openldap-technical January 2015

openldap-technical@openldap.org

38 participants
37 discussions

Virtual list view problem
by Venish Khant 31 May '16

31 May '16

Hi all I am using cpan Net::LDAP module to access LDAP entries. I want to search LDAP entries using Net::LDAP search method. When I do search, I want some limited number of entries from search result, for this(searching) process I am using Net::LDAP::Control::VLV module. But I get error on VLV response control. Please, any one have idea about this error. * Error:* Died at vlv.pl line 50, This is my example. I changed the font style of line 50 #!/usr/bin/perl -w use Net::LDAP; use Net::LDAP::Control::VLV; use Net::LDAP::Constant qw( LDAP_CONTROL_VLVRESPONSE ); use Net::LDAP::Control::Sort; sub procentry { my ( $mesg, $entry) = @_; # Return if there is no entry to process if ( !defined($entry) ) { return; } print "dn: " . $entry->dn() . "\n"; @attrs = $entry->attributes(); foreach $attr (@attrs) { #printf("\t%s: %s\n", $attr, $entry->get_value($attr)); $attrvalue = $entry->get_value($attr,asref=>1); #print $attr.":". $entry->get_value($attr)."\n"; foreach $value(@$attrvalue) { print "$attr: $value\n"; } } $mesg->pop_entry; print "\n"; } $ldap = Net::LDAP->new( "localhost" ); # Get the first 20 entries $vlv = Net::LDAP::Control::VLV->new( before => 0, # No entries from before target entry after => 19, # 19 entries after target entry content => 0, # List size unknown offset => 1, # Target entry is the first ); my $sort = Net::LDAP::Control::Sort->new( order => 'cn' ); @args = ( base => "dc=example,dc=co,dc=in", scope => "subtree", filter => "(objectClass=inetOrgPerson)", callback => \&procentry, # Call this sub for each entry control => [ $sort, $vlv ], ); $mesg = $ldap->search( @args ); # Get VLV response control *($resp) = $mesg->control( LDAP_CONTROL_VLVRESPONSE ) or die;* $vlv->response( $resp ); # Set the control to get the last 20 entries $vlv->end; $mesg = $ldap->search( @args ); # Get VLV response control ($resp) = $mesg->control( LDAP_CONTROL_VLVRESPONSE ) or die; $vlv->response( $resp ); # Now get the previous page $vlv->scroll_page( -1 ); $mesg = $ldap->search( @args ); # Get VLV response control ($resp) = $mes # Now page with first entry starting with "B" in the middle $vlv->before(9); # Change page to show 9 before $vlv->after(10); # Change page to show 10 after $vlv->assert("B"); # assert "B" $mesg = $ldap->search( @args );g->control( LDAP_CONTROL_VLVRESPONSE ) or die; $vlv->response( $resp ); -- Venish Khant www.deeproot.co.in

4 11

OpenLDAP and dynalogin (two-factor auth with HOTP)
by Daniel Pocock 29 Jun '15

29 Jun '15

Some time ago I created the dynalogin ( http://www.dynalogin.org ) solution for two-factor authentication. I'm just contemplating how to make it easier to integrate, and making it convenient to use with OpenLDAP seems like a good strategy: can anyone comment on that? The initial thoughts that I have about the subject: - SASL based solution (dynalogin has digest capability already, so it could be adapted for SASL PLAIN or DIGEST-MD5) - should not prevent password logins (user should be able to use either password or HOTP code) - should enable people to use it indirectly (e.g. if someone already has pam_ldap working, they should be able to add dynalogin to their OpenLDAP server and get immediate benefit) - use cases: UNIX login, high-security webmail login, VPN and OpenID provider backed by OpenLDAP I know that SASL already supports OTP, but that is not HOTP, it is OPIE (or S/Key) RFC 2289: http://tools.ietf.org/html/rfc2289 whereas HOTP is RFC 4226: http://www.ietf.org/rfc/rfc4226.txt HOTP is considered more secure and more widely implemented.

