openldap-technical December 2015

openldap-technical@openldap.org

53 participants
66 discussions

Checksum query
by Penza Kenneth at MITA 10 Dec '15

10 Dec '15

Hi, I am configuring an openldap 2.4.40 on RHEL7 x86_64 and want to enable database checksum. Below please find the steps I am following: [root@host01 mail]# cat config.ldif dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /etc/openldap/slapd.conf.bak olcConfigDir: /etc/openldap/slapd.d olcAllows: bind_v2 olcArgsFile: /var/run/openldap/slapd.args olcAttributeOptions: x-hidden lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcLocalSSF: 71 olcPidFile: /var/run/openldap/slapd.pid olcReadOnly: FALSE olcReverseLookup: FALSE olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCACertificatePath: /etc/openldap/certs olcTLSCertificateFile: "OpenLDAP Server" olcTLSCertificateKeyFile: /etc/openldap/certs/password olcTLSVerifyClient: never olcToolThreads: 1 olcWriteTimeout: 0 structuralObjectClass: olcGlobal dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema include: file:///etc/openldap/schema/core.ldif include: file:///etc/openldap/schema/cosine.ldif include: file:///etc/openldap/schema/inetorgperson.ldif include: file:///etc/openldap/schema/nis.ldif dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAddContentAcl: TRUE olcAccess: to attrs=name;x-hidden by * =cs olcAccess: to attrs=userPassword by * auth olcAccess: to * by * read olcLastMod: TRUE olcMaxDerefDepth: 0 olcReadOnly: FALSE olcSchemaDN: cn=Subschema olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none olcAddContentAcl: TRUE olcRootPW: {SSHA}C6JfIRI6XajtZcjabtSJZyi1rArPsy1j olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=config olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig dn: olcDatabase={1}monitor,cn=config objectClass: olcDatabaseConfig olcDatabase: {1}monitor olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=manager,dc=example,dc=com" read by * none olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcAccess: {0} to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=manager,dc=example,dc=com" write by * none olcAccess: {1} to dn.base="" by * read olcAccess: {2} to * by self write by dn="cn=manager,dc=example,dc=com" write by * read olcAddContentAcl: FALSE olcDatabase: {2}hdb olcDbCacheFree: 1 olcDbCacheSize: 1000 olcDbCheckpoint: 512 15 olcDbChecksum: true olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 3000 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbDirectory: /var/lib/ldap olcDbDirtyRead: FALSE olcDbDNcacheSize: 0 olcDbIDLcacheSize: 3000 olcDbIndex: cn,sn,mail pres,eq,approx,sub olcDbIndex: objectClass eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbNoSync: FALSE olcDbSearchStack: 16 olcDbShmKey: 0 olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=manager,dc=example,dc=com olcRootPW: {SSHA}C6JfIRI6XajtZcjabtSJZyi1rArPsy1j olcSuffix: dc=example,dc=com structuralObjectClass: olcHdbConfig [root@host01 mail]# [root@host01 mail]# slapadd -v -F slapd.d -n 0 -l config.ldif added: "cn=config" (00000001) added: "cn=schema,cn=config" (00000001) added: "cn={0}core,cn=schema,cn=config" (00000001) added: "cn={1}cosine,cn=schema,cn=config" (00000001) added: "cn={2}inetorgperson,cn=schema,cn=config" (00000001) added: "cn={3}nis,cn=schema,cn=config" (00000001) added: "olcDatabase={-1}frontend,cn=config" (00000001) added: "olcDatabase={0}config,cn=config" (00000001) added: "olcDatabase={1}monitor,cn=config" (00000001) 56617865 Entry (olcDatabase={2}hdb,cn=config), attribute 'olcDbChecksum' not allowed slapadd: dn="olcDatabase={2}hdb,cn=config" (line=1079): (65) attribute 'olcDbChecksum' not allowed _#################### 100.00% eta none elapsed none fast! Closing DB... [root@host01 mail]# >From the github sources back-bdb/config.c 78 { "checksum", NULL, 1, 2, 0, ARG_ON_OFF|ARG_MAGIC|BDB_CHECKSUM, 79 bdb_cf_gen, "( OLcfgDbAt:1.16 NAME 'olcDbChecksum' " 80 "DESC 'Enable database checksum validation' " I tried olcDbChecksum: true, olcDbChecksum: TRUE, olcDbChecksum: 1, olcDbChecksum: ON without any success. Do you have any ideas on how I get around this ? Regards Kenneth

