openldap-technical July 2021

openldap-technical@openldap.org

17 participants
20 discussions

Multiple memberOf overlays
by John C. Pfeifer 05 Aug '25

05 Aug '25

I am in the process of converting an existing LDAP infrastructure to OpenLDAP. I have a case where it would be convenient for two different objectClasses to map into the memberOf attribute. Is it possible to define two overlay configs or will they end up fighting each other over the memberOf attribute? For instance: dn: olcOverlay={5}memberofA,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcMemberOf olcOverlay: {5}memberofA olcMemberOfDangling: error olcMemberOfRefInt: FALSE olcMemberOfGroupOC: objectClassA olcMemberOfMemberAD: member olcMemberOfMemberOfAD: memberOf dn: olcOverlay={6}memberofB,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcMemberOf olcOverlay: {6}memberofB olcMemberOfDangling: error olcMemberOfRefInt: FALSE olcMemberOfGroupOC: objectClassB olcMemberOfMemberAD: member olcMemberOfMemberOfAD: memberOf // John Pfeifer Division of Information Technology University of Maryland, College Park

4 3

Problem with "force user to password reset at first login
by Rajagopal Rc 30 Oct '23

30 Oct '23

Hi, I am trying to force users to change their password at first login or after password reset by administrator. Tried following: 1)Password policy 'pwdMustChange TRUE' doesn't seems to be working as non of the users get prompt to change their password at first login. 2) used the 'pwdReset TRUE' attribute in users attributes, and it won't prompt to change the password and didn't allow to login i observe below messages in log "slapd[12684]: connection restricted to password changing only slapd[12684]: send_ldap_result: err=50 matched="" text="Operations are restricted to bind/unbind/abandon/StartTLS/modify password" slapd[12684]: conn=1053 op=1 SEARCH RESULT tag=101 err=50 nentries=0 text=Operations are restricted to bind/unbind/abandon/StartTLS/modify password" Please help me configure the option to force all users to change their password at first login or after pwd reset by administrator. Thanks & Regards Raj Tata Consultancy Services Mailto: rajagopal.rc(a)tcs.com Website: http://www.tcs.com ____________________________________________ Experience certainty. IT Services Business Solutions Consulting ____________________________________________ =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

5 9

Index seems to return wrong amount of candidate causing really poor search performance
by chrichardso27＠gmail.com 18 Aug '21

18 Aug '21

Hi, Considering the following assumptions; - OpenLDAP version 2.4.51 - attributes objectClass and abc are indexed based on equality - the EQUALITY of attribute abc is based on distinguishedNameMatch - The database contains roughly 2 million entries - 2 entries have defined the attribute abc with a dn value cn=foo,dc=bar and objectClass=someClass - 2 entries have defined the attribute abc with a dn value cn=bar,dc=baz and objectClass=someClass Now, the issue started with really slow search performance using objectClass=someClass & abc=cn=foo,dc=bar as filter criteria. Debugging a while seems to indicate that the objectClass filter returns roughly 2 million entries as candidates. Now, one would expect that the second filter would return only the 2 potential candidates from the abc index, or a subset of the whole database but this is not the case. The second filter also returns nearly the whole database entries as potential candidates and causes really slow query performance. Interestingly, this only occurs when attribute abc has value cn=foo,dc=bar, but for some reason for the entry having attribute abc with value cn=bar,dc=baz the query returns immediately. In both cases, the actual entries matching the search return immediately but for the problematic search "(&(objectClass=someClass)(abc=cn=foo,dc=bar))", the completion of the search takes a long time (around 15 seconds to be precise). The issue started suddenly and wasn't a degradation of query performance over time. Few things I have tried - Rebuilt the whole database again - Reindex the existing database again - Testing with bdb and mdb as backends - Increased cache sizes for bdb to hold the whole database in cache - For bdb adjust the page size of the indexes according to suggestion by db_tuner - Change the order of the filters None of these made any difference. At the moment, there does not seem to be any good options to try. Any ideas or help would be greatly appreciated!

