openldap-technical February 2015

openldap-technical@openldap.org

66 participants
63 discussions

OpenLDAP Inheritance not working
by Matthew W. Marshall 12 Feb '15

12 Feb '15

I’m running into an issue with adding users to LDAP, when I use the following LDIF dn: mail=jsmith,ou=customers,dc=mydeqcust,dc=org cn: John Smith sn: Smith uid: jsmith mail: jsmith(a)dev.local<mailto:jsmith@dev.local> objectClass: inetOrgPerson mail: jsmith it adds fine, however does not show any attributes from OrginizationalPerson or Person. I checked in the slapd.d schema files and all the objectClasses have the correct SUP records. My understanding from the docs at http://www.zytrax.com/books/ldap/apa/ldif-objects.html was that openldap will include the inherited items automatically. I’m running slapd 2.4.39 with the slapd.d config style. Is there an additional option I need to configure? Matthew Marshall Network/Systems Engineer 602-771-4637 Matthew.Marshall(a)azdeq.gov<mailto:Matthew.Marshall@azdeq.gov> ********************************************************************** NOTICE: This e-mail (and any attachments) may contain PRIVILEGED OR CONFIDENTIAL information and is intended only for the use of the specific individual(s) to whom it is addressed. It may contain information that is privileged and confidential under state and federal law. This information may be used or disclosed only in accordance with law, and you may be subject to penalties under law for improper use or further disclosure of the information in this e-mail and its attachments. If you have received this e-mail in error, please immediately notify the person named above by reply e-mail, and then delete the original e-mail. Thank you.

3 4

Re: i am new to ldap plz help i have provided ldif file and simple authentication code
by Andrew Findlay 12 Feb '15

12 Feb '15

On Wed, Feb 11, 2015 at 11:19:40AM +0530, Bharath K wrote: > this is my java code where i can get output for "none" authentication when i > use "simple" authentication its not working... > env.put(Context.SECURITY_AUTHENTICATION, "simple"); > env.put(Context.SECURITY_PRINCIPAL, "cn=Manager, ou=People,dc=example,dc=com"); That DN is not in the LDIF data that you posted. It might be set as the rootDN for the database, but we need to see the OpenLDAP configuration to know whether it is right (either the slapd.conf file or an LDIF dump of everything under cn=config depending on which config system you are using). > env.put(Context.SECURITY_CREDENTIALS, "ldap123"); > // env.put(Context.SECURITY_CREDENTIALS, "{SSHA}rZe5WkunQdmRkyCcEHu9g6VsqRecnzIa"); Note that you must send the plain-text password. The SSHA hash is only used in server config or in LDAP entries. > this is my LDIF file > # nagios, People, example.com > dn: uid=nagios,ou=People,dc=example,dc=com > objectClass: inetOrgPerson > objectClass: posixAccount > objectClass: shadowAccount > uid: nagios > sn: nagios > givenName: nagios > cn: nagios > displayName: nagios > uidNumber: 500 > gidNumber: 500 > userPassword:: secret If you want to set the password to 'secret' then you should only have one colon: userPassword: secret Using :: means that the data is Base-64 encoded. Please post the OpenLDAP configuration so that we can check the DNs and passwords. Please also reload the data with the correct userPassword values and try: env.put(Context.SECURITY_PRINCIPAL, "uid=nagios,ou=People,dc=example,dc=com"); env.put(Context.SECURITY_CREDENTIALS, "secret"); VERY IMPORTANT: please post the actual data and the real passwords that you are using to test with. If they are really secret, then change them to something trivial BEFORE doing the tests. Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

LMDB b-tree question
by Kristoffer Sjögren 11 Feb '15

11 Feb '15

Hi Does every database consist of a separate b-tree or is "database" just a name spacing convince? I.e. are reads faster for many smaller databases rather than one large database? Cheers, -Kristoffer

