openldap-technical February 2012

openldap-technical@openldap.org

98 participants
113 discussions

problem recovering ldap database
by deconya 11 Feb '12

11 Feb '12

Hi Im having a big problem with a database user for ldap and samba users. Without reason the database crashes with the error: Feb 11 09:46:23 earth slapd[5395]: bdb(dc=esci,dc=es): file id2entry.bdb has LSN 26/7816674, past end of log at 26/1025642 Feb 11 09:46:23 earth slapd[5395]: bdb(dc=esci,dc=es): Commonly caused by moving a database from one database environment Feb 11 09:46:23 earth slapd[5395]: bdb(dc=esci,dc=es): to another without clearing the database LSNs, or by removing all of Feb 11 09:46:23 earth slapd[5395]: bdb(dc=esci,dc=es): the log files from a database environment Feb 11 09:46:23 earth slapd[5395]: bdb(dc=esci,dc=es): /var/lib/ldap/id2entry.bdb: unexpected file type or format Feb 11 09:46:23 earth slapd[5395]: hdb_db_open: database "dc=esci,dc=es": db_open(/var/lib/ldap/id2entry.bdb) failed: Invalid argument (22). Feb 11 09:46:23 earth slapd[5395]: backend_startup_one: bi_db_open failed! (22) Feb 11 09:46:23 earth slapd[5395]: bdb_db_close: database "dc=esci,dc=es": alock_close failed Feb 11 09:46:23 earth slapd[5395]: slapd stopped. And only I have backups from files, but this not works NEVER!!!!!! How it's possible? How I can restore the database? I was looking for internet and only sais to recover from ldif file, How can be possible If I replace the files continues appearing the same error? Any help will be appreciated Best Regards

1 0

Linux Authentication
by Andy Carlson 10 Feb '12

10 Feb '12

I am getting the following error when I attempt to add the account objectclass to an existing LDAP account: invalid structural object class chain (inetOrgPerson/account) I read an explanation of which the cliffnote version was "an person is a person, not an account, so the two objectclasses can't be on the same entry". While that logic makes sense, I have many accounts on a Sun Directory instance that have both objectclasses. I am trying to migrate entries from Sun to an existing OpenLDAP instance, but because of this error I am unable to implement this objectclass. Ultimately, the functionality I am trying to implement is Linux Authentication. I have successfully added posixAccount and shadowAccount objectclasses, but am unable to add account. Any thoughts? Thanks much!!!, Andy Carlson Moody Bible Institute Identity Administrator | Information Systems 312-329-4385 www.moody.edu<http://www.moody.edu>

3 2

Migration of old LDAP / old schema to new release of openLDAP and new GOSA schema!
by rey sebastien 10 Feb '12

10 Feb '12

Hi, here the step i begin to make a clean migration between ldap(s) with different version of gosa schema : a ) I export all my users from old ldap + old gosa 2.6.2 into a backup ldif file backup.ldif, b) I create a new openLdap (last release version) on a server wich run with all the new schema for gosa 2.7.1 c) I start with a new bdb which get the data from my backup.ldif : database config rootdn "cn=admin,cn=config" rootpw {SSHA}... database bdb suffix "dc=parisgeo,dc=cnrs,dc=fr" rootdn "cn=admin,dc=parisgeo,dc=cnrs,dc=fr" rootpw {SSHA}.... c ) I import the backup.ldif into the new ldap, no problem at this step ! d ) i install the new version of Gosa on apache2, and i configure gosa.conf to connect to this dn ="cn=admin,cn=config" with the good admin password. At this step i'm not sure, but i think gosa want a specific administrator dn, not THE config dn, can you certify me this point ? If it's the case, the new LDAP doesn't have the correct ACL and i think i need to import old ACL for specific administrors of Gosa. But i'm not sure, it is possible to use the cn=config access to use with gosa ? Thansk for enlightements, SR

