openldap-technical January 2017

openldap-technical@openldap.org

47 participants
80 discussions

organizationIdentifier ATTRIBUTE mapping
by Francesco Sordi 23 Jan '17

23 Jan '17

Hi,I am trying to define into a custom schema the organizationIdentifier attribute, as defined in the doc of ITU x.520 standards: organizationIdentifier ATTRIBUTE ::= { WITH SYNTAX UnboundedDirectoryString EQUALITY MATCHING RULE caseIgnoreMatch SUBSTRINGS MATCHING RULE caseIgnoreSubstringsMatch SINGLE VALUE TRUE LDAP-SYNTAX directoryString.&id LDAP-NAME {"organizationIdentifier"} ID id-at-organizationIdentifier }I managed to start slapd by inserting into a custom schema this: objectidentifier id-at-organizationIdentifier 2.5.4.97 attributeType ( id-at-organizationIdentifier NAME 'organizationIdentifier' DESC 'X520 attribute Organization Identifier' SUP name EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SINGLE-VALUE ) But i cannot understand which objectclass can use this attribute and how to add an object using it.

2 2

openldap slowness after restoration
by PRATIK SINGAL 23 Jan '17

23 Jan '17

Hello all, After performing restoration the openldap server is performing slow. openldap 2.4.40 with bdb. Can any one suggest me on what to check which might cause the slowness. Regards, Pratik

2 1

Re: use proprietary password hash in "userpassword"
by Howard Chu 23 Jan '17

23 Jan '17

Meike Stone wrote: > Hello dear list, > > we like to migrate an a user database from SQL to LDAP and need to > take over the user passwords. > Problem is, the passwords are hashed by an known but proprietary algorithm. > Is there a possibility, to write an small external binary, that is > used by slapd to validate these passwords? (Maybe, we import that in a > own attribute?) > After password change, we want write a ssha hash, so that we can > disable this external binary... > > Write a openldap modul like pw-sha2 is not the first choice, because > we need to compile the openldap after each update on our own and that > prevents us to use the distribution packages. Writing an OpenLDAP module like pw-sha2 is precisely the way to write a small external binary to validate passwords. There's no need to recompile all of OpenLDAP just to update a password module. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

LDAP search rule to find group owners
by Philip Colmer 20 Jan '17

20 Jan '17

We've got LDAP ACLs to restrict who can make changes to a group, like this one: to dn.sub="ou=groups,dc=example,dc=com" by dnattr="owner" write by set="this/owner/member & user" write by users none by * none so that both direct owners and people in groups that are owners can modify the group they own. This works really well but now I want to list all of the groups that a DN matches against as an owner. For direct owners, that is simple enough, but where someone is in a group and that group is an owner, it becomes trickier. Is there a way of performing an LDAP search that does the equivalent of the ACL (or something like it) to tell me which groups can be written to for a given DN? Regards Philip

3 2

Slapd.conf for doing stress
by PRATIK SINGAL 20 Jan '17

20 Jan '17

Hello , Am new to openldap and need to perform stress on openldap2.4. Can any one please provide me with some usefull link / optimized conf file for stress. we are using Berkley DB. Regards, Pratik

3 2

Re: Antw: Re: slapd-meta with olc
by Martin Stejskal 20 Jan '17

20 Jan '17

Hi Ulrich, I totally agree, but I wanted to show "quick and dirty" way. Sometimes you just need to test something, and when everything works it is time to play around ;) Hey Ryan, thanks for advice. Today I played with "osixia/openldap" docker image and at the end of the day I was able to make it work. Just for reference, I'm sending modified part of ".config" file. ====================================================== include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/openldap.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema//ppolicy.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args #ldapmod#modulepath ../servers/slapd/back-ldap/ #ldapmod#moduleload back_ldap.la #metamod#modulepath ../servers/slapd/back-meta/ #metamod#moduleload back_meta.la #monitormod#modulepath ../servers/slapd/back-monitor/ #monitormod#moduleload back_monitor.la modulepath /usr/lib/ldap/ moduleload back_meta.la moduleload rwm.la moduleload back_ldap.la ====================================================== Then just delete old slapd.d and convert .config to slapd.d directory and it is work. But still, it is not proper way through slapadd/slapmodify, which I'm looking for. Best regards Martin Stejskal ________________________________ From: Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> Sent: 19 January 2017 08:45:43 To: Martin Stejskal; openldap-technical(a)openldap.org; michael(a)stroeder.com Subject: Antw: Re: slapd-meta with olc >>> Martin Stejskal <mstejskal(a)alps.cz> schrieb am 17.01.2017 um 09:08 in Nachricht <OS2PR01MB02343BFA404E587BC43468B9B37C0(a)OS2PR01MB0234.jpnprd01.prod.outlook.com> [...] > 3) Simply remove (3A) or configure (3B) "apparmor" to avoid strange start > failure and another "permission denied" errors. Choice is up to you > (security vs convenience) > > 3A) Remove apparrmor > $ sudo apt remove apparmor > > 3B) Configure apparmor [...] I'd recommend to change the "enforce mode" for slapd to "complain mode". Then updating the apparmor profile can be done with the tools provided. Alternatively remove the profile for slapd in apparmor. I would not remove the whole package, because then no appliocation can/will be protected. Regards, Ulrich

