openldap-technical March 2015

openldap-technical@openldap.org

51 participants
70 discussions

Are sets "production ready"?
by Tomasz Lesniewski 19 Mar '15

19 Mar '15

Hi. I would like to use sets in my openldap ACLs, but i'm worried about "Sets are considered experimental"as is written in docs (http://www.openldap.org/doc/admin24/access-control.html#Sets%20-%20Granting…) Is anybody using sets in production environment without problems? Are there any known issues with sets? Or is known when sets will be ready to use? -- Pozdrawiam/Best regards Tomasz Leśniewski

3 3

ppolicy: pwdInHistory attribute
by Esther Garcia 19 Mar '15

19 Mar '15

Hello, We have installed an openldap server 2.4.23-34 on RHEL 6.5 with ppolicy enabled. # Standard, Policies dn: cn=Standard,ou=Policies,dc=test,dc=es cn: Standard description: Standard password policy. pwdAttribute: userPassword pwdCheckQuality: 1 pwdMinLength: 8 pwdLockout: TRUE pwdMustChange: TRUE pwdAllowUserChange: TRUE objectClass: device objectClass: pwdPolicy pwdSafeModify: FALSE pwdFailureCountInterval: 3 pwdGraceAuthNLimit: 0 pwdLockoutDuration: 1200 pwdMaxFailure: 10 pwdMinAge: 10 pwdMaxAge: 31536000 pwdExpireWarning: 0 pwdInHistory: 5 All ppolicy attributtes except pwdInHistory are working. We store passwords encrypted in the directory. Is there any way to have pwdInHistory attribute working with encrypted passwords stored in the directory? Thanks! Esther

2 4

default behavior of server certificate validation
by Bin Lu 19 Mar '15

19 Mar '15

Hi, In connecting the LDAP server with LDAPs or (start)TLS, what is the default behavior of the server certificate validation? How can I disable the default behavior? Thanks, -binlu

2 2

Error while integrating OpenLDAP and Kerberos
by Verónica Ovando 19 Mar '15

19 Mar '15

I am trying to set up Kerberos with OpenLDAP backend. I followed this doc http://web.mit.edu/Kerberos/www/krb5-1.12/doc/admin/conf_ldap.htmland this https://help.ubuntu.com/lts/serverguide/kerberos-ldap.html#kerberos-ldap-op… My |krb5.conf|file looks like this: |[libdefaults] default_realm = EXAMPLE.TEST dns_lookup_realm = false dns_lookup_kdc = false rdns = false [kdcdefaults] restrict_anonymous_to_tgt = true # The following krb5.conf variables are only for MIT Kerberos. krb4_config = /etc/krb.conf krb4_realms = /etc/krb.realms kdc_timesync = 1 ccache_type = 4 forwardable = true proxiable = true # The following libdefaults parameters are only for Heimdal Kerberos. v4_instance_resolve = false v4_name_convert = { host = { rcmd = host ftp = ftp } plain = { something = something-else } } fcc-mit-ticketflags = true [realms] #configuracion para mi reino EXAMPLE.TEST = { kdc = krb1.example.test:88 kdc = krb2.example.test:88 admin_server = krb1.example.test default_domain = example.test database_module = openldap_ldapconf } [domain_realm] #configuracion para mi servidor .example.test = EXAMPLE.TEST EXAMPLE.test = EXAMPLE.TEST [dbdefaults] ldap_kerberos_container_dn = cn=krbContainer,dc=example,dc=test [dbmodules] openldap_ldapconf = { db_library = kldap ldap_kdc_dn = "cn=krbadmin,dc=example,dc=test" # this object needs to have read rights on # the realm container, principal container and realm sub-trees ldap_kadmind_dn = "cn=krbadmin,dc=example,dc=test" # this object needs to have read and write rights on # the realm container, principal container and realm sub-trees ldap_service_password_file = /etc/krb5kdc/service.keyfile ldap_servers = ldap://127.0.0.1 ldap_conns_per_server = 5 } [login] # krb4_convert = true # krb4_get_tickets = false [logging] kdc = FILE:/var/log/kerberos/krb5kdc.log admin_server = FILE:/var/log/kerberos/kadmin.log default = FILE:/var/log/kerberos/krb5lib.log | I added the krbPrincipalName index: |dn: olcDatabase={1}hdb,cn=config add: olcDbIndex olcDbIndex: krbPrincipalName eq,pres,sub | I gave permissions to the kadmind and krb5kdc for reading a writing in the LDAP database: |dn: olcDatabase={1}hdb,cn=config replace: olcAccess olcAccess: to attrs=userPassword,shadowLastChange,krbPrincipalKey by dn="cn=krbadmin,dc=example,dc=com" write by anonymous auth by self write by * none - add: olcAccess olcAccess: to dn.base="" by * read - add: olcAccess olcAccess: to * by dn="cn=krbadmin,dc=example,dc=com" write by * read | When i try to restart the krb5-admin-server I get this error: *[....] Restarting Kerberos administrative servers: kadmindkadmind: Invalid credentials while initializing, aborting failed!* Any suggestion for solving this problem? I thinks there is a missing configuration on my LDAP, but I am not sure. Thanks in advance. -- Verónica Ovando