5 6

nssov not working after upgrading nss-pam-ldapd
by btb＠bitrate.net 17 Mar '15

17 Mar '15

i use the nss and pam stub libraries from nss-pam-ldapd [no nslcd] with nssov. i've just upgraded nss-pam-ldapd from 0.8.13 to 0.9.4. at the moment, i'm using openldap version 2.4.31. after upgrading nss-pam-ldapd, nss and pam stopped working with ldap, and i see this in slapd's debug log: 54acaf72 daemon: activity on 1 descriptor 54acaf72 daemon: activity on:54acaf72 13r54acaf72 54acaf72 daemon: read active on 13 54acaf72 daemon: epoll: listen=7 active_threads=0 tvp=NULL 54acaf72 daemon: epoll: listen=8 active_threads=0 tvp=NULL 54acaf72 connection_get(13) 54acaf72 connection_get(13): got connid=0 54acaf72 daemon: activity on 1 descriptor 54acaf72 daemon: activity on:54acaf72 54acaf72 daemon: epoll: listen=7 active_threads=0 tvp=NULL 54acaf72 daemon: epoll: listen=8 active_threads=0 tvp=NULL 54acaf72 nssov: connection from uid=0 gid=0 54acaf72 nssov: wrong nslcd version id (33554432) how can i find out what nslcd version id is required, and what version is present in each of the components? thanks -ben

3 5

2.4.40 RPMs for openSUSE
by Michael Ströder 17 Feb '15

17 Feb '15

HI! After some struggle and help by some opensuse-packaging list members (thanks!) I achieved almost what I wanted. I'd appreciate if someone could work on SLES support. Build status and files: https://build.opensuse.org/package/show/home:stroeder:branches:network:ldap… If you're using the openldap packages shipped with openSUSE make sure to read the .changes files to see whether something could break your current setup. Up to now I've tested openSUSE 13.2 and Factory on x86_64 and Factory_ARM on rasperry pi. Note: openSUSE 12.3 was announced to be EOL so I've disabled the repo in my home project. I can easily re-enable it if needed (or branch my repo in your own home project). The usual disclaimer: Don't play with it in production! The download repos are here: http://download.opensuse.org/repositories/home:/stroeder:/branches:/network… Make yourself familiar with zypper commands. Example: Add the repo in openSUSE 13.1 (command in one line): zypper addrepo --refresh http://download.opensuse.org/repositories/home:/stroeder:/branches:/network… Please test. Your feedback is appreciated. Especially have a look at whether the RPMs behave well regarding config files, package descriptions etc. There's a new package openldap2-contrib with a selection of overlays from, you might have guessed, the contrib/ source directory. slapo-noopsrch is still missing because of http://www.openldap.org/its/index.cgi?findid=7998 Since web2ldap makes heavy use of noop search control I'd be glad if someone could look into ITS#7998. ;-) Ciao, Michael.

1 2

bind UID in DN instead of CN
by Dennis 04 Feb '15

04 Feb '15

Hi everyone, I'm new to the ldap stuff, therefore sorry if this is a silly question. My openldap (slapd) version is 2.4.28. To manage openldap I'm using phpldapadmin. I'm using a third party software which relies on ldap to manage users. I've added a test user to ldap via phpldapadmin. The 3rd party software tries to modify/add an object via the following bind: slapd[19030]: conn=1435 fd=18 ACCEPT from IP=X.X.X.X:35541 (IP=0.0.0.0:389) slapd[19030]: conn=1435 op=0 BIND dn="cn=admin,dc=dmp,dc=..." method=128 slapd[19030]: conn=1435 op=0 BIND dn="cn=admin,dc=dmp,dc=..." mech=SIMPLE ssf=0 slapd[19030]: conn=1435 op=0 RESULT tag=97 err=0 text= slapd[19030]: conn=1435 op=1 MOD dn="uid=test1003,ou=users,dc=dmp,dc=..." slapd[19030]: conn=1435 op=1 MOD attr=objectclass slapd[19030]: conn=1435 op=1 RESULT tag=103 err=32 text= slapd[19030]: conn=1435 fd=18 closed (connection lost) This fails because it tries to accomplish this by using dn="uid=...", but as shown in phpldapadmin the dn is cn=Test Testuser,ou=users,dc=dmp,dc=... Therefore the distinguished name for dn="uid=...,ou=users,dc=dmp,dc=..." doesn't exist (the user has a uid of course). Therefore my question is, is there a possibility to change / to configure openldap to use / allow the uid instead of the cn? Or did I something wrong? So far I couldn't find any information about this. Any help is welcome and I would really appreciate this :) Best regards and have a nice weekend! Dennis Wehrle

