openldap-technical September 2024

openldap-technical@openldap.org

13 participants
11 discussions

Removing AutoCA overlay, objectClass, etc
by Brendan Kearney 30 Oct '24

30 Oct '24

list members, i have a multi-provider footprint that i want to remove the AutoCA functionality from. when i loaded the overlay, i set it to disabled, per the below: dn: olcOverlay={5}autoca objectClass: olcOverlayConfig objectClass: olcAutoCAConfig objectClass: top olcOverlay: {5}autoca structuralObjectClass: olcAutoCAConfig entryUUID: 739501f2-49ad-103e-911a-3dc9b40470bf creatorsName: uid=brendan,ou=domainusers,ou=users,dc=bpk2,dc=com createTimestamp: 20240117175614Z olcAutoCADays: 3650 olcAutoCAKeybits: 2048 olcDisabled: TRUE olcAutoCAserverKeybits: 2048 olcAutoCAuserClass: inetOrgPerson olcAutoCAserverClass: device olcAutoCAserverDays: 1826 olcAutoCAuserDays: 365 olcAutoCAuserKeybits: 2048 entryCSN: 20240117192443.210024Z#000000#001#000000 modifiersName: uid=brendan,ou=domainusers,ou=users,dc=bpk2,dc=com modifyTimestamp: 20240117192443Z note, olcDisabled is set to true. it seems that something went awry and even though i didn't want the capability active, i wound up with some caCertificate and caPrivateKey objects created in the DIT. it looks like i may have added the overlay in an active state and disabled it after the caCertificate/PrivateKey objects were created. i want to clean up things and remove the AutoCA pieces until i can test them better. what process is needed to remove the objects and overlay, as replication may play a part in some of the effort? i could imagine that deleting the caCertificate and caPrivateKey objects would be relatively straight forward, but the overlay may prove a bit more complicated. i found a message on this list from some time ago, https://www.openldap.com/lists/openldap-technical/201811/msg00075.html, that says i can stop the slapd instance, remove the overlay ldif files and restart the instance, to accomplish this task. the issue that i am trying to avoid is having to take down the entire fully replicated DIT, in order to delete the overlay and not have replication recreate it because one active node "didn't get the memo". are there any insights into how i can delete overlays without having replication recreate the objects i want to remove, all while still providing at least one instance to service requests? if it clarifies things, i am running 3 slapd instances behind a load balancer and both the config DB and DIT are replicated between all nodes. if it comes to it, i could take down all instances to perform this work, but i would like to avoid it if possible. thanks in advance, brendan kearney

3 8

Re: Replication issue during performance test with MMR configuration and LastBind enabled
by Falgon 16 Oct '24

16 Oct '24

Hello, I'm working on the same project as Meheni. Thanks for your answer, we'll try version 2.6 OpenLDAP using the lastbind-precision. However we have several questions for the current version we're using. Is this a known problem and referenced somewhere? (we haven't found it) Is it normal to find no replication error logs even in stats + sync mode? We ran some tests in sequential mode (300,000 accounts one after the other) and managed to reproduce the problem. -Denis Le mer. 11 oct. 2023 à 14:11, Quanah Gibson-Mount <quanah(a)fast-mail.org> a écrit : > > > --On Tuesday, October 10, 2023 9:30 PM +0200 Ziani Meheni > <mehani06(a)gmail.com> wrote: > > > > > > > Hello, we are working on a project and we've come across a problem with > > the replication after performance testing : > > You need to use OpenLDAP 2.6 and then set the: > > lastbind-precision > > value. I use 5 minutes. > > --Quanah >

4 8

ldapsearch by aliased objectClass
by Joril 11 Oct '24

11 Oct '24

Hello, I've created an alias by following the FAQ at https://www.openldap.org/faq/data/cache/1111.html dn: uid=alias,ou=People,dc=example,dc=net objectclass: alias objectclass: extensibleObject uid: alias aliasedobjectname: uid=target,ou=Retired People,dc=example,dc=com The problem I'm facing is that this needs to be queried by an application (out of my control) that queries LDAP looking for a particular objectClass, like this: (&(objectClass=person)(uid=alias)) This query misses the alias, I guess because the alias object has just "alias" and "extensibleObject" as classes... Is this expected? Is there a way to work around this, server-side? I mean, to tell the LDAP server to look for "aliased" properties? Many thanks for your time!