2 1

olcAccess syntax
by Igor Shmukler 18 Mar '15

18 Mar '15

Hello, Sorry. This is repost. I was unable to figure out what is wrong my olcAccess configuration! I am trying to configure my OpenLDAP so that cn=config has full over-the-network write-access with a password.I thought at one point that I got the permissions working. It turns out, those are not working, now. Please say what I am doing wrong. Last time, I had a similar problem with policy. Michael S. saved me a bunch of time by advising to load ppolicy.ldif [with the appropriate schema]. This is obviously no indicator of any kind, yet the problem might be not in the LDIFs or ... I understood that manage is the LDIF version of full permissions. Found olcAccess syntax as "olcAccess: to <what> [ by <who> [<accesslevel>] [<control>] ]+" My OLC directives for ldapmodify(1) are below: dn: olcDatabase={0}config,cn=config changetype: modify replace: olcAccess olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break olcAccess: {1}to * by self write by dn="cn=config" write by * read dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW olcRootPW: {SSHA}HyVltU836iL4aR0P0C6O8eHkOJt8nYGK I tried various combinations, like: olcAccess: {1}to * by dn=cn=config manage by * read The command syntax is valid. Yet my configuration not result in the desired access rights. Instead, when ldapdelete(1) is invoked with -D cn=config on records inside non-config databases, I get: ldap_delete: Insufficient access (50) additional info: no write access to parent Please advise. I thank everyone on the openldap-technical who has been reading my messages. People on this list have been extremely helpful. Sorry to continue being a nag. Sincerely, Igor Shmukler

1 0

openldap MMR "read_config: no serverID / URL match found"
by Divya Vikraman 17 Mar '15

17 Mar '15

Hi, I am using openldap 2.4.39 version and trying to set up multi master replication. This is my configuration ServerID 1 "ldap://ldap1-test.com" ServerID 2 "ldap://ldap2-test.com" overlay syncprov syncprov-checkpoint 10 1 syncprov-sessionlog 100 syncrepl rid=1 provider="ldap://ldap1-test.com" binddn="uid=replication,ou=People,dc=ldap,dc=nqa,dc=test,dc=com" bindmethod=simple credentials="xyzabc" searchbase="dc=ldap,dc=nqa,dc=test,dc=com" type=refreshAndPersist interval=00:00:00:10 retry="5 10 60 +" timeout=1 schemachecking=off scope=sub syncrepl rid=2 provider="ldap://ldap2-test.com" binddn="uid=replication,ou=People,dc=ldap,dc=nqa,dc=test,dc=com" bindmethod=simple credentials="xyzabc" searchbase="dc=ldap,dc=nqa,dc=test,dc=com" type=refreshAndPersist interval=00:00:00:10 retry="5 10 60 +" timeout=1 schemachecking=off scope=sub MirrorMode on I have put the below entries in /etc/default/slap on server 1 SLAPD_SERVICES="ldapi:// ldap://ldap1-test.com" and server 2 SLAPD_SERVICES="ldapi:// ldap://ldap2-test.com" After this I am not able to start the service and when I do a slapd -d sync , I get the error "read_config: no serverID / URL match found" I have seen a similar issue posted in an earlier thread but could not find a solution. Thanks, Divya

3 3

nssov not working after upgrading nss-pam-ldapd
by btb＠bitrate.net 17 Mar '15

17 Mar '15

i use the nss and pam stub libraries from nss-pam-ldapd [no nslcd] with nssov. i've just upgraded nss-pam-ldapd from 0.8.13 to 0.9.4. at the moment, i'm using openldap version 2.4.31. after upgrading nss-pam-ldapd, nss and pam stopped working with ldap, and i see this in slapd's debug log: 54acaf72 daemon: activity on 1 descriptor 54acaf72 daemon: activity on:54acaf72 13r54acaf72 54acaf72 daemon: read active on 13 54acaf72 daemon: epoll: listen=7 active_threads=0 tvp=NULL 54acaf72 daemon: epoll: listen=8 active_threads=0 tvp=NULL 54acaf72 connection_get(13) 54acaf72 connection_get(13): got connid=0 54acaf72 daemon: activity on 1 descriptor 54acaf72 daemon: activity on:54acaf72 54acaf72 daemon: epoll: listen=7 active_threads=0 tvp=NULL 54acaf72 daemon: epoll: listen=8 active_threads=0 tvp=NULL 54acaf72 nssov: connection from uid=0 gid=0 54acaf72 nssov: wrong nslcd version id (33554432) how can i find out what nslcd version id is required, and what version is present in each of the components? thanks -ben

