openldap-technical November 2024

openldap-technical@openldap.org

17 participants
20 discussions

olcPPolicyForwardUpdates not working
by Benjamin Renard 18 Jun '25

18 Jun '25

Hello, I have problem with the olcPPolicyForwardUpdates option that seem not working : On master and slave, I configured Ppolicy with pwdLockout. When I try to connect on master with a bad password, the pwdFailureTime attribute of the entry is successfully updated, but not if I do the same on the slave. On slave, my ppolicy configuration is exactly the same as on master but I add olcPPolicyForwardUpdates=TRUE. I also configured the chain overlay and the updateref parameter on the database. Extract of my slave configuration : olcDatabase={1}mdb,cn=config [...] olcSyncrepl: [...] olcUpdateRef: ldaps://ldap-master olcOverlay={0}chain,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcChainConfig objectClass: top olcOverlay: {0}chain olcChainReturnError: TRUE olcDatabase={0}ldap,olcOverlay={0}chain,olcDatabase={1}mdb,cn=config objectClass: olcLDAPConfig objectClass: olcChainDatabase objectClass: top olcDatabase: {0}ldap olcDbURI: ldaps://ldap-master olcDbIDAssertBind: bindmethod=simple binddn="[same user used in olcSyncrepl of the database]" credentials="secret" mode=self olcDbRebindAsUser: TRUE olcOverlay={1}ppolicy,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig objectClass: top olcOverlay: {1}ppolicy olcPPolicyHashCleartext: TRUE olcPPolicyUseLockout: TRUE olcPPolicyForwardUpdates: TRUE Do you have any idea of what I doing wrong ? Thanks, -- Benjamin Renard - Easter-eggs 44-46 rue de l'Ouest - 75014 Paris - France - Métro Gaité Phone: +33 (0) 1 43 35 00 37 - mailto:brenard@easter-eggs.com

