openldap-technical January 2014

openldap-technical@openldap.org

74 participants
92 discussions

Re: ldap_add: Object class violation (65), additional info: attribute 'host' not allowed
by W Forum W 24 Jan '14

24 Jan '14

Hi, Thanks for the quick response I am using Debian wheezy. I installed the ldapns.schema from the deb package but I still when I try to add a user (as a ldif file with a host attribute defined) a get the error ldap_add: Object class violation (65) additional info: attribute 'host' not allowed If I remove the host attribute (from ldif file) the user is added successfully. How can I get the host attribute working? Many thanks On 01/20/2014 05:43 PM, Joshua Schaeffer wrote: > There is some information from the Debian wiki > (https://wiki.debian.org/LDAP/PAM) on adding a host attribute to a > user, but I'm sure it applies to other distro's as well: > > To add the "host" attribute to a user, he should have an objectClass > that supports this. The "account" objectClass has the attribute, but > is not compatible with the "inetOrgPerson" objectClass. To work around > this, you can use the "ldapns" schema, supplied with the libpam-ldap > <http://packages.debian.org/libpam-ldap> package. This schema provides > the "hostObject" objectClass, which has the proper "host" attribute. > > > On Mon, Jan 20, 2014 at 9:08 AM, W Forum W <wforumw(a)gmail.com > <mailto:wforumw@gmail.com>> wrote: > > Hi > I try to add a user but the host attribute is not accept > (everything else is fine) > > ldapadd -x -W -D "cn=admin,dc=example,dc=com" -f user.ldif > Enter LDAP Password: > adding new entry "uid=user,ou=Users,dc=example,dc=comt" > ldap_add: Object class violation (65) > additional info: attribute 'host' not allowed > > how can i add a host attribute > i have following schema installed > > core.schema > cosine.schema > nis.schema > inetorgperson.schema > samba.schema > > thanks in advance > >

2 1

providing a default value for an attribute (w/ translucent proxy)
by Dan Pritts 23 Jan '14

23 Jan '14

Hi all - I've got a familiar story, I'm sure. I have a campus-wide AD infrastructure that I'd like to leverage. Unfortunately, my LDAP client (an Isilon NAS) requires some attributes that AD doesn't populate. e.g., homeDirectory. As it turns out, the silly thing doesn't even use these values, at least not for our use case. But the entire lookup fails if it doesn't get something back for those attributes. I presumably can use a translucent proxy to set these attributes locally. I tested this successfully. Ideally, though, instead of creating DNs for each person on the translucent proxy server, I'd like to just have slapd fill in a default value for these attributes when they are empty. I would also be happy with a method that just overwrites the existing attribute, regardless of whether it exists. Again, for ALL DNs... I don't want to create each account individually in both places. I thought maybe the rewrite overlay would allow this but it seems like I was incorrect (please advise if it can be done). I have poked around and found no other way to do this. Am I missing something? thanks -- Dan Pritts ICPSR Computing & Network Services University of Michigan +1 (734)615-7362

