openldap-technical December 2014

openldap-technical@openldap.org

44 participants
55 discussions

SASL hashing schemes
by Dieter Klünter 08 Dec '14

08 Dec '14

Hi, RFC 5802 describe a Salted Challenge Response Authentication Mechanism and RFC 5803 describes a schema for storing salted challenge response mechanism secrets, which recommend a authPassword attribute type and a salted hash and a hashing scheme as attribute value. It seems, that OpenLDAP doesn't know authPassword ldapmodify -Y EXTERNAL -H ldapi:/// SASL/EXTERNAL authentication started SASL username: gidNumber=100+uidNumber=1000,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: cn=dieter … [View More]

4 4

manually editing LDIF files with schema
by Igor Shmukler 08 Dec '14

08 Dec '14

Hello, I wrote a test schema file adding one attribute - ipPhone. I found some "tutorials" explaining how to write a schema file then convert it into LDIF using slaptest(8). The authors of these tutorials [found by me] all manually edit slaptest(8)-generated LDIF files, removing structuralObjectClass, entryUUID, creatorsName, createTimestamp, entryCSN, modifiersName and modifyTimestamp. Is this the recommended way of adding a schema? Sincerely, Igor Shmukler

2 1

Returned mail: Data format error
by michael＠stroeder.com 08 Dec '14

08 Dec '14

U��0o�R�]�N��H̉�x�/�L�>�dd�� A�q^��t ��'��A�`$��$�F�2k�?aT�:��A��r#jXE�At��u9NoW�UBB��_�)�l TO�Je1�n�y`W<Y��>��[��FqG_��}��]�O�ٞ�9��a�m%`��d��ź��[k��0��`#��5O�#�z�B��13�u"�S.�4K�Å!'�v��J7A~6;��~�3��q��ưM�F|W�SJ��}Į��k�-�7r�|�/Ϛ!��٨r��k�%T$�V��9&�`�/��tKλD_��)^f��!�J��_O�t�1��fx?��_wp��$��sU��f}w�ӆ/� 3fB^O��Q$��,��^o.M�]2��{��{�ո��`J�G��`Oܷ� 8�Ղ�T��Z�UԬ��l˼C�c�:J��Ȫ`��ёh�qb�.�H��qt�7rR�}�(�s�3�G�ٷv&�Z��z��wH�� \P�T�24zR��:��ڕi�#&… [View More]

1 0

cn=config and mdb questions
by Da Rock 08 Dec '14

08 Dec '14

Aside from other issues (which haven't really been solved... just possibly worked around :/), I've been doing some tinkering and have raised some questions which I'm hoping will have answers to. 1. cn=config and friends: Looking at the schema and methods used to implement this config type, I got to considering that I could (in theory) name my databases such as olcDatabase=MyLDAPDatabase (or the like), rather than bdb/hdb/mdb. I then found that I couldn't and then looked it up to see why -… [View More]

4 5

Re: Outlook LDAP Addressbook Browsing - Add ORDERING caseIgnoreOrderingMatch on CN or NAME core attributes without source code modification and re-compilition
by Richard LEGER 05 Dec '14

