January 2014 - openldap-technical

by Borresen, John - 0442 - MITLL

All, Attempting to backtrack a bit by deleting an overlay using the following (have tried both with & without the escape character with the same error "Invalid DN": # ldapdelete -W -x -ZZ -D cn=admin,cn=config -v -d 9 "olcOverlay=\{0\}syncprov,olcDatabase=\{0\}config,cn=config" And receiving the following error: ... read1msg: ld 0xb749c40 0 new referrals read1msg: mark request completed, ld 0xb749c40 msgid 3 request done: ld 0xb749c40 msgid 3 res_errno: 34, res_error: <invalid DN>, res_matched: <> ldap_free_request (origid 3, msgid 3) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (}) ber: ldap_msgfree ldap_err2string ldap_delete: Invalid DN syntax (34) additional info: invalid DN ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 3 TLS trace: SSL3 alert write:warning:close notify ldap_free_connection: actually freed Here is a slapcat of that "olcDatabase". # slapcat -s olcDatabase=\{0\}config,cn=config dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcAddContentAcl: TRUE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,cn=config olcRootPW:: _________________________________= olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 4354a8b6-8a36-4804-81f8-14a8550aef74 creatorsName: cn=config createTimestamp: 20131218155313Z entryCSN: 20131218155313.477459Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20131218155313Z dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: 644d3984-d125-446e-aae2-1ddc541f4661 creatorsName: cn=admin,cn=config createTimestamp: 20140121191314Z entryCSN: 20140121191314.076259Z#000000#004#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140121191314Z Thanks in advance John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

9 years, 10 months

1
0
0 / 0

indexing warning considered harmful

by Michael Ströder

HI! We all know the following messages in syslog (loglevel stats): mdb_equality_candidates: (foo) not indexed At first glance this seems helpful to find indexing issues. But IMO 1. this is somewhat mis-leading. regarding performance tuning and 2. if internal searches are conducted (e.g. by set-based ACLs) the amount of the very same indexing warnings is really annoying and costs performance due to excessive logging. AFAIK a set of search candidates is derived from filter assertions by first searching the indexed attributes. Then the non-indexed assertions are tested but only on the search candidate set. Is this correct? If yes, then indexing an attribute which is present in many entries can lead to large search candidate set even though the amount of final search results are small. Consider the following simple example: (&(objectClass=posixAccount)(uid=foo)) With lots of user accounts this would lead to two search candidate sets, one very large and one with one entry (assuming uid values are unique). Not indexing objectClass would one result in *one* search candidate. So indexing objectClass might not be very wise. What do you think about this? Ciao, Michael.

9 years, 10 months

3
4
0 / 0

slapadd question

by Mundry, Marvin

hi, when I use slapadd to setup cn=config I get > slapadd: warning, missing attrs entryUUID,entryCSN from entry dn="olcDatabase=bdb,cn=config" warnings (one for each database and overlay that is configured) as soon as I add an olcSyncrepl attribute to "dn: olcDatabase=config,cn=config" should I be worried about these warnings? what I am doing: slapadd -S 1 -bcn=config -l slapd.ldif -F slapd.d/ with slapd.ldif having the following content: dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /usr/local/openldap/var/run/slapd.args olcPidFile: /usr/local/openldap/var/run/slapd.pid dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/local/openldap/libexec/openldap olcModuleload: back_bdb.la dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema include: file:///usr/local/openldap/etc/openldap/schema/core.ldif dn: olcDatabase=frontend,cn=config objectClass: olcDatabaseConfig olcDatabase: frontend dn: olcDatabase=config,cn=config objectClass: olcDatabaseConfig olcDatabase: config olcRootDN: cn=admin,cn=config olcRootPW:: e1NTSEF9L1Q1US9ibUl0V3pYRnpOUG9iajdsbk5IVVJmS2E5Ykk= olcSyncrepl: rid=001 provider=ldap://someldapserver/ binddn="cn=acme" credentials=secret bindmethod=simple searchbase="cn=config" type=refreshAndPersist dn: olcDatabase=bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: bdb olcSuffix: dc=my-domain,dc=com olcRootDN: cn=Manager,dc=my-domain,dc=com olcRootPW: secret olcDbDirectory: /usr/local/openldap/var/openldap-data Best regards, Marvin

