January 2013 - openldap-technical

Virtual list view problem
by Venish Khant 31 May '16

31 May '16

Hi all I am using cpan Net::LDAP module to access LDAP entries. I want to search LDAP entries using Net::LDAP search method. When I do search, I want some limited number of entries from search result, for this(searching) process I am using Net::LDAP::Control::VLV module. But I get error on VLV response control. Please, any one have idea about this error. * Error:* Died at vlv.pl line 50, This is my example. I changed the font style of line 50 #!/usr/bin/perl -w use Net::LDAP; use Net::LDAP::Control::VLV; use Net::LDAP::Constant qw( LDAP_CONTROL_VLVRESPONSE ); use Net::LDAP::Control::Sort; sub procentry { my ( $mesg, $entry) = @_; # Return if there is no entry to process if ( !defined($entry) ) { return; } print "dn: " . $entry->dn() . "\n"; @attrs = $entry->attributes(); foreach $attr (@attrs) { #printf("\t%s: %s\n", $attr, $entry->get_value($attr)); $attrvalue = $entry->get_value($attr,asref=>1); #print $attr.":". $entry->get_value($attr)."\n"; foreach $value(@$attrvalue) { print "$attr: $value\n"; } } $mesg->pop_entry; print "\n"; } $ldap = Net::LDAP->new( "localhost" ); # Get the first 20 entries $vlv = Net::LDAP::Control::VLV->new( before => 0, # No entries from before target entry after => 19, # 19 entries after target entry content => 0, # List size unknown offset => 1, # Target entry is the first ); my $sort = Net::LDAP::Control::Sort->new( order => 'cn' ); @args = ( base => "dc=example,dc=co,dc=in", scope => "subtree", filter => "(objectClass=inetOrgPerson)", callback => \&procentry, # Call this sub for each entry control => [ $sort, $vlv ], ); $mesg = $ldap->search( @args ); # Get VLV response control *($resp) = $mesg->control( LDAP_CONTROL_VLVRESPONSE ) or die;* $vlv->response( $resp ); # Set the control to get the last 20 entries $vlv->end; $mesg = $ldap->search( @args ); # Get VLV response control ($resp) = $mesg->control( LDAP_CONTROL_VLVRESPONSE ) or die; $vlv->response( $resp ); # Now get the previous page $vlv->scroll_page( -1 ); $mesg = $ldap->search( @args ); # Get VLV response control ($resp) = $mes # Now page with first entry starting with "B" in the middle $vlv->before(9); # Change page to show 9 before $vlv->after(10); # Change page to show 10 after $vlv->assert("B"); # assert "B" $mesg = $ldap->search( @args );g->control( LDAP_CONTROL_VLVRESPONSE ) or die; $vlv->response( $resp ); -- Venish Khant www.deeproot.co.in

4 11

OpenLDAP and dynalogin (two-factor auth with HOTP)
by Daniel Pocock 29 Jun '15

29 Jun '15

Some time ago I created the dynalogin ( http://www.dynalogin.org ) solution for two-factor authentication. I'm just contemplating how to make it easier to integrate, and making it convenient to use with OpenLDAP seems like a good strategy: can anyone comment on that? The initial thoughts that I have about the subject: - SASL based solution (dynalogin has digest capability already, so it could be adapted for SASL PLAIN or DIGEST-MD5) - should not prevent password logins (user should be able to use either password or HOTP code) - should enable people to use it indirectly (e.g. if someone already has pam_ldap working, they should be able to add dynalogin to their OpenLDAP server and get immediate benefit) - use cases: UNIX login, high-security webmail login, VPN and OpenID provider backed by OpenLDAP I know that SASL already supports OTP, but that is not HOTP, it is OPIE (or S/Key) RFC 2289: http://tools.ietf.org/html/rfc2289 whereas HOTP is RFC 4226: http://www.ietf.org/rfc/rfc4226.txt HOTP is considered more secure and more widely implemented.

5 6

trouble with slapo-pcache
by btb＠bitrate.net 24 Mar '13

24 Mar '13

hi- i'm having a few different issues with slapo-pcache. i did a bit of searching in the its and did not find any items which seemed to match my symptoms. i'm using 2.4.31, on ubuntu 12.10. the first is that i so to not be able to add, via ldapadd, additional olcPcacheTemplate attributes to the config entry. i was able to add the first one using ldapadd, but subsequent modify operations to add another complain "no equality matching rule": >ldapsearch -LLLZZxWH 'ldap://localhost/' -D 'cn=config' -b 'olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config' -s base Enter LDAP Password: dn: olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config objectClass: olcPcacheConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {0}pcache olcPcache: mdb 1000 100 1000 60 olcPcacheAttrset: 0 "*" "+" olcPcacheTemplate: "(uid=)" 0 3600 >cat template.ldif dn: olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config changetype: modify add: olcPcacheTemplate olcPcacheTemplate: "(cn=)" 0 3600 >ldapadd -ZZxWH 'ldap://localhost/' -D 'cn=config' -f template.ldif Enter LDAP Password: modifying entry "olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config" ldap_modify: Inappropriate matching (18) additional info: modify/add: olcPcacheTemplate: no equality matching rule Oct 29 20:01:30 dsa1 slapd[8250]: conn=1003 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Oct 29 20:01:30 dsa1 slapd[8250]: conn=1003 op=0 STARTTLS Oct 29 20:01:30 dsa1 slapd[8250]: conn=1003 op=0 RESULT oid= err=0 text= Oct 29 20:01:30 dsa1 slapd[8250]: conn=1003 fd=12 ACCEPT from IP=127.0.0.1:32916 (IP=0.0.0.0:389) Oct 29 20:01:30 dsa1 slapd[8250]: conn=1003 fd=12 TLS established tls_ssf=128 ssf=128 Oct 29 20:01:32 dsa1 slapd[8250]: conn=1003 op=1 BIND dn="cn=config" method=128 Oct 29 20:01:32 dsa1 slapd[8250]: conn=1003 op=1 BIND dn="cn=config" mech=SIMPLE ssf=0 Oct 29 20:01:32 dsa1 slapd[8250]: conn=1003 op=1 RESULT tag=97 err=0 text= Oct 29 20:01:32 dsa1 slapd[8250]: connection_input: conn=1003 deferring operation: binding Oct 29 20:01:32 dsa1 slapd[8250]: conn=1003 op=2 MOD dn="olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config" Oct 29 20:01:32 dsa1 slapd[8250]: conn=1003 op=2 MOD attr=olcPcacheTemplate Oct 29 20:01:32 dsa1 slapd[8250]: conn=1003 op=2 RESULT tag=103 err=18 text=modify/add: olcPcacheTemplate: no equality matching rule Oct 29 20:01:32 dsa1 slapd[8250]: conn=1003 op=3 UNBIND Oct 29 20:01:32 dsa1 slapd[8250]: conn=1003 fd=12 closed adding the attribute "manually" [e.g. slapcat, modify ldif, slapadd] seems to be fine: >ldapsearch -LLLZZxWH 'ldap://localhost/' -D 'cn=config' -b 'olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config' -s base Enter LDAP Password: dn: olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config objectClass: olcPcacheConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {0}pcache olcPcache: mdb 1000 100 1000 60 olcPcacheAttrset: 0 "*" "+" olcPcacheTemplate: "(objectclass=)" 0 3600 olcPcacheTemplate: "(uid=)" 0 3600 my second problem is with caching when slapo-nssov is involved. it appears to not cache [QUERY NOT ANSWERABLE/QUERY NOT CACHEABLE] when a query occurs via nss: >getent passwd flash flash:x:2013:2013:flash gordon:/home/flash:/bin/bash Oct 31 08:42:15 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:42:15 deepfield slapd[12862]: daemon: activity on: Oct 31 08:42:15 deepfield slapd[12862]: 11r Oct 31 08:42:15 deepfield slapd[12862]: Oct 31 08:42:15 deepfield slapd[12862]: daemon: read active on 11 Oct 31 08:42:15 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:42:15 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:42:15 deepfield slapd[12862]: connection_get(11) Oct 31 08:42:15 deepfield slapd[12862]: connection_get(11): got connid=0 Oct 31 08:42:15 deepfield slapd[12862]: nssov: connection from uid=0 gid=0 Oct 31 08:42:15 deepfield slapd[12862]: nssov_passwd_byname(flash) Oct 31 08:42:15 deepfield slapd[12862]: str2filter "(&(objectClass=posixAccount)(uid=flash))" Oct 31 08:42:15 deepfield slapd[12862]: begin get_filter Oct 31 08:42:15 deepfield slapd[12862]: AND Oct 31 08:42:15 deepfield slapd[12862]: begin get_filter_list Oct 31 08:42:15 deepfield slapd[12862]: begin get_filter Oct 31 08:42:15 deepfield slapd[12862]: EQUALITY Oct 31 08:42:15 deepfield slapd[12862]: end get_filter 0 Oct 31 08:42:15 deepfield slapd[12862]: begin get_filter Oct 31 08:42:15 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:42:15 deepfield slapd[12862]: EQUALITY Oct 31 08:42:15 deepfield slapd[12862]: daemon: activity on: Oct 31 08:42:15 deepfield slapd[12862]: end get_filter 0 Oct 31 08:42:15 deepfield slapd[12862]: Oct 31 08:42:15 deepfield slapd[12862]: end get_filter_list Oct 31 08:42:15 deepfield slapd[12862]: end get_filter 0 Oct 31 08:42:15 deepfield slapd[12862]: query template of incoming query = (&(objectClass=)(uid=)) Oct 31 08:42:15 deepfield slapd[12862]: QUERY NOT ANSWERABLE Oct 31 08:42:15 deepfield slapd[12862]: QUERY NOT CACHEABLE Oct 31 08:42:15 deepfield slapd[12862]: =>ldap_back_getconn: conn 0xb51f8ee8 fetched refcnt=1. Oct 31 08:42:15 deepfield slapd[12862]: => ldap_back_munge_filter "(&(objectClass=posixAccount)(uid=flash))" Oct 31 08:42:15 deepfield slapd[12862]: <= ldap_back_munge_filter "(&(objectClass=posixAccount)(uid=flash))" (0) Oct 31 08:42:15 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:42:15 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:42:15 deepfield slapd[12862]: >>> dnPrettyNormal: <uid=flash,ou=people,ou=accounts,dc=example,dc=net> Oct 31 08:42:15 deepfield slapd[12862]: <<< dnPrettyNormal: <uid=flash,ou=people,ou=accounts,dc=example,dc=net>, <uid=flash,ou=people,ou=accounts,dc=example,dc=net> Oct 31 08:42:15 deepfield slapd[12862]: send_ldap_result: conn=-1 op=0 p=0 Oct 31 08:42:15 deepfield slapd[12862]: send_ldap_result: err=0 matched="" text="" although i believe i have a matching query template defined in the config: dn: olcDatabase={2}ldap,cn=config objectClass: olcLDAPConfig objectClass: olcDatabaseConfig objectClass: olcConfig objectClass: top olcDatabase: {2}ldap olcSuffix: dc=example,dc=net olcLastMod: TRUE olcReadOnly: TRUE olcRootDN: uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net olcMonitoring: TRUE olcDbURI: ldap://dsa1.example.net/ olcDbStartTLS: start tls_cacert="/etc/pki/trusted_roots/example_networks_roo t_ca-cert.pem" tls_reqcert="demand" olcDbACLBind: bindmethod=simple binddn="cn=slapd,ou=deepfield,ou=services,ou=a ccounts,dc=example,dc=net" credentials="xxxxxxxxxxxxxxx" s tarttls="critical" tls_cacert="/etc/pki/trusted_roots/example_networks_root _ca-cert.pem" tls_reqcert="demand" olcDbIDAssertBind: bindmethod=simple binddn="cn=slapd,ou=deepfield,ou=services ,ou=accounts,dc=example,dc=net" credentials="xxxxxxxxxxxxxxx" structuralObjectClass: olcLDAPConfig entryUUID: f24e435a-b35a-1031-8f37-336141b7bc90 creatorsName: cn=config createTimestamp: 20121026014812Z entryCSN: 20121031023501.089672Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20121031023501Z dn: olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config objectClass: olcPcacheConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {0}pcache olcPcache: mdb 1000 100 1000 60 olcPcacheAttrset: 0 "*" "+" olcPcacheTemplate: "(objectClass=)" 0 3600 olcPcacheTemplate: "(uid=)" 0 3600 olcPcacheTemplate: "(&(objectClass=)(uid=))" 0 3600 olcPcacheBind: "(uid=)" 0 60 "sub" "dc=example,dc=net" structuralObjectClass: olcPcacheConfig entryUUID: ddb05d7e-b4fa-1031-811e-353e11fff366 creatorsName: cn=config createTimestamp: 20121028032528Z entryCSN: 20121030002115.179177Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20121030002115Z dn: olcDatabase={0}mdb,olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config objectClass: olcPcacheDatabase objectClass: olcMdbConfig objectClass: olcDatabaseConfig objectClass: olcConfig objectClass: top olcDatabase: {0}mdb olcDbDirectory: /var/lib/ldap/example.net/ olcLastMod: TRUE olcMaxDerefDepth: 15 olcDbNoSync: FALSE olcDbIndex: certfingerprint eq olcDbIndex: cn eq olcDbIndex: default eq olcDbIndex: description eq olcDbIndex: entrycsn eq olcDbIndex: entryuuid eq olcDbIndex: gidnumber pres,eq olcDbIndex: host eq olcDbIndex: iphostnumber eq olcDbIndex: ipserviceport eq olcDbIndex: ipserviceprotocol eq olcDbIndex: mail eq olcDbIndex: maillocaladdress eq olcDbIndex: member eq olcDbIndex: memberof eq olcDbIndex: memberuid eq olcDbIndex: objectclass eq olcDbIndex: rfc822mailmember eq olcDbIndex: sudoUser eq olcDbIndex: uid pres,eq,sub olcDbIndex: uidnumber pres,eq olcDbMode: 0600 olcDbSearchStack: 16 structuralObjectClass: olcMdbConfig entryUUID: 88b37716-b590-1031-8c75-439de7087923 creatorsName: cn=config createTimestamp: 20121028211650Z entryCSN: 20121029021315.039143Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20121029021315Z dn: olcOverlay={1}nssov,olcDatabase={2}ldap,cn=config objectClass: olcNssOvConfig objectClass: olcOverlayConfig objectClass: olcConfig olcOverlay: {1}nssov olcNssMap: group uniquemember member olcNssPam: authz2dn hostservice olcNssPamSession: sshd olcNssPamSession: login structuralObjectClass: olcNssOvConfig entryUUID: 47ecaef0-b73e-1031-8761-9f0bff5d3212 creatorsName: cn=config createTimestamp: 20121031003305Z entryCSN: 20121031003305.637051Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20121031003305Z and if i perform the same query using ldapsearch: >ldapsearch -LLLZZxH 'ldap://localhost/' -D 'uid=flash,ou=people,ou=accounts,dc=example,dc=net' -w 'test' '(&(objectClass=posixAccount)(uid=flash))' dn: uid=flash,ou=people,ou=accounts,dc=example,dc=net initials: fg givenName: flash loginShell: /bin/bash uidNumber: 2013 gidNumber: 2013 uid: flash objectClass: posixAccount objectClass: top objectClass: shadowAccount objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: extensibleObject c: us homeDirectory: /home/flash sn: gordon cn: flash gordon displayName: flash_gordon mail: user(a)example.com it does seem to cache it: Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: slap_listener_activate(8): Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 busy Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: >>> slap_listener(ldap:///) Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: listen=8, new connection on 18 Oct 31 08:55:37 deepfield slapd[12862]: daemon: added 18r (active) listener=(nil) Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 fd=18 ACCEPT from IP=127.0.0.1:37220 (IP=0.0.0.0:389) Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: 18r Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: read active on 18 Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18) Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18): got connid=1003 Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: connection_read(18): checking for input on id=1003 Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: op tag 0x77, time 1351688137 Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=0 do_extended Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Oct 31 08:55:37 deepfield slapd[12862]: do_extended: oid=1.3.6.1.4.1.1466.20037 Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=0 STARTTLS Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_extended: err=0 oid= len=0 Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_response: msgid=1 tag=120 err=0 Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=0 RESULT oid= err=0 text= Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: 18r Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: read active on 18 Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18) Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18): got connid=1003 Oct 31 08:55:37 deepfield slapd[12862]: connection_read(18): checking for input on id=1003 Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: 18r Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: read active on 18 Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18) Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18): got connid=1003 Oct 31 08:55:37 deepfield slapd[12862]: connection_read(18): checking for input on id=1003 Oct 31 08:55:37 deepfield slapd[12862]: connection_read(18): unable to get TLS client DN, error=49 id=1003 Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 fd=18 TLS established tls_ssf=128 ssf=128 Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: 18r Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: read active on 18 Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18) Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18): got connid=1003 Oct 31 08:55:37 deepfield slapd[12862]: connection_read(18): checking for input on id=1003 Oct 31 08:55:37 deepfield slapd[12862]: op tag 0x60, time 1351688137 Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=1 do_bind Oct 31 08:55:37 deepfield slapd[12862]: >>> dnPrettyNormal: <uid=flash,ou=people,ou=accounts,dc=example,dc=net> Oct 31 08:55:37 deepfield slapd[12862]: <<< dnPrettyNormal: <uid=flash,ou=people,ou=accounts,dc=example,dc=net>, <uid=flash,ou=people,ou=accounts,dc=example,dc=net> Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=1 BIND dn="uid=flash,ou=people,ou=accounts,dc=example,dc=net" method=128 Oct 31 08:55:37 deepfield slapd[12862]: do_bind: version=3 dn="uid=flash,ou=people,ou=accounts,dc=example,dc=net" method=128 Oct 31 08:55:37 deepfield slapd[12862]: => mdb_entry_get: ndn: "uid=flash,ou=people,ou=accounts,dc=example,dc=net" Oct 31 08:55:37 deepfield slapd[12862]: => mdb_entry_get: oc: "(null)", at: "(null)" Oct 31 08:55:37 deepfield slapd[12862]: mdb_dn2entry("uid=flash,ou=people,ou=accounts,dc=example,dc=net") Oct 31 08:55:37 deepfield slapd[12862]: => mdb_dn2id("uid=flash,ou=people,ou=accounts,dc=example,dc=net") Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: <= mdb_dn2id: got id=0x4 Oct 31 08:55:37 deepfield slapd[12862]: => mdb_entry_decode: Oct 31 08:55:37 deepfield slapd[12862]: <= mdb_entry_decode Oct 31 08:55:37 deepfield slapd[12862]: => mdb_entry_get: found entry: "uid=flash,ou=people,ou=accounts,dc=example,dc=net" Oct 31 08:55:37 deepfield slapd[12862]: mdb_entry_get: rc=0 Oct 31 08:55:37 deepfield slapd[12862]: str2filter "(uid=flash)" Oct 31 08:55:37 deepfield slapd[12862]: begin get_filter Oct 31 08:55:37 deepfield slapd[12862]: EQUALITY Oct 31 08:55:37 deepfield slapd[12862]: end get_filter 0 Oct 31 08:55:37 deepfield slapd[12862]: Lock QC index = 0xb867e250 Oct 31 08:55:37 deepfield slapd[12862]: Base of added query = dc=example,dc=net Oct 31 08:55:37 deepfield slapd[12862]: QUERY ANSWERABLE (answered 5 times) Oct 31 08:55:37 deepfield slapd[12862]: => mdb_search Oct 31 08:55:37 deepfield slapd[12862]: mdb_dn2entry("uid=flash,ou=people,ou=accounts,dc=example,dc=net") Oct 31 08:55:37 deepfield slapd[12862]: => mdb_dn2id("uid=flash,ou=people,ou=accounts,dc=example,dc=net") Oct 31 08:55:37 deepfield slapd[12862]: <= mdb_dn2id: got id=0x4 Oct 31 08:55:37 deepfield slapd[12862]: => mdb_entry_decode: Oct 31 08:55:37 deepfield slapd[12862]: <= mdb_entry_decode Oct 31 08:55:37 deepfield slapd[12862]: => access_allowed: search access to "uid=flash,ou=people,ou=accounts,dc=example,dc=net" "entry" requested Oct 31 08:55:37 deepfield slapd[12862]: <= root access granted Oct 31 08:55:37 deepfield slapd[12862]: => access_allowed: search access granted by manage(=mwrscxd) Oct 31 08:55:37 deepfield slapd[12862]: base_candidates: base: "uid=flash,ou=people,ou=accounts,dc=example,dc=net" (0x00000004) Oct 31 08:55:37 deepfield slapd[12862]: => test_filter Oct 31 08:55:37 deepfield slapd[12862]: EQUALITY Oct 31 08:55:37 deepfield slapd[12862]: => access_allowed: search access to "uid=flash,ou=people,ou=accounts,dc=example,dc=net" "uid" requested Oct 31 08:55:37 deepfield slapd[12862]: <= root access granted Oct 31 08:55:37 deepfield slapd[12862]: => access_allowed: search access granted by manage(=mwrscxd) Oct 31 08:55:37 deepfield slapd[12862]: <= test_filter 6 Oct 31 08:55:37 deepfield slapd[12862]: pc_bind_search: cache is stale, reftime: 1351688135, current time: 1351688137 Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_result: conn=1003 op=1 p=3 Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_result: err=0 matched="" text="" Oct 31 08:55:37 deepfield slapd[12862]: =>ldap_back_getconn: conn=1003 op=1: lc=0xb38f9788 inserted refcnt=1 rc=0 Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=1 BIND dn="uid=flash,ou=people,ou=accounts,dc=example,dc=net" mech=SIMPLE ssf=0 Oct 31 08:55:37 deepfield slapd[12862]: do_bind: v3 bind: "uid=flash,ou=people,ou=accounts,dc=example,dc=net" to "uid=flash,ou=people,ou=accounts,dc=example,dc=net" Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_result: conn=1003 op=1 p=3 Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_result: err=0 matched="" text="" Oct 31 08:55:37 deepfield slapd[12862]: pc_setpw: CACHING BIND for uid=flash,ou=people,ou=accounts,dc=example,dc=net Oct 31 08:55:37 deepfield slapd[12862]: mdb_modify: uid=flash,ou=people,ou=accounts,dc=example,dc=net Oct 31 08:55:37 deepfield slapd[12862]: mdb_dn2entry("uid=flash,ou=people,ou=accounts,dc=example,dc=net") Oct 31 08:55:37 deepfield slapd[12862]: => mdb_dn2id("uid=flash,ou=people,ou=accounts,dc=example,dc=net") Oct 31 08:55:37 deepfield slapd[12862]: <= mdb_dn2id: got id=0x4 Oct 31 08:55:37 deepfield slapd[12862]: => mdb_entry_decode: Oct 31 08:55:37 deepfield slapd[12862]: <= mdb_entry_decode Oct 31 08:55:37 deepfield slapd[12862]: mdb_modify_internal: 0x00000004: uid=flash,ou=people,ou=accounts,dc=example,dc=net Oct 31 08:55:37 deepfield slapd[12862]: <= acl_access_allowed: granted to database root Oct 31 08:55:37 deepfield slapd[12862]: mdb_modify_internal: replace userPassword Oct 31 08:55:37 deepfield slapd[12862]: => mdb_entry_encode(0x00000004): uid=flash,ou=people,ou=accounts,dc=example,dc=net Oct 31 08:55:37 deepfield slapd[12862]: <= mdb_entry_encode(0x00000004): uid=flash,ou=people,ou=accounts,dc=example,dc=net Oct 31 08:55:37 deepfield slapd[12862]: mdb_modify: updated id=00000004 dn="uid=flash,ou=people,ou=accounts,dc=example,dc=net" Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_result: conn=1003 op=1 p=3 Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_result: err=0 matched="" text="" Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_response: msgid=2 tag=97 err=0 Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=1 RESULT tag=97 err=0 text= Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: 18r Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: read active on 18 Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18) Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18): got connid=1003 Oct 31 08:55:37 deepfield slapd[12862]: connection_read(18): checking for input on id=1003 Oct 31 08:55:37 deepfield slapd[12862]: op tag 0x63, time 1351688137 Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=2 do_search Oct 31 08:55:37 deepfield slapd[12862]: >>> dnPrettyNormal: <dc=example,dc=net> Oct 31 08:55:37 deepfield slapd[12862]: <<< dnPrettyNormal: <dc=example,dc=net>, <dc=example,dc=net> Oct 31 08:55:37 deepfield slapd[12862]: SRCH "dc=example,dc=net" 2 0 Oct 31 08:55:37 deepfield slapd[12862]: 0 60 0 Oct 31 08:55:37 deepfield slapd[12862]: begin get_filter Oct 31 08:55:37 deepfield slapd[12862]: AND Oct 31 08:55:37 deepfield slapd[12862]: begin get_filter_list Oct 31 08:55:37 deepfield slapd[12862]: begin get_filter Oct 31 08:55:37 deepfield slapd[12862]: EQUALITY Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: end get_filter 0 Oct 31 08:55:37 deepfield slapd[12862]: begin get_filter Oct 31 08:55:37 deepfield slapd[12862]: EQUALITY Oct 31 08:55:37 deepfield slapd[12862]: end get_filter 0 Oct 31 08:55:37 deepfield slapd[12862]: end get_filter_list Oct 31 08:55:37 deepfield slapd[12862]: end get_filter 0 Oct 31 08:55:37 deepfield slapd[12862]: filter: (&(objectClass=posixAccount)(uid=flash)) Oct 31 08:55:37 deepfield slapd[12862]: attrs: Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=2 SRCH base="dc=example,dc=net" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=flash))" Oct 31 08:55:37 deepfield slapd[12862]: ==> limits_get: conn=1003 op=2 self="uid=flash,ou=people,ou=accounts,dc=example,dc=net" this="dc=example,dc=net" Oct 31 08:55:37 deepfield slapd[12862]: query template of incoming query = (&(objectClass=)(uid=)) Oct 31 08:55:37 deepfield slapd[12862]: Entering QC, querystr = (&(objectClass=posixAccount)(uid=flash)) Oct 31 08:55:37 deepfield slapd[12862]: Lock QC index = 0xb867e350 Oct 31 08:55:37 deepfield slapd[12862]: Base of added query = dc=example,dc=net Oct 31 08:55:37 deepfield slapd[12862]: QUERY ANSWERABLE (answered 1 times) Oct 31 08:55:37 deepfield slapd[12862]: => mdb_search Oct 31 08:55:37 deepfield slapd[12862]: mdb_dn2entry("dc=example,dc=net") Oct 31 08:55:37 deepfield slapd[12862]: => mdb_dn2id("dc=example,dc=net") Oct 31 08:55:37 deepfield slapd[12862]: <= mdb_dn2id: got id=0x1 Oct 31 08:55:37 deepfield slapd[12862]: => mdb_entry_decode: what am i doing wrong? -ben

2 2

Problem with too many concurrent LDAP requests (Postfix+LDAP)
by Denis BUCHER (lists) 09 Feb '13

09 Feb '13

Dear all, I am using LDAP as backend for Postfix for all email accounts. Any email coming to the server is checked against LDAP to check if email is valid, and deliver it accordingly. It works almost perfectly but I have a big problem that arise when receiving (or sending) too many emails at the same time. It looks like slapd server is overwhelmed with too many requests at the same time, which makes postfix getting timeouts. On the postfix side hopefully it's only a "temporary lookup failure" but I want to correct that problem. In the logs I get two kind of LDAP errors : a) * postfix/trivial-rewrite: warning: dict_ldap_lookup: Search error -5: Timed out * postfix/trivial-rewrite: fatal: ldap:/etc/postfix/ldap-domains.cf(0,lock|fold_fix): table lookup problem b) * postfix/smtpd: warning: dict_ldap_connect: Unable to bind to server ldap://localhost:389 as cn=mailadmin, ou=mailservices, dc=domain, dc=ch: -5 (Timed out) If someone had a suggestion on how to optimize the LDAP server to be able to cope with the demand coming from postfix it would be great ! Denis

2 3

Error from MOD referral containing spaces
by Chris Palmer 05 Feb '13

05 Feb '13

I am having trouble processing referred MOD requests where the DN contains spaces. It always fails with error 32 (not found). Instance A is the master. Instance B is a replica, type refreshAndPersist, and contains "updateref ldap://instanceA:389" following the syncrepl. Both A and B are openldap 2.4.33 with identical configuration apart from the sync and referral settings. Updates to A replicate immediately and correctly to B (including those with spaces in the DN). Updates to B, without spaces in the DN, are referred to A, processed correctly on A, and replicated correctly to B. But: updates to B, *with* spaces in the DN, are referred to A where they fail with error 32. The client (using Novell jldap 2009.10.07) does not report an error, and of course the change is not replicated. The MOD to B appears in ldap.log as dn="cn=first second,ou=.......". Note the space between the two words of the CN. (This is also how MODs sent directly to A appear, which do get correctly processed). A network trace shows B generating a referral to A of the form: ldap://instanceA:389/cn=first%20second,ou=..... The MOD referral to A appears in A's ldap.log as dn="cn=first%20second,ou=....." with err=32. I'm at a loss to know where to go from here, or even which component is at fault. Can anyone help? Many thanks Chris

3 4

client server connection to LDAP/Kerberos
by Asmaa Ahmed 04 Feb '13

04 Feb '13

Hello, I recently added Kerberos authentication to my LDAP server, and I am trying to connect the other servers to it.I have a server running Davical shared calendar, and I hope to get it working with my LDAP server again after Kerberos integration. Here is my configuration which was working before the integration and my source is "http://wiki.davical.org/w/Configuration/LDAP#Kerberos_Authentication" $c->authenticate_hook['config'] = array( 'host' => 'ldap.domain.com', //host name of your LDAP Server 'port' => '389', //port// 'bindDN' => 'cn=admin,dc=domain,dc=com', //DN to bind request to this server (if required)// 'passDN' => 'password', //Password of request bind 'baseDNUsers' => 'ou=People,dc=domain,dc=com', //where to look for valid user 'filterUsers' => 'objectClass=*', //filter which must validate a user according to RFC4515, i.e. surrounded by brackets 'protocolVersion' => 3, // important for simple auth (no sasl)// 'startTLS' => true, // securing your LDAP connection 'i_use_mode_kerberos' => "i_know_what_i_am_doing", My slapd error logs:Jan 31 23:40:00 ldap slapd[1059]: conn=1273 fd=43 ACCEPT from IP=203.28.247.193:56887 (IP=0.0.0.0:389)Jan 31 23:40:00 ldap slapd[1059]: conn=1273 op=0 BIND dn="" method=128Jan 31 23:40:00 ldap slapd[1059]: conn=1273 op=0 RESULT tag=97 err=0 text=Jan 31 23:40:00 ldap slapd[1059]: conn=1273 op=1 SRCH base="ou=People,dc=domain,dc=com" scope=2 deref=0 filter="(objectClass=*)"Jan 31 23:40:00 ldap slapd[1059]: conn=1273 op=1 SRCH attr=uid modifyTimestamp cn mailJan 31 23:40:00 ldap slapd[1059]: conn=1273 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text=Jan 31 23:40:00 ldap slapd[1059]: conn=1273 op=2 UNBIND My OLC configuration:root@ldap:/var/log# ldapsearch -LLLQY EXTERNAL -H ldapi:/// -b cn=config "(|(cn=config)(olcDatabase={1}hdb))"dn: cn=configobjectClass: olcGlobalcn: configolcArgsFile: /var/run/slapd/slapd.argsolcAuthzRegexp: {0}uid=([^,]+),cn=domain.com,cn=gssapi,cn=auth uid=$1 ,ou=people,dc=domain,dc=comolcLogLevel: statsolcPidFile: /var/run/slapd/slapd.pidolcSaslRealm: DOMAIN.COMolcToolThreads: 1 dn: olcDatabase={1}hdb,cn=configobjectClass: olcDatabaseConfigobjectClass: olcHdbConfigolcDatabase: {1}hdbolcDbDirectory: /var/lib/ldapolcSuffix: dc=domain,dc=comolcAccess: {0}to attrs=userPassword,shadowLastChange by anonymous auth by * no neolcAccess: {1}to dn.subtree="ou=krb5,dc=domain,dc=com" by dn="c n=adm-srv,ou=krb5,domain,dc=com" write by dn="cn=kdc-srv,ou =krb5,domain,dc=com" read by * noneolcAccess: {2}to attrs=loginShell,gecos by self write by users read by * noneolcAccess: {3}to dn.base="" by * readolcAccess: {4}to * by users read by * noneolcLastMod: TRUEolcRootDN: uid=admin,ou=people,domain,dc=com Any suggestion to fix the binding and get my search working again with kerberos authentication ? Thanks.

2 4

Access control
by Philip Colmer 04 Feb '13

04 Feb '13

I'm trying to get access control for writing to groups as automated as possible, in as much as I would like LDAP to be able to determine who is able to write based on other attributes. I've been able to successfully do this if I only need to grant access to one or a few individuals, by specifying their DN as a value to an attribute, and then using this ACL: add: olcAccess olcAccess: {2}to dn.sub="ou=groups,dc=example,dc=com" by dnattr="owner" write by users read by * none That works really well - I just add the owner attribute to an object, specify the owner's DN and they can then write to the object. However, for larger scale permissions, I need to be able to use the membership of a group. Now I've read http://www.openldap.org/faq/data/cache/52.html and seen that you can specify: access to <what> by group/<objectclass>/<attributename>=<DN> <access> However, that would require me to explicitly set the DN of the group in the access control itself. What I want/need to be able to do is for LDAP to read the DN of the group that has permission, in the same what that it does with dnattr. I thought that I had read something about this being possible with sets, but slapd.access says that "The statement set=<pattern> is undocumented yet." so I'm not clear if that is the most appropriate way to proceed. Can someone please advise on how this might be accomplished? Thanks. Philip

2 5

problem with ldap group check in squid
by Fuhrmann, Marcel 03 Feb '13

03 Feb '13

Hello, i'm trying to to configure squid to use a ldap (ADS 2008) group check to give access to the internet. The squid mailing list couldn't help me. Maybe you can. /usr/lib64/squid/squid_ldap_group -d -v3 -b 'ou=OU3,ou=OU2,ou=OU1,dc=DOMAIN,dc=LOCAL' -f \ '(&(sAMAccountName=%v)(memberOf=cn=%a,ou=USERGRUPPEN,dc=DOMAIN,dc=LOCAL))' -D cn=LDAP,cn=USERS,dc=DOMAIN,dc=LOCAL \ -w PASSWORT -h DOMAINCONTROLLER testuser internet Connected OK group filter '(&(sAMAccountName=testuser) (memberOf=cn=internet,ou=USERGROUPS,dc=DOMAIN,dc=LOCAL))', searchbase 'ou=OU3,ou=OU2,ou=OU1,dc=DOMAIN,dc=LOCAL' ERR The user TESTUSER is in OU3. The group INTERNET is in a OU called USERGROUPS. TESTUSER is member of INTERNET. But it doesn't work. Can somebody give me advice? Thanks a lot -- Marcel

1 1

slapd-meta and tls_reqcert=allow
by Jim Vanes 01 Feb '13

01 Feb '13

I'm using OpenLDAP 2.4.23-26 from Centos 6. I seem to be hitting a configuration issue regarding slapd-meta and SSL/TLS. Here is my meta config: database meta suffix "dc=virtual,dc=local" rootdn "cn=root,dc=virtual,dc=local" rootpw password # Local uri ldap://localhost/dc=ds1,dc=virtual,dc=local suffixmassage "dc=ds1,dc=virtual,dc=local" "dc=lab,dc=local" idassert-bind bindmethod=simple binddn="cn=root,dc=lab,dc=local" credentials=password #Remote AD server uri ldap://10.33.63.125:389/dc=ad1,dc=virtual,dc=local tls start suffixmassage "dc=ad1,dc=virtual,dc=local" "dc=mslab,dc=local" idassert-bind bindmethod=simple binddn="CN=Sync,CN=Users,DC=lab,DC=local" credentials="Password1" starttls="yes" tls_reqcert="allow" It seems as though tls_reqcert="allow" is ignored for the remote AD server. If set that variable in the ldap.conf everything works fine. But shouldn't the above function as an override to the default of 'demand'? The behaviour is the same when I change the above to use SSL instead. Another thing I noticed was that adding tls_crlcheck="none" to my idassert-bind line causes slaptest to fail..not sure if this is related or not. /etc/openldap/slapd.conf: line 68: "idassert-bind <args>": unable to parse field "tls_crlcheck=none". slaptest: bad configuration file! I must be misunderstanding the docs. Any help would be appreciated.

3 4

missing entry in slapcat backup
by Meike Stone 01 Feb '13

01 Feb '13

Hello dear List, I tried to import a slapcat backup from our production machine in a test environment and got following message: debld02:~ # time slapadd -w -q -f /etc/openldap/slapd.conf -l /backup.ldif 50f98421 mdb_monitor_db_open: monitoring disabled; configure monitor database to enable -#################### 100.00% eta none elapsed 09m18s spd 4.6 M/s Closing DB...Error, entries missing! entry 1156449: ou=a,ou=b,ou=c,ou=root First I did not noticed this message, but now I see the database is broken, because the node "ou=a" is missing. So my questions: - What ist the origin for such orphaned nodes (In MMR, it happens and I see a few glue records, but in my backup this one node is complete missing...)? - How can I prevent from such entires and how can I recognize them without importing? - How can I remove this entry (esp. in production DB without downtime), because a delete show following messages: ~ # ldapdelete -x -h localhost -w password -D cn=admin,ou=root 'cn=cname,ou=a,ou=b,ou=c,ou=root' ldap_delete: Other (e.g., implementation specific) error (80) additional info: could not locate parent of entry and if I try to add this missing node, then I get: ldapadd -x -h localhost -w password -D"cn=admin,ou=root" -f test.ldif adding new entry ou=a,ou=b,ou=c,ou=root ldap_add: Already exists (68) Thanks for help Meike

4 11

Duplicate attributeType: "2.5.4.35"
by rodrigo tavares 01 Feb '13

01 Feb '13

Hello, In my samba.schema, added the atribute userPassword. attributetype ( 1.3.6.1.4.1.7165.2.1.24 NAME 'sambaLMPassword' DESC 'LanManager Password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.7165.2.1.25 NAME 'sambaNTPassword' DESC 'MD4 hash of the unicode password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE ) attributetype ( 2.5.4.35 NAME 'userPassword' DESC 'RFC2256/2307: password of user' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128}) Then, i excute command slapindex -v. root@fileserver02:/etc/ldap/schema# slapindex -v WARNING! Runnig as root! There's a fair chance slapd will fail to start. Check file permissions! /etc/ldap/schema/samba.schema: line 195 attributetype: Duplicate attributeType: "2.5.4.35" slapindex: bad configuration file! What´s wrong ? Rodrigo

3 4

server-side sub-search
by Benin Technologies 31 Jan '13

31 Jan '13

Hi, Is it possible to do a server-side sub-search before returning the data to the client ? Let's say I have this tree : ---> dc=com | |-->dc=mycompany | | --> cn=Jane Doe | |-- objectClass=inetOrgPerso |-- cn=Jane Doe |-- mobile : 11223344 | --> cn=secretary | |-- objectClass=organizationalRole |--cn=secretary |--telephoneNumber=12345678 |--roleOccupant=cn=Jane Doe,dc=mycompany,dc=com I'd like to return, in a single search, something like : cn : Jane Doe - mobile : 11223344 - telephoneNumber : 12345678 Can this be done ? Ben

2 2

Search speed regarding BDB_IDL_LOGN and order in search filter
by Meike Stone 31 Jan '13

31 Jan '13

Hello, I'm sorry, but I want to ask again for clarifying. First question: - An index slot is loosing precision if the search result for an (indexed) attribute is larger than 2^16. Then the search time is going to increase a lot. - I can change this via BDB_IDL_LOGN. - But if I have a directory, that holds 200.000 employees with '(ObjectClass=Employees)', the result is larger than 2^16 and it is slow. - lets say, the employees are distributed over 4 continents and the DIT is structured geographical eg.: o=myOrg, c=us (100,000 employees) o=myOrg, c=gb ( 30,000 employees) o=myOrg, c=de ( 25,000 employees) o=myOrg, c=br ( 45,000 employees) Can i prevent it this problem with index slot size, if I change the search base to "o=myOrg, c=gb", because there are only 30,000 employees. This takes me to the second question: "How is a search filter evaluated?" Lets say, I combine three filter via "and" like '(&(objectlass=Employees)(age=30)(sex=m))' and the all attributes are indexed. Each filter results: (objectlass=Employees) => 200,000 entries (age=30) => 10,000 entries (sex=m) => 3,000 entries Does the order matter regarding speed, is it better to form the filter like this? '(&(sex=m)(age=30)(objectlass=Employees))' Thanks Meike

2 2

CLOSE_WAIT TCP connection
by Vanpeer 31 Jan '13

31 Jan '13

Hello, Could you please help me to understand the problem that i didn't really resolv.. I have my openldap platform which has been working well OpenldapServer : 2.3.39 Openldapclient : RedHat 5.x with nss_ldap and pam_ldap.so release 253-51 All my servers were configured with : /etc/nsswitch.conf /etc/ldap.conf and /etc/pam.d/sshd The user authentification with ssh connection is perfect. The filter of authorisation host connection is ok too. Everything is ok. But i've recently realized that i have a lot of TCP CLOSE_WAIT connexion from differents servers to my OpenLdapServer. These connexions are somethings like : tcp 1 0 IP_CLIENT:44633 OPENLDAP_SERVER:389 CLOSE_WAIT 3321/crond off (0.00/0/0) tcp 1 0 IP_CLIENT:44674 OPENLDAP_SERVER:389 CLOSE_WAIT 2426/nagios off (0.00/0/0) tcp 1 0 IP_CLIENT:44956 OPENLDAP_SERVER:389 CLOSE_WAIT 4652/ntpd off (0.00/0/0) ..... And so on .. I have ~20 TCP CLOSE_WAIT connection to OPENLDAP_SERVER I don't understand when these applications tried to connect to OPENLDAP server and why i have TCP persistent connexion. Meanwhile, I only have SSHD configured to use pam_ldap.so ... Someone can help me please ?!? Thanks by advance for your answer and i m sorry about my English

1 0

indexing with mdb
by anil beniwal 30 Jan '13

30 Jan '13

Hi i am using openldap 2.4.33 on rhel 6.3 with large mdb database size. We are using it for last few weeks, now we want to add index few attributes. What approach we should take, so that there is no downtime. How we can check the status if indexing is complete or not ? with both dynamic and static config We are using flat file configuration. Anil

1 0

Kerberos/LDAP integration
by Asmaa Ahmed 30 Jan '13

30 Jan '13

Hello, I am trying to integrate Kerberos to my Openldap server, and I am following pretty much the instructions from there 'http://www.rjsystems.nl/en/2100-d6-kerberos-openldap-client.php'But still can't get it work to connect the client server to the LDAP one after the integration!I can see this error in my logs:Jan 30 17:27:17 mail nscd: nss_ldap: failed to bind to LDAP server ldapi://ldap.domain.com/: Can't contact LDAP serverJan 30 17:27:17 mail nscd: nss_ldap: reconnecting to LDAP server (sleeping 1 seconds)...Jan 30 17:27:18 mail nscd: nss_ldap: failed to bind to LDAP server ldapi://ldap.domain.com/: Can't contact LDAP serverJan 30 17:27:18 mail nscd: nss_ldap: could not search LDAP server - Server is unavailable Thanks.