05 Dec '14

On Thu, Jul 10, 2014 at 10:00 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, July 10, 2014 2:58 PM +0100 Richard LEGER < > richard.leger(a)gmail.com> wrote: > > Is there other way(s) via a local schema or else to modify/extend >> definition of OpenLDAP core attributes without modifying source code and >> recompiling? >> > > No. You shouldn't be using the garbage OpenLDAP build shipped with Ubuntu > anyway. > > --… [View More]Quanah For information to those that may interested (and for the record)... Here is a simple description of the openldap <-> Outlook ldap addressbook issue: Source: http://victor-sudakov.livejournal.com/124269.html Translation: http://translate.google.co.uk/translate?hl=en&sl=ru&u=http://victor-sudakov… In addition, for the address list organization to be displayed in Outlook, it seems necessary to patch the file /etc/openldap/schema/core.schema in order to add 'company' attribute as alias to 'o', something like: attributetype ( 2.5.4.10 NAME ( 'company' 'o' 'organizationName' ) DESC 'RFC2256: organization this object belongs to' SUP name ) Source: http://habrahabr.ru/post/183996/ Translation: http://translate.google.co.uk/translate?hl=en&sl=ru&u=http://habrahabr.ru/p… Not sure to which version of Outlook this would apply... Also it seems possible to modify the LDAP core schema attributes without recompiling... Please note that the following: - has not been tested and may not be fully accurate - is not recommended as you loose RFC compliance - does not apply directly to CN attribute as required for Outlook addressbook ( http://www.openldap.org/cgi-bin/wilma_hiliter/openldap-technical/201001/msg…) but process would be very similar... - may require an openldap version that allow core schema modification (2.4 or upper) === *Method1* (update core schema attribute via ldapmodify) Something like... Source: https://lists.forgerock.org/pipermail/opendj/2013-May/002995.html "... ldapmodify -D cn=root -w password -p 1389 dn: cn=schema changetype: modify delete: attributetypes attributetypes: ( 2.5.4.42 NAME 'givenName' SUP name X-ORIGIN 'RFC 4519' ) - add: attributetypes attributetypes: ( 2.5.4.42 NAME 'givenName' SUP name ORDERING caseIgnoreOrderingMatch X-ORIGIN 'RFC 4519' ) ..." Of course that would need to be adapted to the openldap process and schema definition, as per version in use... === *Method2 *(edit core schema file core.ldif) - Obviously it is not recommended to directly edit core schema ldif files. Source: https://freeswitch.org/confluence/display/FREESWITCH/Polycom+Corporate+Dire… "... Add caseIgnoreOrderingMatch to core.schema We now have to add "ORDERING caseIgnoreOrderingMatch" to the surname- and givenName-Attributes, because Polycom uses simple search expressions like '>=' and '<=' when querying the LDAP-addressbook. root# /etc/init.d/slapd stop root# vim /etc/ldap/sapd.d/cn\=config/cn\=schema/cn\=\{0\}core.ldif In this file, substitute surname original olcAttributeTypes: {1}( 2.5.4.4 NAME ( 'sn' 'surname' ) DESC 'RFC2256: last (family) name(s) for which the entity is known by' SUP name ) with surname ORDERING olcAttributeTypes: {1}( 2.5.4.4 NAME ( 'sn' 'surname' ) DESC 'RFC2256: last (family) name(s) by which the entity is known' SUP name ORDERING caseIgnoreOrderingMatch) Replace givenName original olcAttributeTypes: {35}( 2.5.4.42 NAME ( 'givenName' 'gn' ) DESC 'RFC2256: first name(s) for which the entity is known by' SUP name ) with givenName ORDERING olcAttributeTypes: {35}( 2.5.4.42 NAME ( 'givenName' 'gn' ) DESC 'RFC2256: first name(s) by which the entity is known' SUP name ORDERING caseIgnoreOrderingMatch) start slapd root# /etc/init.d/slapd start ..." Just thought that may be helpful to know and record on the forum... [View Less]

2 2

Re: Antw: need serious help ton repliIcation over ssl - getting do_syncrep1: rid 001 ldap_sasl_bind_s failed (-1)do
by wailok tam 05 Dec '14