3 2

Errors building Current Git Version with windows
by Frank Offermanns 02 Feb '15

02 Feb '15

Hello, when building the current GIT Version 2.4.40 with Windows and MinGW/MSYS I get 3 errors: C:/msys/1.0/openldap-2.4.40git/servers/slapd/slapadd.c:116: undefined reference to `ftello' slapadd.o: In function `slapadd': C:/msys/1.0/openldap-2.4.40git/servers/slapd/slapadd.c:486: undefined reference to `ftello' libbackends.a(mdbmdb.o): In function `mdb_cursor_push': C:/msys/1.0/openldap-2.4.40git/servers/slapd/back-mdb/./../../../libraries/liblm db/mdb.c:4990: undefined reference to `GetFileSizeEx' collect2: ld returned 1 exit status make[2]: *** [slapd.exp] Error 1 Configure was: configure --prefix=/mingw --enable-accesslog --with-tls --enable-syncprov Regards, Frank

2 3

MatchingRuleUseDescription::APPLIES
by michael-catchall＠mail.stroeder.local (POP3) 31 Jan '15

31 Jan '15

HI! In yet another attempt to make more use of server's subschema in web2ldap I'm looking more closely at matchingRuleUse in OpenLDAP's subschema subentry. What's the base for the matchingRuleUse values generated by slapd? RFC 4512 is pretty terse on this: APPLIES provides a list of attribute types the matching rule applies to Ah, well... :-/ Basically I wonder why I can't use this filter and why caseIgnoreIA5SubstringsMatch is not listed as being applicable to krbPrincipalName: (krbPrincipalName:caseIgnoreIA5SubstringsMatch:=k/m*) Yes, I know: krbPrincipalName is correctly declared with EQUALITY caseExactIA5Match. But what's the reason you cannot override the equality matching with this extensible filter? Normalization issues when indexing? Ciao, Michael. [1] http://tools.ietf.org/html/rfc4512#section-4.1.4

1 0

Large Number of Transactions x Low performance
by Alessandro Lasmar Mourao 30 Jan '15