2 2

ldapsearch question
by Benin Technologies 29 Jan '13

29 Jan '13

Hi, I was wondering if the following search can be done. Let's say I have this tree : ---> dc=com | |-->dc=mycompany | | -->cn=Jane Doe | |-- objectClass=inetOrgPerson |-- cn=Jane Doe |-- mobile : 11223344 |--> cn=secretary | |--objectClass=organizationalRole |--cn=secretary |--telephoneNumber = 12345678 I'd like to return, in a SINGLE search, something like : cn : Jane Doe - mobile : 11223344 - telephoneNumber : 12345678 In other words, I'd like the search to return the attribute telephoneNumber AS an attribute of Jane Doe, and not as an attribute of Jane Doe --> cn=secretary Ben

2 1

ldapsearch trying to use SASL
by Scott Classen 29 Jan '13

29 Jan '13

Hello, I have a script which checks for the existence of an email address in my LDAP directory. the relevant line is: ldapsearch -D "uid=nss,dc=bah,dc=com" -w mypassword -b "ou=People,dc=blah,dc=com" uid=bobthebuilder mail If I run this script as the root or tomcat user it works as expected and returns the mail attribute. If this script is called from Apache Tomcat webapp (running as the tomcat user). I receive the following errors in my slapd.log file: Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 fd=26 ACCEPT from IP=131.1.2.3:50230 (IP=0.0.0.0:389) Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 op=0 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 op=0 SRCH attr=supportedSASLMechanisms Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 op=0 SEARCH RESULT tag=101 err=0 nentries=1 text= Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 op=1 BIND dn="uid=nss,dc=bah,dc=com" method=163 Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 op=1 RESULT tag=97 err=14 text=SASL(0): successful result: security flags do not match required Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 op=2 BIND dn="uid=nss,dc=bah,dc=com" method=163 Jan 29 13:59:29 bl1 slapd[3783]: SASL [conn=247839] Failure: no secret in database Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 op=2 RESULT tag=97 err=49 text=SASL(-13): user not found: no secret in database Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 fd=26 closed (connection lost) I don't understand why the ldapsearch is searching for attr=supportedSASLMechanisms when invoked from within a Tomcat Webapp, but works fine when invoked from a c shell. Any ideas? Your help is greatly appreciated. Scott

2 2

TLS problem
by Chris 29 Jan '13

29 Jan '13

Hi I am running Openldap 2.4.23 on RHEL6. I can telnet to the server on both 389 636 ports. I can do a ldapsearch and ldapadd without any errors. I get this error when I start the slapd daemon. /ldap_start_tls_s() failed: Can't contact LDAP server: Transport endpoint is not connected (uri="ldap://ldapserver")// //failed to bind to LDAP server ldap://ldapserver: Can't contact LDAP server: Transport endpoint is not connected/ When I do a ldapsearch -x -d1 -Z -b 'dc=flamengro,dc=co,dc=za' I get the following error /TLS: certificate [//CA certificate details omitted here...] is not valid - error -8172:Peer's certificate issuer has been marked as not trusted by the user..// //TLS: error: connect - force handshake failure: errno 0 - moznss error -8172// //TLS: can't connect: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user..// //ldap_err2string// //ldap_start_tls: Connect error (-11)// // additional info: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user/ Any help will be appreciated. This is my slapd.conf file include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args TLSCipherSuite HIGH TLSCertificateFile /etc/pki/tls/certs/slapdcert.pem TLSCertificateKeyFile /etc/pki/tls/certs/slapdkey.pem TLSVerifyClient never database bdb suffix "dc=flamengro,dc=co,dc=za" checkpoint 1024 15 rootdn "cn=Manager,dc=flamengro,dc=co,dc=za" rootpw secret directory /var/lib/ldap/flamengro index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub database monitor # allow only rootdn to read the monitor access to * by dn.exact="cn=Manager,dc=flamengro,dc=co,dc=za" read by * none access to attrs=userPassword,shadowLastChange by anonymous auth by self write by * none I

4 3

Atribute Samba
by rodrigo tavares 29 Jan '13

29 Jan '13

Hi, I have a master ldap master, then make replication. The replication is ok, but when i see the samba atributes are empty. sambaAcctFlags: [U] sambaLogonScript: netlogon.vbs sambaPasswordHistory: 00000000000000000000000000000000000000000000000000000000 00000000 sambaPwdCanChange: 1359464617 sambaPwdLastSet: 1359464617 sambaPwdMustChange: 2147483647 sambaLMPassword: sambaNTPassword: sambaSID: S-1-5-21-4183517729-3427035622-36389750-6040 sambaPrimaryGroupSID: S-1-5-21-4183517729-3427035622-36389750-3003 Any suggestion ? Rodrigo Faria Tavares

1 0

Replication LDAP Users Samba
by rodrigo tavares 29 Jan '13

29 Jan '13

Hello, Today, I have one host vmware, it a master, it replicate all datas about LDAP from filesever01 (Samba). Using LDAP, I using the inteface, and when i create a ldap user, it create a samba account. So, i not need create user samba. ldap admin dn = cn=admin,dc=def,dc=mg,dc=gov,dc=us ldap group suffix = ou=Groups ldap machine suffix = ou=Computers ldap passwd sync = yes pam password change = yes encrypt passwords = True ldap suffix = ou=def,dc=def,dc=mg,dc=gov,dc=us ldap ssl = no ldap user suffix = ou=Users Well, When I remove slapd config replicate, i got change users samba passwords. But is replication LDAP is active, my ldap users can to email, but sambausers is not login in domain. root@fileserver02:~# smbclient -L localhost -U house.green Enter house.green's password: session setup failed: NT_STATUS_LOGON_FAILURE Any suggestion ? Rodrigo Faria Tavares

1 0

389 port is closed from the client point of view
by Asmaa Ahmed 29 Jan '13

29 Jan '13

Hello, I am trying to get my ldap binding running, but some how it doen't work!When I checked the port using nmap, I can see clearly that it is closed while the server listens to it! client# nmap -p 389 ldap.domain.com Starting Nmap 5.00 ( http://nmap.org ) at 2013-01-29 23:09 ESTInteresting ports on ldap.domain.com (203.28.247.83):PORT STATE SERVICE389/tcp closed ldap Nmap done: 1 IP address (1 host up) scanned in 0.06 seconds root@server:/etc/ldap# nmap -p 389 localhost Starting Nmap 5.00 ( http://nmap.org ) at 2013-01-29 23:09 ESTInteresting ports on localhost (127.0.0.1):PORT STATE SERVICE389/tcp open ldap Nmap done: 1 IP address (1 host up) scanned in 0.04 secondsroot@server:/etc/ldap#root@server:/etc/ldap# nmap localhost Starting Nmap 5.00 ( http://nmap.org ) at 2013-01-29 23:10 ESTInteresting ports on localhost (127.0.0.1):Not shown: 994 closed portsPORT STATE SERVICE22/tcp open ssh80/tcp open http389/tcp open ldap464/tcp open kpasswd5636/tcp open ldapssl749/tcp open kerberos-adm Nmap done: 1 IP address (1 host up) scanned in 0.05 secondsroot@server:/etc/ldap# cat /etc/hosts127.0.0.1 localhost#127.0.1.1 ldap.domain.com ldap203.28.247.83 ldap.domain.com ldap How can I fix this? Thanks.

2 3

Re: replication between a back-sql master and back-hdb slave
by Benin Technologies 28 Jan '13

28 Jan '13

ok thanks I found that in the mailing list archive, dating back from 2007 (http://www.openldap.org/lists/openldap-software/200708/msg00015.html) Indeed back-sql was intended to loosely support acting as a syncrepl provider (limited to refreshOnly), but it's currently broken, and it's never been fixed (mostly due to lack of interest). Patches (or sponsorships) are welcome. Ing. Pierangelo Masarati OpenLDAP Core Team So I was wondering if it has been fix since... > your question is, can I use back-sql as syncperov. A sql backend is not > a fully featered database to use with slapd. > > -Dieter >

3 4

Usage of groups in an access control
by Marco de Booij 28 Jan '13

28 Jan '13

I use openLDAP already for years to store my users so I have to define them only once. The users can logon to both Linux and Windows (samba). Now I want to add address-books and manage the access rights. I have a problem with the usage of groups in an access control. I want to gave addressbooks in my LDAP but they should not be accessible by everybody. I used http://www.openldap.org/faq/data/cache/52.html to configure openLDAP but it does not seem to work. I have created a group like this: dn: cn=abk-admin,ou=Roles,dc=example,dc=com objectClass: groupOfNames member: cn=My ENTRY,ou=People,dc=example,dc=com cn: abk-admin and an address-book like this: dn: ou=abk1,ou=Addressbooks,dc=example,dc=com ou: abk1 objectClass: organizationalUnit objectClass: top (Both entries are output of slapcat. I did not put in the attributes like creatorsName and entryUUID) In the slapd:conf I have the following access rules: access to attrs=userPassword,sambaNTPassword,sambaLMPassword,sambaPwdMustChange,sambaPwdLastSet by dn="cn=admin,dc=example,dc=com" write by dn="cn=proxyuser,dc=example,dc=com" read by anonymous auth by self write by * none access to attrs=shadowLastChange,shadowMax by self write by * read access to dn.base="" by * read access to * by dn="cn=admin,dc=example,dc=com" write by * read access to dn.children="ou=abk1,ou=Addressbooks,dc=example,dc=com" by dn="cn=admin,dc=example,dc=com" write by groupOfNames="cn=abk-admin,ou=Roles,dc=example,dc=com" write by groupOfNames="cn=abk-user,ou=Roles,dc=example,dc=com" read by * none I searched around and changed dn.children by dn.subtree and dn.one but the result is the same. I can read the entries but I cannot insert or delete an entry. I can only do this with admin but only if the line for admin is defined. What did I do wrong or understood wrong? I tried to find the answer on the internet but was not able :( OpenLDAP: slapd 2.4.23 (Jun 16 2011 02:53:39) Debian 6.0.6 Regards, Marco

4 6

Re: Permissions, users, startup when install from source
by Ori Bani 28 Jan '13

28 Jan '13

Thanks for your reply, >> If compiling and installing from source, I don't see any information >> in the manual about how to auto-start the software and about >> process/file/directory permissions and ownership. I'm still searching >> the Faq-O-Matic (which is a little frustrating). >> >> Taking a step back, I'd love to install from yum on RHEL/CentOS and >> let it be taken care of in a trusted manner. But we require better >> password hashing than SHA1, so we are required to compile by hand >> using the passwd/sha2 contributed module (little surprised this isn't >> accepted into the core project, but I'm sure there are reasons). >> Maybe I can find this in a third-party repo somewhere? > > Not sure what you mean. the SHA2 contrib module is shipped with every > OpenLDAP release. Thus, as best I can tell, it is indeed included. My "surprised" comment is in reference to the fact that the default build of OpenLDAP only supports SHA1, which is widely regarded as deprecated. Why hasn't the sha2 module been migrated out of the contrib directory is what I am getting at (which commonly requires situations like this -- forcing people who wouldn't otherwise do so to install from source just to obtain this feature). One could argue that situations like this contribute to the lack of adoption of stronger password schemes in general. Something of an off-topic tangent. > If you are using RHEL or CentOS, you may be interested in > <http://ltb-project.org/wiki/download#openldap> Great. I will investigate. Does anyone else know of any yum-compatible repos that have a sha2-enabled OpenLDAP build in them? Anyone know anything about the OpenLDAP packages in RepoForge? I actually only assumed without testing that the OpenLDAP package in the CentOS base repo doesn't have the sha2 module compiled in. I should go back and check that assumption. Also, reflecting on the installation of the sha2 module, it occurs to me that short of the CentOS repo package already having sha2 compiled in, the best course of action is probably to compile only the sha2 module and use it with the CentOS package --- including the module in the slapd configuration seems to be the extent of integration, so that should work, no? If so, I think this would be the best option. >> After installation, what is commonly done in this regard? Create >> user/group "ldap" with no login shell and chown ldap:ldap on >> /usr/local/var/openldap-data? Is that all? > > It depends on your needs. I have done anything from running slapd as root, > to running it as a specific user. I'd welcome pointers to somewhere this is discussed (don't see it in the docs, maybe in the FAQ?). I don't have needs that are much different than anyone else. I naively assume slapd should generally not be run as root. In that case, is creating a ldap user/group and chowning the openldap-data directory the only things to do? >> Then what do people use for auto-starting the software (presumably >> with -u ldap -g ldap) in a RedHat environment? > > I wrote my own startup script that works with chkconfig. > <http://linuxcommand.org/man_pages/chkconfig8.html> I'm looking for anyone who wants to share such scripts. Thanks kindly for your time, much appreciated.

5 9

Re: syncrepl issue
by Meike Stone 28 Jan '13

28 Jan '13

> > a) Use a current release. That would be 2.4.33. > b) Delta-syncrepl supports MMR in current releases > c) The reason I suggest delta-syncrepl is because syncrepl is known to be > problematic, particularly with MMR. If you want reliable replication, use > delta-syncrepl. Is it recommended in MMR setups to use delta-syncrepl before syncrepl in general? Are there any disadvantages, like using more RAM, or other things to care..? Thanks, Meike

2 1

replication between a back-sql master and back-hdb slave
by Benin Technologies 28 Jan '13

28 Jan '13

Hi, I set up a back-sql server to access some existing data in a postgresql database. I was wondering if it's possible to replicate that server to some (read-only) back-hdb servers. Thanks BT

2 2

Is any way to make proxy cache working for acl requests?
by Tio Teath 28 Jan '13

28 Jan '13

I'm thick and tired of configuring this dame thing! I mean slapo-pcache. It just won't work. Is any way to force this to cache JUST EVERYTHING, including ACL requests to remote server? I don't care of disk or memory usage, I just want dame thing working!

1 0

back-sql : defining groups
by DavidHornung 27 Jan '13

27 Jan '13

Hello, until now I don't understand how to add users to a group in Openldap with back-sql I use a VIEW for ldap_entries like described in the manual pages of slapd-sql. CREATE VIEW ldap_entries (id, dn, oc_map_id, parent, keyval) AS SELECT 0, UPPER(’o=MyCompany,c=NL’), 3, 0, ’baseObject’ FROM unixusers WHERE userid=’root’ UNION SELECT (1000000000+userid), UPPER(CONCAT(CONCAT(’cn=’,gecos),’,o=MyCompany,c=NL’)), 1, 0, userid FROM unixusers UNION SELECT (2000000000+groupnummer), UPPER(CONCAT(CONCAT(’cn=’,groupnaam),’,o=MyCompany,c=NL’)), 2, 0, groupnummer FROM groups; How can I add users to a group? 1.) build additional entries like uid=testuser,cn=group1,o=MyCompany,c=NL OR 2.) use the memberOf Attribute (but how?) Thank you for your answers Cheers, David

1 0

Re: slapcat output is truncated every now and then
by Bálint Réczey 25 Jan '13

25 Jan '13

Hi Quanah, 2013/1/25 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Friday, January 25, 2013 12:07 AM +0100 Bálint Réczey < > balint(a)balintreczey.hu> wrote: > > >> I have a attached two patches hoping that they may be useful. >> > > I suggest you file an ITS if you want them considered for inclusion: > I have file them under http://www.openldap.org/its/index.cgi?findid=7503 and http://www.openldap.org/its/index.cgi?findid=7504 hopefully complying to the instructions. Please CC me in further related discussions about the problem because I will unsubscribe from the list for now. Cheers, Balint

2 2

using back-sql with cn=config
by Benin Technologies 25 Jan '13

25 Jan '13

Hi, Has anyone out there managed to successfully convert slapd.conf into cn=config with back-sql enabled ? I'm on Debian 6 / OpenLDAP 2.4.33 with back-sql support (./configure --enable-sql) According tohttp://www.openldap.org/software/release/changes.html, back-sql supports dynamic config as of version 2.4.27. So I converted slapd.conf to slapd.d, conversion went well. However, when I start slapd, I get the following message : # /usr/local/libexec/slapd -u openldap -g openldap -d -1 ....... 50ff3f0a<<< dnPrettyNormal:<cn=root,dc=example,dc=com>,<cn=root,dc=example,dc=com> 50ff3f0a olcSqlInsEntryStmt: value #0:<olcSqlInsEntryStmt> extra cruft after<SQL expression>. 50ff3f0a config error processing olcDatabase={1}sql,cn=config: <olcSqlInsEntryStmt> extra cruft after<SQL expression> 50ff3f0a send_ldap_result: conn=-1 op=0 p=0 50ff3f0a send_ldap_result: err=19 matched="" text="" 50ff3f0a slapd destroy: freeing system resources. 50ff3f0a slapd stopped. 50ff3f0a connections_destroy: nothing to destroy. The error message seems to be "extra cruft after<SQL expression>" If I edit slapd.d/cn=config/olcDatabase={1}sql.ldif and I comment the line starting with olcSqlInsEntryStmt, then slapd starts fine. So what's the right syntax for olcSqlInsEntryStmt ??? Thanks Ben

2 2

slapd not starting at boot when compiled with --enable-sql
by Benin Technologies 25 Jan '13

25 Jan '13

Hi, I'm not sure wether this is an OpenLDAP issue or a Debian issue... When installing OpenLDAP 2.4.33 from source on Debian 6.0.4 with back-sql support, I'm unable to make it start at boot. I tested it a few times to isolate the problem, and the simple fact of installing OpenLDAP with "--enable-sql" seems to be the cause. My "/etc/init.d/slapd" file works fine, but the service won't start at boot. Does anybody have an idea ? Below the details of my tests, I tried two configurations, without and with back-sql enabled : Config 1°/ I installed OpenLDAP 2.4.33 WITHOUT back-sql support. (plain "./configure") I installed an adequate "/etc/init.d/slapd" file (inspired from the file shipped with the Debian package installation), and then I installed the slapd service (update-rc.d slapd defaults). When I reboot the debian server, everything works fine, slapd starts. Config 2°/ Same installation, but this time WITH back-sql support (./configure --enable-sql) Like before, I deployed my "/etc/init.d/slapd" file. The file works fine ("/etc/init.d/slapd start" starts the OpenLDAP server) Then I install the slapd service, it seems to install well (update-rc.d slapd defaults). But when I reboot, slapd fails to start. I tried the following commands : # service slapd start Starting OpenLDAP: slapd failed! # /etc/init.d/slapd start Starting OpenLDAP: slapd. # service slapd stop Stopping OpenLDAP: slapd So it seems the "slapd" service can not be started by the "service" command (and thus cannot be launched a boot). NOTE that the ONLY difference between Config 1 and Config 2 is that I compiled OpenLDAP with "--enable-sql". At this point, I don't even use a back-sql backend (I'm still with the default configuration, using the bdb backend). Does anybody have an idea what's happening ? One last thing : I tried also to compile OpenLDAP with back-sql as a dynamic loaded module (./configure --enable-modules --enable-sql=mod). Same result, if my "slapd.conf" contains the instructions to dynamically load "back_sql.la", then : - OpenLDAP doesn't start at boot - "#service slapd start" doesn't work - "#/etc/init.d slapd start" still works Ben Note : I tried to use insserv instead of update-rc.d, same result

1 0

Re: syncrepl issue
by Frank Luo 25 Jan '13

25 Jan '13

thanks. I am using 2.4.23 sudo /opt/openldap/libexec/slapd -V @(#) $OpenLDAP: slapd 2.4.23 (Mar 9 2011 11:39:07) $ I understand that delta-syncrepl will significantly reduce traffic but that should not be the problem here. Also we have mirror mode turned on and I read "Note: Delta-syncrepl is not yet supported with MirrorMode." Frank On Fri, Jan 25, 2013 at 2:14 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Friday, January 25, 2013 11:59 AM -0500 Frank Luo > <frank.luoy(a)gmail.com> wrote: > >> We have 4 openldap servers, 1 and 2 are masters with mirror mode., 3 >> and 4 are slaves. 3 and 4 sometimes get out of sync with masters. But >> a few minutes or a few hours later, it can get synced again with some >> "random" events. The reason I call it "random" because I could not >> find any patter yet. This happens almost every day. > > > a) Always note the version of OpenLDAP you are using > b) Use delta-syncrepl > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

2 1

syncrepl issue
by Frank Luo 25 Jan '13

25 Jan '13

We have 4 openldap servers, 1 and 2 are masters with mirror mode., 3 and 4 are slaves. 3 and 4 sometimes get out of sync with masters. But a few minutes or a few hours later, it can get synced again with some "random" events. The reason I call it "random" because I could not find any patter yet. This happens almost every day. What I found is 3 and 4 (consumer) sometime get newer entryCSN than 1 and 2 (provider) for example on 1 and 2 entryCSN: 20130115190406.091431Z#000000#001#000000 on 3 and 4 entryCSN: 20130116183923.969790Z#000000#000#000000 I have confirmed that with the following syncrepl config, we can not update entry on 3 or 4 directly. (ldap_modify: Server is unwilling to perform (53) additional info: shadow context; no update referral). So that exclude the possibility 3 and 4 get updated directly from ldap client. Any direction? Thanks Frank Attachment: sync config portion #server 1 serverID 1 syncrepl rid=001 provider=ldap://s2.domain.com bindmethod=simple binddn="cn=Manager,dc=domain,dc=com" credentials=xxxxxxx searchbase="dc=domain,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on #server 2 serverID 2 syncrepl rid=002 provider=ldap://s1.domain.com bindmethod=simple binddn="cn=Manager,dc=domain,dc=com" credentials=xxxxxxx searchbase="dc=domain,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on #server 3 syncrepl rid=003 provider=ldap://ldaptm.domain.com bindmethod=simple binddn="cn=Manager,dc=domain,dc=com" credentials=xxxxxxx searchbase="dc=domain,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" #server 4 syncrepl rid=004 provider=ldap://ldaptm.domain.com bindmethod=simple binddn="cn=Manager,dc=domain,dc=com" credentials=xxxxxxx searchbase="dc=domain,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" As you noticed, ldaptm.domain.com is a virtual service on load balancer with server 1 and 2 behind

2 1

slapd-ldap: second search operation always generates error LdapErr: DSID-0C0906E8
by Bryce Powell 25 Jan '13

25 Jan '13

Hi, I have setup an LDAP proxy using OpenLDAP 2.4.23 running on CentOS release 6.2 Linux 2.6.32-220.4.2.el6.x86_64. Every second search operation on a connection returns an error: SEARCH RESULT tag=101 err=1 nentries=0 text=000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1 database ldap readonly on suffix "dc=example,dc=com" # Recreate cached connection before it can be dropped by the Active Directory. Default Active Directory timeout MaxConnIdleTime=900 idle-timeout 899 rebind-as-user yes uri "ldap://169.254.253.228/ ldap://169.254.239.115/ ldap://169.254.245.81/ ldap://169.254.239.91/" Here is an extract of the LDAP log, filtered on one connection: Jan 22 16:41:17 vmldapproxy1 slapd[1851]: conn=1035 fd=29 ACCEPT from IP=172.16.10.126:3579 (IP=0.0.0.0:389) Jan 22 16:41:17 vmldapproxy1 slapd[1851]: conn=1035 op=0 BIND dn="cn=sa_srv,ou=service accounts,dc=example,dc=com" method=128 Jan 22 16:41:17 vmldapproxy1 slapd[1851]: conn=1035 op=0 BIND dn="cn=sa_srv,ou=service accounts,dc=example,dc=com" mech=SIMPLE ssf=0 Jan 22 16:41:17 vmldapproxy1 slapd[1851]: conn=1035 op=0 RESULT tag=97 err=0 text= Jan 22 17:21:46 vmldapproxy1 slapd[1851]: conn=1035 op=1 SRCH base="dc=example,dc=com" scope=2 deref=3 filter="(|(cn=foobar)(uid=foobar)(sn=foobar)(givenName=foobar)(mail=foobar))" Jan 22 17:21:46 vmldapproxy1 slapd[1851]: conn=1035 op=1 SRCH attr=FullName userPassword MailServer mail CalendarDomain MailFile uid ServerName EncryptIncomingMail ListName MailSystem objectClass member NetUserName SametimeServer uniqueMember DB2UserName MailDomain NotesDN AltFullName HTTPPasswordChangeDate modifyTimestamp Location CertificateThumbprint MailAddress HTTPPasswordForceChange Policy MessageStorage NewMailFile LTPA-UsrNm NewMailServer AltFullNameLanguage CN Jan 22 17:21:46 vmldapproxy1 slapd[1851]: conn=1035 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Jan 22 17:23:31 vmldapproxy1 slapd[1851]: conn=1035 op=2 SRCH base="dc=example,dc=com" scope=2 deref=3 filter="(|(cn=foo.bar@example.com)(uid=foo.bar@example.com)(sn=foo.bar@example.com)(givenName=foo.bar@example.com)(mail=foo.bar@example.com))" Jan 22 17:23:31 vmldapproxy1 slapd[1851]: conn=1035 op=2 SRCH attr=FullName userPassword MailServer mail CalendarDomain MailFile uid ServerName EncryptIncomingMail ListName MailSystem objectClass member NetUserName SametimeServer uniqueMember DB2UserName MailDomain NotesDN AltFullName HTTPPasswordChangeDate modifyTimestamp Location CertificateThumbprint MailAddress HTTPPasswordForceChange Policy MessageStorage NewMailFile LTPA-UsrNm NewMailServer AltFullNameLanguage CN Jan 22 17:23:31 vmldapproxy1 slapd[1851]: conn=1035 op=2 SEARCH RESULT tag=101 err=1 nentries=0 text=000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1 Every subsequent search operation going forward generates the same error. The time difference between the bind (op=0) and the first successful search (op=1) is 40 minutes 29 seconds. The time between op=1 and the first failed search op=2 is 1 minute 45 seconds. This behaviour is consistent for all connections, and appears independent of time. Therefore I'm not seeing how timeouts factor into this issue. Appears a few folks have posted about this, here and elsewhere, but I could not find any suitable explanation that resolved the issue. Hoping someone can help me out. Thanks, and regards, Bryce Powell

3 4

exclude subtree from ppolicy
by Marc Patermann 25 Jan '13

25 Jan '13

Hi, is it possible to exclude a subtree (or some objects by filter) from the password policy overlay? Marc

2 1

Re: slapcat output is truncated every now and then
by Bálint Réczey 24 Jan '13

24 Jan '13

Hi Quanah, Thank you for the answer. 2013/1/22 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Sunday, January 20, 2013 11:58 AM +0100 Balint Reczey < > balint(a)balintreczey.hu> wrote: > > Dear Members of OpenLDAP Technical List, >> >> Could you please help in finding and explanation and potentially a fix >> for the bug reported at [1]? >> > > Per Howard Chu: > > I think it's because slapcat's attempt to get a read lock failed, probably > because slapd already had a conflicting write lock on it and the deadlock > detector chose slapcat to lose and slapcat doesn't retry on lock errors, > unlike slapd. > > The solution, of course, is to use back-mdb. > Forgive me for asking this with so little experience with OpenLDAP, but would fixing slapcat to retry on lock errors be an other option? It seems it could help people managing LDAP servers with high write-rate and others who are not be able to migrate to mdb in short term. Cheers, Balint

2 2

no data are fetched when using cn=config + back-sql
by Benin Technologies 24 Jan '13

24 Jan '13

Hi, I'm using back-sql. After converting to cn=config, ldapsearch fetches no data (with the old slapd.conf everything worked fine). Any idea why ? ------> $ ldapsearch -x -h localhost -b "dc=example,dc=com" "(objectClass=*)" # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: (objectClass=*) # requesting: ALL # # search result search: 2 result: 80 Other (e.g., implementation specific) error # numResponses: 1 ------> Versions : OpenLDAP 2.4.33 with latest patchs applied (until ITS#7499) Debian 6.0.4

1 0

Preoperation Plugin Questions
by Julius Plenz 23 Jan '13

23 Jan '13

Hi, I'm writing an preoperation authentication plugin for OpenLDAP, but I have trouble finding any documentation whatsoever on this. So most of what I know comes from tutorials like this one from Oracle: http://docs.oracle.com/cd/E19099-01/nscp.dirsvr416/816-6683-10/custauth.htm But since this is not official documentation and I find the execution paths hard to trace, I have two questions stemming from above guide: 1) The guide says that for an authentication preop plugin, Your pre-operation plug-in function is responsible for sending the result code to the client and for setting the DN and authentication method for the connection. Okay, so I do that. Like in the code example, I set the connection's DN to the value I got from the 'pb' in the first place: slapi_pblock_set(pb, SLAPI_CONN_DN, slapi_ch_strdup(dn)); But setting the authentication type fails: slapi_pblock_set(pb, SLAPI_CONN_AUTHTYPE, SLAPD_AUTH_SIMPLE); This is no real error though, it's simply not implemented: See http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=servers/sl… case SLAPI_CONN_AUTHMETHOD: ... /* These parameters cannot be set */ rc = PBLOCK_ERROR; break; (This was noted in 2006 already, with no reply on this list: http://www.openldap.org/lists/openldap-software/200601/msg00044.html ) So basically it boils down to: Do I have to do *any* other stuff except for sending back the result code? Like this: slapi_send_ldap_result(pb, rc, NULL, NULL, 0, NULL); 2) What is the preferred return value for a plugin function? Most (other) documentations and the code hints at this: i) return 0 if you handled the authentication ii) return 1 if you want successive plugins/backends/... to handle the authentication Is this correct? Or should I use the more suggestive SLAPI_BIND_SUCCESS and SLAPI_BIND_FAIL? Thanks! Julius P.S.: What I'm actually trying to achieve is to do RADIUS authentification via an external library. But I want to send the client's IP in a Calling-Station-Id attribute, so I cannot simply write a password check function, right? If you got any ideas that are better than a preop module, please tell me...

3 4

RE: slapd-ldap: second search operation always generates error LdapErr: DSID-0C0906E8
by Quanah Gibson-Mount 23 Jan '13

23 Jan '13

--On Wednesday, January 23, 2013 11:22 AM -0700 Bryce Powell <Bryce.Powell(a)TELUS.COM> wrote: > Hi Quanah, > > Thank you. Is this a known issue that's been addressed in the 2.4.33 > release? Please keep replies to the list, and please don't top post. There have been a multitude of bug fixes to slapd-ldap since the 2.4.23 release (I counted over 10 in the CHANGES file). There are also numerous other reasons not to use the generally broken packages provided by RH/CentOS. The first step to getting help with an issue like this is always going to be to first verify whether or not it occurs on a current release. Regards, Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

openldap overlays
by Carlos Santos 23 Jan '13

23 Jan '13

Greetings, I'm relatively new to OpenLDAP and I think I am an average user and a newbie when it comes to development. I am currently on a project on which we use openldap2.4 and the dyngroup overlay. My goal is to build another group overlay which will fetch data from outside the ldap machine (webservices) and then works just like the regular dyngroup overlay, returning the members of that group based on the results of the call to the webservices. The problem is, like I said, that I'm a newbie. I looked at dyngroup.c and I find it quite hard to understand what is going on. It has very few comments and of little help. Can someone give me an overview of the code, and maybe introduce me to the steps of creating an overlay? thanks, Carlos Santos

1 0

RE: (ITS#7498) Openldap syncrepl issue
by Chris Card 23 Jan '13

23 Jan '13

Hi,> > Hi, > > I've been having issues with syncrepl in openldap. This is plain > syncrepl. I'm not using delta-syncrepl as I run with mirror mode on. > > I've noticed that when there are a large number of writes on the > writemaster (Typically around 10 per second) the data on the readslave > goes out of sync with the master, typically having entries which have > been deleted on the master. The contextCSNs on both the readslaves and > writemaster match eventually, but the data doesn't. I'm running the > readslave in refreshOnly mode with an interval of 1 minute. I'm using a > reasonably large DB of size ~ 2 GB. I turned on the sync logs and found > lots of entries with "nonpresent_callback" and "syncrepl_del_nonpresent". > > Tested this and found it occurring in both 2.4.29 and 2.4.33 (Latest as > of this time), and with BDB 4.2.36 as the backend. > > I was wondering if anyone has faced similar issues before, and if there > exists a solution to this problem. I will send any relevant > configuration and log snippets as needed. > > Thanks >I am certainly seeing similar problems with plain syncrepl in an MMR setup (all writes to one server currently, openldap 2.4.31):for example, at the moment in my production system, there are 18 DNs (out of 5.7 million) which are in the writemaster but which are missing from the 3 readslaves, although the contextCSNs all match. Deleting and re-adding such DNs to the writemastercan usually fix this up, but sometimes the contextCSNs get out of sync, andthen the only practical way to recover is to rebuild the readslaves from a backup taken from the writemaster. Because of this issue I am planning to change to using delta-syncrepl, which does appear to work and not get out of sync in the testingI have done. I believe this is the only solution at the moment. Chris

1 0

Grant access to a group
by Onno van der Straaten 23 Jan '13

23 Jan '13

Hi, I would like to grant access to a group in my directory. Granting access to user is straightforward and works, for example access to attrs=myAttribute by dn="cn=User,dc=mydomain,dc=com" write by anonymous auth by users read by * none Now I'm trying to do the same using a group for example access to attrs=myAttribute by group/groupOfUniqueNames/uniqueMember="cn=ldap-admins,dc=groups,dc=mydomain,dc=com" write by anonymous auth by users read by * none I can't get this to work. I tried by group and by group.exact, these also don't work. From the documentation I understand that by group assumes objectClass 'groupOfNames' and attribute 'member' I used groupOfUniqueNames and uniqueMember so the configuration ended up as above. Is is possible to grant access to the directory in such a way? To a group? How? Best Regards, Onno

1 0

bug on dynamic configuration with back-sql
by Benin Technologies 22 Jan '13

22 Jan '13

Hi, I'm on Debian 6 / OpenLDAP 2.4.33 with back-sql. According to http://www.openldap.org/software/release/changes.html, back-sql supports dynamic config as of version 2.4.27. So I converted slapd.conf to slapd.d, conversion went well. However, when I start slapd, I get the following message : # /usr/local/libexec/slapd -u openldap -g openldap -d -1 ....... 50ff3f0a <<< dnPrettyNormal: <cn=root,dc=example,dc=com>, <cn=root,dc=example,dc=com> 50ff3f0a olcSqlInsEntryStmt: value #0: <olcSqlInsEntryStmt> extra cruft after <SQL expression>. 50ff3f0a config error processing olcDatabase={1}sql,cn=config: <olcSqlInsEntryStmt> *extra cruft after <SQL expression>* 50ff3f0a send_ldap_result: conn=-1 op=0 p=0 50ff3f0a send_ldap_result: err=19 matched="" text="" 50ff3f0a slapd destroy: freeing system resources. 50ff3f0a slapd stopped. 50ff3f0a connections_destroy: nothing to destroy. I took a look into olcDatabase={1}sql.ldif, and I saw that olcSqlInsEntryStmt was splitted on two lines : olcSqlInsEntryStmt: insert into ldap_entries (id,dn,oc_map_id,parent,keyval) v alues ((select max(id)+1 from ldap_entries),?,?,?,?) I tries to put everything on the same line, like : olcSqlInsEntryStmt: insert into ldap_entries (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from ldap_entries),?,?,?,?) But the error persists. If I comment that line, the server starts fine # olcSqlInsEntryStmt: insert into ldap_entries (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from ldap_entries),?,?,?,?)

1 0

slapcat output is truncated every now and then
by Balint Reczey 22 Jan '13

22 Jan '13

Dear Members of OpenLDAP Technical List, Could you please help in finding and explanation and potentially a fix for the bug reported at [1]? It seems it has been found often enough by Elmar as well to write a workaround [2]. Thanks, Balint [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=673038 [2] https://github.com/elmar/ldap-git-backup/blob/master/README.mdown#safe-ldif On 06/19/2012 06:27 PM, Quanah Gibson-Mount wrote: > --On Tuesday, June 19, 2012 2:25 PM +0200 Axel Beckert > <abe(a)debian.org> wrote: > >> Hi Steve, >> >> Steve Langasek wrote: >>> > According to the slapcat man page it should be "always safe to run >>> > slapcat with the slapd-bdb(5) ... backends" even if slapd runs. We do >>> > use a BDB backend. >>> >>> Note that the HDB backend is the one recommended upstream and the >>> Debian >>> default. >> >> Well, yeah, that system has been dist-upgraded from at least Etch. >> IIRC it started at some time when BDB was still the default. >> >> I wrote that -- according to our backups -- this happened already with >> Lenny's slapd. But with Lenny it seemed to have happened less often >> (which is why we noticed it only recently). > > Personally, I would advise you to ask a question about this on > openldap-technical(a)openldap.org. I asked Howard about it, and he had > a ready answer as to why you were seeing this, but I forget what it > is. In any case, this is not a debian specific openldap bug. > > --Quanah > ...