2 3

Accessing random rows from LMDB
by Sravan Kumar Reddy Javaji 10 Feb '15

10 Feb '15

Hello Everyone, I am new to LMDB. I have couple of questions, 1) Is there anyway that I can find the total number of records in LMDB. 2) Can I access all the rows from LMDB randomly instead of sequentially. For example, if there are 10 rows in LMDB as shown below, Key, Value K1, V1 K2, V2 K3, V3 K4, V4 K5, V5 I want to access it randomly, something like shown below Key, Value K3, V3 K5, V5 K4, V4 K2, V2 K1, V1 I know that it is better to read sequentially from LMDB and then later randomize the records. But I have around 1 million records in LMDB, I cant upload entire data to memory at once. I am planning to read data batch wise into memory and perform some operation on it. So, I am wondering, is there anyway that I can read the data randomly from LMDB directly. Looking forward to hear from you - Regards, Sravan

2 3

Crash with LMDB on iOS
by QW Support 10 Feb '15

10 Feb '15

I'm having trouble running the latest LMDB version on iOS 8.1.3 It seems to work with previous versions before SysV semaphores were used. Now it crashes with SIGSYS on line: semid = semget(IPC_PRIVATE, 2, mode); (line:4520 file:mdb.c) Has anyone got this to work? Thanks - Greg

2 1

Limitation to MirrorMode
by Tony S. Wu 10 Feb '15

10 Feb '15

Hi, Just curious, does MirrorMode have limitation? Is one master to multiple (4 or 5) slaves with MirrorMode supported? Thanks, Tony Wu Sent from my iPhone

1 0

OpenLDAP at CLT 2015
by Michael Ströder 09 Feb '15

09 Feb '15

HI! Peter Gietz, Dieter Klünter and me will be present OpenLDAP at Chemnitzer Linuxtage 2015 and will answer questions about OpenLDAP server, clients, and integration. Booth: https://chemnitzer.linux-tage.de/2015/en/programm/beitrag/134 My presentation: https://chemnitzer.linux-tage.de/2015/en/programm/beitrag/135 See you there. Ciao, Michael.

1 0

NamingContexts and DN question
by Leonard Smith 07 Feb '15

07 Feb '15

I have two Openldap servers ( openldap-servers-2.4.23-32.el6_4.1.x86_64 ) running on Centos 6.4 and I have a question on NamingContexts. Both servers should have been setup with the same ldif file and comparing the database and configs so far hasn't show any differences. However when I query the namingcontexts on one I get # /usr/bin/ldapsearch -H ldapi:/// -LLL -s base namingContexts dn: namingContexts: dc=foo,dc=com While on the second I get # /usr/bin/ldapsearch -H ldapi:/// -LLL namingContexts dn: dc=foo,dc=com Both have a single database. I verified both have the olcSuffix set to dc=foo,dc=com. The olcAccess rules are the same. Any suggestions on why one is returning a DN and the other a namingContext? Thanks Len

2 1

ITS#8046 - remote unauth DoS on 2.4.40
by Paul B. Henson 06 Feb '15

06 Feb '15

I haven't seen any announcement of this other than on security lists, but there's an unauthenticated remote DoS bug in 2.4.40: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776991 The actual ITS is a bit confusing, the reporter at one point says he had the issue with a beta version of 2.4.40 and it didn't work against release, but debian confirmed it kills their official 2.4.40 package and it caused a segfault against my gentoo 2.4.40 release, so if you're running 2.4.40 (older versions not vulnerable), it's probably worth applying the patch from head: http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=patch;h=2f1a2dd32… I rebuilt my 2.4.40 with this and it no longer dies when the PoC query is issued.

2 2

set-based constraints on multi-valued attrs
by Michael Ströder 06 Feb '15

06 Feb '15

HI! I have a hybrid groupOfEntries/posixGroup object class, let's call it 'aeGroup'. It's supposed to serve the same group membership information to RFC2307 and RFC2307bis NSS clients. I want to keep attributes group membership attriutes consistent by using the following constraint: # restrict memberUID to be consistent with group membership defined in member constraint_attribute memberUID,member set "this/memberUID & this/member/uid" restrict="ldap:///dc=example,dc=com??sub?(objectClass=aeGroup)" This does not work as expected. I suspect that the constraint is not applied to each value separately. Rather the constraint is true when any of the values fulfill the constraint rules. Similar constraints cross-referencing values work pretty well for attributes only containing a single value. Any clue? (Yes, I'm already taking care of this in the admin UI web2ldap, but still I want to prevent inconsistent values for any writing LDAP client.) Ciao, Michael.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical February 2015