openldap-technical August 2024

openldap-technical@openldap.org

19 participants
18 discussions

ppolicy: passing operational attribute changes from replica to provider
by Nick Urbanik 08 Aug '24

08 Aug '24

Dear Team, I love your work. in man(5) slapo-ppolicy we see: "In general, authentication attempts on a replica server only affect the copy of the operational attributes on that replica and will not affect any attributes for a user's entry on the provider." I would prefer to have the replica send the changes to the provider. Is the chain overlay the right approach for this?

2 1

Understanding LDAP vs shadow password policies
by Windl, Ulrich 08 Aug '24

08 Aug '24

Hi! I'm writing a tool that checks password policy provided by LDAP against the attributes defines in shadowAccount. For example shadowLastChange vs. pwdChangedTime. For one account I see: pwdChangedTime 20240806150232Z shadowLastChange 16000 (I have no idea where that 16000 came from, but the difference is almost 10 years if I understood it correctly) Sorry, for the ignorance, but *who* is expected to update those attributes on password change (assuming UNIX/Linux "passwd" is being used)? Could it be a permission problem when isn't updated? Also it seems to me that the "old LDAP client" is using shadowAccount attributes to display an expiration warning, while the newer sssd seems to use the LDAP password policy attributes instead. The original reason for writing the tool was users complaining that they didn't get a warning when their password was expired and grace logins were being used (and eventually the account being locked). I have a similar question: How many failed login attempts (pwdFailureTime) are being stored, and who will remove the attributes? We have a setting that at most 10 bad authentication attempts (pwdMaxFailure ) are allowed, and that the failed attempts will be deleted after two weeks (pwdFailureCountInterval). However one user has 15 authentication failures recorded, and the first one is like 10 years old. Our platform is Linux (SLES 12/15), BTW. Regards, Ulrich

1 0

Re: Maximum Replicating Consumers
by Erik de Waard 06 Aug '24

06 Aug '24

Curious what's the rationale of using syncrepl over delta-syncrepl? We have 40 consumers (5GB data (and using syncrepl) no problems, but was interested in switching.. thought it might be more efficient. On Sat, Aug 3, 2024, 05:10 Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Friday, August 2, 2024 9:15 PM +0000 thomaswilliampritchard(a)gmail.com > wrote: > > > OpenLDAP 2.4.56 (we are working to upgrade to OpenLDAP 2.5 LTS) > > Known issue with OpenLDAP 2.4 series. > > > We are configured with delta-syncrepl. > > I would recommend upgrading to the latest OpenLDAP 2.6 release and > switching to standard syncrepl. If you don't want to build OpenLDAP > yourself, the Symas packages are what I use in production. > > --Quanah >

3 3

Help debugging sync issue with accesslog
by BECOT Jérôme 06 Aug '24

06 Aug '24

Hello, We face sync issue between two servers (2.5.14) in mirrormode with accesslog. Some updates on groups are not replicated because the modification is not added to the accesslog where the modification is applied. There is no plain error when we ADD some groups (they are added to the DIT) but after enabling the 'sync' log level, we an see these errors: Aug 5 15:20:18 server1 slapd[15489]: conn=12173218 op=8040 accesslog_response: got result 0x50 adding log entry reqStart=20240805132018.000093Z,cn=accesslog We could find that it is probably due to olcAccessLogSuccess: TRUE, but the log follows with a normal result: Aug 5 15:20:18 server1 slapd[15489]: conn=12173218 op=8040 RESULT tag=105 err=0 qtime=0.000019 etime=0.034941 text= If we later update the group, a fullsync happens and the group is created on the other server. Since increasing loglevel may overwhelm the server, I didn't blindly try any other loglevels. How should I test and debug what makes the accesslog entry rejected (and thus, the object is not replicated) ? Thanks Jerome