2 1

Re: Replication not working
by anil beniwal 22 Jan '13

22 Jan '13

> > I will be highly thankful to you, if you can help me out in below issue. > > We have three servers on rhel 6.3, 16 vcpu and 32G RAM , openldap 2.4.33 > with mdb db of 200G > > We are facing replication issue on our servers, otherwise servers are good > with login and user registration from website.(doing on one server only as > of now) > > We imported data on one server mmam01 and copied it to other 2 servers. > After some time we got big diff b/w db size of mmam01 and other two servers. > Then exported data and restored it on other two servers. > > i tried adding a user and i got replicated to other two servers, but after > some time, new users stop getting replicated to other servers. > > initial replication status after some 30 min > > Even when i tried with blank db it initally started and then stopped. i got errors like dn_callback : entries have identical CSN syncrepl_entry: rid=111 entry unchanged, ignored > Sat Jan 12 12:40:41 EST 2013 > > DR-SJ > contextCSN: 20130101132757.303803Z#000000#000#000000 > contextCSN: 20130111144013.926562Z#000000#001#000000 > contextCSN: 20130112174023.266193Z#000000#002#000000 > DC-mmam01 > contextCSN: 20130101132757.303803Z#000000#000#000000 > contextCSN: 20130112174006.314483Z#000000#001#000000 > contextCSN: 20130112174023.266193Z#000000#002#000000 > DC-mmam04 > contextCSN: 20130101132757.303803Z#000000#000#000000 > contextCSN: 20130111144013.926562Z#000000#001#000000 > contextCSN: 20130112174023.266193Z#000000#002#000000 > > After 2 hours > > DR-SJ > contextCSN: 20130101132757.303803Z#000000#000#000000 > contextCSN: 20130111144013.926562Z#000000#001#000000 > contextCSN: 20130112174023.266193Z#000000#002#000000 > contextCSN: 20130112175710.938307Z#000000#003#000000 > DC-mmam01 > contextCSN: 20130101132757.303803Z#000000#000#000000 > contextCSN: 20130112193219.242546Z#000000#001#000000 > contextCSN: 20130112174023.266193Z#000000#002#000000 > contextCSN: 20130112175710.938307Z#000000#003#000000 > DC-mmam04 > contextCSN: 20130101132757.303803Z#000000#000#000000 > contextCSN: 20130111144013.926562Z#000000#001#000000 > contextCSN: 20130112174023.266193Z#000000#002#000000 > contextCSN: 20130112175710.938307Z#000000#003#000000 > > My ldap.conf file is(same on all server) , we have host-ip mapping in > /etc/hosts file > > BASE dc=example, dc=com > URI ldap://mmam01.com ldaps://mmam01.com ldap://mmam04.com ldaps:// > mmam04.com ldap://sjam01.com ldaps://sjam01.com > TLS_REQCERT demand > TLS_CACERT /etc/openldap/cacerts/cacert.pem > > slapd.conf file(from mmam01) > > include /etc/openldap/schema/core.schema > include /etc/openldap/schema/cosine.schema > include /etc/openldap/schema/nis.schema > include /etc/openldap/schema/inetorgperson.schema > include /etc/openldap/schema/openldap.schema > include /etc/openldap/schema/dyngroup.schema > include /etc/openldap/schema/ppolicy.schema > include /etc/openldap/schema2/channelIdentifier.schema > include /etc/openldap/schema2/platform.schema > include /etc/openldap/schema2/extendedProfileKey.schema > include /etc/openldap/schema2/extendedProfileValue.schema > include /etc/openldap/schema2/behaviorKey.schema > include /etc/openldap/schema2/behaviorValue.schema > include /etc/openldap/schema2/questionAnswer.schema > include /etc/openldap/schema2/extendedTop.schema > include /etc/openldap/schema2/counter.schema > serverid 1 > TLSCipherSuite HIGH:MEDIUM:+SSLv3 > TLSCACertificateFile /etc/openldap/cacerts/cacert.pem > TLSCertificateFile /etc/openldap/cacerts/mmam01.crt > TLSCertificateKeyFile /etc/openldap/cacerts/mmam01.key > TLSVerifyClient never > pidfile /var/symas/run/slapd.pid > argsfile /var/symas/run/slapd.args > loglevel sync stats > idletimeout 30 > writetimeout 30 > modulepath /etc/openldap/lib64/openldap > moduleload back_mdb.la > moduleload ppolicy.la > moduleload unique.la > moduleload syncprov.la > database mdb > suffix "dc=example,dc=com" > directory /openldap/var/data > access to attrs=userPassword > by self write > by anonymous auth > by * break > > access to * > by > group/groupOfUniqueNames/uniqueMember.exact="cn=PWrite,ou=bGroup,dc=example,dc=com" > manage > by > group/groupOfUniqueNames/uniqueMember.exact="cn=PRead,ou=bGroup,dc=example,dc=com" > read > by * break > access to * > by self write > by anonymous auth > by * read > rootdn "cn=Manager,dc=example,dc=com" > rootpw {SSHA}dXDESQeFjSoa/A1HfJ2TAzYf4DrSYWY > index > mail,uid,postalCode,smail,channelType,channelValue,answer,behavName,objectclass,type > eq > index givenName,sn,city,cn,extName sub > index displayName approx > index entryCSN,entryUUID eq > checkpoint 128 15 > maxsize 274877906944 > syncrepl rid=111 > provider=ldap://sjam01.com > binddn="cn=Manager,dc=example,dc=com" > bindmethod=simple > credentials=0m2013 > tls_cacert=/etc/openldap/cacerts/cacert.pem > searchbase="dc=example,dc=com" > type=refreshAndPersist > retry="5 5 60 +" > network-timeout=10 > timeout=10 > syncrepl rid=222 > provider=ldap://mmam04.com > binddn="cn=Manager,dc=example,dc=com" > bindmethod=simple > credentials=0m2013 > tls_cacert=/etc/openldap/cacerts/cacert.pem > searchbase="dc=example,dc=com" > type=refreshAndPersist > retry="5 5 60 +" > network-timeout=10 > timeout=10 > overlay syncprov > syncprov-checkpoint 100 10 > syncprov-sessionlog 100 > mirrormode true > overlay unique > unique_attributes mail > overlay ppolicy > ppolicy_default "cn=default,ou=pwdPolicy,dc=example,dc=com" > ppolicy_use_lockout > > logs > > DR-sj > > Jan 12 14:51:28 sjprodam01 slapd[25165]: do_syncrep2: rid=111 > LDAP_RES_INTERMEDIATE - SYNC_ID_SET > Jan 12 14:51:28 sjprodam01 slapd[25165]: do_syncrep2: rid=111 > LDAP_RES_INTERMEDIATE - SYNC_ID_SET > Jan 12 14:51:28 sjprodam01 slapd[25165]: do_syncrep2: rid=111 > LDAP_RES_INTERMEDIATE - SYNC_ID_SET > Jan 12 14:51:28 sjprodam01 slapd[25165]: do_syncrep2: rid=111 > LDAP_RES_INTERMEDIATE - SYNC_ID_SET > Jan 12 14:51:28 sjprodam01 slapd[25165]: do_syncrep2: rid=111 > LDAP_RES_INTERMEDIATE - SYNC_ID_SET > > mmam04 > > Jan 12 14:53:24 mmprodam04 slapd[14108]: do_syncrep2: rid=222 > LDAP_RES_INTERMEDIATE - SYNC_ID_SET > Jan 12 14:53:24 mmprodam04 slapd[14108]: do_syncrep2: rid=222 > LDAP_RES_INTERMEDIATE - SYNC_ID_SET > Jan 12 14:53:25 mmprodam04 slapd[14108]: do_syncrep2: rid=222 > LDAP_RES_INTERMEDIATE - SYNC_ID_SET > Jan 12 14:53:25 mmprodam04 slapd[14108]: do_syncrep2: rid=222 > LDAP_RES_INTERMEDIATE - SYNC_ID_SET > > mmam01 > Users are add on this server > > > Jan 12 14:53:26 mmprodam01 slapd[24380]: slap_queue_csn: queing > 0x7f55dd4fa120 20130112195326.941804Z#000000#001#000000 > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=291 RESULT tag=105 > err=0 text= > Jan 12 14:53:27 mmprodam01 slapd[24380]: slap_graduate_commit_csn: > removing 0x7f55d010ee30 20130112195326.941804Z#000000#001#000000 > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=292 MOD > dn="extName=PIT,cn=entitlements,cn=extendedProfile,uid=6a9ddf85-1072-48b4-9f09-10f032c8f05e,ou=endUsers,dc=example,dc=com" > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=292 MOD attr=extValue > Jan 12 14:53:27 mmprodam01 slapd[24380]: slap_queue_csn: queing > 0x7f55deffc210 20130112195327.100182Z#000000#001#000000 > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=292 RESULT tag=103 > err=0 text= > Jan 12 14:53:27 mmprodam01 slapd[24380]: slap_graduate_commit_csn: > removing 0x7f55d8392770 20130112195327.100182Z#000000#001#000000 > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=293 MOD > dn="extName=RVW,cn=entitlements,cn=extendedProfile,uid=6a9ddf85-1072-48b4-9f09-10f032c8f05e,ou=endUsers,dc=example,dc=com" > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=293 MOD attr=extValue > Jan 12 14:53:27 mmprodam01 slapd[24380]: slap_queue_csn: queing > 0x7f560a22e210 20130112195327.103686Z#000000#001#000000 > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=293 RESULT tag=103 > err=0 text= > Jan 12 14:53:27 mmprodam01 slapd[24380]: slap_graduate_commit_csn: > removing 0x7f55fc6f35e0 20130112195327.103686Z#000000#001#000000 > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=294 MOD > dn="extName=ICA,cn=entitlements,cn=extendedProfile,uid=6a9ddf85-1072-48b4-9f09-10f032c8f05e,ou=endUsers,dc=example,dc=com" > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=294 MOD attr=extValue > Jan 12 14:53:27 mmprodam01 slapd[24380]: slap_queue_csn: queing > 0x7f55f3ffd210 20130112195327.107815Z#000000#001#000000 > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=294 MOD attr=extValue > Jan 12 14:53:27 mmprodam01 slapd[24380]: slap_queue_csn: queing > 0x7f55f3ffd210 20130112195327.107815Z#000000#001#000000 > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=294 RESULT tag=103 > err=0 text= > Jan 12 14:53:27 mmprodam01 slapd[24380]: slap_graduate_commit_csn: > removing 0x7f55e87ae550 20130112195327.107815Z#000000#001#000000 > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=295 MOD > dn="extName=RVP,cn=entitlements,cn=extendedProfile,uid=6a9ddf85-1072-48b4-9f09-10f032c8f05e,ou=endUsers,dc=example,dc=com" > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=295 MOD attr=extValue > Jan 12 14:53:27 mmprodam01 slapd[24380]: slap_queue_csn: queing > 0x7f55f0cf8210 20130112195327.112994Z#000000#001#000000 > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=295 RESULT tag=103 > err=0 text= > Jan 12 14:53:27 mmprodam01 slapd[24380]: slap_graduate_commit_csn: > removing 0x7f55e4618780 20130112195327.112994Z#000000#001#000000 > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=296 MOD > dn="extName=RAD,cn=entitlements,cn=extendedProfile,uid=6a9ddf85-1072-48b4-9f09-10f032c8f05e,ou=endUsers,dc=example,dc=com" > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=296 MOD attr=extValue > Jan 12 14:53:27 mmprodam01 slapd[24380]: slap_queue_csn: queing > 0x7f55dd4f9210 20130112195327.117321Z#000000#001#000000 > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=296 RESULT tag=103 > err=0 text= > Jan 12 14:53:27 mmprodam01 slapd[24380]: slap_graduate_commit_csn: > removing 0x7f55d0001490 20130112195327.117321Z#000000#001#000000 > > > I have tried adding users and changing passwords one by one, it doesn't > work. > I can search old entries from one server to other server. > > -- Thanks&Regards Anil Beniwal +919891695048

3 6

about Too many executing
by rodrigo tavares 22 Jan '13

22 Jan '13

Hello ! I'm see my logs, many messagens come: deferring operation: too many executing. Search in Google, I found informations, about message. First: "too many executing" is undesirable. Second: It means there are too many operations active on the given connection, so mais operations on that connection will be queued until some of the active operations complete. It is cause some problem for the sytem, memory or slapd ? Thanks: Rodrigo

2 1

How to get all attributes of a entry
by ctosgh 22 Jan '13

22 Jan '13

Hi, All I enabled memberOf overlay feature. Now I can get memberOf back with ldapsarch. ldapsearch -x -D "cn=admin,dc=xxx,dc=xxx" -b "dc=xxx,dc=xxx" -w xxx -H "ldap://10.139.36.7:389" "cn=user2" "memberOf" However, with above command other attributes, such as cn and sn, can't be retrieved back... As manual said, memberOf is a opertional attribute so that you should require it explicitly.. Is there a way that I can retrieve all other attributes in addition to memberOf? Thanks, Jacky

2 2

Microsoft Outlook (2011) jpegPhoto and thumbnailPhoto Suffixed With ';binary'
by Eren Türkay 22 Jan '13

22 Jan '13

Hello, I am testing my tree with outlook 2011 (for mac) to see if everything works expected. When I search a contact in address book, photo of the user is not shown. I searched the problem and learned that outlook uses thumbnailPhoto attribute for photos. Then, I created an outlook compatibility schema that includes thumbnailPhoto attribute. However, photos still not shown, at which time I started investigating the problem. I debugged the problem using the network analyzer and realized that Outlook 2011 requests awkward attribute names suffixed with the word ';binary'. When searching, it requests these attributes below along with standard ones: - userSMIMECertificate;binary - userCertificate;binary - thumbnailPhoto;binary - jpegPhoto;binary Since these attributes are not present in my tree (though I have 'normal' ones without a suffix), they are not sent to outlook client so photos are not shown. I, then, tried to change my compatibility schema to use 'thumbnailPhoto;binary', but I got an error stating that the attribute name is not valid. OpenLDAP does not seem to accept ';' character in attribute names. Probably, AD accepts ';' character in attribute names and outlook 2011 works with AD. Apart from not seeing photos, you cannot send encrypted e-mail using outlook because you cannot send a user certificate with openldap (';binary' suffix). So, if you try to use current openldap with outlook, you will miss 2 features, encryption on photos. I'm not sure if ';binary' suffix is done on purpose to make other LDAP servers work with outlook harder. Is there any workaround for it? Being able to include ';' in attribute name will probably fix the problem but I don't know if ';' is acceptable in LDAP standard. Regards, Eren -- . 73! DE TA1AET http://linkedin.com/in/erenturkay

2 1

Re: slapd segfaults with mdb
by Meike Stone 22 Jan '13

22 Jan '13

> File an ITS (http://www.openldap.org/its/) with a full backtrace of all > threads from gdb. => #7496 Thanks

1 0

Continuous mode (ldapmodify -c) not working
by Ori Bani 21 Jan '13

21 Jan '13

Am I doing something wrong? Here is an example: $ ldapmodify -c -x -D 'cn=config' -W Enter LDAP Password: <password> dn: olcDatabase={0}config,cn=config changetype: modify delete: olcSizeLimit - modifying entry "olcDatabase={0}config,cn=config" ldap_modify: No such attribute (16) additional info: modify/delete: olcSizeLimit: no such attribute

2 12

slapd segfaults with mdb
by Meike Stone 21 Jan '13

21 Jan '13

Hello, I play a little with the mdb on a test machine, and imported our db from production system. (about 1,500,000 entires, 2,5GByte ldif from slapcat) I took the slapd source from git today, and because of segmentation fault, I compiled slapd with debugging symbols. My configuration is simple: -------------------------------------------- include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/yast.schema include /etc/openldap/schema/rfc2307bis.schema include /etc/openldap/schema/my_ldap_attributes.schema include /etc/openldap/schema/my_ldap_ObjectClasses.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args sizelimit -1 timelimit 300 disallow bind_anon require authc gentlehup on tool-threads 4 serverID 001 ############################ # mdb database definitions ############################ database mdb suffix "ou=root" rootdn "cn=admin,ou=root" rootpw password directory /var/lib/ldap/ldap.mdb loglevel 256 maxsize 10737418240 envflags writemap,nometasync index objectClass,entryUUID,entryCSN eq index cn eq,sub . . . some other own indexes here -------------------------------------------- I started my search via: /tmp/ol/usr/local/bin/ldapsearch -x -h localhost -w password -D cn=admin,ou=root -b'ou=root' '(objectClass=*)' >/dev/null and got in the syslog folloing meassge: Jan 21 17:50:31 debld02 kernel: [348860.053152] slapd[19394]: segfault at 7f760f974ce8 ip 000000000053bea1 sp 00007f738b10a650 error 4 in slapd [400000+227000] Because of this, I configured the kernel to core dump: sysctl -w kernel.core_pattern=/tmp/core sysctl -w kernel.core_uses_pid=1 sysctl -w kernel.suid_dumpable=2 ulimit -c unlimited ulimit -v unlimited and got the result via: ~# gdb /tmp/ol/usr/local/libexec/slapd /tmp/core.19386 Core was generated by `/tmp/buildforopenldaptechnical/usr/local/libexec/slapd -h ldap:/// -f /etc/op'. Program terminated with signal 11, Segmentation fault. #0 0x000000000053bea1 in mdb_entry_decode (op=0xc3a020, data=0x7f738b10a770, e=0x7f738b11a828) at id2entry.c:666 666 a->a_desc = mdb->mi_ads[*lp++]; (gdb) How can I solve this? Btw.: This error is repeatable and I saw the same error with the release OL2.4.33. Thanks Meike

2 1

openldap 2.4.33 from source, can't find slapd.d directory
by Benin Technologies 21 Jan '13

21 Jan '13

3 5

ACL: Permissions with Groups and 'memberOf' Using Regex
by Eren Türkay 21 Jan '13

21 Jan '13

Hello, I'm designing a directory structure for our radio amateur union, and I have a problem with somewhat complex ACL (for me). Before I ask my question, I want to mention that this structure is not in production so it can always change. I may have designed the structure wrong, and there would be a better way to represent it. However, I believe that this is the correct way of representing our amateur radio union's organization. As a radio amateur union, we have different branches across different cities. These branches have their own members, and own managers, Additionally, there is a unit which is the manager of the whole union. Their members are listed in "cn=general-managers,<base dn>". All of the user information is stored under "ou=people,<base dn>" and 'memberOf' overlay is enabled. The structure is below: ==== BEGIN: directory structure ==== - <base dn> - cn=general-managers (groupOfNames) - ou=branch - ou=foo-city - cn=managers (groupOfNames) - cn=members (groupOfNames) - ou= bar-city - cn=managers (groupOfNames) - cn=members (groupOfNames) ... ... - ou=people cn=ta1aet (inetOrgPerson) memberOf: cn=managers,ou=foo-city,ou-branch,<base-dn> memberOf: cn=members,ou=foo-city,ou-branch,<base-dn> cn=CALLSIGN1 memberOf: cn=members,ou=foo-city,ou-branch,<base-dn> cn=CALLSIGN2 memberOf: cn=members,ou=bar-city,ou-branch,<base-dn> cn= CALLSIGNn ... ... ==== END: directory structure ==== So far, I have achieved to write an ACL for "ou=people". The users have write permission to some of the attributes such as "givenName, sn, mail, address" but they don't have permission to edit "title" (which should be edited by his manager in his branch) What I am aiming is listed below. 1- People in cn=managers,ou=XXXX,ou=branch should be able to add new user/member under "ou=people,<base dn>". (Of course, setting member attribute their branch "cn=members,ou=XXXX,ou=branch") 2- These managers (cn=managers,ou=XXX,ou=branch) should only be able to edit attributes of members registered to them. So, only people that are member of "cn=members,ou=XXX,ou=branch" should be edited by "cn=managers,ou=XXX,ou=branch". 3- Any user should be able to edit some (e.g not 'title') of his attributes (I've done it but I'm not sure if it can be done in a more elegant way. Config is attached at the end). 4- General managers should be able to edit the tree and children of "ou=branch,<base dn>" as well as "ou=people,<base dn>". This looks a bit easier compared to 1 and 2. I have searched through all regular expressions tutorials but none of them includes such a membership example. "access to" syntax has "filter" option. Since 'access to' requires <what> clause first, I thought of using regular expression to filter the people accordingly to their 'memberOf' attributes, somehow (-don't know how :) -) match their branches that they belong to, and give access to corresponding manager group. However, 'filter' does not seem to accept regular expressions and it requires a direct attribute. I cannot further proceed right now, and I will really appreciate a hand on this issue. My best regards and 73s! Eren ==== BEGIN: current olcAccess ==== olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonym ous auth by dn="cn=admin,dc=trac,dc=org,dc=tr" write by * none olcAccess: {1}to dn.base="dc=trac,dc=org,dc=tr" by dn="cn=admin,dc=trac,dc=o rg,dc=tr" write by * read by anonymous none olcAccess: {2}to dn.base="ou=people,dc=trac,dc=org,dc=tr" attrs="entry,objec tClass" by dn.one="ou=people,dc=trac,dc=org,dc=tr" read by anonymous none olcAccess: {3}to dn.one="ou=people,dc=trac,dc=org,dc=tr" attrs="givenName,sn ,mail" by self write by dn.one="ou=people,dc=trac,dc=org,dc=tr" read olcAccess: {4}to dn.one="ou=people,dc=trac,dc=org,dc=tr" attrs="entry,object Class,cn,givenName,sn,title,mail" by dn.one="ou=people,dc=trac,dc=org,dc=tr " read by anonymous none ==== END: current olcAccess ==== -- . 73! DE TA1AET http://linkedin.com/in/erenturkay

1 1

Rewriting query and results
by Kurt Roeckx 20 Jan '13

20 Jan '13

Hi, I have PBX that queries the ldap server, but I'm not very happy with how it behaves, and of course have no control over what it does. It sends a query for "sn=foo*". But I want it to run a query that checks against fields like cn, givenName and sn. I also want to query to be "*foo*" instead of "foo*". It only requests the fields sn, givenName and the various phone numbers and then shows sn and givenName. I want it to display cn instead. So I guess I want to return the value of cn in sn and don't return a givenName. I've been looking at slapo-rwm manpage, but it's not really making much sense to me. Can someone guide me on how to do it? Kurt

1 0

Understanding dynamic configuration
by Ori Bani 20 Jan '13

20 Jan '13

Hello, I'm struggling a little with understanding the dynamic configuration system (sorry, but wanted to say my vote is for file-based config; the way some of this config has been put into LDAP feels forced and unnecessarily convoluted). Specifically, I'm having a hard time getting my mind around how to manage and secure the configuration database. What's tripping me up is how to reconcile the separate ldif files that contain global server-level configuation settings and config database level settings with what I understand to be the recommended way to manage those things -- using OpenLDAP client tools. When starting a fresh server (CentOS6.3, installed from yum if that matters here), it's not clear to me how I can bind using ldapadd in order to modify global server settings. Right now, I suspect the trouble is that the default databases have been created without a olcRootPw. Do I have to violate best practices just long enough to add that setting to the cn=config/olcDatabase={0}config.ldif file? After that, do I bind to "cn=config" in order to change global configuration settings using the base DN "cn=config"? (The olcRootDN is in the config database ldif file is "cn=config") To modify settings for the configuration database itself, do I also use the same bind ("cn=config") but use a base DN of "olcDatabase={0}config.ldif,cn=config"? I'm also curious, many of the examples I see for things like cn=Modules don't use the full DN, which I think is cn=Modules,cn=config. Why is this? I've read the website docs, the man pages, but I don't see any information that addresses how to initially bind to and start configuring the server in the Right Way. The quick start guide would be a good place for that, but it still talks about slapd.conf. Thanks for the help and for the good software

2 1

unable to sasl bind to openldap .
by mallapadi niranjan 20 Jan '13

20 Jan '13

Hi all, I need some help in finding more about the below error: Jan 20 05:34:58 ldap2 slapd[2561]: conn=1025 op=1 RESULT tag=97 err=14 text=SASL(0): successful result: Jan 20 05:34:58 ldap2 slapd[2561]: conn=1025 op=2 BIND dn="" method=163 Jan 20 05:34:58 ldap2 slapd[2561]: SASL [conn=1025] Failure: Inappropriate authentication Jan 20 05:34:58 ldap2 slapd[2561]: conn=1025 op=2 RESULT tag=97 err=50 text=SASL(-14): authorization failure: Inappropriate authentication Jan 20 05:34:58 ldap2 slapd[2561]: conn=1025 op=3 UNBIND Jan 20 05:34:58 ldap2 slapd[2561]: conn=1025 fd=31 closed More information: Openldap version:openldap-servers-2.4.23-26.el6_3.2.x86_64 What i am trying to do is i have configure bind (named) to store it's records in LDAP server using plugin provided by bind-dyndb-ldap-1.1.0-0.9.b1.el6.x86_64, And i have configure named.conf to access ldap server only through GSSAPI. options { listen-on port 53 { 127.0.0.1; }; listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; forward first; forwarders { }; #dnssec-enable yes; #dnssec-validation yes; #dnssec-lookaside auto; allow-recursion { any; }; /* Path to ISC DLV key */ #bindkeys-file "/etc/named.iscdlv.key"; #managed-keys-directory "/var/named/dynamic"; tkey-gssapi-credential "dnsadmin(a)EXAMPLE.ORG"; tkey-domain "EXAMPLE.ORG"; }; logging { channel default_debug { file "data/named.run"; severity dynamic; }; }; zone "." IN { type hint; file "named.ca"; }; include "/etc/named.rfc1912.zones"; include "/etc/named.root.key"; dynamic-db "openldap" { library "ldap.so"; #arg "uri ldapi://%2fvar%2frun%2fldapi"; arg "uri ldap://localhost"; arg "base cn=dns,dc=example,dc=org"; arg "fake_mname ldap2.example.org."; arg "auth_method sasl"; arg "sasl_mech GSSAPI"; arg "sasl_user dnsadmin(a)EXAMPLE.ORG"; arg "zone_refresh 30"; }; As you can see named checks for dnsadmin(a)EXAMPLE.ORG as it sasl authentication user, dnsadmin(a)EXAMPLE.ORG is an user who exists in ldap records dn: cn=dnsadmin,ou=People,dc=example,dc=org cn: dnsadmin sn: user objectClass: person objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux userPassword:: U2VjcmV0MTIz krbPrincipalName: dnsadmin(a)EXAMPLE.ORG krbLoginFailedCount: 0 krbPrincipalKey:: MIIByKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBsDCCAawwVKAHMAWgAwIBAKFJ MEegAwIBEqFABD4gACUNiDAaRqfI6BDKN9YZ/DhvIf6TfUZY8pdWQ5HvM1ZI/DOxdPnIoXfnbjRT+ i7D7lMpkixzcxcFki3fFDBEoAcwBaADAgEAoTkwN6ADAgERoTAELhAAqBkEvL+gzUndM8TNS7ik+I 1weyacnVPB3PaFjtteeQBLcmrqikUN9eCWTDgwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAM0347z v8kK3gj0A9SYOzUDa7Hc89pG1dg4LOdJfam6QkNGamezP45ZnFLzGSQ/oTR76I3YwRKAHMAWgAwIB AKE5MDegAwIBF6EwBC4QAC3muW46EjvmxYXnvzA11/kiUrGwknrOL/dtcVVhx2ul81zChqkfuHYjU BbTMDygBzAFoAMCAQChMTAvoAMCAQihKAQmCADtDnWrNBUuisnbEstExWOiwQphTqqXyrzPi1XQ3U jvE0TpMZUwPKAHMAWgAwIBAKExMC+gAwIBA6EoBCYIAFNul3CO38n/hMzLT9lT31ma7ObzhJ9B1qn BIGSvn7wDSiH2dw== krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20130119232256Z krbExtraData:: AALQKvtQcm9vdC9hZG1pbkBFWEFNUExFLk9SRwA= krbExtraData:: AAgBAA== named reads /etc/named.keytab file to get dnsadmin(a)EXAMPLE.ORG [root@ldap2 master]# klist -k /etc/named.keytab Keytab name: WRFILE:/etc/named.keytab KVNO Principal ---- -------------------------------------------------------------------------- 2 dnsadmin(a)EXAMPLE.ORG 2 dnsadmin(a)EXAMPLE.ORG 2 dnsadmin(a)EXAMPLE.ORG 2 dnsadmin(a)EXAMPLE.ORG 2 dnsadmin(a)EXAMPLE.ORG 2 dnsadmin(a)EXAMPLE.ORG what i am looking for is when bind tries to connect using " dnsadmin(a)EXAMPLE.ORG" to ldap server i am seeing below error Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 op=0 RESULT tag=97 err=14 text=SASL(0): successful result: Jan 20 05:47:43 ldap2 slapd[2561]: connection_input: conn=1031 deferring operation: binding Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 op=1 BIND dn="" method=163 Jan 20 05:47:43 ldap2 slapd[2561]: connection_input: conn=1031 deferring operation: binding Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 op=1 RESULT tag=97 err=14 text=SASL(0): successful result: Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 op=2 BIND dn="" method=163 Jan 20 05:47:43 ldap2 slapd[2561]: SASL [conn=1031] Failure: Inappropriate authentication Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 op=3 UNBIND Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 op=2 RESULT tag=97 err=50 text=SASL(-14): authorization failure: Inappropriate authentication Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 fd=34 closed Can any one help me on how to enable more debugging to get more info about the error=50 (Insufficient access error) , Below is my olcAuthRegexp configuration: # config dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /opt/setup-openldap/sample-slapd.conf olcConfigDir: /etc/openldap/slapd.d/ olcAllows: bind_v2 ... .. ... ... .... olcTLSCACertificateFile: /etc/pki/tls/certs/cacert.pem olcTLSCertificateFile: /etc/pki/tls/certs/server.pem olcTLSCertificateKeyFile: /etc/pki/tls/certs/serverkey.pem olcTLSVerifyClient: allow olcToolThreads: 1 olcWriteTimeout: 0 olcAuthzRegexp: {0}uid=(.*),cn=EXAMPLE.ORG,cn=gssapi,cn=auth uid=$1,ou=People ,dc=example,dc=org olcLogLevel: stats And the output of ldapwhoami [root@ldap2 master]# ldapwhoami -Y GSSAPI -H ldapi:/// SASL/GSSAPI authentication started SASL username: dnsadmin(a)EXAMPLE.ORG SASL SSF: 56 SASL data security layer installed. dn:uid=dnsadmin,cn=example.org,cn=gssapi,cn=auth I just want to find out why named when trying to sasl bind with openldap it fails, Thanks Niranjan

2 2

ldap users with users samba
by rodrigo tavares 18 Jan '13

18 Jan '13

Hello ! I trying sync ldap users with users samba. I´m using a interface, by create ldap users. So, when ldap user be created, i want account e password samba be created. No my smb.conf I put the follow lines: ldap admin dn = cn=admin,dc=def,dc=mg,dc=gov,dc=br ldap group suffix = ou = groups ldap machine suffix = ou = computers ldap passwd sync = yes encrypt passwords = Yes ldap suffix = dc=def,dc=mg,dc=gov,dc=br ldap ssl = no ldap user suffix = ou = defensory smb ports = 445 139 add user script = /usr/sbin/smbldap-useradd -a -m "%u" add group script = /usr/sbin/smbldap-groupadd -p "%g" add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g" delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g" set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%u" add machine script = /usr/sbin/smbldap-useradd -w "%u" passwd program = /usr/sbin/smbldap-passwd -s "%u" passdb backend = ldapsam:ldap://10.65.8.95 passdb backend = tdbsam hosts allow = 127.0.0.1, 10.65.8.0/255.255.252.0 pam password change = yes passwd program = /usr/bin/passwd %u I configure in sladp.conf: include /etc/ldap/schema/ppolicy.schema moduleload ppolicy.so overlay ppolicy access to attrs=userPassword,shadowLastChange,sambaPwdMustChange,sambaLMPassword,sambaPwdLastSet,sambaNTPassword by dn="cn=admin,dc=def,dc=mg,dc=gov,dc=br" write by anonymous auth by self write by * none The user ldap is done, but samba user is not created. See some logs: Jan 18 16:09:01 defensoria slapd[6210]: conn=2455 fd=50 ACCEPT from IP=10.65.8.95:54507 (IP=0.0.0.0:389) So its bad. root@replica:/etc/ldap# smbclient -L 10.65.8.95 -U xbox Enter xbox's password: session setup failed: NT_STATUS_LOGON_FAILURE Thanks ! Rodrigo Faria Tavares

1 0

Re: don't get running the slapd while using mdb backend
by Meike Stone 18 Jan '13

18 Jan '13

> >>>>> So my first question: >>>>> Does mdb have limitations like bdb it have aka BDB_IDL_LOGN? >>>> >>>> >>>> >>>> Yes. back-mdb is ~60% the same code as back-bdb/hdb, its indexing >>>> functions are basically identical. >>> >>> >>> >>> However, I never got mdb to work successfully by modifying these values. >> >> >> Does this mean, it's not possible at moment to get running the mdb >> with BDB_IDL_LOGN = 2^17? > > > I can guarantee that would never work, as the variable with MDB is > MDB_IDL_LOGN. I don't recall exactly the issues I hit when changing it to > 17 from 16. Also, MDB has changed substantially since I did that testing. > ;) I was ok with not modifying it given the read speed improvements in mdb > vs bdb. > Thank for sharing, so I'll do test regarding this with the unmodified slapd and mdb, if it is fast enough in our environment! Have a nice weekend! Meike

2 1

Re: don't get running the slapd while using mdb backend
by Meike Stone 18 Jan '13

18 Jan '13

>>> So my first question: >>> Does mdb have limitations like bdb it have aka BDB_IDL_LOGN? >> >> >> Yes. back-mdb is ~60% the same code as back-bdb/hdb, its indexing >> functions are basically identical. > > > However, I never got mdb to work successfully by modifying these values. Does this mean, it's not possible at moment to get running the mdb with BDB_IDL_LOGN = 2^17? @Howard: I'm sorry, it was really not my intention to annoy, because of my statement about this problem in the bdb/mdb. Yes and I've read/followed each document under http://symas.com/mdb/, but not every one is a developer and not all of them is easy to understand. I try to get deeper inside to openldap and understand how it works, but it is really hard ;-) But anyway, I have to say thanks to all the great work you and the developer have done on openldap and especially mdb too! Thanks Meike

2 1

don't get running the slapd while using mdb backend
by Meike Stone 18 Jan '13

18 Jan '13

Hello, because of problems with bdb (virtual memory using and glibc) and limitiations (IDL), I want migrate to mdb. So my first question: Does mdb have limitations like bdb it have aka BDB_IDL_LOGN? Second, I set up an small lab for tests with mdb and don't get the slapd started with larger mdb size (10GB). Here the lab and test: Start slapd with an empty /var/lib/ldap/ldap.mdb directory I want reserve 10GByte disk space for mdb (maxsize 10737418240) error message in syslog ============================================================== @(#) $OpenLDAP: slapd 2.4.33 $ opensuse-buildservice(a)opensuse.org daemon: IPv6 socket() failed errno=97 (Address family not supported by protocol) mdb_db_open: database "ou=demo" cannot be opened, err 12. Restore from backup! backend_startup_one (type=mdb, suffix="ou=demo"): bi_db_open failed! (12) slapd stopped. created files from slapd while using ============================================================== ~# du -b /var/lib/ldap/ldap.mdb/* 12288 /var/lib/ldap/ldap.mdb/data.mdb 8192 /var/lib/ldap/ldap.mdb/lock.mdb I "straced" the start of slapd, here I think is the importand part: ============================================================== . . . stat("/var/lib/ldap/ldap.mdb", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 mmap(NULL, 2101248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe38f915000 brk(0x7fe3948ae000) = 0x7fe3948ae000 open("/var/lib/ldap/ldap.mdb/lock.mdb", O_RDWR|O_CREAT, 0600) = 9 fcntl(9, F_GETFD) = 0 fcntl(9, F_SETFD, FD_CLOEXEC) = 0 fcntl(9, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0 lseek(9, 0, SEEK_END) = 0 ftruncate(9, 8192) = 0 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_SHARED, 9, 0) = 0x7fe3941e4000 open("/var/lib/ldap/ldap.mdb/data.mdb", O_RDWR|O_CREAT, 0600) = 11 read(11, "", 4096) = 0 mmap(NULL, 10737418240, PROT_READ, MAP_SHARED, 11, 0) = -1 ENOMEM (Cannot allocate memory) close(11) = 0 munmap(0x7fe3941e4000, 8192) = 0 close(9) = 0 . . . So I tried to start slapd with the default of maxsize -- every thing is ok -- ============================================================== If i comment out maxsize 10737418240 (use the default of 10M), start slapd every thing is fine, slapd starts and create files: ~# du -b /var/lib/ldap/ldap.mdb/* 12288 /var/lib/ldap/ldap.mdb/data.mdb 8192 /var/lib/ldap/ldap.mdb/lock.mdb As I understand, at first slapd start, the database file will be created with the full size, but as sparse file? So why I don't see this, if I use the default (maxsize 10485760) Here my slapd.configuration file ============================================================== include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/yast.schema include /etc/openldap/schema/rfc2307bis.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_mdb moduleload back_monitor sizelimit -1 timelimit 300 disallow bind_anon require authc gentlehup on tool-threads 4 serverID 001 database mdb suffix "ou=demo" rootdn "cn=admin" rootpw password directory /var/lib/ldap/ldap.mdb loglevel 256 maxsize 10737418240 index objectClass,entryUUID,entryCSN eq mounted filesystem for database ============================================================== debld02:/etc/openldap # mount | grep ldap /dev/sdb5 on /var/lib/ldap type ext3 (rw,relatime) free space on filsystem ============================================================== debld02:/etc/openldap # df -h | grep ldap /dev/sdb5 30G 5.6G 23G 20% /var/lib/ldap So I tried to create the sparse file manual ============================================================== ~# su -- ldap ~> id uid=76(ldap) gid=70(ldap) groups=70(ldap) ~> dd if=/dev/zero of=/var/lib/ldap/ldap.mdb/test.sparse bs=1 count=0 seek=10G 0+0 records in 0+0 records out 0 bytes (0 B) copied, 1.3413e-05 s, 0.0 kB/s ~> du -b /var/lib/ldap/ldap.mdb/test.sparse 10737418240 /var/lib/ldap/ldap.mdb/test.sparse What is going wrong with my test lab? Thanks Meike

3 4

Re: ldap update ( 2.2 to 2.4)
by Dan White 17 Jan '13

17 Jan '13

>On Thu, Jan 17, 2013 at 5:20 PM, Dan White <dwhite(a)olp.net> wrote: >> What is the output of: >> >> slapcat -n0 -s olcDatabase={1}bdb,cn=config >> >> (remove any passwords or sensitive information) >> >> Increase your debug level to see if you get any more specific information. On 01/17/13 18:37 -0200, Bruno Furtado wrote: >this is the output of slapcat: > > str2entry: invalid value for attributeType objectClass #1 (syntax >1.3.6.1.4.1.1466.115.121.1.38) That looks like the output of slapadd, not slapcat. Either that, or something strange has happened. >and this is the debug output: > config_add_internal: DN="olcDatabase={1}bdb,cn=config" no >structural objectClass in configuration table My output of the above slapcat command includes the following objectClasses (for olcDatabase={1}bdb,cn=config): objectClass: olcDatabaseConfig objectClass: olcBdbConfig If I understand your above error correctly, your configuration is bad. -- Dan White