3 3

Slapd process randomly hangs on consumers and comes back to life after a while with no intervention
by Pierre-Jean CROUZET 20 Sep '24

20 Sep '24

Hello, To start with, this is my very first post on a mailing list of this kind. I've read much about how to do things right, like here: https://www.openldap.org/doc/admin24/troubleshooting.html or here: https://www.openldap.org/faq/data/cache/59.html Nonetheless, please do tell me if I'm not following the standards. I'm facing an issue with my OpenLDAP servers that I struggle to fix or even find info about. To summarize: We have an architecture of 2 providers with mirror mode replication for their configuration. They are LXC's hosted in a datacenter. We have 2 consumers with mirror mode replication for their config also, and they get the DB (mdb backend) from the above providers. They are VMs hosted in a different hypervisor and datacenter than the providers. We have a loadbalancing architecture in front that sends requests evenly to the 4 servers. The writes requests directed to the consumers are forwarded to the providers using the chain overlay. The slapd process of those 2 consumers randomly hangs. When it happens, the slapd service is still running and listening, but not a single query can go through, even the logging stops. Like a complete freeze. The service comes back to life after some time (several minutes, different every time) without any manual intervention. Trying to manually restart the process during such even obviously fails, unless I kill -9, which is not something I want to do. My observations so far : - The hangs appear only during business hours (nothing during nights or week-end). - Only the consumers hang. The providers are always fine. - CPU / RAM / Disks are fine before / during the crashes. - The hangs seem random and I could not find a way to trigger them at will. - strace shows the following lines in an infinite loop during hangs. ``` [pid 1082] gettimeofday({tv_sec=1726669191, tv_usec=694473}, NULL) = 0 [pid 1082] poll([{fd=18, events=POLLIN|POLLPRI}], 1, 100) = 0 (Timeout) [pid 1082] sched_yield() ``` It seems that the process is waiting for some data that never comes. The fd=18 is referencing to a TCP socket connected to provider1. So it would suggests that the provider is not sending what the consumer wants. This has led me to several suppositions: 1. Network issues Unlikely, since only those 2 servers in the DC are experiencing misbehavior, and I can telnet / ldapsearch from the faulty consumer to the provider with no problem during hangs. 2. Syncrepl / slapo-chain misconfiguration I might have a configuration problem, but no matter how much I review it, I don't see what's wrong. I've provided the syncrepl / slapo-chain conf in the config.ldif attachment. I've also provided several other attachments that I thought would be helpful: - log.txt => The slapd logs in trace level that show the last bind before the service hangs. - ldaps_request.log => An ldapsearch performed against the faulty consumer during hang. - starttls_request.log => Same as above, but using StartTLS => the connection seems successful and stops at the server hello TLS exchange. Versions : - slapd: 2.5.18 LTS - Server: Ubuntu 22.04 LTS I am a bit out of ideas on things I could try to fix the issues. Hence this email. I thank you for your time and I am very grateful for any help you could give me. Regards, Pierre-Jean

1 0

"realdn" in auditlog
by Christopher Paul 18 Sep '24

18 Sep '24

Hi OpenLDAP-Technical, What does a comment beginning with "realdn" mean in an auditlog LDIF? I see it after the first line of COMMENT FIELD INFORMATION on some modify operations. Running version 2.5.18 on Ubuntu. At first glance, it looks like it's due to overlays (refint, ppolicy) making modifications as a result of an operation by "realdn"(?)b Many thanks for any insight on this. -- Chris Paul | Rex Consulting |https://www.rexconsulting.net ParaphraseBasicClose