9 years, 10 months

2
1
0 / 0

Ldap Autofs Connection Issue

by Borresen, John - 0442 - MITLL

All, Here is an interesting dilemma that we are trying to figure out. server1.example.ldap server2.example.ldap client1.example.ldap All running 2.4.38, this is a test environment. Server1 is a client to itself, server2 is a client to itself, and client1 is a client to server2. client1's LDAP Autofs (in the /etc/nsswitch.conf) is pointing to server2...and it works fine. In the /etc/sysconfig/autofs file on the client (client1) the URI entry indicates: "ldap://server2.example.ldap"; and the /etc/nsswitch.conf file shows "ldap" On both server1 and server2, for now -- because if fails otherwise, the URI in the /etc/sysconfig/autofs shows "ldaps://server1.production.ldap"; and the /etc/nsswitch.conf file shows "ldap". As you can see, the production server is using port 636 (SSL), the test environment is using TLS over port 389. Neither test environment server holds the production certificates, and the production side is not holding the test environment certs. Another interesting tidbit, is all the Automount/NFS servers are NetApp filers and they hold certs for the Production Environment, except one which is a Test Filer (in the Test Environment). Sorry if this sounds like an old "Abbott & Costello" routine from the 30's... If anyone can shed some light on what to look for. That would be great. By the way, permission is not an issue. I can explicitly mount all mountpoints to all three in the test environment. The issue is LDAP and Autofs in the Test environment. Thanks, in advance. -----Original Message----- From: openldap-technical-bounces(a)OpenLDAP.org [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Dieter Klünter Sent: Friday, January 24, 2014 4:09 PM To: openldap-technical(a)openldap.org Subject: Re: Ldap Connection Issue Am Fri, 24 Jan 2014 14:45:25 -0500 schrieb "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu>: > All, > > Very similar issue that Warron was/is having. > > Server1: # ldapsearch -W -x -ZZ -b cn=config -v -D cn=admin,cn=config > Server1: # ldapsearch -W -x -ZZ -H ldap://server2.example.ldap -b > cn=config -v -D cn=admin,cn=config > > These commands work (they returns the dbase as expect & desired), both > servers are clients to themselves and the other server (using > self-signed wildcard certificates) Both ldap.confs are identical, the > one on server1 was used on server2. The URI directive looks like: > > uri ldap://server1.example.ldap ldap://server1.<FQDN> > ldap://server2.example.ldap ldap://server2.<FQDN> > > Server2: > > a) # ldapsearch -W -x -ZZ -b cn=config -v -D cn=admin,cn=config > Fails with: > ldap_initialize( <DEFAULT> ) > ldap_start_tls: Connect error (-11) > > > b) # ldapsearch -W -x -ZZ -H ldap://server2.example.ldap -b > cn=config -v -D cn=admin,cn=config > > ldap_initialize( ldap://server2.example.ldap:389/??base ) > > ldap_start_tls: Connect error (-11) > > > c) # ldapsearch -W -x -ZZ -h ldap://server1.example.ldap -b > cn=config -v -D cn=admin,cn=config > > d) ldap_initialize( ldap://ldap:%2F%2Fserver1.example.ldap) > > e) Could not create LDAP session handle for > URI=ldap://ldap:%2F%2Fgp42-admin4.llan.ll.mit.edu (-9): Bad parameter > to an ldap routine > > There is one other client that like server1 can search the dbase(s) on > both servers (it too is a client of both servers). > > Any ideas at what to look for? read on ldapsearch(1) and distinction of -h and -H parameters. furthermore read on LDAP URL and escape sequences (RFC-4516). -Dieter -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

9 years, 10 months

1
0
0 / 0

Question about olcServerID

by Philip Colmer

If I extend my existing OpenLDAP implementation to support N-way multi-master, is it acceptable for the first server to retain an olcServerID of 0 (the default when OpenLDAP gets installed) or do I need to change it to a non-zero value? Probably a stupid question but I thought I better ask before making any changes :-) Thanks. Philip

9 years, 10 months

1
0
0 / 0

Re: SLAPD Proxy and AD backend - Binding by UPN.

by egidiomelissano＠libero.it

> You can configure dovecot to use any (unique) user record attribute for authentication Could you give me an example, please? Regards, Egidio.