1 0

Re: ldap update ( 2.2 to 2.4)
by Dan White 17 Jan '13

17 Jan '13

On 01/17/13 17:10 -0200, Bruno Furtado wrote: >On Fri, Jan 11, 2013 at 6:09 PM, Dan White <dwhite(a)olp.net> wrote: >> On 01/11/13 17:29 -0200, Bruno Furtado wrote: >>> On Thu, Jan 10, 2013 at 12:34 PM, Dan White <dwhite(a)olp.net> wrote: >>>> On 01/10/13 12:04 -0200, Bruno Furtado wrote: >>>>> Hi Folks! >>>>> >>>>> I'm newbie to LDAP and I received a mission to update the version. >>>>> >>>>> Today is running Openldap 2.2.23 and I need to update to OpenLDAP >>>>> 2.4.28. all update attempts failed. I observed that the new version >>>>> have a different method of configuration. >>>>> >>>>> What the best way to do this? >>>>> >>>>> >>>> What error messages did you receive? >>>> >>>> You can use slaptest (with both -f and -F options) to convert your >>>> configuration to the newer configuration database format (see man >>>> slapd-config), although you can still use a slapd.conf based >>>> configuration. >>> >>> I tried both settings. >>> >>> This is the error message: >>> >>> 50f066f8 str2entry: invalid value for attributeType objectClass #1 >>> (syntax 1.3.6.1.4.1.1466.115.121.1.38) >>> >> >> This error means that you have a value within your input, for an >> objectClass, which is invalid per rfc2252 and is not accepted by the >> newer version of slapd that you are using. >> >> Try to found out which entry in your input is causing the error. > >Now when I try to start LDAP I get this error: > >config error processing olcDatabase={1}bdb,cn=config > >olcDatabase={1}bdb.ldif aparently is ok! What is the output of: slapcat -n0 -s olcDatabase={1}bdb,cn=config (remove any passwords or sensitive information) Increase your debug level to see if you get any more specific information. -- Dan White

1 0

back-sql documentation (was: SELinux woes)
by Ori Bani 17 Jan '13

17 Jan '13

>> Trying to switch to slapd.conf instead of dynamic configuration in >> order to test the back-sql backend > > As of version 2.4.27, I believe back-sql supports dynamic configuration, so > there's no need to switch to slapd.conf > > see http://www.openldap.org/software/release/changes.html : > > OpenLDAP 2.4.27 Release (2011/11/24) > > Added slapd-sql dynamic config support Oh! Thanks for the pointer. Anyone know if there's any chance the documentation is going to be updated? It's over a year later and the docs (and everything I saw in the list archives) say I must use slapd.conf

3 2

Re: slapd crashes with ch_realloc of X bytes failed
by Meike Stone 17 Jan '13

17 Jan '13

Hello, I could update both systems during my vacation to 2.4.33. Both servers had 16GByte RAM. The system crashed again randomly (as expected). So we increased the memory on one server to 24 GByte RAM. No effect, this server crashes too, sometime till 5 times a day. I installed a test machine (VM), but only with 7GByte RAM and could reproduce the crashes with one/two parallel searches. So I tried tcmalloc, but with the same result. I digged a little deeper and the results are, that not the physical memory from the system is insufficient. First - slapd tries to allocate memory more then available, but not use it. It is enough physical memory available during slapd crashes. I ran the commands continuously with while and sleep 1: free -m, and pmap $PID_OF_LDAP and vmstat 1 The last memory information before the crash was: pmap: -------------------------- 21954: slapd START SIZE RSS PSS DIRTY SWAP PERM MAPPING 00007f63f4904000 4K 0K 0K 0K 0K rw-p [anon] 00007f63f4905000 4K 0K 0K 0K 0K ---p [anon] 00007f63f4906000 16384K 2080K 2080K 2080K 0K rw-p [anon] 00007f63f5906000 4K 0K 0K 0K 0K ---p [anon] 00007f63f5907000 16384K 4120K 4120K 4120K 0K rw-p [anon] 00007f63f6907000 4K 0K 0K 0K 0K ---p [anon] 00007f63f6908000 16384K 4120K 4120K 4120K 0K rw-p [anon] 00007f63f7908000 4K 0K 0K 0K 0K ---p [anon] 00007f63f7909000 16384K 4104K 4104K 4104K 16K rw-p [anon] 00007f63f8909000 4K 0K 0K 0K 0K ---p [anon] 00007f63f890a000 16384K 8K 8K 8K 4K rw-p [anon] 00007f63f990a000 24K 8K 8K 8K 0K rw-s /SYSV0000000c 00007f63f9910000 544K 44K 44K 44K 0K rw-s /SYSV0000000b 00007f63f9998000 2304K 12K 12K 12K 0K rw-s /SYSV0000000a 00007f63f9bd8000 2097152K 2097052K 2097052K 2097052K 0K rw-s /SYSV00000009 00007f6479bd8000 78008K 60508K 60508K 60508K 0K rw-s /SYSV00000008 00007f647e806000 16K 0K 0K 0K 0K r-xp /usr/lib64/sasl2/libplain.so.2.0.22 00007f647e80a000 2044K 0K 0K 0K 0K ---p /usr/lib64/sasl2/libplain.so.2.0.22 00007f647ea09000 4K 0K 0K 0K 4K r--p /usr/lib64/sasl2/libplain.so.2.0.22 00007f647ea0a000 4K 0K 0K 0K 4K rw-p /usr/lib64/sasl2/libplain.so.2.0.22 00007f647ea0b000 16K 0K 0K 0K 0K r-xp /usr/lib64/sasl2/libanonymous.so.2.0.22 00007f647ea0f000 2044K 0K 0K 0K 0K ---p /usr/lib64/sasl2/libanonymous.so.2.0.22 00007f647ec0e000 4K 0K 0K 0K 4K r--p /usr/lib64/sasl2/libanonymous.so.2.0.22 00007f647ec0f000 4K 0K 0K 0K 4K rw-p /usr/lib64/sasl2/libanonymous.so.2.0.22 00007f647ec10000 20K 0K 0K 0K 0K r-xp /usr/lib64/sasl2/libsasldb.so.2.0.22 00007f647ec15000 2044K 0K 0K 0K 0K ---p /usr/lib64/sasl2/libsasldb.so.2.0.22 00007f647ee14000 4K 0K 0K 0K 4K r--p /usr/lib64/sasl2/libsasldb.so.2.0.22 00007f647ee15000 4K 0K 0K 0K 4K rw-p /usr/lib64/sasl2/libsasldb.so.2.0.22 00007f647ee16000 16K 0K 0K 0K 0K r-xp /usr/lib64/sasl2/liblogin.so.2.0.22 00007f647ee1a000 2044K 0K 0K 0K 0K ---p /usr/lib64/sasl2/liblogin.so.2.0.22 00007f647f019000 4K 0K 0K 0K 4K r--p /usr/lib64/sasl2/liblogin.so.2.0.22 00007f647f01a000 4K 0K 0K 0K 4K rw-p /usr/lib64/sasl2/liblogin.so.2.0.22 00007f647f01b000 8K 0K 0K 0K 0K r-xp /lib64/libkeyutils-1.2.so 00007f647f01d000 2044K 0K 0K 0K 0K ---p /lib64/libkeyutils-1.2.so 00007f647f21c000 4K 0K 0K 0K 4K r--p /lib64/libkeyutils-1.2.so 00007f647f21d000 4K 0K 0K 0K 4K rw-p /lib64/libkeyutils-1.2.so 00007f647f21e000 28K 0K 0K 0K 0K r-xp /usr/lib64/libkrb5support.so.0.1 00007f647f225000 2048K 0K 0K 0K 0K ---p /usr/lib64/libkrb5support.so.0.1 00007f647f425000 4K 0K 0K 0K 4K r--p /usr/lib64/libkrb5support.so.0.1 00007f647f426000 4K 0K 0K 0K 4K rw-p /usr/lib64/libkrb5support.so.0.1 00007f647f427000 12K 0K 0K 0K 0K r-xp /lib64/libcom_err.so.2.1 00007f647f42a000 2044K 0K 0K 0K 0K ---p /lib64/libcom_err.so.2.1 00007f647f629000 4K 0K 0K 0K 4K r--p /lib64/libcom_err.so.2.1 00007f647f62a000 4K 0K 0K 0K 4K rw-p /lib64/libcom_err.so.2.1 00007f647f62b000 144K 0K 0K 0K 0K r-xp /usr/lib64/libk5crypto.so.3.1 00007f647f64f000 2044K 0K 0K 0K 0K ---p /usr/lib64/libk5crypto.so.3.1 00007f647f84e000 8K 0K 0K 0K 8K r--p /usr/lib64/libk5crypto.so.3.1 00007f647f850000 4K 0K 0K 0K 4K rw-p /usr/lib64/libk5crypto.so.3.1 00007f647f851000 632K 0K 0K 0K 0K r-xp /usr/lib64/libkrb5.so.3.3 00007f647f8ef000 2044K 0K 0K 0K 0K ---p /usr/lib64/libkrb5.so.3.3 00007f647faee000 12K 0K 0K 0K 12K r--p /usr/lib64/libkrb5.so.3.3 00007f647faf1000 8K 0K 0K 0K 8K rw-p /usr/lib64/libkrb5.so.3.3 00007f647faf3000 172K 0K 0K 0K 0K r-xp /usr/lib64/libgssapi_krb5.so.2.2 00007f647fb1e000 2048K 0K 0K 0K 0K ---p /usr/lib64/libgssapi_krb5.so.2.2 00007f647fd1e000 4K 0K 0K 0K 4K r--p /usr/lib64/libgssapi_krb5.so.2.2 00007f647fd1f000 4K 0K 0K 0K 4K rw-p /usr/lib64/libgssapi_krb5.so.2.2 00007f647fd20000 28K 0K 0K 0K 0K r-xp /usr/lib64/sasl2/libgssapiv2.so.2.0.22 00007f647fd27000 2044K 0K 0K 0K 0K ---p /usr/lib64/sasl2/libgssapiv2.so.2.0.22 00007f647ff26000 4K 0K 0K 0K 4K r--p /usr/lib64/sasl2/libgssapiv2.so.2.0.22 00007f647ff27000 4K 0K 0K 0K 4K rw-p /usr/lib64/sasl2/libgssapiv2.so.2.0.22 00007f647ff28000 48K 0K 0K 0K 0K r-xp /usr/lib64/sasl2/libdigestmd5.so.2.0.22 00007f647ff34000 2044K 0K 0K 0K 0K ---p /usr/lib64/sasl2/libdigestmd5.so.2.0.22 00007f6480133000 4K 0K 0K 0K 4K r--p /usr/lib64/sasl2/libdigestmd5.so.2.0.22 00007f6480134000 4K 0K 0K 0K 4K rw-p /usr/lib64/sasl2/libdigestmd5.so.2.0.22 00007f6480135000 84K 0K 0K 0K 0K r-xp /lib64/libz.so.1.2.3 00007f648014a000 2044K 0K 0K 0K 0K ---p /lib64/libz.so.1.2.3 00007f6480349000 4K 0K 0K 0K 4K r--p /lib64/libz.so.1.2.3 00007f648034a000 4K 0K 0K 0K 4K rw-p /lib64/libz.so.1.2.3 00007f648034b000 84K 0K 0K 0K 0K r-xp /lib64/libgcc_s.so.1 00007f6480360000 2044K 0K 0K 0K 0K ---p /lib64/libgcc_s.so.1 00007f648055f000 4K 0K 0K 0K 4K r--p /lib64/libgcc_s.so.1 00007f6480560000 4K 0K 0K 0K 4K rw-p /lib64/libgcc_s.so.1 00007f6480561000 940K 0K 0K 0K 0K r-xp /usr/lib64/libstdc++.so.6.0.16 00007f648064c000 2048K 0K 0K 0K 0K ---p /usr/lib64/libstdc++.so.6.0.16 00007f648084c000 32K 0K 0K 0K 32K r--p /usr/lib64/libstdc++.so.6.0.16 00007f6480854000 8K 0K 0K 0K 8K rw-p /usr/lib64/libstdc++.so.6.0.16 00007f6480856000 84K 0K 0K 0K 4K rw-p [anon] 00007f648086b000 36K 28K 28K 0K 0K r-xp /lib64/libunwind.so.7.0.0 00007f6480874000 2044K 0K 0K 0K 0K ---p /lib64/libunwind.so.7.0.0 00007f6480a73000 4K 4K 4K 4K 0K r--p /lib64/libunwind.so.7.0.0 00007f6480a74000 4K 4K 4K 4K 0K rw-p /lib64/libunwind.so.7.0.0 00007f6480a75000 16K 4K 4K 4K 0K rw-p [anon] 00007f6480a79000 1460K 444K 38K 0K 0K r-xp /lib64/libc-2.11.3.so 00007f6480be6000 2048K 0K 0K 0K 0K ---p /lib64/libc-2.11.3.so 00007f6480de6000 16K 16K 16K 8K 0K r--p /lib64/libc-2.11.3.so 00007f6480dea000 4K 4K 4K 4K 0K rw-p /lib64/libc-2.11.3.so 00007f6480deb000 20K 16K 16K 16K 4K rw-p [anon] 00007f6480df0000 36K 28K 10K 0K 0K r-xp /lib64/libwrap.so.0.7.6 00007f6480df9000 2044K 0K 0K 0K 0K ---p /lib64/libwrap.so.0.7.6 00007f6480ff8000 4K 4K 4K 0K 0K r--p /lib64/libwrap.so.0.7.6 00007f6480ff9000 4K 4K 4K 4K 0K rw-p /lib64/libwrap.so.0.7.6 00007f6480ffa000 4K 4K 4K 4K 0K rw-p [anon] 00007f6480ffb000 76K 4K 0K 0K 0K r-xp /lib64/libresolv-2.11.3.so 00007f648100e000 2048K 0K 0K 0K 0K ---p /lib64/libresolv-2.11.3.so 00007f648120e000 4K 0K 0K 0K 4K r--p /lib64/libresolv-2.11.3.so 00007f648120f000 4K 0K 0K 0K 4K rw-p /lib64/libresolv-2.11.3.so 00007f6481210000 8K 0K 0K 0K 0K rw-p [anon] 00007f6481212000 48K 4K 0K 0K 0K r-xp /lib64/libcrypt-2.11.3.so 00007f648121e000 2044K 0K 0K 0K 0K ---p /lib64/libcrypt-2.11.3.so 00007f648141d000 4K 0K 0K 0K 4K r--p /lib64/libcrypt-2.11.3.so 00007f648141e000 4K 0K 0K 0K 4K rw-p /lib64/libcrypt-2.11.3.so 00007f648141f000 184K 0K 0K 0K 0K rw-p [anon] 00007f648144d000 1484K 4K 4K 0K 0K r-xp /usr/lib64/libcrypto.so.0.9.8 00007f64815c0000 2044K 0K 0K 0K 0K ---p /usr/lib64/libcrypto.so.0.9.8 00007f64817bf000 64K 0K 0K 0K 64K r--p /usr/lib64/libcrypto.so.0.9.8 00007f64817cf000 100K 0K 0K 0K 100K rw-p /usr/lib64/libcrypto.so.0.9.8 00007f64817e8000 16K 0K 0K 0K 12K rw-p [anon] 00007f64817ec000 308K 4K 4K 0K 0K r-xp /usr/lib64/libssl.so.0.9.8 00007f6481839000 2044K 0K 0K 0K 0K ---p /usr/lib64/libssl.so.0.9.8 00007f6481a38000 8K 0K 0K 0K 8K r--p /usr/lib64/libssl.so.0.9.8 00007f6481a3a000 24K 0K 0K 0K 24K rw-p /usr/lib64/libssl.so.0.9.8 00007f6481a40000 8K 4K 0K 0K 0K r-xp /lib64/libdl-2.11.3.so 00007f6481a42000 2048K 0K 0K 0K 0K ---p /lib64/libdl-2.11.3.so 00007f6481c42000 4K 0K 0K 0K 4K r--p /lib64/libdl-2.11.3.so 00007f6481c43000 4K 0K 0K 0K 4K rw-p /lib64/libdl-2.11.3.so 00007f6481c44000 100K 44K 36K 0K 0K r-xp /usr/lib64/libsasl2.so.2.0.22 00007f6481c5d000 2048K 0K 0K 0K 0K ---p /usr/lib64/libsasl2.so.2.0.22 00007f6481e5d000 4K 4K 4K 4K 0K r--p /usr/lib64/libsasl2.so.2.0.22 00007f6481e5e000 4K 4K 4K 4K 0K rw-p /usr/lib64/libsasl2.so.2.0.22 00007f6481e5f000 84K 4K 0K 0K 0K r-xp /lib64/libnsl-2.11.3.so 00007f6481e74000 2044K 0K 0K 0K 0K ---p /lib64/libnsl-2.11.3.so 00007f6482073000 4K 0K 0K 0K 4K r--p /lib64/libnsl-2.11.3.so 00007f6482074000 4K 0K 0K 0K 4K rw-p /lib64/libnsl-2.11.3.so 00007f6482075000 8K 0K 0K 0K 0K rw-p [anon] 00007f6482077000 364K 4K 0K 0K 0K r-xp /lib64/libm-2.11.3.so 00007f64820d2000 2044K 0K 0K 0K 0K ---p /lib64/libm-2.11.3.so 00007f64822d1000 4K 0K 0K 0K 4K r--p /lib64/libm-2.11.3.so 00007f64822d2000 120K 0K 0K 0K 8K rw-p /lib64/libm-2.11.3.so 00007f64822f0000 96K 4K 4K 0K 0K r-xp /usr/lib64/libslp.so.1.0.0 00007f6482308000 2044K 0K 0K 0K 0K ---p /usr/lib64/libslp.so.1.0.0 00007f6482507000 4K 0K 0K 0K 4K r--p /usr/lib64/libslp.so.1.0.0 00007f6482508000 4K 0K 0K 0K 4K rw-p /usr/lib64/libslp.so.1.0.0 00007f6482509000 92K 76K 26K 0K 0K r-xp /lib64/libpthread-2.11.3.so 00007f6482520000 2048K 0K 0K 0K 0K ---p /lib64/libpthread-2.11.3.so 00007f6482720000 4K 4K 4K 4K 0K r--p /lib64/libpthread-2.11.3.so 00007f6482721000 4K 4K 4K 4K 0K rw-p /lib64/libpthread-2.11.3.so 00007f6482722000 16K 4K 4K 4K 0K rw-p [anon] 00007f6482726000 400K 4K 4K 0K 0K r-xp /usr/lib64/libodbc.so.1.0.0 00007f648278a000 2044K 0K 0K 0K 0K ---p /usr/lib64/libodbc.so.1.0.0 00007f6482989000 4K 0K 0K 0K 4K r--p /usr/lib64/libodbc.so.1.0.0 00007f648298a000 28K 0K 0K 0K 28K rw-p /usr/lib64/libodbc.so.1.0.0 00007f6482991000 4K 0K 0K 0K 0K rw-p [anon] 00007f6482992000 1224K 196K 187K 0K 0K r-xp /usr/lib64/libdb-4.5.so 00007f6482ac4000 2048K 0K 0K 0K 0K ---p /usr/lib64/libdb-4.5.so 00007f6482cc4000 12K 4K 4K 4K 8K r--p /usr/lib64/libdb-4.5.so 00007f6482cc7000 12K 12K 12K 12K 0K rw-p /usr/lib64/libdb-4.5.so 00007f6482cca000 36K 4K 0K 0K 0K r-xp /usr/lib64/libltdl.so.7.2.0 00007f6482cd3000 2044K 0K 0K 0K 0K ---p /usr/lib64/libltdl.so.7.2.0 00007f6482ed2000 4K 0K 0K 0K 4K r--p /usr/lib64/libltdl.so.7.2.0 00007f6482ed3000 4K 0K 0K 0K 4K rw-p /usr/lib64/libltdl.so.7.2.0 00007f6482ed4000 56K 44K 14K 0K 0K r-xp /usr/lib64/liblber-2.4.so.2.8.5 00007f6482ee2000 2044K 0K 0K 0K 0K ---p /usr/lib64/liblber-2.4.so.2.8.5 00007f64830e1000 4K 4K 4K 4K 0K r--p /usr/lib64/liblber-2.4.so.2.8.5 00007f64830e2000 4K 4K 4K 4K 0K rw-p /usr/lib64/liblber-2.4.so.2.8.5 00007f64830e3000 308K 64K 64K 0K 0K r-xp /usr/lib64/libldap_r-2.4.so.2.8.5 00007f6483130000 2048K 0K 0K 0K 0K ---p /usr/lib64/libldap_r-2.4.so.2.8.5 00007f6483330000 4K 4K 4K 4K 0K r--p /usr/lib64/libldap_r-2.4.so.2.8.5 00007f6483331000 8K 8K 8K 8K 0K rw-p /usr/lib64/libldap_r-2.4.so.2.8.5 00007f6483333000 12K 8K 8K 8K 4K rw-p [anon] 00007f6483336000 288K 96K 96K 0K 0K r-xp /usr/local/lib/libtcmalloc.so.4.1.0 00007f648337e000 2044K 0K 0K 0K 0K ---p /usr/local/lib/libtcmalloc.so.4.1.0 00007f648357d000 4K 4K 4K 4K 0K r--p /usr/local/lib/libtcmalloc.so.4.1.0 00007f648357e000 4K 4K 4K 4K 0K rw-p /usr/local/lib/libtcmalloc.so.4.1.0 00007f648357f000 156K 92K 92K 88K 36K rw-p [anon] 00007f64835a6000 124K 40K 0K 0K 0K r-xp /lib64/ld-2.11.3.so 00007f6483708000 212K 0K 0K 0K 0K r--s /var/run/nscd/group 00007f648373d000 212K 0K 0K 0K 0K r--s /var/run/nscd/passwd 00007f6483772000 212K 0K 0K 0K 0K r--s /var/run/nscd/dbvbS4oY 00007f64837a7000 48K 28K 28K 24K 20K rw-p [anon] 00007f64837bc000 24K 8K 8K 8K 0K rw-s /SYSV00000007 00007f64837c2000 8K 4K 4K 4K 4K rw-p [anon] 00007f64837c4000 4K 4K 4K 4K 0K r--p /lib64/ld-2.11.3.so 00007f64837c5000 4K 4K 4K 4K 0K rw-p /lib64/ld-2.11.3.so 00007f64837c6000 4K 4K 4K 4K 0K rw-p [anon] 00007f64837c7000 1944K 456K 456K 0K 0K r-xp /usr/lib/openldap/slapd 00007f6483bac000 20K 8K 8K 8K 12K r--p /usr/lib/openldap/slapd 00007f6483bb1000 48K 24K 24K 24K 24K rw-p /usr/lib/openldap/slapd 00007f6483bbd000 3812K 1052K 1052K 984K 1788K rw-p [heap] 00007f6483f76000 5004408K 4574484K 4574484K 4574392K 257508K rw-p [heap] 00007fff9f532000 132K 4K 4K 4K 32K rw-p [stack] 00007fff9f5b6000 4K 4K 0K 0K 0K r-xp [vdso] ffffffffff600000 4K 0K 0K 0K 0K r-xp [vsyscall] Total: 7350688K 6749464K 6748875K 6747724K 259932K 5091328K writable-private, 80668K readonly-private, 2178692K shared, and 4900700K referenced ================================================================================ last free -m before crash: ------------------------------- total used free shared buffers cached Mem: 6928 6813 115 0 0 2180 -/+ buffers/cache: 4632 2296 Swap: 2047 288 1759 last free after crash: ------------------------------- total used free shared buffers cached Mem: 6928 4978 1950 0 0 2166 -/+ buffers/cache: 2810 4117 Swap: 2047 42 2005 ================================================================================ and vmstat: ------------------------------- procs -----------memory---------- ---swap-- -----io---- -system-- -----cpu------ r b swpd free buff cache si so bi bo in cs us sy id wa st 1 4 295284 110148 540 2255804 108 0 13428 0 796 1373 3 5 27 65 0 0 3 295260 118140 608 2242804 36 0 9308 0 2227 1309 2 5 23 70 0 0 3 295224 116668 680 2237396 48 0 4008 0 1253 2002 3 6 52 39 0 1 0 295164 116296 736 2232588 128 0 6028 0 1083 954 3 14 45 39 0 0 0 42332 4742716 768 2219044 784 0 1104 0 1428 1178 3 23 63 11 0 0 0 42332 4743020 768 2219168 0 0 0 0 253 97 0 0 100 0 0 0 0 42332 4743408 768 2219160 0 0 0 0 201 98 0 0 100 0 0 0 1 42300 4743408 768 2219140 216 0 216 0 295 150 0 0 99 1 0 What I see, that slapd had reserved "Total: 7350688K" (overcommitted?), but only referenced 4900700K. Why does slapd reserve so much memory and use it not? Because of this, I changed the default values for memory overcomittment from: vm.overcommit_memory = 0 (guess, default) vm.overcommit_ratio = 50 to: vm.overcommit_memory=2 (strict overcommit) vm.overcommit_ratio=100 but it crashed again (ch_malloc of 34545 bytes failed): . . 00007f2bf8e1a000 5019920K 4597460K 4597460K 4597116K 333472K rw-p [heap] 00007fffe86c5000 132K 0K 0K 0K 36K rw-p [stack] 00007fffe87af000 4K 4K 0K 0K 0K r-xp [vdso] ffffffffff600000 4K 0K 0K 0K 0K r-xp [vsyscall] Total: 7333420K 6766996K 6766484K 6765536K 336192K 5074068K writable-private, 80660K readonly-private, 2178692K shared, and 4681876K referenced So in spite of increase the memory from 16GByte to 24 GByte (one of the production server - configuration described in the first mail) same results. Is there anywhere a memory leak - how can I find out this? Thanks Meike P.S., mdb is not the option now, we need time to evaluate this ...

2 3

[OT] SELinux woes
by Ori Bani 17 Jan '13

17 Jan '13

All, Trying to switch to slapd.conf instead of dynamic configuration in order to test the back-sql backend I ran into a problem with SELinux that I do not understand. The startup fails with the error: /etc/openldap/slapd.conf: line 27: invalid path: Permission denied Disabling SELinux fixes the problem, however I'm not sure what is going on. The line in question is naturally the "directory" that points in this case to /var/lib/ldap. That directory is a hand-made clone of the original one that was there which was moved (renamed) out of the way. Here is what I did: mv /etc/openldap/slapd.d /etc/openldap/slapd.d.BAK mv /var/lib/ldap /var/lib/ldap.BAK mkdir /var/lib/ldap chown ldap:ldap /var/lib/ldap chmod 700 /var/lib/ldap create a simple /etc/openldap/slapd.conf The ownership and permissions on ldap and ldap.BAK directories are identical. OpenLDAP works fine if I disable SELinux. What is SELinux doing here?

3 3

Issue with LDAP TLS for Unix Login
by Arvind Navale 17 Jan '13

17 Jan '13

Hi Folks, I have a openldap server version slapd 2.4.16 running on a Solaris-10 OS. I have generated the self signed CA certificate on the ldap server to use TLS and configured the slapd.conf with certificate information. I am looking to get LDAP authentication using TLS on the ldap client side. I was able to setup centos-6.3 linux as ldap client using openldap client to LDAP authentication using TLS but I am having issues to setup a Solaris-10 OS using native LDAP client software. Solaris-10 LDAP client is setup using 'ldapclient manaul' and certificate was added using certutil command. Here is error messages seeing when trying to authenticate when using LDAP-TLS in sladp.log file on the openldap server side, Jan 14 14:51:53 ldapsrv slapd[543]: [ID 848112 local4.debug] conn=1270 fd=25 ACCEPT from IP=10.90.180.236:41051 (IP=0.0.0.0:636) Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 609413 local4.debug] daemon: waked Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 802679 local4.debug] daemon: activity on: Jan 14 14:51:53 ldapsrv slapd[543]: [ID 522297 local4.debug] 25r Jan 14 14:51:53 ldapsrv slapd[543]: [ID 100000 local4.debug] Jan 14 14:51:53 ldapsrv slapd[543]: [ID 694296 local4.debug] daemon: read activity on 25 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 525477 local4.debug] connection_get(25) Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 611214 local4.debug] connection_get(25): got connid=1270 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 138202 local4.debug] connection_read(25): checking for input on id=1270 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 609413 local4.debug] daemon: waked Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 802679 local4.debug] daemon: activity on: Jan 14 14:51:53 ldapsrv slapd[543]: [ID 522297 local4.debug] 25r Jan 14 14:51:53 ldapsrv slapd[543]: [ID 100000 local4.debug] Jan 14 14:51:53 ldapsrv slapd[543]: [ID 694296 local4.debug] daemon: read activity on 25 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 525477 local4.debug] connection_get(25) Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 611214 local4.debug] connection_get(25): got connid=1270 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 138202 local4.debug] connection_read(25): checking for input on id=1270 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 688457 local4.debug] connection_read(25): TLS accept failure error=-1 id=1270, closing Jan 14 14:51:53 ldapsrv slapd[543]: [ID 734893 local4.debug] connection_closing: readying conn=1270 sd=25 for close Jan 14 14:51:53 ldapsrv slapd[543]: [ID 330685 local4.debug] connection_close: conn=1270 sd=25 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 609413 local4.debug] daemon: waked Jan 14 14:51:53 ldapsrv slapd[543]: [ID 423323 local4.debug] daemon: removing 25 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 485650 local4.debug] conn=1270 fd=25 closed (TLS negotiation failure) Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 802679 local4.debug] daemon: activity on: Jan 14 14:51:53 ldapsrv slapd[543]: [ID 522297 local4.debug] 23r Jan 14 14:51:53 ldapsrv slapd[543]: [ID 100000 local4.debug] On the ldap client side I have enabled pam debugging and I see the following error messages associated with it, Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 492885 auth.debug] PAM[6459]: pam_setcred(80c9bd8, 2) Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 931871 auth.debug] PAM[6459]: load_modules(80c9bd8, pam_sm_setcred)=/usr/lib/security/pam_authtok_get.s o.1 Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 962116 auth.debug] PAM[6459]: pam_setcred(80c9bd8, 2): error Permission denied Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 509612 auth.debug] PAM[6459]: pam_set_item(80c9bd8:authtok) Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 725776 auth.debug] PAM[6459]: pam_end(80c9bd8): status = Permission denied Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 826707 auth.debug] PAM[6820]: pam_set_item(80c9bd8:authtok) Jan 14 14:52:45 drac9ec2 last message repeated 1 time Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 887652 auth.debug] PAM[6820]: pam_authenticate(80c9bd8, 1): error Authentication failed Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 285619 auth.debug] ldap pam_sm_authenticate(sshd-kbdint ldapusr2), flags = 1 Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 293258 auth.warning] libsldap: Status: 81 Mesg: openConnection: simple bind failed - Can't contact LDA P server Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 887652 auth.debug] PAM[6820]: pam_authenticate(80c9bd8, 1): error Permission denied Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 826707 auth.debug] PAM[6820]: pam_set_item(80c9bd8:authtok) Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 800047 auth.info] Keyboard-interactive (PAM) userauth failed[9] while authenticating: Authentication fa iled Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 800047 auth.notice] Failed keyboard-interactive for ldapusr2 from 10.90.176.38 port 44078 ssh2 Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 826707 auth.debug] PAM[6820]: pam_set_item(80c9bd8:conv) Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 814791 auth.debug] PAM[6820]: pam_end(80c9bd8): status = Authentication failed Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 324150 auth.debug] PAM[6820]: pam_start(sshd-kbdint,ldapusr2,80a98a8:80c9bd8) - debug = 1 Here is the ldapclient I have ran to setup the ldapclient, ldapclient -v manual -a defaultServerList=10.90.177.2 -a credentialLevel=anonymous -a domainName=dvsg-ldap.com -a defaultSearchBase=dc=dvsg-ldap,dc=com -a authenticationMethod=tls:simple -a serviceAuthenticationMethod=pam_ldap:tls:simple -a proxyDN=cn=readonly,dc=dvsg-ldap,dc=com -a proxyPassword=secret -a certificatePath=/var/ldap Any guidance or help to resolve this issue would be most appreciated. thank you, Arvind.

1 0

Strange ACL evaluation depending on AttributeSelection?
by Michael Ströder 17 Jan '13

17 Jan '13

HI! Today I made a strange observation tested with release 2.4.32 and git-build RE24 6f33e2c both with same results. The following commands (lines wrapped herein) were all typed as user root which gets mapped by authz-regexp to the rootdn of the database o=example (LDAPI with SASL/EXTERNAL). Let's check that: # ldapwhoami SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn:uid=admin,o=example I wanted to check ACLs applied to attribute 'sambaNTPassword' and to test Samba logon of course. Samba logon did work when putting the Samba demon user in a special group which has read access everywhere but it didn't when the special Samba ACLs were to be applied. So I tried to examine a possible bug in my ACLs but noticed unexpected results during that. Everything looks fine with a normal search as rootdn and we see that the entry indeed contains 'sambaNTPassword': # ldapsearch -LLL "(&(objectclass=sambaSamAccount)(uid=wtester))" sambaNTPassword SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: employeeNumber=42424242,ou=users,o=example sambaNTPassword: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx But when requesting to use the authz-DN with which the Samba demon binds the attribute is not shown which one might consider an ACL issue. Note that sambaNTPassword is explicitly requested just like Samba correctly does it: # ldapsearch -LLL -X "dn:uid=samba_dc_1,ou=samba,o=example" "(&(objectclass=sambaSamAccount)(uid=wtester))" sambaNTPassword SASL/EXTERNAL authentication started SASL username: dn:uid=samba_dc_1,ou=samba,o=example SASL SSF: 0 dn: employeeNumber=42424242,ou=users,o=example But then I would expect this search also *not* to return attribute 'sambaNTPassword' but it does! # ldapsearch -LLL -X "dn:uid=samba_dc_1,ou=samba,o=example" "(&(objectclass=sambaSamAccount)(uid=wtester))" "*" |grep -i sambaNTPassword SASL/EXTERNAL authentication started SASL username: dn:uid=samba_dc_1,ou=samba,o=example SASL SSF: 0 sambaNTPassword: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Maybe I'm doing something wrong on the command-line but I simply don't get it... :-/ Or is there some difference in ACL handling based on SearchRequest.attributes (AttributeSelection)? I have an ACL which blocks access to password attributes of disabled users by using a filter-based ACL. Hmm, I did not try what happens when explicitly requesting the attribute used in the filter. I have to do that tomorrow... Ciao, Michael.

2 3

Re: Replication not working
by anil beniwal 16 Jan '13

16 Jan '13

Ok Thanks a lot , looks like i will be able to swim through Final question, before going for this config. What would be impact of lastmode on/off with and without replication with big db size. On Thu, Jan 17, 2013 at 4:45 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, January 17, 2013 4:37 AM +0530 anil beniwal < > beni.anil(a)gmail.com> wrote: > > >> I am using rpm from symas, latest update on 29th dec,2013. i think that >> will work. >> >> Is my acceslog db configuration in slapd.conf right ? >> > > If that is your actual config file, no. You stuck the definition of the > accesslog DB in the middle of your existing DB configuration, which is > going to cause you all sorts of problems. I prefer to list the accesslog > db prior to the main db. > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Thanks&Regards Anil Beniwal +919891695048

1 0

Re: Replication not working
by anil beniwal 16 Jan '13

16 Jan '13

I am using rpm from symas, latest update on 29th dec,2013. i think that will work. Is my acceslog db configuration in slapd.conf right ? On Thu, Jan 17, 2013 at 4:27 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, January 17, 2013 2:49 AM +0530 anil beniwal < > beni.anil(a)gmail.com> wrote: > > >> My Bad >> >> Going forward, what would be my strategy, to enable delta sync repl with >> one master is already running with 200G mdb db. >> >> What i understand is >> 1.enable accesslog overlay on master server configure accesslog start >> the master >> 2. Take backup with mdb_copyand restore it on other master servers. >> 3. Enable accesslog configure to new consumers(work as providers as >> well) >> > > That sounds about right. I assume you are using current RE24 OpenLDAP, > and not 2.4.33. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Thanks&Regards Anil Beniwal +919891695048

2 1

Re: Replication not working
by anil beniwal 16 Jan '13

16 Jan '13

My Bad Going forward, what would be my strategy, to enable delta sync repl with one master is already running with 200G mdb db. What i understand is 1.enable accesslog overlay on master server configure accesslog start the master 2. Take backup with mdb_copyand restore it on other master servers. 3. Enable accesslog configure to new consumers(work as providers as well) Can you have a look, if i am wrong some where or any suggestion. include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema2/channelIdentifier.schema include /etc/openldap/schema2/platform.schema include /etc/openldap/schema2/extendedProfileKey.schema include /etc/openldap/schema2/extendedProfileValue.schema include /etc/openldap/schema2/behaviorKey.schema include /etc/openldap/schema2/behaviorValue.schema include /etc/openldap/schema2/questionAnswer.schema include /etc/openldap/schema2/extendedTop.schema include /etc/openldap/schema2/counter.schema serverid 1 TLSCipherSuite HIGH:MEDIUM:+SSLv3 TLSCACertificateFile /etc/openldap/cacerts/cacert.pem TLSCertificateFile /etc/openldap/cacerts/mmam01.crt TLSCertificateKeyFile /etc/openldap/cacerts/mmam01.key TLSVerifyClient never pidfile /var/run/slapd.pid argsfile /var/run/slapd.args loglevel sync stats idletimeout 30 writetimeout 30 modulepath /etc/openldap/lib64/openldap moduleload back_mdb.la moduleload ppolicy.la moduleload unique.la moduleload syncprov.la database mdb suffix "dc=example,dc=com" directory /openldap/var/data access to attrs=userPassword by self write by anonymous auth by * break access to * by group/groupOfUniqueNames/uniqueMember.exact="cn=PWrite,ou=bGroup,dc=example,dc=com" manage by group/groupOfUniqueNames/uniqueMember.exact="cn=PRead,ou=bGroup,dc=example,dc=com" read by * break access to * by self write by anonymous auth by * read rootdn "cn=Manager,dc=example,dc=com" rootpw {SSHA}dXDESQeFjSoa/A1HfJ2TAzYf4DrSYWY index mail,uid,postalCode,smail,channelType,channelValue,answer,behavName,objectclass,type eq index givenName,sn,city,cn,extName sub index displayName approx index entryCSN,entryUUID eq checkpoint 128 15 maxsize 274877906944 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 #accesslog db configuration database mdb suffix cn=log rootdn "cn=Manager,cn=log" rootpw xxxxxx directory /apps/accesslog index reqStart,objectclass,entryCSN,reqResult eq overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE overlay accesslog logdb cn=log logops writes logpurge 7+00:00 2+00:00 logsuccess TRUE syncrepl rid=111 provider=ldap://sjam01.com binddn="cn=Manager,dc=example,dc=com" bindmethod=simple credentials=0m2013 tls_cacert=/etc/openldap/cacerts/cacert.pem searchbase="dc=example,dc=com" type=refreshAndPersist retry="5 5 60 +" network-timeout=10 timeout=10 syncdata=accesslog logbase="cn=log" logfilter="(&(objectclass=auditWriteObject)(reqResult=0))" syncrepl rid=222 provider=ldap://mmam04.com binddn="cn=Manager,dc=example,dc=com" bindmethod=simple credentials=0m2013 tls_cacert=/etc/openldap/cacerts/cacert.pem searchbase="dc=example,dc=com" type=refreshAndPersist retry="5 5 60 +" network-timeout=10 timeout=10 syncdata=accesslog logbase="cn=log" logfilter="(&(objectclass=auditWriteObject)(reqResult=0))" mirrormode true overlay unique unique_attributes mail overlay ppolicy ppolicy_default "cn=default,ou=pwdPolicy,dc=example,dc=com" ppolicy_use_lockout On Thu, Jan 17, 2013 at 1:51 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, January 17, 2013 1:48 AM +0530 anil beniwal < > beni.anil(a)gmail.com> wrote: > > >> If i can't use multi master with refreshandpersist then why its given at >> all. >> i was able to get replication working with same configuration in other >> testing environment, but with very less users 1m only. >> > > I don't understand your statement/question. Delta-Syncrepl MMR uses > refresh and persist, and it is the best option to use for replication in > OpenLDAP. Particularly with multi-master replication. > > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Thanks&Regards Anil Beniwal +919891695048

2 1

Access questions
by Ori Bani 16 Jan '13

16 Jan '13

Hello, I think I understand that default access for everything that does not have any access rule is to allow read permission to everyone. All other entries (that have some form of access rules) will have a default of "access to * by * none" applied. I'd like instead to have all defaults be no access. I have a directory that will be used for internal email processes and also have a certain amount of public/anonymous access (but only to chosen attributes). Due to the public/anonymous component, I'd like to have default access rules be as restrictive as possible. Does it make sense to (do people commonly) set a global access of "access to * by * none" and then open access up for individual databases as desired? I'm thinking a global rule: access to * by dn.base="cn=Manager,dc=example,dc=com" write by * none Then each database will have to explicitly open access only as much as needed. The following would be in the database that uses the suffix for dc=example,dc=com Passwords for auth only, only admin can change passwords: access to attrs=userPassword by dn.base="cn=Manager,dc=example,dc=com" write by anonymous auth by * none Attributes needed by email delivery software only visible to the entry itself: access to attrs=mailMessageStore,homeDirectory,uidNumber,gidNumber by dn.base="cn=Manager,dc=example,dc=com" write by self read by * none Publicly available attributes defined explicitly: access to attrs=mail,jpegPhoto by dn.base="cn=Manager,dc=example,dc=com" write by * read Nothing else can be seen by anyone except the admin: access to * by dn.base="cn=Manager,dc=example,dc=com" write by * none In this scenario, cn is used to identify entries when searching but as you see, that attribute is forbidden to anonymous. Is that a problem or is it OK to allow query against cn while still disallowing cn in the results? I guess I'd also add this within this database's context, but I have to do it above the other rules I just listed? access to dn.base="cn=Manager,dc=example,dc=com" by peername.ip=127.0.0.1 auth by peername.ip=192.168.0.0%255.255.255.0 auth by * none Any tips much appreciated.