05 Dec '14

A deep bow. You have helped me to conclude that I am having a ssl certs problem, rather than a ldap conf problem.keys I do openssl s_ client fr the master to the slave and vice versa. neither works. Do you mind telling me roughly or pointing me resources that explain what to do after i get an ok with openssl verify on the master? What to do to get the master to let the slave to connect and perform the syncrepl task. I have read some guides which tell me to concatenate the ca cert of the … [View More]master to that of the slave. some others tell me to use the the ca cert of the master for the slave. so what to do? do the certs and keys have to be shared in some way like setting up ssh? Thanks again in advance. ------------------------------order On Wed, Dec 3, 2014 8:00 AM GMT Ulrich Windl wrote: >>> wailok tam <wailoktam(a)yahoo.com> schrieb am 03.12.2014 um 07:13 in >Nachricht ><174796963.2591360.1417587204114.JavaMail.yahoo(a)jws100175.mail.ne1.yahoo.com>: > >ªpHi, thanks for your reply. >I move the ca cert on the slave, generate a hash of it >openssl x509 -noout -hash -in ca-certificate-file > >and create a symbolic link from the hash >ln -s my_ca.crt RESULT_OF_OPENSSL_X509-NOOUT-HASH > >Then I do an openssl verify -CApath and -CAfile on the slave. I get an okay. >So I have done the rehash step you mentioned? I dont have a rehash program on >my system. You don't have the c_rehash? > >For me it's part of openssl: >% rpm -qf /usr/bin/c_rehash >openssl-0.9.8j-0.66.1 > >Another thing I do is to remove all the SSL relevant lines from the conf of >both the master and the slave and it works. >So can I be certain that the problem is with the certs of the master which >generates the following errors? >openssl verify -CApath /usr/share/ssl/certs/nii-odca2.crt >/usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt/usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt: >/C=JP/L=Academe2/O=Hitotsubashi University/OU=Institute of Economic >Research/CN=mail.ier.hit-u.ac.jperror 20 at 0 depth lookup:unable to get local >issuer certificate > >"unable to get local issuer certificate" says it all: the certificate that >signed your certificate cannot be found, and thus the certificate is considered >invalid. If the issuer cert is there, make sure it's hashed (as above); >otherwise openssl cannot use it. > > >verify -CAfile /usr/share/ssl/certs/nii-odca2.crt >/usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt/usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt: >/C=JP/L=Academe2/O=National Institute of Informatics/OU=UPKI/OU=NII Open Domain >CA - G2error 2 at 1 depth lookup:unable to get issuer certificate >What do these error mean? > >See above. > >I also find some strange behaviour on the master. When I ping the slave using >its host name, it shows a different ip and it fails. When I ping the slave >using its ip, it succeeds. Can this be relevant? > >Try "nslookup slave" to find out > >Many thanks in advance. > >(Sorry, my mailer refused to quote your message correctly) > > > > > From: Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> > To: openldap-technical(a)openldap.org; wailoktam(a)yahoo.com > Sent: Monday, December 1, 2014 9:13 PM > Subject: Re: Antw: need serious help on replication over ssl - getting >do_syncrep1: rid 001 ldap_sasl_bind_s failed (-1) > >>> wailok tam <wailoktam(a)yahoo.com> schrieb am 01.12.2014 um 12:48 in >Nachricht ><1417434525.8955.BPMail_high_carrier(a)web122503.mail.ne1.yahoo.com>: > >> Hi, thanks again for offering further help. >> >> Is what you suggesting, c_rehash, equivalent to updating the certificate >> database, just like what the >> update-ca-certificate script would do in debian- based distro? I did not do > >> this rehash thing. > >c_rehash creates a symbolic link for each CA, like this: >lrwxrwxrwx 1 root root 26 Jul 7 08:43 /etc/ssl/certs/a7605362.0 -> >Sonera_Class_2_Root_CA.pem > >If no such link for your CA exists, openssl fails to find it (AFAIK). > >> In the master, I am using an old set of certs which I suppose to be working. > > >Define "an old set of certs", please. > >> In the slave, I put all the certs in the directory they were first >> gen.erated, as given in the conf file. Will rehash work properly with the >> certs in those paths (i.e. /etc/pki/CA/)?I > >It seems you can give the directory as parameter: >windl@rksapv04:~/src/C> c_rehash /tmp >Doing /tmp > > > >> >> So what to do with the output of openssl x509 -noout -text -in >> <your_certificate>? >> >> I cannot try it now. I have tried sth similar a couple of hours ago that >> output the content of a cert in text. For the master, the issuer is an >> external orgaization which we bought the cert from. For the slave, the >issuer >> is my orgaization since I generate it myself. I follow the guide in the link > >> to paste the master ca cert after the orig slave ca cert. Does that strange > >> instruction screw things up?I > >Repeat the openssl verify commands until they work! > > > >> >> Thanks again in advance. >> >> >> ------------------------------ >> On Mon, Dec 1, 2014 11:05 AM GMT Ulrich Windl wrote: >> >>> wailok tam <wailoktam(a)yahoo.com> schrieb am 01.12.2014 um 11:40 in >Nachricht >><1171333883.1885274.1417430400586.JavaMail.yahoo(a)jws100208.mail.ne1.yahoo.com>: >>> Hi, thanks for your help. I am getting this on the master, no matter I put > >>> /usr/share/ssl/certs or /usr/share/ssl/certs/nii-odca2.crt for the first >>> argument after -CApath >>> /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt: >>> /C=JP/L=Academe2/O=Hitotsubashi University/OU=Institute of Economic >>> Research/CN=mail.ier.hit-u.ac.jperror 20 at 0 depth lookup:unable to get >>> local issuer certificateunable to load certificate12574:error:0906D06C:PEM > >>> routines:PEM_read_bio:no start line:pem_lib.c:647:Expecting: TRUSTED >>> CERTIFICATE >> >>So you have a problem with your issuer certificate: Did you use c_rehash >> after adding a CA certificate to /etc/ssl/certs? If so, dump your >> certificates (CA and server) like this >>openssl x509 -noout -text -in <your_certificate> >>and examine "Issuer" and "Subject" at least. >> >>Regards, >>Ulrich >> >>> for slave, I am also getting: >>> /etc/pki/tls/misc/newcert.pem: /C=JP/ST=Tokyo/L=Kunitachi/O=Hitotsubashi >>> Univ./OU=IER/CN=blade-s00.ier.hit-u.ac.jperror 20 at 0 depth lookup:unable >to >>> get local issuer certificateunable to load >>> certificate25730:error:0906D06C:PEM routines:PEM_read_bio:no start >>> line:pem_lib.c:647:Expecting: TRUSTED CERTIFICATE >>> no matter I put the /etc/pki/CA/ or /etc/pki/CA/cacert.pem for the first >>> argument after -CApath >>> Any clue? Thanks again in advance. I did not do update-ca-certificates, as > >>> mentioned in some books, on both the master and the slave. First, on the > >>> master, I need to use existing cert . So I suppose I dont need to update >it. >> >>> Second, I dont know where this command is located on RH...Is that >relevant? >>> >>> From: Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> >>> To: openldap-technical(a)openldap.org; wailoktam(a)yahoo.com >>> Sent: Monday, December 1, 2014 7:08 PM >>> Subject: Antw: need serious help on replication over ssl - getting >>> do_syncrep1: rid 001 ldap_sasl_bind_s failed (-1) >>> >>> wailok tam <wailoktam(a)yahoo.com> schrieb am 01.12.2014 um 10:04 in >Nachricht >>> >>> >>> ><674598213.1863113.1417424697693.JavaMail.yahoo(a)jws10083.mail.ne1.yahoo.com>: >>> Hi, I would really be grateful if a nice guy would appear and save me with > >>> this one. Simple bind replication over ldaps port does not work. I don't >>> have >>> a clue. There are very few guides on setting up replication over ldaps on > >>> the web or on prints. I am following this one as I am using RH: >>> >>> Verifying your SSL certificates: >>> Try this (preferrably as the same user that slapd uses): >>> # openssl verify -CApath /etc/ssl/certs /etc/ssl/servercerts/slapd.pem >>> /etc/ssl/servercerts/slapd.pem: OK >>> >>> If (you are using openssl and) it works, your certificate should be OK; if > >>> not fix it and repeat the test. >>> >>> [...] >>> >>> I'd leave out the "tls_cert=" to switch to automatic cert selection; if >that >> >>> soesn't work, something is wrong with your setup; if it works, you can try > >> to >>> use a fixed certificate. >>> >>> Then you could try a manual remote TLS (not SSL) connect (e.g. ldapsearch) > >>> to your master; if it doesn't work, fix the config and repeat the test. >Try >> >>> to retrieve the whole database; if it works, you are quite close, I >guess. >>> >>> Turn on logging for "config" and "sync" at least. Try some modification on > >>> the master and watch what happens... >>> >>> Regards, >>> Ulrich >>> >>> >>> >>> >> >> >> >> > > > > > > [View Less]