30 Jan '15

Hi, I work in a company that has 140,000 registered users in OpenLDAP. This OpenLDAP is used for authentication of our internal systems. In our tree of groups we have the systems and below the each system there are the groups' authorization (systems profiles). The user is bound in each group according to position, function and department in the company. When a user replaces another user hierarchically higher, this user is taken from the respective group (that he belonged) and registered in user_group with the highest hierarchy. This movement in the company is very common, and this is the cause of our problems. We have a group with 50,000 registered users, and when we need to delete a user of that group or add a new one, OpenLADP takes up to 6 minute to effect the transaction. We have a tool (BMC Identity Management (formerly Control-SA)) that automates the transactions, but due to delay in the transactions are with a row of 100,000 operations of insert / delete to perform. I wonder if you have any way to improve the performance of OpenLDAP for these write operations. The OpenLDAP version is 2.4.40. Thanks, Alessandro Lasmar Mourão Below is our slapd.conf: ############################################## serverID 2 idletimeout 0 include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/ldap.schema include /etc/ldap/schema/ppolicy.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 256 modulepath /usr/lib/ldap/ moduleload back_mdb moduleload back_monitor moduleload memberof moduleload ppolicy moduleload syncprov moduleload refint moduleload accesslog sizelimit 250 tool-threads 16 password-hash {SSHA} monitoring true TLSCACertificateFile /etc/ssl/certs/cacert.pem TLSCertificateFile /etc/ssl/certs/servercrt.pem TLSCertificateKeyFile /etc/ssl/certs/serverkey.pem backend mdb database config rootdn "cn=admin,cn=config" rootpw secret monitoring true database monitor rootdn "cn=admin,cn=monitor" rootpw secret monitoring true database mdb suffix "cn=accesslog" rootdn "cn=admin,cn=accesslog" rootpw secret maxsize 1073741824 monitoring true directory "/var/lib/ldap/intranet/log" index default eq,pres,sub index entryCSN eq,pres index objectClass,reqEnd eq,pres index reqResult,reqStart eq,pres limits dn.exact="uid=replication,ou=Users,o=company" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE access to * by dn.base="uid=replication,ou=Users,o=company" read by * break database mdb suffix "o=company" rootdn "cn=admin,o=company" rootpw secret maxsize 4294967296 monitoring true overlay ppolicy ppolicy_use_lockout ppolicy_hash_cleartext ppolicy_default "cn=default,ou=policy,o=company" overlay memberof memberof-group-oc groupOfUniqueNames memberof-member-ad uniqueMember memberof-refint true overlay refint refint_attributes uniqueMember overlay accesslog logdb "cn=accesslog" logops writes logsuccess TRUE logpurge 07+00:00 01+00:00 limits dn.exact="uid=replication01,ou=Users,o=company" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited limits dn.exact="uid=replication02,ou=Users,o=company" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited limits dn.exact="uid=replication03,ou=Users,o=company" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited limits dn.exact="uid=replication04,ou=Users,o=company" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited overlay syncprov syncprov-checkpoint 1000 20 syncprov-sessionlog 10000 syncrepl rid=100 provider=ldap://10.192.184.195:389 searchbase="o=company" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" type=refreshAndPersist retry="60 +" scope=sub schemachecking=on bindmethod=simple binddn="uid=replication01,ou=Users,o=company" credentials=secret mirrormode true directory "/var/lib/ldap/intranet" directory "/var/lib/ldap/intranet" index objectClass eq,pres index uniqueMember,memberof eq,pres index nu-cpf,nu-cnpj eq,pres index dt-nascimento pres index entryUUID,entryCSN eq,pres index uid,ou,cn,sn,mail eq,pres,sub index default,givenname eq,pres,sub lastmod on checkpoint 1024 10 access to attrs=userPassword,shadowLastChange by dn="cn=admin,o=company" write by dn.exact="uid=replica01,ou=Users,o=company" read by dn.exact="uid=replica02,ou=Users,o=company" read by dn.exact="uid=replica03,ou=Users,o=company" read by dn.exact="uid=replica04,ou=Users,o=company" read by anonymous auth by self write by * none access to * by dn="cn=admin,o=company" write by * read

3 4

LMDB memory location on Android
by Kristoffer Sjögren 30 Jan '15

30 Jan '15

Hi LMDB JNI is a Java wrapper ontop of LMDB which runs on Linux, OSX, Windows and Android (arm-linux-androideabi-4.9 x86_64). At the moment the Android implementation rely on buffer copies and we're trying to implement zero copy using memory addresses provided by LMDB. Zero copy is already working on Linux, OSX and Windows but is not as straight forward on Android since the memory addresses are handled differently? We try to use the memory address of a direct ByteBuffer and hand it over to LMDB (exactly how the PC version works) but something is wrong. The full discussion and code on this can be found here. https://github.com/deephacks/lmdbjni/issues/21 I would greatly appreciate any tips on what might be wrong. Cheers, -Kristoffer

1 0

I have added customized schema in ldap, and it is displaying under schema section (phpldapadmin), but how to make accounts on basis of that schema.
by Abhishek koserwal 29 Jan '15

29 Jan '15

I have added customized schema in ldap, and it is displaying under schema section (phpldapadmin), but how to make accounts on basis of that schema. Creating new entries on basis of customized schema added into phpldapadmin. Regards Abhishek Koserwal Final year, CSE, IET-DAVV The capacity to learn is a gift; The ability to learn is a skill; The willingness to learn is a choice -- Brian Herbert

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical January 2015