2 6

Re: Replication not working
by anil beniwal 16 Jan '13

16 Jan '13

If i can't use multi master with refreshandpersist then why its given at all. i was able to get replication working with same configuration in other testing environment, but with very less users 1m only. I am having all this running in production, but replication is not working. What should be my strategy to add new consumer, where my provider is running with mdb db size of 200G in production. i don't want to mess with configuration changes on master or with minimum changes. Any other suggestions are all welcome. On Wed, Jan 16, 2013 at 12:46 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, January 15, 2013 6:53 PM +0000 Chris Card < > ctcard(a)hotmail.com> wrote: > > This second problem doesn't happen consistently, but because I don't >> understand why it happens or how to fix it consistently, I can't go ahead >> with the production upgrade to delta-syncrepl, which is very frustrating. >> We are currently running openldap 2.4.31, but I do plan to see if 2.4.33 >> or RE24 behaves better. However, looking at the openldap sources I >> haven't spotted any fixes which look likely to help. >> Any ideas? >> > > I take it you are replicating cn=config then? I never do that, so hard > for me to comment on issues that may arise by doing that. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Thanks&Regards Anil Beniwal +919891695048

2 1

Using policy overlay
by rodrigo tavares 16 Jan '13

16 Jan '13

Hello ! I´m with troubles, in trying to load policy overlay,it is /usr/lib/ldap/ppolicy.so. Then I put overlay ppolicy in slapd.conf. So, restart openldap. But is com error: Jan 16 16:08:12 defensoria slapd[14010]: @(#) $OpenLDAP: slapd 2.4.23 (Jun 16 2011 02:53:39) $#012#011buildd@murphy:/build/buildd-openldap_2.4.23-7.2-i386-Y1mwvF/openldap-2.4.23/debian/build/servers/slapd Jan 16 16:08:12 defensoria slapd[14010]: overlay "ppolicy" not found Jan 16 16:08:12 defensoria slapd[14010]: slapd stopped. Jan 16 16:08:12 defensoria slapd[14010]: connections_destroy: nothing to destroy. Anybody Can to help me ? Thanks ! Rodrigo Faria

2 3

Re: uninstall?
by Ori Bani 15 Jan '13

15 Jan '13

>> Is there a make rule for uninstallation? "make uninstall" doesn't do >> the trick... >> >> If there's not, is there any recommended way to handle removing >> OpenLDAP that was installed from source? > > > Use --prefix so you install everything into the path you want? Otherwise, > no, no particularly easy way to uninstall. Hmmm, OK thank you.

1 0

uninstall?
by Ori Bani 15 Jan '13

15 Jan '13

Hi, Is there a make rule for uninstallation? "make uninstall" doesn't do the trick... If there's not, is there any recommended way to handle removing OpenLDAP that was installed from source? Thank you!

2 1

Permissions, users, startup when install from source
by Ori Bani 15 Jan '13

15 Jan '13

Hi, If compiling and installing from source, I don't see any information in the manual about how to auto-start the software and about process/file/directory permissions and ownership. I'm still searching the Faq-O-Matic (which is a little frustrating). Taking a step back, I'd love to install from yum on RHEL/CentOS and let it be taken care of in a trusted manner. But we require better password hashing than SHA1, so we are required to compile by hand using the passwd/sha2 contributed module (little surprised this isn't accepted into the core project, but I'm sure there are reasons). Maybe I can find this in a third-party repo somewhere? After installation, what is commonly done in this regard? Create user/group "ldap" with no login shell and chown ldap:ldap on /usr/local/var/openldap-data? Is that all? Then what do people use for auto-starting the software (presumably with -u ldap -g ldap) in a RedHat environment? Thanks for the work that you do, thanks for the great software.

2 1

Re: slapd crashes with ch_realloc of X bytes failed
by Meike Stone 15 Jan '13

15 Jan '13

> > Yes, that would significantly increase memory usage. I have only ever done > the *second* modification (BDB_IDL_LOGN) to fix the IDL issues. I've run > that way for years. How much have you increased the BDB_IDL_LOGN -> 2^17 or more, would be interesting for me, because we are nearly reach this size too. > Try dropping the modification to LDAP_PVT_THREAD_STACK_SIZE. It has never > been necessary for any of my customers, many of whom have DBs with 6 to 10 > million entries. Ok, thanks, I'll do this and check. Thanks Mike

2 1

Fwd: adding support to mdb
by Friedrich Locke 15 Jan '13

15 Jan '13

Dear gentleman/madam, as you may be aware i am having hard times trying to get qmail+ldap working on my OpenBSD 5.2 amd64. While after installation OLDAP works 100% (I am using BDB as backend). When i start qmail, every query sent by qmail to the OLDAP server increases memory up to a point OLDAP needs to be restarted. I emailed misc(a)openbsd.org. I got responses. Here i pass them to the OLDAP developer: After some advice from Mr. Quanah, i gave up BDB and would like to give MDB a try. Here is what i got from the misc(a)openbsd.org I believe the OLDAP developer should know: ---------- Forwarded message ---------- From: Stuart Henderson <stu(a)spacehopper.org> Date: Mon, Jan 14, 2013 at 8:47 PM Subject: Re: adding support to mdb To: Friedrich Locke <friedrich.locke(a)gmail.com> Cc: ports(a)openbsd.org On 2013/01/14 19:18, Friedrich Locke wrote: > Hi folks, > > this is my first message to this list. I am writing because i am in need to > use openldap from ports. > Initially i tried openldap with support to BDB, but it is buggy. > I was suggest to try mdb, but openldap's Makefile have the --disable-mdb > instruction. > > Since i do need to get a directory service and have no knownledge on > openldap internals, i come to you > in order to suggest how could i help in order to get mdb supported by > OpenBSD Ports OpenLDAP. > > Thank you a lot for your time and cooperation. > > Best regards, > > Fried. So this is a memory-mapped database; there have been problems with these in the past (e.g. in Cyrus imapd and Dovecot) but I am not sure of all the details. The port diff is easy enough but I would really like some advice from someone who is knowledgeable about the mmap issues as to whether or not it's safe to use this on OpenBSD. A bit more info from slides at http://www.openldap.org/pub/hyc/mdm-slides.pdf :- -- -- -- -- -- * Uses a read-only memory map * Protects the database structure from corruption due to stray writes in memory * Any attempts to write to the map will cause a SEGV, allowing immediate identification of software bugs * There's no point in making the pages writable anyway, since only existing pages may be written. Growing the database requires file ops (write, ftruncate) so for uniformity, file ops are also used for updates. -- -- -- -- -- I *think* the problems were only with mmap writes, if this is correct then they seem to be sidestepping the problems by doing this. BTW I'm using OpenLDAP 2.4 with BDB here and haven't noticed issues however it is not under extreme load..

2 1

Fwd: adding support to mdb
by Friedrich Locke 15 Jan '13

15 Jan '13

This one too. []s ---------- Forwarded message ---------- From: Stuart Henderson <stu(a)spacehopper.org> Date: Tue, Jan 15, 2013 at 6:41 AM Subject: Re: adding support to mdb To: Friedrich Locke <friedrich.locke(a)gmail.com> On 2013/01/14 21:31, Friedrich Locke wrote: > Hi! > > people from openldap group have already migrated to mdb. > Why OpenBSD has such problems. On other OSes, things work nicely. > BTW, no offense, i do like obsd, but things like make me upset. I suspect that the MDB code probably requires something from the OS that OpenBSD doesn't have (coherent buffer and page caches - http://utcc.utoronto.ca/~cks/space/blog/unix/UnifiedCacheMmap) If I'm correct then it will appear to work, but with a risk of database corruption. For this reason I won't enable this in the OpenLDAP port unless someone who knows the area well is satisfied that it's safe. Some other database code which likes to use mmap (e.g. cyrus skiplist) takes into account the various types of cache behaviour and has options to avoid using mmap. It doesn't appear that MDB has this yet.

1 0

Re: slapd crashes with ch_realloc of X bytes failed
by Meike Stone 15 Jan '13

15 Jan '13

>> >>> From slapd.conf/cn=config: >>> a) cachesize setting >>> b) idlcachesize setting >>> c) dncachesize setting >> >> >> cachesize 750000 >> dncachesize 750000 >> idlcachesize 2250000 >> >> Thanks and best regards > > > Your settings here don't make a lot of sense. > > I would try > cachesize 1500000 > dncachesize 0 (or leave it unset) > idlcachesize 3000000 > Yes, I know this values are very low in my configuration, but if I have problems with the memory, should I increase the caches that use this memory? In the last thread , you confirmed, that if I increasing the DB cachesize, the system is faster running out of memory. http://www.openldap.org/lists/openldap-technical/201211/msg00171.html ("ch_realloc means the system ran out of memory. Increasing the DB_CONFIG cachesize will run you out of memory more quickly.") To get the slapd a little bit more stable, I reduced this values (caches) to the posted in last message. Before i had: cachesize 1000000 dncachesize 1000000 idlcachesize 3000000 > Your current idlcachesize in particular may be part of the issue in addition > to your glibc setting. But the problem exist on the test system with tcmalloc too. So are 24GByte RAM for 1.500.000 DNs and 6GByte DB are not enough? During all time (especially the crash), there was enough physical (unallocated) memory free. But "slapd/malloc" tried to allocate more and more (as you can see in the post from 2013/01/12), but did not use it, no matter if glibc or tcmalloc I hope I interpreted it right?! Thanks Meike Btw.: I use a "special version" of openldap. Because of limited index slot of 65535, I changed in openldap-2.4.33.orig/include/ldap_pvt_thread.h from # define LDAP_PVT_THREAD_STACK_SIZE ( 1 * 1024 * 1024 * sizeof(void *) ) to # define LDAP_PVT_THREAD_STACK_SIZE ( 2 * 1024 * 1024 * sizeof(void *) ) and in openldap-2.4.33/servers/slapd/back-bdb/idl.h from #define BDB_IDL_LOGN 16 /* DB_SIZE is 2^16, UM_SIZE is 2^17 */ to #define BDB_IDL_LOGN 17 /* DB_SIZE is 2^17, UM_SIZE is 2^18 */ as Howard it recommended http://www.openldap.org/lists/openldap-technical/201101/msg00095.html Maybe this could be the problem?? My changes are available under: https://build.opensuse.org/package/show?expand=0&package=openldap2&project=…

2 1

Using smbtools an create account
by rodrigo tavares 15 Jan '13

15 Jan '13

Hello People. I have a samba server and LDAP, it´s running, but i put the slap replicate, come this error: root@replica:/etc/smbldap-tools# smbldap-useradd -a ola Error: shadow context; no update referral at /usr/share/perl5/smbldap_tools.pm line 1187. If I remove config slap replicate is run. syncrepl rid=123 provider=ldap://10.65.11.250:389 type=refreshOnly interval=00:00:05:00 retry="60 30 300 +" searchbase="dc=net,dc=mg,dc=gov,dc=br" filter="(objectClass=*)" scope=sub attrs="*,+" schemachecking=off bindmethod=simple binddn="cn=admin,dc=net,dc=mg,dc=gov,dc=br" credentials=secret Any idea ? Rodrigo Faria

2 4

Re: kernel: slapd[7962]: segfault
by Quanah Gibson-Mount 14 Jan '13

14 Jan '13

--On Tuesday, January 15, 2013 11:43 AM +0530 Pawan Kamboj <pawank.kamboj(a)gmail.com> wrote: > > Is there any fixes for time being? > Keep replies to the list. You need to understand you're running a piece of software that is several years old, for which support ended a few years ago. Even then 2.3.43 was the last release of the 2.3 series. So you are running an ancient version of OpenLDAP with numerous known problems. Any help is going to require you to upgrade to a supported release. If you want to pay for help, you could try Symas perhaps: <http://www.symas.com> --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

kernel: slapd[7962]: segfault
by Pawan Kamboj 14 Jan '13

14 Jan '13

Hi Team, SLAPD is crashing with the throwing following error. ldap1p kernel: slapd[7962]: segfault at 0000000000000008 rip 000000000044cef0 rsp 000000004169c528 error 4 We are using the following version of openldap and bdb. Openldap 2.3.32 DB.4.5 Any help? Regards Pawan Kamboj

2 1

Re: pthread lock failed: Resource deadlock avoided
by Chandrashekar Kola 14 Jan '13

14 Jan '13

Linux version: Linux version 2.6.18-194.el5 *Regards,* *Chandrashekar kola,* *408-666-2814* On Mon, Jan 14, 2013 at 7:37 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, January 14, 2013 7:13 PM -0800 Chandrashekar Kola < > chandrashekar.kola(a)gmail.com> wrote: > > >> What version of BDB is OpenLDAP compiled against? >>> >> BDB version is 4.3.29 >> > > BDB 4.3 has been known to be buggy for years. You should use something > recent. > > > What version of OpenLDAP 2.4? >>> >> OpenLDAP 2.4.22 >> > > Use a real version of OpenLDAP > > What OS? >> > > You still didn't answer this. > > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: pthread lock failed: Resource deadlock avoided
by Chandrashekar Kola 14 Jan '13

14 Jan '13

Hi Quanah, Thank you for quick reply. Here are the details. > Have you checked your lock/lockers/lock object settings? 112 Last allocated locker ID 0x7fffffff Current maximum unused locker ID 9 Number of lock modes 1500 Maximum number of locks possible 1500 Maximum number of lockers possible 1500 Maximum number of lock objects possible 40 Number of lock object partitions 8 Number of current locks 445 Maximum number of locks at any one time 12 Maximum number of locks in any one bucket 0 Maximum number of locks stolen by for an empty partition 0 Maximum number of locks stolen for any one partition 90 Number of current lockers 115 Maximum number of lockers at any one time 8 Number of current lock objects 226 Maximum number of lock objects at any one time 3 Maximum number of lock objects in any one bucket 0 Maximum number of objects stolen by for an empty partition 0 Maximum number of objects stolen for any one partition 10M Total number of locks requested (10526725) 10M Total number of locks released (10518219) 0 Total number of locks upgraded 18 Total number of locks downgraded 8766 Lock requests not available due to conflicts, for which we waited 7739 Lock requests not available due to conflicts, for which we did not wait 759 Number of deadlocks 0 Lock timeout value 0 Number of locks that have timed out 0 Transaction timeout value 0 Number of transactions that have timed out 1MB 224KB The size of the lock region 3663 The number of partition locks that required waiting (0%) 243 The maximum number of times any partition lock was waited for (0%) 0 The number of object queue operations that required waiting (0%) 675 The number of locker allocations that required waiting (0%) 0 The number of region locks that required waiting (0%) 3 Maximum hash bucket length > What version of BDB is OpenLDAP compiled against? BDB version is 4.3.29 > What version of OpenLDAP 2.4? OpenLDAP 2.4.22 What OS? *Regards,* *Chandrashekar kola,* *408-666-2814* On Mon, Jan 14, 2013 at 5:50 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, January 14, 2013 5:08 PM -0800 Chandrashekar Kola < > chandrashekar.kola(a)gmail.com> wrote: > > Hello, >> >> We have a openldap running on version 2.4, recently we started seeing >> these kind of error messages in ldap.log. >> > > Have you checked your lock/lockers/lock object settings? > > What version of BDB is OpenLDAP compiled against? > > What version of OpenLDAP 2.4? > > What OS? > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

pthread lock failed: Resource deadlock avoided
by Chandrashekar Kola 14 Jan '13

14 Jan '13

Hello, We have a openldap running on version 2.4, recently we started seeing these kind of error messages in ldap.log. Jan 14 04:03:03 ldap-cl-node02-vm slapd2.4[32455]: bdb(o=foo): pthread lock failed: Resource deadlock avoided Jan 14 04:03:03 ldap-cl-node02-vm slapd2.4[32455]: bdb(o=foo): PANIC: Resource deadlock avoided Jan 14 04:03:03 ldap-cl-node02-vm slapd2.4[32455]: => bdb_idl_insert_key: c_put id failed: DB_RUNRECOVERY: Fatal error, run database recovery (-30974) Jan 14 04:03:03 ldap-cl-node02-vm slapd2.4[32455]: bdb(o=foo): PANIC: fatal region error detected; run recovery Jan 14 04:03:03 ldap-cl-node02-vm slapd2.4[32455]: conn=23402078 op=6: attribute "entryCSN" index add failure This happened today morning and after restarting, it's started working fine for few hours. And then we saw these error messages in the logs, and crashed again. Jan 14 13:35:15 ldap-cl-node02-vm slapd2.4[1397]: bdb(o=foo): PANIC: Invalid argument Jan 14 13:35:15 ldap-cl-node02-vm slapd2.4[1397]: => bdb_idl_insert_key: c_put id failed: DB_RUNRECOVERY: Fatal error, run database recovery (-30974) Jan 14 13:35:15 ldap-cl-node02-vm slapd2.4[1397]: bdb(o=foo): PANIC: fatal region error detected; run recovery Did anybody face this issue, and what will be the resolution. Please help me. *Regards,* chandu

2 1

pthread lock failed: Resource deadlock avoided
by Chandrashekar Kola 14 Jan '13

14 Jan '13

Hello, We have a openldap running on version 2.4, recently we started seeing these kind of error messages in ldap.log. Jan 14 04:03:03 ldap-cl-node02-vm slapd2.4[32455]: bdb(o=foo): pthread lock failed: Resource deadlock avoided Jan 14 04:03:03 ldap-cl-node02-vm slapd2.4[32455]: bdb(o=foo): PANIC: Resource deadlock avoided Jan 14 04:03:03 ldap-cl-node02-vm slapd2.4[32455]: => bdb_idl_insert_key: c_put id failed: DB_RUNRECOVERY: Fatal error, run database recovery (-30974) Jan 14 04:03:03 ldap-cl-node02-vm slapd2.4[32455]: bdb(o=foo): PANIC: fatal region error detected; run recovery Jan 14 04:03:03 ldap-cl-node02-vm slapd2.4[32455]: conn=23402078 op=6: attribute "entryCSN" index add failure This happened today morning and after restarting, it's started working fine for few hours. And then we saw these error messages in the logs, and crashed again. Jan 14 13:35:15 ldap-cl-node02-vm slapd2.4[1397]: bdb(o=foo): PANIC: Invalid argument Jan 14 13:35:15 ldap-cl-node02-vm slapd2.4[1397]: => bdb_idl_insert_key: c_put id failed: DB_RUNRECOVERY: Fatal error, run database recovery (-30974) Jan 14 13:35:15 ldap-cl-node02-vm slapd2.4[1397]: bdb(o=foo): PANIC: fatal region error detected; run recovery Did anybody face this issue, and what will be the resolution. Please help me. *Regards,* *Chandrashekar kola,* *408-666-2814*

1 0

Re: slapd crashes with ch_realloc of X bytes failed
by Meike Stone 14 Jan '13

14 Jan '13

2013/1/14 Quanah Gibson-Mount <quanah(a)zimbra.com>: > > > Sorry, I don't have your configuration memorized. Generally, you should > list: Oops sorry, I used my gmail account and did not see, that the thread in the mailing list is "broken".. Here are all posted informations from my production system http://www.openldap.org/lists/openldap-technical/201211/msg00164.html > > memory allocator (should be tcmalloc, if you've set that up correctly) In the test system yes (us see it in the pmaps), but on production, I use glibc. > > DB Information: > a) Total number of DNs in your database about 1.500.000 > b) DB_CONFIG settings set_cachesize 2 0 1 set_lg_regionmax 262144 set_lg_bsize 2097152 set_flags DB_LOG_AUTOREMOVE > c) Size of database on disk: du -c -h *.bdb 27M MyActivateTime.bdb 8.0K MyClassName.bdb 30M MyDeletedTime.bdb 14M MyInsertDate.bdb 92K MyJpeg.bdb 1.9M MyKey.bdb 2.2M MyLanguage.bdb 184K MyPhoneNumber.bdb 38M MyPk.bdb 14M MyPId.bdb 5.4M MyPIfId.bdb 9.4M MyProductTyp.bdb 140K MyProperty.bdb 2.5M MySystemFlag.bdb 22M MyUserName.bdb 184K MyVId.bdb 428M cn.bdb 728M dn2id.bdb 37M entryCSN.bdb 39M entryUUID.bdb 4.0G id2entry.bdb 6.2M objectClass.bdb 5.4G total > From slapd.conf/cn=config: > a) cachesize setting > b) idlcachesize setting > c) dncachesize setting cachesize 750000 dncachesize 750000 idlcachesize 2250000 Thanks and best regards Meike

2 1

Re: Replication not working
by Quanah Gibson-Mount 14 Jan '13

14 Jan '13

--On Sunday, January 13, 2013 1:37 AM +0530 anil beniwal <beni.anil(a)gmail.com> wrote: > > Hi Quanah > > I will be highly thankful to you, if you can help me out in below issue. > > We have three servers on rhel 6.3, 16 vcpu and 32G RAM , openldap 2.4.33 > with mdb db of 200G a) Keep messages to the list b) Use delta-syncrepl for MMR c) Grab the latest RE24 code --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: Memory usage with bdb
by Friedrich Locke 14 Jan '13

14 Jan '13

Quanah, i would like to have ti fully functional on OpenBSD 5.2. I have no coding skill nor understand technically how ldap works. How may we get in touch with OpenLDAP developer to let them know about this problem ? Since you are baffled. Probably, the OpenLDAP should be aware about this problem. []s On Mon, Jan 14, 2013 at 4:33 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, January 14, 2013 3:45 PM -0200 Friedrich Locke < > friedrich.locke(a)gmail.com> wrote: > > Sorry. >> >> Here you have it: >> > > If further information is necessary, let me know! >> > > Thanks. I have to say I'm pretty baffled. I've never used OpenLDAP under > BSD, but I wonder if there are issues with how BDB itself is built. For > Linux, there are particular flags you want to set to get it to work well. > > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: Memory usage with bdb
by Friedrich Locke 14 Jan '13

14 Jan '13

Sorry. Here you have it: On Mon, Jan 14, 2013 at 3:30 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, January 14, 2013 2:00 PM -0200 Friedrich Locke < > friedrich.locke(a)gmail.com> wrote: > > Some time ago, i send a message about slapd "eating" all my memory >> resource. >> >> Mr. Quanah asked me to provide more details. Here you have it: >> sioux@gustav$ uname -a >> OpenBSD gustav.cpd.ufv.br 5.2 GENERIC.MP#368 amd64 >> sioux@gustav$ >> >> sioux@gustav$ pkg_info | grep openldap >> openldap-client-2.4.31 Open source LDAP software (client) >> openldap-server-2.4.31p0 Open source LDAP software (server) >> sioux@gustav$ pkg_info | grep db >> cyrus-sasl-2.1.25p3-db4 RFC 2222 SASL (Simple Authentication and Security >> Layer) >> db-4.6.21v0 Berkeley DB package, revision 4 >> dbus-1.6.2p0v0 message bus system >> gdbm-1.8.3p0 GNU dbm >> iodbc-3.52.7 ODBC 3.x driver manager >> sioux@gustav$ >> > > You are still extremely vague in your details. > > How large is your DB on disk? (du -c -h *.bdb) > gustav# pwd /var/openldap-data gustav# du -c -h *.bdb 32.0K cn.bdb 32.0K dn2id.bdb 64.0K id2entry.bdb 32.0K mail.bdb 32.0K mailAlternateAddress.bdb 32.0K mailHost.bdb 32.0K objectClass.bdb 32.0K uid.bdb 288K total > What are your BDB settings in your DB_CONFIG file? > gustav# cat /var/openldap-data/DB_CONFIG # $OpenLDAP$ # Example DB_CONFIG file for use with slapd(8) BDB/HDB databases. # # See the Oracle Berkeley DB documentation # < http://www.oracle.com/technology/documentation/berkeley-db/db/ref/env/db_co… > # for detail description of DB_CONFIG syntax and semantics. # # Hints can also be found in the OpenLDAP Software FAQ # <http://www.openldap.org/faq/index.cgi?file=2> # in particular: # <http://www.openldap.org/faq/index.cgi?file=1075> # Note: most DB_CONFIG settings will take effect only upon rebuilding # the DB environment. # one 0.25 GB cache #set_cachesize 0 268435456 1 set_cachesize 0 16777216 1 # Data Directory #set_data_dir db # Transaction Log settings set_lg_regionmax 262144 set_lg_bsize 2097152 #set_lg_dir logs # Note: special DB_CONFIG flags are no longer needed for "quick" # slapadd(8) or slapindex(8) access (see their -q option). > What how many DNs are there in your database? > gustav# ldapsearch -D cn=oldap,dc=ufv,dc=br -W | grep dn: Enter LDAP Password: dn: dc=ufv,dc=br dn: ou=group,dc=ufv,dc=br dn: cn=its,ou=group,dc=ufv,dc=br dn: cn=asd,ou=group,dc=ufv,dc=br dn: cn=dba,ou=group,dc=ufv,dc=br dn: cn=wbx,ou=group,dc=ufv,dc=br dn: cn=alg,ou=group,dc=ufv,dc=br dn: cn=djb,ou=group,dc=ufv,dc=br dn: cn=nofiles,ou=group,dc=ufv,dc=br dn: cn=qmail,ou=group,dc=ufv,dc=br dn: cn=ftp,ou=group,dc=ufv,dc=br dn: cn=src,ou=group,dc=ufv,dc=br dn: cn=vmail,ou=group,dc=ufv,dc=br dn: cn=ord,ou=group,dc=ufv,dc=br dn: cn=adc,ou=group,dc=ufv,dc=br dn: cn=bod,ou=group,dc=ufv,dc=br dn: cn=frn,ou=group,dc=ufv,dc=br dn: ou=people,dc=ufv,dc=br dn: uid=sioux,ou=people,dc=ufv,dc=br dn: uid=mysql,ou=people,dc=ufv,dc=br dn: uid=oldap,ou=people,dc=ufv,dc=br dn: uid=dnscache,ou=people,dc=ufv,dc=br dn: uid=dnslog,ou=people,dc=ufv,dc=br dn: uid=tinydns,ou=people,dc=ufv,dc=br dn: uid=ftp,ou=people,dc=ufv,dc=br dn: uid=alias,ou=people,dc=ufv,dc=br dn: uid=qmaild,ou=people,dc=ufv,dc=br dn: uid=qmaill,ou=people,dc=ufv,dc=br dn: uid=qmailp,ou=people,dc=ufv,dc=br dn: uid=qmailq,ou=people,dc=ufv,dc=br dn: uid=qmailr,ou=people,dc=ufv,dc=br dn: uid=qmails,ou=people,dc=ufv,dc=br dn: uid=cvs,ou=people,dc=ufv,dc=br dn: uid=tftp,ou=people,dc=ufv,dc=br dn: uid=vmail,ou=people,dc=ufv,dc=br dn: uid=grios,ou=people,dc=ufv,dc=br dn: uid=vlobo,ou=people,dc=ufv,dc=br dn: ou=appsrv,dc=ufv,dc=br dn: cn=ypldap,ou=appsrv,dc=ufv,dc=br dn: cn=webprv,ou=appsrv,dc=ufv,dc=br dn: cn=mail,ou=appsrv,dc=ufv,dc=br gustav# Total: 41 > What is your total amount of RAM? > > Memory: 2GB > May be a few useful bits of information to have. > > If further information is necessary, let me know! > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

memory leak
by Friedrich Locke 14 Jan '13

14 Jan '13

Hi! Is anybody aware of memory leaks in OpenLDAP 2.4.31 ? My server is consuming memory. I have only around 16 users on my oldap implementation. Every search performed increase memory consumption. Any ideia ?

2 1

OpenLDAP SSL
by Andy Carlson 14 Jan '13

14 Jan '13

I am running an OpenLDAP server and I am attempting to get it set up with SSL. The service config appears to already be configured with port 636. I have added the Cert, CACert, and Key into the cn=config context using the three corresponding attributes. When I attempt to restart the slapd service it will not start up. I have done this on three other servers whose configuration is exactly the same and it worked perfectly. Any thoughts? Thanks much!!!, Andy Carlson Moody Bible Institute Identity Administrator | Information Systems 312-329-4385 www.moody.edu<http://www.moody.edu>

3 2

Re: Memory usage with bdb
by Friedrich Locke 14 Jan '13

14 Jan '13

Some time ago, i send a message about slapd "eating" all my memory resource. Mr. Quanah asked me to provide more details. Here you have it: sioux@gustav$ uname -a OpenBSD gustav.cpd.ufv.br 5.2 GENERIC.MP#368 amd64 sioux@gustav$ sioux@gustav$ pkg_info | grep openldap openldap-client-2.4.31 Open source LDAP software (client) openldap-server-2.4.31p0 Open source LDAP software (server) sioux@gustav$ pkg_info | grep db cyrus-sasl-2.1.25p3-db4 RFC 2222 SASL (Simple Authentication and Security Layer) db-4.6.21v0 Berkeley DB package, revision 4 dbus-1.6.2p0v0 message bus system gdbm-1.8.3p0 GNU dbm iodbc-3.52.7 ODBC 3.x driver manager sioux@gustav$ So: Why is this happening ? On Thu, Nov 1, 2012 at 3:02 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, November 01, 2012 2:24 PM -0200 Friedrich Locke < > friedrich.locke(a)gmail.com> wrote: > > Is anyone aware of any buggy in openldap+bdb related to memory usage? >> Have anyone here using this type of backend ? Any problem to report? >> > > No. Yes. No. > > I would suggest you provide some more detailed information as to what, if > any, problem you feel you are experiencing. This email is quite vague. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

openbsd+ldap+qmail: a nightmare
by Friedrich Locke 14 Jan '13

14 Jan '13

Hi folks, i have been walking around and now i need to get qmail+ldap+openbsd working. I could configure everything, as usual openbsd runs rock solid. But i believe openldap does not like openbsd somehow. That's what i want to figure it out. The point is: i have just setted up obsd+oldap+qmail. I am trying to send a message for the only user i have in the tree: somehow, i don't know why is "eating" all my system memory. I am really curious why it happens on OBSD. I am running amd64 5.2, but i remenber to have given up some time ago when the obsd version was not 5.2. When i issue ldapsearch not memory increase is realized. The problem remains even with the 5.2 version. Some information is provided below : sioux@gustav$ uname -a OpenBSD gustav.cpd.ufv.br 5.2 GENERIC.MP#368 amd64 sioux@gustav$ pkg_info | grep openldap openldap-client-2.4.31 Open source LDAP software (client) openldap-server-2.4.31p0 Open source LDAP software (server) sioux@gustav$ For the /etc/openldap/slapd.conf, here you have it: # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/qmail.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_hdb.la # moduleload back_ldap.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb #suffix "dc=my-domain,dc=com" suffix "dc=ufv,dc=br" #rootdn "cn=Manager,dc=my-domain,dc=com" rootdn "cn=oldap,dc=ufv,dc=br" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. #rootpw secret rootpw {SSHA}HBjSmSCbiE8J26EuDg3ULnSj2SmN1x5g # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/openldap-data # Indices to maintain index cn eq index objectClass eq index mail,mailalternateaddress,uid eq,sub index accountstatus,mailhost,deliverymode eq index default eq cachesize 4096 checkpoint 128 15 dbnosync dirtyread sasl-host gustav.cpd.ufv.br sasl-realm UFV.BR sasl-regexp uid=([^,]+),cn=UFV.BR,cn=gssapi,cn=auth uid=$1,ou=people,dc=ufv,dc=br limits dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" time=2048 size=16384 limits dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" time=2048 size=16384 limits dn.onelevel="ou=people,dc=ufv,dc=br" time=4 size=16384 ################################################################################ # access definition on ou=appsrv,dc=ufv,dc=br ################################################################################ access to dn.one="ou=appsrv,dc=ufv,dc=br" attrs=userPassword by self read by anonymous auth # by * none access to dn.one="ou=appsrv,dc=ufv,dc=br" by dn.one="ou=appsrv,dc=ufv,dc=br" read access to dn.base="ou=appsrv,dc=ufv,dc=br" attrs=entry by dn.one="ou=appsrv,dc=ufv,dc=br" read ################################################################################ # access definition on ou=group,dc=ufv,dc=br ################################################################################ access to dn.one="ou=group,dc=ufv,dc=br" by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by dn.one="ou=people,dc=ufv,dc=br" read access to dn.base="ou=group,dc=ufv,dc=br" attrs=entry by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by dn.one="ou=people,dc=ufv,dc=br" read ################################################################################ # access definition on ou=people,dc=ufv,dc=br ################################################################################ access to dn.one="ou=people,dc=ufv,dc=br" attrs=userPassword by self read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read by anonymous auth by * none access to dn.one="ou=people,dc=ufv,dc=br" attrs=uid,homeDirectory by self read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read access to dn.one="ou=people,dc=ufv,dc=br" attrs=cn,uidNumber,gidNumber,loginShell,gecos,description by self read by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read access to dn.one="ou=people,dc=ufv,dc=br" attrs=mail,mailMessageStore,mailAlternateAddress,qmailUID,qmailGID,mailHost,mailForwardingAddress,deliveryProgramPath,qmailDotMode,deliveryMode,mailReplyText,accountStatus,qmailAccountPurge,mailQuotaSize,mailQuotaCount,mailSizeMax by self read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read access to dn.one="ou=people,dc=ufv,dc=br" by self read by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read access to dn.base="ou=people,dc=ufv,dc=br" attrs=entry by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read ################################################################################ # access definition for the root (ufv.br) ################################################################################ access to dn.base="dc=ufv,dc=br" attrs=entry by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read ####################################################################### # Monitor database definitions ####################################################################### database monitor access to dn.subtree="cn=monitor" by dn.base="cn=oldap,dc=ufv,dc=br" read # by * none

1 0

authentication problems
by Friedrich Locke 12 Jan '13

12 Jan '13

Dear list member, i am trying to retrieve data from a openldap server. When i issue ldapsearch from local machine itself, every thing works ok, but when i try from a remote host, i got problems related to GSSAPI authentication. Here you have: sioux@gustav$ ldapsearch -D cn=ypldap,ou=appsrv,dc=ufv,dc=br -b uid=vlobo,ou=people,dc=ufv,dc=br -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <uid=vlobo,ou=people,dc=ufv,dc=br> with scope subtree # filter: (objectclass=*) # requesting: ALL # # vlobo, people, ufv.br dn: uid=vlobo,ou=people,dc=ufv,dc=br uid: vlobo objectClass: organizationalRole objectClass: posixAccount objectClass: qmailUser cn: Valter Lobo uidNumber: 2001 gidNumber: 2000 homeDirectory: /home/vlobo loginShell: /bin/sh gecos: Valter Lobo,,, # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 sioux@gustav$ ############################################################################ But when i try from a remote host (the same command line with -h option, of course): sioux@lion$ ldapsearch -D cn=ypldap,ou=appsrv,dc=ufv,dc=br -b ou=people,dc=ufv,dc=br -h gustav.cpd.ufv.br -W Enter LDAP Password: SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Miscellaneous failure (see text) (open(/tmp/krb5cc_1000): No such file or directory) sioux@lion$ What is it my mistaken ? Thanks in advance.

2 1

cluster
by Friedrich Locke 12 Jan '13

12 Jan '13

Hi! I am aware that openldap supports custering, but i have some doubts. Is this cluster based on a single write server/multiple read server ? Or i may have multiple read/write server ? Does an openldap cluster scales unlimited ? I mean: if I need more space or processing power, it is just to add a new server . I would like to use a configuration like: The space requirement would be spread over the number of servers; A client can connect to any node of the cluster for read/write operation; To increase space/processing power, just add a new node. Is that possible with openldap ? PS: keep in mind that there is a huge difference in allowing multiple write/read over a set of nodes that keep is own copy of the data and a set of nodes whose data is spread accross them all.

