what I was doing wrong :-( > You can express the serial number in hex. My example becomes '... serialNumber 0x13E2, issuer ...' OpenLDAP follows the X.520 name comparison rules for the issuer name; you can switch case, change spaces into multiple spaces, add heading/trailing spaces, etc. I hadn't looked at the code yet to understand why asking for serialNumber 0x013E2 or 05090 doesn't match my certificates. -- Erwann.

1 0

RE: deleting all entries
by jeevan kc 03 Dec '12

03 Dec '12

Thanks for the quick reply. One more question, we have a master and couple slaves on the replication topology. Do I need to remove the files of all 3 servers individually? From: turbo(a)bayour.com Subject: Re: deleting all entries Date: Mon, 3 Dec 2012 17:05:45 +0100 To: jeev_biz(a)hotmail.com On Dec 3, 2012, at 4:33 PM, jeevan kc wrote:My openldap on the server is built from the source and the DB files are located on /usr/local/var/openldap-data. Simply shut the server down and delete all files (possibly except the DB_CONFIGfile) in that directory. It's that simple. --Build a man a fire, and he will be warm for the night.Set a man on fire and he will be warm for the rest of his life.

1 0

Difference between 2.4.30 and 2.3.43 in certificateMatch.
by Mike Hulsman 03 Dec '12

03 Dec '12

Hi, I stumbled upon an difference between openldap 2.4.30 and 2.3.43. This is my configuration. X509 certificates are stored in the directory and a search is done with: (&(mail=aaa@a.b)(userCertificate:certificateMatch:=<binary certificate)) if that is a match the uid must be returned. That is working on 2.3.43 but when I try that on 2.4.30 it does not work and I start debugging I see filter="(&(mail=aaa(a)a.b)(?=undefined))" in the logfiles. The request is the same on both openldap servers, I copied the schema's and the acl's are the same. A slapcat on 2.3.43 is done and imported on 2.4.30 An ldapsearch on both servers for that user is returning the same data. Do I need some more configuration for the 2.4.30 version or am I doing something wrong. The 2.3.43 version is working properly, but I want to update to 2.4.xx for better replication. Kind regards. Mike Hulsman ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

3 6

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical December 2012