3 20

openldap TLSv1.0 is enabled
by Andre Rodier 16 May '25

16 May '25

Hello, I have configured OpenLDAP using SSL certificate, but I have a few issues. Here the TLS configuration, especially "olcTLSProtocolMin: 3.3" > # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. > # CRC32 c70363a6 > dn: cn=config > objectClass: olcGlobal > cn: config > olcArgsFile: /var/run/slapd/slapd.args > olcLogLevel: none > olcPidFile: /var/run/slapd/slapd.pid > olcToolThreads: 1 > structuralObjectClass: olcGlobal > entryUUID: 40ee991a-0efe-103d-855a-11ff3a5638b4 > creatorsName: cn=config > createTimestamp: 20221213065102Z > olcPasswordCryptSaltFormat: $6$%.16s > olcTLSCACertificateFile: /etc/ldap/certs/ldap.homebox.world.issuer.crt > olcTLSCertificateKeyFile: /etc/ldap/certs/ldap.homebox.world.key > olcTLSCertificateFile: /etc/ldap/certs/ldap.homebox.world.crt > olcTLSProtocolMin: 3.3 > entryCSN: 20221214054517.926245Z#000000#000#000000 > modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth > modifyTimestamp: 20221214054517Z But if I try sslscan: I see TLSv1.0, TLSv1.1 and TLSv1.2 enabled. Why ? > root@main:/etc/ldap/changes# sslscan ldap.homebox.world:636 > Version: 2.0.7 > OpenSSL 1.1.1n 15 Mar 2022 > > Connected to 2001:19f0:7402:86e:5400:4ff:fe38:b9b4 > > Testing SSL server ldap.homebox.world on port 636 using SNI name ldap.homebox.world > > SSL/TLS Protocols: > SSLv2 disabled > SSLv3 disabled > TLSv1.0 enabled > TLSv1.1 enabled > TLSv1.2 enabled > TLSv1.3 enabled > > TLS Fallback SCSV: > Server supports TLS Fallback SCSV > > TLS renegotiation: > Secure session renegotiation supported > > TLS Compression: > OpenSSL version does not support compression > Rebuild with zlib1g-dev package for zlib support > > Heartbleed: > TLSv1.3 not vulnerable to heartbleed > TLSv1.2 not vulnerable to heartbleed > TLSv1.1 not vulnerable to heartbleed > TLSv1.0 not vulnerable to heartbleed > > Supported Server Cipher(s): > Preferred TLSv1.3 128 bits TLS_AES_128_GCM_SHA256 Curve 25519 DHE 253 > Accepted TLSv1.3 256 bits TLS_AES_256_GCM_SHA384 Curve 25519 DHE 253 > Accepted TLSv1.3 256 bits TLS_CHACHA20_POLY1305_SHA256 Curve 25519 DHE 253 > Accepted TLSv1.3 128 bits TLS_AES_128_CCM_SHA256 Curve 25519 DHE 253 > Preferred TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve 25519 DHE 253 > Accepted TLSv1.2 256 bits ECDHE-RSA-CHACHA20-POLY1305 Curve 25519 DHE 253 > Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256 Curve 25519 DHE 253 > Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA Curve 25519 DHE 253 > Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA Curve 25519 DHE 253 > Accepted TLSv1.2 256 bits AES256-GCM-SHA384 > Accepted TLSv1.2 256 bits AES256-CCM > Accepted TLSv1.2 128 bits AES128-GCM-SHA256 > Accepted TLSv1.2 128 bits AES128-CCM > Accepted TLSv1.2 256 bits AES256-SHA > Accepted TLSv1.2 128 bits AES128-SHA > Preferred TLSv1.1 256 bits ECDHE-RSA-AES256-SHA Curve 25519 DHE 253 > Accepted TLSv1.1 128 bits ECDHE-RSA-AES128-SHA Curve 25519 DHE 253 > Accepted TLSv1.1 256 bits AES256-SHA > Accepted TLSv1.1 128 bits AES128-SHA > Preferred TLSv1.0 256 bits ECDHE-RSA-AES256-SHA Curve 25519 DHE 253 > Accepted TLSv1.0 128 bits ECDHE-RSA-AES128-SHA Curve 25519 DHE 253 > Accepted TLSv1.0 256 bits AES256-SHA > Accepted TLSv1.0 128 bits AES128-SHA > > Server Key Exchange Group(s): > TLSv1.3 128 bits secp256r1 (NIST P-256) > TLSv1.3 192 bits secp384r1 (NIST P-384) > TLSv1.3 260 bits secp521r1 (NIST P-521) > TLSv1.3 128 bits x25519 > TLSv1.3 224 bits x448 > TLSv1.3 112 bits ffdhe2048 > TLSv1.3 128 bits ffdhe3072 > TLSv1.3 150 bits ffdhe4096 > TLSv1.3 175 bits ffdhe6144 > TLSv1.3 192 bits ffdhe8192 > TLSv1.2 128 bits secp256r1 (NIST P-256) > TLSv1.2 192 bits secp384r1 (NIST P-384) > TLSv1.2 260 bits secp521r1 (NIST P-521) > TLSv1.2 128 bits x25519 > TLSv1.2 224 bits x448 > > SSL Certificate: > Signature Algorithm: sha256WithRSAEncryption > RSA Key Strength: 2048 > > Subject: ldap.homebox.world > Altnames: DNS:ldap.homebox.world > Issuer: (STAGING) Artificial Apricot R3 > > Not valid before: Dec 13 05:34:29 2022 GMT > Not valid after: Mar 13 05:34:28 2023 GMT Thanks for your insights. Andre

6 13

Problem getting slapd-meta to work
by cyril＠stoll.info 18 Dec '24

18 Dec '24

Hi there Sorry for the long post however I aim to provide as much information as possible to help pinpoint the issue. Also sorry for any wrong wording as I am still a bit overwhelmed with OpenLDAP and struggle to understand everything I need. From my predecessor I inherited an OpenLDAP 2.4.x cluster running on RHEL 7. My job is to migrate this cluster to OpenLDAP 2.6.x on RHEL 8. The cluster consists of two provider and four consumer servers. The old cluster was based on self-compiled original OpenLDAP binaries. For the new cluster I am using the LTB version of OpenLDAP, currently with version 2.6.8. I also switched from HDB to MDB with the new cluster and am using Let's Encrypt instead of DigiCert certificates and upped the TLS version from 1.0 to 1.2. And for the default password hashing algorhythm I switched from SSHA to ARGON2. So there are lots of changes that might potentially influence the meta databases though I did not see anything that suggests this. The synchronisation of the normal databases between the provider servers and to the consumer servers is working fine. My problem is with the meta databases I try to build using slapd-meta. They are only needed on the consumer servers. Unfortunately the meta databases do not seem to be created or are not working as expected. On the old cluster I can ldapsearch in the meta databases and they show up as trees when connecting with Apache Directory Studio. On the new cluster I am setting up I don't see those meta trees in Apache Directory Studio and ldapsearches don't return any results. Furthermore slapcat on those databases returns the message "slapcat: database doesn't support necessary operations." The meta trees don't query external servers but suffixmassage locally present sub-trees. From what I've read this could also be accomplished with slapd-relay but the man page states that it is experimental. That is why I am trying the same way my predecessor did using slapd-meta. I temporarily set the loglevel to 4094 but even then did not see any hint on what goes wrong with those meta databases. By the way, when I do set the loglevel so high I can no longer connect using Apache Directory Studio, but that is not the issue I'm concerned about. Neither the documentation, nor the slapd-meta man page, nor the very few tutorials/stackexchange-posts/mailinglist-posts I found online about meta-back helped me in solving this issue. That is why I hope someone on this mailinglist can spot an issue in my configuration. Or point me to other resources/tutorials or share some debugging advice. For the purpose of sharing the configuration I omitted all the schemata and some of the ACLs. Also I removed the linebreaks so what belongs together is all on one line. Lastly I redacted any sensitive information. It is attached as a text/ldif file. Thanks a lot in advance and let me know if I need to share further information such as log entries etc. Best regards, Cyril