2 1

Re: ldap update ( 2.2 to 2.4)
by Dan White 11 Jan '13

11 Jan '13

>On Thu, Jan 10, 2013 at 12:34 PM, Dan White <dwhite(a)olp.net> wrote: > >> On 01/10/13 12:04 -0200, Bruno Furtado wrote: >> >>> Hi Folks! >>> >>> I'm newbie to LDAP and I received a mission to update the version. >>> >>> Today is running Openldap 2.2.23 and I need to update to OpenLDAP 2.4.28. >>> all update attempts failed. I observed that the new version have a >>> different method of configuration. >>> >>> What the best way to do this? >>> >> >> What error messages did you receive? >> >> You can use slaptest (with both -f and -F options) to convert your >> configuration to the newer configuration database format (see man >> slapd-config), although you can still use a slapd.conf based configuration. >> >> See chapters 10, 19, and appendix B of the OpenLDAP Administrator's Guide, >> and the man pages for slapcat/slapdd. You should dump the contents of your >> databases on the old system with slapcat, and slapadd them on the new >> installation. On 01/11/13 17:29 -0200, Bruno Furtado wrote: >Hi Dan, > >I tried both settings. > >This is the error message: > > 50f066f8 str2entry: invalid value for attributeType objectClass #1 >(syntax 1.3.6.1.4.1.1466.115.121.1.38) This error means that you have a value within your input, for an objectClass, which is invalid per rfc2252 and is not accepted by the newer version of slapd that you are using. Try to found out which entry in your input is causing the error. -- Dan White

1 0

Openldap Server Issue - ver-2.4.23 (Jun 22 2012 14:02:53)
by Arvind Navale 11 Jan '13

11 Jan '13

Hi There, Need help with resolving an configuration issue I am having with openldap server (OpenLDAP: slapd 2.4.23 (Jun 22 2012 14:02:53) ) running a CentOS-6.3 1. Have a openldap server setup with TLS running on CentOS-6.3 rpm -qa | grep ldap openldap-devel-2.4.23-26.el6.x86_64 python-ldap-2.3.10-1.el6.x86_64 apr-util-ldap-1.3.9-3.el6_0.1.x86_64 openldap-servers-2.4.23-26.el6.x86_64 openldap-2.4.23-26.el6.x86_64 openldap-clients-2.4.23-26.el6.x86_64 pam_ldap-185-11.el6.x86_64 ldapjdk-4.18-6.el6.x86_64 3. Have generated self signed server certificates using openssl command. openssl req -x509 -nodes -days 3650 -newkey rsa:1048 -keyout /etc/openldap/certs/server-key.pem -out /etc/openldap/certs/server-cert.pem 3. Have a CentOS-6.3 setup a openldap client and enable TLS. rpm -qa | grep ldap openldap-2.4.23-26.el6.x86_64 python-ldap-2.3.10-1.el6.x86_64 openldap-clients-2.4.23-26.el6.x86_64 apr-util-ldap-1.3.9-3.el6_0.1.x86_64 pam_ldap-185-11.el6.x86_64 4. When I try to login on a LDAP client, I am seeing following debugging messages in LDAP server side, >>> slap_listener(ldaps://:389/) daemon: listen=7, new connection on 14 daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: added 14r (active) listener=(nil) conn=1000 fd=14 ACCEPT from IP=xxx.xxx.xxx.xxxx:55585 (IP=0.0.0.0:389) daemon: activity on 2 descriptors daemon: activity on: 14r daemon: read active on 14 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(14) connection_get(14): got connid=1000 connection_read(14): checking for input on id=1000 TLS: file server-cert.pem does not end in [.0] - does not appear to be a CA certificate directory file with a properly hashed file name - skipping. TLS: file server-key.pem does not end in [.0] - does not appear to be a CA certificate directory file with a properly hashed file name - skipping. TLS: error: no server certificate: must specify a certificate for the server to use TLS: error: could not initialize moznss security context - error -5939:No more entries in the directory TLS: can't create ssl handle. connection_read(14): TLS accept failure error=-1 id=1000, closing connection_closing: readying conn=1000 sd=14 for close connection_close: conn=1000 sd=14 5. I generate the hash in the directory were the certs are and then try connecting again, see different slapd debugging messages conn=1001 fd=14 ACCEPT from IP=10.90.180.220:55586 (IP=0.0.0.0:389) daemon: activity on 1 descriptor daemon: activity on: 14r daemon: read active on 14 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(14) connection_get(14): got connid=1001 connection_read(14): checking for input on id=1001 TLS: error: could not initialize moznss security context - error -5925:The one-time function was previously called and failed. Its error code is no longer available TLS: can't create ssl handle. connection_read(14): TLS accept failure error=-1 id=1001, closing connection_closing: readying conn=1001 sd=14 for close connection_close: conn=1001 sd=14 daemon: removing 14 daemon: activity on 1 descriptor daemon: activity on: conn=1001 fd=14 closed (TLS negotiation failure) Is there any bug with the version of openldap I am using? Appreciate any and every help from any of the group member to resolve the issue. Thank you, anlinux.

2 1

setting rootpw for cn=monitor
by Chris Card 11 Jan '13

11 Jan '13

Hi all, I'm seeing an issue with setting the rootpw for the cn=monitor database and syncrepl replication (multi-master syncrepl). I am seeing this problem with openldap 2.4.31 at the moment, but I intend to upgrade to 2.4.34 when that becomes available. When I just have one LDAP server (ldap1 say), I can set the olcrootdn to cn=monitor and set the olcrootpw without any error, so I have something like: dn: olcDatabase={2}monitor,cn=config objectClass: olcDatabaseConfig olcDatabase: {2}monitor olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcSyncUseSubentry: FALSE olcMonitoring: FALSE olcRootPW: {SSHA}************** olcRootDN: cn=monitor When I create another LDAP server (ldap2 say) and set up multi-master syncrepl replication for cn=config between ldap1 and ldap2 I see an error in the slapd log on ldap2 like: olcRootPW: value #0: <olcRootPW> can only be set when rootdn is under suffix No olcSuffix is set for the cn=monitor database in the cn=config, but all the cn=monitor DNs are of the form cn=X,cn=Y,...,cn=monitor, so it seems that the suffix of the cn=monitor database is effectively cn=monitor. Any ideas? Chris

4 6

installing a new cacert - the transition
by Adam Wolfe 10 Jan '13

10 Jan '13

Greetings all. I am looking at having to install a new ca cert on our ldap server(s) and thus swapping out the client certs as well. This totals roughly 250 different machines. I am wondering as to the easiest way to go about this. Is there some grace period that can be set to allow me to relax and get to all the clients over a week's time? Or possibly the ability to use two certs? Then just slowly remove the old ones from the clients?

2 1

ldap update ( 2.2 to 2.4)
by Bruno Furtado 10 Jan '13

10 Jan '13

Hi Folks! I'm newbie to LDAP and I received a mission to update the version. Today is running Openldap 2.2.23 and I need to update to OpenLDAP 2.4.28. all update attempts failed. I observed that the new version have a different method of configuration. What the best way to do this? Best regards, -- Bruno Furtado

2 1

How to change a schema attribute definition or how to change the slapd configuration?
by Philip Colmer 10 Jan '13

10 Jan '13

I'm using OpenLDAP on Ubuntu 12.04. The installation of OpenLDAP automatically installs the schemas for core, cosine, nis and inetorgperson. In the nis schema, posixGroup is defined as structural but I need it to be auxiliary. Is it possible to change that definition? My database is completely empty - I've literally uninstalled OpenLDAP and then reinstalled it in an attempt to try and find a clean way of solving my problem. Alternatively - and perhaps better since I'm a bit worried about changing *just* that one thing - is it possible for me to export the slapd configuration in a way that I can then edit the configuration to replace nis with rfc2037bis and create everything afresh? Unfortunately, because the installation on Ubuntu does all of the slapd configuration automatically, I don't know what parameters are being specified. Many thanks for any help or suggestions provided. Philip

3 5

Re: LDAP - not starting
by Oshadha Gunawardena 09 Jan '13

09 Jan '13

Well I don't think so When I issue * netstat -lt | grep ldap* it shows nothing On Thu, Jan 10, 2013 at 7:01 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, January 10, 2013 6:29 AM +0530 Oshadha Gunawardena < > oshadha.rocky(a)gmail.com> wrote: > > >> >> >> >> >> >> >> Hi all, >> >> I myself is struggling to configure and starting up the openldap server >> (v 2.4.33). Every time I started the server >> >> service slapd start >> >> I'm getting this error - and it never starts >> > > Your output shows it started just fine. It looks like the status command > is broken. > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

LDAP - not starting
by Oshadha Gunawardena 09 Jan '13

09 Jan '13

Hi all, I myself is struggling to configure and starting up the openldap server (v 2.4.33). Every time I started the server *service slapd start* I'm getting this error - and it never starts check-config.sh[3003]: Configuration directory '/etc/openldap/slapd.d' does not exist. check-config.sh[3003]: Warning: Usage of a configuration file is obsolete! runuser[3006]: pam_unix(runuser:session): session opened for user ldap by (uid=0) runuser[3006]: pam_unix(runuser:session): session closed for user ldap slapd[3019]: @(#) $OpenLDAP: slapd 2.4.33 (Oct 31 2012 12:02:13) $ slapd[3021]: bdb_monitor_db_open: monitoring disabled; configure monitor database to enable slapd[3021]: slapd starting slapd[3021]: daemon: shutdown requested and initiated. slapd[3021]: slapd shutdown: waiting for 0 operations/tasks to finish slapd[3021]: slapd stopped. When I issue the *service slapd status* slapd.service - OpenLDAP Server Daemon Loaded: loaded (/usr/lib/systemd/system/slapd.service; disabled) Active: failed (Result: timeout) since Thu, 10 Jan 2013 06:21:30 +0530; 21s ago Process: 3019 ExecStart=/usr/sbin/slapd -u ldap -h ${SLAPD_URLS} $SLAPD_OPTIONS (code=exited, status=0/SUCCESS) Process: 3003 ExecStartPre=/usr/libexec/openldap/check-config.sh (code=exited, status=0/SUCCESS) CGroup: name=systemd:/system/slapd.service My slapd.conf file * **include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema database bdb suffix "dc=test,dc=lan" rootdn "cn=Manager,dc=test,dc=lan" rootpw {SSHA}6U9AkmiHv9XpWBDyD9fsjhtF/NC0wpiq directory /mydata/Downloads/ldap/ # Global Read ACL access to * by self write by * read # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret* My ldap.conf file * # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example,dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never TLS_CACERTDIR /etc/openldap/certs* I'm kind of new to LDAP and Openldap so appreciate some assistance Thanks, Oshadha.

2 1

syncrepl mirrormode with SSL/TLS issues
by Houston Ray 09 Jan '13

09 Jan '13

I am attempting to move my sycrepl with mirrormode configuration over to TLS using LDAPS (not starttls) and running into problems. Multimaster setup (2 servers) behind a VIP both RHEL 6.3 Openldap 2.4.23-26 still running the old slapd.conf method (apologies) There are 3 separate certificates ldap.mycompany.net, server01.mycompany.net, and server02.mycompany.net The primary certificate is used for running slapd, and the individual server certs are intended to allow syncrepl over ssl. My configurations for syncrepl/mirrormode are down below. I had success with non-ssl syncrepl/mirrormode. It worked great actually. Now I am attempting to get syncrepl/mirrormode working with SSL. What I observe is whichever slapd instance is the last to startup is the one that becomes a "Master" as if I was in a producer/consumer setup. Errors I am seeing are slapd[11995]: conn=1003 fd=13 ACCEPT from IP=<server1_IP>:56368 (IP= 0.0.0.0:636) slapd[11995]: connection_read(13): TLS accept failure error=-1 id=1003, closing slapd[11485]: slap_client_connect: URI=ldaps://server01.mycompany.netDN="cn=Admin,dc=mycompany,dc=net" ldap_sasl_bind_s failed (-1) slapd[11485]: do_syncrepl: rid=001 rc -1 retrying Server 1 configuration ************************* # Server1 synchronization settings serverID 1 syncrepl rid=002 provider=ldaps://server02.mycompany.net binddn="cn=Admin,dc=mycompany,dc=net" bindmethod=simple credentials=secret tls_cert=/etc/openldap/certs/server02.mycompany.net.pem tls_cacert=/etc/openldap/certs/Verisignbundle.crt tls_key=/etc/openldap/certs/server02.mycompany.net.key tls_reqcert=allow searchbase="dc=mycompany,dc=net" type=refreshAndPersist retry="5 5 300 +" timelimit=5 attrs="*,+" interval=00:00:05:00 schemachecking=off mirrormode on # Server1 synchronization overlay overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 # Server1 end ************************************************************************************************** Server 2 configuration ********************************* # Server2 syncronization settings serverID 2 syncrepl rid=001 provider=ldaps://server01.mycompany.net binddn="cn=Admin,dc=mycompany,dc=net" bindmethod=simple credentials=secret tls_cert=/etc/openldap/certs/server01.mycompany.net.pem tls_cacert=/etc/openldap/certs/Verisignbundle.crt tls_key=/etc/openldap/certs/server01.mycompany.net.key tls_reqcert=allow searchbase="dc=mycompany,dc=net" type=refreshAndPersist retry="5 5 300 +" timelimit=5 attrs="*,+" interval=00:00:05:00 schemachecking=off mirrormode on # Server02 synchronization overlay overlay syncprov syncprov-checkpoint 100 10 # Server2 end ************************************************************************************************** any help is greatly appreciated

2 1

Get machines in Base LDAP
by rodrigo tavares 09 Jan '13

09 Jan '13

Hello, I have in my smb.conf, the follow line is: add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody %u So, with the line machines get logon in domain, but machines come to /etc/passwd. I would like add all machines in LDAP, how I can to do it ? ldap admin dn = cn=admin,dc=brazil,dc=mg,dc=gov,dc=br ldap group suffix = ou=groups ldap machine suffix = ou=computers ldap passwd sync = yes ldap suffix = dc=brazil,dc=mg,dc=gov,dc=br ldap ssl = no ldap user suffix = ou=defensoria passdb backend = ldapsam:ldap://10.65.8.250 passdb backend = tdbsam hosts allow = 127.0.0.1, 10.65.8.0/255.255.252.0

2 1

slapd-ldap and backend errors
by John Madden 09 Jan '13

09 Jan '13

While setting up and testing new 2.4 infra (2.4.33), I've come across the situation where the proxy (slapd-ldap) doesn't pass LDAP_UNAVAILABLE back to the client when the backend slapd goes away. Is this behavior configurable on the proxy, something along the lines of chain-return-error? Example: connect to the backend slapd and ldapsearch a long-running query, then shut down slapd and the client provides the proper "error can't contact." Duplicate that behavior while searching against the proxy and you simply get a truncated list of entries with no errors. Thanks, John -- John Madden / Systems Engineer III Office of Technology / Ivy Tech Community College of Indiana Free Software is a matter of liberty, not price. To understand the concept, you should think of Free as in 'free speech,' not as in 'free beer.' -- Richard Stallman

2 2

access directive
by Friedrich Locke 09 Jan '13

09 Jan '13

Hi folks, i have just installed openldap and i am having trouble to understand access directive: I have 6 access rules : ################################################################################ # access definition on ou=people,dc=ufv,dc=br ################################################################################ access to dn.one="ou=people,dc=ufv,dc=br" attrs=userPassword by self read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read by anonymous auth by * none access to dn.one="ou=people,dc=ufv,dc=br" attrs=uid,homeDirectory by self read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read access to dn.one="ou=people,dc=ufv,dc=br" attrs=cn,uidNumber,gidNumber,loginShell,gecos,description by self read by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read access to dn.one="ou=people,dc=ufv,dc=br" attrs=mail,mailMessageStore,mailAlternateAddress,qmailUID,qmailGID,mailHost,mailForwardingAddress,deliveryProgramPath,qmailDotMode,deliveryMode,mailReplyText,accountStatus,qmailAccountPurge,mailQuotaSize,mailQuotaCount,mailSizeMax by self read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read access to dn.one="ou=people,dc=ufv,dc=br" by self read by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read access to dn.base="ou=people,dc=ufv,dc=br" by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read I have some rules, as you can see, giving acess to certain attributes of anything below (one level) ou=people,dc=ufv,dc=br. I have another rule given access to everything on the same level, this is the rule 5th. Everything works ok, for instance: sioux@gustav$ ldapsearch -b uid=sioux,ou=people,dc=ufv,dc=br homedirectory SASL/GSSAPI authentication started SASL username: sioux(a)UFV.BR SASL SSF: 56 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <uid=sioux,ou=people,dc=ufv,dc=br> with scope subtree # filter: (objectclass=*) # requesting: homedirectory # # sioux, people, ufv.br dn: uid=sioux,ou=people,dc=ufv,dc=br homeDirectory: /home/sioux # search result search: 5 result: 0 Success # numResponses: 2 # numEntries: 1 sioux@gustav$ But if i comment the 5th rule (I keep the others, giving access to the homedirectory attribute), it does not work: sioux@gustav$ ldapsearch -b uid=sioux,ou=people,dc=ufv,dc=br homedirectory SASL/GSSAPI authentication started SASL username: sioux(a)UFV.BR SASL SSF: 56 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <uid=sioux,ou=people,dc=ufv,dc=br> with scope subtree # filter: (objectclass=*) # requesting: homedirectory # # search result search: 5 result: 32 No such object # numResponses: 1 sioux@gustav$ Does anybody here know why ? Thanks in advance.

2 1

Re: MDB Newbie
by Kyle Smith 08 Jan '13

08 Jan '13

On Wed, Jan 2, 2013 at 5:00 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Wednesday, January 02, 2013 4:35 PM -0500 Kyle Smith < > alacer.cogitatus(a)gmail.com> wrote: > > >> Greetings and Salutations. >> >> >> December 20, I converted from bdb to mdb. Now my memory usage looks like >> this: http://faculty.ycp.edu/~**ksmith8/openldap_stats.png<http://faculty.ycp.edu/~ksmith8/openldap_stats.png> >> >> >> I am concerned with the graph for "superman". How can I start tracking >> down the usage and why almost 50% of my memory is being consumed. These 4 >> are in MMR and are 2.4.33 and are nearly exact in server specification. >> Thanks in advance! >> > > Memory is vague. Do you mean shared, resident, or virtual? Your graphs > don't illustrate which either. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > Memory in this case is Physical memory as reported by ubuntu top. %MEM is the column. I did a "du -c -h data.mdb" on each of the four. Superman is listed at 1.4GB, while the other 3 are at 185MB. Not quite sure why that one is so much bigger. Thanks in advance.

1 0

Re: Replication status
by anil beniwal 07 Jan '13

07 Jan '13

Dear It means my DR server is not in sync with other two servers dc1 and dc2. but i am able to do successful search of last added user on all the servers.(which i added only on dc1 server) On Mon, Jan 7, 2013 at 7:44 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, January 07, 2013 5:24 AM +0530 anil beniwal < > beni.anil(a)gmail.com> wrote: > > >> Hi >> >> We are having 3 openldap 2.4.33 servers on rhel 6.3 in MMR, below is my >> replication status for all of them. >> We have imported all the data on one server and copied same data to other >> 2 servers. >> > > DR >> contextCSN: 20130101132757.303803Z#000000#**000#000000 >> contextCSN: 20130102093855.341468Z#000000#**001#000000 >> contextCSN: 20130102050153.147891Z#000000#**002#000000 >> contextCSN: 20130102135821.337371Z#000000#**003#00000 >> > > #000# is the CSN created before MMR was set up, so there were no servers > with any server ID, i.e., one server with a server ID of zero. This > context CSN will never update. > > #001# is the CSN of the server with ServerID 1. > #002# is the CSN of the server with ServerID 2. > #003# is the CSN of the server with ServerID 3. > > The 001 through 003 CSNs will reflect the last time any of those servers > had a direct *not replicated* update. For testing if a server is up to > date, you want to compare all the CSNs to one another between the two > servers. > > I.e., you want CSN 001 to match CSN 001 on both servers. CSN 002 to match > CSN 002 on both servers. CSN 003 to CSN 003 on both servers. I wrote a > rather fun perl script for Zimbra to do this across a MMR setup. > > I will note that delta-syncrepl MMR remains the best option for > configuring MMR, as it is the least likely to end up with conflicts, unless > you run purely in MirrorMode. It also retains the bandwidth and write > throughput advantages it has with provider/replica replication as well. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

MirrorMode, delta syncrepl and memberof issues
by Al 07 Jan '13

07 Jan '13

Hi All - I'm having an issue with mirrormode replication (via delta syncrepl) and the memberof overlay. When a group membership is changed on the first node, slapd on the second node is crashing with the following error (as seen from running slapd with -d-1): slapd: memberof.c:1465: memberof_res_modify: Assertion `0' failed. If I disable either memberof or mirrormode, the change replicates correctly. This behavior happens on both bdb and mdb backends. Any thoughts on what that might mean? I am still in development, so I can try pretty much anything at this point - I appreciate any guidance that you can offer. Here are the important details: OpenLDAP 2.4.33 Redhat Linux 6.3 - x64 Server1 and Server2 are using the same configuration, minus the serverid and the syncrepl provider. here is server1's pertinent config: olcServerID: 1 ... olcSyncrepl: rid=000 provider=ldap://server1.xxx.xxx.com:389/ bindme thod=simple timeout=0 network-timeout=0 binddn="cn=ldapreplicator,xxx, xxx,xxx.com" credentials="secret" keepalive=0:0:0 starttls=critical filter="(objectclass=*)" searchbase="xxx.com" logfilter= "(&(objectClass=auditWriteObject)(reqResult=0))" logbase="cn=accesslog" scope =sub schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog olcMirrorMode: TRUE ... olcMemberOfRefInt: FALSE olcMemberOfGroupOC: groupOfUniqueNames olcMemberOfMemberAD: uniquemember Regards, Al

2 1

Replication status
by anil beniwal 06 Jan '13

06 Jan '13

Hi We are having 3 openldap 2.4.33 servers on rhel 6.3 in MMR, below is my replication status for all of them. We have imported all the data on one server and copied same data to other 2 servers. 1. I am not able to figure out why i am having 4th line in my DR server, while searching contextCSN, while we are having only 3 ldap servers 2. Why CSN values are different , while i am getting latest added record in search on all the servers. Before Adding user dc1 contextCSN: 20130101132757.303803Z#000000#000#000000 contextCSN: 20130106222129.577348Z#000000#001#000000 contextCSN: 20130102050153.147891Z#000000#002#000000 dc2 contextCSN: 20130101132757.303803Z#000000#000#000000 contextCSN: 20130106222129.577348Z#000000#001#000000 contextCSN: 20130102050153.147891Z#000000#002#000000 DR contextCSN: 20130101132757.303803Z#000000#000#000000 contextCSN: 20130106222129.577348Z#000000#001#000000 contextCSN: 20130102050153.147891Z#000000#002#000000 contextCSN: 20130102135821.337371Z#000000#003#000000 After adding User ( its reflecting on all the servers in search) DC 1 contextCSN: 20130101132757.303803Z#000000#000#000000 contextCSN: 20130102093855.341468Z#000000#001#000000 contextCSN: 20130102050153.147891Z#000000#002#000000 DC 2 contextCSN: 20130101132757.303803Z#000000#000#000000 contextCSN: 20130102093855.341468Z#000000#001#000000 contextCSN: 20130102050153.147891Z#000000#002#000000 DR contextCSN: 20130101132757.303803Z#000000#000#000000 contextCSN: 20130102093855.341468Z#000000#001#000000 contextCSN: 20130102050153.147891Z#000000#002#000000 contextCSN: 20130102135821.337371Z#000000#003#00000 -- Thanks&Regards Anil Beniwal

2 1

How to change the base dn after installation
by Onno van der Straaten 06 Jan '13

06 Jan '13

Hi, I have a simple directory setup with base dn dc=my-domain, dc=com. How can I change the base dn? I'm running the latest OpenLDAP version on Fedora 17. Thanks, Onno

2 1

How to create a directory admin group
by Onno van der Straaten 06 Jan '13

06 Jan '13

Hi, How can I define a admin group for my directory? Currently I have one admin account, the one that was created during installation, cn=Manager, dc=my-domain, dc=com. I would like to create a group for example cn=ldap-admins,dc=my-domain,dc=com and then make users member of this group to grant them privilege to do admin work on the directory similar to cn=Manager. I suppose I have to add access rules. But where and how I don't know. Thanks, Onno

2 1

Bind failing with "critical extension is unavailable" error when used with pagedresultscontrol
by Cannady, Mike 05 Jan '13