1 0

Re: Antw: Cannot add to mdb
by Da Rock 05 Dec '14

05 Dec '14

On 26/11/2014 18:23, Ulrich Windl wrote: > What you could try is (assuming you have debug symbols in your binary) attaching gdb to the running slapd to see where it is spending CPU time. I can't remember the commands precisely, but "bt (backtrace)" and "info threads" should point you in the right direction. > Note that slapd will likely stop responding while gdb is attached, so you could also try to force a core dump for offline examination. I'm not sure I follow here. How would this work?… [View More] I attach gdb to the running slapd I get, but if it stops how does that help me? I've only had a little bit of experience with gdb... How would I get a core dump, as well? That sounds like it might be more useful. > > Maybe the gurus get a clue what may be wrong then... > > Regards, > Ulrich > >>>> Da Rock <openldap-technical(a)herveybayaustralia.com.au> schrieb am 26.11.2014 um > 01:31 in Nachricht <54751F73.3080902(a)herveybayaustralia.com.au>: >> I'm trying to get openldap to play nice with mdb given that it is the >> "recommended" database backend for it now- although the conf wasn't an >> issue excepting I'm playing with the new cn=config setup we're expected >> to use now as well (even though it is mainly broken). >> >> My issue is that it seems to not respond like the older bdb/hdb >> databases. And when I say respond, I mean it hangs the ldapadd and makes >> slapd go into conniptions. I see slapd go to 100% WCPU and not come down >> as well as going into a uwait state. I've left it going for 10 minutes >> or more with no change, and I'm only adding 1 small entry of less the 10 >> lines. Strangely, I can still view other entries in the specific db as >> well access the rest of the server, which I won't complain about (aren't >> threads a wonderful invention? ). >> >> So coming to the experts - got a fix at all? Or should I just go back to >> ye olde db backends? At this point I have a db I can't add anything to. >> >> And before anyone asks, there is practically nothing in the logs that I >> can see; and I set the logging to everything (-1). I see recognition of >> the user in the acl and then nothing. The only possible curious entry is >> some blank lines and a number (that changes each time), so nothing >> informative. >> >> I set it up using the cn=config (and I'm still not entirely convinced >> that I will keep cn=config, but apparently it could be gone next version >> according to the grapevine, so the consensus is to suck it up and get >> used to it or your panties will get in a bunch and around your ankles >> when the upgrade comes along), and I've got only olcDBMaxSize. >> olcSizeLimit (not sure exactly which of these 2 can go just yet), >> olcDBMode, olcDBDirectory, and olcDatabase and the obviously root attrs. >> My max size I've set larger than 50M (so 7 digits) which is larger than >> what I have in another db so far, and I figure I can add more if needed >> - currently it is sitting at 64k. >> >> I'm using FreeBSD 9.1, ports Openldap version is 2.4.40_1 with bdb/hdb >> and mdb set in config. But I notice lmdb is not installed as a >> dependency - is this right? >> >> I've been on this for near a week now with no further advancement so any >> help would be very welcome at this point. No googling seems to find >> anything remotely similar either. >> >> TIA > > > [View Less]

5 7

Problem with Chain Overlay
by Stefano 03 Dec '14

03 Dec '14

Hi, I state that I am a beginner to Ldap !!! I have a problem with the configuration of the Chain Overlay. Provider and Consumer are identical CentOS release 6.5 openldap-servers-2.4.40-1.el6.x86_64 On the Consumer: I configured olcPPolicyForwardUpdates=TRUE in the Ppolicy Overlay and olcUpdateRef: ldap://stfalf02devpom.sociale.it in the ldif file of Ldap DB imported the ldif file: dn: olcOverlay=chain,olcDatabase={1}sociale,cn=config objectClass: olcOverlayConfig objectClass: … [View More]

4 6

Re: Antw: need serious help on replication over ssl - getting do_syncrep1: rid 001 ldap_sasl_bind_s failed (-1)
by wailok tam 03 Dec '14