3 2

Replication Issue with OpenLDAP 2.6.3
by mridumit＠amdocs.com 18 Dec '24

18 Dec '24

Hi I am very new to OpenLDAP, and we have a multi master configuration with us and our replication is not working. The error we get in log file is mainly : slap_client_connect: URI=<provider url> DN="cn=<sample value>,dc=<sample value>,dc=<sample value>" ldap_sasl_bind_s failed (-1). Attaching below logs after starting slapd service , Could you please help us ? Oct 16 14:15:47 <our ldap host> slapd[853101]: @(#) $OpenLDAP: slapd 2.6.3 (Nov 15 2023 00:00:00) $#012#011openldap Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 11 (TLSProtocolMin 3.3) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 12 (TLSCertificateFile <path to crt file>) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 13 (TLSCertificateKeyFile <path to key file file>) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 14 (TLSCipherSuite ECDHE-RSA-AES256-SHA) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 17 (disallow bind_anon) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 19 (require bind) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 21 (security simple_bind=128) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 23 (serverID 001) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 23: SID=0x001 Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 25 (moduleload syncprov) Oct 16 14:15:47 <our ldap host> slapd[853101]: loaded module syncprov Oct 16 14:15:47 <our ldap host> slapd[853101]: module syncprov: null module registered Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 28 (database config) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 29 (rootdn cn=admin,cn=config) Oct 16 14:15:47 <our ldap host> slapd[853101]: >>> dnPrettyNormal: <cn=admin,cn=config> Oct 16 14:15:47 <our ldap host> slapd[853101]: <<< dnPrettyNormal: <cn=admin,cn=config>, <cn=admin,cn=config> Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 30 (rootpw ***) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 33 (database monitor) Oct 16 14:15:47 <our ldap host> slapd[853101]: >>> dnPrettyNormal: <cn=Monitor> Oct 16 14:15:47 <our ldap host> slapd[853101]: <<< dnPrettyNormal: <cn=Monitor>, <cn=monitor> Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 36 (database mdb) Oct 16 14:15:47 <our ldap host> slapd[853101]: mdb_db_init: Initializing mdb database Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 37 (suffix dc=<sample value>,dc=com) Oct 16 14:15:47 <our ldap host> slapd[853101]: >>> dnPrettyNormal: <dc=<sample value>,dc=com> Oct 16 14:15:47 <our ldap host> slapd[853101]: <<< dnPrettyNormal: <dc=<sample value>,dc=com>, <dc=<sample value>,dc=com> Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 38 (rootdn cn=Manager,dc=<sample value>,dc=com) Oct 16 14:15:47 <our ldap host> slapd[853101]: >>> dnPrettyNormal: <cn=Manager,dc=<sample value>,dc=com> Oct 16 14:15:47 <our ldap host> slapd[853101]: <<< dnPrettyNormal: <cn=Manager,dc=<sample value>,dc=com>, <cn=manager,dc=<sample value>,dc=com> Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 39 (rootpw ***) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 40 (directory /home/ldap) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 49 (syncrepl ***) Oct 16 14:15:47 <our ldap host> slapd[853101]: >>> dnNormalize: <cn=<sample value>,dc=<sample value>,dc=com> Oct 16 14:15:47 <our ldap host> slapd[853101]: <<< dnNormalize: <cn=<sample value>,dc=<sample value>,dc=com> Oct 16 14:15:47 <our ldap host> slapd[853101]: >>> dnNormalize: <dc=<sample value>,dc=com> Oct 16 14:15:47 <our ldap host> slapd[853101]: <<< dnNormalize: <dc=<sample value>,dc=com> Oct 16 14:15:47 <our ldap host> slapd[853101]: str2filter "(objectclass=*)" Oct 16 14:15:47 <our ldap host> slapd[853101]: begin get_filter Oct 16 14:15:47 <our ldap host> slapd[853101]: PRESENT Oct 16 14:15:47 <our ldap host> slapd[853101]: end get_filter 0 Oct 16 14:15:47 <our ldap host> slapd[853101]: Config: ** successfully added syncrepl rid=001 "<provider url>" Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 51 (mirrormode TRUE) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 52 (multiprovider on) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 55 (index entryCSN eq) Oct 16 14:15:47 <our ldap host> slapd[853101]: index entryCSN 0x0004 Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 56 (index entryUUID eq ) Oct 16 14:15:47 <our ldap host> slapd[853101]: index entryUUID 0x0004 Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 58 (index objectClass eq) Oct 16 14:15:47 <our ldap host> slapd[853101]: index objectClass 0x0004 Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 59 (index ps eq) Oct 16 14:15:47 <our ldap host> slapd[853101]: index ps 0x0004 Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 60 (index <sample value>-safe-id eq) Oct 16 14:15:47 <our ldap host> slapd[853101]: index <sample value>--id 0x0004 Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 61 (checkpoint 128 15) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 64 (overlay syncprov) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 66 (syncprov-checkpoint 100 10) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 72 (limits dn.exact=cn=<sample value>,dc=<sample value>,dc=com size=unlimited time=unlimited) Oct 16 14:15:47 <our ldap host> slapd[853101]: >>> dnNormalize: <cn=<sample value>,dc=<sample value>,dc=com> Oct 16 14:15:47 <our ldap host> slapd[853101]: <<< dnNormalize: <cn=<sample value>,dc=<sample value>,dc=com> Oct 16 14:15:47 <our ldap host> slapd[853101]: >>> dnNormalize: <cn=Subschema> Oct 16 14:15:47 <our ldap host> slapd[853101]: <<< dnNormalize: <cn=subschema> Oct 16 14:15:47 <our ldap host> slapd[853103]: slapd startup: initiated. Oct 16 14:15:47 <our ldap host> slapd[853103]: backend_startup_one: starting "cn=config" Oct 16 14:15:47 <our ldap host> slapd[853103]: config_back_db_open Oct 16 14:15:47 <our ldap host> slapd[853103]: config_back_db_open: line 0: warning: cannot assess the validity of the ACL scope within backend naming context Oct 16 14:15:47 <our ldap host> slapd[853103]: config_back_db_open: No explicit ACL for back-config configured. Using hardcoded default Oct 16 14:15:47 <our ldap host> slapd[853103]: config_build_entry: "cn=config" Oct 16 14:15:47 <our ldap host> slapd[853103]: slap_get_csn: conn=-1 op=0 generated new csn=20241016084547.895827Z#000000#001#000000 manage=0 Oct 16 14:15:47 <our ldap host> slapd[853103]: config_build_entry: "cn=module{0}" Oct 16 14:15:47 <our ldap host> slapd[853103]: slap_get_csn: conn=-1 op=0 generated new csn=20241016084547.896054Z#000000#001#000000 manage=0 Oct 16 14:15:47 <our ldap host> slapd[853103]: config_build_entry: "cn=schema" Oct 16 14:15:47 <our ldap host> slapd[853103]: slap_get_csn: conn=-1 op=0 generated new csn=20241016084547.897011Z#000000#001#000000 manage=0 Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn={0}core> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn={0}core> Oct 16 14:15:47 <our ldap host> slapd[853103]: config_build_entry: "cn={0}core" Oct 16 14:15:47 <our ldap host> slapd[853103]: slap_get_csn: conn=-1 op=0 generated new csn=20241016084547.899435Z#000000#001#000000 manage=0 Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn={1}> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn={1}> Oct 16 14:15:47 <our ldap host> slapd[853103]: config_build_entry: "cn={1}" Oct 16 14:15:47 <our ldap host> slapd[853103]: slap_get_csn: conn=-1 op=0 generated new csn=20241016084547.903375Z#000000#001#000000 manage=0 Oct 16 14:15:47 <our ldap host> slapd[853103]: config_build_entry: "olcDatabase={-1}frontend" Oct 16 14:15:47 <our ldap host> slapd[853103]: slap_get_csn: conn=-1 op=0 generated new csn=20241016084547.903549Z#000000#001#000000 manage=0 Oct 16 14:15:47 <our ldap host> slapd[853103]: config_build_entry: "olcDatabase={0}config" Oct 16 14:15:47 <our ldap host> slapd[853103]: slap_get_csn: conn=-1 op=0 generated new csn=20241016084547.903679Z#000000#001#000000 manage=0 Oct 16 14:15:47 <our ldap host> slapd[853103]: config_build_entry: "olcDatabase={1}monitor" Oct 16 14:15:47 <our ldap host> slapd[853103]: slap_get_csn: conn=-1 op=0 generated new csn=20241016084547.903828Z#000000#001#000000 manage=0 Oct 16 14:15:47 <our ldap host> slapd[853103]: config_build_entry: "olcDatabase={2}mdb" Oct 16 14:15:47 <our ldap host> slapd[853103]: slap_get_csn: conn=-1 op=0 generated new csn=20241016084547.904066Z#000000#001#000000 manage=0 Oct 16 14:15:47 <our ldap host> slapd[853103]: config_build_entry: "olcOverlay={0}syncprov" Oct 16 14:15:47 <our ldap host> slapd[853103]: slap_get_csn: conn=-1 op=0 generated new csn=20241016084547.904212Z#000000#001#000000 manage=0 Oct 16 14:15:47 <our ldap host> slapd[853103]: backend_startup_one: starting "cn=Monitor" Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=Backends> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=Backends> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Backends> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=backends> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=Connections> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=Connections> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Connections> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=connections> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=Databases> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=Databases> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Databases> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=databases> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=Listeners> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=Listeners> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Listeners> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=listeners> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=Log> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=Log> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Log> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=log> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=Operations> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=Operations> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Operations> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=operations> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=Overlays> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=Overlays> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Overlays> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=overlays> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=SASL> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=SASL> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=SASL> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=sasl> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=Statistics> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=Statistics> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Statistics> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=statistics> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=Threads> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=Threads> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Threads> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=threads> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=Time> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=Time> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Time> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=time> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=TLS> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=TLS> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=TLS> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=tls> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=Waiters> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=Waiters> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Waiters> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=waiters> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Backend 0> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=backend 0> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Database 0,cn=Databases,cn=Monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=database 0,cn=databases,cn=monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Backend 1> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=backend 1> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Backend 2> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=backend 2> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Database 1,cn=Databases,cn=Monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=database 1,cn=databases,cn=monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Backend 3> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=backend 3> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Backend 4> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=backend 4> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Max File Descriptors> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=max file descriptors> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Total> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=total> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Current> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=current> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Frontend> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=frontend> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Database 0> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=database 0> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Backend 0,cn=Backends,cn=Monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=backend 0,cn=backends,cn=monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Database 1> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=database 1> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Backend 2,cn=Backends,cn=Monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=backend 2,cn=backends,cn=monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Database 2> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=database 2> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Overlay 1,cn=Overlays,cn=Monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=overlay 1,cn=overlays,cn=monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Backend 3,cn=Backends,cn=Monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=backend 3,cn=backends,cn=monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Overlay 0> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=overlay 0> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Overlay 1,cn=Overlays,cn=Monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=overlay 1,cn=overlays,cn=monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Listener 0> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=listener 0> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Listener 1> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=listener 1> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Listener 2> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=listener 2> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Listener 3> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=listener 3> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Listener 4> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=listener 4> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Bind> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=bind> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Unbind> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=unbind> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Search> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=search> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Compare> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=compare> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Modify> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=modify> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Modrdn> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=modrdn> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Add> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=add> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Delete> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=delete> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Abandon> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=abandon> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Extended> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=extended> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Overlay 0> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=overlay 0> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Overlay 1> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=overlay 1> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Database 2,cn=Databases,cn=Monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=database 2,cn=databases,cn=monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Overlay 2> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=overlay 2> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Bytes> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=bytes> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=PDU> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=pdu> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Entries> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=entries> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Referrals> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=referrals> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Max> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=max> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Max Pending> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=max pending> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Open> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=open> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Starting> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=starting> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Active> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=active> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Pending> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=pending> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Backload> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=backload> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=State> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=state> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Runqueue> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=runqueue> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Tasklist> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=tasklist> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Start> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=start> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Current> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=current> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Uptime> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=uptime> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Read> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=read> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Write> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=write> Oct 