openldap-technical November 2013

openldap-technical@openldap.org

73 participants
72 discussions

Replication fails after network outage
by Darouichi, Aziz 15 Nov '13

15 Nov '13

Hi, We are running 2 replicas one local and the other is remote. When there is a network interruption replication fails and I have to delete the entire database in the remote replica, and let it re-synch again. Is there a way to make the remote continue its replication after the network connection is established without having to delete the database or restart the services? Thank you,

6 10

Can a DN entry have multiple structural object class
by Harishkumar Pathangay 14 Nov '13

14 Nov '13

Hi, Can a DN entry have multiple structural object class? For example, an entry with inetOrgPerson Object class with custom object class, both being STRUCTURAL. Thanks,Harish Pathangay

2 1

trouble when switching from bdb to mdb database
by Aleksander Dzierżanowski 14 Nov '13

14 Nov '13

Hi. I have properly runnig setup of three multimaster OpenLDAP servers (version 2.4.36 from ltb project) with bdb database backend. Everything was working flawless so I decided to try out ‚new shiny' mdb database with the same configuration - the only thing I changed was removing ‚cache’ settings and adding ‚maxsize’. What I’m doing and observing: - clear all config and database on all masters. Generate new configuration from slapd.conf using ‚slaptest’ tool. - on master1 I add three base organizations let’s say o=test1 + o=test2 + o=test3 using slapadd [without -w switch] - on master1 I add some entries using ldapadd command so all organizations have now contextCSN attribute. - starting master1 - everything OK - starting master2 - everything OK, including succesfull replication from master1 - starting master3 - everything OK and including replication, but… some or all other master are dying unexpectedly. strace of dying process show: --- write(2, "slapd: id2entry.c:509: mdb_opinfo_get: Assertion `!rc' failed.\n", 63) = 63 — debug log last lines: — => mdb_entry_get: ndn: „o=test1” => mdb_entry_get: oc: "(null)", at: „contextCSN" — But when I do ‚slapcat’ I can clearly see contextCSN for all o=test[123] databases... Is it bug or some possible replication configuration issue? — Olo

4 5

olcAccess: Regex questions for "departments" and there admins
by Denny Fuchs 14 Nov '13

14 Nov '13

hi, I plan the new ACL layout for our Wheezy LDAP server. Our layout: Main suffix: dc=example,dc=com than the first department: ou=department1,dc=example,dc=com ou=people,ou=department1,dc=example,dc=com uid=foobar,ou=people,ou=department1,dc=example,dc=com [...] ou=groups,ou=department1,dc=example,dc=com gid=students,ou=groups,ou=department1,dc=example,dc=com [...] ou=roles,ou=department1,dc=example,dc=com cn=mail,ou=roles,ou=department1,dc=example,dc=com cn=admins,ou=roles,ou=department1,dc=example,dc=com ou=services,ou=department1,dc=example,dc=com ou=mail,ou=services,ou=department1,dc=example,dc=com cn=aliases,ou=mail,ou=services,ou=department1,dc=example,dc=com [...] next department2, the same: ou=department2,dc=example,dc=com ou=people,ou=department2,dc=example,dc=com uid=foobar,ou=people,ou=department2,dc=example,dc=com [...] [...] .... complete the same one, as department1 Now I stuck on the ACLs. I want to make use of RegEx, so that every department has its own roles, groups and admins and access only to there (for example) services. What I already have: {0}to attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTpassword by self =xw by anonymous auth by * none {1}to dn.regex="uid=(.+),ou=people,ou=(.+),dc=example,dc=com$" attrs="myFB,myStudiengang,gender,myMatrikel,myTudUserUniqueID" by self read by * none {2}to dn.regex="uid=(.+),ou=people,ou=(.+),dc=example,dc=com$" attrs="mail,myMailalias,myMailDomain,myNoMail" by self read by dn.regex="cn=mail,ou=roles,ou=$2,dc=example,dc=com$" read by * none {3}to dn.regex="^(.+,)?ou=mail,ou=services,ou=(.+)?,dc=example,dc=com$" by dn.regex="cn=mail,ou=roles,ou=$2,dc=example,dc=com$" read {4}to dn.regex="^(.+,)?ou=services,ou=(.+,)?dc=example,dc=com$" by * none {5}to * by dn.base="cn=Admin,dc=example,dc=com" write by * read {6}to dn.base="dc=example,dc=com" by self write by dn.base="cn=Admin,dc=example,dc=com" write by * read I'm able to read the subtree: "ou=mail,ou=services,ou=department1,dc=example,dc=com" only with the authenticated user "cn=mail,ou=roles,ou=department1,dc=example,dc=com" and "ou=mail,ou=services,ou=department2,dc=example,dc=com" with authenticated user "cn=mail,ou=roles,ou=department2,dc=example,dc=com" and I can't search with user from ou=department2 the service tree from ou=department1 :-) But, why I can't see the "ou=services,ou=department2,dc=example,dc=com" ? Just for me to know, where I have a problem ... for the services (Postfix in most cases) it isn't important, that they can't see the "ou=services" Also I want to make sure, that every department "admin group" (cn=admins,ou=roles,ou=<department>,dc=example,dc=com -> groupOfUniqueNames) can do everything under there (and only) three ou=<department>,ou=example,ou=com so, any tipps are welcome :-) cu denny pages I have already open: http://www.openldap.org/doc/admin24/access-control.html http://wiki.mandriva.com/fr/uploads/3/3a/Mandriva-dit-access-template.conf http://www.openldap.org/devel/admin/slapdconf2.html