6 18

migrate from 2.4 to 2.5, determine existing MDB format
by Michael Ströder 07 Aug '21

07 Aug '21

HI! As far as I understood the MDB disk format changed. So the MDB files have to be re-created (either by simply removing/replicating or slapcat/slapadd). Right? Now I'm wondering how to automate things (with ansible and puppet) in a truly idempotent way. Ideally I could determine whether existing MDB files were last maintained by OpenLDAP 2.4.x or whether they already have the 2.5 format. Can I find out the disk format version in any way, e.g. with python-lmdb? Ciao, Michael.

6 18

Generating a memberOf attribute for posixGroups (dynlist module)
by Eduardo Lúcio Amorim Costa 03 Aug '21

03 Aug '21

According to this post http://blog.oddbit.com/post/2013-07-22-generating-a-membero/ it is possible to use a strategy for generating a memberOf attribute for posixGroups (dynlist module). This need arose for a legacy OpenLDAP LDAP and with several applications using it. So, this seems to me the best solution to be able to use the memberOf as a filter. NOTE: Complete information about the problem here https://stackoverflow.com/questions/68583838/ldap-add-a-filter-to-an-ldap-u… ). *QUESTION:* Has anyone tested/used the procedure in the post http://blog.oddbit.com/post/2013-07-22-generating-a-membero/ ? Ie, generating a memberOf attribute for posixGroups (dynlist module)? What I have for group OU and user OU is what goes below... *GROUP* ``` cn: accessgroup gidNumber: 1004 memberUid: usera userb userc userd usere userf userg userh useri objectClass: top posixGroup ``` *USERS* ``` cn: User Letter A gecos: User Letter A gender: M gidNumber: 544 givenName: User gotoLastSystemLogin: 01.01.1970 00:00:00 homeDirectory: /home/usera loginShell: /bin/bash mail: user.letter.a(a)domain.abc.de objectClass: top person organizationalPerson inetOrgPerson gosaAccount posixAccount shadowAccount sambaSamAccount [...] uid: usera uidNumber: 1004 [...] ``` *Thanks! =D* -- *Eduardo Lúcio* Tecnologia, Desenvolvimento e Software Livre LightBase Consultoria em Software Público eduardo.lucio(a)lightbase.com.br <eduardo.lucio(a)LightBase.com.br> *+55-61-3347-1949* - http://brlight.org <eduardo.lucio(a)LightBase.com.br> - *Brasil-DF* *Software livre! Abrace essa idéia! * *"Aqueles que negam liberdade aos outros não a merecem para si mesmos."* *Abraham Lincoln*

3 5

Re: Generating a memberOf attribute for posixGroups (dynlist module)
by Eduardo Lúcio Amorim Costa 30 Jul '21

30 Jul '21

Hi people! My version is the one below... ``` [root@ldap_provider ~]# slapd -VV @(#) $OpenLDAP: slapd 2.4.44 (Apr 28 2021 13:32:00) $ mockbuild(a)x86-02.bsys.centos.org: /builddir/build/BUILD/openldap-2.4.44/openldap-2.4.44/servers/slapd ``` ...anything else you can tell us? PLUS: Is this procedure safe? Have you ever used it? []'s Em sex., 30 de jul. de 2021 às 13:37, Quanah Gibson-Mount <quanah(a)symas.com> escreveu: > > > --On Friday, July 30, 2021 2:30 PM -0300 Eduardo Lúcio Amorim Costa > <eduardolucioac(a)gmail.com> wrote: > > > > > > > According to this post > > http://blog.oddbit.com/post/2013-07-22-generating-a-membero/ it is > > possible to use a strategy for generating a memberOf attribute for > > posixGroups (dynlist module). > > > > This need arose for a legacy OpenLDAP LDAP and with several applications > > using it. > > > > So, this seems to me the best solution to be able to use the memberOf as > > a filter. > > You want OpenLDAP 2.5's version of dynlist. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > -- *Eduardo Lúcio* Tecnologia, Desenvolvimento e Software Livre LightBase Consultoria em Software Público eduardo.lucio(a)lightbase.com.br <eduardo.lucio(a)LightBase.com.br> *+55-61-3347-1949* - http://brlight.org <eduardo.lucio(a)LightBase.com.br> - *Brasil-DF* *Software livre! Abrace essa idéia! * *"Aqueles que negam liberdade aos outros não a merecem para si mesmos."* *Abraham Lincoln*