2 1

Double free in ldap_set_option
by radiatejava 16 Sep '24

16 Sep '24

I am getting double free core from ldap library. We are running this version of the code (2.4.49 with 2 patches). git clone https://github.com/openldap/openldap.git -b OPENLDAP_REL_ENG_2_4_49 git cherry-pick 32e965c27134d3d83adbf471186330e361150491 git cherry-pick 5452fb154eaabc46992402a4f1bb1081bc367157 Any idea what could be going on? I am putting the stack trace below: #2 0x00007a1e506d7590 in DoLiveCoreDump (cause=0x7a1e506df7e2 "DoubleFree") at src/heap-profiler.cc:732 #3 0x00007a1e506bed31 in (anonymous namespace)::do_free_with_callback (ptr=ptr@entry=0x5af3d4216dc8, invalid_free_fn=0x7a1e506bd270 <(anonymous namespace)::InvalidFree(void*)>) at src/tcmalloc.cc:1299 #4 0x00007a1e506dd467 in (anonymous namespace)::do_free (ptr=0x5af3d4216dc8) at src/tcmalloc.cc:1376 #5 tc_free (ptr=0x5af3d4216dc8) at src/tcmalloc.cc:1761 #6 0x00007a1e3f19106b in ldap_pvt_tls_set_option (ld=ld@entry=0x0, option=option@entry=24579, arg=arg@entry=0x7a1e416e2220) at tls2.c:766 #7 0x00007a1e3f186386 in ldap_set_option (ld=0x0, option=24579, invalue=0x7a1e416e2220) at options.c:791 #8 0x00007a1e415e03fd in auth::LdapAuthenticationBroker::connectAndBindLdap(sec::LdapProvider const&) () from /mgmt/usr/lib/x86_64-linux-gnu/libauth.so

2 1

Search callbacks for refreshAndPersist sync searches
by Hawes, David 10 Sep '24

10 Sep '24

I have a custom overlay that registers a callback to rewrite attribute values for searches. I noticed that it was not working for refreshAndPersist sync searches for queued responses, and the reason for this is that there are no callbacks registered in syncprov_qtask() [1]. I'd see the initial responses come through with rewritten attributes, but later responses would not be rewritten. I had some success adding the callbacks back, but it was a bit of a minefield. Before investigating further, I was hoping to understand why the decision was made to not set callbacks in syncprov_qtask(). For now I'm operating under the assumption that this is simply not supported. So, why aren't callbacks supported for queued sync responses? I noticed that valsort doesn't handle syncrepl responses [2], and I wonder if the reason is because the results may be inconsistent, as I am experiencing. [1] https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_5/serv… [2] https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_5/serv…

2 3

certutil - nsldap + nss trustargs
by venugopal chinnakotla 04 Sep '24

04 Sep '24

Hi Team, We are migrating our source code to use openldap client libraries instead of nsldap libraries. We have the below query for the openldap team. Please share your thoughts on this feature availability in the openldap library. nsldap has the below feature while validating TLS Connections. please refer to the nss tool, and refer to the section "Options and Arguments" https://www-archive.mozilla.org/projects/security/pki/nss/tools/certutil -t trustargs Specify the trust attributes to modify in an existing certificate or to apply to a certificate when creating it or adding it to a database. There are three available trust categories for each certificate, expressed in this order: "SSL, email, object signing". In each category position use zero or more of the following attribute codes: p Valid peer P Trusted peer (implies p) c Valid CA T Trusted CA to issue client certificates (implies c) C Trusted CA to issue server certificates (SSL only) (implies c) u Certificate can be used for authentication or signing w Send warning (use with other attributes to include a warning when the certificate is used in that context) The attribute codes for the categories are separated by commas, and the entire set of attributes enclosed by quotation marks. For example: -t "TCu,Cu,Tuw" Use the -L option to see a list of the current certificates and trust attributes in a certificate database. our query: Does openldap provide trustargs support to verify TLS connection? Please share details on this. Thanks In advance. -- Thanks, *c.venugopal*

