openldap-technical August 2020

openldap-technical@openldap.org

39 participants
42 discussions

LDAP Tool Box packages [was: OpenLDAP 2.4.51 available, LMDB 0.9.26 available]
by Clément OUDOT 17 Aug '20

17 Aug '20

Hello, LDAP Tool Box packages for OpenLDAP 2.4.51 are released. They can be downloaded on https://ltb-project.org/download#openldap or installed with yum/apt Thanks again to OpenLDAP team for their great work! Clément.

3 3

LMDB alignment of values
by Gábor Melis 14 Aug '20

14 Aug '20

I understand that at some points keys were aligned to 2 bytes and maybe values, too: https://github.com/AltSysrq/lmdb-zero/issues/8 Maybe that's still the case. However a solution I'm looking at needs double word (16 bytes on 64 bit) alignment of values. This would allow using the value directly as a read-only Lisp object. Leaving whether that's a good idea aside, is there any way to guarantee double word alignment of values? My preliminary hacks involving varying the key size were not successful. Cheers, Gábor Melis

2 1

LMDB safety under misuse
by Gábor Melis 14 Aug '20

14 Aug '20

Hello I'm writing a Common Lisp wrapper for LMDB, starting where the previous efforts left off. I have a number of questions related to safety and the color of the smoke after a disaster. 1. lmdb.h says that "A parent transaction and its cursors may not issue any other operations than mdb_txn_commit and mdb_txn_abort while it has active child transactions." What I observe is that when a cursor associated with the parent transaction is used in the child, there are no errors and the cursor behaves (my test only involved mdb_cursor_put and MDB_SET_KEY) as if it belonged to the child. Is this to be expected in general or my tests are insufficient and something really bad can happen? If this is a disaster waiting to happen, I need to add checks to the cursor code. 2. mdb_txns are calloc()ed and free()d. In the case where a thread performs some operation (e.g. put, get, del) involving an already freed mdb_txn pointer, what kind of nastiness can happen? Can the database be corrupted? 3. Same question about mdb_cursors. 4. Async unwind safety. This is a bit like a thread being destroyed in the middle of an lmdb function call. Context: In some Common Lisp implementations (SBCL), Posix interrupts like SIGINT are used during development. If the developer presses C-c the lisp debugger will start where the signal handler was invoked, which may be in the middle of some mdb_* call. Depending on the actions taken, the stack (both the lisp and the C stack) may be unwound to some earlier frame. Another example is async timeouts (SBCL's WITH-TIMEOUT) can also unwind the stack. I understand that async unwinds are unsafe in general. There is a way to defer handling of interrupts, which I already use to protect allocations (mdb_txn_begin, mdb_txn_commit and similar), but it has a small performance cost and I hesitate to apply it to performance hotspots (e.g. put, get, del and most cursor ops). Are [some of] these functions safe in face of async unwinds? What kind of problem may arise? Cheers, Gábor Melis

3 5

Race condition with groupOfNames using syncrepl
by Jonathan Steel 13 Aug '20

13 Aug '20

Hi, When trying to sync our LDAP data to a consumer, the consumer errors with: null_callback : error code 0x13 syncrepl_entry: rid=002 be_add cn=mygroup,ou=Group,dc=domain,dc=com failed (19) I believe this is because it is a groupOfNames (list of member DNs) that do not yet exist on the consumer. If I sync with a filter to exclude the groupOfNames entries, it completes fine, which confirms it is only having an issue with groupOfNames: filter="(!(objectClass=groupOfNames))" Can you advise if this is a known issue, and if there's a way to work around it, short of importing the LDAP data manually? I wonder if there's a way to skip errors, so it will skip the groupOfNames and retry once the users have been created. Best regards, Jonathan

3 5

Acl for admin group
by Клеусов Владимир Сергеевич 13 Aug '20

13 Aug '20

Hi Sorry for the banal question I created an acl for a group whose members have full access to OpenLDAP. dn: olcDatabase={1}mdb,cn=config changetype: modify replace: olcAccess olcAccess: to attrs=userPassword by self write by group.exact="cn=ldap_admins,ou=Groups,dc=domain,dc=com" write by anonymous auth by * none olcAccess: to * by self write by group.exact="cn=ldap_admins,ou=Groups,dc=domain,dc=com write by * read But members of this group didn't get full access. Please tell me what I did wrong ?

