openldap-technical January 2018

openldap-technical@openldap.org

23 participants
26 discussions

Problem with "force user to password reset at first login
by Rajagopal Rc 30 Oct '23

30 Oct '23

Hi, I am trying to force users to change their password at first login or after password reset by administrator. Tried following: 1)Password policy 'pwdMustChange TRUE' doesn't seems to be working as non of the users get prompt to change their password at first login. 2) used the 'pwdReset TRUE' attribute in users attributes, and it won't prompt to change the password and didn't allow to login i observe below messages in log "slapd[12684]: connection restricted to password changing only slapd[12684]: send_ldap_result: err=50 matched="" text="Operations are restricted to bind/unbind/abandon/StartTLS/modify password" slapd[12684]: conn=1053 op=1 SEARCH RESULT tag=101 err=50 nentries=0 text=Operations are restricted to bind/unbind/abandon/StartTLS/modify password" Please help me configure the option to force all users to change their password at first login or after pwd reset by administrator. Thanks & Regards Raj Tata Consultancy Services Mailto: rajagopal.rc(a)tcs.com Website: http://www.tcs.com ____________________________________________ Experience certainty. IT Services Business Solutions Consulting ____________________________________________ =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

5 9

Re: Syncrepl and multipe values
by Quanah Gibson-Mount 24 Feb '18

24 Feb '18

--On Friday, January 06, 2017 6:50 PM +0000 Matheus Eduardo Bonifacio Morais <matheus_morais(a)sicredi.com.br> wrote: > > > > Issue 8559 opened. > > > > I'm trying to work on a patch but I'm not sure if the best solution is to > fix accesslog to avoid duplicated values or if the sample LDIF (in its > description) should result in a constraint violation. What do you think? The accesslog should never write an operation that can't be replicated. If the MOD is a valid LDAP operation (which I think it is), then it should be accepted at the frontend. The issue may be more in delta-syncrepl's handling of the write op than anything else. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 3

Re: Ldap crash with Error "Assertion 'NUMKEYS(mp) > 1' failed in mdb_page_search_root()"
by Quanah Gibson-Mount 30 Jan '18

30 Jan '18

--On Tuesday, January 30, 2018 1:15 PM -0800 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > One more question i have is, i have installed openldap-2.4.44 but i have > not installed lmdb rpm but i have configured my ldap to use mdb as > backend so now is it really using mdb or some thing else? RHEL may have compiled liblmdb in statically. That's the default configuration for OpenLDAP. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Ldap crash with Error "Assertion 'NUMKEYS(mp) > 1' failed in mdb_page_search_root()"
by Quanah Gibson-Mount 30 Jan '18

30 Jan '18

--On Tuesday, January 30, 2018 12:01 PM -0800 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > Quanah, > > > openldap-2.4.44 rpm provided by redhat repo is by defaulting > installing libdb-5.3, so do i have to build rpms with LMDB to get this > fix? It is generally advised to not use the builds provided by RedHat, including their lack of LMDB support. Other options include the LTB project (<https://ltb-project.org/download#openldap>) which include LMDB support along with BDB and require no support contract. Alternatively, the company I work for (Symas) provides builds of OpenLDAP backed by LMDB, but ones that allow for replication require a support contract. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Ldap crash with Error "Assertion 'NUMKEYS(mp) > 1' failed in mdb_page_search_root()"
by Quanah Gibson-Mount 30 Jan '18

30 Jan '18

--On Tuesday, January 30, 2018 8:53 AM -0800 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > Quanah, > > > Thank you, where can i read more about the reason for this issue and > how it got fixed jut for my understanding? Hi, You can find the details in the ITS I referenced: <http://www.openldap.org/its/index.cgi/?findid=8336> --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Ldap crash with Error "Assertion 'NUMKEYS(mp) > 1' failed in mdb_page_search_root()"
by Quanah Gibson-Mount 30 Jan '18

30 Jan '18

--On Tuesday, January 30, 2018 8:38 AM -0800 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > Hi, > > > I am using "openldap-2.4.43" with MDB as backend DB, trying to run some > load test before i deploy it in prod, while i am running add or delete > operations ldap is crashing with the following error. > > > ../../../../servers/slapd/back-mdb/../../../libraries/liblmdb/mdb.c:5276: > Assertion 'NUMKEYS(mp) > 1' failed in mdb_page_search_root() This is ITS#8336, fixed in OpenLDAP 2.4.44/LDMB 0.9.18. I suggest you upgrade to the current OpenLDAP Release (2.4.45/LMDB 0.9.21) -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Exponential increase in Free Pages
by John Holder 30 Jan '18

30 Jan '18

Hi OpenLdap list I have a question on how to interprite the Free Pages stat from mdb_copy. I may be reading this particular stat wrong. After using the compact utility from mdb_copy -c, free page count will start at zero and immediately increase to where it left off before the compact then increases by a few. I was just wondering if the free pages count is actually a free pages pointer where it left off instead of a count of total free pages. Is it possible that the sparse file needs holes dug in using fallocate -d or something else. Thank you!

1 0

Partial OpenLDAP replication
by Paulo Coimbra 29 Jan '18

29 Jan '18

Hi everybody, I need to replicate part of our OpenLDAP Directory (Main) to other openLDAP servers (Customers), like this: MAIN...................................CUSTOMER OU=People,dc=XXX ---> OU=XXX_Users,dc=XXX **OR** Customer's LDAP query at Main (if a user is not found on Customer LDAP database) without any kind of replication (I really prefer this). How can I do this? Any Sugestion? -- br, Paulo Coimbra

1 0

Re: publisher migration or upgrade
by Scott Bickford 25 Jan '18

25 Jan '18

Quaanh, I did not use -q on slapadd. Essentially I do a slapadd -f /etc/openldap/slapd.conf -b o=myco,c=us, -v -w > load_myco.log We have three databases, so there are three slapadd above with -b o=myapps,c=us -v -w > load_apps.log and a -b o=mycust,c=us -v -w > load_cust.log We have a very large custom schema and three databases, so we are still using slapd.conf instead of cn=config. The schema dates back to the 1990s. The database is "bdb" on all three schemas. The three production subscribers are load balanced and just one publisher, which is not load balanced. It is used by some java applications (which are also clustered) for updates. I am hoping that we can replace subscribers over the course of several weeks since there is quite a bit involved and have them up and running in production with the publisher still on 2.4.40 and the subscribers on 2.4.44. I am working with a VMWare person on planning how we are going to rename the servers.

2 2

Pending EPIPE fix for macOS
by Lorenz Bauer 25 Jan '18

25 Jan '18

Hello Howard, List, My bug and corresponding patch seems to have fallen through the cracks: http://www.openldap.org/its/index.cgi?findid=8590 Could you have a look and let me know whether you'd like any modifications? Best Lorenz -- Lorenz Bauer | Systems Engineer 25 Lavington St., London SE1 0NZ www.cloudflare.com

3 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical January 2018