2 2

providers in mirror mode replication issue
by Jean-Luc Bourguignon 09 Dec '15

09 Dec '15

Hi all, I've 2 ldap instance in mirror mode which each one has its consumer. Since a few days, even if contextCSN attributs gave me the info that all instance are in sync (as shown below), this is not the case !! I did ldapsearch against the 2 provider for one branch and I found difference in number of entries. I also did it against consumer and I saw a difference between consumer/provider for sys1 but not for consumer/provider for sys2 which were in sync. !! very strange ... sys1 - 389 (consumer) contextCSN: 20151208154738.903128Z#000000#001#000000 contextCSN: 20151208154739.102248Z#000000#002#000000 sys1 - 3892 (provider) contextCSN: 20151208154738.903128Z#000000#001#000000 contextCSN: 20151208154739.102248Z#000000#002#000000 sys2 - 389 (consumer) contextCSN: 20151208154738.903128Z#000000#001#000000 contextCSN: 20151208154739.102248Z#000000#002#000000 sys2 - 3892 (provider) contextCSN: 20151208154738.903128Z#000000#001#000000 contextCSN: 20151208154739.102248Z#000000#002#000000 I also did a stop/start of providers to force the replication process from difference because of the stop, but even they have done some replication between them, the difference in that concerned branch doesn't disappeared. Can you help me to find out the root cause of this unsync mirrored systems ? How can I check it deeper ? Where do have I to check why I get this difference ? Can It be related to system performance ? (memory ..) Thx in advance for your help. Brgds, J-L. PS. We use openldap version 2.4.35 under solaris 5.10 (zone systems) ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at http://www.techmahindra.com/Disclaimer.html externally http://tim.techmahindra.com/tim/disclaimer.html internally within TechMahindra. ============================================================================================================================

1 0

disable TLS compression with openssl?
by Paul B. Henson 08 Dec '15

08 Dec '15

We're currently running through all of our SSL/TLS using apps to disable SSLv3 and update the accepted ciphers list, as well as other current best practices. I don't see any way to disable SSL compression in openldap? Does SSL compression with ldap traffic not lead to the same issue as it does in web traffic? Also, are there any plans to support ECDHE ciphers in openldap? I see there's an ITS ticket about it, it's rather old and the last update questioned whether those ciphers should be avoided due to potential NSA meddling in their design. Thanks...

4 5

Binding through a chaining. It's possible?
by Maximiliano Boscovich 08 Dec '15

08 Dec '15

Hello, I'm having trouble making binding through a chaining. I have 2 servers, server 1 has a referral ou pointing to a another server (server2). Server1 has the following configuration: dn: olcOverlay=chain,olcDatabase={-1}frontend,cn=config objectClass: olcOverlayConfig objectClass: olcChainConfig objectClass: top olcOverlay: chain olcChainCacheURI: FALSE olcChainMaxReferralDepth: 1 olcChainReturnError: TRUE dn: olcDatabase=ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: ldap olcDbURI: "ldap://server2" olcDbStartTLS: none starttls=no olcDbIDAssertBind: mode=self flags=prescriptive,proxy-authz-non-critical bindmethod=simple timeout=0 network-timeout=0 binddn="cn=admin,dc=example,dc=ar" credentials="password" keepalive=0:0:0 olcDbRebindAsUser: FALSE olcDbChaseReferrals: TRUE olcDbTFSupport: no olcDbProxyWhoAmI: FALSE olcDbProtocolVersion: 3 olcDbSingleConn: FALSE olcDbCancel: abandon olcDbUseTemporaryConn: FALSE olcDbConnectionPoolMax: 16 olcDbNoRefs: FALSE olcDbNoUndefFilter: FALSE >From the server1 I can make changes and searches without problems to entries on server2 (the chaining works fine for this), but when I want to make a binding, it gives me invalid credentials. For instance: mboscovich@mambo-tango:~$ ldapwhoami -vvv -h server1 -x -D "uid=useronserver02,ou=users,dc=example,dc=ar" -W ldap_initialize( ldap://server1:389 ) Enter LDAP Password: ldap_bind: Invalid credentials (49) If I make the same query but to the server2 where is hosted the entry (so not the chaining is used) the binding runs smoothly: mboscovich@mambo-tango:~$ ldapwhoami -vvv -h server2 -x -D "uid=useronserver02,ou=users,dc=example,dc=ar" -W ldap_initialize( ldap://server2:389 ) Enter LDAP Password: dn:uid=useronserver02,ou=users,dc=example,dc=ar" Result: Success (0) The logs on server1 when it's fail, show this: Dec 8 19:19:55 server1 slapd[2219]: conn=1014 fd=20 ACCEPT from IP= 10.0.2.2:52358 (IP=0.0.0.0:389) Dec 8 19:19:55 server1 slapd[2219]: conn=1014 op=0 BIND dn="uid=useronserver2,dc=example,dc=ar" method=128 Dec 8 19:19:55 server1 slapd[2219]: conn=1014 op=0 RESULT tag=97 err=49 text= Dec 8 19:19:55 server1 slapd[2219]: conn=1014 op=1 UNBIND Dec 8 19:19:55 server1 slapd[2219]: conn=1014 fd=20 closed and on the server02 i couldn't see any log in this case. What am I doing wrong?. Regards Maximiliano Boscovich

