openldap-technical September 2014

openldap-technical@openldap.org

48 participants
64 discussions

RE24 testing call (2.4.40)
by Quanah Gibson-Mount 10 Sep '14

10 Sep '14

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.39 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Server Architect Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

7 8

question on ldap_unbind_ext_s
by Aditham, Radhakrishna 09 Sep '14

09 Sep '14

Hi, We have a long running server that tries to get a new LDAP handle if the current handle becomes invalid (LDAP_SERVER_DOWN error, etc). However if I call ldap_unbind_ext_s() on the old handle to release it, it hangs with the following stack: (gdb) bt #0 0x000000080166935c in read () at read.S:2 #1 0x00000008014748f0 in __read (fd=68, buf=0x803293003, nbytes=5) at /.automount/nfs.panwest.panasas.com/root/sb10/hlewis/hlewis-sb10-pioneer-ldap/src/freebsd-c/lib/libthr/thread/thr_syscalls.c:384 #2 0x0000000802c715d2 in sb_stream_read (sbiod=0x8088070d0, buf=0x803293003, len=5) at /.automount/nfs.panwest.panasas.com/root/sb10/hlewis/hlewis-sb10-pioneer-ldap/src/likewise/openldap/libraries/liblber/sockbuf.c:493 #3 0x0000000802c7207e in sb_debug_read (sbiod=0x803291220, buf=0x803293003, len=5) at /.automount/nfs.panwest.panasas.com/root/sb10/hlewis/hlewis-sb10-pioneer-ldap/src/likewise/openldap/libraries/liblber/sockbuf.c:827 #4 0x0000000802356971 in tlso_bio_read (b=0x803205400, buf=0x803293003 "\027\003\001", len=5) at tls_o.c:687 #5 0x000000080252c2df in BIO_read () from /usr/lib/libcrypto.so.1.0.0 #6 0x0000000802eb9f01 in ssl3_read_n () from /usr/lib/libssl.so.1.0.0 #7 0x0000000802eba3ce in ssl3_read_bytes () from /usr/lib/libssl.so.1.0.0 #8 0x0000000802eb67ac in ssl3_shutdown () from /usr/lib/libssl.so.1.0.0 #9 0x0000000802356cf6 in tlso_sb_close (sbiod=0x803291250) at tls_o.c:808 #10 0x0000000802c71253 in ber_int_sb_close (sb=0x803291160) at /.automount/nfs.panwest.panasas.com/root/sb10/hlewis/hlewis-sb10-pioneer-ldap/src/likewise/openldap/libraries/liblber/sockbuf.c:383 #11 0x000000080233d625 in ldap_free_connection (ld=0x804c48c00, lc=0x8088080f0, force=1, unbind=1) at request.c:769 #12 0x000000080232ffa2 in ldap_ld_free (ld=0x804c48c00, close=1, sctrls=0x0, cctrls=0x0) at unbind.c:93 #13 0x000000080232fe8b in ldap_unbind_ext (ld=0x804c48c00, sctrls=0x0, cctrls=0x0) at unbind.c:52 #14 0x000000080232fec5 in ldap_unbind_ext_s (ld=0x804c48c00, sctrls=0x0, cctrls=0x0) at unbind.c:61 ...... I want to make sure that there are memory leaks etc, hence the attempt to release the invalid handle. Question: What is the best or correct way to release an invalid LDAP handle? Appreciate any help. Thanks R.K. Aditham

2 2

Replication breaks and needs restart - version 2.4.30
by Raja T Nair 09 Sep '14

09 Sep '14

Hello All, I am running openldap-2.4.30 in multiple locations, and all are replicating from a single Provider. Though it seems working fine initially, the replication stops as time progresses. The only way to bring it back is to restart clients. Here are the relevant configuration lines from my provider and consumers: Provider: ----------- overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 Consumer: ----------------- syncrepl rid=203 provider=ldap://192.168.1.101:389 type=refreshAndPersist searchbase="dc=com" retry="120 3" attrs="*,+" scope=sub bindmethod=simple binddn="cn=user1,ou=people,dc=mydomain,dc=com" credentials="user1pass" It would be great if someone can help me with this situation. Currently I keep restarting every client, and it breaks the respective operation being served by the client every now and then. Thanks in Advance, Raja. -- :^)

2 1

Counting the total number of users in an AD forest
by Sankar P 09 Sep '14

09 Sep '14

Hi, Is there a way to count the total number of user objects in an AD forest. I do not want the names/details of any of these user objects. But I just want a programmatic way of finding the total number of AD users. Is it possible to achieve ? Could not get anything related from Googling. Thanks. -- Sankar P http://psankar.blogspot.com

