openldap-technical April 2017

openldap-technical@openldap.org

27 participants
45 discussions

Manual LDAP 2.4.44 Installation
by Alexandre Vilarinho 23 Apr '17

23 Apr '17

Hello all, Recently I've installed LDAP - version 2.4.44 Manually in a Ubuntu 16.04 TLS server. root@Linux-LDAP-SERVER:~# lsb_release -aNo LSB modules are available.Distributor ID: UbuntuDescription: Ubuntu 16.04.2 LTSRelease: 16.04Codename: xenialroot@Linux-LDAP-SERVER:~# I followed every step in the official Quick-Start Quide (http://www.openldap.org/doc/admin24/quickstart.html) But from step 9 forward it practically didn't work: 9.Import the configuration database You are now ready to import your configration database for use by slapd(8), by running the command:su root -c /usr/local/sbin/slapadd -F /usr/local/etc/cn=config -l /usr/local/etc/openldap/slapd.ldif root@Linux-LDAP-SERVER:~# /usr/local/sbin/slapadd -F /usr/local/etc/cn=config -l /usr/local/etc/openldap/slapd.ldif58fa3f94 invalid config directory /usr/local/etc/cn=config, error 2slapadd: bad configuration directory! root@Linux-LDAP-SERVER:~# 10. Start SLAPD. You are now ready to start the Standalone LDAP Daemon, slapd(8), by running the command:su root -c /usr/local/libexec/slapd -F /usr/local/etc/cn=config To check to see if the server is running and configured correctly, you can run a search against it with ldapsearch(1). By default, ldapsearch is installed as /usr/local/bin/ldapsearch:ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts Note the use of single quotes around command parameters to prevent special characters from being interpreted by the shell. This should return:dn: namingContexts: dc=example,dc=com root@Linux-LDAP-SERVER:~# /usr/local/libexec/slapd -F /usr/local/etc/cn=configroot@Linux-LDAP-SERVER:~# ldapsearch -x -b 'dc=example,dc=com' '(objectclass=*)'ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)root@Linux-LDAP-SERVER:~# What am i doing wrong? Why can't it contact the server, if the installation was ok, with no errors ou warnings... Regards

2 1

Multi Master replication with many 'nonpresent_callback' lines
by Jesper Grøndahl 23 Apr '17

23 Apr '17

Hi everyone We have a multi-master replication setup with 3 nodes (running openldap-2.4.40 on Debian Jessie). The sync of the config database and the user database is working fine. However, when we modify/delete an object on one node we get a "nonpresent_callback" line for each of our users on the two other nodes. Our log level is stats and sync. The logs look like this, for the user being modified ----- nonpresent_callback: rid=005 present UUID 528929d6-acaa-1036-922a-a3f5c9285d9d, dn uid=xxx,ou=users,dc=ruc,dc=dk Entry uid=xxx,ou=users,dc=ruc,dc=dk CSN 20170406140323.504919Z#000000#002#000000 greater than snapshot 20170403102309.253881Z#000000#002#000000 ----- ... and something like this for the rest of the users ----- nonpresent_callback: rid=005 present UUID c7cf376c-acaa-1036-8052-a3f5c9285d9d, dn uid=yyy,ou=users,dc=ruc,dc=dk ----- We only expected the log entry for the modified user and not for all the rest of the users too. Is this the way it should be because of the log level setting or is it not normal? If this is not the way it's supposed to be I'll of course supply you with our configs. Thanks in advance. Sincerely yours, Jesper

1 0

Re: Filtered proxy to Active Directory
by Howard Chu 23 Apr '17

23 Apr '17

Kamenko Pajic wrote: > We have Panasonic KX-UTG300B phones (SIP phone) which has LDAP Phonebook option. > > > > Settings on the phone to make this work are simple: > > > > LDAP Server Address: > > LDAP Server Port: > > LDAP Authentication ID: > > LDAP Authentication Password: > > LDAP Search Base: > > > > When I go to LDAP address book on the phone I get thousands of entries listing > not only users with their phone number but also all other entries like > resources, empty lines(???), N/A, Distribution lists …. Etc. in short probably > everything. Sounds like quite a stupid phone; they probably expected you to point the search base at an "ou=people" folder that doesn't contain any other types of entries. > There is no way I can set up a filter to filter users only that have phone > number set in AD. > > > > What I need is LDAP proxy server which will be queried by our phones instead > of querying AD Server directly and return filtered list (example: just entries > containing information in “telephoneNumber” attribute) > > > > Is this possible? I’ve been trying for weeks now with no success. I'm not aware of any existing modules that do what you want. But it would be a trivially small piece of overlay code to write. > Please someone, send me sample ldap.conf and slapd.conf configuration files > > > > > > Thanks > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: LMDB master branch
by Howard Chu 21 Apr '17

21 Apr '17

opensource(a)gmx-topmail.de wrote: > Hi there, > > I am on the mdb.master branch because of MDB_VL32. We updated the LMDB code in January, and before I update to the latest commit I wanted to check with you. > > Disclaimer: I am aware of being outside of the official release cycles and potential risks. On the other hand, we have a lot of unit tests, and a pretty good installation base. In that way it is also a good test for LMDB. > > Now to my questions: > 1) What are your rough plans with mdb.master in terms of time line and features? > (With the 0.9.20 release being delayed, new features may pile up in mdb.master. When will they be merged?) 0.9 is not receiving any more new features. Any features not yet released are slated for 1.0. > 2) Is mdb.master running on any systems you know of? mdb.master is a development branch only. > 3) Recent changes in mdb.master also include format changes for the locking file (e.g. commit "Store lock ID instead of pathname in lockfile"). What are the consequences when updating from an older version? The lock file is ephemeral. There is a possibility of a clash if two processes linked against different versions access the same environment at the same time, otherwise there's no issue. > 4) Are the formats for lock & data files considered stable? Nothing in mdb.master is considered stable. > Thanks, > Markus > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