16 14:15:47 <our ldap host> slapd[853103]: backend_startup_one: starting "dc=<sample value>,dc=com" Oct 16 14:15:47 <our ldap host> slapd[853103]: mdb_db_open: "dc=<sample value>,dc=com" Oct 16 14:15:47 <our ldap host> slapd[853103]: mdb_db_open: database "dc=<sample value>,dc=com": dbenv_open(/home/ldap). Oct 16 14:15:47 <our ldap host> slapd[853103]: syncprov_db_open: starting syncprov for suffix dc=<sample value>,dc=com Oct 16 14:15:47 <our ldap host> slapd[853103]: => mdb_entry_get: ndn: "dc=<sample value>,dc=com" Oct 16 14:15:47 <our ldap host> slapd[853103]: => mdb_entry_get: oc: "(null)", at: "contextCSN" Oct 16 14:15:47 <our ldap host> slapd[853103]: mdb_dn2entry("dc=<sample value>,dc=com") Oct 16 14:15:47 <our ldap host> slapd[853103]: => mdb_dn2id("dc=<sample value>,dc=com") Oct 16 14:15:47 <our ldap host> slapd[853103]: <= mdb_dn2id: got id=0x1 Oct 16 14:15:47 <our ldap host> slapd[853103]: => mdb_entry_decode: Oct 16 14:15:47 <our ldap host> slapd[853103]: <= mdb_entry_decode Oct 16 14:15:47 <our ldap host> slapd[853103]: => mdb_entry_get: found entry: "dc=<sample value>,dc=com" Oct 16 14:15:47 <our ldap host> slapd[853103]: mdb_entry_get: rc=0 Oct 16 14:15:47 <our ldap host> slapd[853103]: slapd starting Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: added 4r listener=(nil) Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: added 7r listener=0x5612300dd830 Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: added 8r listener=0x5612300dd920 Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: added 9r listener=0x5612300ddad0 Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: added 10r listener=0x5612300ddbc0 Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: added 11r listener=0x5612300ddd10 Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=7 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=10 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=11 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: activity on 1 descriptor Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: activity on: Oct 16 14:15:47 <our ldap host> slapd[853103]: Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=7 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=10 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=11 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Consumer 001> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=consumer 001> Oct 16 14:15:47 <our ldap host> slapd[853103]: =>do_syncrepl rid=001 Oct 16 14:15:47 <our ldap host> slapd[853103]: slap_client_connect: URI=<provider url> DN="cn=<sample value>,dc=<sample value>,dc=com" ldap_sasl_bind_s failed (-1) Oct 16 14:15:47 <our ldap host> slapd[853103]: do_syncrepl: rid=001 rc -1 retrying (4 retries left) Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: activity on 1 descriptor Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: activity on: Oct 16 14:15:47 <our ldap host> slapd[853103]: Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=7 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=10 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=11 active_threads=0 tvp=zero Oct 16 14:15:52 <our ldap host> slapd[853103]: daemon: epoll: listen=7 active_threads=0 tvp=zero Oct 16 14:15:52 <our ldap host> slapd[853103]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 16 14:15:52 <our ldap host> slapd[853103]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 16 14:15:52 <our ldap host> slapd[853103]: daemon: epoll: listen=10 active_threads=0 tvp=zero Oct 16 14:15:52 <our ldap host> slapd[853103]: daemon: epoll: listen=11 active_threads=0 tvp=zero Oct 16 14:15:52 <our ldap host> slapd[853103]: =>do_syncrepl rid=001 Oct 16 14:15:52 <our ldap host> slapd[853103]: slap_client_connect: URI=<provider url> DN="cn=<sample value>,dc=<sample value>,dc=com" ldap_sasl_bind_s failed (-1) Oct 16 14:15:52 <our ldap host> slapd[853103]: do_syncrepl: rid=001 rc -1 retrying (3 retries left) Oct 16 14:15:52 <our ldap host> slapd[853103]: daemon: activity on 1 descriptor Oct 16 14:15:52 <our ldap host> slapd[853103]: daemon: activity on: Oct 16 14:15:52 <our ldap host> slapd[853103]: Oct 16 14:15:52 <our ldap host> slapd[853103]: daemon: epoll: listen=7 active_threads=0 tvp=zero Oct 16 14:15:52 <our ldap host> slapd[853103]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 16 14:15:52 <our ldap host> slapd[853103]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 16 14:15:52 <our ldap host> slapd[853103]: daemon: epoll: listen=10 active_threads=0 tvp=zero Oct 16 14:15:52 <our ldap host> slapd[853103]: daemon: epoll: listen=11 active_threads=0 tvp=zero Oct 16 14:15:57 <our ldap host> slapd[853103]: daemon: epoll: listen=7 active_threads=0 tvp=zero Oct 16 14:15:57 <our ldap host> slapd[853103]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 16 14:15:57 <our ldap host> slapd[853103]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 16 14:15:57 <our ldap host> slapd[853103]: daemon: epoll: listen=10 active_threads=0 tvp=zero Oct 16 14:15:57 <our ldap host> slapd[853103]: daemon: epoll: listen=11 active_threads=0 tvp=zero Oct 16 14:15:57 <our ldap host> slapd[853103]: =>do_syncrepl rid=001 Oct 16 14:15:57 <our ldap host> slapd[853103]: slap_client_connect: URI=<provider url> DN="cn=<sample value>,dc=<sample value>,dc=com" ldap_sasl_bind_s failed (-1) Oct 16 14:15:57 <our ldap host> slapd[853103]: do_syncrepl: rid=001 rc -1 retrying (2 retries left) Oct 16 14:15:57 <our ldap host> slapd[853103]: daemon: activity on 1 descriptor

