openldap-technical January 2013

openldap-technical@openldap.org

71 participants
131 discussions

Continuous mode (ldapmodify -c) not working
by Ori Bani 22 Jan '13

22 Jan '13

Am I doing something wrong? Here is an example: $ ldapmodify -c -x -D 'cn=config' -W Enter LDAP Password: <password> dn: olcDatabase={0}config,cn=config changetype: modify delete: olcSizeLimit - modifying entry "olcDatabase={0}config,cn=config" ldap_modify: No such attribute (16) additional info: modify/delete: olcSizeLimit: no such attribute

2 12

slapd segfaults with mdb
by Meike Stone 22 Jan '13

22 Jan '13

Hello, I play a little with the mdb on a test machine, and imported our db from production system. (about 1,500,000 entires, 2,5GByte ldif from slapcat) I took the slapd source from git today, and because of segmentation fault, I compiled slapd with debugging symbols. My configuration is simple: -------------------------------------------- include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/yast.schema include /etc/openldap/schema/rfc2307bis.schema include /etc/openldap/schema/my_ldap_attributes.schema include /etc/openldap/schema/my_ldap_ObjectClasses.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args sizelimit -1 timelimit 300 disallow bind_anon require authc gentlehup on tool-threads 4 serverID 001 ############################ # mdb database definitions ############################ database mdb suffix "ou=root" rootdn "cn=admin,ou=root" rootpw password directory /var/lib/ldap/ldap.mdb loglevel 256 maxsize 10737418240 envflags writemap,nometasync index objectClass,entryUUID,entryCSN eq index cn eq,sub . . . some other own indexes here -------------------------------------------- I started my search via: /tmp/ol/usr/local/bin/ldapsearch -x -h localhost -w password -D cn=admin,ou=root -b'ou=root' '(objectClass=*)' >/dev/null and got in the syslog folloing meassge: Jan 21 17:50:31 debld02 kernel: [348860.053152] slapd[19394]: segfault at 7f760f974ce8 ip 000000000053bea1 sp 00007f738b10a650 error 4 in slapd [400000+227000] Because of this, I configured the kernel to core dump: sysctl -w kernel.core_pattern=/tmp/core sysctl -w kernel.core_uses_pid=1 sysctl -w kernel.suid_dumpable=2 ulimit -c unlimited ulimit -v unlimited and got the result via: ~# gdb /tmp/ol/usr/local/libexec/slapd /tmp/core.19386 Core was generated by `/tmp/buildforopenldaptechnical/usr/local/libexec/slapd -h ldap:/// -f /etc/op'. Program terminated with signal 11, Segmentation fault. #0 0x000000000053bea1 in mdb_entry_decode (op=0xc3a020, data=0x7f738b10a770, e=0x7f738b11a828) at id2entry.c:666 666 a->a_desc = mdb->mi_ads[*lp++]; (gdb) How can I solve this? Btw.: This error is repeatable and I saw the same error with the release OL2.4.33. Thanks Meike

2 1

openldap 2.4.33 from source, can't find slapd.d directory
by Benin Technologies 22 Jan '13

22 Jan '13

3 5

ACL: Permissions with Groups and 'memberOf' Using Regex
by Eren Türkay 21 Jan '13