9 years, 10 months

2
1
0 / 0

SLAPD Proxy and AD backend - Binding by UPN.

by egidiomelissano＠libero.it

Hello everyone. First of all, I'm a newbie in OpenLDAP Server administration (but not in Active Directory). Said that, this is my goal: - set up an LDAP Front End-Server to a AD Back-End Server - and, so far, there are many infos about this. But I wanna do it in an environment where there are many UX services which binding to AD Server, and any service of these needs ldap-client configuration, with insertion and storing of credential for binding. One of these is Dovecot which do ldap-authentication of any user of its by a typical fashion... user: ad_username(a)my.ad psw: ad_username_password Hence, I wish to avoid spreading of AD-binding-credentials gathering this couple of data in just one point of my system: that is, OpenLDAP proxy or SLAPD Front-End. I've already tried to do it. First of all, I got an error at installation stage which gave me crazy and I've not yet solved: i.e, after copy of DB_CONFIG example file to lib directory: root@lamp ~# rm -fr /var/lib/ldap/* && rm -fr /etc/ldap/slapd.d/* && cp /usr/share/slapd/DB_CONFIG /var/lib/ldap/DB_CONFIG when I run: root@lamp ~# slapadd -v -l xdom.ldif+ I get an error like the following: 52e1597b bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap: (14). Even though DB_CONFING is there and has right permissions... Anyway, I discovered that this issues was not blocking, so I went forward. I populate splap.d: root@lamp ~# slaptest -f /etc/ldap/slapd.conf -F /etc/ldap/slapd.d/ 52e280b2 bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap: (14). Expect poor performance for suffix "dc=xdom,dc=loc". I gave right permission to directories: root@lamp ~# chown -R openldap:openldap /etc/ldap/slapd.d/ && chown -R openldap:openldap /var/lib/ldap/ and I started LDAP Service: root@lamp ~# service slapd start At this time, I tested OpenLDAP Proxy Server by 5 combinations of ldap request: 1) bypassing OpenLDAP Proxy Server and directly binding AD Server by conventional D.N.: ldapsearch -H ldap://server.my.ad -D "cn=ad_user,ou=ced,dc=my,dc=ad" -w ad_user_password -x -b "ou=ced,dc=my,dc=ad" -LLL "(sAMAccountName=*)" and it works. 2) bypassing OpenLDAP Proxy Server and directly binding AD Server by U.P.N (User Principal Name): ldapsearch -H ldap://server.my.ad -D ad_user(a)my.ad -w ad_user_password -x -b "ou=ced,dc=my,dc=ad" -LLL "(sAMAccountName=*)" and it works. 3) through OpenLDAP Proxy Server without any binding: ldapsearch -x -b "ou=ced,dc=my,dc=ad" -LLL "(sAMAccountName=*)" and it works. 4) through OpenLDAP Proxy Server and binding by conventional D.N.: ldapsearch -D "cn=ad_user,ou=ced,dc=my,dc=ad" -w ad_user_password -x -b "ou=ced,dc=my,dc=ad" -LLL "(sAMAccountName=*)" and it works. 5) through OpenLDAP Proxy Server and binding by U.P.N (User Principal Name): ldapsearch -D ad_user(a)my.ad -w ad_user_password -x -b "ou=ced,dc=my,dc=ad" - LLL "(sAMAccountName=*)" and it DOES NOT works. And it is a very BIG BIG problem for me: I cannot force users to authenticate themselves in Dovecot by complicated and unacceptable (because of comma, equal and space characters) D.N.!!!! I tried to face this issue by Rewriting Overlay, just to discover that these library rewrite BINDDN only after "dnPrettyNormal()" call (making "rewriting- method" useless...) Now, please: help me!!!! What can I do? How can I solve my issue??? And how can I avoid DB_CONFING issue? Regards, Egidio. PS: follow my ldap.conf and slapd.conf ## LDAP.CONF #################################### BASE dc=xdom,dc=loc URI ldap://localhost TLS_CACERT /etc/ssl/certs/ca-certificates.crt ## SLAPD.CONF #################################### include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args logfile /var/log/slapd.log loglevel -1 modulepath /usr/lib/ldap moduleload back_bdb moduleload back_ldap moduleload rwm tool-threads 1 database bdb suffix "dc=xdom,dc=loc" checkpoint 1024 15 rootdn "cn=droot,dc=xdom,dc=loc" rootpw {SSHA}Xhy4Gc0k5DU+gfpbpkv+PJWJ92Itp5rJ Database ldap Suffix "dc=ts,dc=dipvvf,dc=it" Uri "ldap://server.my.ad/ ldap://server2.my.ad/" rebind-as-user idassert-bind bindmethod=simple binddn="cn=email ed. demon,ou=email,ou=virtualization,ou=ced,dc=ts, dc=dipvvf,dc=it" credentials=xxxxxx mode=none idassert-authzFrom "*" overlay rwm rwm-rewriteEngine on rwm-rewriteMap ldap samacc "ldap://vfdc1.ts.dipvvf.it/dc=ts,dc=dipvvf,dc=it?dn? sub?samaccountname=" #"ldap:///dc=ts,dc=dipvvf,dc=it?dn?sub?samaccountname=" rwm-rewriteContext bindDN rwm-rewriteRule "^([^,]+)@[^,]+$" "${samacc($1)}" ":@I"

