openldap-technical November 2013

openldap-technical@openldap.org

73 participants
72 discussions

Q: "opjectClass: top" or not?
by Ulrich Windl 22 Nov '13

22 Nov '13

Hi! Sorry, this is a somewhat generic question: I wonder what difference it makes whether I specify "objectClass: top" for an object, or not: Conceptually, "top" is included automatically (so the objectClass attribute goes to any structural class), but when I fetch an object, I never see the "top" objectClass. Explicitly specifying "objectClass: top" makes every object a few bytes larger. So is there any reason to explicitly specify "objectClass: top"? Regards, Ulrich

3 2

fwd field
by arun.sasi1＠wipro.com 22 Nov '13

22 Nov '13

Hello Team, I have a mail server which is authenticating with OPenLDAP; when I set mail forwarding option I get the below error code LDAP Error Code - 17 - Undefined attribute type so I would like to know how to enable fwd filed and related field like out of office in OpenLDAP. which schema I should use in my openldap to enable it. I have below schema already enabled. include /ldap/etc/openldap/schema/corba.schema include /ldap/etc/openldap/schema/core.schema include /ldap/etc/openldap/schema/cosine.schema include /ldap/etc/openldap/schema/duaconf.schema include /ldap/etc/openldap/schema/dyngroup.schema include /ldap/etc/openldap/schema/inetorgperson.schema include /ldap/etc/openldap/schema/java.schema include /ldap/etc/openldap/schema/misc.schema include /ldap/etc/openldap/schema/nis.schema include /ldap/etc/openldap/schema/openldap.schema include /ldap/etc/openldap/schema/ppolicy.schema include /ldap/etc/openldap/schema/collective.schema include /ldap/etc/openldap/schema/samba.schema Thanks -Arun Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

3 5

Modify indexes on a delta-syncrepl consumer
by ML mail 21 Nov '13

21 Nov '13

Hello, I am using two OpenLDAP 2.4.31 servers with delta-syncrepl as replication method. So far everything works perfectly but I was wondering how I can modify cn=config settings on the consumer. For instance I would like to add new indexes (olcDbIndex) on the consumer to my replicated HDB database but this fails as you can see here: ldap_modify: Server is unwilling to perform (53) additional info: shadow context; no update referral I understand that it does not want me to modify any settings on my consumer but I was thinking this should be possible no? If not this means if I want to change a setting on the consumer I need to delete my whole database on the consumer configure it and add replication again. Any one has an idea what am I doing wrong here? Cheers, M.L.

3 6

openldap database replication and multiple hosts TLScertificates question
by lux-integ 21 Nov '13

21 Nov '13

Greetings, I am learning to configure/use openldap. I have a question regarding database replication I have a primary openldap server. I prepared/installed openssl certificates for the server -and he slapd.conf has these lines #--- Define SSL and TLS properties TLSCertificateFile /etc/certs/ldap1stServerCert.pem TLSCertificateKeyFile /etc/certs/ldap1stServerKey.pem TLSCACertificateFile /etc/certs/cacert.pem #---if client authentication is/isNOT required TLSVerifyClient demand I want to replicate the database over two other hosts. Call these 2ndServer and 3rdserver. Both of these computers ALSO have ssl certificates in /etc/certs like so:- #### in 2nd ldap host /etc/certs/ldap2ndServerCert.pem /etc/certs/ldap2ndServerKey.pem /etc/certs/cacert.pem #### in 3rd ldap host /etc/certs/ldap3rdServerCert.pem /etc/certs/ldap3rdServerKey.pem /etc/certs/cacert.pem As regards these certificates (the fact that they are not the same ) I would like to know what happens when I try to do replication.. I am following the guides 18.3.1.1. Syncrepl configuration ( http://www.openldap.org/doc/admin24/replication.html ) and 18.3.2. Delta-syncrepl ( also from http://www.openldap.org/doc/admin24/replication.html ) ( In otherwords is is best to remove the certificates and install after replication or whatever. ) Thanks in advance sincerely LuxInteg

2 1

SSL authentication to Active Directory via OpenLDAP client
by Ashwin Kumar 21 Nov '13