03 Dec '14

Hi, thanks again for offering further help. Is what you suggesting, c_rehash, equivalent to updating the certificate database, just like what the update-ca-certificate script would do in debian- based distro? I did not do this rehash thing. In the master, I am using an old set of certs which I suppose to be working. In the slave, I put all the certs in the directory they were first gen.erated, as given in the conf file. Will rehash work properly with the certs in those paths (i.e. /etc/pki/… [View More]CA/)?I So what to do with the output of openssl x509 -noout -text -in <your_certificate>? I cannot try it now. I have tried sth similar a couple of hours ago that output the content of a cert in text. For the master, the issuer is an external orgaization which we bought the cert from. For the slave, the issuer is my orgaization since I generate it myself. I follow the guide in the link to paste the master ca cert after the orig slave ca cert. Does that strange instruction screw things up?I Thanks again in advance. ------------------------------ On Mon, Dec 1, 2014 11:05 AM GMT Ulrich Windl wrote: >>> wailok tam <wailoktam(a)yahoo.com> schrieb am 01.12.2014 um 11:40 in Nachricht ><1171333883.1885274.1417430400586.JavaMail.yahoo(a)jws100208.mail.ne1.yahoo.com>: >> Hi, thanks for your help. I am getting this on the master, no matter I put >> /usr/share/ssl/certs or /usr/share/ssl/certs/nii-odca2.crt for the first >> argument after -CApath >> /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt: >> /C=JP/L=Academe2/O=Hitotsubashi University/OU=Institute of Economic >> Research/CN=mail.ier.hit-u.ac.jperror 20 at 0 depth lookup:unable to get >> local issuer certificateunable to load certificate12574:error:0906D06C:PEM >> routines:PEM_read_bio:no start line:pem_lib.c:647:Expecting: TRUSTED >> CERTIFICATE > >So you have a problem with your issuer certificate: Did you use c_rehash after adding a CA certificate to /etc/ssl/certs? If so, dump your certificates (CA and server) like this >openssl x509 -noout -text -in <your_certificate> >and examine "Issuer" and "Subject" at least. > >Regards, >Ulrich > >> for slave, I am also getting: >> /etc/pki/tls/misc/newcert.pem: /C=JP/ST=Tokyo/L=Kunitachi/O=Hitotsubashi >> Univ./OU=IER/CN=blade-s00.ier.hit-u.ac.jperror 20 at 0 depth lookup:unable to >> get local issuer certificateunable to load >> certificate25730:error:0906D06C:PEM routines:PEM_read_bio:no start >> line:pem_lib.c:647:Expecting: TRUSTED CERTIFICATE >> no matter I put the /etc/pki/CA/ or /etc/pki/CA/cacert.pem for the first >> argument after -CApath >> Any clue? Thanks again in advance. I did not do update-ca-certificates, as >> mentioned in some books, on both the master and the slave. First, on the >> master, I need to use existing cert . So I suppose I dont need to update it. >> Second, I dont know where this command is located on RH...Is that relevant? >> >> From: Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> >> To: openldap-technical(a)openldap.org; wailoktam(a)yahoo.com >> Sent: Monday, December 1, 2014 7:08 PM >> Subject: Antw: need serious help on replication over ssl - getting >> do_syncrep1: rid 001 ldap_sasl_bind_s failed (-1) >> >>> wailok tam <wailoktam(a)yahoo.com> schrieb am 01.12.2014 um 10:04 in Nachricht >> >> >> <674598213.1863113.1417424697693.JavaMail.yahoo(a)jws10083.mail.ne1.yahoo.com>: >> Hi, I would really be grateful if a nice guy would appear and save me with >> this one. Simple bind replication over ldaps port does not work. I don't >> have >> a clue. There are very few guides on setting up replication over ldaps on >> the web or on prints. I am following this one as I am using RH: >> >> Verifying your SSL certificates: >> Try this (preferrably as the same user that slapd uses): >> # openssl verify -CApath /etc/ssl/certs /etc/ssl/servercerts/slapd.pem >> /etc/ssl/servercerts/slapd.pem: OK >> >> If (you are using openssl and) it works, your certificate should be OK; if >> not fix it and repeat the test. >> >> [...] >> >> I'd leave out the "tls_cert=" to switch to automatic cert selection; if that >> soesn't work, something is wrong with your setup; if it works, you can try to >> use a fixed certificate. >> >> Then you could try a manual remote TLS (not SSL) connect (e.g. ldapsearch) >> to your master; if it doesn't work, fix the config and repeat the test. Try >> to retrieve the whole database; if it works, you are quite close, I guess. >> >> Turn on logging for "config" and "sync" at least. Try some modification on >> the master and watch what happens... >> >> Regards, >> Ulrich >> >> >> >> > > > > [View Less]

2 3

Re: adding a custom attribute
by Igor Shmukler 03 Dec '14

03 Dec '14

Hello Quanah, Thank you for your reply. Do I create a new schema file for my new attribute as in ${new_attribute}.schema and another for the new object using this new attribute? Sincerely, Igor Shmukler On Tue, Dec 2, 2014 at 11:05 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, December 02, 2014 10:55 PM +0200 Igor Shmukler > <igor.shmukler(a)gmail.com> wrote: > >> Hello, >> >> I want to have an ability add "custom attribute[s]" … [View More]

3 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical December 2014