openldap-technical April 2024

openldap-technical@openldap.org

17 participants
14 discussions

Used rewriteMap with different uri
by lsoulas 11 Apr '24

11 Apr '24

Hi, I want used slapo-rwm to redirect a rule in a different URI. Here my configuration : /database meta suffix "dc=lan" uri "ldaps://server1/dc=lan" / /rewriteEngine on rewriteContext default rewriteRule ".*" ".*" ":" rewriteMap ldap attr2dn "ldap://server2/dc=lan?dn?sub" rewriteContext bindDN rewriteRule ".*" "${attr2dn($0)}" ":@I"/ I d'ont really understand rewrite map. Can you explain me. According to the documentation, it seems to be feasible. Thanks -- *Loïc Soulas* *ILIWI* /(https://www.iliwi.fr)/ lsoulas(a)iliwi.fr +33(0)662 249 445 ILIWI - Audit et solutions réseau informatique

1 0

Help debugging slave slapd issues
by BECOT Jérôme 04 Apr '24

04 Apr '24

Hello, On all different OpenLDAP 2.4 and 2.5 slaves of 2.4 servers, we see a lot of deferring errors: slapd[37277]: connection_input: conn=32974 deferring operation: too many executing or slapd[37277]: connection_input: conn=32974 deferring operation: pending operations Can you give any hints about way to debug what causes these messages ? (which log level should I aim for and witch system settings should I check) I can provide more details then. Regards Jerome

6 9

Permissive Modify and mdb
by lesignor＠cirad.fr 02 Apr '24

02 Apr '24

Hi, I try to modify an entry with permissive modify control. The response is protocole error : permissiveModify control value not absent. I check with wireshark the request, and there was no value with the control, but the control was marked as critical. The problem appears with openldap 2.5.x and 2.6.x with mdb database. It is ok with openldap 2.4.x with bdb database. So is the permissive modify control supported with mdb database in openldap >= 2.5.x ? Thank for your help

2 2

kerberos-cache location
by Stefan Kania 02 Apr '24

02 Apr '24

I normally use Debian for OpenLDAP and Kerberos, but now I have to uses Alamalinux 9. When I create a Ticket with kinit I'm getting: --------- u1-prod@ldapserver1 ~]$ kinit Password for u1-prod(a)EXAMPLE.NET: [u1-prod@ldapserver1 ~]$ klist Ticket cache: KCM:10001 Default principal: u1-prod(a)EXAMPLE.NET --------- So the ticket cache is the KCM-daemon and not FILE: like in Debian. When I die an ldapsearch or an ldapwhoami I'm getting ----------- [u1-prod@ldapserver1 ~]$ ldapwhoami SASL/GSSAPI authentication started ldap_sasl_interactive_bind: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Miscellaneous failure (see text) (get-principal lstat(/tmp/krb5cc_10001)) ----------- All the ldap-commands are looking for the credential cache in FILE: and not in KCM: I'm using OpenLDAP 2.6 from the repositories. Is there a way that the ldap-commands are using KCM:?

3 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical April 2024