05 Jan '13

I have a program that works with Microsoft LDAP that I'm trying to get to work with openldap. The program is from a third-party and I have NO access to the code. I was able to duplicate the behavior with Perl code (testPaged.pl) later in this email. The bind is to a domain that uses the BDB backend. If my test code ignores the error from bind, it does the paged results just fine. The problem is the third-party program stops if it sees the error in bind. I've captured network traffic to the Microsoft LDAP server and see that it generates NO error. The version I'm running is: [root@radius1 openldap]# slapd -V @(#) $OpenLDAP: slapd 2.4.23 (Jul 31 2012 10:47:00) $ mockbuild@x86-001.build.bos.redhat.com:/builddir/build/BUILD/openldap-2.4.23/openldap-2.4.23/build-servers/servers/slapd Is this a bug? I have the perl code, the debug run of the perl code, the slapd.d structure, dumps of the olcDatabase entries, and the results of "slapd -d -1" output. ##==============================================================testPaged.pl [mcannady@vmHTCradius1 ldap]$ cat testPaged.pl use Net::LDAP; use Net::LDAP::Control::Paged; use Net::LDAP::Constant qw( LDAP_CONTROL_PAGED ); ################################## sub ProcessSearch { my ( $msg, $result ) = @_; ## Nothing to do return if ( ! defined($result) ); if ( $result->isa("Net::LDAP::Reference") ) { ## a reference... just mention it. } else { $result->dump( ); print "\n"; } } ##################################### $ldap = Net::LDAP->new( "radius1.pbx.htc.internal" ); $page = Net::LDAP::Control::Paged->new( size => 10 , critical => true ); $mesg = $ldap->bind( "uid=NuPoint,dc=htc,dc=com", password => "XXXXXXX[redacted]XXXXXXXXXXX" , control => [ $page ] ); if ( $mesg->code ) { ## print error print "error on bind: ", $mesg->error(), "\n"; return; } @args = ( base => "cn=Users,dc=htc,dc=com", scope => "subtree", filter => "(objectClass=user)", callback => \&ProcessSearch, # Call this sub for each entry control => [ $page ], ); my $cookie; while(1) { # Perform search my $mesg = $ldap->search( @args ); # Only continue on LDAP_SUCCESS $mesg->code and last; # Get cookie from paged control my($resp) = $mesg->control( LDAP_CONTROL_PAGED ) or last; $cookie = $resp->cookie or last; # Set cookie in paged control $page->cookie($cookie); } if ($cookie) { # We had an abnormal exit, so let the server know we do not want any more $page->cookie($cookie); $page->size(0); $ldap->search( @args ); } [mcannady@vmHTCradius1 ldap]$ ##================================================================ perl debug-mode test [mcannady@vmHTCradius1 ldap]$ perl -d testPaged.pl Loading DB routines from perl5db.pl version 1.32 Editor support available. Enter h or `h h' for help, or `man perldebug' for more help. main::(testPaged.pl:20): $ldap = Net::LDAP->new( "radius1.pbx.htc.internal" ); DB<1> n main::(testPaged.pl:22): $page = Net::LDAP::Control::Paged->new( size => 10 , critical => true ); DB<1> n main::(testPaged.pl:24): $mesg = $ldap->bind( "uid=NuPoint,dc=htc,dc=com", main::(testPaged.pl:25): password => "XXXXXXXXX[redacted]XXXXXX" , main::(testPaged.pl:26): control => [ $page ] main::(testPaged.pl:27): ); DB<1> n main::(testPaged.pl:28): if ( $mesg->code ) { DB<1> n main::(testPaged.pl:30): print "error on bind: ", $mesg->error(), "\n"; DB<1> n error on bind: critical extension is unavailable main::(testPaged.pl:31): return; ##====================================================================================== [root@radius1 slapd.d]# find . -print . ./cn=config.ldif ./cn=config ./cn=config/cn=include{1}.ldif ./cn=config/cn=schema ./cn=config/cn=schema/cn={1}cosine.ldif ./cn=config/cn=schema/cn={4}ad.ldif ./cn=config/cn=schema/cn={2}inetorgperson.ldif ./cn=config/cn=schema/cn={3}nis.ldif ./cn=config/cn=schema/cn={0}core.ldif ./cn=config/cn=include{3}.ldif ./cn=config/olcDatabase={1}bdb.ldif ./cn=config/olcDatabase={2}bdb.ldif ./cn=config/olcDatabase={0}config.ldif ./cn=config/cn=schema.ldif ./cn=config/cn=include{2}.ldif ./cn=config/cn=include{0}.ldif ./cn=config/olcDatabase={3}monitor.ldif ./cn=config/olcDatabase={-1}frontend.ldif ##======================================================================================= ======================================================== cat olcDatabase={0}config.ldif dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,cn=config olcRootPW:: XXXredactedXXX structuralObjectClass: olcDatabaseConfig entryUUID: ac0d8a60-c861-1031-9bd4-5591ba7dfe32 creatorsName: cn=config createTimestamp: 20121121195915Z entryCSN: 20121121195915Z#000000#00#000000 modifiersName: cn=config modifyTimestamp: 20121121195915Z ======================================================== cat olcDatabase={1}bdb.ldif dn: olcDatabase={1}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcSuffix: dc=htc,dc=com olcAccess: {0}to * by dn.base="uid=push-master,cn=nupointproxy,dc=internal" w rite by * +0 break olcAccess: {1}to dn.base="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read olcAccess: {3}to dn.subtree="cn=monitor" by users read by * none olcAccess: {4}to * by self write by * read olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootPW:: XXXXXXXXXXXXXXXXXXXXredactedXXXXXXXXXXXX olcDbDirectory: /var/lib/ldap/htc.com olcDbCacheSize: 150000 olcDbCheckpoint: 102400 1 olcDbConfig: {0}set_cachesize 0 268435465 1 olcDbConfig: {1}set_lg_bsize 2097152 olcDbConfig: {2}set_lg_regionmax 262144 olcDbConfig: {3}set_flags DB_LOG_AUTOREMOVE olcDbNoSync: TRUE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 150000 olcDbIndex: objectClass pres,eq olcDbIndex: cn pres,eq,sub olcDbIndex: ou pres,eq,sub olcDbIndex: mail pres,eq,sub olcDbIndex: sn pres,eq,sub olcDbIndex: givenName pres,eq,sub olcDbLinearIndex: FALSE olcDbMode: 384 olcDbSearchStack: 16 olcDbShmKey: 12321 olcDbCacheFree: 1 structuralObjectClass: olcBdbConfig entryUUID: ac0da28e-c861-1031-9bd5-5591ba7dfe32 creatorsName: cn=config createTimestamp: 20121121195915Z olcRootDN: uid=Manager,dc=htc,dc=com olcUpdateDN: uid=Push-Master,cn=NupointProxy,dc=internal entryCSN: 20121212180425.846656Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20121212180425Z ======================================================== cat olcDatabase={-1}frontend.ldif dn: olcDatabase={-1}frontend objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcLastMod: TRUE olcMaxDerefDepth: 0 olcReadOnly: FALSE olcSchemaDN: cn=Subschema structuralObjectClass: olcDatabaseConfig entryUUID: ac0d771e-c861-1031-9bd3-5591ba7dfe32 creatorsName: cn=config createTimestamp: 20121121195915Z olcTimeLimit: unlimited olcSizeLimit: unlimited entryCSN: 20121214201101.233668Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20121214201101Z ======================================================== cat olcDatabase={2}bdb.ldif dn: olcDatabase={2}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcSuffix: dc=internal olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,cn=config olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/ldap/htc.internal olcDbCacheSize: 1000 olcDbCheckpoint: 100 63 olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 92ff370e-dcc9-1031-8a59-533cee5baf07 creatorsName: cn=config createTimestamp: 20121217191324Z entryCSN: 20121217191324.652465Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20121217191324Z ======================================================== cat olcDatabase={3}monitor.ldif dn: olcDatabase={3}monitor objectClass: olcDatabaseConfig olcDatabase: {3}monitor olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 54da1e50-d8df-1031-85bf-235d062b63b6 creatorsName: cn=config createTimestamp: 20121212193904Z entryCSN: 20121212193904.665758Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20121212193904Z ======================================================== Script started on Tue 18 Dec 2012 01:56:28 PM EST [root@radius1 openldap]# slapd -u ldap -d -1 @(#) $OpenLDAP: slapd 2.4.23 (Jul 31 2012 10:47:00) $ mockbuild@x86-001.build.bos.redhat.com:/builddir/build/BUILD/openldap-2.4.23/openldap-2.4.23/build-servers/servers/slapd ldap_pvt_gethostbyname_a: host=radius1.pbx.htc.internal, r=0 daemon_init: <null> daemon_init: listen on ldap:/// daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap:///) daemon: listener initialized ldap:/// daemon_init: 2 listeners opened ldap_create slapd init: initiated server. slap_sasl_init: initialized! bdb_back_initialize: initialize BDB backend bdb_back_initialize: Berkeley DB 4.7.25: (March 5, 2012) hdb_back_initialize: initialize HDB backend hdb_back_initialize: Berkeley DB 4.7.25: (March 5, 2012) null_back_initialize: initialize null backend backend_startup_one: starting "cn=config" ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config.ldif" => str2entry: "dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /etc/openldap/slapd.conf olcConfigDir: /etc/openldap/slapd.d olcAllows: bind_v2 olcArgsFile: /var/run/openldap/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcTLSCACertificateFile: /etc/pki/tls/certs/ca-bundle.crt olcTLSCertificateFile: /etc/pki/tls/certs/slapd.pem olcTLSCertificateKeyFile: /etc/pki/tls/certs/slapd.pem olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcLocalSSF: 71 olcLogLevel: Stats olcPidFile: /var/run/openldap/slapd.pid olcReadOnly: FALSE olcReplicationInterval: 0 olcReverseLookup: FALSE olcSaslHost: htcRadius1.htc.internal olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCRLCheck: none olcTLSVerifyClient: never olcToolThreads: 1 structuralObjectClass: olcGlobal entryUUID: ac065c7c-c861-1031-9bc9-5591ba7dfe32 creatorsName: cn=config createTimestamp: 20121121195915Z entryCSN: 20121121195915Z#000000#00#000000 modifiersName: cn=config modifyTimestamp: 20121121195915Z " >>> dnPrettyNormal: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnPrettyNormal: <cn=config>, <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(cn=config) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 olcTLSCRLCheck: value #0: keyword <TLSCRLCheck> ignored olcTLSCRLCheck: value #0: keyword <TLSCRLCheck> ignored olcReplicationInterval: value #0: <olcReplicationInterval> keyword is obsolete (ignored) ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=include{0}.ldif" => str2entry: "dn: cn=include{0} objectClass: olcIncludeFile cn: include{0} olcInclude: /etc/openldap/schema/core.schema structuralObjectClass: olcIncludeFile entryUUID: ac0c28d2-c861-1031-9bca-5591ba7dfe32 creatorsName: cn=config createTimestamp: 20121121195915Z entryCSN: 20121121195915Z#000000#00#000000 modifiersName: cn=config modifyTimestamp: 20121121195915Z " >>> dnPrettyNormal: <cn=include{0}> => ldap_bv2dn(cn=include{0},0) <= ldap_bv2dn(cn=include{0})=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=include{0})=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=include{0})=0 <<< dnPrettyNormal: <cn=include{0}>, <cn=include{0}> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(cn=include{0}) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "cn=include{0},cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=include{1}.ldif" => str2entry: "dn: cn=include{1} objectClass: olcIncludeFile cn: include{1} olcInclude: /etc/openldap/schema/cosine.schema structuralObjectClass: olcIncludeFile entryUUID: ac0c434e-c861-1031-9bcb-5591ba7dfe32 creatorsName: cn=config createTimestamp: 20121121195915Z entryCSN: 20121121195915Z#000000#00#000000 modifiersName: cn=config modifyTimestamp: 20121121195915Z " >>> dnPrettyNormal: <cn=include{1}> => ldap_bv2dn(cn=include{1},0) <= ldap_bv2dn(cn=include{1})=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=include{1})=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=include{1})=0 <<< dnPrettyNormal: <cn=include{1}>, <cn=include{1}> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(cn=include{1}) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "cn=include{1},cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=include{2}.ldif" => str2entry: "dn: cn=include{2} objectClass: olcIncludeFile cn: include{2} olcInclude: /etc/openldap/schema/inetorgperson.schema structuralObjectClass: olcIncludeFile entryUUID: ac0c54f6-c861-1031-9bcc-5591ba7dfe32 creatorsName: cn=config createTimestamp: 20121121195915Z entryCSN: 20121121195915Z#000000#00#000000 modifiersName: cn=config modifyTimestamp: 20121121195915Z " >>> dnPrettyNormal: <cn=include{2}> => ldap_bv2dn(cn=include{2},0) <= ldap_bv2dn(cn=include{2})=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=include{2})=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=include{2})=0 <<< dnPrettyNormal: <cn=include{2}>, <cn=include{2}> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(cn=include{2}) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "cn=include{2},cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=include{3}.ldif" => str2entry: "dn: cn=include{3} objectClass: olcIncludeFile cn: include{3} olcInclude: /etc/openldap/schema/nis.schema structuralObjectClass: olcIncludeFile entryUUID: ac0c6496-c861-1031-9bcd-5591ba7dfe32 creatorsName: cn=config createTimestamp: 20121121195915Z entryCSN: 20121121195915Z#000000#00#000000 modifiersName: cn=config modifyTimestamp: 20121121195915Z " >>> dnPrettyNormal: <cn=include{3}> => ldap_bv2dn(cn=include{3},0) <= ldap_bv2dn(cn=include{3})=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=include{3})=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=include{3})=0 <<< dnPrettyNormal: <cn=include{3}>, <cn=include{3}> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(cn=include{3}) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "cn=include{3},cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=schema.ldif" => str2entry: "dn: cn=schema objectClass: olcSchemaConfig cn: schema olcObjectIdentifier: OLcfg 1.3.6.1.4.1.4203.666.11.1 olcObjectIdentifier: OLcfgAt OLcfg:3 olcObjectIdentifier: OLcfgGlAt OLcfgAt:0 olcObjectIdentifier: OLcfgBkAt OLcfgAt:1 olcObjectIdentifier: OLcfgDbAt OLcfgAt:2 olcObjectIdentifier: OLcfgOvAt OLcfgAt:3 olcObjectIdentifier: OLcfgOc OLcfg:4 olcObjectIdentifier: OLcfgGlOc OLcfgOc:0 olcObjectIdentifier: OLcfgBkOc OLcfgOc:1 olcObjectIdentifier: OLcfgDbOc OLcfgOc:2 olcObjectIdentifier: OLcfgOvOc OLcfgOc:3 olcObjectIdentifier: OMsyn 1.3.6.1.4.1.1466.115.121.1 olcObjectIdentifier: OMsInteger OMsyn:27 olcObjectIdentifier: OMsBoolean OMsyn:7 olcObjectIdentifier: OMsDN OMsyn:12 olcObjectIdentifier: OMsDirectoryString OMsyn:15 olcObjectIdentifier: OMsOctetString OMsyn:40 olcAttributeTypes: ( 2.5.4.0 NAME 'objectClass' DESC 'RFC2256: object classes of the entity' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121 .1.38 ) olcAttributeTypes: ( 2.5.21.9 NAME 'structuralObjectClass' DESC 'X.500(93): st ructural object class of entry' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1 .4.1.1466.115.121.1.38 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOpera tion ) olcAttributeTypes: ( 2.5.18.1 NAME 'createTimestamp' DESC 'RFC2252: time which object was created' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOr deringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-MODIFIC ATION USAGE directoryOperation ) olcAttributeTypes: ( 2.5.18.2 NAME 'modifyTimestamp' DESC 'RFC2252: time which object was last modified' EQUALITY generalizedTimeMatch ORDERING generalized TimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-M ODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 2.5.18.3 NAME 'creatorsName' DESC 'RFC2252: name of creat or' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SING LE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 2.5.18.4 NAME 'modifiersName' DESC 'RFC2252: name of last modifier' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1. 12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 2.5.18.9 NAME 'hasSubordinates' DESC 'X.501: entry has ch ildren' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALU E NO-USER-MODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 2.5.18.10 NAME 'subschemaSubentry' DESC 'RFC2252: name of controlling subschema entry' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1. 4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperat ion ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.33 NAME 'entryDN' DESC 'DN of the entry' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 S INGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 1.3.6.1.1.16.4 NAME 'entryUUID' DESC 'UUID of the entry' EQUALITY UUIDMatch ORDERING UUIDOrderingMatch SYNTAX 1.3.6.1.1.16.1 SINGLE-VA LUE NO-USER-MODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.7 NAME 'entryCSN' DESC 'change seq uence number of the entry content' EQUALITY CSNMatch ORDERING CSNOrderingMatc h SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} SINGLE-VALUE NO-USER-MODIFICATION US AGE directoryOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.13 NAME 'namingCSN' DESC 'change s equence number of the entry naming (RDN)' EQUALITY CSNMatch ORDERING CSNOrder ingMatch SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} SINGLE-VALUE NO-USER-MODIFICA TION USAGE directoryOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.23 NAME 'syncreplCookie' DESC 'syn crepl Cookie for shadow copy' EQUALITY octetStringMatch ORDERING octetStringO rderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE NO-USER-MODIFI CATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.25 NAME 'contextCSN' DESC 'the lar gest committed CSN of a context' EQUALITY CSNMatch ORDERING CSNOrderingMatch SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} SINGLE-VALUE NO-USER-MODIFI>>> dnPrettyNormal: <cn=schema> => ldap_bv2dn(cn=schema,0) <= ldap_bv2dn(cn=schema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=schema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=schema)=0 <<< dnPrettyNormal: <cn=schema>, <cn=schema> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(cn=schema) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=schema/cn={0}core.ldif" => str2entry: "dn: cn={0}core objectClass: olcSchemaConfig cn: {0}core olcAttributeTypes: {0}( 2.5.4.2 NAME 'knowledgeInformation' DESC 'RFC2256: kno wledge information' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121. 1.15{32768} ) olcAttributeTypes: {1}( 2.5.4.4 NAME ( 'sn' 'surname' ) DESC 'RFC2256: last (f amily) name(s) for which the entity is known by' SUP name ) olcAttributeTypes: {2}( 2.5.4.5 NAME 'serialNumber' DESC 'RFC2256: serial numb er of the entity' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch S YNTAX 1.3.6.1.4.1.1466.115.121.1.44{64} ) olcAttributeTypes: {3}( 2.5.4.6 NAME ( 'c' 'countryName' ) DESC 'RFC2256: ISO- 3166 country 2-letter code' SUP name SINGLE-VALUE ) olcAttributeTypes: {4}( 2.5.4.7 NAME ( 'l' 'localityName' ) DESC 'RFC2256: loc ality which this object resides in' SUP name ) olcAttributeTypes: {5}( 2.5.4.8 NAME ( 'st' 'stateOrProvinceName' ) DESC 'RFC2 256: state or province which this object resides in' SUP name ) olcAttributeTypes: {6}( 2.5.4.9 NAME ( 'street' 'streetAddress' ) DESC 'RFC225 6: street address of this object' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreS ubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) olcAttributeTypes: {7}( 2.5.4.10 NAME ( 'o' 'organizationName' ) DESC 'RFC2256 : organization this object belongs to' SUP name ) olcAttributeTypes: {8}( 2.5.4.11 NAME ( 'ou' 'organizationalUnitName' ) DESC ' RFC2256: organizational unit this object belongs to' SUP name ) olcAttributeTypes: {9}( 2.5.4.12 NAME 'title' DESC 'RFC2256: title associated with the entity' SUP name ) olcAttributeTypes: {10}( 2.5.4.14 NAME 'searchGuide' DESC 'RFC2256: search gui de, deprecated by enhancedSearchGuide' SYNTAX 1.3.6.1.4.1.1466.115.121.1.25 ) olcAttributeTypes: {11}( 2.5.4.15 NAME 'businessCategory' DESC 'RFC2256: busin ess category' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTA X 1.3.6.1.4.1.1466.115.121.1.15{128} ) olcAttributeTypes: {12}( 2.5.4.16 NAME 'postalAddress' DESC 'RFC2256: postal a ddress' EQUALITY caseIgnoreListMatch SUBSTR caseIgnoreListSubstringsMatch SYN TAX 1.3.6.1.4.1.1466.115.121.1.41 ) olcAttributeTypes: {13}( 2.5.4.17 NAME 'postalCode' DESC 'RFC2256: postal code ' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4. 1.1466.115.121.1.15{40} ) olcAttributeTypes: {14}( 2.5.4.18 NAME 'postOfficeBox' DESC 'RFC2256: Post Off ice Box' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3 .6.1.4.1.1466.115.121.1.15{40} ) olcAttributeTypes: {15}( 2.5.4.19 NAME 'physicalDeliveryOfficeName' DESC 'RFC2 256: Physical Delivery Office Name' EQUALITY caseIgnoreMatch SUBSTR caseIgnor eSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) olcAttributeTypes: {16}( 2.5.4.20 NAME 'telephoneNumber' DESC 'RFC2256: Teleph one Number' EQUALITY telephoneNumberMatch SUBSTR telephoneNumberSubstringsMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.50{32} ) olcAttributeTypes: {17}( 2.5.4.21 NAME 'telexNumber' DESC 'RFC2256: Telex Numb er' SYNTAX 1.3.6.1.4.1.1466.115.121.1.52 ) olcAttributeTypes: {18}( 2.5.4.22 NAME 'teletexTerminalIdentifier' DESC 'RFC22 56: Teletex Terminal Identifier' SYNTAX 1.3.6.1.4.1.1466.115.121.1.51 ) olcAttributeTypes: {19}( 2.5.4.23 NAME ( 'facsimileTelephoneNumber' 'fax' ) DE SC 'RFC2256: Facsimile (Fax) Telephone Number' SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.22 ) olcAttributeTypes: {20}( 2.5.4.24 NAME 'x121Address' DESC 'RFC2256: X.121 Addr ess' EQUALITY numericStringMatch SUBSTR numericStringSubstringsMatch SYNTAX 1 .3.6.1.4.1.1466.115.121.1.36{15} ) olcAttributeTypes: {21}( 2.5.4.25 NAME 'internationaliSDNNumber' DESC 'RFC2256 : international ISDN number' EQUALITY numericStringMatch SUBSTR numericString SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.36{16} ) olcAttributeTypes: {22}( 2.5.4.26 NAME 'registeredAddress' DESC 'RFC2256: regi stered postal address' SUP postalAddress SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 ) olcAttributeTypes: {23}( 2.5.4.27 NAME 'destinationIndicator' DESC 'RFC2256: d estination indicator' EQUALITY caseIgnoreMatch SUBSTR cas>>> dnPrettyNormal: <cn={0}core> => ldap_bv2dn(cn={0}core,0) <= ldap_bv2dn(cn={0}core)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn={0}core)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn={0}core)=0 <<< dnPrettyNormal: <cn={0}core>, <cn={0}core> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(cn={0}core) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "cn={0}core,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=schema/cn={1}cosine.ldif" => str2entry: "dn: cn={1}cosine objectClass: olcSchemaConfig cn: {1}cosine olcAttributeTypes: {0}( 0.9.2342.19200300.100.1.2 NAME 'textEncodedORAddress' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1. 1466.115.121.1.15{256} ) olcAttributeTypes: {1}( 0.9.2342.19200300.100.1.4 NAME 'info' DESC 'RFC1274: g eneral information' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{2048} ) olcAttributeTypes: {2}( 0.9.2342.19200300.100.1.5 NAME ( 'drink' 'favouriteDri nk' ) DESC 'RFC1274: favorite drink' EQUALITY caseIgnoreMatch SUBSTR caseIgno reSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {3}( 0.9.2342.19200300.100.1.6 NAME 'roomNumber' DESC 'RFC1 274: room number' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch S YNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {4}( 0.9.2342.19200300.100.1.7 NAME 'photo' DESC 'RFC1274: photo (G3 fax)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.23{25000} ) olcAttributeTypes: {5}( 0.9.2342.19200300.100.1.8 NAME 'userClass' DESC 'RFC12 74: category of user' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {6}( 0.9.2342.19200300.100.1.9 NAME 'host' DESC 'RFC1274: h ost computer' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTA X 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {7}( 0.9.2342.19200300.100.1.10 NAME 'manager' DESC 'RFC127 4: DN of manager' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115 .121.1.12 ) olcAttributeTypes: {8}( 0.9.2342.19200300.100.1.11 NAME 'documentIdentifier' D ESC 'RFC1274: unique identifier of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {9}( 0.9.2342.19200300.100.1.12 NAME 'documentTitle' DESC ' RFC1274: title of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstri ngsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {10}( 0.9.2342.19200300.100.1.13 NAME 'documentVersion' DES C 'RFC1274: version of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSu bstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {11}( 0.9.2342.19200300.100.1.14 NAME 'documentAuthor' DESC 'RFC1274: DN of author of document' EQUALITY distinguishedNameMatch SYNTAX 1 .3.6.1.4.1.1466.115.121.1.12 ) olcAttributeTypes: {12}( 0.9.2342.19200300.100.1.15 NAME 'documentLocation' DE SC 'RFC1274: location of document original' EQUALITY caseIgnoreMatch SUBSTR c aseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {13}( 0.9.2342.19200300.100.1.20 NAME ( 'homePhone' 'homeTe lephoneNumber' ) DESC 'RFC1274: home telephone number' EQUALITY telephoneNumb erMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121 .1.50 ) olcAttributeTypes: {14}( 0.9.2342.19200300.100.1.21 NAME 'secretary' DESC 'RFC 1274: DN of secretary' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.146 6.115.121.1.12 ) olcAttributeTypes: {15}( 0.9.2342.19200300.100.1.22 NAME 'otherMailbox' SYNTAX 1.3.6.1.4.1.1466.115.121.1.39 ) olcAttributeTypes: {16}( 0.9.2342.19200300.100.1.26 NAME 'aRecord' EQUALITY ca seIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {17}( 0.9.2342.19200300.100.1.27 NAME 'mDRecord' EQUALITY c aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {18}( 0.9.2342.19200300.100.1.28 NAME 'mXRecord' EQUALITY c aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {19}( 0.9.2342.19200300.100.1.29 NAME 'nSRecord' EQUALITY c aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {20}( 0.9.2342.19200300.100.1.30 NAME 'sOARecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {21}( 0.9.2342.19200300.100.1.31 NAME 'cNAMERecord' EQUALIT Y caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {22}( 0.9.2342.19200300.100.1.38 NAM>>> dnPrettyNormal: <cn={1}cosine> => ldap_bv2dn(cn={1}cosine,0) <= ldap_bv2dn(cn={1}cosine)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn={1}cosine)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn={1}cosine)=0 <<< dnPrettyNormal: <cn={1}cosine>, <cn={1}cosine> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(cn={1}cosine) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "cn={1}cosine,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=schema/cn={2}inetorgperson.ldif" => str2entry: "dn: cn={2}inetorgperson objectClass: olcSchemaConfig cn: {2}inetorgperson olcAttributeTypes: {0}( 2.16.840.1.113730.3.1.1 NAME 'carLicense' DESC 'RFC279 8: vehicle license or registration plate' EQUALITY caseIgnoreMatch SUBSTR cas eIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {1}( 2.16.840.1.113730.3.1.2 NAME 'departmentNumber' DESC ' RFC2798: identifies a department within an organization' EQUALITY caseIgnoreM atch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {2}( 2.16.840.1.113730.3.1.241 NAME 'displayName' DESC 'RFC 2798: preferred name to be used when displaying entries' EQUALITY caseIgnoreM atch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SI NGLE-VALUE ) olcAttributeTypes: {3}( 2.16.840.1.113730.3.1.3 NAME 'employeeNumber' DESC 'RF C2798: numerically identifies an employee within an organization' EQUALITY ca seIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.15 SINGLE-VALUE ) olcAttributeTypes: {4}( 2.16.840.1.113730.3.1.4 NAME 'employeeType' DESC 'RFC2 798: type of employment for a person' EQUALITY caseIgnoreMatch SUBSTR caseIgn oreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {5}( 0.9.2342.19200300.100.1.60 NAME 'jpegPhoto' DESC 'RFC2 798: a JPEG image' SYNTAX 1.3.6.1.4.1.1466.115.121.1.28 ) olcAttributeTypes: {6}( 2.16.840.1.113730.3.1.39 NAME 'preferredLanguage' DESC 'RFC2798: preferred written or spoken language for a person' EQUALITY caseIg noreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1. 15 SINGLE-VALUE ) olcAttributeTypes: {7}( 2.16.840.1.113730.3.1.40 NAME 'userSMIMECertificate' D ESC 'RFC2798: PKCS#7 SignedData used to support S/MIME' SYNTAX 1.3.6.1.4.1.14 66.115.121.1.5 ) olcAttributeTypes: {8}( 2.16.840.1.113730.3.1.216 NAME 'userPKCS12' DESC 'RFC2 798: personal identity information, a PKCS #12 PFX' SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.5 ) olcObjectClasses: {0}( 2.16.840.1.113730.3.2.2 NAME 'inetOrgPerson' DESC 'RFC2 798: Internet Organizational Person' SUP organizationalPerson STRUCTURAL MAY ( audio $ businessCategory $ carLicense $ departmentNumber $ displayName $ em ployeeNumber $ employeeType $ givenName $ homePhone $ homePostalAddress $ ini tials $ jpegPhoto $ labeledURI $ mail $ manager $ mobile $ o $ pager $ photo $ roomNumber $ secretary $ uid $ userCertificate $ x500uniqueIdentifier $ pre ferredLanguage $ userSMIMECertificate $ userPKCS12 ) ) structuralObjectClass: olcSchemaConfig entryUUID: ac0d4294-c861-1031-9bd1-5591ba7dfe32 creatorsName: cn=config createTimestamp: 20121121195915Z entryCSN: 20121121195915Z#000000#00#000000 modifiersName: cn=config modifyTimestamp: 20121121195915Z " >>> dnPrettyNormal: <cn={2}inetorgperson> => ldap_bv2dn(cn={2}inetorgperson,0) <= ldap_bv2dn(cn={2}inetorgperson)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn={2}inetorgperson)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn={2}inetorgperson)=0 <<< dnPrettyNormal: <cn={2}inetorgperson>, <cn={2}inetorgperson> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(cn={2}inetorgperson) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "cn={2}inetorgperson,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=schema/cn={3}nis.ldif" => str2entry: "dn: cn={3}nis objectClass: olcSchemaConfig cn: {3}nis olcAttributeTypes: {0}( 1.3.6.1.1.1.1.2 NAME 'gecos' DESC 'The GECOS field; th e common name' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatc h SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {1}( 1.3.6.1.1.1.1.3 NAME 'homeDirectory' DESC 'The absolut e path to the home directory' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1 466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {2}( 1.3.6.1.1.1.1.4 NAME 'loginShell' DESC 'The path to th e login shell' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.2 6 SINGLE-VALUE ) olcAttributeTypes: {3}( 1.3.6.1.1.1.1.5 NAME 'shadowLastChange' EQUALITY integ erMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {4}( 1.3.6.1.1.1.1.6 NAME 'shadowMin' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {5}( 1.3.6.1.1.1.1.7 NAME 'shadowMax' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {6}( 1.3.6.1.1.1.1.8 NAME 'shadowWarning' EQUALITY integerM atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {7}( 1.3.6.1.1.1.1.9 NAME 'shadowInactive' EQUALITY integer Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {8}( 1.3.6.1.1.1.1.10 NAME 'shadowExpire' EQUALITY integerM atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {9}( 1.3.6.1.1.1.1.11 NAME 'shadowFlag' EQUALITY integerMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {10}( 1.3.6.1.1.1.1.12 NAME 'memberUid' EQUALITY caseExactI A5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1. 26 ) olcAttributeTypes: {11}( 1.3.6.1.1.1.1.13 NAME 'memberNisNetgroup' EQUALITY ca seExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.11 5.121.1.26 ) olcAttributeTypes: {12}( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple' DESC 'Netgr oup triple' SYNTAX 1.3.6.1.1.1.0.0 ) olcAttributeTypes: {13}( 1.3.6.1.1.1.1.15 NAME 'ipServicePort' EQUALITY intege rMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {14}( 1.3.6.1.1.1.1.16 NAME 'ipServiceProtocol' SUP name ) olcAttributeTypes: {15}( 1.3.6.1.1.1.1.17 NAME 'ipProtocolNumber' EQUALITY int egerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {16}( 1.3.6.1.1.1.1.18 NAME 'oncRpcNumber' EQUALITY integer Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {17}( 1.3.6.1.1.1.1.19 NAME 'ipHostNumber' DESC 'IP address ' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} ) olcAttributeTypes: {18}( 1.3.6.1.1.1.1.20 NAME 'ipNetworkNumber' DESC 'IP netw ork' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} SI NGLE-VALUE ) olcAttributeTypes: {19}( 1.3.6.1.1.1.1.21 NAME 'ipNetmaskNumber' DESC 'IP netm ask' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} SI NGLE-VALUE ) olcAttributeTypes: {20}( 1.3.6.1.1.1.1.22 NAME 'macAddress' DESC 'MAC address' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} ) olcAttributeTypes: {21}( 1.3.6.1.1.1.1.23 NAME 'bootParameter' DESC 'rpc.bootp aramd parameter' SYNTAX 1.3.6.1.1.1.0.1 ) olcAttributeTypes: {22}( 1.3.6.1.1.1.1.24 NAME 'bootFile' DESC 'Boot image nam e' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {23}( 1.3.6.1.1.1.1.26 NAME 'nisMapName' SUP name ) olcAttributeTypes: {24}( 1.3.6.1.1.1.1.27 NAME 'nisMapEntry' EQUALITY caseExac tIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121. 1.26{1024} SINGLE-VALUE ) olcObjectClasses: {0}( 1.3.6.1.1.1.2.0 NAME 'posixAccount' DESC 'Abstraction o f an account with POSIX attributes' SUP top AUXILIARY MUST ( cn $ uid $ uidNu mber $ gidNumber $ homeDirectory ) MAY ( userPassword $ loginShell $ gecos $ description ) ) olcObjectClasses: {1}( 1.3.6.1.1.1.2.1 NAME 'shadowAccount' DESC 'Additional a ttributes for shadow passwords'>>> dnPrettyNormal: <cn={3}nis> => ldap_bv2dn(cn={3}nis,0) <= ldap_bv2dn(cn={3}nis)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn={3}nis)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn={3}nis)=0 <<< dnPrettyNormal: <cn={3}nis>, <cn={3}nis> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(cn={3}nis) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "cn={3}nis,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=schema/cn={4}ad.ldif" => str2entry: "dn: cn={4}AD objectClass: olcSchemaConfig cn: {4}AD olcAttributeTypes: {0}( 1.2.840.113556.1.2.447 NAME 'mailNickname' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {1}( 1.2.840.113556.1.4.782 NAME 'objectCategory' SYNTA X 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE ) olcAttributeTypes: {2}( 1.2.840.113556.1.4.221 NAME 'sAMAccountName' SYNTA X 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) olcObjectClasses: {0}( 1.2.840.113556.1.5.9 NAME 'user' SUP organizational Person STRUCTURAL MAY ( objectCategory $ mailNickname $ sAMAccountName $ di splayName $ mail ) ) olcObjectClasses: {1}( 1.2.840.113556.1.3.23 NAME 'container' SUP top STRU CTURAL MUST cn ) structuralObjectClass: olcSchemaConfig entryUUID: 6feaa26c-cf6d-1031-986d-79eaa697be5e creatorsName: cn=config createTimestamp: 20121130191106Z entryCSN: 20121130191106Z#000000#00#000000 modifiersName: cn=config modifyTimestamp: 20121130191106Z " >>> dnPrettyNormal: <cn={4}AD> => ldap_bv2dn(cn={4}AD,0) <= ldap_bv2dn(cn={4}AD)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn={4}AD)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn={4}ad)=0 <<< dnPrettyNormal: <cn={4}AD>, <cn={4}ad> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(cn={4}AD) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "cn={4}AD,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/olcDatabase={-1}frontend.ldif" => str2entry: "dn: olcDatabase={-1}frontend objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcLastMod: TRUE olcMaxDerefDepth: 0 olcReadOnly: FALSE olcSchemaDN: cn=Subschema structuralObjectClass: olcDatabaseConfig entryUUID: ac0d771e-c861-1031-9bd3-5591ba7dfe32 creatorsName: cn=config createTimestamp: 20121121195915Z olcTimeLimit: unlimited olcSizeLimit: unlimited entryCSN: 20121214201101.233668Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20121214201101Z " >>> dnPrettyNormal: <olcDatabase={-1}frontend> => ldap_bv2dn(olcDatabase={-1}frontend,0) <= ldap_bv2dn(olcDatabase={-1}frontend)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={-1}frontend)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={-1}frontend)=0 <<< dnPrettyNormal: <olcDatabase={-1}frontend>, <olcDatabase={-1}frontend> >>> dnNormalize: <cn=Subschema> => ldap_bv2dn(cn=Subschema,0) <= ldap_bv2dn(cn=Subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=subschema)=0 <<< dnNormalize: <cn=subschema> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=admin,cn=config> => ldap_bv2dn(cn=admin,cn=config,0) <= ldap_bv2dn(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 <<< dnNormalize: <cn=admin,cn=config> <= str2entry(olcDatabase={-1}frontend) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "olcDatabase={-1}frontend,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 >>> dnPrettyNormal: <cn=Subschema> => ldap_bv2dn(cn=Subschema,0) <= ldap_bv2dn(cn=Subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=subschema)=0 <<< dnPrettyNormal: <cn=Subschema>, <cn=subschema> >>> dnPrettyNormal: <cn=Subschema> => ldap_bv2dn(cn=Subschema,0) <= ldap_bv2dn(cn=Subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=subschema)=0 <<< dnPrettyNormal: <cn=Subschema>, <cn=subschema> ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/olcDatabase={0}config.ldif" => str2entry: "dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,cn=config olcRootPW:: Y29uZmln structuralObjectClass: olcDatabaseConfig entryUUID: ac0d8a60-c861-1031-9bd4-5591ba7dfe32 creatorsName: cn=config createTimestamp: 20121121195915Z entryCSN: 20121121195915Z#000000#00#000000 modifiersName: cn=config modifyTimestamp: 20121121195915Z " >>> dnPrettyNormal: <olcDatabase={0}config> => ldap_bv2dn(olcDatabase={0}config,0) <= ldap_bv2dn(olcDatabase={0}config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={0}config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={0}config)=0 <<< dnPrettyNormal: <olcDatabase={0}config>, <olcDatabase={0}config> >>> dnNormalize: <cn=admin,cn=config> => ldap_bv2dn(cn=admin,cn=config,0) <= ldap_bv2dn(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 <<< dnNormalize: <cn=admin,cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(olcDatabase={0}config) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "olcDatabase={0}config,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 >>> dnPrettyNormal: <cn=admin,cn=config> => ldap_bv2dn(cn=admin,cn=config,0) <= ldap_bv2dn(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 <<< dnPrettyNormal: <cn=admin,cn=config>, <cn=admin,cn=config> >>> dnPrettyNormal: <cn=admin,cn=config> => ldap_bv2dn(cn=admin,cn=config,0) <= ldap_bv2dn(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 <<< dnPrettyNormal: <cn=admin,cn=config>, <cn=admin,cn=config> ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/olcDatabase={1}bdb.ldif" => str2entry: "dn: olcDatabase={1}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcSuffix: dc=htc,dc=com olcAccess: {0}to * by dn.base="uid=push-master,cn=nupointproxy,dc=internal" w rite by * +0 break olcAccess: {1}to dn.base="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read olcAccess: {3}to dn.subtree="cn=monitor" by users read by * none olcAccess: {4}to * by self write by * read olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootPW:: e1NIQX01ZW42RzZNZXpScm9UM1hLcWtkUE9tWS9CZlE9 olcDbDirectory: /var/lib/ldap/htc.com olcDbCacheSize: 150000 olcDbCheckpoint: 102400 1 olcDbConfig: {0}set_cachesize 0 268435465 1 olcDbConfig: {1}set_lg_bsize 2097152 olcDbConfig: {2}set_lg_regionmax 262144 olcDbConfig: {3}set_flags DB_LOG_AUTOREMOVE olcDbNoSync: TRUE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 150000 olcDbIndex: objectClass pres,eq olcDbIndex: cn pres,eq,sub olcDbIndex: ou pres,eq,sub olcDbIndex: mail pres,eq,sub olcDbIndex: sn pres,eq,sub olcDbIndex: givenName pres,eq,sub olcDbLinearIndex: FALSE olcDbMode: 384 olcDbSearchStack: 16 olcDbShmKey: 12321 olcDbCacheFree: 1 structuralObjectClass: olcBdbConfig entryUUID: ac0da28e-c861-1031-9bd5-5591ba7dfe32 creatorsName: cn=config createTimestamp: 20121121195915Z olcRootDN: uid=Manager,dc=htc,dc=com olcUpdateDN: uid=Push-Master,cn=NupointProxy,dc=internal entryCSN: 20121212180425.846656Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20121212180425Z " >>> dnPrettyNormal: <olcDatabase={1}bdb> => ldap_bv2dn(olcDatabase={1}bdb,0) <= ldap_bv2dn(olcDatabase={1}bdb)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={1}bdb)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={1}bdb)=0 <<< dnPrettyNormal: <olcDatabase={1}bdb>, <olcDatabase={1}bdb> >>> dnNormalize: <dc=htc,dc=com> => ldap_bv2dn(dc=htc,dc=com,0) <= ldap_bv2dn(dc=htc,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=htc,dc=com)=0 <<< dnNormalize: <dc=htc,dc=com> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <uid=Manager,dc=htc,dc=com> => ldap_bv2dn(uid=Manager,dc=htc,dc=com,0) <= ldap_bv2dn(uid=Manager,dc=htc,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=manager,dc=htc,dc=com)=0 <<< dnNormalize: <uid=manager,dc=htc,dc=com> >>> dnNormalize: <cn=admin,cn=config> => ldap_bv2dn(cn=admin,cn=config,0) <= ldap_bv2dn(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 <<< dnNormalize: <cn=admin,cn=config> <= str2entry(olcDatabase={1}bdb) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "olcDatabase={1}bdb,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 >>> dnPrettyNormal: <dc=htc,dc=com> => ldap_bv2dn(dc=htc,dc=com,0) <= ldap_bv2dn(dc=htc,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=htc,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=htc,dc=com)=0 <<< dnPrettyNormal: <dc=htc,dc=com>, <dc=htc,dc=com> >>> dnPrettyNormal: <uid=Manager,dc=htc,dc=com> => ldap_bv2dn(uid=Manager,dc=htc,dc=com,0) <= ldap_bv2dn(uid=Manager,dc=htc,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=Manager,dc=htc,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=manager,dc=htc,dc=com)=0 <<< dnPrettyNormal: <uid=Manager,dc=htc,dc=com>, <uid=manager,dc=htc,dc=com> >>> dnPrettyNormal: <uid=Push-Master,cn=NupointProxy,dc=internal> => ldap_bv2dn(uid=Push-Master,cn=NupointProxy,dc=internal,0) <= ldap_bv2dn(uid=Push-Master,cn=NupointProxy,dc=internal)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=Push-Master,cn=NupointProxy,dc=internal)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=push-master,cn=nupointproxy,dc=internal)=0 <<< dnPrettyNormal: <uid=Push-Master,cn=NupointProxy,dc=internal>, <uid=push-master,cn=nupointproxy,dc=internal> bdb_db_init: Initializing BDB database >>> dnPrettyNormal: <dc=htc,dc=com> => ldap_bv2dn(dc=htc,dc=com,0) <= ldap_bv2dn(dc=htc,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=htc,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=htc,dc=com)=0 <<< dnPrettyNormal: <dc=htc,dc=com>, <dc=htc,dc=com> >>> dnNormalize: <uid=push-master,cn=nupointproxy,dc=internal> => ldap_bv2dn(uid=push-master,cn=nupointproxy,dc=internal,0) <= ldap_bv2dn(uid=push-master,cn=nupointproxy,dc=internal)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=push-master,cn=nupointproxy,dc=internal)=0 <<< dnNormalize: <uid=push-master,cn=nupointproxy,dc=internal> Backend ACL: access to * by dn.base="uid=push-master,cn=nupointproxy,dc=internal" write by * +0 break /etc/openldap/slapd.d: line 1: warning: cannot assess the validity of the ACL scope within backend naming context >>> dnNormalize: <> <<< dnNormalize: <> Backend ACL: access to dn.base="" by * read /etc/openldap/slapd.d: line 1: warning: ACL appears to be out of scope within backend naming context >>> dnNormalize: <cn=subschema> => ldap_bv2dn(cn=subschema,0) <= ldap_bv2dn(cn=subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=subschema)=0 <<< dnNormalize: <cn=subschema> Backend ACL: access to dn.base="cn=subschema" by * read /etc/openldap/slapd.d: line 1: warning: ACL appears to be out of scope within backend naming context >>> dnNormalize: <cn=monitor> => ldap_bv2dn(cn=monitor,0) <= ldap_bv2dn(cn=monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=monitor)=0 <<< dnNormalize: <cn=monitor> Backend ACL: access to dn.subtree="cn=monitor" by users read by * none /etc/openldap/slapd.d: line 1: warning: ACL appears to be out of scope within backend naming context Backend ACL: access to * by self write by * read /etc/openldap/slapd.d: line 1: warning: cannot assess the validity of the ACL scope within backend naming context >>> dnPrettyNormal: <uid=Manager,dc=htc,dc=com> => ldap_bv2dn(uid=Manager,dc=htc,dc=com,0) <= ldap_bv2dn(uid=Manager,dc=htc,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=Manager,dc=htc,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=manager,dc=htc,dc=com)=0 <<< dnPrettyNormal: <uid=Manager,dc=htc,dc=com>, <uid=manager,dc=htc,dc=com> >>> dnPrettyNormal: <uid=Push-Master,cn=NupointProxy,dc=internal> => ldap_bv2dn(uid=Push-Master,cn=NupointProxy,dc=internal,0) <= ldap_bv2dn(uid=Push-Master,cn=NupointProxy,dc=internal)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=Push-Master,cn=NupointProxy,dc=internal)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=push-master,cn=nupointproxy,dc=internal)=0 <<< dnPrettyNormal: <uid=Push-Master,cn=NupointProxy,dc=internal>, <uid=push-master,cn=nupointproxy,dc=internal> index objectClass 0x0006 index cn 0x0716 index ou 0x0716 index mail 0x0716 index sn 0x0716 index givenName 0x0716 ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/olcDatabase={2}bdb.ldif" => str2entry: "dn: olcDatabase={2}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcSuffix: dc=internal olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,cn=config olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/ldap/htc.internal olcDbCacheSize: 1000 olcDbCheckpoint: 100 63 olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 92ff370e-dcc9-1031-8a59-533cee5baf07 creatorsName: cn=config createTimestamp: 20121217191324Z entryCSN: 20121217191324.652465Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20121217191324Z " >>> dnPrettyNormal: <olcDatabase={2}bdb> => ldap_bv2dn(olcDatabase={2}bdb,0) <= ldap_bv2dn(olcDatabase={2}bdb)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={2}bdb)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={2}bdb)=0 <<< dnPrettyNormal: <olcDatabase={2}bdb>, <olcDatabase={2}bdb> >>> dnNormalize: <dc=internal> => ldap_bv2dn(dc=internal,0) <= ldap_bv2dn(dc=internal)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=internal)=0 <<< dnNormalize: <dc=internal> >>> dnNormalize: <cn=admin,cn=config> => ldap_bv2dn(cn=admin,cn=config,0) <= ldap_bv2dn(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 <<< dnNormalize: <cn=admin,cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(olcDatabase={2}bdb) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "olcDatabase={2}bdb,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 >>> dnPrettyNormal: <dc=internal> => ldap_bv2dn(dc=internal,0) <= ldap_bv2dn(dc=internal)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=internal)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=internal)=0 <<< dnPrettyNormal: <dc=internal>, <dc=internal> >>> dnPrettyNormal: <cn=admin,cn=config> => ldap_bv2dn(cn=admin,cn=config,0) <= ldap_bv2dn(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 <<< dnPrettyNormal: <cn=admin,cn=config>, <cn=admin,cn=config> bdb_db_init: Initializing BDB database >>> dnPrettyNormal: <dc=internal> => ldap_bv2dn(dc=internal,0) <= ldap_bv2dn(dc=internal)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=internal)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=internal)=0 <<< dnPrettyNormal: <dc=internal>, <dc=internal> >>> dnPrettyNormal: <cn=admin,cn=config> => ldap_bv2dn(cn=admin,cn=config,0) <= ldap_bv2dn(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 <<< dnPrettyNormal: <cn=admin,cn=config>, <cn=admin,cn=config> ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/olcDatabase={3}monitor.ldif" => str2entry: "dn: olcDatabase={3}monitor objectClass: olcDatabaseConfig olcDatabase: {3}monitor olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 54da1e50-d8df-1031-85bf-235d062b63b6 creatorsName: cn=config createTimestamp: 20121212193904Z entryCSN: 20121212193904.665758Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20121212193904Z " >>> dnPrettyNormal: <olcDatabase={3}monitor> => ldap_bv2dn(olcDatabase={3}monitor,0) <= ldap_bv2dn(olcDatabase={3}monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={3}monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={3}monitor)=0 <<< dnPrettyNormal: <olcDatabase={3}monitor>, <olcDatabase={3}monitor> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(olcDatabase={3}monitor) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "olcDatabase={3}monitor,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 >>> dnPrettyNormal: <cn=Monitor> => ldap_bv2dn(cn=Monitor,0) <= ldap_bv2dn(cn=Monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=monitor)=0 <<< dnPrettyNormal: <cn=Monitor>, <cn=monitor> send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=0 matched="" text="" matching_rule_use_init 1.2.840.113556.1.4.804 (integerBitOrMatch): matchingRuleUse: ( 1.2.840.113556.1.4.804 NAME 'integerBitOrMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcChainMaxReferralDepth $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber ) ) 1.2.840.113556.1.4.803 (integerBitAndMatch): matchingRuleUse: ( 1.2.840.113556.1.4.803 NAME 'integerBitAndMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcChainMaxReferralDepth $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber ) ) 1.3.6.1.4.1.1466.109.114.2 (caseIgnoreIA5Match): matchingRuleUse: ( 1.3.6.1.4.1.1466.109.114.2 NAME 'caseIgnoreIA5Match' APPLIES ( altServer $ olcDbConfig $ mail $ dc $ associatedDomain $ email $ aRecord $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMailbox $ gecos $ homeDirectory $ loginShell $ memberUid $ memberNisNetgroup $ ipHostNumber $ ipNetworkNumber $ ipNetmaskNumber $ macAddress $ bootFile $ nisMapEntry ) ) 1.3.6.1.4.1.1466.109.114.1 (caseExactIA5Match): matchingRuleUse: ( 1.3.6.1.4.1.1466.109.114.1 NAME 'caseExactIA5Match' APPLIES ( altServer $ olcDbConfig $ mail $ dc $ associatedDomain $ email $ aRecord $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMailbox $ gecos $ homeDirectory $ loginShell $ memberUid $ memberNisNetgroup $ ipHostNumber $ ipNetworkNumber $ ipNetmaskNumber $ macAddress $ bootFile $ nisMapEntry ) ) 2.5.13.39 (certificateListMatch): 2.5.13.38 (certificateListExactMatch): matchingRuleUse: ( 2.5.13.38 NAME 'certificateListExactMatch' APPLIES ( authorityRevocationList $ certificateRevocationList $ deltaRevocationList ) ) 2.5.13.35 (certificateMatch): 2.5.13.34 (certificateExactMatch): matchingRuleUse: ( 2.5.13.34 NAME 'certificateExactMatch' APPLIES ( userCertificate $ cACertificate ) ) 2.5.13.30 (objectIdentifierFirstComponentMatch): matchingRuleUse: ( 2.5.13.30 NAME 'objectIdentifierFirstComponentMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ ldapSyntaxes $ supportedApplicationContext ) ) 2.5.13.29 (integerFirstComponentMatch): matchingRuleUse: ( 2.5.13.29 NAME 'integerFirstComponentMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcChainMaxReferralDepth $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber ) ) 2.5.13.27 (generalizedTimeMatch): matchingRuleUse: ( 2.5.13.27 NAME 'generalizedTimeMatch' APPLIES ( createTimestamp $ modifyTimestamp ) ) 2.5.13.24 (protocolInformationMatch): matchingRuleUse: ( 2.5.13.24 NAME 'protocolInformationMatch' APPLIES protocolInformation ) 2.5.13.23 (uniqueMemberMatch): matchingRuleUse: ( 2.5.13.23 NAME 'uniqueMemberMatch' APPLIES uniqueMember ) 2.5.13.22 (presentationAddressMatch): matchingRuleUse: ( 2.5.13.22 NAME 'presentationAddressMatch' APPLIES presentationAddress ) 2.5.13.20 (telephoneNumberMatch): matchingRuleUse: ( 2.5.13.20 NAME 'telephoneNumberMatch' APPLIES ( telephoneNumber $ homePhone $ mobile $ pager ) ) 2.5.13.17 (octetStringMatch): matchingRuleUse: ( 2.5.13.17 NAME 'octetStringMatch' APPLIES ( userPassword $ olcDbCryptKey ) ) 2.5.13.16 (bitStringMatch): matchingRuleUse: ( 2.5.13.16 NAME 'bitStringMatch' APPLIES x500UniqueIdentifier ) 2.5.13.14 (integerMatch): matchingRuleUse: ( 2.5.13.14 NAME 'integerMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcChainMaxReferralDepth $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber ) ) 2.5.13.13 (booleanMatch): matchingRuleUse: ( 2.5.13.13 NAME 'booleanMatch' APPLIES ( hasSubordinates $ olcAddContentAcl $ olcGentleHUP $ olcHidden $ olcLastMod $ olcMirrorMode $ olcMonitoring $ olcReadOnly $ olcReverseLookup $ olcSyncUseSubentry $ olcDbChecksum $ olcDbNoSync $ olcDbDirtyRead $ olcDbLinearIndex $ olcChainCacheURI $ olcChainReturnError $ olcDbRebindAsUser $ olcDbChaseReferrals $ olcDbProxyWhoAmI $ olcDbSingleConn $ olcDbUseTemporaryConn $ olcDbNoRefs $ olcDbNoUndefFilter ) ) 2.5.13.11 (caseIgnoreListMatch): matchingRuleUse: ( 2.5.13.11 NAME 'caseIgnoreListMatch' APPLIES ( postalAddress $ registeredAddress $ homePostalAddress ) ) 2.5.13.8 (numericStringMatch): matchingRuleUse: ( 2.5.13.8 NAME 'numericStringMatch' APPLIES ( x121Address $ internationaliSDNNumber ) ) 2.5.13.7 (caseExactSubstringsMatch): matchingRuleUse: ( 2.5.13.7 NAME 'caseExactSubstringsMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.6 (caseExactOrderingMatch): matchingRuleUse: ( 2.5.13.6 NAME 'caseExactOrderingMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.5 (caseExactMatch): matchingRuleUse: ( 2.5.13.5 NAME 'caseExactMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcInclude $ olcLdapSyntaxes $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLimit $ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTCPBuffer $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSCRLFile $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSProtocolMin $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbCryptFile $ olcDbPageSize $ olcDbIndex $ olcDbLockDetect $ olcDbMode $ olcChainingBehavior $ olcDbURI $ olcDbStartTLS $ olcDbNetworkTimeout $ olcDbQuarantine $ olcDbACLPasswd $ olcDbACLBind $ olcDbIDAssertPasswd $ olcDbIDAssertBind $ olcDbIDAssertMode $ olcDbIDAssertAuthzFrom $ olcDbTFSupport $ olcDbTimeout $ olcDbIdleTimeout $ olcDbConnTtl $ olcDbCancel $ olcDbIDAssertPassThru $ olcDbSocketPath $ olcDbSocketExtensions $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName $ destinationIndicator $ givenName $ initials $ generationQualifier $ dnQualifier $ houseIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info $ drink $ roomNumber $ userClass $ host $ documentIdentifier $ documentTitle $ documentVersion $ documentLocation $ personalTitle $ co $ uniqueIdentifier $ organizationalStatus $ buildingName $ documentPublisher $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ preferredLanguage $ ipServiceProtocol $ nisMapName $ mailNickname $ sAMAccountName ) ) 2.5.13.4 (caseIgnoreSubstringsMatch): matchingRuleUse: ( 2.5.13.4 NAME 'caseIgnoreSubstringsMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.3 (caseIgnoreOrderingMatch): matchingRuleUse: ( 2.5.13.3 NAME 'caseIgnoreOrderingMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.2 (caseIgnoreMatch): matchingRuleUse: ( 2.5.13.2 NAME 'caseIgnoreMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcInclude $ olcLdapSyntaxes $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLimit $ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTCPBuffer $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSCRLFile $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSProtocolMin $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbCryptFile $ olcDbPageSize $ olcDbIndex $ olcDbLockDetect $ olcDbMode $ olcChainingBehavior $ olcDbURI $ olcDbStartTLS $ olcDbNetworkTimeout $ olcDbQuarantine $ olcDbACLPasswd $ olcDbACLBind $ olcDbIDAssertPasswd $ olcDbIDAssertBind $ olcDbIDAssertMode $ olcDbIDAssertAuthzFrom $ olcDbTFSupport $ olcDbTimeout $ olcDbIdleTimeout $ olcDbConnTtl $ olcDbCancel $ olcDbIDAssertPassThru $ olcDbSocketPath $ olcDbSocketExtensions $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName $ destinationIndicator $ givenName $ initials $ generationQualifier $ dnQualifier $ houseIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info $ drink $ roomNumber $ userClass $ host $ documentIdentifier $ documentTitle $ documentVersion $ documentLocation $ personalTitle $ co $ uniqueIdentifier $ organizationalStatus $ buildingName $ documentPublisher $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ preferredLanguage $ ipServiceProtocol $ nisMapName $ mailNickname $ sAMAccountName ) ) 1.2.36.79672281.1.13.3 (rdnMatch): 2.5.13.1 (distinguishedNameMatch): matchingRuleUse: ( 2.5.13.1 NAME 'distinguishedNameMatch' APPLIES ( creatorsName $ modifiersName $ subschemaSubentry $ entryDN $ namingContexts $ aliasedObjectName $ dynamicSubtrees $ distinguishedName $ seeAlso $ olcDefaultSearchBase $ olcRootDN $ olcSchemaDN $ olcSuffix $ olcUpdateDN $ olcDbACLAuthcDn $ olcDbIDAssertAuthcDn $ olcRelay $ member $ owner $ roleOccupant $ manager $ documentAuthor $ secretary $ associatedName $ dITRedirect $ objectCategory ) ) 2.5.13.0 (objectIdentifierMatch): matchingRuleUse: ( 2.5.13.0 NAME 'objectIdentifierMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ supportedApplicationContext ) ) slapd startup: initiated. backend_startup_one: starting "cn=config" config_back_db_open Backend ACL: access to * by * none config_back_db_open: line 0: warning: cannot assess the validity of the ACL scope within backend naming context backend_startup_one: starting "dc=htc,dc=com" bdb_db_open: "dc=htc,dc=com" bdb_db_open: database "dc=htc,dc=com": dbenv_open(/var/lib/ldap/htc.com). backend_startup_one: starting "dc=internal" bdb_db_open: "dc=internal" bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap/htc.internal: (2). Expect poor performance for suffix "dc=internal". bdb_db_open: database "dc=internal": dbenv_open(/var/lib/ldap/htc.internal). backend_startup_one: starting "cn=Monitor" >>> dnNormalize: <cn=Monitor> <<< dnNormalize: <cn=monitor> >>> dnPretty: <cn=Backends> => ldap_bv2dn(cn=Backends,0) <= ldap_bv2dn(cn=Backends)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Backends)=0 <<< dnPretty: <cn=Backends> >>> dnNormalize: <cn=Backends> <<< dnNormalize: <cn=backends> >>> dnPretty: <cn=Connections> => ldap_bv2dn(cn=Connections,0) <= ldap_bv2dn(cn=Connections)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Connections)=0 <<< dnPretty: <cn=Connections> >>> dnNormalize: <cn=Connections> <<< dnNormalize: <cn=connections> >>> dnPretty: <cn=Databases> => ldap_bv2dn(cn=Databases,0) <= ldap_bv2dn(cn=Databases)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Databases)=0 <<< dnPretty: <cn=Databases> >>> dnNormalize: <cn=Databases> <<< dnNormalize: <cn=databases> >>> dnPretty: <cn=Listeners> => ldap_bv2dn(cn=Listeners,0) <= ldap_bv2dn(cn=Listeners)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Listeners)=0 <<< dnPretty: <cn=Listeners> >>> dnNormalize: <cn=Listeners> <<< dnNormalize: <cn=listeners> >>> dnPretty: <cn=Log> => ldap_bv2dn(cn=Log,0) <= ldap_bv2dn(cn=Log)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Log)=0 <<< dnPretty: <cn=Log> >>> dnNormalize: <cn=Log> <<< dnNormalize: <cn=log> >>> dnPretty: <cn=Operations> => ldap_bv2dn(cn=Operations,0) <= ldap_bv2dn(cn=Operations)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Operations)=0 <<< dnPretty: <cn=Operations> >>> dnNormalize: <cn=Operations> <<< dnNormalize: <cn=operations> >>> dnPretty: <cn=Overlays> => ldap_bv2dn(cn=Overlays,0) <= ldap_bv2dn(cn=Overlays)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Overlays)=0 <<< dnPretty: <cn=Overlays> >>> dnNormalize: <cn=Overlays> <<< dnNormalize: <cn=overlays> >>> dnPretty: <cn=SASL> => ldap_bv2dn(cn=SASL,0) <= ldap_bv2dn(cn=SASL)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=SASL)=0 <<< dnPretty: <cn=SASL> >>> dnNormalize: <cn=SASL> <<< dnNormalize: <cn=sasl> >>> dnPretty: <cn=Statistics> => ldap_bv2dn(cn=Statistics,0) <= ldap_bv2dn(cn=Statistics)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Statistics)=0 <<< dnPretty: <cn=Statistics> >>> dnNormalize: <cn=Statistics> <<< dnNormalize: <cn=statistics> >>> dnPretty: <cn=Threads> => ldap_bv2dn(cn=Threads,0) <= ldap_bv2dn(cn=Threads)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Threads)=0 <<< dnPretty: <cn=Threads> >>> dnNormalize: <cn=Threads> <<< dnNormalize: <cn=threads> >>> dnPretty: <cn=Time> => ldap_bv2dn(cn=Time,0) <= ldap_bv2dn(cn=Time)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Time)=0 <<< dnPretty: <cn=Time> >>> dnNormalize: <cn=Time> <<< dnNormalize: <cn=time> >>> dnPretty: <cn=TLS> => ldap_bv2dn(cn=TLS,0) <= ldap_bv2dn(cn=TLS)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=TLS)=0 <<< dnPretty: <cn=TLS> >>> dnNormalize: <cn=TLS> <<< dnNormalize: <cn=tls> >>> dnPretty: <cn=Waiters> => ldap_bv2dn(cn=Waiters,0) <= ldap_bv2dn(cn=Waiters)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Waiters)=0 <<< dnPretty: <cn=Waiters> >>> dnNormalize: <cn=Waiters> <<< dnNormalize: <cn=waiters> >>> dnNormalize: <cn=Backend 0> <<< dnNormalize: <cn=backend 0> >>> dnNormalize: <cn=Database 0,cn=Databases,cn=Monitor> => ldap_bv2dn(cn=Database 0,cn=Databases,cn=Monitor,0) <= ldap_bv2dn(cn=Database 0,cn=Databases,cn=Monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=database 0,cn=databases,cn=monitor)=0 <<< dnNormalize: <cn=database 0,cn=databases,cn=monitor> >>> dnNormalize: <cn=Backend 1> <<< dnNormalize: <cn=backend 1> >>> dnNormalize: <cn=Backend 2> <<< dnNormalize: <cn=backend 2> >>> dnNormalize: <cn=Database 3,cn=Databases,cn=Monitor> => ldap_bv2dn(cn=Database 3,cn=Databases,cn=Monitor,0) <= ldap_bv2dn(cn=Database 3,cn=Databases,cn=Monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=database 3,cn=databases,cn=monitor)=0 <<< dnNormalize: <cn=database 3,cn=databases,cn=monitor> >>> dnNormalize: <cn=Backend 3> <<< dnNormalize: <cn=backend 3> >>> dnNormalize: <cn=Database 1,cn=Databases,cn=Monitor> => ldap_bv2dn(cn=Database 1,cn=Databases,cn=Monitor,0) <= ldap_bv2dn(cn=Database 1,cn=Databases,cn=Monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=database 1,cn=databases,cn=monitor)=0 <<< dnNormalize: <cn=database 1,cn=databases,cn=monitor> >>> dnNormalize: <cn=Database 2,cn=Databases,cn=Monitor> => ldap_bv2dn(cn=Database 2,cn=Databases,cn=Monitor,0) <= ldap_bv2dn(cn=Database 2,cn=Databases,cn=Monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=database 2,cn=databases,cn=monitor)=0 <<< dnNormalize: <cn=database 2,cn=databases,cn=monitor> >>> dnNormalize: <cn=Backend 4> <<< dnNormalize: <cn=backend 4> >>> dnNormalize: <cn=Backend 5> <<< dnNormalize: <cn=backend 5> >>> dnNormalize: <cn=Backend 6> <<< dnNormalize: <cn=backend 6> >>> dnNormalize: <cn=Backend 7> <<< dnNormalize: <cn=backend 7> >>> dnNormalize: <cn=Backend 8> <<< dnNormalize: <cn=backend 8> >>> dnNormalize: <cn=Backend 9> <<< dnNormalize: <cn=backend 9> >>> dnNormalize: <cn=Backend 10> <<< dnNormalize: <cn=backend 10> >>> dnNormalize: <cn=Backend 11> <<< dnNormalize: <cn=backend 11> >>> dnNormalize: <cn=Max File Descriptors> <<< dnNormalize: <cn=max file descriptors> >>> dnNormalize: <cn=Total> <<< dnNormalize: <cn=total> >>> dnNormalize: <cn=Current> <<< dnNormalize: <cn=current> >>> dnNormalize: <cn=Frontend> <<< dnNormalize: <cn=frontend> >>> dnNormalize: <cn=Database 0> <<< dnNormalize: <cn=database 0> >>> dnNormalize: <cn=Backend 0,cn=Backends,cn=Monitor> => ldap_bv2dn(cn=Backend 0,cn=Backends,cn=Monitor,0) <= ldap_bv2dn(cn=Backend 0,cn=Backends,cn=Monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=backend 0,cn=backends,cn=monitor)=0 <<< dnNormalize: <cn=backend 0,cn=backends,cn=monitor> >>> dnNormalize: <cn=Database 1> <<< dnNormalize: <cn=database 1> >>> dnNormalize: <cn=Backend 3,cn=Backends,cn=Monitor> => ldap_bv2dn(cn=Backend 3,cn=Backends,cn=Monitor,0) <= ldap_bv2dn(cn=Backend 3,cn=Backends,cn=Monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=backend 3,cn=backends,cn=monitor)=0 <<< dnNormalize: <cn=backend 3,cn=backends,cn=monitor> >>> dnNormalize: <cn=Database 2> <<< dnNormalize: <cn=database 2> >>> dnNormalize: <cn=Backend 3,cn=Backends,cn=Monitor> => ldap_bv2dn(cn=Backend 3,cn=Backends,cn=Monitor,0) <= ldap_bv2dn(cn=Backend 3,cn=Backends,cn=Monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=backend 3,cn=backends,cn=monitor)=0 <<< dnNormalize: <cn=backend 3,cn=backends,cn=monitor> >>> dnNormalize: <cn=Database 3> <<< dnNormalize: <cn=database 3> >>> dnNormalize: <cn=Backend 2,cn=Backends,cn=Monitor> => ldap_bv2dn(cn=Backend 2,cn=Backends,cn=Monitor,0) <= ldap_bv2dn(cn=Backend 2,cn=Backends,cn=Monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=backend 2,cn=backends,cn=monitor)=0 <<< dnNormalize: <cn=backend 2,cn=backends,cn=monitor> >>> dnNormalize: <cn=Listener 0> <<< dnNormalize: <cn=listener 0> >>> dnNormalize: <cn=Listener 1> <<< dnNormalize: <cn=listener 1> >>> dnNormalize: <cn=Bind> <<< dnNormalize: <cn=bind> >>> dnNormalize: <cn=Unbind> <<< dnNormalize: <cn=unbind> >>> dnNormalize: <cn=Search> <<< dnNormalize: <cn=search> >>> dnNormalize: <cn=Compare> <<< dnNormalize: <cn=compare> >>> dnNormalize: <cn=Modify> <<< dnNormalize: <cn=modify> >>> dnNormalize: <cn=Modrdn> <<< dnNormalize: <cn=modrdn> >>> dnNormalize: <cn=Add> <<< dnNormalize: <cn=add> >>> dnNormalize: <cn=Delete> <<< dnNormalize: <cn=delete> >>> dnNormalize: <cn=Abandon> <<< dnNormalize: <cn=abandon> >>> dnNormalize: <cn=Extended> <<< dnNormalize: <cn=extended> >>> dnNormalize: <cn=Overlay 0> <<< dnNormalize: <cn=overlay 0> >>> dnNormalize: <cn=Overlay 1> <<< dnNormalize: <cn=overlay 1> >>> dnNormalize: <cn=Overlay 2> <<< dnNormalize: <cn=overlay 2> >>> dnNormalize: <cn=Overlay 3> <<< dnNormalize: <cn=overlay 3> >>> dnNormalize: <cn=Bytes> <<< dnNormalize: <cn=bytes> >>> dnNormalize: <cn=PDU> <<< dnNormalize: <cn=pdu> >>> dnNormalize: <cn=Entries> <<< dnNormalize: <cn=entries> >>> dnNormalize: <cn=Referrals> <<< dnNormalize: <cn=referrals> >>> dnNormalize: <cn=Max> <<< dnNormalize: <cn=max> >>> dnNormalize: <cn=Max Pending> <<< dnNormalize: <cn=max pending> >>> dnNormalize: <cn=Open> <<< dnNormalize: <cn=open> >>> dnNormalize: <cn=Starting> <<< dnNormalize: <cn=starting> >>> dnNormalize: <cn=Active> <<< dnNormalize: <cn=active> >>> dnNormalize: <cn=Pending> <<< dnNormalize: <cn=pending> >>> dnNormalize: <cn=Backload> <<< dnNormalize: <cn=backload> >>> dnNormalize: <cn=State> <<< dnNormalize: <cn=state> >>> dnNormalize: <cn=Runqueue> <<< dnNormalize: <cn=runqueue> >>> dnNormalize: <cn=Tasklist> <<< dnNormalize: <cn=tasklist> >>> dnNormalize: <cn=Start> <<< dnNormalize: <cn=start> >>> dnNormalize: <cn=Current> <<< dnNormalize: <cn=current> >>> dnNormalize: <cn=Uptime> <<< dnNormalize: <cn=uptime> >>> dnNormalize: <cn=Read> <<< dnNormalize: <cn=read> >>> dnNormalize: <cn=Write> <<< dnNormalize: <cn=write> slapd starting daemon: added 4r listener=(nil) daemon: added 7r listener=0x7fcb0f5bc2d0 daemon: added 8r listener=0x7fcb0f5bc390 daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(7): daemon: epoll: listen=7 busy daemon: epoll: listen=8 active_threads=0 tvp=zero >>> slap_listener(ldap:///) daemon: activity on 1 descriptor daemon: activity on:daemon: listen=7, new connection on 16 daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: added 16r (active) listener=(nil) conn=1000 fd=16 ACCEPT from IP=172.24.10.201:23867 (IP=0.0.0.0:389) daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: activity on 1 descriptor daemon: activity on: 16r daemon: read active on 16 daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero connection_get(16) connection_get(16): got connid=1000 connection_read(16): checking for input on id=1000 ber_get_next ldap_read: want=8, got=8 0000: 30 60 02 01 01 60 33 02 0`...`3. ldap_read: want=90, got=90 0000: 01 03 04 19 75 69 64 3d 4e 75 50 6f 69 6e 74 2c ....uid=NuPoint, 0010: 64 63 3d 68 74 63 2c 64 63 3d 63 6f 6d 80 13 64 dc=htc,dc=com..d 0020: 65 63 20 31 33 20 32 30 31 32 20 63 72 65 61 74 ec 13 2012 creat 0030: 65 64 a0 26 30 24 04 16 31 2e 32 2e 38 34 30 2e ed.&0$..1.2.840. 0040: 31 31 33 35 35 36 2e 31 2e 34 2e 33 31 39 01 01 113556.1.4.319.. 0050: ff 04 07 30 05 02 01 0a 04 00 ...0...... ber_get_next: tag 0x30 len 96 contents: ber_dump: buf=0x7fcad8000920 ptr=0x7fcad8000920 end=0x7fcad8000980 len=96 0000: 02 01 01 60 33 02 01 03 04 19 75 69 64 3d 4e 75 ...`3.....uid=Nu 0010: 50 6f 69 6e 74 2c 64 63 3d 68 74 63 2c 64 63 3d Point,dc=htc,dc= 0020: 63 6f 6d 80 13 64 65 63 20 31 33 20 32 30 31 32 com..dec 13 2012 0030: 20 63 72 65 61 74 65 64 a0 26 30 24 04 16 31 2e created.&0$..1. 0040: 32 2e 38 34 30 2e 31 31 33 35 35 36 2e 31 2e 34 2.840.113556.1.4 0050: 2e 33 31 39 01 01 ff 04 07 30 05 02 01 0a 04 00 .319.....0...... op tag 0x60, time 1355857467 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable daemon: activity on 1 descriptor daemon: activity on: conn=1000 op=0 do_bind daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero ber_scanf fmt ({imt) ber: ber_dump: buf=0x7fcad8000920 ptr=0x7fcad8000923 end=0x7fcad8000980 len=93 0000: 60 33 02 01 03 04 19 75 69 64 3d 4e 75 50 6f 69 `3.....uid=NuPoi 0010: 6e 74 2c 64 63 3d 68 74 63 2c 64 63 3d 63 6f 6d nt,dc=htc,dc=com 0020: 80 13 64 65 63 20 31 33 20 32 30 31 32 20 63 72 ..dec 13 2012 cr 0030: 65 61 74 65 64 a0 26 30 24 04 16 31 2e 32 2e 38 eated.&0$..1.2.8 0040: 34 30 2e 31 31 33 35 35 36 2e 31 2e 34 2e 33 31 40.113556.1.4.31 0050: 39 01 01 ff 04 07 30 05 02 01 0a 04 00 9.....0...... ber_scanf fmt (m}) ber: ber_dump: buf=0x7fcad8000920 ptr=0x7fcad8000943 end=0x7fcad8000980 len=61 0000: 00 13 64 65 63 20 31 33 20 32 30 31 32 20 63 72 ..dec 13 2012 cr 0010: 65 61 74 65 64 a0 26 30 24 04 16 31 2e 32 2e 38 eated.&0$..1.2.8 0020: 34 30 2e 31 31 33 35 35 36 2e 31 2e 34 2e 33 31 40.113556.1.4.31 0030: 39 01 01 ff 04 07 30 05 02 01 0a 04 00 9.....0...... => get_ctrls ber_scanf fmt ({m) ber: ber_dump: buf=0x7fcad8000920 ptr=0x7fcad800095a end=0x7fcad8000980 len=38 0000: 30 24 04 16 31 2e 32 2e 38 34 30 2e 31 31 33 35 0$..1.2.840.1135 0010: 35 36 2e 31 2e 34 2e 33 31 39 01 01 ff 04 07 30 56.1.4.319.....0 0020: 05 02 01 0a 04 00 ...... ber_scanf fmt (b) ber: ber_dump: buf=0x7fcad8000920 ptr=0x7fcad8000974 end=0x7fcad8000980 len=12 0000: 00 01 ff 04 07 30 05 02 01 0a 04 00 .....0...... ber_scanf fmt (m) ber: ber_dump: buf=0x7fcad8000920 ptr=0x7fcad8000977 end=0x7fcad8000980 len=9 0000: 04 07 30 05 02 01 0a 04 00 ..0...... => get_ctrls: oid="1.2.840.113556.1.4.319" (critical) <= get_ctrls: n=1 rc=12 err="critical extension is unavailable" send_ldap_result: conn=1000 op=0 p=3 send_ldap_result: err=12 matched="" text="critical extension is unavailable" send_ldap_response: msgid=1 tag=97 err=12 ber_flush2: 47 bytes to sd 16 0000: 30 2d 02 01 01 61 28 0a 01 0c 04 00 04 21 63 72 0-...a(......!cr 0010: 69 74 69 63 61 6c 20 65 78 74 65 6e 73 69 6f 6e itical extension 0020: 20 69 73 20 75 6e 61 76 61 69 6c 61 62 6c 65 is unavailable ldap_write: want=47, written=47 0000: 30 2d 02 01 01 61 28 0a 01 0c 04 00 04 21 63 72 0-...a(......!cr 0010: 69 74 69 63 61 6c 20 65 78 74 65 6e 73 69 6f 6e itical extension 0020: 20 69 73 20 75 6e 61 76 61 69 6c 61 62 6c 65 is unavailable conn=1000 op=0 RESULT tag=97 err=12 text=critical extension is unavailable conn=1000 op=0 do_bind: get_ctrls failed daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: activity on 1 descriptor daemon: activity on: 16r daemon: read active on 16 daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero connection_get(16) connection_get(16): got connid=1000 connection_read(16): checking for input on id=1000 ber_get_next ldap_read: want=8, got=0 ber_get_next on fd 16 failed errno=0 (Success) connection_read(16): input error=-2 id=1000, closing. connection_closing: readying conn=1000 sd=16 for close connection_close: conn=1000 sd=16 daemon: activity on 1 descriptor daemon: activity on: daemon: removing 16 conn=1000 fd=16 closed (connection lost) daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero ^Cdaemon: shutdown requested and initiated. daemon: closing 7 daemon: closing 8 slapd shutdown: waiting for 0 operations/tasks to finish slapd shutdown: initiated ====> bdb_cache_release_all ====> bdb_cache_release_all slapd destroy: freeing system resources. slapd stopped. [root@radius1 openldap]# exit exit Script done on Tue 18 Dec 2012 03:06:10 PM EST ********************************************************************** HTC Disclaimer: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you. **********************************************************************