9 years, 10 months

2
1
0 / 0

Ldap Connection Issue

by Borresen, John - 0442 - MITLL

All, Very similar issue that Warron was/is having. Server1: # ldapsearch -W -x -ZZ -b cn=config -v -D cn=admin,cn=config Server1: # ldapsearch -W -x -ZZ -H ldap://server2.example.ldap -b cn=config -v -D cn=admin,cn=config These commands work (they returns the dbase as expect & desired), both servers are clients to themselves and the other server (using self-signed wildcard certificates) Both ldap.confs are identical, the one on server1 was used on server2. The URI directive looks like: uri ldap://server1.example.ldap ldap://server1.<FQDN> ldap://server2.example.ldap ldap://server2.<FQDN> Server2: a) # ldapsearch -W -x -ZZ -b cn=config -v -D cn=admin,cn=config Fails with: ldap_initialize( <DEFAULT> ) ldap_start_tls: Connect error (-11) b) # ldapsearch -W -x -ZZ -H ldap://server2.example.ldap -b cn=config -v -D cn=admin,cn=config ldap_initialize( ldap://server2.example.ldap:389/??base ) ldap_start_tls: Connect error (-11) c) # ldapsearch -W -x -ZZ -h ldap://server1.example.ldap -b cn=config -v -D cn=admin,cn=config d) ldap_initialize( ldap://ldap:%2F%2Fserver1.example.ldap) e) Could not create LDAP session handle for URI=ldap://ldap:%2F%2Fgp42-admin4.llan.ll.mit.edu (-9): Bad parameter to an ldap routine There is one other client that like server1 can search the dbase(s) on both servers (it too is a client of both servers). Any ideas at what to look for? thanks in advance John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Ph: (781) 981-1609 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

9 years, 10 months

2
2
0 / 0

LMDB as separate library

by Jan Staněk

Hello, I'm trying to package LMDB for Fedora as possible system-wide replacement for Oracle's BerkeleyDB. The main trouble is that in current state the LMDB builds an unversioned liblmdb.so, although having a option to link the binaries dynamically without patching the Makefile would be also nice. I want to ask, are there any intentions to release the LMDB as separable library (with versioned soname, etc.)? Thanks in advance, Jan -- Jan Stanek - Red Hat Associate Developer Engineer - Databases Team

9 years, 10 months

2
1
0 / 0

ldap_bind: Invalid credentials (49)

by W Forum W

Hi, I try to add the samba.schema in my openldap server (Debian Wheezy), default installed. slapd: 2.4.31 ldap-utils 2.4.31 I followed this tutorial https://help.ubuntu.com/10.04/serverguide/samba-ldap.html I can use ldapsearch, ldapadd and ldapmodify with my cn=admin,dc=example,dc=com password but when I try to add the new schema to the directory with ldapadd -x -D cn=admin,cn=config -W -f /tmp/cn\=samba.ldif I get ldap_bind: Invalid credentials (49) Is there a different password for cn=admin,cn=config? I was never asked to create it. And how can I change it if necessary? Many thanks!!!

9 years, 10 months

4
4
0 / 0

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical January 2014