1 0

Simple bind error in CAS-Openldap authentication.
by Darouichi, Aziz 10 Feb '12

10 Feb '12

Hi, I am trying to use CAS-Openldap authentication for a local application. At this point I am not sure if this error is a CAS problem or Openldap: This is the error in catalina.out: WHAT: simple bind failed: ldap1.curry.edu:389; nested exception is javax.naming.CommunicationException: simple bind failed: ldap1.curry.edu:389 [Root exception is javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake] ACTION: TICKET_GRANTING_TICKET_NOT_CREATED APPLICATION: CAS WHEN: Fri Feb 10 11:15:48 EST 2012 CLIENT IP ADDRESS: 192.168.1.91 SERVER IP ADDRESS: 192.168.60.44 Thanks, Aziz

1 0

Syncreplication configuration - olcSyncProvConfig no such objectClass
by Valentin Bud 10 Feb '12

10 Feb '12

Hello Community, I am trying to setup LDAP replication using the syncrepl overlay. I am using Debian Squeeze up to date as of today. # dpkg -l | grep slapd ii slapd 2.4.23-7.2 OpenLDAP server (slapd) As far as I understand on the master/provider I just have to tell him that it is a syncrepl provider. I have tried to achieve just that using: # ldapadd -a -x -W -D cn=admin,cn=config -H ldapi:/// << 'SYNCREPL' dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpCheckpoint: 100 10 olcSpSessionlog: 100 SYNCREPL The following error occurs: ldap_add: Invalid syntax (21) additional info: objectClass: value #0 invalid per syntax I have searched in the schemas for olcSyncProvConfig objectClass but it is no where to be found. What do you suggest to do next? Have a great day, -- w: http://databus.ro/blog in: http://www.linkedin.com/pub/valentin-bud/9/881/830 t: https://twitter.com/valentinbud

2 1

Re: Question on LDAP Schema(s) for Intranet Mail Routing
by Nick Milas 09 Feb '12

09 Feb '12

On 9/2/2012 7:08 μμ, Charles T. Brooks wrote: > I wish I could help more than I have, Nick, but as far as I know there > is no useable RFC standard for mail routing that covers real world > needs. Working pragmatic implementations are based on someone's > interpretation of an expired internet draft, at best. > > I would love for someone to prove me wrong, though! Thanks Charles, First, the reason I started this new thread is that the whole discussion we had was under an irrelevant subject. Second, your advice re. the Lachman / Laser / Sendmail schema was very insightful. After reading the associated draft, I found that I could improve my setup by implementing it (at least to some extent), following your suggestions and experience. Note: In the meantime, I found this: http://www.qmail-ldap.org/wiki/index.php/Qmail.schema. I agree that real world needs vary enormously, yet it is very helpful to avoid re-inventing the wheel. Adding a safe schema with some objectClasses and attributes which seem to cover a range of needs re. ldap-based MTAs, aids both design and implementation. The qmail-ldap schema adds some really helpful and needed attributes, like mailForwardingAddress (also mentioned in Lachman draft) and accountStatus (and even mailQuotaSize; I am using an irrelevant attribute to store this info at the moment). Since I am already using misc.schema file and the basic attributes are available (inetLocalMailRecipient objectClass with mailLocalAddress, mailHost, mailRoutingAddress attributes), I am tempted to manually add selectively attributes from the qmail schema. In order to avoid messing things, I am hoping this thread might attract some more experienced users here, like you, to provide some ideas on how to proceed. (My applications to use these attributes are mainly Postfix/Dovecot.) All advice will be welcome. Thanks, Nick