21 Jan '13

Hello, I'm designing a directory structure for our radio amateur union, and I have a problem with somewhat complex ACL (for me). Before I ask my question, I want to mention that this structure is not in production so it can always change. I may have designed the structure wrong, and there would be a better way to represent it. However, I believe that this is the correct way of representing our amateur radio union's organization. As a radio amateur union, we have different branches across different cities. These branches have their own members, and own managers, Additionally, there is a unit which is the manager of the whole union. Their members are listed in "cn=general-managers,<base dn>". All of the user information is stored under "ou=people,<base dn>" and 'memberOf' overlay is enabled. The structure is below: ==== BEGIN: directory structure ==== - <base dn> - cn=general-managers (groupOfNames) - ou=branch - ou=foo-city - cn=managers (groupOfNames) - cn=members (groupOfNames) - ou= bar-city - cn=managers (groupOfNames) - cn=members (groupOfNames) ... ... - ou=people cn=ta1aet (inetOrgPerson) memberOf: cn=managers,ou=foo-city,ou-branch,<base-dn> memberOf: cn=members,ou=foo-city,ou-branch,<base-dn> cn=CALLSIGN1 memberOf: cn=members,ou=foo-city,ou-branch,<base-dn> cn=CALLSIGN2 memberOf: cn=members,ou=bar-city,ou-branch,<base-dn> cn= CALLSIGNn ... ... ==== END: directory structure ==== So far, I have achieved to write an ACL for "ou=people". The users have write permission to some of the attributes such as "givenName, sn, mail, address" but they don't have permission to edit "title" (which should be edited by his manager in his branch) What I am aiming is listed below. 1- People in cn=managers,ou=XXXX,ou=branch should be able to add new user/member under "ou=people,<base dn>". (Of course, setting member attribute their branch "cn=members,ou=XXXX,ou=branch") 2- These managers (cn=managers,ou=XXX,ou=branch) should only be able to edit attributes of members registered to them. So, only people that are member of "cn=members,ou=XXX,ou=branch" should be edited by "cn=managers,ou=XXX,ou=branch". 3- Any user should be able to edit some (e.g not 'title') of his attributes (I've done it but I'm not sure if it can be done in a more elegant way. Config is attached at the end). 4- General managers should be able to edit the tree and children of "ou=branch,<base dn>" as well as "ou=people,<base dn>". This looks a bit easier compared to 1 and 2. I have searched through all regular expressions tutorials but none of them includes such a membership example. "access to" syntax has "filter" option. Since 'access to' requires <what> clause first, I thought of using regular expression to filter the people accordingly to their 'memberOf' attributes, somehow (-don't know how :) -) match their branches that they belong to, and give access to corresponding manager group. However, 'filter' does not seem to accept regular expressions and it requires a direct attribute. I cannot further proceed right now, and I will really appreciate a hand on this issue. My best regards and 73s! Eren ==== BEGIN: current olcAccess ==== olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonym ous auth by dn="cn=admin,dc=trac,dc=org,dc=tr" write by * none olcAccess: {1}to dn.base="dc=trac,dc=org,dc=tr" by dn="cn=admin,dc=trac,dc=o rg,dc=tr" write by * read by anonymous none olcAccess: {2}to dn.base="ou=people,dc=trac,dc=org,dc=tr" attrs="entry,objec tClass" by dn.one="ou=people,dc=trac,dc=org,dc=tr" read by anonymous none olcAccess: {3}to dn.one="ou=people,dc=trac,dc=org,dc=tr" attrs="givenName,sn ,mail" by self write by dn.one="ou=people,dc=trac,dc=org,dc=tr" read olcAccess: {4}to dn.one="ou=people,dc=trac,dc=org,dc=tr" attrs="entry,object Class,cn,givenName,sn,title,mail" by dn.one="ou=people,dc=trac,dc=org,dc=tr " read by anonymous none ==== END: current olcAccess ==== -- . 73! DE TA1AET http://linkedin.com/in/erenturkay

1 1

Rewriting query and results
by Kurt Roeckx 21 Jan '13

21 Jan '13

Hi, I have PBX that queries the ldap server, but I'm not very happy with how it behaves, and of course have no control over what it does. It sends a query for "sn=foo*". But I want it to run a query that checks against fields like cn, givenName and sn. I also want to query to be "*foo*" instead of "foo*". It only requests the fields sn, givenName and the various phone numbers and then shows sn and givenName. I want it to display cn instead. So I guess I want to return the value of cn in sn and don't return a givenName. I've been looking at slapo-rwm manpage, but it's not really making much sense to me. Can someone guide me on how to do it? Kurt