21 Nov '13

I have set up Active Directory to serve requests over SSL (ldaps://). Also, I have generated the certificate files on Windows 2008 server. (I have copied the self-signed certificate to test.cer) I have downloaded test.cer file to my linux machine to use it with Openldap client. The .cer file is present in /etc/openldap/certs directory and the content of ldap.conf file is TLS_CACERTDIR /etc/openldap/certs However, when I issue an ldapsearch on the Active Directory I end up with the following error: ldapsearch -x -H ldaps://192.168.1.84:636 -D CN=Administrator,CN=Users,DC=test,DC=ldap,DC=com -b CN=Administrator,CN=Users,DC=test,DC=ldap,DC=com -w Admin123 ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) My question: 1) Is this how I use my *.cer file? 2) How do I convert it to a proper file recognized by openldap clients? 3) What am I missing? (Very new to ldap and Active Directory) 4) Any useful resource or documentation to get ldaps working? Thanks. -- Ashwin kumar (http://ashwinkumar.me)

1 0

Error while updating olcDbConfig
by Daniel Jung 20 Nov '13

20 Nov '13

Hi wonderful ppl at openldap- Running 2.4.37 - on centos 6.4 using following ldif to update olcDbConfig dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcDbConfig olcDbConfig: set_lg_max 10485760 olcDbConfig: set_lg_regionmax 262144 olcDbConfig: set_lg_bsize 2097152 olcDbConfig: set_lg_dir /var/lib/ldap/ olcDbConfig: set_lk_max_locks 8192 olcDbConfig: set_lk_max_objects 8192 olcDbConfig: set_flags DB_LOG_AUTOREMOVE olcDbConfig: set_tas_spins 1 - ldapmodifyx -d 1 -h localhost -D 'cn=Manager,cn=config' -W -f /var/tmp/ldif Getting the following error res_errno: 80, res_error: <failed to reopen database, rc=22>, res_matched: <> ldap_free_request (origid 2, msgid 2) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (}) ber: ldap_msgfree ldap_err2string ldap_modify: Other (e.g., implementation specific) error (80) additional info: failed to reopen database, rc=22 Going through the list lead me to believe that changes will be applied after the restart? but didnt say it causes an error. Also does olcDbNoSync play a role here ? Can someone shed some light on this?

3 5

Re: Openldap for proxy AD
by Clément OUDOT 20 Nov '13

20 Nov '13

2013/11/20 Willy Ramos <wrm(a)cdtn.br>: > Em 20/11/2013 10:26, Clément OUDOT escreveu: > >> 2013/11/20 <wrm(a)cdtn.br>: >>> >>> Thank you. >>> >>> Yes, the credentials are stored in AD. >>> >>> I saw this documentation, >>> http://ltb-project.org/wiki/documentation/general/sasl_delegation >>> >>> Helped me very much, but I think there are some wrong in my >>> saslauth.conf, >>> because when I put the AD server and ldap_filter = (sAMAccountName=%u is >>> Ok Success SASL, " but when I put my localhost like this: >>> >>> ldap_servers: ldaps://127.0.0.1 #or ldap://localhost >>> #ldap_servers: ldaps://1.1.2.1 >>> ldap_version: 3 >>> ldap_auth_method: bind >>> ldap_search_base: cn=users,dc=foobar,dc=br >>> #ldap_filter: (sAMAccountname=%u) >>> #ldap_filter: (userPrincipalName=%u) >>> ldap_filter: uid=%u >>> ldap_bind_dn: cn=vmail,cn=users,dc=foobar,dc=br #or >>> cn=admin,dc=foobar >>> ldap_password: abc@123 >>> ldap_deref: never >>> ldap_restart: yes >>> ldap_scope: sub >>> ldap_use_sasl: no >>> ldap_start_tls: no >>> ldap_timeout: 10 >>> >>> >>> testsaslauthd -u usertst -p password >>> >>> NO "authentication failed" >>> >>> See the log: >>> >>> Nov 20 09:13:23 mail slapd[12776]: conn=1139 fd=18 ACCEPT from >>> IP=127.0.0.1:50194 (IP=0.0.0.0:636) >>> Nov 20 09:13:23 mail slapd[12776]: conn=1139 fd=18 TLS established >>> tls_ssf=256 ssf=256 >>> Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=0 BIND >>> dn="cn=vmail,cn=users,dc=foobar,dc=br" method=128 >>> Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=0 BIND >>> dn="cn=vmail,cn=users,dc=foobar,dc=br" mech=SIMPLE ssf=0 >>> Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=0 RESULT tag=97 err=0 >>> text= >>> Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=1 SRCH >>> base="cn=users,dc=foobar,dc=br" scope=2 deref=0 filter="(uid=usertst)" >>> Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=1 SRCH attr=dn >>> Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=1 SEARCH RESULT tag=101 >>> err=0 nentries=0 text= >>> >>> What can I do to fix this? >>> >> The log says that the entry is not found (nentries=0) either because >> it does not exist, either because you can't read it (ACL). >> >> But what are you using localhost behind your SASL pass trough? Seems >> like you are doing a loop on your LDAP server. >> >> >> Clément. >> > > That is a problem, because don´t found the base but when I´m using > ldapsearch my search is acepted, very strange. > > how this example: > ldapsearch -x -H ldaps://localhost -b dc=foobar,dc=com -D > cn=usertst,cn=users,dc=foobar,dc=com -w password > > I see all objects in database, when I do this command. > > If you had another idea please tell me, I just was seeing that link in the > ltb-project.org. where tell me to use in localhost SASL. > Seems you don't really understand how it works. OpenLDAP talks to saslauthd on localhost, then saslauthd talks to AD. So don't configure localhost in saslauthd, just set your AD settings in saslauthd.conf. Clément.