3 5

Update custom schema
by Gremaud Cyrill 17 Mar '15

17 Mar '15

Hello everybody. I have an openldap 2.4+ and I added a custom schema. In my ldap I have a lot of entries which use this schema. I just want to know how can add fields (update) to this schema ? My first idea is to create a new ldif file containing the new schema description, stopping the server, removing the old schema and replace it by the new one and then try to restart the server but I don't know if there is a better way to do this. Thanks you very much for your help. Cyrill Gremaud

2 2

LMDB sequential read from a ">>RAM" database caffe use case
by Brian 16 Mar '15

16 Mar '15

Hi, all I am a caffe user. In my use case, I am reading from a ~300GB lmdb sequentially, reading one element and never accessing again until I read every other element in the db and loops around again. It seems that lmdb will page cache every element. This becomes a problem as the dataset is read in fairly fast and it takes 1 hour before nearly 60% of the RAM is devoted to my lmdb page caches. Then it runs out of unmapped memory to use, so it starts kicking out the page frames of processes of other users, many of which have not been accessed in the last hour. So the system will prefer to kick out those page frames instead of page frames mapped at the beginning of the run. This behavior is entirely understandable but it causes extremely severe thrashing and unresponsive system, as those page frames of other user's comes into use very soon. Does my diagnosis of the situation seem reasonable? As many of our caffe use case is a similar sequential read of a dataset much greater than available RAM, many other caffe users besides me reports a similar issue. They all report their system becoming unresponsive, presumably due to the same thrashing. "training is freezing for multiple hours" https://github.com/BVLC/caffe/issues/1412 "Caffe memory increases with time(iterations?)" https://github.com/BVLC/caffe/issues/1377 "Random freezes" https://github.com/BVLC/caffe/issues/1807 Is there some option that I missed that can inform lmdb that for a certain read-only transaction is going to be purely sequential, so it shouldn't bother to cache the already read elements? If not, is there a plan to include such a feature? Or is there an option I can limit the maximum memory a single lmdb transaction is going to use to cache? Or is there some other possible solution to this problem? ----- I have been using a hack based on this fork https://github.com/raingo/lmdb-fork/commit/091ff5e8be35c2f2336e37c0db4c392f… to avoid this issue. However, I would love to know if there is any less hacky way to solve this problem. ----- I have seen this thread http://www.openldap.org/lists/openldap-devel/201502/msg00052.html but it looks like it is for multiple readers. ----- Any advice on this will be much appreciated!