1 0

Understanding dynamic configuration
by Ori Bani 21 Jan '13

21 Jan '13

Hello, I'm struggling a little with understanding the dynamic configuration system (sorry, but wanted to say my vote is for file-based config; the way some of this config has been put into LDAP feels forced and unnecessarily convoluted). Specifically, I'm having a hard time getting my mind around how to manage and secure the configuration database. What's tripping me up is how to reconcile the separate ldif files that contain global server-level configuation settings and config database level settings with what I understand to be the recommended way to manage those things -- using OpenLDAP client tools. When starting a fresh server (CentOS6.3, installed from yum if that matters here), it's not clear to me how I can bind using ldapadd in order to modify global server settings. Right now, I suspect the trouble is that the default databases have been created without a olcRootPw. Do I have to violate best practices just long enough to add that setting to the cn=config/olcDatabase={0}config.ldif file? After that, do I bind to "cn=config" in order to change global configuration settings using the base DN "cn=config"? (The olcRootDN is in the config database ldif file is "cn=config") To modify settings for the configuration database itself, do I also use the same bind ("cn=config") but use a base DN of "olcDatabase={0}config.ldif,cn=config"? I'm also curious, many of the examples I see for things like cn=Modules don't use the full DN, which I think is cn=Modules,cn=config. Why is this? I've read the website docs, the man pages, but I don't see any information that addresses how to initially bind to and start configuring the server in the Right Way. The quick start guide would be a good place for that, but it still talks about slapd.conf. Thanks for the help and for the good software