3 2

Re: Fwd: Multi-Master OpenLDAP Replication for 3 nodes -- slapadd command failing
by fal patel 04 Jan '13

04 Jan '13

Oho, so you agree that the OpenLDAP Guide Section 18.3.3 "N-Way Multi-Master" fails to work as is with the Section 10.2 "Creating a database off-line", specifically with Section 10.2.1 "The slapadd program"? And you're failing or refusing to provide a LDIF file for the above that that actually works? That means you don't have "enough understanding and general competence" to make your own product, OpenLDAP, work according to the description in your own manual, the "OpenLDAP 2.4 Administrator's Guide". Your product is a joke and you're another. I hereby unsubscribe from this mailing list. Fal On Thu, Jan 3, 2013 at 9:51 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, January 03, 2013 9:28 PM -0800 fal patel < > fal0patel(a)gmail.com> wrote: > > It should be acceptable as an LDIF as input to slapadd. >> If it is not, it is buggy by definition. >> Remember, we should be able to perform database configuration OFF-LINE. >> ie. without slapd running. >> And obviously when off-line, slapadd works whereas ldapmodify, ldapadd >> etc. cannot. >> > > If you would spend the time to start with a basic cn=config setup, and > then perform the ldap modifications as noted in the admin guide, your end > result would be a cn=config DB you could *slapcat* into LDIF, which you > could then use as a template for loading other servers. In fact, you'd be > long done with this if you'd simply done that very simple thing. > > Just because slapadd doesn't parse LDIF meant for ldap modify does *not* > mean it is buggy. It means you are following the admin guide. > > The admin guide is not a document that explains how to do anything and > everything under the sun. It is a general guide that gives working > examples of how to do various things. The end user is supposed to have > enough understanding and general competence to be able to extrapolate how > to go from there. > > In addition, you've also been pointed to test suites that set up > multi-master replication of cn=config. You could have trivially exported > those cn=config DB's via slapcat as well. > > You seem awfully determined to have other people take the time to do your > work for you, rather than doing what you could have already done weeks ago > in a few minutes. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: About TLS - ldaps search
by Bheeshma SM 04 Jan '13

04 Jan '13

Is there a specific way, i have to configure the slapd to listem to 636 port..? And does the 389 search is a secure search...? Is there a particular way of Starting the TLS operation..? Thanks in advance On Fri, Jan 4, 2013 at 4:31 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, January 04, 2013 4:09 PM -0800 Bheeshma SM < > bheeshma.manjunath(a)gmail.com> wrote: > > >> Hi guys. >> >> I have a problem in Openldap 2.4.33 on RHEL 5.8 >> >> I am able to do a " ldapsearch -x -p 389 -h -D<> -w<> -b<> " >> >> but i am not able to do >> >> " ldapsearch -x -p 636 -h -D<> -w<> -b<> >> > > Sounds like slapd is not configured to listen to port 636. No amount of > mucking with ldapsearch is going to change that. > > I would note that you can do secure searches over port 389 just fine. > Simply use the startTLS operation. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

About TLS - ldaps search
by Bheeshma SM 04 Jan '13

04 Jan '13

Hi guys. I have a problem in Openldap 2.4.33 on RHEL 5.8 I am able to do a *" ldapsearch -x -p 389 -h -D<> -w<> -b<> "* but i am not able to do *" ldapsearch -x -p 636 -h -D<> -w<> -b<>* I have done all the changes in ldap.conf and certificates are working fine. The weird thing is *"ldapsearch -x -H **ldaps://hostname* <ldaps://hostname>* -D <> -w <> -b<> " is working fine.* What i am trying to do is-- I want to disable the 389 port so that is no searches running in the non-secure port. So can any1 tell me why the *" ldapsearch -x -p 636 -h -D<> -w<> -b<>" [secure search is not working]* Please help me out in this. Thanks in advance. -bhee

2 1

Forcing TLS, but keep working SASL authentication
by Wiebe Cazemier 04 Jan '13

04 Jan '13

Hi, I want to force SSL on my OpenLDAP server (2.4.21-0ubuntu5.7, Ubuntu 10.04 LTS), but then the SASL authentication breaks. I did this to enable tls-only: # feed to ldapmodify dn: cn=config changetype: modify add: olcSecurity olcSecurity: tls=1 But, then I can't use "-Y EXTERNAL" anymore, because it then demands a TLS connection. When I enable TLS (-ZZ) on tools like ldapmodify and use ldap://hostname/ and bind with my rootDN (admin user), it doesn't work (insufficient access (50)). I guess it needs the socket to know I'm root. Inspecting all DB's with "ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b cn=config", it appears the config DB's have an olcAccess rule like: olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break gid and uid = 0, so I guess it's the system's root account. I tried adding an olcRootDN and olcRootPW to olcDatabase={0}config,cn=config so that I could modify the cn=config, but adding them gave an error: "<olcRootPW> can only be set when rootdn is under suffix". When I tried adding olcSuffix to "dc=domain,dc=tld", it said: "<olcSuffix> handler exited with 1". I also tried specifying a olcRootDN only (no olcRootPW) (like cn=admin,dc=domain,dc=tld) and then add that user to "dc=domain,dc=tld", but it didn't work. Unfortunately, I don't remember what went wrong. So, is there a way to enforce TLS but still use the SASL authentication? Any help is appreciated. Thanks in advance, Wiebe Cazemier

2 3

Fwd: Multi-Master OpenLDAP Replication for 3 nodes -- slapadd command failing
by fal patel 03 Jan '13

03 Jan '13

---------- Forwarded message ---------- From: fal patel <fal0patel(a)gmail.com> Date: Thu, Jan 3, 2013 at 3:28 PM Subject: Re: Multi-Master OpenLDAP Replication for 3 nodes -- slapadd command failing To: openldap-technica(a)openldapl.org, Howard Chu <hyc(a)symas.com>, Philip Guenther <guenther+ldaptech(a)sendmail.com> Cc: fal patel <fal0patel(a)gmail.com> Hi Howard and Philip, Thank you very much for your emails. Well, it doesn't work for me, and hasn't for the two weeks I've been wrestling with it. Could you please post a *working* LDIF file of Section 18.3.3 "N-Way Multi-Master"? (I can substitute my real values if you keep the "$xxx" labels in there, of course.) I want to be able to feed the above LDIF file in to slapadd and obtain both config db replication and also data replication. The only change I should have to make for my 3 OpenLDAP servers is that the Server#1 should have "olcServerID: 1", Server#2 should have "olcServerID: 2", etc. Thanks very much. Best regards Fal On Thu, Jan 3, 2013 at 6:40 AM, Howard Chu <hyc(a)symas.com> wrote: > fal patel wrote: > >> Hi Philip, >> >> hank you very much for your email. >> >> In that case, my original surmise is correct: The OpenLDAP >> Administrator's >> Guide's Section 18.3.3 "N-Way Multi-Master" definitely is buggy. >> Because my LDIF file is a direct copy thereof (except for my environment >> values substituted in instead of the labels such as $URI1, of course.) >> > > The example in 18.3.3 works perfectly when you substitute the correct > values in for the variables and follow the steps listed. > > > How can this be reported as a bug, please? (In OpenLDAP documentation >> or/and >> code). >> And can a *working* sample LDIF file be provided, please, for this >> important >> replication design, n-way multi-master? >> > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/**project/<http://www.openldap.org/project/> >

3 3

authentication for users in referral branch
by Wu, James C. 03 Jan '13

03 Jan '13

Hi, I have sent out a relevant email about this issue before but the context was a little bit complicated. So I simplified the settings and post this issue again, hoping to get more attentions from this mailing list. I am trying to set up a testing environment in which there are two openldap servers and have one server (externalldap) refer to the second server (internalldap) for some users in a subtree (sub.example.com). Both servers contains some POSIX users. However, I could not get the authentication for the users in the referral branch to work. For example, this command fails. ldapwhoami -d -1 -x -H ldap://externalldap -D "uid=mark,ou=People,dc=sub,dc=example,dc=com" -w password The log of the externalldap shows as follows: 50e6279d bdb_dn2entry("uid=mark,ou=people,dc=sub,dc=example,dc=com") 50e6279d => bdb_dn2id("dc=example,dc=com") 50e6279d <= bdb_dn2id: got id=0x1 50e6279d => bdb_dn2id("dc=sub,dc=example,dc=com") 50e6279d <= bdb_dn2id: got id=0x6 50e6279d => bdb_dn2id("ou=people,dc=sub,dc=example,dc=com") 50e6279d <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30988) I am wondering why the externalldap did not just send the client the uri of the referral ldap box and have the client connect directly to the internalldap instead. Similarly error also happened when I use ldapsearch command ldapsearch -d -1 -x -H ldap:// externalldap -D "uid=mark,ou=People,dc=sub,dc=example,dc=com" -w password -CC The referral record is defined as follows and added into the external ldap using ldapadd command. dn: dc=sub,dc=example,dc=com objectClass: referral objectClass: extensibleObject dc: sub ref: ldap://10.42.13.212/dc=sub,dc=example,dc=com The slapd.conf of both the external and the internal ldap are defined as follows: #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=example;dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw password directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq TLSCACertificateFile /etc/pki/tls/certs/example_cert.pem TLSCertificateFile /etc/pki/tls/certs/example_cert.pem TLSCertificateKeyFile /etc/pki/tls/certs/example_key.pem # configure the SASL parameters sasl-host localhost sasl-secprops none For the client, I am just using the default settings. I believe referral chasing is enabled by default in the ldap client library. I have spent more than two weeks on this problem and the project is delayed quite a lot. Referral in LDAP has been in RFC for more than five years. I can not believe that OpenLDAP's implementation of referral can't handle authentication. Can anyone kindly let me know what is missing from my setup? Regards, James

1 0

referral authentication
by Wu, James C. 03 Jan '13

03 Jan '13

Hi Kurt, I saw you once replied a question by Ming Hou about referral authentication. Could you let me know how to do it? I read through the man pages slap and slapd-ldap and still could not have it work. http://linux.die.net/man/5/slapd-ldap http://linux.die.net/man/8/slapd the rebind-as-user option does not seem to be supported by openldap. Regards, James

1 0

Re: Multi-Master OpenLDAP Replication for 3 nodes -- slapadd command failing
by fal patel 03 Jan '13

03 Jan '13

Hey Quanah, Oh no, my question was whether an arbitrary external variable (eg. URI1) could be set (eg. to ldap://host1.hq.mycompany.com:389/) inside an LDIF file and used in subsequent places in the file. (to avoid having to type in the value in multiple places). I suppose not? Assuming not, I typed in each value into all its relevant places in my LDIF file and re-ran slapadd. Now it gives me the following error (on latest redhat 64bit): loaded module syncprov.la *module syncprov.la: null module registered* Surely the above message signifies an error? Anyway, processing continues until it gives the following final error: >>> dnPrettyNormal: <cn=config> <<< dnPrettyNormal: <cn=config>, <cn=config> *<= str2entry: str2ad(changetype): attribute type undefined* slapadd: could not parse entry (line=48) Could you please advise? I have no clue as to what is going wrong. I have attached the LDIF file "nwaymmr2s.ldif" and the debug output from running the command slapadd -d -1 -v -F /etc/openldap/slapd.d -n 0 -l /etc/openldap/nwaymmr2s.ldif >& output.txt. Also, do I need to run slappasswd and copy the hash value from it into my LDIF' file's olcRootPW field value? Or can I just keep the original value, "secret"? And a final question, please: Why does the data replication (unlike the config replication, which does operate in refreshAndPersist mode) have to operate in refreshOnly mode? Why can't it operate in refreshAndPersist mode? Thank you very much. Fal On Mon, Dec 31, 2012 at 12:49 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, December 31, 2012 9:49 AM -0800 fal patel < > fal0patel(a)gmail.com> wrote: > > Hey Quanah, >> >> Thank you very much for the debugging tip! -- Using it I got further in. >> Now I get an error "<= str2entry: str2ad(UR1): attribute type undefined". >> I must be setting my external variables (such as UR1) incorrectly in my >> LDIF file. >> What is the correct syntax for setting them, please? >> I tried each of the following sentences, none of which worked: >> URI1: ldap://host1.hq.mycompany.com:**389/<http://host1.hq.mycompany.com:389/> >> URI1: ldap://host1.hq.mycompany.com:**389<http://host1.hq.mycompany.com:389> >> URI1: "ldap://host1.hq.mycompany.**com:389/<http://host1.hq.mycompany.com:389/> >> " >> URI1="ldap://host1.hq.**mycompany.com:389/<http://host1.hq.mycompany.com:389/> >> " >> URI1="ldap://host1.hq.**mycompany.com:389<http://host1.hq.mycompany.com:389> >> " >> URI1 ldap://host1.hq.mycompany.com:**389/<http://host1.hq.mycompany.com:389/> >> > > There is no URI bit in the admin guide. I highly advise you go re-read > it. What you posted is clearly invalid. > > From the admin guide: >> > > ------------------------------**----------------------- > > Now we setup the first Master Node (replace $URI1, $URI2 and $URI3 etc. > with your actual ldap urls): > > > dn: cn=config > changetype: modify > replace: olcServerID > olcServerID: 1 $URI1 > olcServerID: 2 $URI2 > olcServerID: 3 $URI3 > > ------------------------------**----------------------- > > I.e. the attribute name is "olcServerID". > > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

5 7

sasl Kerberos authentication with subordinate
by Wu, James C. 02 Jan '13

02 Jan '13

Hi, I am trying to set up an OpenLDAP and Kerberos authentication for testing purpose. The setup contains a pair of internal ldap server and Kerberos server and the pair of external ldap server and Kerberos server. I made the tree of the internal ldap server to be a subordinate of the external server and enabled the saslauthd for authentication on both the internal and the external ldap server to the respective Kerberos server. I have tested that the LDAP authentication through saslauthd using Kerberos works well on both the internal ldap and Kerberos pair and the external ldap Kerberos pair. However, when I point the client machine to the external ldap server and the add the subordinate relationship, I could not get the authentication for the uses in the internal ldap directory to work. For example, when I used "su - peter" where peter is a user in the external ldap server and the password is {SASL}peter(a)EXAMPLE.COM<mailto:%7bSASL%7dpeter@EXAMPLE.COM>. The authentication works. However, when I use "su - James" where james is a user defined in the internal ldap server with password {SASL}james(a)SUB.EXAMPLE.COM<mailto:%7bSASL%7djames@SUB.EXAMPLE.COM>, then the authentication failed. I check the log file, the internal server did get the search request forwarded from the external ldap server and returned the correct information back. However, I did not see the saslauthd process on either the external or the internal ldap server get any inquiry for the authentication. I tried to modify the /etc/krb5.conf and added the realms for both EXAMPLE.COM and SUB.EXAMPLE.COM. Still, the authentication does not work for users defined in the internal ldap server. Could anyone give me some hints for this issue? james

2 12

MDB Newbie
by Kyle Smith 02 Jan '13

02 Jan '13

Greetings and Salutations. December 20, I converted from bdb to mdb. Now my memory usage looks like this: http://faculty.ycp.edu/~ksmith8/openldap_stats.png I am concerned with the graph for "superman". How can I start tracking down the usage and why almost 50% of my memory is being consumed. These 4 are in MMR and are 2.4.33 and are nearly exact in server specification. Thanks in advance! Kyle Smith

2 1

Ldap db is corupt
by Jorge Armijo 02 Jan '13

02 Jan '13

Hi my friends i have the next problem when mi server is down for electrical fails my ldap db is corrupt I need some procedure to restore de db because until this moment I restore but from a backup but i thing that is not the better strategy I realy need your help!!!!!!! Atento a sus comentarios Jorge Armijo Ingeniero de Soporte Soporte Libre Cia. Ltda. D: Hernandez de Giron Oe4-175 y Vasco de Contreras T: +593 (2) 331-9027 F: +593 (2) 243-1103 @: jorge.armijo(a)soportelibre.com www.soportelibre.com

2 1

GDM + pwdPolicy problem
by cbulist 02 Jan '13

02 Jan '13

Hi, We have a problem using Red Hat 5.7, gdm 2.16.0-59 y pwdPolicy. When an account gets pwdMaxAge limit and the user try to login using GUI the user doesn't receive any warning about expiration account, it just requests the user and password like a normal login and it fail. The warning works if the user try login by SSH. If we use pwdReset the user get the warning message and it is able to change the password. We comment pwdPolicy rules and using shadow attributes gdm works fine. We tried the same configuration with a Red Hat 6 server and everything works fine but we are not able to change our Red Hat version now. Our requirements are keep the password history and we tried pam_unix remember=3 option in /etc/pam.d/system-auth with /etc/security/opasswd but It did not work. We can go with shadow attributes as long as we keep the password history. Any idea? Thanks in advance!

2 1

olcToolthreads and slapadd -n0
by Василий Молостов 01 Jan '13

01 Jan '13

i have migrated server side config for my db and I have found some strange behavior of slapadd: I've got started migration from converting slapd.conf containing my db config and a 'tool-threads' parameter (with value above 1) into common ldif file, in which an 'olcToolThreads' was defined appropriately (i.e above 1). It was the simplest and clear step. The next step was to 'slapadd -n 0' this ldif file into an empty server config (having slapd stopped), but just at adding 'cn=config' object (which contains olcToolThreads with value > 1) 'slapadd' stuck indefinitely at shed_yelds() call (I have observed this via strace tool from ubuntu). So as a result slapadd had been in processing its operation indefinitely without any output but was capable to stop working by Ctrl-C handler. Setting olcToolThreads to 0 or 1 has solved this problem. I dont know is this a bug or my misconfiguration?

3 2

missing structuralObjectClass
by Dusty Doris 01 Jan '13

01 Jan '13

I recently migrated a client's ldap directories to new servers. I setup replication from the new servers to the old servers to do the initial build of the directory and to keep up to date with changes before the cutover. In the process we also moved from 2.4.12 to 2.4.33. I've run into an issue since then with an object that was missing a structuralObjectClass. When we try to commit modifications to that object, we received an error that says: ldap_modify: Other (e.g., implementation specific) error (80) additional info: no structuralObjectClass operational attribute Doing a search on that object with +, shows that it is in fact missing a structuralObjectClass. Other users that we can modify, show that they do have that attribute. I was able to solve this problem by doing an ldapsearch on the user and saving to an ldif, ldapdelete the user, then ldapadd the user back from the ldif file. When re-adding that user, the structuralObjectClass was created. It looks like about 50% of our objects are missing that attribute. To get those numbers, I am searching with: '(&(objectClass=*)(!(structuralObjectClass=*)))' + VS '(&(objectClass=*)(structuralObjectClass=*))' + What would be the best way for me to fix these issues on every object that is missing the structuralObjectClass? Also, in the future, would you recommend I do a slapcat/slapadd or something like that to populate a new database instead of letting syncrepl load it for me? Would that have fixed this problem from the start? Thanks for any suggestions. - Dusty Doris

2 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical January 2013