2 2

Configure openldap 2.5.6 on CentOS7 with TLS
by Scott Classen 30 Jul '21

30 Jul '21

Hello, I’m making some progress with building 2.5.6 on my CentOS 7 machine, but I am stuck getting TLS support First I installed openssl version 1.1.1 from the epel repository: sudo yum install openssl11.x86_64 sudo yum install openssl11-devel.x86_64 sudo yum install openssl11-libs.x86_64 sudo yum install openssl11-static.x86_64 Then download and configure openldap: wget https://www.openldap.org/software/download/OpenLDAP/openldap-release/openld… tar zxvf openldap-2.5.6.tgz cd openldap-2.5.6/ CPPFLAGS=-I/usr/include/openssl11 export CPPFLAGS ./configure --with-tls=openssl [snip] checking openssl/ssl.h usability... yes checking openssl/ssl.h presence... yes checking for openssl/ssl.h... yes checking for SSL_export_keying_material_early in -lssl... no configure: error: Could not locate TLS/SSL package Any idea how I might get past this? I can configure, make depend, and make if I don’t specify the "--with-tls=openssl” option, but my understanding was that TLS was essential for OpenLDAP. Thanks, Scott

3 3

Re: Much Higher Latency With Paged Results Asked
by Romain Madala 28 Jul '21

28 Jul '21

Hi, I'm trying to understand what I can do to reduce the time needed by slapd to answer one simple query even though using the paging response option. When I do my request without pr switch it takes 5 ms, but if i do use the option it's around 105ms. Question is why ? And how I can get back to 5 ms when using the option ? Thanks Le mer. 28 juil. 2021 à 21:10, Quanah Gibson-Mount <quanah(a)symas.com> a écrit : > > > --On Tuesday, July 27, 2021 8:13 PM +0200 Romain Madala > <romain.madala(a)gmail.com> wrote: > > > Please provide additional details of the issue. > > Thanks, but you didn't answer the above. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Re: Much Higher Latency With Paged Results Asked
by Romain Madala 28 Jul '21

28 Jul '21

Hi, I'm using "Ubuntu 20.04.2 LTS" slapd is : apt-cache policy slapd slapd: Installed: 2.4.49+dfsg-2ubuntu1.8 My DB backend is olcDatabase={1}mdb.ldif, If you need further details, please provide me with the commands because I'm quite a newbie. Thanks in advance, Le mar. 27 juil. 2021 à 17:00, Quanah Gibson-Mount <quanah(a)symas.com> a écrit : > > > --On Tuesday, July 27, 2021 1:50 PM +0000 romain.madala(a)gmail.com wrote: > > > Hi, > > > > Is there anyone who could help me to figure out this behaviour ? > > What release of OpenLDAP are you running? What database backend are you > using? Please provide additional details of the issue. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Re: OpenLDAP 2.5.6 available
by Michael Ströder 27 Jul '21

27 Jul '21

On 7/27/21 8:31 PM, project(a)openldap.org wrote: > OpenLDAP 2.5.6 is now available As usual you can find packages for several openSUSE/SLE versions in this OBS project: https://build.opensuse.org/project/show/home:stroeder:openldap25 Feedback welcome! Notes: - The packages are still considered experimental and not tested in production. This is not a statement about OpenLDAP 2.5.6 itself. - This is my private work not related to the OpenLDAP nor the openSUSE projects => blame me if something looks wrong with the packaging. - If unsure install openldap-ms, not openldap2. This uses a separate prefix /opt/openldap-ms. Ciao, Michael.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical July 2021