1 1

Re: Replication issue in 2.4
by Quanah Gibson-Mount 19 Jan '17

19 Jan '17

--On Thursday, January 19, 2017 10:14 AM +0100 Dieter Klünter <dieter(a)dkluenter.de> wrote: > Am Tue, 17 Jan 2017 18:07:33 +0530 > schrieb PRATIK SINGAL <pratik.singal13(a)gmail.com>: > >> Hello , >> >> Can any one please help me with this.Am using BDB and openldap 2.4 >> with multi master replication >> below is my slapd.conf for replication >> >> syncRepl rid=000 >> provider=ldap://host1:389 >> type=refreshAndPersist >> retry="5 + 5 +" >> searchbase="dc=example,dc=com" >> attrs=* > > operational attributes should also be synchronized. Or to expand a bit, don't define the attrs= bit at all. Just go with the default. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: ContextCSN values in 3-multimaster setup
by Quanah Gibson-Mount 19 Jan '17

19 Jan '17

--On Tuesday, January 17, 2017 2:11 PM +0100 Marc Franquesa <mark(a)l3jane.net> wrote: > In the past I migrated some server, added some other node so is > possible that a 'ghost' provider CSN is still on the DB ? Yes. If you have any entries still in the DB that have an entryCSN from your old provider, it will be a valid contextCSN value. If you want that contextCSN gone, you'll need to slapcat your database and modify the LDIF accordingly before re-importing. I assume that was serverID 006, you would want to find all instances of #006# and replace them with one of #001#, #004#, or #005# (so they are consistent) and then reload all servers. Hope that helps. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

use proprietary password hash in "userpassword"
by Meike Stone 19 Jan '17

19 Jan '17

Hello dear list, we like to migrate an a user database from SQL to LDAP and need to take over the user passwords. Problem is, the passwords are hashed by an known but proprietary algorithm. Is there a possibility, to write an small external binary, that is used by slapd to validate these passwords? (Maybe, we import that in a own attribute?) After password change, we want write a ssha hash, so that we can disable this external binary... Write a openldap modul like pw-sha2 is not the first choice, because we need to compile the openldap after each update on our own and that prevents us to use the distribution packages. Thanks for help, kindly regards Meike

2 1

Replication issue in 2.4
by PRATIK SINGAL 19 Jan '17

19 Jan '17

Hello , Can any one please help me with this.Am using BDB and openldap 2.4 with multi master replication below is my slapd.conf for replication syncRepl rid=000 provider=ldap://host1:389 type=refreshAndPersist retry="5 + 5 +" searchbase="dc=example,dc=com" attrs=* interval=00:00:00:05 schemachecking=on bindmethod=simple binddn="cn=Manager,dc=example,dc=com" credentials=password when the database are empty and i try to import a ldif the replication is working fine.But after that when i add few records in one ldap its not getting replicated to another.below is the difference in contextCSN ldapsearch -x -u -h<host2> -b "dc=example,dc=com" -s base contextCSN -LLL dn: dc=example,dc=com ufn: example.com contextCSN: 20150604060008.504258Z#000000#000#000000 contextCSN: 20170117173528.506070Z#000000#001#000000 contextCSN: 20170117182158.011615Z#000000#002#000000 ldapsearch -x -u -h<host1> -b "dc=example,dc=com" -s base contextCSN -LLL dn: dc=example,dc=com ufn: example.com contextCSN: 20150604060008.504258Z#000000#000#000000 contextCSN: 20170117174748.128319Z#000000#001#000000 contextCSN: 20170117182127.009918Z#000000#002#000000 *Can any one please help me on how to make the sync speedup or any other parameter that i need to tweak.* Regards, Pratik

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical January 2017