2 2

Re: Implementing PPolicy
by Dieter Klünter 23 Jan '14

23 Jan '14

Am Wed, 22 Jan 2014 18:14:22 -0700 schrieb Joshua Schaeffer <jschaeffer0922(a)gmail.com>: > Just now getting back to this. I ran the daemon in debug mode, then > ran the passwd utility on a different server for my uid (got the same > results as before and then terminated the daemon) and it output a lot > on the acl's. I attached the full log file. Below is the tail end of > the log: > > =================================================== > 52e068f8 <= acl_mask: [3] mask: read(=rscxd) > 52e068f8 => slap_access_allowed: read access granted by read(=rscxd) > 52e068f8 => access_allowed: read access granted by read(=rscxd) > 52e068f8 => access_allowed: result not in cache (userPassword) > 52e068f8 => access_allowed: read access to > "uid=jschaeffer,ou=People,dc=harmonywave,dc=com" "userPassword" > requested 52e068f8 => acl_get: [1] attr userPassword > 52e068f8 => acl_mask: access to entry > "uid=jschaeffer,ou=People,dc=harmonywave,dc=com", attr "userPassword" > requested > 52e068f8 => acl_mask: to value by "", (=0) > 52e068f8 <= check a_dn_pat: self > 52e068f8 <= check a_dn_pat: anonymous > 52e068f8 <= acl_mask: [2] applying auth(=xd) (stop) > 52e068f8 <= acl_mask: [2] mask: auth(=xd) > 52e068f8 => slap_access_allowed: read access denied by auth(=xd) > 52e068f8 => access_allowed: no more rules > 52e068f8 send_search_entry: conn 1000 access to attribute > userPassword, value #0 not allowed > 52e068fb => bdb_entry_get: found entry: > "uid=jschaeffer,ou=people,dc=harmonywave,dc=com" > 52e068fb => bdb_entry_get: found entry: > "cn=default,ou=policies,dc=harmonywave,dc=com" > 52e068fb => access_allowed: result not in cache (userPassword) > 52e068fb => access_allowed: auth access to > "uid=jschaeffer,ou=People,dc=harmonywave,dc=com" "userPassword" > requested 52e068fb => acl_get: [1] attr userPassword > 52e068fb => acl_mask: access to entry > "uid=jschaeffer,ou=People,dc=harmonywave,dc=com", attr "userPassword" > requested > 52e068fb => acl_mask: to value by "", (=0) > 52e068fb <= check a_dn_pat: self > 52e068fb <= check a_dn_pat: anonymous > 52e068fb <= acl_mask: [2] applying auth(=xd) (stop) > 52e068fb <= acl_mask: [2] mask: auth(=xd) > 52e068fb => slap_access_allowed: auth access granted by auth(=xd) [...] There is an anonymous trying to read a userPassword (and probably trying to modifying it afterwards). Acording to your access rules only auth permissions are granted to anonymous. -Dieter -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

2 1

Access of entryUUID in an overlay module
by Alexander Kläser 23 Jan '14

23 Jan '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear all, I am new to OpenLDAP. In order to process transactions in a separate piece of software, I am parsing the output of a slightly modified version of the auditlog overlay module. As I need to know the entryUUID of a modified LDAP object, I tried to query it and write it along with the other information into the auditlog file. My current patch seems to navigate slapd into a deadlock situation. I do not understand the reason for that and would be very happy if someone may help to point me into the correct direction for implementing this. Here is my patch that I am working with, so far: ==================== - --- ./servers/slapd/overlays/auditlog.c.orig 2014-01-09 12:26:22.060000000 -0500 +++ ./servers/slapd/overlays/auditlog.c 2014-01-17 11:13:34.624000000 - -0500 @@ -24,6 +24,7 @@ #ifdef SLAPD_OVER_AUDITLOG #include <stdio.h> +#include <time.h> #include <ac/string.h> #include <ac/ctype.h> @@ -74,8 +75,13 @@ Modifications *m; struct berval *b, *who = NULL, peername; char *what, *whatm, *suffix; - - time_t stamp; + struct timeval stamp; int i; + int rc; + Entry *e = NULL; + Attribute *a_entryUUID; + char *entryUUID = "NULL"; + BackendInfo *bi = op->o_bd->bd_info; if ( rs->sr_err != LDAP_SUCCESS ) return SLAP_CB_CONTINUE; @@ -119,6 +125,16 @@ if ( !who ) who = &op->o_dn; + /* get the entryUUID */ + //rc = overlay_entry_get_ov( op, &op->o_req_ndn, NULL, NULL, 0, &e, on ); + op->o_bd->bd_info = (BackendInfo *)on->on_info; + rc = be_entry_get_rw( op, &op->o_req_ndn, NULL, NULL, 0, &e ); + op->o_bd->bd_info = bi; + if ( rc == LDAP_SUCCESS ) { + a_entryUUID = attr_find( e->e_attrs, slap_schema.si_ad_entryUUID ); + entryUUID = a_entryUUID->a_vals[0].bv_val; + } + peername = op->o_conn->c_peer_name; ldap_pvt_thread_mutex_lock(&ad->ad_mutex); if((f = fopen(ad->ad_logfile, "a")) == NULL) { @@ -126,9 +142,11 @@ return SLAP_CB_CONTINUE; } - - stamp = slap_get_time(); - - fprintf(f, "# %s %ld %s%s%s %s conn=%ld\n", - - what, (long)stamp, suffix, who ? " " : "", who ? who->bv_val : "", + gettimeofday(&stamp, NULL); + fprintf(f, "# %s %ld.%06ld %s %s%s%s %s conn=%ld\n", + what, stamp.tv_sec, stamp.tv_usec, + entryUUID, + suffix, who ? " " : "", who ? who->bv_val : "", peername.bv_val ? peername.bv_val: "", op->o_conn->c_connid); if ( !BER_BVISEMPTY( &op->o_conn->c_dn ) && @@ -176,7 +194,7 @@ break; } - - fprintf(f, "# end %s %ld\n\n", what, (long)stamp); + fprintf(f, "# end %s %ld.%06ld\n\n", what, stamp.tv_sec, stamp.tv_usec); fclose(f); ldap_pvt_thread_mutex_unlock(&ad->ad_mutex); ==================== thanks so much in advance Alex - -- Dr. Alexander Kläser Open Source Software Engineer Univention GmbH be open. Mary-Somerville-Str.1 28359 Bremen Tel. : +49 421 22232-59 Fax : +49 421 22232-99 klaeser(a)univention.de http://www.univention.de Geschäftsführer: Peter H. Ganten HRB 20755 Amtsgericht Bremen Steuer-Nr.: 71-597-02876 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlLZWZkACgkQgX5Q1Nb/qB0VSACfanVbcP79n3gEnH0zivWSThGA dxUAnj+2NaKhLweCFjFMtGoHPdHzByQZ =DHYq -----END PGP SIGNATURE-----