3 2

Error when trying to setup olcMirrorMode
by Gremaud Cyrill 09 Sep '14

09 Sep '14

Hello, I'm trying to setup N-way multimaster replication for cn=config only (for the moment). I have problem when I try to add olcMirrorMode: TRUE. Here is my ldif file to do this: dn: olcDatabase={0}config,cn=config changetype: modify add: olcMirrorMode olcMirrorMode: TRUE and the error is the following : root@ldap1:~/downloads/ldif/config# ldapmodify -Y EXTERNAL -H ldapi:// -f 7_addMirrorMode.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={0}config,cn=config" ldap_modify: Server is unwilling to perform (53) additional info: shadow context; no update referral I have tried a lot of things but nothing working. Please I really need your help. Thanks a lot. Cyrill Gremaud

3 6

what mean null_callback : error code 0x35
by Gremaud Cyrill 09 Sep '14

09 Sep '14

Hi all, I have freshly installed 3 openLDAP 2.4 with cn=config and setting up N-Way multi master replication. When I check the logs, I have a lot of this error: slapd[2534] : null_callback : error code 0x35 What this error means ? thanks in advance for your help. cyrill gremaud

1 0

Q: frontend and cn=Subschema
by Ulrich Windl 08 Sep '14

08 Sep '14

Hi! forgive a beginner's question, but: If I examine cn=Subschema, I see the following object classes: objectClass[0] top objectClass[1] subentry objectClass[2] subschema objectClass[3] extensibleObject And among the attributes is ldapSyntaxes. ldapSyntaxes however is not part of subentry or subschema; according to the schemata presented, ldapSyntaxes is only part of olcGlobal and olcSchemaConfig. So should cn=Subentry have olcSchemaConfig as auxiliary object class? And in which object class should structuralObjectClass (and things like createTimestamp) belong? Regards, Ulrich

2 1

OpenLDAP self-signed certificates issue
by Vijay Ganesan 08 Sep '14

08 Sep '14

For SSL, I'm trying to install a self-signed certificate to OpenLDAP (version 2.4.28 on Ubuntu 12.04). Followed the following steps: *1. Created server certificate using:* openssl req -newkey rsa:1024 -x509 -nodes -out server.pem -keyout server.pem -days 365 *2. Added following entries to /usr/share/slapd/slapd.conf:* TLSCACertificateFile server.pem TLSCertificateFile server.pem TLSCertificateKeyFile server.pem *3. Restarted openldap:* sudo /etc/init.d/slapd restart *4. Tried to read the certs:* openssl s_client -connect localhost:636 -showcerts This causes the following error: *CONNECTED(00000003)* *140409289410208:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177:* *---* *no peer certificate available* *---* *No client certificate CA names sent* *---* *SSL handshake has read 0 bytes and written 213 bytes* *---* *New, (NONE), Cipher is (NONE)* *Secure Renegotiation IS NOT supported* *Compression: NONE* *Expansion: NONE* *---* Can someone help with what might be wrong in the setup? Thanks -- - Vijay

5 9

LDAP gateway to RADIUS serverf
by David R 08 Sep '14

08 Sep '14

Dear All, I have setup 2 factor authentication on a RADIUS server (OTP).The user has to authenticate using:login: adusernamepassword: ADpasswordGENERATEDPIN My issue is that some applications like VMWare supports only LDAP authentication. So i was wondering how i could use RADIUS server for authentication inside LDAP. I have found some elements like pw-radius.so, but this is clearly not fully documented. So I was wondering if one of you has ever implemented this kind of solution and how... Kind reagrds, David

3 2

accesslog search filter using reqAttr
by John Alex. 08 Sep '14

08 Sep '14

Hi all, Is anyone using "reqAttr" of accesslog overlay to find ldap requests for specific attributes? Our accesslog db contains some entries like for example: dn: reqStart=20140902092840.000001Z,cn=accesslog objectClass: auditSearch reqStart: 20140902092840.000001Z reqEnd: 20140902092840.000002Z reqType: search reqSession: 1018 reqAuthzID: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth reqDN: dc=example,dc=com reqResult: 0 reqScope: sub reqDerefAliases: never reqAttrsOnly: FALSE reqFilter: (objectClass=*) reqAttr: userPassword reqEntries: 7 reqTimeLimit: 3600 reqSizeLimit: 500 I am trying to search using the filter "(reqAttr=userPassword)" but no results are returned, while "(reqAttr=*)" returns all entries. What am I missing? Using version 2.4.39 John

1 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical September 2014