2 1

unable to sasl bind to openldap .
by mallapadi niranjan 21 Jan '13

21 Jan '13

Hi all, I need some help in finding more about the below error: Jan 20 05:34:58 ldap2 slapd[2561]: conn=1025 op=1 RESULT tag=97 err=14 text=SASL(0): successful result: Jan 20 05:34:58 ldap2 slapd[2561]: conn=1025 op=2 BIND dn="" method=163 Jan 20 05:34:58 ldap2 slapd[2561]: SASL [conn=1025] Failure: Inappropriate authentication Jan 20 05:34:58 ldap2 slapd[2561]: conn=1025 op=2 RESULT tag=97 err=50 text=SASL(-14): authorization failure: Inappropriate authentication Jan 20 05:34:58 ldap2 slapd[2561]: conn=1025 op=3 UNBIND Jan 20 05:34:58 ldap2 slapd[2561]: conn=1025 fd=31 closed More information: Openldap version:openldap-servers-2.4.23-26.el6_3.2.x86_64 What i am trying to do is i have configure bind (named) to store it's records in LDAP server using plugin provided by bind-dyndb-ldap-1.1.0-0.9.b1.el6.x86_64, And i have configure named.conf to access ldap server only through GSSAPI. options { listen-on port 53 { 127.0.0.1; }; listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; forward first; forwarders { }; #dnssec-enable yes; #dnssec-validation yes; #dnssec-lookaside auto; allow-recursion { any; }; /* Path to ISC DLV key */ #bindkeys-file "/etc/named.iscdlv.key"; #managed-keys-directory "/var/named/dynamic"; tkey-gssapi-credential "dnsadmin(a)EXAMPLE.ORG"; tkey-domain "EXAMPLE.ORG"; }; logging { channel default_debug { file "data/named.run"; severity dynamic; }; }; zone "." IN { type hint; file "named.ca"; }; include "/etc/named.rfc1912.zones"; include "/etc/named.root.key"; dynamic-db "openldap" { library "ldap.so"; #arg "uri ldapi://%2fvar%2frun%2fldapi"; arg "uri ldap://localhost"; arg "base cn=dns,dc=example,dc=org"; arg "fake_mname ldap2.example.org."; arg "auth_method sasl"; arg "sasl_mech GSSAPI"; arg "sasl_user dnsadmin(a)EXAMPLE.ORG"; arg "zone_refresh 30"; }; As you can see named checks for dnsadmin(a)EXAMPLE.ORG as it sasl authentication user, dnsadmin(a)EXAMPLE.ORG is an user who exists in ldap records dn: cn=dnsadmin,ou=People,dc=example,dc=org cn: dnsadmin sn: user objectClass: person objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux userPassword:: U2VjcmV0MTIz krbPrincipalName: dnsadmin(a)EXAMPLE.ORG krbLoginFailedCount: 0 krbPrincipalKey:: MIIByKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBsDCCAawwVKAHMAWgAwIBAKFJ MEegAwIBEqFABD4gACUNiDAaRqfI6BDKN9YZ/DhvIf6TfUZY8pdWQ5HvM1ZI/DOxdPnIoXfnbjRT+ i7D7lMpkixzcxcFki3fFDBEoAcwBaADAgEAoTkwN6ADAgERoTAELhAAqBkEvL+gzUndM8TNS7ik+I 1weyacnVPB3PaFjtteeQBLcmrqikUN9eCWTDgwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAM0347z v8kK3gj0A9SYOzUDa7Hc89pG1dg4LOdJfam6QkNGamezP45ZnFLzGSQ/oTR76I3YwRKAHMAWgAwIB AKE5MDegAwIBF6EwBC4QAC3muW46EjvmxYXnvzA11/kiUrGwknrOL/dtcVVhx2ul81zChqkfuHYjU BbTMDygBzAFoAMCAQChMTAvoAMCAQihKAQmCADtDnWrNBUuisnbEstExWOiwQphTqqXyrzPi1XQ3U jvE0TpMZUwPKAHMAWgAwIBAKExMC+gAwIBA6EoBCYIAFNul3CO38n/hMzLT9lT31ma7ObzhJ9B1qn BIGSvn7wDSiH2dw== krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20130119232256Z krbExtraData:: AALQKvtQcm9vdC9hZG1pbkBFWEFNUExFLk9SRwA= krbExtraData:: AAgBAA== named reads /etc/named.keytab file to get dnsadmin(a)EXAMPLE.ORG [root@ldap2 master]# klist -k /etc/named.keytab Keytab name: WRFILE:/etc/named.keytab KVNO Principal ---- -------------------------------------------------------------------------- 2 dnsadmin(a)EXAMPLE.ORG 2 dnsadmin(a)EXAMPLE.ORG 2 dnsadmin(a)EXAMPLE.ORG 2 dnsadmin(a)EXAMPLE.ORG 2 dnsadmin(a)EXAMPLE.ORG 2 dnsadmin(a)EXAMPLE.ORG what i am looking for is when bind tries to connect using " dnsadmin(a)EXAMPLE.ORG" to ldap server i am seeing below error Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 op=0 RESULT tag=97 err=14 text=SASL(0): successful result: Jan 20 05:47:43 ldap2 slapd[2561]: connection_input: conn=1031 deferring operation: binding Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 op=1 BIND dn="" method=163 Jan 20 05:47:43 ldap2 slapd[2561]: connection_input: conn=1031 deferring operation: binding Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 op=1 RESULT tag=97 err=14 text=SASL(0): successful result: Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 op=2 BIND dn="" method=163 Jan 20 05:47:43 ldap2 slapd[2561]: SASL [conn=1031] Failure: Inappropriate authentication Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 op=3 UNBIND Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 op=2 RESULT tag=97 err=50 text=SASL(-14): authorization failure: Inappropriate authentication Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 fd=34 closed Can any one help me on how to enable more debugging to get more info about the error=50 (Insufficient access error) , Below is my olcAuthRegexp configuration: # config dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /opt/setup-openldap/sample-slapd.conf olcConfigDir: /etc/openldap/slapd.d/ olcAllows: bind_v2 ... .. ... ... .... olcTLSCACertificateFile: /etc/pki/tls/certs/cacert.pem olcTLSCertificateFile: /etc/pki/tls/certs/server.pem olcTLSCertificateKeyFile: /etc/pki/tls/certs/serverkey.pem olcTLSVerifyClient: allow olcToolThreads: 1 olcWriteTimeout: 0 olcAuthzRegexp: {0}uid=(.*),cn=EXAMPLE.ORG,cn=gssapi,cn=auth uid=$1,ou=People ,dc=example,dc=org olcLogLevel: stats And the output of ldapwhoami [root@ldap2 master]# ldapwhoami -Y GSSAPI -H ldapi:/// SASL/GSSAPI authentication started SASL username: dnsadmin(a)EXAMPLE.ORG SASL SSF: 56 SASL data security layer installed. dn:uid=dnsadmin,cn=example.org,cn=gssapi,cn=auth I just want to find out why named when trying to sasl bind with openldap it fails, Thanks Niranjan