2 3

Re: [Engine-devel] OpenLdap and Kerberos for oVirt on f19
by Piotr Kliczewski 14 Nov '13

14 Nov '13

On Thu, Nov 14, 2013 at 11:05 AM, Juan Hernandez <jhernand(a)redhat.com> wrote: > On 11/14/2013 11:01 AM, Piotr Kliczewski wrote: >> Hello everyone, >> >> I working on configuring OpenLdap 2.4.36 with kerberos for oVirt running on f19. >> >> I follow following instruction: >> https://bugzilla.redhat.com/show_bug.cgi?id=967327#c5 >> >> Please note that the instruction was written for f18. In order to have >> step 18 working from >> command line I had to set SASL_NOCANON to off. The reason was that I got: >> >> ldap_sasl_interactive_bind_s: Invalid credentials (49) >> additional info: SASL(-13): authentication failure: GSSAPI Failure: >> gss_accept_sec_context >> >> When SASL_NOCANON is off I can search the ldap but have the same issue >> from java code: >> >> I got javax.naming.AuthenticationException: [LDAP: error code 49 - >> SASL(-13): authentication failure: GSSAPI Failure: >> gss_accept_sec_context]. >> Have this when connecting using engine-manage-domains >> (http://gerrit.ovirt.org/gitweb?p=ovirt-engine.git;a=blob;f=backend/manager/… >> line 84). >> >> Can you please point me where is my config issue? >> >> I copied engine-devel for reference. >> > > Do you have the cyrus-sasl-gssapi package installed? That should have > been part of step 1. Try this: > > # yum -y install cyrus-sasl-gssapi > > I think that once that is installed you shouldn't need to set > SASL_NOCANON off. > You are right the package was not installed I restarted slapd, krb5kdc and kadmin after installing. I kinit one more time and tried to ldapsearch as in step 18 but with the same result. > -- > Dirección Comercial: C/Jose Bardasano Baos, 9, Edif. Gorbea 3, planta > 3ºD, 28016 Madrid, Spain > Inscrita en el Reg. Mercantil de Madrid – C.I.F. B82657941 - Red Hat S.L.

1 1

OpenLdap and Kerberos for oVirt on f19
by Piotr Kliczewski 14 Nov '13

14 Nov '13

Hello everyone, I working on configuring OpenLdap 2.4.36 with kerberos for oVirt running on f19. I follow following instruction: https://bugzilla.redhat.com/show_bug.cgi?id=967327#c5 Please note that the instruction was written for f18. In order to have step 18 working from command line I had to set SASL_NOCANON to off. The reason was that I got: ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context When SASL_NOCANON is off I can search the ldap but have the same issue from java code: I got javax.naming.AuthenticationException: [LDAP: error code 49 - SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context]. Have this when connecting using engine-manage-domains (http://gerrit.ovirt.org/gitweb?p=ovirt-engine.git;a=blob;f=backend/manager/… line 84). Can you please point me where is my config issue? I copied engine-devel for reference. Thanks, Piotr

1 0

"dn: cn=admin,cn=config" adding problem
by Oleg 13 Nov '13

13 Nov '13

Hello. Our slapd listens on outer interfaces and i want to create an access rule for rootdn to allow admin access only from 127.0.0.1 ip. So, i try to add "dn: cn=admin,cn=config" record to config database: ~# cat admin.ldif dn: cn=admin,cn=config objectClass: person cn: admin sn: admin userPassword: 1 ~# ldapadd -xWD 'cn=admin,cn=config' -f admin.ldif Enter LDAP Password: adding new entry "cn=admin,cn=config" ldap_add: Object class violation (65) I got no extra info, just this. According to core.schema mandatory fields are only cn and sn. So, i don't understand why i see this error. Can anybody help me? Thanks.

7 18

TLS_REQCERT and no server certificate
by Jan Synacek 13 Nov '13

13 Nov '13

Hello, quoting ldap.conf(5): TLS_REQCERT <level> ... try The server certificate is requested. If no certificate is provided, the session proceeds normally. If a bad certificate is provided, the session is immediately terminated. ... I'd like to try the "If no certificate is provided" part, but can't manage to do so. I tried configuring the server to 1) not use any CA certificate or server certificate, 2) only use the CA certificate without any server certificate, 3) specify CA certificate dir with no certs in it, 4) specify CA certificate dir with a valid CA cert and no server certs. In any case, the client (ldapsearch) doesn't even connect to the server, stating either "SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure" or simply failing to connect with "Can't contact LDAP server (-1)". The server is listening on ldap and ldaps. I tested this using both ldaps and StartTLS. That leads me to a conclusion that what I'm trying to achieve is not achievable and that the manpage should be changed. Is the manpage wrong or is there any other way I can test the client with no server certificate provided? Cheers, -- Jan Synacek Software Engineer, Red Hat

4 9

RE24 testing call (OpenLDAP 2.4.38)
by Quanah Gibson-Mount 12 Nov '13

12 Nov '13

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.38 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

4 3

Last days to get a place at LDAPCon 2013!
by Clément OUDOT 12 Nov '13

12 Nov '13

Hi, the final program of LDAPCon has been published: http://ldapcon.org/#program The conference is now in one week, and you can still book your place: http://ldapcon2013.eventbrite.fr Hope to see you next week in Paris! Clément.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical November 2013