2 1

Question about ldap_search_ext_s and memory leak
by Jean-Marc Choulet 16 Mar '15

16 Mar '15

Hello, I have a little with this very simple program : #include <iostream> #include <stdlib.h> #define LDAP_DEPRECATED 1 #include <ldap.h> using namespace std; const char* server = "ldap://ldap.xxxx.fr"; const char* cacert_file = "cacert.pem"; const char* root_dn = "cn=replicator,ou=DSA,dc=xxxx,dc=fr"; const char* root_pw = "xxxx"; const char* aliased_people_dn ="ou=AliasedPeople,dc=xxxx,dc=fr"; int main(int argc, char *argv[]) { if (argc != 3) { cerr << "Usage: " << argv[0] << " username password" << endl; return 1; } LDAP *ld; int version = LDAP_VERSION3; int rc; if ((rc = ldap_initialize(&ld, server)) != LDAP_SUCCESS) { cerr << "ldap_initialize: " << server << endl; return EXIT_FAILURE; } if ((rc = ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version)) != LDAP_OPT_SUCCESS) { cerr << "ldap_set_option error: " << ldap_err2string(rc) << endl; return EXIT_FAILURE; } if ((rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE, cacert_file)) != LDAP_OPT_SUCCESS ) { cerr << "ldap_set_option error: " << ldap_err2string(rc) << endl; return EXIT_FAILURE; } if ((rc = ldap_start_tls_s(ld, NULL, NULL)) != LDAP_SUCCESS) { cerr << "ldap_start_tls_s error: " << ldap_err2string(rc) << endl; return EXIT_FAILURE; } if ((rc = ldap_bind_s(ld, root_dn, root_pw, LDAP_AUTH_SIMPLE)) != LDAP_SUCCESS) { cerr << "ldap_bind_s: " << ldap_err2string(rc) << endl; return EXIT_FAILURE; } cout << "user replicator authenticated :)." << endl; LDAPMessage *pResult; struct berval cred; char *pDN; std::string filter("uid=" + string(argv[1])); rc = ldap_search_ext_s(ld, aliased_people_dn, LDAP_SCOPE_SUBTREE, filter.c_str(), NULL, 0, NULL, NULL, NULL, LDAP_NO_LIMIT, &pResult); if (rc != LDAP_SUCCESS) { cerr << "ldap_search_ext_s error: " << ldap_err2string(rc) << endl; ldap_unbind_s(ld); return EXIT_FAILURE; } struct berval **vals; LDAPMessage *pEntry; string user_dn; if (ldap_count_entries(ld, pResult) == 1) { pEntry = ldap_first_entry(ld, pResult); pDN = ldap_get_dn(ld, pEntry); vals = ldap_get_values_len(ld, pEntry, "aliasedObjectName"); if (vals) { user_dn = vals[0]->bv_val; ldap_value_free_len(vals); } ldap_memfree(pDN); } else { cout << "aliasedObjectName attribute not found" << endl; ldap_unbind_s(ld); return EXIT_FAILURE; } ldap_memfree(pResult); if ((rc = ldap_bind_s(ld, user_dn.c_str(), argv[2], LDAP_AUTH_SIMPLE)) != LDAP_SUCCESS) { cerr << "user " << argv[1] << " not authenticated" << endl; ldap_unbind_s(ld); return EXIT_FAILURE; } cout << "user " << argv[1] << " (" << user_dn << ") authenticated" << endl; ldap_unbind_s(ld); return EXIT_SUCCESS; } My program works fine but, if I use valgrind, I have memory leaks : valgrind --leak-check=full ./ldapauth.exe toto secret ==13616== Memcheck, a memory error detector ==13616== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al. ==13616== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright info ==13616== Command: ./ldapauth.exe toto secret ==13616== user replicator authenticated :). user toto (uid=toto,ou=People,ou=17,dc=xxxx,dc=fr) authenticated ==13616== Warning: invalid file descriptor -1 in syscall write() ==13616== ==13616== HEAP SUMMARY: ==13616== in use at exit: 260,453 bytes in 1,157 blocks ==13616== total heap usage: 13,835 allocs, 12,678 frees, 2,138,249 bytes allocated ==13616== ==13616== 149 (56 direct, 93 indirect) bytes in 1 blocks are definitely lost in loss record 65 of 84 ==13616== at 0x4C2CC70: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==13616== by 0x596E604: ber_memcalloc_x (in /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2.8.3) ==13616== by 0x4E48687: ldap_result (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4E4ACA6: ldap_pvt_search_s (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4E4AD4F: ldap_search_ext_s (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4016D4: main (ldapauth.cpp:72) ==13616== ==13616== 271 (80 direct, 191 indirect) bytes in 1 blocks are definitely lost in loss record 69 of 84 ==13616== at 0x4C2CC70: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==13616== by 0x596E604: ber_memcalloc_x (in /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2.8.3) ==13616== by 0x596D031: ber_alloc_t (in /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2.8.3) ==13616== by 0x4E5AA22: ldap_alloc_ber_with_options (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4E48BB7: ldap_result (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4E4ACA6: ldap_pvt_search_s (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4E4AD4F: ldap_search_ext_s (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4016D4: main (ldapauth.cpp:72) ==13616== ==13616== LEAK SUMMARY: ==13616== definitely lost: 136 bytes in 2 blocks ==13616== indirectly lost: 284 bytes in 3 blocks ==13616== possibly lost: 0 bytes in 0 blocks ==13616== still reachable: 260,033 bytes in 1,152 blocks ==13616== suppressed: 0 bytes in 0 blocks ==13616== Reachable blocks (those to which a pointer was found) are not shown. ==13616== To see them, rerun with: --leak-check=full --show-leak-kinds=all ==13616== ==13616== For counts of detected and suppressed errors, rerun with: -v ==13616== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0) I don't understand why. Do you have a idea ? I work on Ubuntu 14.04. The OpenLDAP version is 2.4.31. Thanks, Jean-Marc.

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical March 2015