2 2

ldap users with users samba
by rodrigo tavares 19 Jan '13

19 Jan '13

Hello ! I trying sync ldap users with users samba. I´m using a interface, by create ldap users. So, when ldap user be created, i want account e password samba be created. No my smb.conf I put the follow lines: ldap admin dn = cn=admin,dc=def,dc=mg,dc=gov,dc=br ldap group suffix = ou = groups ldap machine suffix = ou = computers ldap passwd sync = yes encrypt passwords = Yes ldap suffix = dc=def,dc=mg,dc=gov,dc=br ldap ssl = no ldap user suffix = ou = defensory smb ports = 445 139 add user script = /usr/sbin/smbldap-useradd -a -m "%u" add group script = /usr/sbin/smbldap-groupadd -p "%g" add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g" delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g" set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%u" add machine script = /usr/sbin/smbldap-useradd -w "%u" passwd program = /usr/sbin/smbldap-passwd -s "%u" passdb backend = ldapsam:ldap://10.65.8.95 passdb backend = tdbsam hosts allow = 127.0.0.1, 10.65.8.0/255.255.252.0 pam password change = yes passwd program = /usr/bin/passwd %u I configure in sladp.conf: include /etc/ldap/schema/ppolicy.schema moduleload ppolicy.so overlay ppolicy access to attrs=userPassword,shadowLastChange,sambaPwdMustChange,sambaLMPassword,sambaPwdLastSet,sambaNTPassword by dn="cn=admin,dc=def,dc=mg,dc=gov,dc=br" write by anonymous auth by self write by * none The user ldap is done, but samba user is not created. See some logs: Jan 18 16:09:01 defensoria slapd[6210]: conn=2455 fd=50 ACCEPT from IP=10.65.8.95:54507 (IP=0.0.0.0:389) So its bad. root@replica:/etc/ldap# smbclient -L 10.65.8.95 -U xbox Enter xbox's password: session setup failed: NT_STATUS_LOGON_FAILURE Thanks ! Rodrigo Faria Tavares

1 0

Re: don't get running the slapd while using mdb backend
by Meike Stone 19 Jan '13

19 Jan '13

> >>>>> So my first question: >>>>> Does mdb have limitations like bdb it have aka BDB_IDL_LOGN? >>>> >>>> >>>> >>>> Yes. back-mdb is ~60% the same code as back-bdb/hdb, its indexing >>>> functions are basically identical. >>> >>> >>> >>> However, I never got mdb to work successfully by modifying these values. >> >> >> Does this mean, it's not possible at moment to get running the mdb >> with BDB_IDL_LOGN = 2^17? > > > I can guarantee that would never work, as the variable with MDB is > MDB_IDL_LOGN. I don't recall exactly the issues I hit when changing it to > 17 from 16. Also, MDB has changed substantially since I did that testing. > ;) I was ok with not modifying it given the read speed improvements in mdb > vs bdb. > Thank for sharing, so I'll do test regarding this with the unmodified slapd and mdb, if it is fast enough in our environment! Have a nice weekend! Meike

2 1

Re: don't get running the slapd while using mdb backend
by Meike Stone 19 Jan '13

19 Jan '13

>>> So my first question: >>> Does mdb have limitations like bdb it have aka BDB_IDL_LOGN? >> >> >> Yes. back-mdb is ~60% the same code as back-bdb/hdb, its indexing >> functions are basically identical. > > > However, I never got mdb to work successfully by modifying these values. Does this mean, it's not possible at moment to get running the mdb with BDB_IDL_LOGN = 2^17? @Howard: I'm sorry, it was really not my intention to annoy, because of my statement about this problem in the bdb/mdb. Yes and I've read/followed each document under http://symas.com/mdb/, but not every one is a developer and not all of them is easy to understand. I try to get deeper inside to openldap and understand how it works, but it is really hard ;-) But anyway, I have to say thanks to all the great work you and the developer have done on openldap and especially mdb too! Thanks Meike

2 1

← Newer
1
2
3
4
5
6
7
8
9
...
14
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical January 2013