4 9

PP/expiry issues with Ubuntu22 and RH6
by Felix Natter 07 Dec '24

07 Dec '24

Dear openldap experts, the company I work for recently migrated to Ubuntu 22.04, and we use openldap with password policies and password expiry (once per year), with no changes to OpenLDAP config. However, we also use a scientific linux 6 (SL6, ~RH6) compile machine for backwards compatibility purposes (also using OpenLDAP). Now what happens is: - user ldaptestuser1's password expires - she/he changes her/his password on Ubuntu (problem 1: no PP checking, maybe due to cache_credentials = yes in /etc/sssd/sssd.conf) - SL6 (host X) does not know about that (problem 2: pwd checking on SL6 _always_ yields a Constraint violation, so user ldaptestuser1 cannot login there): ldaptestuser1@X's password: You are required to change your password immediately (password aged) You are required to change your LDAP password immediately. Last login: DATE from Y WARNING: Your password has expired. You must change your password now and login again! Changing password for user ldaptestuser1. Enter login(LDAP) password: New password: Retype new password: LDAP password information update failed: Constraint violation Password fails quality checking policy passwd: Authentication token manipulation error Connection to X closed. I cannot see any relevant error in the server (sys)log (with stats logging). Which log level shall I enable? - is there a workaround / fix for problem 1? - Regarding problem 2: shall I disable password expiry (shadow extension)? Many Thanks and Best Regards! -- Felix Natter

2 2

Meaning of "slapd[2606]: ppolicy_bind: Setting warning for password expiry for ... = ... seconds"
by Windl, Ulrich 04 Dec '24

04 Dec '24

Hi! Me again after 10 years with basically the same question (https://www.openldap.org/lists/openldap-technical/201411/msg00044.html): What is the meaning of messages like these (note the number of messages created): Nov 19 11:53:47 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1040879 seconds Nov 19 11:53:50 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1040876 seconds Nov 19 11:53:52 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1040874 seconds Nov 19 11:53:54 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1040872 seconds Nov 19 11:53:57 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1040869 seconds Nov 19 11:53:59 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1040867 seconds Nov 19 11:57:41 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1040645 seconds Nov 19 11:57:44 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1040642 seconds Nov 19 11:58:01 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1040625 seconds ... Nov 19 13:18:35 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1035791 seconds Nov 19 13:18:39 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1035787 seconds Nov 19 13:18:41 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1035785 seconds Nov 19 13:18:44 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1035782 seconds Nov 19 13:18:46 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1035780 seconds Nov 19 13:18:48 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1035778 seconds Nov 19 13:18:51 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1035775 seconds Nov 19 13:18:54 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1035772 seconds Nov 19 13:18:56 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1035770 seconds Nov 19 13:18:59 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1035767 seconds Nov 19 13:19:02 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1035764 seconds So the server logs such an entry every few seconds. I might guess that the user tried to authenticate every few seconds (for whatever reason). But what I wonder most: The LDAP server does not seed to "set" the password expiration; it just has to check the value. And for the latter I see no need to log it in syslog. It seems the number is the number of seconds until the password actually expired. So is that a (historic) bug? And yes, I'm still running a historic 2.4 version of OpenLDAP, so no need to tell me that it's quite old. (Despite of that we really intend to upgrade, but the more persons involved, the loger it takes...) Kind regards, Ulrich