2 3

Re: N-Way Multi-Master
by Quanah Gibson-Mount 22 Jan '14

22 Jan '14

--On Wednesday, January 22, 2014 9:40 AM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Anyway, setting up (or attempting) an N-way Multi-Master (in the end will > be 3-way Multi-Master -- the below is only a 2-Way). Been reading the > man pages, and the procedure(s) in section 18.3.3 in the "24 Admin > Guide", etc. OpenLDAP version you are using? > Currently, have two servers (going to build one more) to play with. You could slapcat cn=config and manually fix the ldif output and then reload it if you aren't able to modify it. Personally, I avoid configuring cn=config for MMR, and instead focus on MMR for the actual databases. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

3 2

RE: N-Way Multi-Master
by Quanah Gibson-Mount 22 Jan '14

22 Jan '14

--On Wednesday, January 22, 2014 4:56 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > I was not able to get slapcat to work, so, thankfully being a test > environment, it was easy to back step and recreate the slapd.d. > > Now, rereading the Admin Guide...years ago, on our production environment > I did this wrong and trying to correct in our test environment before > rolling it out; but, it was my intent to create MMR but only ended up > creating a Delta-syncrepl. > > Am I mistaken, or do I on each server in the MMR configuration need to > create an accesslog? Looking at the script that Quanah sent, it appears > that it is what's going on. If you are going to set up delta-syncrepl based MMR, then yes, the accesslog db must exist on each master. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

RE: N-Way Multi-Master
by Quanah Gibson-Mount 22 Jan '14

22 Jan '14

--On Wednesday, January 22, 2014 2:00 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Thanks Quanah...I was wondering about that (both points --> slapcat and > only focusing on the actual dbases in MMR), too. > > I will attempt that (slapcat)...first. You might find this script useful as well: <https://github.com/Zimbra-Community/zimbra-sources/blob/master/main/ZimbraS…> --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

openldap.org down?
by Patrick Lists 22 Jan '14

22 Jan '14

Hi, I wanted to check if 2.4.39 had been released yet but the website does not seem to work. I only seen "Connecting" followed by "Connected" and then nothing. Regards, Patrick

2 3

RE: Antw: Adding attributes to cn=config
by Borresen, John - 0442 - MITLL 22 Jan '14