3 2

Slapd sometimes stucks: slapd shutdown: waiting for N operations/tasks to finish
by Покотиленко Костик 20 Nov '13

20 Nov '13

Hi, In our 1 Master - several slaves environment master slapd sometimes stucks in such condition that it takes minutes to get replay to simple queries with no visible resource consumption on both: the slapd process itself and the linux it is running on. Restarting slapd helps for several days. Today I have not been able to restart it without kill -9 because of: slapd shutdown: waiting for 12 operations/tasks to finish Waited 5 minutes with no luck, kill -9, start. slapd: 2.4.28 OS: Ubuntu 12.04.2 LTS I'm Ok with "try latest version", but it would be nice to have some pointers (maybe bug in this version or error in configuration). The server is running for 6+ month with no problems. The stucks first appeared 2 weeks ago after changing ACLs to use group.exact instead of set which came deadly slow.

2 2

openldap syncrepl issue
by Chris Card 19 Nov '13

19 Nov '13

Hi All, I am running openldap 2.4.36 with BDB for my main backend db, and multi-master replication setup using delta-syncrepl with MDB for the cn=accesslog db. I monitor the contextCSN to check that replication is in sync, but I've noticed what looks like a bug: If I try to delete a non-existent DN from the main db on machine A, I see the delete attempt in the cn=accesslog db on machine A with status 32, but the contextCSN of the main db is not changed, as expected. On machine B the contextCSN of the main db is updated, as if the delete had succeeded, and then machine A appears to be behind machine B according to the contextCSN values. Is this a known bug? Chris

3 7

RE24 testing call (OpenLDAP 2.4.37)
by Sergio NNX 15 Nov '13

15 Nov '13

Ciao all. I'd like to contribute to this testing call. I'm afraid I haven't been as lucky as the rest of you, guys! I'm building OpenLDAP 2.4.37 from source under MinGW. When I type in: make check, all tests pass except the ones (quite a few, by the way) containing the following line: $SLAPADD -f $ADDCONF -l $LDIFORDERED (for instance here: test001-slapadd) ... 52812558 bdb_db_open: database "dc=example,dc=com": dbenv_open(testrun/db.1.a). Program received signal SIGSEGV, Segmentation fault. 0x008061de in pthread_mutex_unlock () (gdb) bt #0 0x008061de in pthread_mutex_unlock () #1 0x0055d2d1 in ldap_pvt_gettime () #2 0x0055d464 in ldap_pvt_csnstr () #3 0x004753b3 in slap_get_csn () #4 0x0041f2e5 in slap_add_opattrs () #5 0x00480fff in bdb_db_open () #6 0x00423647 in backend_startup_one () #7 0x00423785 in backend_startup () #8 0x0043f028 in slap_startup () #9 0x00477ed5 in slap_tool_init () #10 0x00476a3a in slapadd () #11 0x0080dcf3 in main () However, if I use: ldapadd ...... using exactly the same LDIF, it works fine. I've done some Google search but found nothing. Since I have no knowledge about how to fix this, I'd like to know whether there's a patch available somewhere or how I can overcome this issue. Thanks in advance. Sergio.

3 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical November 2013