LMDB master branch
by opensource＠gmx-topmail.de 19 Apr '17

19 Apr '17

Hi there, I am on the mdb.master branch because of MDB_VL32. We updated the LMDB code in January, and before I update to the latest commit I wanted to check with you. Disclaimer: I am aware of being outside of the official release cycles and potential risks. On the other hand, we have a lot of unit tests, and a pretty good installation base. In that way it is also a good test for LMDB. Now to my questions: 1) What are your rough plans with mdb.master in terms of time line and features? (With the 0.9.20 release being delayed, new features may pile up in mdb.master. When will they be merged?) 2) Is mdb.master running on any systems you know of? 3) Recent changes in mdb.master also include format changes for the locking file (e.g. commit "Store lock ID instead of pathname in lockfile"). What are the consequences when updating from an older version? 4) Are the formats for lock & data files considered stable? Thanks, Markus

1 0

Is there anything in LDAP that works similar to HTTP's virtual hosting.
by John Lewis 17 Apr '17

17 Apr '17

I am reading in the LDAP spec https://tools.ietf.org/html/rfc4511 about naming contexts and I am looking at my RootDSE. Since my DIT mirrors DNS https://tools.ietf.org/html/rfc2247, there must be some way to route someone to the correct naming context based on the DNS they were using to access the LDAP server, otherwise I just don't understand the spec.

4 10

this is really good news
by Egidio Melissano 17 Apr '17

17 Apr '17

Greetings, Have you heard the latest news already? I think you'll like it, please read it here http://www.mensworld.center/hospital.php?0002 Very truly yours, Egidio Melissano

1 0

Re: lmdb
by Howard Chu 17 Apr '17

17 Apr '17

Patrick Hawley wrote: > > > I've been puzzled by lmdb's free list use. In some experiments, I've > been seeing that it sometimes grabs pages from the end instead of > using free list pages. This means that the number of pages used > tends to grow until it uses them all. I've tried increasing the map size > (to even quite a large value), and ensuring that write transactions are > not held open long but that doesn't seem to help. Length of write transactions is irrelevant. Nothing in the LMDB documentation talks about length of write transactions; perhaps you need to reread the docs. The issue is keeping a lot of read transactions open when writes are in progress. I've tried with > subdatabases and without subdatabases. It does appear to increase > faster when overflow pages are used, but even without overflow > pages the effect occurs. I can see in the code some places where it > might choose not to use the free list, but I haven't been able to > identify a problem in the code. Wondering whether anyone else > has observed this also. The library otherwise looks quite useful > and performant. Using lmdb via python (0.92). Thanks. > > Patrick -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Slapd authenticating with krb5 localhost principal
by Jaap Winius 15 Apr '17

15 Apr '17

Hi folks, My new Debian stretch slapd consumer configuration is suffering from a Kerberos authentication problem that looks like a bug. It is apparently unable to read the Kerberos keytab file and instead authenticates to its provider as (for my realm) ldap/localhost(a)EXAMPLE.COM. The error I keep getting is: slapd[1668]: GSSAPI Error: Unspecified GSS failure. \ Minor code may provide more information \ (Server ldap/localhost(a)EXAMPLE.COM not found in Kerberos database) The software I'm using is: * Debian stretch * MIT Kerberos 1.15-1 * slapd 2.4.44+dfsg-3 * libsasl2-modules-gssapi-mit 2.1.27~101-g0780600+dfsg-3 The usual way to get slapd to use a Kerberos principal to authenticate to a provider is by telling it where the Kerberos key table file is. On Debian systems, slapd looks in a default location first (/etc/krb5.keytab), but an alternate keytab can be set in /etc/default/slapd with e.g.: export KRB5_KTNAME=/etc/ldap/krb5-ldap.keytab Just ensure that the openldap group can read the keytab file. This works on Debian wheezy with slapd 2.4.31-2+deb7u2, but for some reason it's not working at all on Debian stretch. Other things I have checked are: * /etc/hostname * hostnamectl status * /etc/hosts (contains only '127.0.0.1 localhost' and linklocal addresses) * DNS forward and reverse lookups So, is this a slapd problem, or maybe something to do with a SASL/GSSAPI library, such as libsasl2-modules-gssapi-mit? Thanks, Jaap

2 1

Re: Info Attribute
by Quanah Gibson-Mount 14 Apr '17

14 Apr '17

--On Wednesday, April 12, 2017 11:12 PM +0200 Michael Ströder <michael(a)stroeder.com> wrote: > Tom Jay wrote: >> I'm trying to add the 'info' attribute to an entry and am getting the >> following: >> >> ldap_modify: Object class violation (65) >> additional info: attribute 'info' not allowed >> [..] >> Currently, the only object class assigned to the entry is inetOrgPerson. >> >> Has anyone got any idea why this may be the case? > > In general one would use attribute 'description' for this kind of content > nowadays. In addition, I would note the comments for the "info" attribute even in the RFC say to not use it: 9.3.4. Information The Information attribute type specifies any general information pertinent to an object. It is recommended that specific usage of this attribute type is avoided, and that specific requirements are met by other (possibly additional) attribute types. Reference: <https://www.ietf.org/rfc/rfc1274.txt> --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical April 2017