22 Jan '14

Thanks, I should've caught that. Going too fast and not enough coffee. -----Original Message----- From: Ulrich Windl [mailto:Ulrich.Windl@rz.uni-regensburg.de] Sent: Wednesday, January 22, 2014 3:02 AM To: Borresen, John - 0442 - MITLL Subject: Antw: Adding attributes to cn=config >>> "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> schrieb >>> am 21.01.2014 um 17:38 in Nachricht <201401211638.s0LGccwE074678(a)boole.openldap.org>: > Ok, > > Trying to add the following: > > objectClass: olcGlobal --> this is the objectClass on another server > that has SSL already set up. > dn: cn=config > changetype: add > olcTLSCipherSuite: HIGH:MEDIUM+TLSv1+SSLv3 > olcTLSCertificateFile: /usr/local/openldap/etc/openldap/CA/cacert.pem > olcTLSCertificateKeyFile: > /usr/local/openldap/etc/openldap/CA/private/cakey.pem > adding new entry "cn=config" > ldapmodify: Object class violation (65) > additional info: no objectClass attribute > > I've read the various manpages that deal with ldif formats, > ldapmodify, ldapadd, etc and been googling too. > > What am I missing? You want to "modify" cn=config, not "add" it. You want to "add" atributes. I'm surprised that someone with a "mit.edu" adress has such primitive problems ;-) Ulrich > > Thanks in advance. > > John D. Borresen (Dave) > Linux/Unix Systems Administrator > MIT Lincoln Laboratory > Surveillance Systems Group > 244 Wood St > Lexington, MA 02420 > Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

1 0

N-Way Multi-Master
by Borresen, John - 0442 - MITLL 22 Jan '14

22 Jan '14

***NOTE: Btw, I can't get to the openldap.org site, this morning. Receiving a "Bad Response" Anyway, setting up (or attempting) an N-way Multi-Master (in the end will be 3-way Multi-Master -- the below is only a 2-Way). Been reading the man pages, and the procedure(s) in section 18.3.3 in the "24 Admin Guide", etc. Currently, have two servers (going to build one more) to play with. (1) [root@<client_of_server2> openldap]# ldapsearch -W -x -H "ldap://<server2>.example.ldap" -ZZ -v -D cn=admin,cn=config -b cn=config olcOverlay={0}syncprov ldap_initialize( ldap://<server2>.example.ldap ) Enter LDAP Password: filter: olcOverlay={0}syncprov requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: olcOverlay={0}syncprov # requesting: ALL # # {0}syncprov, {0}config, config dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top objectClass: olcSyncProvConfig olcOverlay: {0}syncprov (2) [root@<server1> openldap]# ldapsearch -W -x -H "ldap://<server1>.example.ldap" -ZZ -v -D cn=admin,cn=config -b cn=config olcOverlay=syncprov ldap_initialize( ldap://<server1>.example.ldap ) Enter LDAP Password: filter: olcOverlay=syncprov requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: olcOverlay=syncprov # requesting: ALL # # {0}syncprov, {0}config, config dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top objectClass: olcSyncProvConfig olcOverlay: {0}syncprov (3) [root@<server1> openldap]# ldapsearch -W -x -H "ldap://<server1>.example.ldap" -ZZ -v -D cn=admin,cn=config -b cn=config olcDatabase=config ldap_initialize( ldap://<server1>.example.ldap ) Enter LDAP Password: filter: olcDatabase=config requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: olcDatabase=config # requesting: ALL # # {0}config, config dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcAddContentAcl: TRUE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,cn=config olcRootPW: {SSHA}**** olcSyncUseSubentry: FALSE olcMonitoring: FALSE olcSyncrepl: {0}rid=001 provider=ldap://<server1>.example.ldap binddn="cn=co nfig" bindmethod=simple credentials=<password> searchbase="cn=config" type=r efreshAndPersist retry="5 5 300 5" timeout=1 When I attempted to add the olcSyncrepl attribute, I added two "rids" but, somehow it only took one. Now, I can't add a second, nor can I delete the rid=001. With the configuration as it stands, I know it is in a loop. Attempt to add the second rid, again: #Add_LDIF: dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncrepl olcSyncreple: {1}rid=002 provider://<server2>.example.ldap binddn="cn=config" bindmethod=simple credentials=<password> searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 I receive the following error: LDAP error code 53: shadow context; no update referral If I attempt to add an olcUpdateRef, the following error appears: "must appear after syncrepl or updatedn" Even if, what appears to me, I add it after the syncrepl attribute. This is a test configuration...so, back-tracking is not a problem. Just would like to know if the Admin Guide missed a few steps and/or I did and where. Again, right now, the openldap.org site cannot be reached...so, I can't review the manual to see what I may have missed. Thanks in advance; Dave Borresen MIT Lincoln Lab

1 0

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical January 2014