3 10

Re: TLSv1.3 support on openldap 2.4.44
by Shaheena Kazi 12 Aug '20

12 Aug '20

My product is a security product and hence I would like to stick to 2.4.44 or a version provided by buster i.e., 2.4.47. May be 2.4.47 is a better option. What do you think? On Tue, 11 Aug 2020 at 11:57 PM, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Wednesday, August 12, 2020 12:43 AM +0530 Shaheena Kazi > <shaheena.kazi(a)gmail.com> wrote: > > > > > Hi Team, > > > > > > I wanted to know if TLSv1.3 is supported on openldap 2.4.44. > > openssl packge which I would be using is - openssl-1.1.1d.tar.bz2 to > > compile openldap. > > If you are building OpenLDAP yourself, you should use the most current > release, not one that's over four years old. > > Build OpenLDAP 2.4.50, and it has TLS 1.3 support as long as the SSL > library does. > > Regards, > Quanah > > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > -- Regards, Shaheena K

4 3

TLSv1.3 support on openldap 2.4.44
by Shaheena Kazi 11 Aug '20

11 Aug '20

Hi Team, I wanted to know if TLSv1.3 is supported on openldap 2.4.44. openssl packge which I would be using is - openssl-1.1.1d.tar.bz2 to compile openldap. Awaiting your reply. Regards, Shaheena K

2 1

Switching roles between 2 DCs
by Lothar Schilling 11 Aug '20

11 Aug '20

Dear Mr. Kania, setting up a DC with Samba 4 and OpenLDAP I am still going exactly by the rules in your book. I got to the point where I would switch, just testing, roles from DC1 to DC2 and vice versa. Switching all roles from DC1 to DC 2 was a piece of cake, reswitching "domaindns" and "forestdns" to DC1 wasn't, though: samba-tool fsmo transfer --role=domaindns -k yes Password for [MY_DOMAIN\root]: Failed to bind - LDAP client internal error: NT_STATUS_LOGON_FAILURE Failed to connect to 'ldap://1b3fd128-1bd3-40fb-bc6c-9f943cac6e9e._msdcs.MY_DOMAIN.NEW' with backend 'ldap': LDAP client internal error: NT_STATUS_LOGON_FAILURE ERROR(ldb): uncaught exception - LDAP client internal error: NT_STATUS_LOGON_FAILURE File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line 177, in _run return self.run(*args, **kwargs) File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 528, in run transfer_dns_role(self.outf, sambaopts, credopts, role, samdb) File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 104, in transfer_dns_role credentials=creds, lp=lp) File "/usr/lib/python2.7/dist-packages/samba/samdb.py", line 64, in __init__ options=options) File "/usr/lib/python2.7/dist-packages/samba/__init__.py", line 115, in __init__ self.connect(url, flags, options) File "/usr/lib/python2.7/dist-packages/samba/samdb.py", line 79, in connect options=options) Any ideas? Thank you Lothar Schilling

1 1

OpenLDAP crashes with search from PC
by a.leurs＠consense-gmbh.de 07 Aug '20

07 Aug '20

I have a functional OpenLDAP service installed and configured on a Windows Server 2016. From another Windows Server 2016 I can get a connection to the server and can search for results. But when I start the search from a Windows 10 machine the server crashes and after that can't be accessed anymore. I don't have the last parts of the log, but I can get it. I know that are not many information, but has anybody an idea how I can find out why the OpenLDAP server is crashing when accessed from a Windows 10 machine?

2 1

LASTVALIDATIONDATE | Attribute error
by Technology Server 07 Aug '20

07 Aug '20

Dear, We tried to import the data to an existing LDAP instance but gives the same error about below attribute. str2entry: str2ad(LASTVALIDATIONDATE): attribute type undefined slapadd: could not parse entry (line=1437875) can you please let me know what is (LASTVALIDATIONDATE) attribute significance ?? We don't see any such attribute . Kindly guide us .

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical August 2020