1 0

Question on LDAP Schema(s) for Intranet Mail Routing
by Nick Milas 09 Feb '12

09 Feb '12

Hello, In file misc.schema, included in the standard OpenLDAP distribution, we read about the Lachman/Laser mail routing schema (which defines inetLocalMailRecipient objectClass with mailLocalAddress, mailHost, mailRoutingAddress attributes, drafted e.g. here: http://www.sendmail.org/m4/laser.txt): # Not recommended for production use! # Use with extreme caution! #----------------------------------------------------------- # draft-lachman-laser-ldap-mail-routing-02.txt !!!EXPIRED!!! # (a work in progress) and: # ...Contents of this file are # subject to change (including deletion) without notice. Question 1: Should this schema be considered now, after all these years, as being stable and a solid basis for implementation? If so, perhaps in next releases these comments could/should be removed? Question 2: As far as I can tell, qmail-ldap schema is also used around for the same purpose. It seems this can be found in different versions, as the initial one had problems (ref.: http://www.openldap.org/lists/openldap-software/200304/msg00378.html). This schema is a considerably extended version of the Lachman/laser one. So: 2.a: Is there some kind of draft elaborating on this schema? 2.b: Is there some official and working (with no issues) version of the schema? 2.c: If 2.b is No, where can we find even an unofficial, yet corrected/working version of the schema? I've only found a reference here: http://www.openldap.org/lists/openldap-software/200304/msg00418.html but no the schema itself. Also, I don't know if we can trust the one here: http://www.zytrax.com/books/ldap/ape/qmail.html (which interestingly mentions that "This schema is released with a standard OpenLDAP distribution" but I haven't seen it in the schema directory of OpenLDAP distros). Thanks, Nick

1 0

circularly MMR Replication ?
by Meike Stone 09 Feb '12

09 Feb '12

Hello, I have 5 different locations and want use MMR. I could configure the replication in a chain, but if on *in* the chain fails, the complete replication fails. So is it a good idea to configure/organize the replication circularly? If one of the "replication member" fails, the replication between the others should still work. Thanks for help Meike

1 0

Compound query question - organization with cn vs. o?
by Matthew M. DeLoera 08 Feb '12

08 Feb '12

Hello, Apologies if this isn't the appropriate list. Searched archives but didn't manage to find anything that seemed related… This query does not return any results: (|(&(objectClass=groupOfNames)(cn=Domain Users))(&(objectClass=inetorgperson)(cn=Domain Users))(&(objectClass=organization)(o=Domain Users))) But, this query does: (|(&(objectClass=groupOfNames)(cn=Domain Users))(&(objectClass=inetorgperson)(cn=Domain Users))(&(objectClass=organization)(cn=Domain Users))) Since RFC 2256 defines organization as STRUCTURAL, with o as MUST, and does not associate cn at all, I'm stumped. FYI, there exists a groupOfNames object with cn=Domain Users. I guess, why would my organization (3rd) clause matter at all? Since the groupOfNames object satisfies the groupOfNames (1st) clause, I was expecting it to be returned regardless of whether the subsequent 2 clauses match anything. And out of curiosity, this query fails: (|(&(objectClass=groupOfNames)(cn=Domain Users))(&(objectClass=inetorgperson)(o=Domain Users))(&(objectClass=organization)(cn=Domain Users))) My guess is that if a subsequent clause specifies an attribute that's not defined for an objectClass, the query fails even if the first clause is known to be good? If that's how things work, I can deal with that. But I just can't find any documentation that clarifies this (or I'm totally missing something super obvious!). Can anyone explain this to me, or point me to some docs that I should go read? Is there a missing piece of info that I should mention? Any suggestions would be really, really appreciated! Regards, - Matthew

2 1

Chinese characters in mail search causes failed assertion in slapd
by Alfie John 08 Feb '12

08 Feb '12

Hi guys, When searching for Chinese names in the "to:" field under Thunderbird, I get an assertion failing in slapd. I see that this is because the "mail" attribute in the default schema is of type "IA5 String" but the Chinese name that I'm searching for falls outside the character set. The work around I have is to modify the "mail" attributetype in the core.schema from: attributetype ( 0.9.2342.19200300.100.1.3 NAME ( 'mail' 'rfc822Mailbox' ) DESC 'RFC1274: RFC822 Mailbox' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) to: attributetype ( 0.9.2342.19200300.100.1.3 NAME ( 'mail' 'rfc822Mailbox' ) DESC 'RFC1274: RFC822 Mailbox' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) Can anyone see a problem with the above, or is there a better way of accomplishing this? Thanks Alfie -- Alfie John alfiej(a)opera.com

4 10

← Newer
1
...
6
7
8
9
10
11
12
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical February 2012