3 3

Maximum Replicating Consumers
by thomaswilliampritchard＠gmail.com 05 Aug '24

05 Aug '24

Hi Friends, Is there a hard limit on the number of consumers that can replicate from a provider? I have a 3 provider master multi master configuration where each consumer is aware of all 3 providers and replicate with refreshAndPersist. Over time we find that the consumers stop getting updates from providers. We enabled keepalive on our replication configs and see that keepalive takes effect. After the idle timer expires keepalive seems to think the connection is still active. Is it possible the providers simply stop pushing changes to some consumers, or fail to push to some at a high number of consumers? What would be the potential failures modes of providers who are expected to push to a high number of consumers? Thanks for the considerations, Tom

2 9

Ordering index and integerOrderingMatch rule
by thierryblaise＠hotmail.com 05 Aug '24

05 Aug '24

Hi everyone, I posting again about my issue on my v2.5.18 OpenLDAP installation on RHEL8. I'm required by an editor to add a custom structural class to the LDAP schema, and especially afterwards to add an index on one interger attribute part of the new class. To that end, in openLdap, I think it means : 1) to my knowledge and following documentation (https://www.openldap.org/doc/admin25/schema.html#Attribute%20Type%20Specifi…), I need to declare an ordering matching rule in attribute definition of the schema. However, when I do that with the following olcAttributeTypes definition : olcAttributeTypes: ( 1.3.6.1.4.1.xxx.x.x.xxx NAME 'last-modified' DESC 'Object Last Modified Time' ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) and try to import the ldif containing this definition, the following error appears: modifying entry "cn={5}clients,cn=schema,cn=config" ldap_modify: Other (e.g., implementation specific) error (80) additional info: olcAttributeTypes: AttributeType inappropriate matching rule: "integerOrderingMatch" I tried with all documented OrderingMatch rules in case, but same error modulo name of OrderingMatch rule appears each time, as if syntax and rule of the attribute don't match. Note that I tested the attribute definition without the ORDERING rule, the attribute is correctly added, but search with operators "<=" and ">=" are not working. 2) add an index to y MDB database through, for example, the following ldif: dn: olcDatabase={1}mdb,cn=config add: olcDbIndex olcDbIndex: last-modified <indexKeyword> However, here, I can't find the index keyword needed for ordering in the documentation... don't know if this is even supported. Can somebody please help me on those two topics ? Regards,

3 5

ldap_simple_bind_s is failing after setting LDAP_OPT_NETWORK_TIMEOUT value
by venugopal chinnakotla 05 Aug '24

05 Aug '24

Hi Team, We are working on migration of nsldap C sdk to OpenLDAP C sdk for our application client code. We are using OpenLDAP 2.6.7. As part of this migration activity, we are replacing one of the timeout values. Without setting LDAP_OPT_NETWORK_TIMEOUT value, ldap bind is working fine and application functionality also working well with bind, search and other operations. After setting LDAP_OPT_NETWORK_TIMEOUT value, ldap_simple_bind_s is failing with return code -1 (LDAP error -1-Unknown Error). Here is the snippet. struct timeval tv = { 20, 0 }; ldap_set_option(ld, LDAP_OPT_NETWORK_TIMEOUT, (void *) &tv); lderr = ldap_simple_bind_s( ld, (char *)AdminDN, (char *)AdminPW); Here we are getting bind failure with return code as -1. But without setting LDAP_OPT_NETWORK_TIMEOUT, the bind function is working well. Could you help us to fix this issue? or let me know if I am missing anything here? -- Thanks, *c.venugopal*

1 0

ACL by anonyous auth
by pficheux＠integra.fr 05 Aug '24

05 Aug '24

Hello, I'm trying to put ACL for a group, to allow write actions. I followed this and it's workin : https://www.openldap.org/faq/data/cache/52.html Here is what I put in my ldif file: dn: olcDatabase={1}mdb,cn=config olcAccess: {0}to dn.subtree="dc=test,dc=example,dc=com" by group.exact="cn=writer,dc=test,dc=example,dc=com" write by anonymous auth But I have two questions: Why do I have to put "by anonymous auth"? Without that I have an error 49, invalid credentials. I have not put "by self write", and it's working like that. Is it important? Regards, Gab

3 9

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical August 2024