1 0

Samba auth on replicated LDAP: no admin user
by Paul van der Vlis 08 Dec '15

08 Dec '15

Hello, I have a replicated LDAP and a few Windows PC's what want to authenticate using Samba. Normally I use "smbpasswd -w" to give the ldap admin dn, but because it's replicated there is no ldap admin! Is there a way to authenticate using a replicated LDAP? The users are created on the master. I am using the "refreshAndPersist" type of replication. With regards, Paul van der Vlis. -- Paul van der Vlis Linux systeembeheer Groningen https://www.vandervlis.nl/

5 13

Fwd: (ITS#8331) Download mirror list needs updating
by Howard Chu 07 Dec '15

07 Dec '15

A number of the mirror sites have gone offline over the years. Anyone interested in running a new mirror for us? -------- Forwarded Message -------- Subject: (ITS#8331) Download mirror list needs updating Date: Fri, 04 Dec 2015 10:01:12 +0000 From: andrew.findlay(a)skills-1st.co.uk To: openldap-its(a)OpenLDAP.org Full_Name: Andrew Findlay Version: OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (2001:8b0:8d0:f7e1::94) The Netherlands mirror has vanished: ftp.nl.uu.net does not resolve in DNS.

2 1

Growing an LMDB database after MDB_MAP_FULL
by Bruno Freudensprung 07 Dec '15

07 Dec '15

Hi, I have a question regarding growing an LMDB database when a write transaction hits MDB_MAP_FULL. I would like to avoid defining a high mapsize value because my application will contain many MDB_envs, and because I have Windows users (Windows allocates the whole file on the disk). Based on the intuition that MDB_MAP_FULL should not leave the database in a weird state, I have made the following little experiment. When MDB_MAP_FULL is encountered I tried to: * copy the current env (mdb_env_copy) into another directory (fine: it does not seem to contain uncommited data) * reset the transaction < error bit > (modified LMDB code to introduce a < txn->mt_flags &= ~MDB_TXN_ERROR > somewhere) * commit the transaction * close the database * close the env * reopen it with a higher mapsize value * reopen the database * create another transaction * continue writing ... and it seems to be working pretty well. Assuming I am ready to < relax > some of the ACID requirements, does it sound reasonable to think that MDB_MAP_FULL does not leave LMDB is a weird state? And that the < trick > described above should always be working? By < working > I mean: the copied environment will never contain uncommitted data (so I can rely on it to implement a kind of rollback), the reopened environment will always be valid and contain the expected data (data written before hitting MDB_MAP_FULL)? Thanks in advance for any insight, Best regards, Bruno.

2 4

TOTP configuration
by PRAJITH 04 Dec '15

04 Dec '15

Hi, Could you please add more info about the TOTP modul? I could not find any single article about this.

2 1

options to maintain computed attributes?
by Jephte Clain 04 Dec '15

04 Dec '15

hello, I may have a need soon to implement "computed" attributes in LDAP, to accommodate dumb clients that are unable to properly update the database for example, an attribute masterAttr may have values like "A:B" (its value updated by the dumb client), but other clients need the A or B part separately. So whenever masterAttr is updated with value "A:B", firstPartAttr have to be updated with "A" and secondPartAttr with "B" what are my options to achieve this? - is there an overlay like slapo-rwm but for attribute values? I searched but did not found anything. So I guess the answer is no. - using a combination of back-perl, back-relay and slapo-translucent? is that even possible - using back-sock as an overlay to monitor modifications and update the modified objects accordingly? - a script that monitor the accesslog database and update the modified objects accordingly? - biting the bullet and writing an overlay myself? before diving too deep into this issue (and possibly drowning), I figured I would ask. any thoughts? ideas? thanks in advance, best regards, Jephté CLAIN -- *Jephté CLAIN | Développeur, Intégrateur d'applications* Service Systèmes d'Information Direction des Systèmes d'Information <http://dsi.univ-reunion.fr> Tél: +262 262 93 86 31 <tel:+262262938631> || Gsm: +262 692 29 58 24 <tel:+262692295824> www.univ-reunion.fr <http://www.univ-reunion.fr> || Facebook <http://www.facebook.com/pages/Universit%C3%A9-de-La-R%C3%A9union-OFFICIEL/1…> || Twitter <http://twitter.com/univ_reunion>

2 4

RE24 testing call (2.4.43)
by Quanah Gibson-Mount 03 Dec '15

03 Dec '15

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.43 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

5 7

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical December 2015