2 2

autoca Attribute olcAutoCAserverClass
by Stefan Kania 29 Nov '24

29 Nov '24

Hello, I try to add the autoca overlay with the following ldif: -------------- dn: olcOverlay=autoca,olcDatabase={2}mdb,cn=config objectClass: olcAutoCAConfig objectClass: olcOverlayConfig olcOverlay: autoca olcAutoCADays: 3652 olcAutoCAKeybits: 4096 olcAutoCAserverClass: ipHost olcAutoCAserverDays: 1826 olcAutoCAserverKeybits: 4096 olcAutoCAuserClass: person olcAutoCAuserDays: 365 olcAutoCAuserKeybits: 4096 -------------- ldapadd gives me: adding new entry "olcOverlay=autoca,olcDatabase={2}mdb,cn=config" ldap_add: Other (e.g., implementation specific) error (80) additional info: <olcAutoCAserverClass> handler exited with 1 If I remove the attribute from my ldif, it works. What is wrong with the olcAutoCAserverClass attribute in my ldif? I try to look it up in the admin handbook but I could not find anything. I looked in the source code and found: ------------ { "serverClass", "objectclass", 2, 2, 0, ARG_STRING|ARG_MAGIC|ACA_SRVCLASS, autoca_cf, "( OLcfgOvAt:22.2 NAME 'olcAutoCAserverClass' " "DESC 'ObjectClass of server entries' " "EQUALITY caseIgnoreMatch " "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL }, ------------ For me it looks the same as the attribute olcAutoCAuserclass. ------------- { "userClass", "objectclass", 2, 2, 0, ARG_STRING|ARG_MAGIC|ACA_USRCLASS, autoca_cf, "( OLcfgOvAt:22.1 NAME 'olcAutoCAuserClass' " "DESC 'ObjectClass of user entries' " "EQUALITY caseIgnoreMatch " "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL }, ------------- Stefan

2 2

mdb_tassert(txn, rc == 0) fails in mdb_page_dirty()
by Christian Wendt 29 Nov '24

29 Nov '24

Hi, I have a system that fails to write to its lmdb based database. There is an assertion triggered from within mdb_txn_commit() inside mdb_page_dirty(). Further investigation shows that there is a duplicate page in a freelist entry: ~# mdb_stat -narrfff /home/skov/data/data.mdb Reader Table Status (no active readers) 0 stale readers cleared. (no active readers) Freelist Status Tree depth: 1 Branch pages: 0 Leaf pages: 1 Overflow pages: 0 Entries: 28 Transaction 128121111, 3 pages, maxspan 1 1281 1300 1468 Transaction 128121112, 6 pages, maxspan 1 [bad sequence] 229 229 569 1317 1444 1460 Transaction 128121113, 5 pages, maxspan 1 ... What could trigger such a duplicate entry and what could I try to do to figure out the root cause of the issue? Is there a recommended way of detecting or handling such errors at runtime? Thanks a lot for any pointers. Best regards, Christian Wendt

2 3

Client IP address in accesslog ?
by Benjamin Renard 21 Nov '24

21 Nov '24

Hi, I would like to know if there is a way to get the client's IP address in the events recorded by accesslog (at least during BINDs). I found traces of requests for this dating back to 2010, but I haven't been able to determine if it was ever implemented. Thanks! -- Benjamin Renard - Easter-eggs 44-46 rue de l'Ouest - 75014 Paris - France - Métro Gaité Phone: +33 (0) 1 43 35 00 37 - mailto:brenard@easter-eggs.com

6 9

Technical account impersonation or not
by BECOT Jérôme 20 Nov '24

20 Nov '24

Hello all, We currently use two distinct accounts for chaining and replication purpose. We want to use a passwordless policy and we go for certificates. As we only own a single certificate per slave server, this means that we authenticate as a single user. We see two way to do things: * Either we just use one account (bound by olcAuthzRegexp rule) and merge ACLs to allow this account to read the directory for sync and write authentication attributes for chaining * Or we keep two accounts and use Proxy Auth to impersonate the other one I personnaly would go for the first one as I don't see any value to use another mechanism given that these are technical accounts that have only one purpose each, except having a distinct login in the logs. What would you advice ? I may have miss something intersting, any security issue, or maybe there is another way. Thank you ! Jerome

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical November 2024