4 3

Syncrepl getting stuck on partial sync
by jose Pereira 04 Sep '24

04 Sep '24

Hello All! I have multiple setups with a Provider(2.6.4) and consumer(2.6.2) with RefreshAndPersist. From time to time I see data missing in the consumer e.g only groups are present and all users are missing, even though users were never removed from the Provider, and were present in the Consumer beforehand. On the Provider all data is present and correct. I can still see the incoming connection, from the Consumers Sync, in the Provider without errors. No errors on the Comsumer logs from syncrepl (with -256 logs). Attempted to look in debug (-1 logs), but nothing caught my eye. When this happened I attempted restart services on both the Provider and the Consumer, disabling and re-enabling the sync on the Consumer. Only clearing the Consumers database seemed to fix the issue. There maybe be sporatic failures in the network connectivity between both systems. This is the config on the Consumer olcSyncrepl: {0}rid=000 provider=ldaps://Provider:636 type=refreshAndPersist retry="30 5 300 +" searchbase="ou=subtree,dc=test,dc=net" scope=sub schemachecking=on binddn="cn=Manager,dc=test,dc=net" credentials=credentials keepalive=240:10:30 Any advice on how to troubleshoot this or fix it?

4 18

FW: [External] RE: Help Openldap objectclass schema add
by Khan, Afaque 04 Sep '24

04 Sep '24

Hi Openldap- Version 2.6.7 I am using below command to change the current running port to 2636 but I am getting below error message Error: name '_pretty_exception' is not defined dsconf -D "cn=admin..... " ldap://(hostname) config replace nsslapd-secureport=2636 Please let me know the command or steps to change the port and also please let me know where to add below local objectclass created file to add new objectclass in schema I am not able to find the slapd.conf(5) or slapd.conf(8) file to include below schema objectclass file '/usr/local/etc/openldap/schema/local.schema' Thanks Afaque khan From: Chris Paul <chris.paul(a)rexconsulting.net<mailto:chris.paul@rexconsulting.net>> Sent: Tuesday, September 3, 2024 1:10 AM Subject: [External] RE: Help Openldap objectclass schema add You don't often get email from chris.paul(a)rexconsulting.net<mailto:chris.paul@rexconsulting.net>. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification> WARNING: This message has originated from an External Source. This may be a phishing email that can result in unauthorized access to Honeywell systems. Please use proper judgment and caution when opening attachments, clicking links, scanning QR codes, or responding. Hi Afaque, You have not indicated what you have tried, given any error, your configuration, or useful information except that everyone now knows that you work for..... Have you read the OpenLDAP admin guide, and the man pages? When I post to openldap-technical(a)openldap.org<mailto:openldap-technical@openldap.org>, I never reveal my clients' identity, for their protection. Yes, obscurity is a layer of security. Good luck to you and....., -- Chris Paul | https://www.rexconsulting.net Sent: Monday, September 2, 2024 3:13 AM To: openldap-technical-request(a)openldap.org<mailto:openldap-technical-request@openldap.org>; openldap-technical(a)openldap.org<mailto:openldap-technical@openldap.org> Subject: Help Openldap objectclass schema add Hi Openldap Team, I have installed the openldap openldap-2.6.7 version on RHEL 8 but I am not able to add the new objectclass hworgperson and attribute manager and hwtype. Please let me know how I can add the new objectclass and attributes. Help -----Original Message----- From: openldap-technical-request(a)openldap.org<mailto:openldap-technical-request@openldap.org> <openldap-technical-request(a)openldap.org<mailto:openldap-technical-request@openldap.org>> Sent: Monday, September 2, 2024 3:37 PM Subject: [External] Welcome to the "openldap-technical" mailing list WARNING: This message has originated from an External Source. This may be a phishing email that can result in unauthorized access to Honeywell systems. Please use proper judgment and caution when opening attachments, clicking links, scanning QR codes, or responding. Welcome to the "openldap-technical" mailing list! To post to this list, send your message to: openldap-technical(a)openldap.org<mailto:openldap-technical@openldap.org> You can unsubscribe or make adjustments to your options via email by sending a message to: openldap-technical-request(a)openldap.org<mailto:openldap-technical-request@openldap.org> with the word 'help' in the subject or body (don't include the quotes), and you will get back a message with instructions. You will need your password to change your options, but for security purposes, this password is not included here. If you have forgotten your password you will need to reset it via the web UI.

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical September 2024